Deep endpoint audit fixes

.claude/settings.local.json

···
       "Bash(npm run:*)",
       "Bash(npm audit:*)",
       "Bash(npm install)",
-      "Bash(curl:*)"
+      "Bash(curl:*)",
+      "Bash(npx tsc:*)"
     ],
     "deny": [],
     "ask": []

client/src/components/metrics-cards.tsx

···
         <CardContent className="p-6">
           <div className="flex items-center justify-between mb-4">
             <h3 className="text-sm font-medium text-muted-foreground">
-              Active Users
+              Total Users
             </h3>
             <div className="w-10 h-10 bg-warning/10 rounded-lg flex items-center justify-center">
               <Users className="h-5 w-5 text-warning" />
···
             >
               {activeUsers.toLocaleString()}
             </p>
-            <p className="text-xs text-muted-foreground">24h active</p>
+            <p className="text-xs text-muted-foreground">In database</p>
           </div>
         </CardContent>
       </Card>

server/routes.ts

···
     }
   });
 
-  // AT Protocol server metadata endpoint (required for service discovery)
+  // AT Protocol server metadata endpoint
+  // NOTE: This endpoint is for PDS (Personal Data Server), not AppView
   app.get('/xrpc/com.atproto.server.describeServer', async (_req, res) => {
     try {
-      const appviewDid = process.env.APPVIEW_DID;
-
-      // In production, APPVIEW_DID is required - fail fast if missing
-      if (process.env.NODE_ENV === 'production' && !appviewDid) {
-        return res.status(500).json({
-          error: 'APPVIEW_DID environment variable is required in production',
-        });
-      }
-
-      // Return standard AT Protocol response - no custom fields allowed
-      res.json({
-        did: appviewDid,
-        availableUserDomains: [],
-        inviteCodeRequired: false,
-        phoneVerificationRequired: false,
+      res.status(501).json({
+        error: 'NotImplemented',
+        message: 'This endpoint is for Personal Data Servers (PDS), not AppView. ' +
+                 'Per ATProto specification, describeServer describes account creation requirements and capabilities. ' +
+                 'AppView aggregates public data but does not manage user accounts or provide account creation services. ' +
+                 'Please query your PDS for server description and account creation policies.',
       });
     } catch {
       res.status(500).json({ error: 'Failed to describe server' });

server/services/search.ts

···
 
 class SearchService {
   /**
-   * Search for posts using full-text search
+   * Search for posts using full-text search with PostgreSQL
    * @param query - Search query string
-   * @param limit - Maximum number of results (default 25)
-   * @param cursor - Pagination cursor (rank threshold)
+   * @param options - Search options including filters and pagination
    * @param userDid - Optional user DID for personalized filtering
    */
   async searchPosts(
     query: string,
-    limit = 25,
-    cursor?: string,
+    options: {
+      limit?: number;
+      cursor?: string;
+      sort?: 'top' | 'latest';
+      since?: string;
+      until?: string;
+      mentions?: string;
+      author?: string;
+      lang?: string;
+      domain?: string;
+      url?: string;
+      tag?: string[];
+    },
     userDid?: string
   ): Promise<{ posts: PostSearchResult[]; cursor?: string }> {
     const trimmedQuery = query.trim();
+    const {
+      limit = 25,
+      cursor,
+      sort = 'top',
+      since,
+      until,
+      mentions,
+      author,
+      lang,
+      domain,
+      url,
+      tag,
+    } = options;
 
     if (!trimmedQuery) {
       return { posts: [] };
     }
 
-    // Use plainto_tsquery which safely handles Unicode, punctuation, and special characters
-    const sqlQuery = cursor
-      ? `SELECT uri, cid, author_did as "authorDid", text, embed, parent_uri as "parentUri", root_uri as "rootUri", created_at as "createdAt", indexed_at as "indexedAt", ts_rank(search_vector, plainto_tsquery('english', $1)) as rank FROM posts WHERE search_vector @@ plainto_tsquery('english', $1) AND ts_rank(search_vector, plainto_tsquery('english', $1)) < $2 ORDER BY rank DESC LIMIT $3`
-      : `SELECT uri, cid, author_did as "authorDid", text, embed, parent_uri as "parentUri", root_uri as "rootUri", created_at as "createdAt", indexed_at as "indexedAt", ts_rank(search_vector, plainto_tsquery('english', $1)) as rank FROM posts WHERE search_vector @@ plainto_tsquery('english', $1) ORDER BY rank DESC LIMIT $2`;
+    // Build WHERE conditions
+    const conditions: string[] = [
+      `search_vector @@ plainto_tsquery('english', $1)`,
+    ];
+    const params: any[] = [trimmedQuery];
+    let paramIndex = 2;
+
+    // Time range filters
+    if (since) {
+      conditions.push(`created_at >= $${paramIndex}`);
+      params.push(new Date(since));
+      paramIndex++;
+    }
+    if (until) {
+      conditions.push(`created_at <= $${paramIndex}`);
+      params.push(new Date(until));
+      paramIndex++;
+    }
+
+    // Author filter
+    if (author) {
+      conditions.push(`author_did = $${paramIndex}`);
+      params.push(author);
+      paramIndex++;
+    }
+
+    // Mentions filter - check if text contains the DID or handle
+    if (mentions) {
+      conditions.push(`(text ILIKE $${paramIndex} OR embed::text ILIKE $${paramIndex})`);
+      params.push(`%${mentions}%`);
+      paramIndex++;
+    }
+
+    // Language filter (stored in langs column)
+    if (lang) {
+      conditions.push(`langs @> ARRAY[$${paramIndex}]::varchar[]`);
+      params.push(lang);
+      paramIndex++;
+    }
+
+    // Domain filter - check if embed contains domain
+    if (domain) {
+      conditions.push(`embed::text ILIKE $${paramIndex}`);
+      params.push(`%${domain}%`);
+      paramIndex++;
+    }
+
+    // URL filter - check if embed contains URL
+    if (url) {
+      conditions.push(`embed::text ILIKE $${paramIndex}`);
+      params.push(`%${url}%`);
+      paramIndex++;
+    }
+
+    // Tag filter - check if tags column contains any of the specified tags
+    if (tag && tag.length > 0) {
+      conditions.push(`tags && ARRAY[${tag.map((_, i) => `$${paramIndex + i}`).join(', ')}]::varchar[]`);
+      params.push(...tag);
+      paramIndex += tag.length;
+    }
+
+    // Determine sort and cursor handling
+    let orderBy: string;
+    let cursorCondition: string | null = null;
 
-    const params = cursor
-      ? [trimmedQuery, parseFloat(cursor), limit + 1]
-      : [trimmedQuery, limit + 1];
+    if (sort === 'latest') {
+      orderBy = 'ORDER BY created_at DESC';
+      if (cursor) {
+        cursorCondition = `created_at < $${paramIndex}`;
+        params.push(new Date(cursor));
+        paramIndex++;
+      }
+    } else {
+      // Default: sort by relevance (top)
+      orderBy = `ORDER BY ts_rank(search_vector, plainto_tsquery('english', $1)) DESC`;
+      if (cursor) {
+        cursorCondition = `ts_rank(search_vector, plainto_tsquery('english', $1)) < $${paramIndex}`;
+        params.push(parseFloat(cursor));
+        paramIndex++;
+      }
+    }
+
+    if (cursorCondition) {
+      conditions.push(cursorCondition);
+    }
+
+    // Build and execute query
+    const sqlQuery = `
+      SELECT
+        uri,
+        cid,
+        author_did as "authorDid",
+        text,
+        embed,
+        parent_uri as "parentUri",
+        root_uri as "rootUri",
+        created_at as "createdAt",
+        indexed_at as "indexedAt",
+        ${sort === 'top' ? `ts_rank(search_vector, plainto_tsquery('english', $1)) as rank` : `EXTRACT(EPOCH FROM created_at) as rank`}
+      FROM posts
+      WHERE ${conditions.join(' AND ')}
+      ${orderBy}
+      LIMIT $${paramIndex}
+    `;
+    params.push(limit + 1);
+
     const queryResult = await pool.query(sqlQuery, params);
     const results = {
       rows: queryResult.rows as (PostSearchResult & { rank: number })[],
···
     const postsToReturn = filteredResults.slice(0, limit);
     const nextCursor =
       hasMore && postsToReturn.length > 0
-        ? postsToReturn[postsToReturn.length - 1].rank.toString()
+        ? sort === 'latest'
+          ? postsToReturn[postsToReturn.length - 1].createdAt.toISOString()
+          : postsToReturn[postsToReturn.length - 1].rank.toString()
         : undefined;
 
     return {

server/services/xrpc-api.ts

···
   token: z.string(),
 });
 
-// Actor preferences schemas - proper validation like Bluesky
-const putActorPreferencesSchema = z.object({
-  preferences: z
-    .array(
-      z
-        .object({
-          $type: z.string().min(1, 'Preference must have a $type'),
-          // Allow any additional properties for flexibility
-        })
-        .passthrough()
-    )
-    .default([]),
-});
-
 const getActorStarterPacksSchema = z.object({
   actor: z.string(),
   limit: z.coerce.number().min(1).max(100).default(50),
···
 const unspeccedNoParamsSchema = z.object({});
 
 export class XRPCApi {
-  // Preferences cache: DID -> { preferences: any[], timestamp: number }
-  private preferencesCache = new Map<
-    string,
-    { preferences: any[]; timestamp: number }
-  >();
-  private readonly PREFERENCES_CACHE_TTL = 5 * 60 * 1000; // 5 minutes
-
   // Handle resolution cache: handle -> { did: string, timestamp: number }
   private handleResolutionCache = new Map<
     string,
···
   constructor() {
     // Clear expired cache entries every minute
     setInterval(() => {
-      this.cleanExpiredPreferencesCache();
       this.cleanExpiredHandleResolutionCache();
     }, 60 * 1000);
   }
···
   }
 
   /**
-   * Check if preferences cache entry is expired
-   */
-  private isPreferencesCacheExpired(cached: {
-    preferences: any[];
-    timestamp: number;
-  }): boolean {
-    return Date.now() - cached.timestamp > this.PREFERENCES_CACHE_TTL;
-  }
-
-  /**
-   * Clean expired entries from preferences cache
-   */
-  private cleanExpiredPreferencesCache(): void {
-    const now = Date.now();
-    const expiredDids: string[] = [];
-
-    this.preferencesCache.forEach((cached, did) => {
-      if (now - cached.timestamp > this.PREFERENCES_CACHE_TTL) {
-        expiredDids.push(did);
-      }
-    });
-
-    expiredDids.forEach((did) => {
-      this.preferencesCache.delete(did);
-    });
-  }
-
-  /**
    * Check if handle resolution cache entry is expired
    */
   private isHandleResolutionCacheExpired(cached: {
···
       }
     }
     return null;
-  }
-
-  /**
-   * Invalidate preferences cache for a specific user
-   */
-  public invalidatePreferencesCache(userDid: string): void {
-    this.preferencesCache.delete(userDid);
-    console.log(`[PREFERENCES] Cache invalidated for ${userDid}`);
   }
 
   private async getUserPdsEndpoint(userDid: string): Promise<string | null> {
···
     return profiles;
   }
 
-  async getPreferences(req: Request, res: Response) {
-    try {
-      // Get authenticated user DID using OAuth token verification
-      const userDid = await this.requireAuthDid(req, res);
-      if (!userDid) return;
-
-      // Check cache first
-      const cached = this.preferencesCache.get(userDid);
-      if (cached && !this.isPreferencesCacheExpired(cached)) {
-        console.log(`[PREFERENCES] Cache hit for ${userDid}`);
-        return res.json({ preferences: cached.preferences });
-      }
-
-      // Cache miss - fetch from user's PDS
-      console.log(`[PREFERENCES] Cache miss for ${userDid}, fetching from PDS`);
-
-      try {
-        // Get user's PDS endpoint from DID document
-        const pdsEndpoint = await this.getUserPdsEndpoint(userDid);
-        if (!pdsEndpoint) {
-          console.log(
-            `[PREFERENCES] No PDS endpoint found for ${userDid}, returning empty preferences`
-          );
-          return res.json({ preferences: [] });
-        }
-
-        // Forward request to user's PDS
-        const pdsResponse = await fetch(
-          `${pdsEndpoint}/xrpc/app.bsky.actor.getPreferences`,
-          {
-            headers: {
-              Authorization: req.headers.authorization || '',
-              'Content-Type': 'application/json',
-            },
-          }
-        );
-
-        if (pdsResponse.ok) {
-          const pdsData = await pdsResponse.json();
-
-          // Cache the response
-          this.preferencesCache.set(userDid, {
-            preferences: pdsData.preferences || [],
-            timestamp: Date.now(),
-          });
-
-          console.log(
-            `[PREFERENCES] Retrieved ${pdsData.preferences?.length || 0} preferences from PDS for ${userDid}`
-          );
-          return res.json({ preferences: pdsData.preferences || [] });
-        } else {
-          console.warn(
-            `[PREFERENCES] PDS request failed for ${userDid}:`,
-            pdsResponse.status
-          );
-          return res.json({ preferences: [] });
-        }
-      } catch (pdsError) {
-        console.error(
-          `[PREFERENCES] Error fetching from PDS for ${userDid}:`,
-          pdsError
-        );
-        return res.json({ preferences: [] });
-      }
-    } catch (error) {
-      this._handleError(res, error, 'getPreferences');
-    }
-  }
-
-  async putPreferences(req: Request, res: Response) {
-    try {
-      // Get authenticated user DID using OAuth token verification
-      const userDid = await this.requireAuthDid(req, res);
-      if (!userDid) return;
-
-      // Parse the preferences from request body
-      const body = putActorPreferencesSchema.parse(req.body);
-
-      try {
-        // Get user's PDS endpoint from DID document
-        const pdsEndpoint = await this.getUserPdsEndpoint(userDid);
-        if (!pdsEndpoint) {
-          return res.status(400).json({
-            error: 'InvalidRequest',
-            message: 'No PDS endpoint found for user',
-          });
-        }
-
-        // Forward request to user's PDS (let PDS handle validation)
-        const pdsResponse = await fetch(
-          `${pdsEndpoint}/xrpc/app.bsky.actor.putPreferences`,
-          {
-            method: 'POST',
-            headers: {
-              Authorization: req.headers.authorization || '',
-              'Content-Type': 'application/json',
-            },
-            body: JSON.stringify(body),
-          }
-        );
-
-        if (pdsResponse.ok) {
-          // Invalidate cache after successful update
-          this.invalidatePreferencesCache(userDid);
-
-          console.log(
-            `[PREFERENCES] Updated preferences via PDS for ${userDid}`
-          );
-
-          // Return success response (no body, like Bluesky)
-          return res.status(200).end();
-        } else {
-          const errorText = await pdsResponse.text();
-          console.error(
-            `[PREFERENCES] PDS request failed for ${userDid}:`,
-            pdsResponse.status,
-            errorText
-          );
-          return res.status(pdsResponse.status).send(errorText);
-        }
-      } catch (pdsError) {
-        console.error(
-          `[PREFERENCES] Error updating preferences via PDS for ${userDid}:`,
-          pdsError
-        );
-        return res.status(500).json({
-          error: 'InternalServerError',
-          message: 'Failed to update preferences',
-        });
-      }
-    } catch (error) {
-      this._handleError(res, error, 'putPreferences');
-    }
-  }
 
   async getFollows(req: Request, res: Response) {
     try {

server/services/xrpc/schemas/actor-schemas.ts

···
   });
 
 export const suggestedUsersUnspeccedSchema = z.object({
-  limit: z.coerce.number().min(1).max(100).default(25),
-  cursor: z.string().optional(),
+  category: z.string().optional(),
+  limit: z.coerce.number().min(1).max(50).default(25),
 });

server/services/xrpc/schemas/feed-generator-schemas.ts

···
 export const describeFeedGeneratorSchema = z.object({
   // No required params
 });
+
+export const getSuggestedFeedsUnspeccedSchema = z.object({
+  limit: z.coerce.number().min(1).max(25).default(10),
+});

server/services/xrpc/schemas/index.ts

···
 // Notification Schemas
 export {
   listNotificationsSchema,
+  getUnreadCountSchema,
   updateSeenSchema,
   registerPushSchema,
   unregisterPushSchema,
   getNotificationPreferencesSchema,
   putNotificationPreferencesSchema,
   putNotificationPreferencesV2Schema,
+  getNotificationPreferencesV2Schema,
   listActivitySubscriptionsSchema,
   putActivitySubscriptionSchema,
 } from './notification-schemas';
···
   getSuggestedFeedsSchema,
   getPopularFeedGeneratorsSchema,
   describeFeedGeneratorSchema,
+  getSuggestedFeedsUnspeccedSchema,
 } from './feed-generator-schemas';
 
 // Starter Pack Schemas
···
   getActorStarterPacksSchema,
   getStarterPacksWithMembershipSchema,
   searchStarterPacksSchema,
+  getOnboardingSuggestedStarterPacksSchema,
 } from './starter-pack-schemas';
 
 // Search Schemas
···
   getJobStatusSchema,
   sendInteractionsSchema,
   unspeccedNoParamsSchema,
+  getTrendsSchema,
 } from './utility-schemas';

server/services/xrpc/schemas/list-schemas.ts

···
  */
 
 export const getListSchema = z.object({
-  list: z.string(),
+  list: z.string().regex(/^at:\/\//, 'Must be a valid AT-URI'),
   limit: z.coerce.number().min(1).max(100).default(50),
   cursor: z.string().optional(),
 });
···
   actor: z.string(),
   limit: z.coerce.number().min(1).max(100).default(50),
   cursor: z.string().optional(),
+  purposes: z.array(z.string()).optional(), // Filter by list purpose (modlist, curatelist, etc.)
 });
 
 export const getListFeedSchema = z.object({
-  list: z.string(),
+  list: z.string().regex(/^at:\/\//, 'Must be a valid AT-URI'),
   limit: z.coerce.number().min(1).max(100).default(50),
   cursor: z.string().optional(),
 });
···
   actor: z.string(),
   limit: z.coerce.number().min(1).max(100).default(50),
   cursor: z.string().optional(),
+  purposes: z.array(z.string()).optional(), // Filter by list purpose (modlist, curatelist, etc.)
 });
 
 export const getListMutesSchema = z.object({

server/services/xrpc/schemas/moderation-schemas.ts

···
 });
 
 export const muteThreadSchema = z.object({
-  root: z.string(), // URI of the thread root post
+  root: z.string().regex(/^at:\/\//, 'Must be a valid AT-URI'), // URI of the thread root post
 });
 
 export const queryLabelsSchema = z.object({

server/services/xrpc/schemas/notification-schemas.ts

···
   seenAt: z.string().optional(),
 });
 
+export const getUnreadCountSchema = z.object({
+  seenAt: z.string().datetime().optional(), // ISO datetime - only count notifications after this time
+});
+
 export const updateSeenSchema = z.object({
-  seenAt: z.string(),
+  seenAt: z.string().datetime(), // ISO datetime when user last viewed notifications
 });
 
 export const registerPushSchema = z.object({
-  serviceDid: z.string(),
-  token: z.string(),
+  serviceDid: z.string(), // The DID of the service (AppView) handling push
+  token: z.string(), // Device token (FCM/APNs) or subscription endpoint (web)
   platform: z.enum(['ios', 'android', 'web']),
   appId: z.string().optional(),
+  // Web push specific fields
+  endpoint: z.string().url().optional(), // Web push subscription endpoint
+  keys: z.object({
+    p256dh: z.string(),
+    auth: z.string(),
+  }).optional(), // Web push encryption keys
 });
 
 export const unregisterPushSchema = z.object({
-  token: z.string(),
+  serviceDid: z.string(), // The DID of the service (AppView) handling push
+  token: z.string(), // Device token to unregister
+  platform: z.enum(['ios', 'android', 'web']),
+  appId: z.string(), // Application identifier
 });
 
 export const getNotificationPreferencesSchema = z.object({});
···
   priority: z.boolean().optional(),
 });
 
+// ATProto notification preference types
+const preferenceSchema = z.object({
+  list: z.boolean(),
+  push: z.boolean(),
+});
+
+const filterablePreferenceSchema = z.object({
+  list: z.boolean(),
+  push: z.boolean(),
+  include: z.enum(['all', 'follows']),
+});
+
+const chatPreferenceSchema = z.object({
+  include: z.enum(['all', 'accepted']),
+  push: z.boolean(),
+});
+
 export const putNotificationPreferencesV2Schema = z.object({
-  priority: z.boolean().optional(),
+  chat: chatPreferenceSchema.optional(),
+  follow: filterablePreferenceSchema.optional(),
+  like: filterablePreferenceSchema.optional(),
+  mention: filterablePreferenceSchema.optional(),
+  reply: filterablePreferenceSchema.optional(),
+  repost: filterablePreferenceSchema.optional(),
+  quote: filterablePreferenceSchema.optional(),
+  likeViaRepost: filterablePreferenceSchema.optional(),
+  repostViaRepost: filterablePreferenceSchema.optional(),
+  starterpackJoined: preferenceSchema.optional(),
+  subscribedPost: preferenceSchema.optional(),
+  unverified: preferenceSchema.optional(),
+  verified: preferenceSchema.optional(),
 });
 
-export const listActivitySubscriptionsSchema = z.object({});
+export const getNotificationPreferencesV2Schema = z.object({});
+
+export const listActivitySubscriptionsSchema = z.object({
+  limit: z.coerce.number().min(1).max(100).default(50),
+  cursor: z.string().optional(),
+});
 
 export const putActivitySubscriptionSchema = z.object({
-  subject: z.string().optional(),
-  notifications: z.boolean().optional(),
+  subject: z.string(), // DID of the account to subscribe to
+  activitySubscription: z.object({
+    post: z.boolean(), // Notify on posts
+    reply: z.boolean(), // Notify on replies
+  }),
 });

server/services/xrpc/schemas/search-schemas.ts

···
   q: z.string().min(1),
   limit: z.coerce.number().min(1).max(100).default(25),
   cursor: z.string().optional(),
+  sort: z.enum(['top', 'latest']).default('top').optional(),
+  since: z.string().datetime().optional(), // ISO datetime string
+  until: z.string().datetime().optional(), // ISO datetime string
+  mentions: z.string().optional(), // DID of mentioned user
+  author: z.string().optional(), // DID of author
+  lang: z.string().optional(), // Language code (e.g., "en", "ja")
+  domain: z.string().optional(), // Domain for link embed filtering
+  url: z.string().url().optional(), // URL for link embed filtering
+  tag: z
+    .union([z.string(), z.array(z.string())])
+    .transform((val) => (typeof val === 'string' ? [val] : val))
+    .optional(), // Tag(s) to filter by
 });

server/services/xrpc/schemas/starter-pack-schemas.ts

···
 });
 
 export const getStarterPacksWithMembershipSchema = z.object({
-  actor: z.string().optional(),
+  actor: z.string(), // Required - the account to check for membership
   limit: z.coerce.number().min(1).max(100).default(50),
   cursor: z.string().optional(),
 });
···
   limit: z.coerce.number().min(1).max(100).default(25),
   cursor: z.string().optional(),
 });
+
+export const getOnboardingSuggestedStarterPacksSchema = z.object({
+  limit: z.coerce.number().min(1).max(25).default(10),
+});

server/services/xrpc/schemas/timeline-schemas.ts

···
     .transform((val) => (Array.isArray(val) ? val : [val]))
     .pipe(
       z
-        .array(z.string())
+        .array(z.string().regex(/^at:\/\//, 'Must be a valid AT-URI'))
         .min(1, 'uris parameter cannot be empty')
         .max(25, 'Maximum 25 uris allowed')
     ),
 });
 
 export const getLikesSchema = z.object({
-  uri: z.string(),
+  uri: z.string().regex(/^at:\/\//, 'Must be a valid AT-URI'),
   cid: z.string().optional(),
   limit: z.coerce.number().min(1).max(100).default(50),
   cursor: z.string().optional(),
 });
 
 export const getRepostedBySchema = z.object({
-  uri: z.string(),
+  uri: z.string().regex(/^at:\/\//, 'Must be a valid AT-URI'),
   cid: z.string().optional(),
   limit: z.coerce.number().min(1).max(100).default(50),
   cursor: z.string().optional(),
 });
 
 export const getQuotesSchema = z.object({
-  uri: z.string(),
+  uri: z.string().regex(/^at:\/\//, 'Must be a valid AT-URI'),
   cid: z.string().optional(),
-  limit: z.coerce.number().min(1).max(50).default(50),
+  limit: z.coerce.number().min(1).max(100).default(50),
   cursor: z.string().optional(),
 });
 
···
 
 // V2 Thread schemas (unspecced but compatible)
 export const getPostThreadV2Schema = z.object({
-  anchor: z.string(),
-  depth: z.coerce.number().min(0).max(50).default(6),
-  prioritizeFollowedUsers: z.coerce.boolean().optional(),
-  sort: z.string().optional(),
-  branchStartDepth: z.coerce.number().optional(),
-  branchEndDepth: z.coerce.number().optional(),
+  anchor: z.string().regex(/^at:\/\//, 'Must be a valid AT-URI'),
+  above: z.coerce.boolean().default(true),
+  below: z.coerce.number().min(0).max(20).default(6),
+  branchingFactor: z.coerce.number().min(0).max(100).default(10),
+  prioritizeFollowedUsers: z.coerce.boolean().default(false),
+  sort: z.enum(['newest', 'oldest', 'top']).default('oldest'),
 });
 
 export const getPostThreadOtherV2Schema = z.object({
-  anchor: z.string(),
-  depth: z.coerce.number().min(0).max(50).default(3),
+  anchor: z.string().regex(/^at:\/\//, 'Must be a valid AT-URI'),
+  prioritizeFollowedUsers: z.coerce.boolean().default(false),
 });

server/services/xrpc/schemas/utility-schemas.ts

···
   interactions: z
     .array(
       z.object({
-        $type: z.string().optional(),
-        subject: z.any().optional(),
-        event: z.string().optional(),
-        createdAt: z.string().optional(),
+        item: z.string().regex(/^at:\/\//, 'Must be a valid AT-URI').optional(),
+        event: z
+          .enum([
+            'requestLess',
+            'requestMore',
+            'clickthroughItem',
+            'clickthroughAuthor',
+            'clickthroughReposter',
+            'clickthroughEmbed',
+            'interactionSeen',
+            'interactionLike',
+            'interactionRepost',
+            'interactionReply',
+            'interactionQuote',
+            'interactionShare',
+          ])
+          .optional(),
+        feedContext: z.string().max(2000).optional(),
+        reqId: z.string().max(100).optional(),
       })
     )
-    .default([]),
+    .min(1, 'interactions array cannot be empty'),
 });
 
 export const unspeccedNoParamsSchema = z.object({});
+
+export const getTrendsSchema = z.object({
+  limit: z.coerce.number().min(1).max(25).default(10),
+});

server/services/xrpc/services/actor-service.ts

···
     const userDid = await requireAuthDid(req, res);
     if (!userDid) return;
 
-    const users = await storage.getSuggestedUsers(userDid, params.limit);
+    // Get suggested users with pagination support
+    const { users, cursor } = await storage.getSuggestedUsers(
+      userDid,
+      params.limit,
+      params.cursor
+    );
+
+    // Convert users to DIDs for profile hydration
+    const userDids = users.map((u) => u.did);
+
+    // Use the full _getProfiles helper to build complete profileView objects
+    const actors = await (xrpcApi as any)._getProfiles(userDids, req);
+
+    // Build response with optional cursor and recId
+    const response: {
+      actors: any[];
+      cursor?: string;
+      recId?: number;
+    } = {
+      actors,
+    };
+
+    if (cursor) {
+      response.cursor = cursor;
+    }
+
+    // Generate recId for recommendation tracking (snowflake-like ID)
+    // Using timestamp + random component for uniqueness
+    response.recId = Date.now() * 1000 + Math.floor(Math.random() * 1000);
 
-    res.json({
-      actors: users.map((user) => ({
-        did: user.did,
-        handle: user.handle,
-        displayName: user.displayName || user.handle,
-        ...(user.description && { description: user.description }),
-        ...maybeAvatar(user.avatarUrl, user.did, req),
-      })),
-    });
+    res.json(response);
   } catch (error) {
     handleError(res, error, 'getSuggestions');
   }
···
       params.limit
     );
 
+    // Check if we have suggestions (not fallback)
+    if (suggestions.length === 0) {
+      return res.json({
+        suggestions: [],
+        isFallback: true,
+      });
+    }
+
+    // Build full profileView objects using _getProfiles helper
+    const suggestionDids = suggestions.map((u) => u.did);
+    const profiles = await (xrpcApi as any)._getProfiles(suggestionDids, req);
+
+    // Generate recId for recommendation tracking (snowflake-like ID)
+    // Using timestamp + random component for uniqueness
+    const recId = Date.now() * 1000 + Math.floor(Math.random() * 1000);
+
     res.json({
-      suggestions: suggestions.map((user) => ({
-        did: user.did,
-        handle: user.handle,
-        displayName: user.displayName || user.handle,
-        ...(user.description && { description: user.description }),
-        ...maybeAvatar(user.avatarUrl, user.did, req),
-      })),
+      suggestions: profiles,
+      isFallback: false,
+      recId,
     });
   } catch (error) {
     handleError(res, error, 'getSuggestedFollowsByActor');
···
 
 /**
  * Get suggested users (unspecced)
- * GET /xrpc/app.bsky.unspecced.getSuggestedUsersUnspecced
+ * GET /xrpc/app.bsky.unspecced.getSuggestedUsers
+ *
+ * IMPORTANT: This endpoint is experimental and marked as "unspecced" in the ATProto specification.
+ * Returns a list of suggested users with complete profileView objects.
  */
 export async function getSuggestedUsersUnspecced(
   req: Request,
···
     const userDid = await requireAuthDid(req, res);
     if (!userDid) return;
 
-    const users = await storage.getSuggestedUsers(userDid, params.limit);
+    // TODO: Implement category-based filtering when params.category is provided
+    // For now, category parameter is accepted but not used
+    const { users } = await storage.getSuggestedUsers(userDid, params.limit);
 
-    res.json({
-      users: users.map((u) => ({
-        did: u.did,
-        handle: u.handle,
-        displayName: u.displayName,
-        ...maybeAvatar(u.avatarUrl, u.did, req),
-      })),
-    });
+    // Convert users to DIDs for profile hydration
+    const userDids = users.map((u) => u.did);
+
+    // Use the full _getProfiles helper to build complete profileView objects
+    const actors = await (xrpcApi as any)._getProfiles(userDids, req);
+
+    res.json({ actors });
   } catch (error) {
     handleError(res, error, 'getSuggestedUsersUnspecced');
   }

server/services/xrpc/services/bookmark-service.ts

···
 /**
  * Bookmark Service
- * Handles bookmark creation, deletion, and retrieval
+ *
+ * NOTE: Bookmark endpoints are not part of the official ATProto specification.
+ * Per ATProto architecture, if/when bookmarks are officially implemented, they will be:
+ * - Stored as private records on the PDS (in a "personal" namespace)
+ * - Not broadcast to the public firehose
+ * - Not accessible to AppView services
+ * - Similar to mutes and preferences (private user data)
+ *
+ * AppView aggregates public data and should not store or serve private user bookmarks.
+ * These endpoints return 501 to maintain proper architectural boundaries.
  */
 
 import type { Request, Response } from 'express';
-import { storage } from '../../../storage';
-import { requireAuthDid, getAuthenticatedDid } from '../utils/auth-helpers';
+import { requireAuthDid } from '../utils/auth-helpers';
 import { handleError } from '../utils/error-handler';
-import { serializePostsEnhanced } from '../utils/serializers';
-import type { PostModel, PostView } from '../types';
-
-/**
- * Serialize posts with optional enhanced hydration
- * Uses environment flag to determine which serialization method to use
- */
-async function serializePosts(
-  posts: PostModel[],
-  viewerDid?: string,
-  req?: Request
-): Promise<PostView[]> {
-  const useEnhancedHydration =
-    process.env.ENHANCED_HYDRATION_ENABLED === 'true';
-
-  if (useEnhancedHydration) {
-    return serializePostsEnhanced(posts, viewerDid, req) as Promise<PostView[]>;
-  }
-
-  // For now, we'll use enhanced serialization as the default
-  // The legacy serialization is complex and will be extracted later
-  return serializePostsEnhanced(posts, viewerDid, req) as Promise<PostView[]>;
-}
+import { getUserPdsEndpoint } from '../utils/pds-helpers';
 
 /**
  * Create a new bookmark
  * POST /xrpc/app.bsky.bookmark.create
+ *
+ * NOTE: Not part of official ATProto specification. Bookmarks are private user data
+ * that should be stored on the PDS, not on AppView. This is similar to mutes and
+ * preferences - private metadata that belongs on the user's Personal Data Server.
  */
 export async function createBookmark(
   req: Request,
···
     const userDid = await requireAuthDid(req, res);
     if (!userDid) return;
 
-    const body = req.body as {
-      subject?: { uri?: string; cid?: string };
-      postUri?: string;
-      postCid?: string;
-    };
-    const postUri: string | undefined = body?.subject?.uri || body?.postUri;
-    const postCid: string | undefined = body?.subject?.cid || body?.postCid;
-
-    if (!postUri) {
-      res.status(400).json({
-        error: 'InvalidRequest',
-        message: 'subject.uri is required',
-      });
-      return;
-    }
+    const pdsEndpoint = await getUserPdsEndpoint(userDid);
 
-    const rkey = `bmk_${Date.now()}`;
-    const uri = `at://${userDid}/app.bsky.bookmark.bookmark/${rkey}`;
-
-    // Ensure post exists locally; if not, try to fetch via PDS data fetcher
-    const post = await storage.getPost(postUri);
-    if (!post) {
-      try {
-        const { pdsDataFetcher } = await import('../../pds-data-fetcher');
-        pdsDataFetcher.markIncomplete('post', userDid, postUri);
-      } catch {
-        // Ignore errors if pdsDataFetcher is unavailable
-      }
-    }
-
-    await storage.createBookmark({
-      uri,
-      userDid,
-      postUri,
-      createdAt: new Date(),
+    res.status(501).json({
+      error: 'NotImplemented',
+      message: 'Bookmarks are not part of the official ATProto specification and should not be stored on AppView. ' +
+               'Per ATProto architecture, bookmarks are private user data that should be stored on the PDS. ' +
+               'Unlike likes (which are public records), bookmarks are private metadata similar to mutes. ' +
+               (pdsEndpoint
+                 ? `If your PDS supports bookmarks, please use: ${pdsEndpoint}/xrpc/app.bsky.bookmark.create`
+                 : 'Please check if your PDS supports bookmark functionality.'),
+      pdsEndpoint: pdsEndpoint || undefined,
     });
-
-    res.json({ uri, cid: postCid });
   } catch (error) {
     handleError(res, error, 'createBookmark');
   }
···
 /**
  * Delete a bookmark
  * POST /xrpc/app.bsky.bookmark.delete
+ *
+ * NOTE: Not part of official ATProto specification. Bookmarks are private user data
+ * that should be stored on the PDS, not on AppView.
  */
 export async function deleteBookmark(
   req: Request,
···
     const userDid = await requireAuthDid(req, res);
     if (!userDid) return;
 
-    const body = req.body as { uri?: string };
-    const uri: string | undefined = body?.uri;
+    const pdsEndpoint = await getUserPdsEndpoint(userDid);
 
-    if (!uri) {
-      res
-        .status(400)
-        .json({ error: 'InvalidRequest', message: 'uri is required' });
-      return;
-    }
-
-    await storage.deleteBookmark(uri);
-    res.json({ success: true });
+    res.status(501).json({
+      error: 'NotImplemented',
+      message: 'Bookmarks are not part of the official ATProto specification and should not be stored on AppView. ' +
+               'Per ATProto architecture, bookmarks are private user data that should be stored on the PDS. ' +
+               (pdsEndpoint
+                 ? `If your PDS supports bookmarks, please use: ${pdsEndpoint}/xrpc/app.bsky.bookmark.delete`
+                 : 'Please check if your PDS supports bookmark functionality.'),
+      pdsEndpoint: pdsEndpoint || undefined,
+    });
   } catch (error) {
     handleError(res, error, 'deleteBookmark');
   }
···
 /**
  * Get user's bookmarks
  * GET /xrpc/app.bsky.bookmark.list
+ *
+ * NOTE: Not part of official ATProto specification. Bookmarks are private user data
+ * that should be stored on the PDS, not on AppView.
  */
 export async function getBookmarks(req: Request, res: Response): Promise<void> {
   try {
     const userDid = await requireAuthDid(req, res);
     if (!userDid) return;
 
-    const limit = Math.min(100, Number(req.query.limit) || 50);
-    const cursor =
-      typeof req.query.cursor === 'string' ? req.query.cursor : undefined;
-
-    const { bookmarks, cursor: nextCursor } = await storage.getBookmarks(
-      userDid,
-      limit,
-      cursor
-    );
+    const pdsEndpoint = await getUserPdsEndpoint(userDid);
 
-    type BookmarkRecord = {
-      uri: string;
-      postUri: string;
-      createdAt: Date;
-    };
-
-    const bookmarkRecords = bookmarks as BookmarkRecord[];
-    const postUris = bookmarkRecords.map((b) => b.postUri);
-    const viewerDid = (await getAuthenticatedDid(req)) || undefined;
-    const posts: PostModel[] = await storage.getPosts(postUris);
-    const serialized = await serializePosts(posts, viewerDid, req);
-    const byUri = new Map(serialized.map((p) => [p.uri, p]));
-
-    res.json({
-      cursor: nextCursor,
-      bookmarks: bookmarkRecords
-        .map((b) => ({
-          uri: b.uri,
-          createdAt: b.createdAt.toISOString(),
-          post: byUri.get(b.postUri),
-        }))
-        .filter((b) => !!b.post),
+    res.status(501).json({
+      error: 'NotImplemented',
+      message: 'Bookmarks are not part of the official ATProto specification and should not be stored on AppView. ' +
+               'Per ATProto architecture, bookmarks are private user data that should be fetched from the PDS. ' +
+               'Unlike public data (posts, likes), bookmarks are private metadata similar to mutes. ' +
+               (pdsEndpoint
+                 ? `If your PDS supports bookmarks, please use: ${pdsEndpoint}/xrpc/app.bsky.bookmark.list`
+                 : 'Please check if your PDS supports bookmark functionality.'),
+      pdsEndpoint: pdsEndpoint || undefined,
     });
   } catch (error) {
     handleError(res, error, 'getBookmarks');

server/services/xrpc/services/feed-generator-service.ts

···
   getSuggestedFeedsSchema,
   describeFeedGeneratorSchema,
   getPopularFeedGeneratorsSchema,
+  getSuggestedFeedsUnspeccedSchema,
 } from '../schemas';
+import { xrpcApi } from '../../xrpc-api';
 
 /**
  * Helper to serialize a feed generator view
+ * Now accepts full profileView from _getProfiles for complete creator data
  */
 function serializeFeedGeneratorView(
   generator: {
···
     likeCount: number;
     indexedAt: Date;
   },
-  creator: {
-    did: string;
-    handle: string;
-    displayName?: string;
-    avatarUrl?: string;
-  },
+  creatorProfile: any, // Full profileView from _getProfiles
   req?: Request
 ) {
-  const creatorView: {
-    did: string;
-    handle: string;
-    displayName?: string;
-    avatar?: string;
-  } = {
-    did: generator.creatorDid,
-    handle: creator.handle,
-  };
-  if (creator.displayName) creatorView.displayName = creator.displayName;
-  if (creator.avatarUrl) {
-    const avatarUri = transformBlobToCdnUrl(
-      creator.avatarUrl,
-      creator.did,
-      'avatar',
-      req
-    );
-    if (avatarUri && typeof avatarUri === 'string' && avatarUri.trim() !== '') {
-      creatorView.avatar = avatarUri;
-    }
-  }
-
-  const view: {
-    uri: string;
-    cid: string;
-    did: string;
-    creator: typeof creatorView;
-    displayName: string;
-    likeCount: number;
-    indexedAt: string;
-    description?: string;
-    avatar?: string;
-  } = {
+  const view: any = {
     uri: generator.uri,
     cid: generator.cid,
     did: generator.did,
-    creator: creatorView,
+    creator: creatorProfile, // Full profileView object
     displayName: generator.displayName || 'Unnamed Feed',
     likeCount: generator.likeCount,
     indexedAt: generator.indexedAt.toISOString(),
   };
+
   if (generator.description) view.description = generator.description;
   if (generator.avatarUrl) {
     const avatarUri = transformBlobToCdnUrl(
···
       indexedAt: Date;
     };
 
-    // Creator profile should be available from firehose events
-    const creator = await storage.getUser(generatorData.creatorDid);
+    // Use _getProfiles for complete creator profileView
+    const creatorProfiles = await (xrpcApi as any)._getProfiles(
+      [generatorData.creatorDid],
+      req
+    );
 
-    if (!creator || !(creator as { handle?: string }).handle) {
+    if (creatorProfiles.length === 0) {
       return res.status(500).json({
         error: 'Feed generator creator profile not available',
         message: 'Unable to load creator information',
···
 
     const view = serializeFeedGeneratorView(
       generatorData,
-      creator as {
-        did: string;
-        handle: string;
-        displayName?: string;
-        avatarUrl?: string;
-      },
+      creatorProfiles[0],
       req
     );
 
···
   try {
     const params = getFeedGeneratorsSchema.parse(req.query);
 
-    const generators = await storage.getFeedGenerators(params.feeds);
+    const generators = await storage.getFeedGenerators(params.feeds) as {
+      uri: string;
+      cid: string;
+      did: string;
+      creatorDid: string;
+      displayName?: string;
+      description?: string;
+      avatarUrl?: string;
+      likeCount: number;
+      indexedAt: Date;
+    }[];
+
+    if (generators.length === 0) {
+      return res.json({ feeds: [] });
+    }
 
-    // Creator profiles should be available from firehose events
-    const views = await Promise.all(
-      (
-        generators as {
-          uri: string;
-          cid: string;
-          did: string;
-          creatorDid: string;
-          displayName?: string;
-          description?: string;
-          avatarUrl?: string;
-          likeCount: number;
-          indexedAt: Date;
-        }[]
-      ).map(async (generator) => {
-        const creator = await storage.getUser(generator.creatorDid);
+    // Batch fetch all creator profiles
+    const creatorDids = [...new Set(generators.map(g => g.creatorDid))];
+    const creatorProfiles = await (xrpcApi as any)._getProfiles(creatorDids, req);
 
-        // Skip generators from creators without valid handles
-        if (!creator || !(creator as { handle?: string }).handle) {
+    // Create map for quick lookup
+    const profileMap = new Map(creatorProfiles.map((p: any) => [p.did, p]));
+
+    // Build views with complete creator profiles
+    const views = generators
+      .map((generator) => {
+        const creatorProfile = profileMap.get(generator.creatorDid);
+        if (!creatorProfile) {
           console.warn(
-            `[XRPC] Skipping feed generator ${generator.uri} - creator ${generator.creatorDid} has no handle`
+            `[XRPC] Skipping feed generator ${generator.uri} - creator ${generator.creatorDid} profile not found`
           );
           return null;
         }
 
-        return serializeFeedGeneratorView(
-          generator,
-          creator as {
-            did: string;
-            handle: string;
-            displayName?: string;
-            avatarUrl?: string;
-          },
-          req
-        );
+        return serializeFeedGeneratorView(generator, creatorProfile, req);
       })
-    );
+      .filter(Boolean);
 
-    // Filter out null entries (generators from creators without valid handles)
-    const validViews = views.filter((view) => view !== null);
-
-    res.json({ feeds: validViews });
+    res.json({ feeds: views });
   } catch (error) {
     handleError(res, error, 'getFeedGenerators');
   }
···
       actorDid,
       params.limit,
       params.cursor
-    );
+    ) as {
+      generators: {
+        uri: string;
+        cid: string;
+        did: string;
+        creatorDid: string;
+        displayName?: string;
+        description?: string;
+        avatarUrl?: string;
+        likeCount: number;
+        indexedAt: Date;
+      }[];
+      cursor?: string;
+    };
 
-    // Creator profiles should be available from firehose events
-    const feeds = await Promise.all(
-      (
-        generators as {
-          uri: string;
-          cid: string;
-          did: string;
-          creatorDid: string;
-          displayName?: string;
-          description?: string;
-          avatarUrl?: string;
-          likeCount: number;
-          indexedAt: Date;
-        }[]
-      ).map(async (generator) => {
-        const creator = await storage.getUser(generator.creatorDid);
+    if (generators.length === 0) {
+      return res.json({ cursor, feeds: [] });
+    }
 
-        // Skip generators from creators without valid handles
-        if (!creator || !(creator as { handle?: string }).handle) {
+    // Batch fetch all creator profiles
+    const creatorDids = [...new Set(generators.map(g => g.creatorDid))];
+    const creatorProfiles = await (xrpcApi as any)._getProfiles(creatorDids, req);
+
+    // Create map for quick lookup
+    const profileMap = new Map(creatorProfiles.map((p: any) => [p.did, p]));
+
+    // Build views with complete creator profiles
+    const feeds = generators
+      .map((generator) => {
+        const creatorProfile = profileMap.get(generator.creatorDid);
+        if (!creatorProfile) {
           console.warn(
-            `[XRPC] Skipping feed generator ${generator.uri} - creator ${generator.creatorDid} has no handle`
+            `[XRPC] Skipping feed generator ${generator.uri} - creator ${generator.creatorDid} profile not found`
           );
           return null;
         }
 
-        return serializeFeedGeneratorView(
-          generator,
-          creator as {
-            did: string;
-            handle: string;
-            displayName?: string;
-            avatarUrl?: string;
-          },
-          req
-        );
+        return serializeFeedGeneratorView(generator, creatorProfile, req);
       })
-    );
+      .filter(Boolean);
 
     res.json({ cursor, feeds });
   } catch (error) {
···
     const { generators, cursor } = await storage.getSuggestedFeeds(
       params.limit,
       params.cursor
-    );
+    ) as {
+      generators: {
+        uri: string;
+        cid: string;
+        did: string;
+        creatorDid: string;
+        displayName?: string;
+        description?: string;
+        avatarUrl?: string;
+        likeCount: number;
+        indexedAt: Date;
+      }[];
+      cursor?: string;
+    };
 
-    // Creator profiles should be available from firehose events
-    const feeds = await Promise.all(
-      (
-        generators as {
-          uri: string;
-          cid: string;
-          did: string;
-          creatorDid: string;
-          displayName?: string;
-          description?: string;
-          avatarUrl?: string;
-          likeCount: number;
-          indexedAt: Date;
-        }[]
-      ).map(async (generator) => {
-        const creator = await storage.getUser(generator.creatorDid);
+    if (generators.length === 0) {
+      return res.json({ cursor, feeds: [] });
+    }
+
+    // Batch fetch all creator profiles
+    const creatorDids = [...new Set(generators.map(g => g.creatorDid))];
+    const creatorProfiles = await (xrpcApi as any)._getProfiles(creatorDids, req);
+
+    // Create map for quick lookup
+    const profileMap = new Map(creatorProfiles.map((p: any) => [p.did, p]));
 
-        // Skip generators from creators without valid handles
-        if (!creator || !(creator as { handle?: string }).handle) {
+    // Build views with complete creator profiles
+    const feeds = generators
+      .map((generator) => {
+        const creatorProfile = profileMap.get(generator.creatorDid);
+        if (!creatorProfile) {
           console.warn(
-            `[XRPC] Skipping feed generator ${generator.uri} - creator ${generator.creatorDid} has no handle`
+            `[XRPC] Skipping feed generator ${generator.uri} - creator ${generator.creatorDid} profile not found`
           );
           return null;
         }
 
-        return serializeFeedGeneratorView(
-          generator,
-          creator as {
-            did: string;
-            handle: string;
-            displayName?: string;
-            avatarUrl?: string;
-          },
-          req
-        );
+        return serializeFeedGeneratorView(generator, creatorProfile, req);
       })
-    );
-
-    // Filter out null entries (generators from creators without valid handles)
-    const validFeeds = feeds.filter((feed) => feed !== null);
+      .filter(Boolean);
 
-    res.json({ cursor, feeds: validFeeds });
+    res.json({ cursor, feeds });
   } catch (error) {
     handleError(res, error, 'getSuggestedFeeds');
   }
···
 /**
  * Describe the feed generator service
  * GET /xrpc/app.bsky.feed.describeFeedGenerator
+ *
+ * NOTE: Per ATProto spec, this endpoint is "implemented by Feed Generator services (not App View)."
+ * This is an AppView, not a Feed Generator service. Feed Generator services are external
+ * services that generate custom feeds, which this AppView consumes via feedGeneratorClient.
+ *
+ * Returns 501 Not Implemented to indicate this endpoint belongs on Feed Generator services.
  */
 export async function describeFeedGenerator(
   req: Request,
···
   try {
     describeFeedGeneratorSchema.parse(req.query);
 
-    const appviewDid = process.env.APPVIEW_DID;
-    if (!appviewDid) {
-      return res.status(500).json({ error: 'APPVIEW_DID not configured' });
-    }
-
-    res.json({
-      did: appviewDid,
-      feeds: [
-        {
-          uri: `at://${appviewDid}/app.bsky.feed.generator/reverse-chron`,
-        },
-      ],
+    res.status(501).json({
+      error: 'NotImplemented',
+      message: 'This endpoint is for Feed Generator services, not AppView. ' +
+               'Feed Generator services implement this endpoint to describe their feed offerings. ' +
+               'This is an AppView that consumes feeds from external Feed Generator services.',
     });
   } catch (error) {
     handleError(res, error, 'describeFeedGenerator');
···
   try {
     const params = getPopularFeedGeneratorsSchema.parse(req.query);
 
-    let generators: unknown[];
+    let generators: {
+      uri: string;
+      cid: string;
+      did: string;
+      creatorDid: string;
+      displayName?: string;
+      description?: string;
+      avatarUrl?: string;
+      likeCount: number;
+      indexedAt: Date;
+    }[];
     let cursor: string | undefined;
 
     // If query is provided, search for feed generators by name/description
···
         params.limit,
         params.cursor
       );
-      generators = (searchResults as { feedGenerators: unknown[] })
+      generators = (searchResults as { feedGenerators: typeof generators })
         .feedGenerators;
       cursor = (searchResults as { cursor?: string }).cursor;
     } else {
···
         params.limit,
         params.cursor
       );
-      generators = (suggestedResults as { generators: unknown[] }).generators;
+      generators = (suggestedResults as { generators: typeof generators }).generators;
       cursor = (suggestedResults as { cursor?: string }).cursor;
     }
 
-    // Creator profiles should be available from firehose events
-    const feeds = await Promise.all(
-      (
-        generators as {
-          uri: string;
-          cid: string;
-          did: string;
-          creatorDid: string;
-          displayName?: string;
-          description?: string;
-          avatarUrl?: string;
-          likeCount: number;
-          indexedAt: Date;
-        }[]
-      ).map(async (generator) => {
-        const creator = await storage.getUser(generator.creatorDid);
+    if (generators.length === 0) {
+      return res.json({ cursor, feeds: [] });
+    }
 
-        // Skip generators from creators without valid handles
-        if (!creator || !(creator as { handle?: string }).handle) {
+    // Batch fetch all creator profiles
+    const creatorDids = [...new Set(generators.map(g => g.creatorDid))];
+    const creatorProfiles = await (xrpcApi as any)._getProfiles(creatorDids, req);
+
+    // Create map for quick lookup
+    const profileMap = new Map(creatorProfiles.map((p: any) => [p.did, p]));
+
+    // Build views with complete creator profiles
+    const feeds = generators
+      .map((generator) => {
+        const creatorProfile = profileMap.get(generator.creatorDid);
+        if (!creatorProfile) {
           console.warn(
-            `[XRPC] Skipping feed generator ${generator.uri} - creator ${generator.creatorDid} has no handle`
+            `[XRPC] Skipping feed generator ${generator.uri} - creator ${generator.creatorDid} profile not found`
           );
           return null;
         }
 
-        return serializeFeedGeneratorView(
-          generator,
-          creator as {
-            did: string;
-            handle: string;
-            displayName?: string;
-            avatarUrl?: string;
-          },
-          req
-        );
+        return serializeFeedGeneratorView(generator, creatorProfile, req);
       })
-    );
+      .filter(Boolean);
 
-    // Filter out null entries (generators from creators without valid handles)
-    const validFeeds = feeds.filter((feed) => feed !== null);
-
-    res.json({ cursor, feeds: validFeeds });
+    res.json({ cursor, feeds });
   } catch (error) {
     handleError(res, error, 'getPopularFeedGenerators');
   }
 }
 
 /**
- * Get suggested feeds (unspecced version - minimal response)
- * GET /xrpc/app.bsky.unspecced.getSuggestedFeedsUnspecced
+ * Get suggested feeds (unspecced)
+ * GET /xrpc/app.bsky.unspecced.getSuggestedFeeds
+ *
+ * IMPORTANT: This endpoint is experimental and marked as "unspecced" in the ATProto specification.
+ * Returns a list of suggested feed generators with complete generatorView objects.
  */
 export async function getSuggestedFeedsUnspecced(
   req: Request,
   res: Response
 ): Promise<void> {
   try {
-    const { generators } = await storage.getSuggestedFeeds(10);
-    res.json({
-      feeds: (generators as { uri: string }[]).map((g) => g.uri),
-    });
+    const params = getSuggestedFeedsUnspeccedSchema.parse(req.query);
+
+    const { generators } = (await storage.getSuggestedFeeds(params.limit)) as {
+      generators: {
+        uri: string;
+        cid: string;
+        did: string;
+        creatorDid: string;
+        displayName?: string;
+        description?: string;
+        avatarUrl?: string;
+        likeCount: number;
+        indexedAt: Date;
+      }[];
+    };
+
+    if (generators.length === 0) {
+      return res.json({ feeds: [] });
+    }
+
+    // Batch fetch all creator profiles
+    const creatorDids = [...new Set(generators.map((g) => g.creatorDid))];
+    const creatorProfiles = await (xrpcApi as any)._getProfiles(
+      creatorDids,
+      req
+    );
+
+    // Create map for quick lookup
+    const profileMap = new Map(creatorProfiles.map((p: any) => [p.did, p]));
+
+    // Build views with complete creator profiles
+    const feeds = generators
+      .map((generator) => {
+        const creatorProfile = profileMap.get(generator.creatorDid);
+        if (!creatorProfile) {
+          console.warn(
+            `[XRPC] Skipping feed generator ${generator.uri} - creator ${generator.creatorDid} profile not found`
+          );
+          return null;
+        }
+
+        return serializeFeedGeneratorView(generator, creatorProfile, req);
+      })
+      .filter(Boolean);
+
+    res.json({ feeds });
   } catch (error) {
     handleError(res, error, 'getSuggestedFeedsUnspecced');
   }

server/services/xrpc/services/graph-service.ts

···
   getKnownFollowersSchema,
   getFollowsSchema,
 } from '../schemas';
+import { xrpcApi } from '../../xrpc-api';
 
 /**
  * Get relationships between an actor and other actors
  * GET /xrpc/app.bsky.graph.getRelationships
+ *
+ * NOTE: Per ATProto spec, relationship objects only include follow relationships.
+ * Blocks and mutes are intentionally excluded from this endpoint.
+ * - Blocks: Public records but not exposed via getRelationships
+ * - Mutes: Private preferences that should never be exposed by AppView
  */
 export async function getRelationships(
   req: Request,
···
         did,
         following: rel.following || undefined,
         followedBy: rel.followedBy || undefined,
-        blocking: rel.blocking || undefined,
-        blockedBy: rel.blockedBy || undefined,
-        muted: rel.muting || undefined,
+        // Per ATProto spec: blocking, blockedBy, muted are NOT included
       })),
     });
   } catch (error) {
···
       params.cursor
     );
 
-    // Get the actor's handle for the subject
-    const actor = await storage.getUser(actorDid);
+    // Build full profileView objects using _getProfiles helper
+    const followerDids = followers.map((f) => f.did);
+    const allDids = [actorDid, ...followerDids];
+    const profiles = await (xrpcApi as any)._getProfiles(allDids, req);
+
+    // Create a map of DID -> profile for quick lookup
+    const profileMap = new Map(profiles.map((p: any) => [p.did, p]));
+
+    // Extract subject profile
+    const subject = profileMap.get(actorDid);
+
+    // Extract follower profiles in order
+    const followerProfiles = followerDids
+      .map((did) => profileMap.get(did))
+      .filter(Boolean);
 
     res.json({
-      subject: {
+      subject: subject || {
         $type: 'app.bsky.actor.defs#profileView',
         did: actorDid,
-        handle: actor?.handle || params.actor,
-        displayName: actor?.displayName || actor?.handle || params.actor,
-        ...maybeAvatar(actor?.avatarUrl, actor?.did || actorDid, req),
-        indexedAt: actor?.indexedAt?.toISOString(),
-        viewer: {
-          muted: false,
-          blockedBy: false,
-          blocking: undefined,
-          following: undefined,
-          followedBy: undefined,
-        },
+        handle: actorDid,
       },
       cursor,
-      followers: followers.map((user) => ({
-        $type: 'app.bsky.actor.defs#profileView',
-        did: user.did,
-        handle: user.handle,
-        displayName: user.displayName || user.handle,
-        ...maybeAvatar(user.avatarUrl, user.did, req),
-        indexedAt: user.indexedAt?.toISOString(),
-        viewer: {
-          muted: false,
-          blockedBy: false,
-          blocking: undefined,
-          following: undefined,
-          followedBy: undefined,
-        },
-      })),
+      followers: followerProfiles,
     });
   } catch (error) {
     handleError(res, error, 'getKnownFollowers');
···
           followedBy: undefined,
         },
       },
-      follows: followsList
-        .map((f) => {
-          const user = userMap.get(f.followingDid);
-          if (!user) return null;
+      follows: followsList.map((f) => {
+        const user = userMap.get(f.followingDid);
 
-          const viewerState = viewerDid
-            ? relationships.get(f.followingDid)
-            : null;
-          const viewer: {
-            muted: boolean;
-            blockedBy: boolean;
-            blocking?: string;
-            following?: string;
-            followedBy?: string;
-          } = {
-            muted: viewerState ? !!viewerState.muting : false,
-            blockedBy: viewerState?.blockedBy || false,
-          };
-          if (viewerState?.blocking) viewer.blocking = viewerState.blocking;
-          if (viewerState?.following) viewer.following = viewerState.following;
-          if (viewerState?.followedBy)
-            viewer.followedBy = viewerState.followedBy;
-
+        // If user profile not found, create minimal profile with DID
+        // This ensures follows always show up even if profile fetch is pending
+        if (!user) {
           return {
             $type: 'app.bsky.actor.defs#profileView',
-            did: user.did,
-            handle: user.handle,
-            displayName: user.displayName || user.handle,
-            ...maybeAvatar(user.avatarUrl, user.did, req),
-            indexedAt: user.indexedAt?.toISOString(),
-            viewer,
+            did: f.followingDid,
+            handle: f.followingDid, // Use DID as fallback handle
+            displayName: f.followingDid,
+            indexedAt: f.indexedAt?.toISOString(),
+            viewer: {
+              muted: false,
+              blockedBy: false,
+            },
           };
-        })
-        .filter((follow) => follow !== null),
+        }
+
+        const viewerState = viewerDid
+          ? relationships.get(f.followingDid)
+          : null;
+        const viewer: {
+          muted: boolean;
+          blockedBy: boolean;
+          blocking?: string;
+          following?: string;
+          followedBy?: string;
+        } = {
+          muted: viewerState ? !!viewerState.muting : false,
+          blockedBy: viewerState?.blockedBy || false,
+        };
+        if (viewerState?.blocking) viewer.blocking = viewerState.blocking;
+        if (viewerState?.following) viewer.following = viewerState.following;
+        if (viewerState?.followedBy)
+          viewer.followedBy = viewerState.followedBy;
+
+        return {
+          $type: 'app.bsky.actor.defs#profileView',
+          did: user.did,
+          handle: user.handle,
+          displayName: user.displayName || user.handle,
+          ...maybeAvatar(user.avatarUrl, user.did, req),
+          indexedAt: user.indexedAt?.toISOString(),
+          viewer,
+        };
+      }),
       cursor: nextCursor,
     });
   } catch (error) {
···
           followedBy: undefined,
         },
       },
-      followers: followersList
-        .map((f) => {
-          const user = userMap.get(f.followerDid);
-          if (!user) return null;
+      followers: followersList.map((f) => {
+        const user = userMap.get(f.followerDid);
 
-          const viewerState = viewerDid
-            ? relationships.get(f.followerDid)
-            : null;
-          const viewer: {
-            muted: boolean;
-            blockedBy: boolean;
-            blocking?: string;
-            following?: string;
-            followedBy?: string;
-          } = {
-            muted: viewerState ? !!viewerState.muting : false,
-            blockedBy: viewerState?.blockedBy || false,
-          };
-          if (viewerState?.blocking) viewer.blocking = viewerState.blocking;
-          if (viewerState?.following) viewer.following = viewerState.following;
-          if (viewerState?.followedBy)
-            viewer.followedBy = viewerState.followedBy;
-
+        // If user profile not found, create minimal profile with DID
+        // This ensures followers always show up even if profile fetch is pending
+        if (!user) {
           return {
             $type: 'app.bsky.actor.defs#profileView',
-            did: user.did,
-            handle: user.handle,
-            displayName: user.displayName || user.handle,
-            ...maybeAvatar(user.avatarUrl, user.did, req),
-            indexedAt: user.indexedAt?.toISOString(),
-            viewer,
+            did: f.followerDid,
+            handle: f.followerDid, // Use DID as fallback handle
+            displayName: f.followerDid,
+            indexedAt: f.indexedAt?.toISOString(),
+            viewer: {
+              muted: false,
+              blockedBy: false,
+            },
           };
-        })
-        .filter((follower) => follower !== null),
+        }
+
+        const viewerState = viewerDid
+          ? relationships.get(f.followerDid)
+          : null;
+        const viewer: {
+          muted: boolean;
+          blockedBy: boolean;
+          blocking?: string;
+          following?: string;
+          followedBy?: string;
+        } = {
+          muted: viewerState ? !!viewerState.muting : false,
+          blockedBy: viewerState?.blockedBy || false,
+        };
+        if (viewerState?.blocking) viewer.blocking = viewerState.blocking;
+        if (viewerState?.following) viewer.following = viewerState.following;
+        if (viewerState?.followedBy)
+          viewer.followedBy = viewerState.followedBy;
+
+        return {
+          $type: 'app.bsky.actor.defs#profileView',
+          did: user.did,
+          handle: user.handle,
+          displayName: user.displayName || user.handle,
+          ...maybeAvatar(user.avatarUrl, user.did, req),
+          indexedAt: user.indexedAt?.toISOString(),
+          viewer,
+        };
+      }),
       cursor: nextCursor,
     });
   } catch (error) {

server/services/xrpc/services/list-service.ts

···
 import { xrpcApi } from '../../xrpc-api';
 
 /**
- * Get a specific list by URI
+ * Get a specific list by URI with items
  * GET /xrpc/app.bsky.graph.getList
  */
 export async function getList(req: Request, res: Response): Promise<void> {
   try {
     const params = getListSchema.parse(req.query);
+    const viewerDid = await getAuthenticatedDid(req);
+
+    // Get list metadata
     const list = await storage.getList(params.list);
 
     if (!list) {
···
       return;
     }
 
+    // Get list items with pagination
+    const { items: listItems, cursor: nextCursor } = await storage.getListItemsWithPagination(
+      params.list,
+      params.limit,
+      params.cursor
+    );
+
+    // Hydrate creator profile
+    const creatorProfiles = await (xrpcApi as any)._getProfiles([list.creatorDid], req);
+    const creator = creatorProfiles[0];
+
+    if (!creator) {
+      res.status(500).json({
+        error: 'InternalServerError',
+        message: 'Failed to fetch list creator profile',
+      });
+      return;
+    }
+
+    // Hydrate subject profiles for list items
+    const subjectDids = listItems.map((item) => item.subjectDid);
+    let subjects: any[] = [];
+
+    if (subjectDids.length > 0) {
+      subjects = await (xrpcApi as any)._getProfiles(subjectDids, req);
+    }
+
+    // Create subject map for quick lookup
+    const subjectMap = new Map(subjects.map((s) => [s.did, s]));
+
+    // Build list item views
+    const itemViews = listItems
+      .map((item) => {
+        const subject = subjectMap.get(item.subjectDid);
+        if (!subject) return null;
+
+        return {
+          uri: item.uri,
+          subject,
+        };
+      })
+      .filter((item): item is NonNullable<typeof item> => item !== null);
+
+    // Count total list items (for listItemCount field)
+    const allItems = await storage.getListItems(params.list, 10000);
+    const listItemCount = allItems.length;
+
+    // Build viewer state if authenticated
+    let viewer: any = undefined;
+    if (viewerDid) {
+      // Check if viewer has muted this list
+      const { mutes } = await storage.getListMutes(viewerDid, 1000, undefined);
+      const isMuted = mutes.some((m) => m.listUri === params.list);
+
+      // Check if viewer has blocked this list
+      const { blocks } = await storage.getListBlocks(viewerDid, 1000, undefined);
+      const isBlocked = blocks.some((b) => b.listUri === params.list);
+
+      if (isMuted || isBlocked) {
+        viewer = {
+          muted: isMuted || undefined,
+          blocked: isBlocked ? params.list : undefined,
+        };
+      }
+    }
+
+    // Build ATProto-compliant response
     res.json({
+      cursor: nextCursor,
       list: {
         uri: list.uri,
         cid: list.cid,
+        creator,
         name: list.name,
         purpose: list.purpose,
-        createdAt: list.createdAt.toISOString(),
+        description: list.description || undefined,
+        avatar: list.avatarUrl || undefined,
+        listItemCount,
         indexedAt: list.indexedAt.toISOString(),
+        ...(viewer && { viewer }),
       },
+      items: itemViews,
     });
   } catch (error) {
     handleError(res, error, 'getList');
···
 export async function getLists(req: Request, res: Response): Promise<void> {
   try {
     const params = getListsSchema.parse(req.query);
+    const viewerDid = await getAuthenticatedDid(req);
+
+    // Resolve actor to DID
     const did = await resolveActor(res, params.actor);
     if (!did) return;
 
-    const lists = await storage.getUserLists(did, params.limit);
+    // Get lists with pagination and optional purpose filtering
+    const { lists: userLists, cursor: nextCursor } = await storage.getUserListsWithPagination(
+      did,
+      params.limit,
+      params.cursor,
+      params.purposes
+    );
+
+    if (userLists.length === 0) {
+      res.json({
+        cursor: nextCursor,
+        lists: [],
+      });
+      return;
+    }
+
+    // Hydrate creator profile for all lists (should be same creator)
+    const creatorProfiles = await (xrpcApi as any)._getProfiles([did], req);
+    const creator = creatorProfiles[0];
+
+    if (!creator) {
+      res.status(500).json({
+        error: 'InternalServerError',
+        message: 'Failed to fetch list creator profile',
+      });
+      return;
+    }
+
+    // Build viewer states if authenticated
+    let viewerMutes: Set<string> = new Set();
+    let viewerBlocks: Set<string> = new Set();
+
+    if (viewerDid) {
+      const { mutes } = await storage.getListMutes(viewerDid, 1000, undefined);
+      viewerMutes = new Set(mutes.map((m) => m.listUri));
+
+      const { blocks } = await storage.getListBlocks(viewerDid, 1000, undefined);
+      viewerBlocks = new Set(blocks.map((b) => b.listUri));
+    }
+
+    // Get list item counts for all lists
+    const listItemCounts = await Promise.all(
+      userLists.map(async (list) => {
+        const items = await storage.getListItems(list.uri, 10000);
+        return { uri: list.uri, count: items.length };
+      })
+    );
+    const countMap = new Map(listItemCounts.map((c) => [c.uri, c.count]));
+
+    // Build full listView objects
+    const listViews = userLists.map((list) => {
+      const listItemCount = countMap.get(list.uri) || 0;
+
+      // Build viewer state if authenticated
+      let viewer: any = undefined;
+      if (viewerDid) {
+        const isMuted = viewerMutes.has(list.uri);
+        const isBlocked = viewerBlocks.has(list.uri);
+
+        if (isMuted || isBlocked) {
+          viewer = {
+            muted: isMuted || undefined,
+            blocked: isBlocked ? list.uri : undefined,
+          };
+        }
+      }
+
+      return {
+        uri: list.uri,
+        cid: list.cid,
+        creator,
+        name: list.name,
+        purpose: list.purpose,
+        description: list.description || undefined,
+        avatar: list.avatarUrl || undefined,
+        listItemCount,
+        indexedAt: list.indexedAt.toISOString(),
+        ...(viewer && { viewer }),
+      };
+    });
 
     res.json({
-      lists: lists.map((l) => ({
-        uri: l.uri,
-        cid: l.cid,
-        name: l.name,
-        purpose: l.purpose,
-        createdAt: l.createdAt.toISOString(),
-        indexedAt: l.indexedAt.toISOString(),
-      })),
+      cursor: nextCursor,
+      lists: listViews,
     });
   } catch (error) {
     handleError(res, error, 'getLists');
···
 export async function getListFeed(req: Request, res: Response): Promise<void> {
   try {
     const params = getListFeedSchema.parse(req.query);
+
+    // Check if list exists (ATProto spec requires UnknownList error)
+    const list = await storage.getList(params.list);
+    if (!list) {
+      res.status(400).json({
+        error: 'UnknownList',
+        message: 'List not found',
+      });
+      return;
+    }
+
+    // Fetch posts from list members with limit+1 for pagination
     const posts = await storage.getListFeed(
       params.list,
       params.limit,
···
 
     const viewerDid = await getAuthenticatedDid(req);
 
-    // Use legacy API for complex post serialization
-    // TODO: Extract serializePosts to utils in future iteration
+    // Use serializePosts for proper post hydration with viewer context
+    // This handles: embeds, author profiles, viewer state (likes/reposts),
+    // reply counts, repost counts, quote counts, labels, and thread context
     const serialized = await (xrpcApi as any).serializePosts(
       posts,
       viewerDid || undefined,
       req
     );
 
-    const oldest = posts.length ? posts[posts.length - 1] : null;
+    // Generate cursor from last post if results exist
+    const cursor = posts.length > 0
+      ? posts[posts.length - 1].indexedAt.toISOString()
+      : undefined;
 
     res.json({
-      cursor: oldest ? oldest.indexedAt.toISOString() : undefined,
+      cursor,
       feed: serialized.map((p: any) => ({ post: p })),
     });
   } catch (error) {
···
 /**
  * Get lists with membership information for an actor
  * GET /xrpc/app.bsky.graph.getListsWithMembership
+ *
+ * Returns lists created by the authenticated user, with membership info
+ * about the specified actor in each list.
  */
 export async function getListsWithMembership(
   req: Request,
···
 ): Promise<void> {
   try {
     const params = getListsWithMembershipSchema.parse(req.query);
-    const did = await resolveActor(res, params.actor);
-    if (!did) return;
+
+    // Requires authentication - lists are created by session user
+    const sessionDid = await requireAuthDid(req, res);
+    if (!sessionDid) return;
+
+    // Resolve the actor to check for membership
+    const actorDid = await resolveActor(res, params.actor);
+    if (!actorDid) return;
+
+    // Get lists created by authenticated user with pagination and optional filtering
+    const { lists: userLists, cursor: nextCursor } = await storage.getUserListsWithPagination(
+      sessionDid,
+      params.limit,
+      params.cursor,
+      params.purposes
+    );
+
+    if (userLists.length === 0) {
+      res.json({
+        cursor: nextCursor,
+        listsWithMembership: [],
+      });
+      return;
+    }
+
+    // Get creator profile (session user)
+    const creator = await storage.getUser(sessionDid);
+    if (!creator || !(creator as { handle?: string }).handle) {
+      res.status(500).json({
+        error: 'InternalServerError',
+        message: 'Creator profile not available',
+      });
+      return;
+    }
 
-    const lists = await storage.getUserLists(did, params.limit);
+    const creatorData = creator as {
+      handle: string;
+      displayName?: string;
+      avatarUrl?: string;
+      did: string;
+    };
+
+    // Build creator ProfileView (will be same for all lists)
+    const creatorProfiles = await (xrpcApi as any)._getProfiles([sessionDid], req);
+    const creatorView = creatorProfiles[0];
+
+    if (!creatorView) {
+      res.status(500).json({
+        error: 'InternalServerError',
+        message: 'Failed to fetch creator profile',
+      });
+      return;
+    }
+
+    // Get all list URIs to check membership
+    const listUris = userLists.map((l) => l.uri);
+
+    // Batch fetch list items to check membership
+    const membershipPromises = listUris.map(async (listUri) => {
+      const items = await storage.getListItems(listUri, 10000);
+      return { listUri, items };
+    });
+    const membershipResults = await Promise.all(membershipPromises);
+    const membershipMap = new Map(
+      membershipResults.map((r) => [r.listUri, r.items])
+    );
+
+    // Get actor profile for listItem views
+    const actorProfiles = await (xrpcApi as any)._getProfiles([actorDid], req);
+    const actorProfile = actorProfiles[0];
+
+    // Batch fetch list item counts
+    const listItemCounts = await Promise.all(
+      userLists.map(async (list) => {
+        const items = await storage.getListItems(list.uri, 10000);
+        return { uri: list.uri, count: items.length };
+      })
+    );
+    const countMap = new Map(listItemCounts.map((c) => [c.uri, c.count]));
+
+    // Build viewer states if needed
+    const viewerDid = sessionDid;
+    const { mutes } = await storage.getListMutes(viewerDid, 1000, undefined);
+    const viewerMutes = new Set(mutes.map((m) => m.listUri));
+
+    const { blocks } = await storage.getListBlocks(viewerDid, 1000, undefined);
+    const viewerBlocks = new Set(blocks.map((b) => b.listUri));
+
+    // Build listsWithMembership response
+    const listsWithMembership = userLists.map((list) => {
+      const listItemCount = countMap.get(list.uri) || 0;
+
+      // Build viewer state
+      let viewer: any = undefined;
+      const isMuted = viewerMutes.has(list.uri);
+      const isBlocked = viewerBlocks.has(list.uri);
+
+      if (isMuted || isBlocked) {
+        viewer = {
+          muted: isMuted || undefined,
+          blocked: isBlocked ? list.uri : undefined,
+        };
+      }
+
+      // Build full listView
+      const listView = {
+        uri: list.uri,
+        cid: list.cid,
+        creator: creatorView,
+        name: list.name,
+        purpose: list.purpose,
+        description: list.description || undefined,
+        avatar: list.avatarUrl || undefined,
+        listItemCount,
+        indexedAt: list.indexedAt.toISOString(),
+        ...(viewer && { viewer }),
+      };
+
+      // Check if actor is a member of this list
+      const listItems = membershipMap.get(list.uri) || [];
+      const memberItem = listItems.find((item) => item.subjectDid === actorDid);
+
+      // Build response object
+      const response: {
+        list: typeof listView;
+        listItem?: { uri: string; subject: any };
+      } = {
+        list: listView,
+      };
+
+      // Include listItem if actor is a member
+      if (memberItem && actorProfile) {
+        response.listItem = {
+          uri: memberItem.uri,
+          subject: actorProfile,
+        };
+      }
+
+      return response;
+    });
 
     res.json({
-      cursor: undefined,
-      lists: lists.map((l) => ({
-        uri: l.uri,
-        cid: l.cid,
-        name: l.name,
-        purpose: l.purpose,
-      })),
+      cursor: nextCursor,
+      listsWithMembership,
     });
   } catch (error) {
     handleError(res, error, 'getListsWithMembership');
···
     const userDid = await requireAuthDid(req, res);
     if (!userDid) return;
 
-    const { mutes, cursor } = await storage.getListMutes(
+    // Get muted list URIs with pagination
+    const { mutes, cursor: nextCursor } = await storage.getListMutes(
       userDid,
       params.limit,
       params.cursor
     );
 
+    if (mutes.length === 0) {
+      res.json({
+        cursor: nextCursor,
+        lists: [],
+      });
+      return;
+    }
+
+    // Batch fetch all muted lists
+    const listUris = mutes.map((m) => m.listUri);
+    const lists = await Promise.all(
+      listUris.map((uri) => storage.getList(uri))
+    );
+
+    // Filter out nulls (lists that no longer exist)
+    const existingLists = lists.filter((list): list is NonNullable<typeof list> => list !== null);
+
+    if (existingLists.length === 0) {
+      res.json({
+        cursor: nextCursor,
+        lists: [],
+      });
+      return;
+    }
+
+    // Get unique creator DIDs
+    const creatorDids = [...new Set(existingLists.map((list) => list.creatorDid))];
+
+    // Batch fetch all creator profiles
+    const creatorProfiles = await (xrpcApi as any)._getProfiles(creatorDids, req);
+    const creatorMap = new Map(creatorProfiles.map((p: any) => [p.did, p]));
+
+    // Batch fetch list item counts
+    const listItemCounts = await Promise.all(
+      existingLists.map(async (list) => {
+        const items = await storage.getListItems(list.uri, 10000);
+        return { uri: list.uri, count: items.length };
+      })
+    );
+    const countMap = new Map(listItemCounts.map((c) => [c.uri, c.count]));
+
+    // Build full listView objects
+    const listViews = existingLists
+      .map((list) => {
+        const creator = creatorMap.get(list.creatorDid);
+        if (!creator) return null;
+
+        const listItemCount = countMap.get(list.uri) || 0;
+
+        // All these lists are muted by the viewer (by definition)
+        const viewer = {
+          muted: true,
+        };
+
+        return {
+          uri: list.uri,
+          cid: list.cid,
+          creator,
+          name: list.name,
+          purpose: list.purpose,
+          description: list.description || undefined,
+          avatar: list.avatarUrl || undefined,
+          listItemCount,
+          indexedAt: list.indexedAt.toISOString(),
+          viewer,
+        };
+      })
+      .filter((list): list is NonNullable<typeof list> => list !== null);
+
     res.json({
-      cursor,
-      lists: await Promise.all(
-        mutes.map(async (listMute) => {
-          const list = await storage.getList(listMute.listUri);
-          return list
-            ? {
-                uri: list.uri,
-                name: list.name,
-                purpose: list.purpose,
-              }
-            : null;
-        })
-      ),
+      cursor: nextCursor,
+      lists: listViews,
     });
   } catch (error) {
     handleError(res, error, 'getListMutes');
···
     const userDid = await requireAuthDid(req, res);
     if (!userDid) return;
 
-    const { blocks, cursor } = await storage.getListBlocks(
+    // Get blocked list URIs with pagination
+    const { blocks, cursor: nextCursor } = await storage.getListBlocks(
       userDid,
       params.limit,
       params.cursor
     );
 
+    if (blocks.length === 0) {
+      res.json({
+        cursor: nextCursor,
+        lists: [],
+      });
+      return;
+    }
+
+    // Batch fetch all blocked lists
+    const listUris = blocks.map((b) => b.listUri);
+    const lists = await Promise.all(
+      listUris.map((uri) => storage.getList(uri))
+    );
+
+    // Filter out nulls (lists that no longer exist)
+    const existingLists = lists.filter((list): list is NonNullable<typeof list> => list !== null);
+
+    if (existingLists.length === 0) {
+      res.json({
+        cursor: nextCursor,
+        lists: [],
+      });
+      return;
+    }
+
+    // Get unique creator DIDs
+    const creatorDids = [...new Set(existingLists.map((list) => list.creatorDid))];
+
+    // Batch fetch all creator profiles
+    const creatorProfiles = await (xrpcApi as any)._getProfiles(creatorDids, req);
+    const creatorMap = new Map(creatorProfiles.map((p: any) => [p.did, p]));
+
+    // Batch fetch list item counts
+    const listItemCounts = await Promise.all(
+      existingLists.map(async (list) => {
+        const items = await storage.getListItems(list.uri, 10000);
+        return { uri: list.uri, count: items.length };
+      })
+    );
+    const countMap = new Map(listItemCounts.map((c) => [c.uri, c.count]));
+
+    // Build full listView objects
+    const listViews = existingLists
+      .map((list) => {
+        const creator = creatorMap.get(list.creatorDid);
+        if (!creator) return null;
+
+        const listItemCount = countMap.get(list.uri) || 0;
+
+        // All these lists are blocked by the viewer (by definition)
+        const viewer = {
+          blocked: list.uri,
+        };
+
+        return {
+          uri: list.uri,
+          cid: list.cid,
+          creator,
+          name: list.name,
+          purpose: list.purpose,
+          description: list.description || undefined,
+          avatar: list.avatarUrl || undefined,
+          listItemCount,
+          indexedAt: list.indexedAt.toISOString(),
+          viewer,
+        };
+      })
+      .filter((list): list is NonNullable<typeof list> => list !== null);
+
     res.json({
-      cursor,
-      lists: await Promise.all(
-        blocks.map(async (listBlock) => {
-          const list = await storage.getList(listBlock.listUri);
-          return list
-            ? {
-                uri: list.uri,
-                name: list.name,
-                purpose: list.purpose,
-              }
-            : null;
-        })
-      ),
+      cursor: nextCursor,
+      lists: listViews,
     });
   } catch (error) {
     handleError(res, error, 'getListBlocks');

server/services/xrpc/services/moderation-service.ts

···
 import { storage } from '../../../storage';
 import { requireAuthDid, getAuthenticatedDid } from '../utils/auth-helpers';
 import { handleError } from '../utils/error-handler';
-import { resolveActor } from '../utils/resolvers';
+import { resolveActor, getUserPdsEndpoint } from '../utils/resolvers';
 import { maybeAvatar } from '../utils/serializers';
 import {
   getBlocksSchema,
···
   queryLabelsSchema,
   createReportSchema,
 } from '../schemas';
+import { xrpcApi } from '../../xrpc-api';
 
 /**
  * Get blocked actors
···
       params.limit,
       params.cursor
     );
+
+    if (blocks.length === 0) {
+      return res.json({
+        cursor,
+        blocks: [],
+      });
+    }
+
     const blockedDids = blocks.map((b) => b.blockedDid);
-    const blockedUsers = await storage.getUsers(blockedDids);
-    const userMap = new Map(blockedUsers.map((u) => [u.did, u]));
+
+    // Use _getProfiles helper to build complete profileView objects
+    const profiles = await (xrpcApi as any)._getProfiles(blockedDids, req);
+
+    // Create a map of DID -> profile for quick lookup
+    const profileMap = new Map(profiles.map((p: any) => [p.did, p]));
+
+    // Build blocks array with full profileView objects and viewer state
+    const blocksWithProfiles = blocks
+      .map((b) => {
+        const profile = profileMap.get(b.blockedDid);
+        if (!profile) return null;
+
+        // Ensure viewer.blocking is set correctly
+        return {
+          ...profile,
+          viewer: {
+            ...profile.viewer,
+            blocking: b.uri, // Override with the specific block URI
+          },
+        };
+      })
+      .filter(Boolean);
 
     res.json({
       cursor,
-      blocks: blocks
-        .map((b) => {
-          const user = userMap.get(b.blockedDid);
-          if (!user) return null;
-          return {
-            did: user.did,
-            handle: user.handle,
-            displayName: user.displayName || user.handle,
-            ...maybeAvatar(user.avatarUrl, user.did, req),
-            viewer: {
-              blocking: b.uri,
-              muted: false,
-            },
-          };
-        })
-        .filter(Boolean),
+      blocks: blocksWithProfiles,
     });
   } catch (error) {
     handleError(res, error, 'getBlocks');
···
 /**
  * Get muted actors
  * GET /xrpc/app.bsky.graph.getMutes
+ *
+ * NOTE: Per ATProto architecture, mutes are private user preferences
+ * that belong on the PDS, NOT the AppView. Unlike blocks (which are public
+ * records), mutes are private metadata affecting content filtering.
+ *
+ * Returns error directing client to fetch from PDS directly.
  */
 export async function getMutes(req: Request, res: Response): Promise<void> {
   try {
-    const params = getMutesSchema.parse(req.query);
     const userDid = await requireAuthDid(req, res);
     if (!userDid) return;
 
-    const { mutes, cursor } = await storage.getMutes(
-      userDid,
-      params.limit,
-      params.cursor
-    );
-    const mutedDids = mutes.map((m) => m.mutedDid);
-    const mutedUsers = await storage.getUsers(mutedDids);
-    const userMap = new Map(mutedUsers.map((u) => [u.did, u]));
+    // Get user's PDS endpoint to include in error message
+    const pdsEndpoint = await getUserPdsEndpoint(userDid);
 
-    res.json({
-      cursor,
-      mutes: mutes
-        .map((m) => {
-          const user = userMap.get(m.mutedDid);
-          if (!user) return null;
-          return {
-            did: user.did,
-            handle: user.handle,
-            displayName: user.displayName || user.handle,
-            ...maybeAvatar(user.avatarUrl, user.did, req),
-            viewer: {
-              muted: true,
-            },
-          };
-        })
-        .filter(Boolean),
+    res.status(501).json({
+      error: 'NotImplemented',
+      message: 'Mutes must be fetched directly from your PDS, not through the AppView. ' +
+               'Per ATProto architecture, mutes are private user preferences stored on the PDS. ' +
+               'Unlike blocks (which are public records), mutes are private metadata. ' +
+               (pdsEndpoint
+                 ? `Please fetch from: ${pdsEndpoint}/xrpc/app.bsky.graph.getMutes`
+                 : 'Please fetch from your PDS using your PDS token.'),
+      pdsEndpoint: pdsEndpoint || undefined,
     });
   } catch (error) {
     handleError(res, error, 'getMutes');
···
 /**
  * Mute an actor
  * POST /xrpc/app.bsky.graph.muteActor
+ *
+ * NOTE: Per ATProto architecture, mutes are private user preferences
+ * that belong on the PDS, NOT the AppView.
+ *
+ * Returns error directing client to create mute on PDS directly.
  */
 export async function muteActor(req: Request, res: Response): Promise<void> {
   try {
-    const params = muteActorSchema.parse(req.body);
     const userDid = await requireAuthDid(req, res);
     if (!userDid) return;
 
-    const mutedDid = await resolveActor(res, params.actor);
-    if (!mutedDid) return;
+    // Get user's PDS endpoint to include in error message
+    const pdsEndpoint = await getUserPdsEndpoint(userDid);
 
-    await storage.createMute({
-      uri: `at://${userDid}/app.bsky.graph.mute/${Date.now()}`,
-      muterDid: userDid,
-      mutedDid,
-      createdAt: new Date(),
+    res.status(501).json({
+      error: 'NotImplemented',
+      message: 'Mutes must be created directly on your PDS, not through the AppView. ' +
+               'Per ATProto architecture, mutes are private user preferences stored on the PDS. ' +
+               (pdsEndpoint
+                 ? `Please create mute at: ${pdsEndpoint}/xrpc/app.bsky.graph.muteActor`
+                 : 'Please create mute on your PDS using your PDS token.'),
+      pdsEndpoint: pdsEndpoint || undefined,
     });
-
-    res.json({ success: true });
   } catch (error) {
     handleError(res, error, 'muteActor');
   }
···
 /**
  * Unmute an actor
  * POST /xrpc/app.bsky.graph.unmuteActor
+ *
+ * NOTE: Per ATProto architecture, mutes are private user preferences
+ * that belong on the PDS, NOT the AppView.
+ *
+ * Returns error directing client to delete mute on PDS directly.
  */
 export async function unmuteActor(req: Request, res: Response): Promise<void> {
   try {
-    const params = muteActorSchema.parse(req.body);
     const userDid = await requireAuthDid(req, res);
     if (!userDid) return;
 
-    const mutedDid = await resolveActor(res, params.actor);
-    if (!mutedDid) return;
+    // Get user's PDS endpoint to include in error message
+    const pdsEndpoint = await getUserPdsEndpoint(userDid);
 
-    const { mutes } = await storage.getMutes(userDid, 1000);
-    const mute = mutes.find((m) => m.mutedDid === mutedDid);
-
-    if (mute) {
-      await storage.deleteMute(mute.uri);
-    }
-
-    res.json({ success: true });
+    res.status(501).json({
+      error: 'NotImplemented',
+      message: 'Mutes must be removed directly on your PDS, not through the AppView. ' +
+               'Per ATProto architecture, mutes are private user preferences stored on the PDS. ' +
+               (pdsEndpoint
+                 ? `Please remove mute at: ${pdsEndpoint}/xrpc/app.bsky.graph.unmuteActor`
+                 : 'Please remove mute on your PDS using your PDS token.'),
+      pdsEndpoint: pdsEndpoint || undefined,
+    });
   } catch (error) {
     handleError(res, error, 'unmuteActor');
   }
···
 /**
  * Mute a list
  * POST /xrpc/app.bsky.graph.muteActorList
+ *
+ * NOTE: Per ATProto architecture, list mutes are private user preferences
+ * that belong on the PDS, NOT the AppView.
+ *
+ * Returns error directing client to create list mute on PDS directly.
  */
 export async function muteActorList(
   req: Request,
   res: Response
 ): Promise<void> {
   try {
-    const params = muteActorListSchema.parse(req.body);
     const userDid = await requireAuthDid(req, res);
     if (!userDid) return;
 
-    // Verify list exists
-    const list = await storage.getList(params.list);
-    if (!list) {
-      res.status(404).json({ error: 'List not found' });
-      return;
-    }
+    // Get user's PDS endpoint to include in error message
+    const pdsEndpoint = await getUserPdsEndpoint(userDid);
 
-    await storage.createListMute({
-      uri: `at://${userDid}/app.bsky.graph.listMute/${Date.now()}`,
-      muterDid: userDid,
-      listUri: params.list,
-      createdAt: new Date(),
+    res.status(501).json({
+      error: 'NotImplemented',
+      message: 'List mutes must be created directly on your PDS, not through the AppView. ' +
+               'Per ATProto architecture, mutes are private user preferences stored on the PDS. ' +
+               (pdsEndpoint
+                 ? `Please create list mute at: ${pdsEndpoint}/xrpc/app.bsky.graph.muteActorList`
+                 : 'Please create list mute on your PDS using your PDS token.'),
+      pdsEndpoint: pdsEndpoint || undefined,
     });
-
-    res.json({ success: true });
   } catch (error) {
     handleError(res, error, 'muteActorList');
   }
···
 /**
  * Unmute a list
  * POST /xrpc/app.bsky.graph.unmuteActorList
+ *
+ * NOTE: Per ATProto architecture, list mutes are private user preferences
+ * that belong on the PDS, NOT the AppView.
+ *
+ * Returns error directing client to delete list mute on PDS directly.
  */
 export async function unmuteActorList(
   req: Request,
   res: Response
 ): Promise<void> {
   try {
-    const params = unmuteActorListSchema.parse(req.body);
     const userDid = await requireAuthDid(req, res);
     if (!userDid) return;
 
-    const { mutes } = await storage.getListMutes(userDid, 1000);
-    const mute = mutes.find((m) => m.listUri === params.list);
+    // Get user's PDS endpoint to include in error message
+    const pdsEndpoint = await getUserPdsEndpoint(userDid);
 
-    if (mute) {
-      await storage.deleteListMute(mute.uri);
-    }
-
-    res.json({ success: true });
+    res.status(501).json({
+      error: 'NotImplemented',
+      message: 'List mutes must be removed directly on your PDS, not through the AppView. ' +
+               'Per ATProto architecture, mutes are private user preferences stored on the PDS. ' +
+               (pdsEndpoint
+                 ? `Please remove list mute at: ${pdsEndpoint}/xrpc/app.bsky.graph.unmuteActorList`
+                 : 'Please remove list mute on your PDS using your PDS token.'),
+      pdsEndpoint: pdsEndpoint || undefined,
+    });
   } catch (error) {
     handleError(res, error, 'unmuteActorList');
   }
···
 /**
  * Mute a thread
  * POST /xrpc/app.bsky.graph.muteThread
+ *
+ * NOTE: Per ATProto architecture, thread mutes are private user preferences
+ * that belong on the PDS, NOT the AppView.
+ *
+ * Returns error directing client to create thread mute on PDS directly.
  */
 export async function muteThread(req: Request, res: Response): Promise<void> {
   try {
-    const params = muteThreadSchema.parse(req.body);
     const userDid = await requireAuthDid(req, res);
     if (!userDid) return;
 
-    // Verify thread root post exists
-    const rootPost = await storage.getPost(params.root);
-    if (!rootPost) {
-      res.status(404).json({ error: 'Thread root post not found' });
-      return;
-    }
+    // Get user's PDS endpoint to include in error message
+    const pdsEndpoint = await getUserPdsEndpoint(userDid);
 
-    // Create thread mute
-    await storage.createThreadMute({
-      uri: `at://${userDid}/app.bsky.graph.threadMute/${Date.now()}`,
-      muterDid: userDid,
-      threadRootUri: params.root,
-      createdAt: new Date(),
+    res.status(501).json({
+      error: 'NotImplemented',
+      message: 'Thread mutes must be created directly on your PDS, not through the AppView. ' +
+               'Per ATProto architecture, mutes are private user preferences stored on the PDS. ' +
+               (pdsEndpoint
+                 ? `Please create thread mute at: ${pdsEndpoint}/xrpc/app.bsky.graph.muteThread`
+                 : 'Please create thread mute on your PDS using your PDS token.'),
+      pdsEndpoint: pdsEndpoint || undefined,
     });
-
-    res.json({ success: true });
   } catch (error) {
     handleError(res, error, 'muteThread');
   }
···
 /**
  * Unmute a thread
  * POST /xrpc/app.bsky.graph.unmuteThread
+ *
+ * NOTE: Per ATProto architecture, thread mutes are private user preferences
+ * that belong on the PDS, NOT the AppView.
+ *
+ * Returns error directing client to remove thread mute on PDS directly.
  */
 export async function unmuteThread(req: Request, res: Response): Promise<void> {
   try {
-    const body = muteThreadSchema.parse(req.body);
     const userDid = await requireAuthDid(req, res);
     if (!userDid) return;
 
-    const { mutes } = await storage.getThreadMutes(userDid, 1000);
-    const existing = mutes.find((m) => m.threadRootUri === body.root);
+    // Get user's PDS endpoint to include in error message
+    const pdsEndpoint = await getUserPdsEndpoint(userDid);
 
-    if (existing) {
-      await storage.deleteThreadMute(existing.uri);
-    }
-
-    res.json({ success: true });
+    res.status(501).json({
+      error: 'NotImplemented',
+      message: 'Thread mutes must be removed directly on your PDS, not through the AppView. ' +
+               'Per ATProto architecture, mutes are private user preferences stored on the PDS. ' +
+               (pdsEndpoint
+                 ? `Please remove thread mute at: ${pdsEndpoint}/xrpc/app.bsky.graph.unmuteThread`
+                 : 'Please remove thread mute on your PDS using your PDS token.'),
+      pdsEndpoint: pdsEndpoint || undefined,
+    });
   } catch (error) {
     handleError(res, error, 'unmuteThread');
   }
···
     const params = queryLabelsSchema.parse(req.query);
     const subjects = params.uriPatterns ?? [];
 
+    // Validate wildcard usage
     if (subjects.some((u) => u.includes('*'))) {
       res.status(400).json({
         error: 'InvalidRequest',
···
       return;
     }
 
-    const sources = params.sources ?? [];
-    if (sources.length === 0) {
-      res.status(400).json({
-        error: 'InvalidRequest',
-        message: 'source dids are required',
-      });
-      return;
-    }
+    // Sources are optional - if not provided, return labels from all sources
+    const sources = params.sources;
 
-    const labels = await storage.getLabelsForSubjects(subjects);
-    const filtered = labels.filter((l) => sources.includes(l.src));
+    // Use the proper storage.queryLabels method which handles filtering in DB
+    const labels = await storage.queryLabels({
+      subjects: subjects.length > 0 ? subjects : undefined,
+      sources: sources && sources.length > 0 ? sources : undefined,
+      limit: params.limit,
+    });
 
-    res.json({ cursor: undefined, labels: filtered });
+    // Note: Cursor-based pagination not yet implemented in storage layer
+    // AT Protocol spec allows cursor to be undefined if pagination not supported
+    res.json({ cursor: undefined, labels });
   } catch (error) {
     handleError(res, error, 'queryLabels');
   }
···
 export async function createReport(req: Request, res: Response): Promise<void> {
   try {
     const params = createReportSchema.parse(req.body);
-    const reporterDid =
-      (await getAuthenticatedDid(req)) ||
-      (req as any).user?.did ||
-      'did:unknown:anonymous';
+
+    // Require authentication - reports must be from known users
+    const reporterDid = await requireAuthDid(req, res);
+    if (!reporterDid) return;
+
+    // Determine subject and subjectType from the subject object
+    let subject: string;
+    let subjectType: 'post' | 'account' | 'message';
+
+    if (params.subject.uri) {
+      subject = params.subject.uri;
+      // Determine type from URI
+      if (params.subject.uri.includes('app.bsky.feed.post')) {
+        subjectType = 'post';
+      } else if (params.subject.uri.includes('chat.bsky.convo.message')) {
+        subjectType = 'message';
+      } else {
+        // Default to post for other URIs
+        subjectType = 'post';
+      }
+    } else if (params.subject.did) {
+      subject = params.subject.did;
+      subjectType = 'account';
+    } else {
+      res.status(400).json({
+        error: 'InvalidRequest',
+        message: 'subject must contain either uri or did',
+      });
+      return;
+    }
 
     const report = await storage.createModerationReport({
       reporterDid,
-      reasonType: params.reasonType,
+      reportType: params.reasonType, // Note: DB field is 'reportType' not 'reasonType'
       reason: params.reason || null,
-      subject:
-        params.subject.uri ||
-        params.subject.did ||
-        params.subject.cid ||
-        'unknown',
+      subject,
+      subjectType,
+      status: 'pending', // Use correct default status
       createdAt: new Date(),
-      status: 'open',
-    } as any);
+    });
 
-    res.json({ id: report.id, success: true });
+    res.json({
+      id: report.id,
+      reasonType: report.reportType,
+      reason: report.reason,
+      subject: {
+        $type: params.subject.$type,
+        uri: params.subject.uri,
+        did: params.subject.did,
+        cid: params.subject.cid,
+      },
+      reportedBy: reporterDid,
+      createdAt: report.createdAt.toISOString(),
+    });
   } catch (error) {
     handleError(res, error, 'createReport');
   }

server/services/xrpc/services/notification-service.ts

···
 import { transformBlobToCdnUrl } from '../utils/serializers';
 import {
   listNotificationsSchema,
+  getUnreadCountSchema,
   updateSeenSchema,
   getNotificationPreferencesSchema,
   putNotificationPreferencesSchema,
···
     const notificationsList = await storage.getNotifications(
       userDid,
       params.limit,
-      params.cursor
+      params.cursor,
+      params.seenAt ? new Date(params.seenAt) : undefined
     );
     console.log(
       `[listNotifications] Found ${notificationsList.length} notifications`
···
       .map((n) => (n as { reasonSubject?: string }).reasonSubject)
       .filter((uri): uri is string => !!uri);
 
+    // Batch fetch all posts at once (not one by one)
+    const postsMap = new Map<string, any>();
     if (postUris.length > 0) {
-      // Check which posts exist
       const existingPosts = await storage.getPosts(postUris);
-      const existingUris = new Set(existingPosts.map((p) => p.uri));
-      const missingUris = postUris.filter((uri) => !existingUris.has(uri));
+      existingPosts.forEach((post) => postsMap.set(post.uri, post));
 
+      const missingUris = postUris.filter((uri) => !postsMap.has(uri));
       if (missingUris.length > 0) {
         console.log(
           `[listNotifications] ${missingUris.length} notification posts not in database (will be backfilled on login)`
···
     // Author profiles should be available from firehose events
     const authors = await storage.getUsers(authorDids);
     const authorMap = new Map(authors.map((a) => [a.did, a]));
+
+    // Get viewer relationships with all authors
+    const relationships = await storage.getRelationships(userDid, authorDids);
 
     const items = await Promise.all(
       notificationsList.map(async (n) => {
···
         };
 
         if (reasonSubject) {
-          try {
-            // For post-related notifications, check if the post still exists
-            if (
-              notification.reason === 'like' ||
-              notification.reason === 'repost' ||
-              notification.reason === 'reply' ||
-              notification.reason === 'quote'
-            ) {
-              const post = await storage.getPost(reasonSubject);
-              if (!post) {
-                // Post was deleted, filter out this notification
-                return null;
-              }
-              const postData = post as {
-                text: string;
-                createdAt: Date;
-                embed?: unknown;
-                facets?: unknown;
-              };
-              record = {
-                $type: 'app.bsky.feed.post',
-                text: postData.text,
-                createdAt: postData.createdAt.toISOString(),
-              };
-              if (postData.embed)
-                (record as { embed?: unknown }).embed = postData.embed;
-              if (postData.facets)
-                (record as { facets?: unknown }).facets = postData.facets;
+          // For post-related notifications, check if the post still exists
+          if (
+            notification.reason === 'like' ||
+            notification.reason === 'repost' ||
+            notification.reason === 'reply' ||
+            notification.reason === 'quote'
+          ) {
+            const post = postsMap.get(reasonSubject);
+            if (!post) {
+              // Post was deleted or not found, filter out this notification
+              return null;
             }
-          } catch (error) {
-            console.warn(
-              '[NOTIFICATIONS] Failed to fetch record for subject:',
-              { reasonSubject },
-              error
-            );
-            // If we can't fetch the record, filter out this notification
-            return null;
+            const postData = post as {
+              text: string;
+              createdAt: Date;
+              embed?: unknown;
+              facets?: unknown;
+            };
+            record = {
+              $type: 'app.bsky.feed.post',
+              text: postData.text,
+              createdAt: postData.createdAt.toISOString(),
+            };
+            if (postData.embed)
+              (record as { embed?: unknown }).embed = postData.embed;
+            if (postData.facets)
+              (record as { facets?: unknown }).facets = postData.facets;
           }
         } else {
           // For notifications without a reasonSubject (like follows), create a fallback
···
           createdAt?: Date;
         };
 
+        // Get actual viewer state for this author
+        const viewerState = relationships.get(authorData.did);
+        const viewer: {
+          muted: boolean;
+          blockedBy: boolean;
+          blocking?: string;
+          following?: string;
+          followedBy?: string;
+        } = {
+          muted: viewerState ? !!viewerState.muting : false,
+          blockedBy: viewerState?.blockedBy || false,
+        };
+        if (viewerState?.blocking) viewer.blocking = viewerState.blocking;
+        if (viewerState?.following) viewer.following = viewerState.following;
+        if (viewerState?.followedBy) viewer.followedBy = viewerState.followedBy;
+
         const view = {
           $type: 'app.bsky.notification.listNotifications#notification',
           uri: notificationUri,
···
             displayName: authorData.displayName ?? authorData.handle,
             pronouns: authorData.pronouns,
             ...maybeAvatar(authorData.avatarUrl, authorData.did, req),
-            associated: {
-              $type: 'app.bsky.actor.defs#profileAssociated',
-              lists: 0,
-              feedgens: 0,
-              starterPacks: 0,
-              labeler: false,
-              chat: undefined,
-              activitySubscription: undefined,
-            },
-            viewer: {
-              $type: 'app.bsky.actor.defs#viewerState',
-              muted: false,
-              mutedByList: undefined,
-              blockedBy: false,
-              blocking: undefined,
-              blockingByList: undefined,
-              following: undefined,
-              followedBy: undefined,
-              knownFollowers: undefined,
-              activitySubscription: undefined,
-            },
-            labels: [],
-            createdAt: authorData.createdAt?.toISOString(),
-            verification: undefined,
-            status: undefined,
+            viewer,
           },
         };
         return view;
···
   res: Response
 ): Promise<void> {
   try {
+    const params = getUnreadCountSchema.parse(req.query);
     const userDid = await requireAuthDid(req, res);
     if (!userDid) return;
-    const count = await storage.getUnreadNotificationCount(userDid);
-    res.json({ count });
+
+    // If seenAt is provided, count only notifications after that time
+    let count: number;
+    if (params.seenAt) {
+      const seenAtDate = new Date(params.seenAt);
+      const allNotifications = await storage.getNotifications(
+        userDid,
+        1000, // High limit to get all recent
+        undefined,
+        undefined // No seenAt filter here
+      );
+      // Count unread notifications that occurred after seenAt
+      count = allNotifications.filter(
+        (n) => !n.isRead && n.indexedAt > seenAtDate
+      ).length;
+    } else {
+      // No seenAt filter - just count all unread
+      count = await storage.getUnreadNotificationCount(userDid);
+    }
+
+    // Get user's last seenAt from preferences
+    const prefs = await storage.getUserPreferences(userDid);
+    const lastSeenAt = (prefs as { lastNotificationSeenAt?: Date })
+      ?.lastNotificationSeenAt;
+
+    res.json({
+      count,
+      ...(lastSeenAt && { seenAt: lastSeenAt.toISOString() }),
+    });
   } catch (error) {
     handleError(res, error, 'getUnreadCount');
   }
···
     const params = updateSeenSchema.parse(req.body);
     const userDid = await requireAuthDid(req, res);
     if (!userDid) return;
-    await storage.markNotificationsAsRead(
-      userDid,
-      params.seenAt ? new Date(params.seenAt) : undefined
-    );
-    res.json({ success: true });
+
+    const seenAtDate = new Date(params.seenAt);
+
+    // Mark notifications as read up to the seenAt timestamp
+    await storage.markNotificationsAsRead(userDid, seenAtDate);
+
+    // Update user's lastNotificationSeenAt preference for cross-device sync
+    const prefs = await storage.getUserPreferences(userDid);
+    if (prefs) {
+      await storage.updateUserPreferences(userDid, {
+        lastNotificationSeenAt: seenAtDate,
+      } as any);
+    } else {
+      // Create preferences if they don't exist
+      await storage.createUserPreferences({
+        userDid,
+        lastNotificationSeenAt: seenAtDate,
+      } as any);
+    }
+
+    // AT Protocol spec: return empty object on success
+    res.json({});
   } catch (error) {
     handleError(res, error, 'updateSeen');
   }
···
 /**
  * Get notification preferences
  * GET /xrpc/app.bsky.notification.getPreferences
+ *
+ * NOTE: Unlike app.bsky.actor.getPreferences (which retrieves general account preferences
+ * from the PDS), notification preferences are stored on the AppView because they control
+ * how THIS AppView delivers notifications to the user.
+ *
+ * Architectural rationale:
+ * - Notification preferences are service-level settings specific to each AppView instance
+ * - These settings control how the AppView processes and filters notifications
+ * - The AppView needs direct access to these preferences to deliver notifications
+ * - These are NOT portable user preferences that should travel between services
+ *
+ * Per ATProto architecture, this pattern is acknowledged as "not ideal" but is the
+ * current design for notification delivery services. The app.bsky.notification.*
+ * namespace is intentionally distinct from app.bsky.actor.* to reflect this difference.
  */
 export async function getNotificationPreferences(
   req: Request,
···
 /**
  * Update notification preferences
  * POST /xrpc/app.bsky.notification.putPreferences
+ *
+ * NOTE: Unlike app.bsky.actor.putPreferences (which stores general account preferences
+ * on the PDS), notification preferences are stored on the AppView because they control
+ * how THIS AppView delivers notifications to the user.
+ *
+ * Architectural rationale:
+ * - Notification preferences are service-level settings specific to each AppView instance
+ * - These settings control how the AppView processes and filters notifications
+ * - The AppView needs direct access to these preferences to deliver notifications
+ * - These are NOT portable user preferences that should travel between services
+ *
+ * Per ATProto architecture, this pattern is acknowledged as "not ideal" but is the
+ * current design for notification delivery services. The app.bsky.notification.*
+ * namespace is intentionally distinct from app.bsky.actor.* to reflect this difference.
  */
 export async function putNotificationPreferences(
   req: Request,
···
 /**
  * Update notification preferences (V2)
  * POST /xrpc/app.bsky.notification.putPreferencesV2
+ *
+ * ATProto-compliant notification preferences supporting all 13 notification categories
+ *
+ * NOTE: Unlike app.bsky.actor.putPreferences (which stores general account preferences
+ * on the PDS), notification preferences are stored on the AppView because they control
+ * how THIS AppView delivers notifications to the user.
+ *
+ * Architectural rationale:
+ * - Notification preferences are service-level settings specific to each AppView instance
+ * - These settings control how the AppView processes and filters notifications
+ * - The AppView needs direct access to these preferences to deliver notifications
+ * - These are NOT portable user preferences that should travel between services
+ *
+ * Per ATProto architecture, this pattern is acknowledged as "not ideal" but is the
+ * current design for notification delivery services. The app.bsky.notification.*
+ * namespace is intentionally distinct from app.bsky.actor.* to reflect this difference.
  */
 export async function putNotificationPreferencesV2(
   req: Request,
···
     const params = putNotificationPreferencesV2Schema.parse(req.body);
     const userDid = await requireAuthDid(req, res);
     if (!userDid) return;
-    let prefs = await storage.getUserPreferences(userDid);
-    if (!prefs) {
-      prefs = await storage.createUserPreferences({
+
+    // Get existing preferences or create with defaults
+    let userPrefs = await storage.getUserPreferences(userDid);
+    if (!userPrefs) {
+      userPrefs = await storage.createUserPreferences({
         userDid,
-        notificationPriority: !!params.priority,
-      } as {
-        userDid: string;
-        notificationPriority: boolean;
-      });
-    } else {
-      prefs = await storage.updateUserPreferences(userDid, {
-        notificationPriority:
-          params.priority ??
-          (prefs as { notificationPriority: boolean }).notificationPriority,
-      });
+      } as any);
     }
+
+    // Get current notification preferences V2 (or use defaults)
+    const currentPrefs = (userPrefs as any).notificationPreferencesV2 || {
+      chat: { include: 'accepted', push: true },
+      follow: { list: true, push: true, include: 'all' },
+      like: { list: true, push: false, include: 'follows' },
+      mention: { list: true, push: true, include: 'all' },
+      reply: { list: true, push: true, include: 'all' },
+      repost: { list: true, push: false, include: 'follows' },
+      quote: { list: true, push: true, include: 'all' },
+      likeViaRepost: { list: false, push: false, include: 'all' },
+      repostViaRepost: { list: false, push: false, include: 'all' },
+      starterpackJoined: { list: true, push: false },
+      subscribedPost: { list: true, push: true },
+      unverified: { list: true, push: false },
+      verified: { list: true, push: true },
+    };
+
+    // Merge new preferences with existing (partial update)
+    const updatedPrefs = {
+      chat: params.chat ?? currentPrefs.chat,
+      follow: params.follow ?? currentPrefs.follow,
+      like: params.like ?? currentPrefs.like,
+      mention: params.mention ?? currentPrefs.mention,
+      reply: params.reply ?? currentPrefs.reply,
+      repost: params.repost ?? currentPrefs.repost,
+      quote: params.quote ?? currentPrefs.quote,
+      likeViaRepost: params.likeViaRepost ?? currentPrefs.likeViaRepost,
+      repostViaRepost: params.repostViaRepost ?? currentPrefs.repostViaRepost,
+      starterpackJoined:
+        params.starterpackJoined ?? currentPrefs.starterpackJoined,
+      subscribedPost: params.subscribedPost ?? currentPrefs.subscribedPost,
+      unverified: params.unverified ?? currentPrefs.unverified,
+      verified: params.verified ?? currentPrefs.verified,
+    };
+
+    // Update preferences in database
+    await storage.updateUserPreferences(userDid, {
+      notificationPreferencesV2: updatedPrefs,
+    } as any);
+
+    // Return preferences in ATProto format (object, not array)
     res.json({
-      preferences: [
-        {
-          $type: 'app.bsky.notification.defs#preferences',
-          priority:
-            (prefs as { notificationPriority?: boolean })
-              ?.notificationPriority ?? false,
-        },
-      ],
+      preferences: {
+        $type: 'app.bsky.notification.defs#preferences',
+        ...updatedPrefs,
+      },
     });
   } catch (error) {
     handleError(res, error, 'putNotificationPreferencesV2');
···
 }
 
 /**
+ * Get notification preferences (V2)
+ * GET /xrpc/app.bsky.notification.getPreferencesV2
+ *
+ * Returns full notification preferences for all 13 categories
+ *
+ * NOTE: Unlike app.bsky.actor.getPreferences (which retrieves general account preferences
+ * from the PDS), notification preferences are stored on the AppView because they control
+ * how THIS AppView delivers notifications to the user.
+ *
+ * Architectural rationale:
+ * - Notification preferences are service-level settings specific to each AppView instance
+ * - These settings control how the AppView processes and filters notifications
+ * - The AppView needs direct access to these preferences to deliver notifications
+ * - These are NOT portable user preferences that should travel between services
+ *
+ * Per ATProto architecture, this pattern is acknowledged as "not ideal" but is the
+ * current design for notification delivery services. The app.bsky.notification.*
+ * namespace is intentionally distinct from app.bsky.actor.* to reflect this difference.
+ */
+export async function getNotificationPreferencesV2(
+  req: Request,
+  res: Response
+): Promise<void> {
+  try {
+    const userDid = await requireAuthDid(req, res);
+    if (!userDid) return;
+
+    const userPrefs = await storage.getUserPreferences(userDid);
+
+    // Get notification preferences V2 (or use defaults)
+    const prefs = (userPrefs as any)?.notificationPreferencesV2 || {
+      chat: { include: 'accepted', push: true },
+      follow: { list: true, push: true, include: 'all' },
+      like: { list: true, push: false, include: 'follows' },
+      mention: { list: true, push: true, include: 'all' },
+      reply: { list: true, push: true, include: 'all' },
+      repost: { list: true, push: false, include: 'follows' },
+      quote: { list: true, push: true, include: 'all' },
+      likeViaRepost: { list: false, push: false, include: 'all' },
+      repostViaRepost: { list: false, push: false, include: 'all' },
+      starterpackJoined: { list: true, push: false },
+      subscribedPost: { list: true, push: true },
+      unverified: { list: true, push: false },
+      verified: { list: true, push: true },
+    };
+
+    res.json({
+      preferences: {
+        $type: 'app.bsky.notification.defs#preferences',
+        ...prefs,
+      },
+    });
+  } catch (error) {
+    handleError(res, error, 'getNotificationPreferencesV2');
+  }
+}
+
+/**
  * List activity subscriptions
  * GET /xrpc/app.bsky.notification.listActivitySubscriptions
+ *
+ * Returns profile views of accounts the user has subscribed to for activity notifications
+ * Per ATProto spec: "Enumerate all accounts to which the requesting account is subscribed to receive notifications for."
  */
 export async function listActivitySubscriptions(
   req: Request,
   res: Response
 ): Promise<void> {
   try {
-    listActivitySubscriptionsSchema.parse(req.query);
+    const params = listActivitySubscriptionsSchema.parse(req.query);
     const userDid = await requireAuthDid(req, res);
     if (!userDid) return;
-    const subs = await storage.getUserPushSubscriptions(userDid);
+
+    // Get activity subscriptions (accounts user is subscribed to)
+    const result = await storage.getActivitySubscriptions(
+      userDid,
+      params.limit,
+      params.cursor
+    );
+
+    // Extract subject DIDs (accounts user is subscribed to)
+    const subjectDids = result.subscriptions.map((sub) => sub.subjectDid);
+
+    if (subjectDids.length === 0) {
+      res.json({
+        subscriptions: [],
+        cursor: result.cursor,
+      });
+      return;
+    }
+
+    // Get full profile views for subscribed accounts
+    const { xrpcApi } = await import('../../xrpc-api');
+    const profiles = await (xrpcApi as any)._getProfiles(subjectDids, req);
+
     res.json({
-      subscriptions: (
-        subs as {
-          id: string;
-          platform: string;
-          appId?: string;
-          createdAt: Date;
-          updatedAt: Date;
-        }[]
-      ).map((s) => ({
-        id: s.id,
-        platform: s.platform,
-        appId: s.appId,
-        createdAt: s.createdAt.toISOString(),
-        updatedAt: s.updatedAt.toISOString(),
-      })),
+      subscriptions: profiles,
+      cursor: result.cursor,
     });
   } catch (error) {
     handleError(res, error, 'listActivitySubscriptions');
···
 /**
  * Update activity subscription
  * POST /xrpc/app.bsky.notification.putActivitySubscription
+ *
+ * Creates or updates an activity subscription for a specific account
+ * Per ATProto spec: "Puts an activity subscription entry. The key should be omitted for creation and provided for updates."
  */
 export async function putActivitySubscription(
   req: Request,
···
     const body = putActivitySubscriptionSchema.parse(req.body);
     const userDid = await requireAuthDid(req, res);
     if (!userDid) return;
-    // Upsert a synthetic web subscription for parity
-    await storage.createPushSubscription({
-      userDid,
-      platform: 'web',
-      token: `activity-${userDid}`,
-      endpoint: undefined,
-      keys: undefined,
-      appId: body.subject || undefined,
-    } as {
-      userDid: string;
-      platform: string;
-      token: string;
-      endpoint?: string;
-      keys?: string;
-      appId?: string;
+
+    // Validate that subject is a valid DID
+    if (!body.subject || !body.subject.startsWith('did:')) {
+      res.status(400).json({
+        error: 'InvalidRequest',
+        message: 'Subject must be a valid DID',
+      });
+      return;
+    }
+
+    // Check if subject user exists
+    const subjectUser = await storage.getUser(body.subject);
+    if (!subjectUser) {
+      res.status(404).json({
+        error: 'NotFound',
+        message: 'Subject account not found',
+      });
+      return;
+    }
+
+    // Create AT URI for the activity subscription
+    // Format: at://{subscriberDid}/app.bsky.notification.activitySubscription/{rkey}
+    // Use subjectDid as rkey for uniqueness
+    const rkey = body.subject.replace(/[^a-zA-Z0-9]/g, '-');
+    const uri = `at://${userDid}/app.bsky.notification.activitySubscription/${rkey}`;
+
+    // Generate a CID (in production, this would be calculated from the record)
+    const cid = `bafyrei${Buffer.from(`${uri}-${Date.now()}`).toString('base64url').slice(0, 44)}`;
+
+    // Check if subscription already exists
+    const existing = await storage.getActivitySubscription(uri);
+
+    if (existing) {
+      // Update existing subscription
+      // Note: For now, we don't have an update method, so we'll delete and recreate
+      await storage.deleteActivitySubscription(uri);
+    }
+
+    // Create/update the activity subscription
+    const subscription = await storage.createActivitySubscription({
+      uri,
+      cid,
+      subscriberDid: userDid,
+      subjectDid: body.subject,
+      priority: body.activitySubscription.post || body.activitySubscription.reply,
+      createdAt: new Date(),
+    });
+
+    // Get profile view for the subject
+    const { xrpcApi } = await import('../../xrpc-api');
+    const profiles = await (xrpcApi as any)._getProfiles([body.subject], req);
+
+    res.json({
+      subject: body.subject,
+      activitySubscription: {
+        post: body.activitySubscription.post,
+        reply: body.activitySubscription.reply,
+      },
+      // Return profile view for convenience
+      profile: profiles[0] || null,
     });
-    res.json({ success: true });
   } catch (error) {
     handleError(res, error, 'putActivitySubscription');
   }

server/services/xrpc/services/post-interaction-service.ts

···
 import { storage } from '../../../storage';
 import { handleError } from '../utils/error-handler';
 import { maybeAvatar } from '../utils/serializers';
-import { getAuthenticatedDid } from '../utils/auth-helpers';
+import { getAuthenticatedDid, requireAuthDid } from '../utils/auth-helpers';
 import {
   getPostsSchema,
   getLikesSchema,
···
       params.limit,
       params.cursor
     );
+
+    if (likes.length === 0) {
+      return res.json({
+        uri: params.uri,
+        cid: params.cid,
+        cursor,
+        likes: [],
+      });
+    }
+
     const userDids = likes.map((like) => like.userDid);
-    const users = await storage.getUsers(userDids);
+
+    // Batch fetch all required data
+    const [
+      users,
+      relationships,
+      listMutes,
+      listBlocks,
+      allLabels,
+      listCounts,
+      feedgenCounts,
+      starterPackCounts,
+      labelerStatuses,
+    ] = await Promise.all([
+      storage.getUsers(userDids),
+      viewerDid
+        ? storage.getRelationships(viewerDid, userDids)
+        : Promise.resolve(new Map()),
+      viewerDid
+        ? storage.getListMutesForUsers(viewerDid, userDids)
+        : Promise.resolve(new Map()),
+      viewerDid
+        ? storage.getListBlocksForUsers(viewerDid, userDids)
+        : Promise.resolve(new Map()),
+      storage.getLabelsForSubjects(userDids),
+      storage.getUsersListCounts(userDids),
+      storage.getUsersFeedGeneratorCounts(userDids),
+      Promise.all(
+        userDids.map(async (did) => {
+          const packs = await storage.getStarterPacksByCreator(did);
+          return { did, count: packs.starterPacks.length };
+        })
+      ),
+      Promise.all(
+        userDids.map(async (did) => {
+          const labelers = await storage.getLabelerServicesByCreator(did);
+          return { did, isLabeler: labelers.length > 0 };
+        })
+      ),
+    ]);
+
     const userMap = new Map(users.map((u) => [u.did, u]));
+    const starterPackCountMap = new Map(
+      starterPackCounts.map((sp) => [sp.did, sp.count])
+    );
+    const labelerStatusMap = new Map(
+      labelerStatuses.map((ls) => [ls.did, ls.isLabeler])
+    );
 
-    const relationships = viewerDid
-      ? await storage.getRelationships(viewerDid, userDids)
-      : new Map();
+    // Fetch list data for mutes/blocks
+    const listUris = new Set<string>();
+    listMutes.forEach((mute) => listUris.add(mute.listUri));
+    listBlocks.forEach((block) => listUris.add(block.listUri));
+
+    const listData = new Map<string, any>();
+    if (listUris.size > 0) {
+      const lists = await Promise.all(
+        Array.from(listUris).map((uri) => storage.getList(uri))
+      );
+      lists.forEach((list, index) => {
+        if (list) {
+          listData.set(Array.from(listUris)[index], list);
+        }
+      });
+    }
+
+    // Group labels by subject
+    const labelsBySubject = new Map<string, any[]>();
+    allLabels.forEach((label) => {
+      if (!labelsBySubject.has(label.subject)) {
+        labelsBySubject.set(label.subject, []);
+      }
+      labelsBySubject.get(label.subject)!.push(label);
+    });
 
     res.json({
       uri: params.uri,
       cid: params.cid,
-      cursor: cursor,
+      cursor,
       likes: likes
         .map((like) => {
           const user = userMap.get(like.userDid);
···
           const viewerState = viewerDid
             ? relationships.get(like.userDid)
             : null;
-          const viewer: any = {
-            muted: viewerState ? !!viewerState.muting : false,
-            blockedBy: viewerState?.blockedBy || false,
+          const mutingList = viewerDid ? listMutes.get(like.userDid) : null;
+          const blockingList = viewerDid ? listBlocks.get(like.userDid) : null;
+
+          // Build viewer state
+          const viewer: any = {};
+          if (viewerDid) {
+            viewer.muted = !!viewerState?.muting || !!mutingList;
+            if (mutingList) {
+              const list = listData.get(mutingList.listUri);
+              if (list) {
+                viewer.mutedByList = {
+                  $type: 'app.bsky.graph.defs#listViewBasic',
+                  uri: list.uri,
+                  name: list.name,
+                  purpose: list.purpose,
+                };
+              }
+            }
+            viewer.blockedBy = viewerState?.blockedBy || false;
+            if (blockingList) {
+              const list = listData.get(blockingList.listUri);
+              if (list) {
+                viewer.blocking = blockingList.uri;
+                viewer.blockingByList = {
+                  $type: 'app.bsky.graph.defs#listViewBasic',
+                  uri: list.uri,
+                  name: list.name,
+                  purpose: list.purpose,
+                };
+              }
+            } else if (viewerState?.blocking) {
+              viewer.blocking = viewerState.blocking;
+            }
+            if (viewerState?.following) viewer.following = viewerState.following;
+            if (viewerState?.followedBy)
+              viewer.followedBy = viewerState.followedBy;
+          }
+
+          // Build full profileView
+          const profileView: any = {
+            $type: 'app.bsky.actor.defs#profileView',
+            did: user.did,
+            handle: user.handle,
+            displayName: user.displayName || user.handle,
           };
-          if (viewerState?.blocking) viewer.blocking = viewerState.blocking;
-          if (viewerState?.following) viewer.following = viewerState.following;
-          if (viewerState?.followedBy)
-            viewer.followedBy = viewerState.followedBy;
+
+          // Add optional fields
+          if (user.description) {
+            profileView.description = user.description;
+          }
+
+          const avatar = maybeAvatar(user.avatarUrl, user.did, req);
+          if (avatar.avatar) {
+            profileView.avatar = avatar.avatar;
+          }
+
+          // Add associated counts
+          profileView.associated = {
+            $type: 'app.bsky.actor.defs#profileAssociated',
+            lists: listCounts.get(like.userDid) || 0,
+            feedgens: feedgenCounts.get(like.userDid) || 0,
+            starterPacks: starterPackCountMap.get(like.userDid) || 0,
+            labeler: labelerStatusMap.get(like.userDid) || false,
+          };
+
+          // Add indexedAt
+          if (user.indexedAt) {
+            profileView.indexedAt = user.indexedAt.toISOString();
+          }
+
+          // Add createdAt
+          if (user.createdAt) {
+            profileView.createdAt = user.createdAt.toISOString();
+          }
+
+          // Add viewer state
+          if (Object.keys(viewer).length > 0) {
+            profileView.viewer = viewer;
+          }
+
+          // Add labels
+          const labels = labelsBySubject.get(like.userDid) || [];
+          if (labels.length > 0) {
+            profileView.labels = labels.map((l: any) => ({
+              src: l.src,
+              uri: l.uri,
+              val: l.val,
+              neg: l.neg,
+              cts: l.createdAt.toISOString(),
+            }));
+          }
 
           return {
-            actor: {
-              did: user.did,
-              handle: user.handle,
-              displayName: user.displayName || user.handle,
-              ...maybeAvatar(user.avatarUrl, user.did, req),
-              viewer,
-            },
+            indexedAt: like.indexedAt.toISOString(),
             createdAt: like.createdAt.toISOString(),
-            indexedAt: like.indexedAt.toISOString(),
+            actor: profileView,
           };
         })
         .filter(Boolean),
···
       params.limit,
       params.cursor
     );
+
+    if (reposts.length === 0) {
+      return res.json({
+        uri: params.uri,
+        cid: params.cid,
+        cursor,
+        repostedBy: [],
+      });
+    }
+
     const userDids = reposts.map((repost) => repost.userDid);
-    const users = await storage.getUsers(userDids);
+
+    // Batch fetch all required data
+    const [
+      users,
+      relationships,
+      listMutes,
+      listBlocks,
+      allLabels,
+      listCounts,
+      feedgenCounts,
+      starterPackCounts,
+      labelerStatuses,
+    ] = await Promise.all([
+      storage.getUsers(userDids),
+      viewerDid
+        ? storage.getRelationships(viewerDid, userDids)
+        : Promise.resolve(new Map()),
+      viewerDid
+        ? storage.getListMutesForUsers(viewerDid, userDids)
+        : Promise.resolve(new Map()),
+      viewerDid
+        ? storage.getListBlocksForUsers(viewerDid, userDids)
+        : Promise.resolve(new Map()),
+      storage.getLabelsForSubjects(userDids),
+      storage.getUsersListCounts(userDids),
+      storage.getUsersFeedGeneratorCounts(userDids),
+      Promise.all(
+        userDids.map(async (did) => {
+          const packs = await storage.getStarterPacksByCreator(did);
+          return { did, count: packs.starterPacks.length };
+        })
+      ),
+      Promise.all(
+        userDids.map(async (did) => {
+          const labelers = await storage.getLabelerServicesByCreator(did);
+          return { did, isLabeler: labelers.length > 0 };
+        })
+      ),
+    ]);
+
     const userMap = new Map(users.map((u) => [u.did, u]));
+    const starterPackCountMap = new Map(
+      starterPackCounts.map((sp) => [sp.did, sp.count])
+    );
+    const labelerStatusMap = new Map(
+      labelerStatuses.map((ls) => [ls.did, ls.isLabeler])
+    );
 
-    const relationships = viewerDid
-      ? await storage.getRelationships(viewerDid, userDids)
-      : new Map();
+    // Fetch list data for mutes/blocks
+    const listUris = new Set<string>();
+    listMutes.forEach((mute) => listUris.add(mute.listUri));
+    listBlocks.forEach((block) => listUris.add(block.listUri));
+
+    const listData = new Map<string, any>();
+    if (listUris.size > 0) {
+      const lists = await Promise.all(
+        Array.from(listUris).map((uri) => storage.getList(uri))
+      );
+      lists.forEach((list, index) => {
+        if (list) {
+          listData.set(Array.from(listUris)[index], list);
+        }
+      });
+    }
+
+    // Group labels by subject
+    const labelsBySubject = new Map<string, any[]>();
+    allLabels.forEach((label) => {
+      if (!labelsBySubject.has(label.subject)) {
+        labelsBySubject.set(label.subject, []);
+      }
+      labelsBySubject.get(label.subject)!.push(label);
+    });
 
     res.json({
       uri: params.uri,
       cid: params.cid,
-      cursor: cursor,
+      cursor,
       repostedBy: reposts
         .map((repost) => {
           const user = userMap.get(repost.userDid);
···
           const viewerState = viewerDid
             ? relationships.get(repost.userDid)
             : null;
-          const viewer: any = {
-            muted: viewerState ? !!viewerState.muting : false,
-            blockedBy: viewerState?.blockedBy || false,
-          };
-          if (viewerState?.blocking) viewer.blocking = viewerState.blocking;
-          if (viewerState?.following) viewer.following = viewerState.following;
-          if (viewerState?.followedBy)
-            viewer.followedBy = viewerState.followedBy;
+          const mutingList = viewerDid ? listMutes.get(repost.userDid) : null;
+          const blockingList = viewerDid ? listBlocks.get(repost.userDid) : null;
+
+          // Build viewer state
+          const viewer: any = {};
+          if (viewerDid) {
+            viewer.muted = !!viewerState?.muting || !!mutingList;
+            if (mutingList) {
+              const list = listData.get(mutingList.listUri);
+              if (list) {
+                viewer.mutedByList = {
+                  $type: 'app.bsky.graph.defs#listViewBasic',
+                  uri: list.uri,
+                  name: list.name,
+                  purpose: list.purpose,
+                };
+              }
+            }
+            viewer.blockedBy = viewerState?.blockedBy || false;
+            if (blockingList) {
+              const list = listData.get(blockingList.listUri);
+              if (list) {
+                viewer.blocking = blockingList.uri;
+                viewer.blockingByList = {
+                  $type: 'app.bsky.graph.defs#listViewBasic',
+                  uri: list.uri,
+                  name: list.name,
+                  purpose: list.purpose,
+                };
+              }
+            } else if (viewerState?.blocking) {
+              viewer.blocking = viewerState.blocking;
+            }
+            if (viewerState?.following) viewer.following = viewerState.following;
+            if (viewerState?.followedBy)
+              viewer.followedBy = viewerState.followedBy;
+          }
 
-          return {
+          // Build full profileView
+          const profileView: any = {
+            $type: 'app.bsky.actor.defs#profileView',
             did: user.did,
             handle: user.handle,
             displayName: user.displayName || user.handle,
-            ...maybeAvatar(user.avatarUrl, user.did, req),
-            viewer,
-            indexedAt: repost.indexedAt.toISOString(),
           };
+
+          // Add optional fields
+          if (user.description) {
+            profileView.description = user.description;
+          }
+
+          const avatar = maybeAvatar(user.avatarUrl, user.did, req);
+          if (avatar.avatar) {
+            profileView.avatar = avatar.avatar;
+          }
+
+          // Add associated counts
+          profileView.associated = {
+            $type: 'app.bsky.actor.defs#profileAssociated',
+            lists: listCounts.get(repost.userDid) || 0,
+            feedgens: feedgenCounts.get(repost.userDid) || 0,
+            starterPacks: starterPackCountMap.get(repost.userDid) || 0,
+            labeler: labelerStatusMap.get(repost.userDid) || false,
+          };
+
+          // Add indexedAt (profile indexed time, not repost time)
+          if (user.indexedAt) {
+            profileView.indexedAt = user.indexedAt.toISOString();
+          }
+
+          // Add createdAt
+          if (user.createdAt) {
+            profileView.createdAt = user.createdAt.toISOString();
+          }
+
+          // Add viewer state
+          if (Object.keys(viewer).length > 0) {
+            profileView.viewer = viewer;
+          }
+
+          // Add labels
+          const labels = labelsBySubject.get(repost.userDid) || [];
+          if (labels.length > 0) {
+            profileView.labels = labels.map((l: any) => ({
+              src: l.src,
+              uri: l.uri,
+              val: l.val,
+              neg: l.neg,
+              cts: l.createdAt.toISOString(),
+            }));
+          }
+
+          return profileView;
         })
         .filter(Boolean),
     });
···
 /**
  * Get posts liked by an actor
  * GET /xrpc/app.bsky.feed.getActorLikes
+ *
+ * IMPORTANT: ATProto spec requires authentication and actor must be the requesting account
  */
 export async function getActorLikes(
   req: Request,
···
 ): Promise<void> {
   try {
     const params = getActorLikesSchema.parse(req.query);
-    const viewerDid = await getAuthenticatedDid(req);
+
+    // Require authentication (per ATProto spec)
+    const viewerDid = await requireAuthDid(req, res);
+    if (!viewerDid) return;
 
+    // Resolve actor to DID
     let actorDid = params.actor;
     if (!params.actor.startsWith('did:')) {
       const user = await storage.getUserByHandle(params.actor);
···
       actorDid = user.did;
     }
 
+    // Check for block relationships
+    const relationship = await storage.getRelationship(viewerDid, actorDid);
+    if (relationship) {
+      if (relationship.blocking) {
+        return res.status(400).json({
+          error: 'BlockedActor',
+          message: 'Requesting user has blocked the target actor',
+        });
+      }
+      if (relationship.blockedBy) {
+        return res.status(400).json({
+          error: 'BlockedByActor',
+          message: 'Target actor has blocked the requesting user',
+        });
+      }
+    }
+
+    // Authorization check: actor must be the requesting account
+    if (actorDid !== viewerDid) {
+      return res.status(403).json({
+        error: 'Forbidden',
+        message: 'Actor must be the requesting account',
+      });
+    }
+
     console.log(
       `[getActorLikes] Fetching likes for ${actorDid}, cursor: ${params.cursor}, limit: ${params.limit}`
     );
···
 
     const serialized = await (xrpcApi as any).serializePosts(
       postsWithLikes.map(({ post }) => post),
-      viewerDid || undefined,
+      viewerDid,
       req
     );
 

server/services/xrpc/services/preferences-service.ts

···
     const userDid = await requireAuthDid(req, res);
     if (!userDid) return;
 
-    console.log(
-      `[PREFERENCES] GET request for ${userDid} - directing to PDS`
-    );
+    // Use debug-level logging to reduce log volume
+    if (process.env.DEBUG_LOGGING === 'true') {
+      console.log(
+        `[PREFERENCES] GET request for ${userDid} - directing to PDS`
+      );
+    }
 
     // Get user's PDS endpoint to include in error message
     const pdsEndpoint = await getUserPdsEndpoint(userDid);
 
-    return res.status(501).json({
+    res.status(501).json({
       error: 'NotImplemented',
       message: 'Preferences must be fetched directly from your PDS, not through the AppView. ' +
                'Per ATProto architecture, preferences are private user data stored on the PDS. ' +
···
     const userDid = await requireAuthDid(req, res);
     if (!userDid) return;
 
-    console.log(
-      `[PREFERENCES] PUT request for ${userDid} - directing to PDS`
-    );
+    // Use debug-level logging to reduce log volume
+    if (process.env.DEBUG_LOGGING === 'true') {
+      console.log(
+        `[PREFERENCES] PUT request for ${userDid} - directing to PDS`
+      );
+    }
 
     // Get user's PDS endpoint to include in error message
     const pdsEndpoint = await getUserPdsEndpoint(userDid);
 
-    return res.status(501).json({
+    res.status(501).json({
       error: 'NotImplemented',
       message: 'Preferences must be updated directly on your PDS, not through the AppView. ' +
                'Per ATProto architecture, preferences are private user data stored on the PDS. ' +

server/services/xrpc/services/push-notification-service.ts

···
     const userDid = await requireAuthDid(req, res);
     if (!userDid) return;
 
+    // Validate serviceDid matches this AppView's DID (if configured)
+    // For now, we accept any serviceDid as this AppView handles push for all users
+    // In production, you might want to validate: params.serviceDid === process.env.SERVICE_DID
+
     // Create or update push subscription
-    const subscription = await storage.createPushSubscription({
+    await storage.createPushSubscription({
       userDid,
       platform: params.platform,
       token: params.token,
       appId: params.appId,
+      endpoint: params.endpoint,
+      keys: params.keys ? JSON.stringify(params.keys) : undefined,
     } as {
       userDid: string;
       platform: string;
       token: string;
       appId?: string;
+      endpoint?: string;
+      keys?: string;
     });
 
-    res.json({
-      id: (subscription as { id: string }).id,
-      platform: (subscription as { platform: string }).platform,
-      createdAt: (subscription as { createdAt: Date }).createdAt.toISOString(),
-    });
+    // AT Protocol spec: return empty object on success
+    res.json({});
   } catch (error) {
     handleError(res, error, 'registerPush');
   }
···
     const params = unregisterPushSchema.parse(req.body);
     const userDid = await requireAuthDid(req, res);
     if (!userDid) return;
-    await storage.deletePushSubscriptionByToken(params.token);
-    res.json({ success: true });
+
+    // Validate serviceDid matches this AppView's DID (if configured)
+    const serviceDid = process.env.SERVICE_DID;
+    if (serviceDid && params.serviceDid !== serviceDid) {
+      res.status(400).json({
+        error: 'InvalidRequest',
+        message: 'serviceDid does not match this service',
+      });
+      return;
+    }
+
+    // Delete push subscription with full validation
+    // Ensures user can only unregister their own devices
+    await storage.deletePushSubscriptionByDetails(
+      userDid,
+      params.token,
+      params.platform,
+      params.appId
+    );
+
+    // AT Protocol spec: return empty object on success
+    res.json({});
   } catch (error) {
     handleError(res, error, 'unregisterPush');
   }

server/services/xrpc/services/search-service.ts

···
 export async function searchPosts(req: Request, res: Response): Promise<void> {
   try {
     const params = searchPostsSchema.parse(req.query);
+
+    // Validate query is not empty/whitespace only
+    if (!params.q.trim()) {
+      res.status(400).json({
+        error: 'InvalidRequest',
+        message: 'query string cannot be empty',
+      });
+      return;
+    }
+
     const viewerDid = await getAuthenticatedDid(req);
 
     const { posts, cursor } = await searchService.searchPosts(
       params.q,
-      params.limit,
-      params.cursor,
+      {
+        limit: params.limit,
+        cursor: params.cursor,
+        sort: params.sort || 'top',
+        since: params.since,
+        until: params.until,
+        mentions: params.mentions,
+        author: params.author,
+        lang: params.lang,
+        domain: params.domain,
+        url: params.url,
+        tag: params.tag,
+      },
       viewerDid || undefined
     );
 
···
     const params = searchActorsSchema.parse(req.query);
     const term = (params.q || params.term)!;
 
+    // Validate query is not empty/whitespace only
+    if (!term.trim()) {
+      res.status(400).json({
+        error: 'InvalidRequest',
+        message: 'query string cannot be empty',
+      });
+      return;
+    }
+
+    const viewerDid = await getAuthenticatedDid(req);
+
     const { actors, cursor } = await searchService.searchActors(
       term,
       params.limit,
···
     const users: UserModel[] = await storage.getUsers(dids);
     const userMap = new Map(users.map((u) => [u.did, u]));
 
-    const results = actorResults
-      .map((a) => {
-        const u = userMap.get(a.did);
-        if (!u) return null;
+    // Get viewer relationships if authenticated
+    const relationships = viewerDid
+      ? await storage.getRelationships(viewerDid, dids)
+      : new Map();
+
+    const results = actorResults.map((a) => {
+      const u = userMap.get(a.did);
+
+      // If user profile not found, create minimal profile with DID
+      if (!u) {
         return {
-          did: u.did,
-          handle: u.handle,
-          displayName: u.displayName,
-          ...maybeAvatar(u.avatarUrl, u.did, req),
+          $type: 'app.bsky.actor.defs#profileView',
+          did: a.did,
+          handle: a.did, // Use DID as fallback
+          displayName: a.did,
+          viewer: {
+            muted: false,
+            blockedBy: false,
+          },
         };
-      })
-      .filter(Boolean);
+      }
+
+      const viewerState = viewerDid ? relationships.get(u.did) : null;
+      const viewer: {
+        muted: boolean;
+        blockedBy: boolean;
+        blocking?: string;
+        following?: string;
+        followedBy?: string;
+      } = {
+        muted: viewerState ? !!viewerState.muting : false,
+        blockedBy: viewerState?.blockedBy || false,
+      };
+      if (viewerState?.blocking) viewer.blocking = viewerState.blocking;
+      if (viewerState?.following) viewer.following = viewerState.following;
+      if (viewerState?.followedBy) viewer.followedBy = viewerState.followedBy;
+
+      return {
+        $type: 'app.bsky.actor.defs#profileView',
+        did: u.did,
+        handle: u.handle,
+        displayName: u.displayName,
+        description: u.description,
+        ...maybeAvatar(u.avatarUrl, u.did, req),
+        indexedAt: u.indexedAt?.toISOString(),
+        viewer,
+      };
+    });
 
     res.json({ actors: results, cursor });
   } catch (error) {
···
 ): Promise<void> {
   try {
     const params = searchActorsTypeaheadSchema.parse(req.query);
-    const results = await searchService.searchActorsTypeahead(
-      (params.q || params.term)!,
-      params.limit
-    );
+    const term = (params.q || params.term)!;
+
+    // Validate query is not empty/whitespace only
+    if (!term.trim()) {
+      res.status(400).json({
+        error: 'InvalidRequest',
+        message: 'query string cannot be empty',
+      });
+      return;
+    }
 
-    res.json({ actors: results });
+    const viewerDid = await getAuthenticatedDid(req);
+
+    const results = await searchService.searchActorsTypeahead(term, params.limit);
+
+    // Get viewer relationships if authenticated
+    const dids = results.map((r) => r.did);
+    const relationships = viewerDid
+      ? await storage.getRelationships(viewerDid, dids)
+      : new Map();
+
+    // Transform to proper profileViewBasic
+    const actors = results.map((actor) => {
+      const viewerState = viewerDid ? relationships.get(actor.did) : null;
+      const viewer: {
+        muted: boolean;
+        blockedBy: boolean;
+        blocking?: string;
+        following?: string;
+        followedBy?: string;
+      } = {
+        muted: viewerState ? !!viewerState.muting : false,
+        blockedBy: viewerState?.blockedBy || false,
+      };
+      if (viewerState?.blocking) viewer.blocking = viewerState.blocking;
+      if (viewerState?.following) viewer.following = viewerState.following;
+      if (viewerState?.followedBy) viewer.followedBy = viewerState.followedBy;
+
+      return {
+        $type: 'app.bsky.actor.defs#profileViewBasic',
+        did: actor.did,
+        handle: actor.handle,
+        displayName: actor.displayName,
+        ...maybeAvatar(actor.avatarUrl, actor.did, req),
+        viewer,
+      };
+    });
+
+    res.json({ actors });
   } catch (error) {
     handleError(res, error, 'searchActorsTypeahead');
   }

server/services/xrpc/services/starter-pack-service.ts

···
 import type { Request, Response } from 'express';
 import { storage } from '../../../storage';
 import { handleError } from '../utils/error-handler';
-import { resolveActor } from '../utils/resolvers';
+import { resolveActor, requireAuthDid } from '../utils/resolvers';
 import { transformBlobToCdnUrl } from '../utils/serializers';
 import {
   getStarterPackSchema,
   getStarterPacksSchema,
   getActorStarterPacksSchema,
   getStarterPacksWithMembershipSchema,
+  getOnboardingSuggestedStarterPacksSchema,
 } from '../schemas';
+import { xrpcApi } from '../../xrpc-api';
 
 /**
  * Get a single starter pack by URI
···
       indexedAt: Date;
     };
 
-    // Creator profile should be available from firehose events
-    const creator = await storage.getUser(packData.creatorDid);
+    // Use _getProfiles for complete creator profileViewBasic
+    const creatorProfiles = await (xrpcApi as any)._getProfiles(
+      [packData.creatorDid],
+      req
+    );
 
-    if (!creator || !(creator as { handle?: string }).handle) {
+    if (creatorProfiles.length === 0) {
       return res.status(500).json({
         error: 'Starter pack creator profile not available',
         message: 'Unable to load creator information',
       });
     }
 
-    const creatorData = creator as {
-      handle: string;
-      displayName?: string;
-      avatarUrl?: string;
-      did: string;
-    };
-
-    let list = null;
-    if (packData.listUri) {
-      list = await storage.getList(packData.listUri);
-    }
-
-    const creatorView: {
-      did: string;
-      handle: string;
-      displayName?: string;
-      avatar?: string;
-    } = {
-      did: packData.creatorDid,
-      handle: creatorData.handle,
-    };
-    if (creatorData.displayName)
-      creatorView.displayName = creatorData.displayName;
-    if (creatorData.avatarUrl) {
-      const avatarUrl = transformBlobToCdnUrl(
-        creatorData.avatarUrl,
-        creatorData.did,
-        'avatar',
-        req
-      );
-      if (
-        avatarUrl &&
-        typeof avatarUrl === 'string' &&
-        avatarUrl.trim() !== ''
-      ) {
-        creatorView.avatar = avatarUrl;
-      }
-    }
-
-    const record: {
-      name: string;
-      list?: string;
-      feeds?: unknown[];
-      createdAt: string;
-      description?: string;
-    } = {
-      name: packData.name,
-      list: packData.listUri,
-      feeds: packData.feeds,
-      createdAt: packData.createdAt.toISOString(),
-    };
-    if (packData.description) record.description = packData.description;
-
-    const starterPackView: {
-      uri: string;
-      cid: string;
-      record: typeof record;
-      creator: typeof creatorView;
-      indexedAt: string;
-      list?: { uri: string; cid: string; name: string; purpose: string };
-    } = {
+    // Build starter pack view
+    const starterPackView: any = {
       uri: packData.uri,
       cid: packData.cid,
-      record,
-      creator: creatorView,
+      record: {
+        name: packData.name,
+        list: packData.listUri,
+        feeds: packData.feeds,
+        createdAt: packData.createdAt.toISOString(),
+        ...(packData.description && { description: packData.description }),
+      },
+      creator: creatorProfiles[0], // Full profileViewBasic
       indexedAt: packData.indexedAt.toISOString(),
     };
 
-    if (list) {
-      const listData = list as {
-        uri: string;
-        cid: string;
-        name: string;
-        purpose: string;
-      };
-      starterPackView.list = {
-        uri: listData.uri,
-        cid: listData.cid,
-        name: listData.name,
-        purpose: listData.purpose,
-      };
+    // Add optional list info if exists
+    if (packData.listUri) {
+      const list = await storage.getList(packData.listUri);
+      if (list) {
+        starterPackView.list = {
+          uri: list.uri,
+          cid: list.cid,
+          name: list.name,
+          purpose: list.purpose,
+        };
+      }
     }
 
     res.json({ starterPack: starterPackView });
···
   try {
     const params = getStarterPacksSchema.parse(req.query);
 
-    const packs = await storage.getStarterPacks(params.uris);
-
-    // Creator profiles should be available from firehose events
-    const views = await Promise.all(
-      (
-        packs as {
-          creatorDid: string;
-          listUri?: string;
-          name: string;
-          description?: string;
-          feeds?: unknown[];
-          uri: string;
-          cid: string;
-          createdAt: Date;
-          indexedAt: Date;
-        }[]
-      ).map(async (pack) => {
-        const creator = await storage.getUser(pack.creatorDid);
+    const packs = await storage.getStarterPacks(params.uris) as {
+      creatorDid: string;
+      listUri?: string;
+      name: string;
+      description?: string;
+      feeds?: unknown[];
+      uri: string;
+      cid: string;
+      createdAt: Date;
+      indexedAt: Date;
+    }[];
 
-        // Skip packs from creators without valid handles
-        if (!creator || !(creator as { handle?: string }).handle) {
-          console.warn(
-            `[XRPC] Skipping starter pack ${pack.uri} - creator ${pack.creatorDid} has no handle`
-          );
-          return null;
-        }
+    if (packs.length === 0) {
+      return res.json({ starterPacks: [] });
+    }
 
-        const creatorData = creator as {
-          handle: string;
-          displayName?: string;
-          avatarUrl?: string;
-          did: string;
-        };
+    // Batch fetch all creator profiles
+    const creatorDids = [...new Set(packs.map(p => p.creatorDid))];
+    const creatorProfiles = await (xrpcApi as any)._getProfiles(creatorDids, req);
 
-        let list = null;
-        if (pack.listUri) {
-          list = await storage.getList(pack.listUri);
-        }
+    // Create map for quick lookup
+    const profileMap = new Map(creatorProfiles.map((p: any) => [p.did, p]));
 
-        const creatorView: {
-          did: string;
-          handle: string;
-          displayName?: string;
-          avatar?: string;
-        } = {
-          did: pack.creatorDid,
-          handle: creatorData.handle,
-        };
-        if (creatorData.displayName)
-          creatorView.displayName = creatorData.displayName;
-        if (creatorData.avatarUrl) {
-          const avatarUri = transformBlobToCdnUrl(
-            creatorData.avatarUrl,
-            creatorData.did,
-            'avatar',
-            req
+    // Build views with complete creator profiles
+    const views = await Promise.all(
+      packs.map(async (pack) => {
+        const creatorProfile = profileMap.get(pack.creatorDid);
+        if (!creatorProfile) {
+          console.warn(
+            `[XRPC] Skipping starter pack ${pack.uri} - creator ${pack.creatorDid} profile not found`
           );
-          if (
-            avatarUri &&
-            typeof avatarUri === 'string' &&
-            avatarUri.trim() !== ''
-          ) {
-            creatorView.avatar = avatarUri;
-          }
+          return null;
         }
 
-        const record: {
-          name: string;
-          list?: string;
-          feeds?: unknown[];
-          createdAt: string;
-          description?: string;
-        } = {
-          name: pack.name,
-          list: pack.listUri,
-          feeds: pack.feeds,
-          createdAt: pack.createdAt.toISOString(),
-        };
-        if (pack.description) record.description = pack.description;
-
-        const view: {
-          uri: string;
-          cid: string;
-          record: typeof record;
-          creator: typeof creatorView;
-          indexedAt: string;
-          list?: { uri: string; cid: string; name: string; purpose: string };
-        } = {
+        const view: any = {
           uri: pack.uri,
           cid: pack.cid,
-          record,
-          creator: creatorView,
+          record: {
+            name: pack.name,
+            list: pack.listUri,
+            feeds: pack.feeds,
+            createdAt: pack.createdAt.toISOString(),
+            ...(pack.description && { description: pack.description }),
+          },
+          creator: creatorProfile, // Full profileViewBasic
           indexedAt: pack.indexedAt.toISOString(),
         };
 
-        if (list) {
-          const listData = list as {
-            uri: string;
-            cid: string;
-            name: string;
-            purpose: string;
-          };
-          view.list = {
-            uri: listData.uri,
-            cid: listData.cid,
-            name: listData.name,
-            purpose: listData.purpose,
-          };
+        // Add optional list info if exists
+        if (pack.listUri) {
+          const list = await storage.getList(pack.listUri);
+          if (list) {
+            view.list = {
+              uri: list.uri,
+              cid: list.cid,
+              name: list.name,
+              purpose: list.purpose,
+            };
+          }
         }
 
         return view;
       })
     );
 
-    // Filter out null entries (packs from creators without valid handles)
-    const validViews = views.filter((view) => view !== null);
+    const validViews = views.filter(Boolean);
 
     res.json({ starterPacks: validViews });
   } catch (error) {
···
     const params = getActorStarterPacksSchema.parse(req.query);
     const did = await resolveActor(res, params.actor);
     if (!did) return;
-    const { starterPacks, cursor } = await storage.getStarterPacksByCreator(
+
+    const { starterPacks, cursor: nextCursor } = await storage.getStarterPacksByCreator(
       did,
       params.limit,
       params.cursor
     );
-    res.json({
-      cursor,
-      starterPacks: (
+
+    if (starterPacks.length === 0) {
+      res.json({
+        cursor: nextCursor,
+        starterPacks: [],
+      });
+      return;
+    }
+
+    // Use _getProfiles for complete creator profileViewBasic (all packs have same creator)
+    const creatorProfiles = await (xrpcApi as any)._getProfiles([did], req);
+
+    if (creatorProfiles.length === 0) {
+      res.status(500).json({
+        error: 'InternalServerError',
+        message: 'Creator profile not available',
+      });
+      return;
+    }
+
+    const creatorView = creatorProfiles[0];
+
+    // Get all starter pack URIs for batch label fetching
+    const packUris = starterPacks.map((p: any) => p.uri);
+
+    // Batch fetch labels for all starter packs
+    const allLabels = await storage.getLabelsForSubjects(packUris);
+    const labelsMap = new Map<string, typeof allLabels>();
+
+    allLabels.forEach((label) => {
+      const existing = labelsMap.get(label.subject) || [];
+      existing.push(label);
+      labelsMap.set(label.subject, existing);
+    });
+
+    // Build starterPackViewBasic objects
+    const starterPackViews = await Promise.all(
+      (
         starterPacks as {
           uri: string;
           cid: string;
           name: string;
+          description?: string;
           listUri?: string;
           feeds?: unknown[];
           createdAt: Date;
+          indexedAt: Date;
         }[]
-      ).map((p) => ({
-        uri: p.uri,
-        cid: p.cid,
-        record: {
-          name: p.name,
-          list: p.listUri,
-          feeds: p.feeds,
-          createdAt: p.createdAt.toISOString(),
-        },
-      })),
-      feeds: [],
+      ).map(async (pack) => {
+        const record: {
+          name: string;
+          list?: string;
+          feeds?: unknown[];
+          createdAt: string;
+          description?: string;
+        } = {
+          name: pack.name,
+          list: pack.listUri,
+          feeds: pack.feeds,
+          createdAt: pack.createdAt.toISOString(),
+        };
+
+        if (pack.description) {
+          record.description = pack.description;
+        }
+
+        // Calculate listItemCount if list exists
+        let listItemCount: number | undefined = undefined;
+        if (pack.listUri) {
+          const items = await storage.getListItems(pack.listUri, 10000);
+          listItemCount = items.length;
+        }
+
+        // Get labels for this pack
+        const packLabels = labelsMap.get(pack.uri);
+        const labels = packLabels?.map((label) => ({
+          src: label.src,
+          uri: label.uri,
+          val: label.val,
+          cts: label.createdAt.toISOString(),
+          ...(label.neg && { neg: true }),
+        }));
+
+        return {
+          uri: pack.uri,
+          cid: pack.cid,
+          record,
+          creator: creatorView,
+          indexedAt: pack.indexedAt.toISOString(),
+          ...(listItemCount !== undefined && { listItemCount }),
+          ...(labels && labels.length > 0 && { labels }),
+        };
+      })
+    );
+
+    res.json({
+      cursor: nextCursor,
+      starterPacks: starterPackViews,
     });
   } catch (error) {
     handleError(res, error, 'getActorStarterPacks');
···
 /**
  * Get starter packs with membership info
  * GET /xrpc/app.bsky.graph.getStarterPacksWithMembership
+ *
+ * Returns starter packs created by the authenticated user, with membership info
+ * about the specified actor in each pack's associated list.
  */
 export async function getStarterPacksWithMembership(
   req: Request,
···
 ): Promise<void> {
   try {
     const params = getStarterPacksWithMembershipSchema.parse(req.query);
-    const did = params.actor ? await resolveActor(res, params.actor) : null;
-    const { starterPacks, cursor } = did
-      ? await storage.getStarterPacksByCreator(did, params.limit, params.cursor)
-      : await storage.listStarterPacks(params.limit, params.cursor);
+
+    // Requires authentication - starter packs are created by session user
+    const sessionDid = await requireAuthDid(req, res);
+    if (!sessionDid) return;
+
+    // Resolve the actor to check for membership
+    const actorDid = await resolveActor(res, params.actor);
+    if (!actorDid) return;
+
+    // Get starter packs created by authenticated user
+    const { starterPacks, cursor: nextCursor } = await storage.getStarterPacksByCreator(
+      sessionDid,
+      params.limit,
+      params.cursor
+    );
+
+    if (starterPacks.length === 0) {
+      res.json({
+        cursor: nextCursor,
+        starterPacksWithMembership: [],
+      });
+      return;
+    }
+
+    // Use _getProfiles for both creator and actor profiles
+    const profiles = await (xrpcApi as any)._getProfiles([sessionDid, actorDid], req);
+
+    if (profiles.length === 0) {
+      res.status(500).json({
+        error: 'InternalServerError',
+        message: 'Profiles not available',
+      });
+      return;
+    }
+
+    const profileMap = new Map(profiles.map((p: any) => [p.did, p]));
+    const creatorView = profileMap.get(sessionDid);
+    const actorProfile = profileMap.get(actorDid);
+
+    if (!creatorView) {
+      res.status(500).json({
+        error: 'InternalServerError',
+        message: 'Creator profile not available',
+      });
+      return;
+    }
+
+    // Get all starter pack URIs for batch label fetching
+    const packUris = starterPacks.map((p: any) => p.uri);
+
+    // Batch fetch labels for all starter packs
+    const allLabels = await storage.getLabelsForSubjects(packUris);
+    const labelsMap = new Map<string, typeof allLabels>();
+
+    allLabels.forEach((label) => {
+      const existing = labelsMap.get(label.subject) || [];
+      existing.push(label);
+      labelsMap.set(label.subject, existing);
+    });
+
+    // Build starterPacksWithMembership response
+    const starterPacksWithMembershipData = await Promise.all(
+      (
+        starterPacks as {
+          uri: string;
+          cid: string;
+          name: string;
+          description?: string;
+          listUri?: string;
+          feeds?: unknown[];
+          createdAt: Date;
+          indexedAt: Date;
+        }[]
+      ).map(async (pack) => {
+        const record: {
+          name: string;
+          list?: string;
+          feeds?: unknown[];
+          createdAt: string;
+          description?: string;
+        } = {
+          name: pack.name,
+          list: pack.listUri,
+          feeds: pack.feeds,
+          createdAt: pack.createdAt.toISOString(),
+        };
+
+        if (pack.description) {
+          record.description = pack.description;
+        }
+
+        // Calculate listItemCount if list exists
+        let listItemCount: number | undefined = undefined;
+        let memberItem = null;
+
+        if (pack.listUri) {
+          const listItems = await storage.getListItems(pack.listUri, 10000);
+          listItemCount = listItems.length;
+
+          // Check if actor is a member of this pack's list
+          memberItem = listItems.find((item) => item.subjectDid === actorDid);
+        }
+
+        // Get labels for this pack
+        const packLabels = labelsMap.get(pack.uri);
+        const labels = packLabels?.map((label) => ({
+          src: label.src,
+          uri: label.uri,
+          val: label.val,
+          cts: label.createdAt.toISOString(),
+          ...(label.neg && { neg: true }),
+        }));
+
+        // Build full starterPackViewBasic
+        const starterPackView = {
+          uri: pack.uri,
+          cid: pack.cid,
+          record,
+          creator: creatorView,
+          indexedAt: pack.indexedAt.toISOString(),
+          ...(listItemCount !== undefined && { listItemCount }),
+          ...(labels && labels.length > 0 && { labels }),
+        };
+
+        // Build response object
+        const response: {
+          starterPack: typeof starterPackView;
+          listItem?: { uri: string; subject: any };
+        } = {
+          starterPack: starterPackView,
+        };
+
+        // Include listItem if actor is a member of the pack's list
+        if (memberItem && actorProfile) {
+          response.listItem = {
+            uri: memberItem.uri,
+            subject: actorProfile,
+          };
+        }
+
+        return response;
+      })
+    );
+
     res.json({
-      cursor,
-      starterPacks: (starterPacks as { uri: string; cid: string }[]).map(
-        (p) => ({ uri: p.uri, cid: p.cid })
-      ),
+      cursor: nextCursor,
+      starterPacksWithMembership: starterPacksWithMembershipData,
     });
   } catch (error) {
     handleError(res, error, 'getStarterPacksWithMembership');
···
 /**
  * Get suggested starter packs for onboarding
  * GET /xrpc/app.bsky.unspecced.getOnboardingSuggestedStarterPacks
+ *
+ * IMPORTANT: This endpoint is experimental and marked as "unspecced" in the ATProto specification.
+ * Returns a list of suggested starter packs for new user onboarding with complete starterPackView objects.
  */
 export async function getOnboardingSuggestedStarterPacks(
   req: Request,
   res: Response
 ): Promise<void> {
   try {
+    const params = getOnboardingSuggestedStarterPacksSchema.parse(req.query);
+
     // Return recent starter packs as onboarding suggestions
-    const { starterPacks } = await storage.listStarterPacks(10);
-    res.json({
-      starterPacks: (
-        starterPacks as { uri: string; cid: string; createdAt: Date }[]
-      ).map((p) => ({
-        uri: p.uri,
-        cid: p.cid,
-        createdAt: p.createdAt.toISOString(),
-      })),
-    });
+    const { starterPacks } = (await storage.listStarterPacks(params.limit)) as {
+      starterPacks: {
+        uri: string;
+        cid: string;
+        creatorDid: string;
+        listUri?: string;
+        name: string;
+        description?: string;
+        feeds?: unknown[];
+        createdAt: Date;
+        indexedAt: Date;
+      }[];
+    };
+
+    if (starterPacks.length === 0) {
+      return res.json({ starterPacks: [] });
+    }
+
+    // Batch fetch all creator profiles
+    const creatorDids = [...new Set(starterPacks.map((p) => p.creatorDid))];
+    const creatorProfiles = await (xrpcApi as any)._getProfiles(
+      creatorDids,
+      req
+    );
+
+    // Create map for quick lookup
+    const profileMap = new Map(creatorProfiles.map((p: any) => [p.did, p]));
+
+    // Build views with complete creator profiles
+    const views = await Promise.all(
+      starterPacks.map(async (pack) => {
+        const creatorProfile = profileMap.get(pack.creatorDid);
+        if (!creatorProfile) {
+          console.warn(
+            `[XRPC] Skipping starter pack ${pack.uri} - creator ${pack.creatorDid} profile not found`
+          );
+          return null;
+        }
+
+        const view: any = {
+          uri: pack.uri,
+          cid: pack.cid,
+          record: {
+            name: pack.name,
+            list: pack.listUri,
+            feeds: pack.feeds,
+            createdAt: pack.createdAt.toISOString(),
+            ...(pack.description && { description: pack.description }),
+          },
+          creator: creatorProfile, // Full profileViewBasic
+          indexedAt: pack.indexedAt.toISOString(),
+        };
+
+        // Add optional list info if exists
+        if (pack.listUri) {
+          const list = await storage.getList(pack.listUri);
+          if (list) {
+            view.list = {
+              uri: list.uri,
+              cid: list.cid,
+              name: list.name,
+              purpose: list.purpose,
+            };
+          }
+        }
+
+        return view;
+      })
+    );
+
+    const validViews = views.filter(Boolean);
+
+    res.json({ starterPacks: validViews });
   } catch (error) {
     handleError(res, error, 'getOnboardingSuggestedStarterPacks');
   }

server/services/xrpc/services/timeline-service.ts

···
     // Get feed generator info
     const feedGen = await storage.getFeedGenerator(params.feed);
     if (!feedGen) {
-      res.status(404).json({ error: 'Feed generator not found' });
+      res.status(404).json({
+        error: 'UnknownFeed',
+        message: 'Feed generator not found'
+      });
       return;
     }
 
···
     );
 
     // Call external feed generator service to get skeleton
-    // Then hydrate with full post data from our database
     const { feed: hydratedFeed, cursor } = await feedGeneratorClient.getFeed(
       feedGen.did,
       {
···
       `[XRPC] Hydrated ${hydratedFeed.length} posts from feed generator`
     );
 
-    // Build post views with author information
-    const feed = await Promise.all(
-      hydratedFeed.map(async ({ post, reason }) => {
-        const author = await storage.getUser(post.authorDid);
+    if (hydratedFeed.length === 0) {
+      return res.json({ feed: [], cursor });
+    }
 
-        // Skip posts from authors without valid handles
-        if (!author || !author.handle) {
-          console.warn(
-            `[XRPC] Skipping post ${post.uri} - author ${post.authorDid} has no handle`
-          );
-          return null;
-        }
+    // Extract post URIs for batch fetching
+    const postUris = hydratedFeed.map(({ post }) => post.uri);
+    const posts = await storage.getPosts(postUris);
 
-        const postView: any = {
-          uri: post.uri,
-          cid: post.cid,
-          author: {
-            $type: 'app.bsky.actor.defs#profileViewBasic',
-            did: post.authorDid,
-            handle: author.handle,
-            displayName: author.displayName ?? author.handle,
-            pronouns: author?.pronouns,
-            ...maybeAvatar(author?.avatarUrl, author?.did, req),
-            associated: {
-              $type: 'app.bsky.actor.defs#profileAssociated',
-              lists: 0,
-              feedgens: 0,
-              starterPacks: 0,
-              labeler: false,
-              chat: undefined,
-              activitySubscription: undefined,
-            },
-            viewer: undefined,
-            labels: [],
-            createdAt: author?.createdAt?.toISOString(),
-            verification: undefined,
-            status: undefined,
-          },
-          record: {
-            text: post.text,
-            createdAt: post.createdAt.toISOString(),
-          },
-          replyCount: 0,
-          repostCount: 0,
-          likeCount: 0,
-          indexedAt: post.indexedAt.toISOString(),
-        };
+    // Get viewer DID for proper serialization
+    const viewerDid = await getAuthenticatedDid(req);
 
-        const feedView: any = { post: postView };
+    // Use existing serializePosts infrastructure for complete post objects
+    const serializedPosts = await (xrpcApi as any).serializePosts(
+      posts,
+      viewerDid || undefined,
+      req
+    );
 
-        // Include reason if present (e.g., repost context)
-        if (reason) {
-          feedView.reason = reason;
-        }
+    // Create map for quick lookup
+    const postsByUri = new Map(serializedPosts.map((p: any) => [p.uri, p]));
+
+    // Build feed with reasons and optional feedContext/reqId
+    const feed = hydratedFeed
+      .map(({ post, reason, feedContext, reqId }) => {
+        const serializedPost = postsByUri.get(post.uri);
+        if (!serializedPost) return null;
+
+        const feedView: any = { post: serializedPost };
+        if (reason) feedView.reason = reason;
+        if (feedContext) feedView.feedContext = feedContext;
+        if (reqId) feedView.reqId = reqId;
 
         return feedView;
       })
-    );
+      .filter(Boolean);
 
-    // Filter out null entries (posts from authors without handles)
-    const validFeed = feed.filter((item) => item !== null);
-
-    res.json({ feed: validFeed, cursor });
+    res.json({ feed, cursor });
   } catch (error) {
-    // If feed generator is unavailable, provide a helpful error
     handleError(res, error, 'getFeed');
   }
 }
···
 /**
  * Get post thread (V2 - unspecced)
  * GET /xrpc/app.bsky.unspecced.getPostThreadV2
+ *
+ * IMPORTANT: This endpoint is experimental and marked as "unspecced" in the ATProto specification.
+ * Per the official lexicon: "this endpoint is under development and WILL change without notice."
+ *
+ * Returns a flat array of thread items with depth indicators for building threaded UIs.
+ * - depth 0: anchor post
+ * - depth < 0: parent posts (ancestors)
+ * - depth > 0: reply posts (descendants)
  */
 export async function getPostThreadV2(
   req: Request,
···
 ): Promise<void> {
   try {
     const params = getPostThreadV2Schema.parse(req.query);
-    const posts = await storage.getPostThread(params.anchor);
     const viewerDid = await getAuthenticatedDid(req);
 
+    // Get the anchor post
+    const anchorPost = await storage.getPost(params.anchor);
+    if (!anchorPost) {
+      return res.status(404).json({ error: 'Post not found' });
+    }
+
+    const threadItems: Array<{ post: any; depth: number }> = [];
+    const depthLimit = Math.min(params.below || 6, 20);
+    const includeAbove = params.above !== false;
+    const branchingFactor = Math.min(params.branchingFactor || 10, 100);
+    const sort = params.sort || 'oldest';
+
+    // 1. Collect parent chain if above=true (depth will be negative)
+    if (includeAbove && anchorPost.parentUri) {
+      let currentUri = anchorPost.parentUri;
+      let depth = -1;
+      const parentChain: Array<{ post: any; depth: number }> = [];
+
+      while (currentUri && depth >= -20) {
+        const parent = await storage.getPost(currentUri);
+        if (!parent) break;
+
+        parentChain.unshift({ post: parent, depth });
+        currentUri = parent.parentUri || null;
+        depth--;
+      }
+
+      threadItems.push(...parentChain);
+    }
+
+    // 2. Add anchor post at depth 0
+    threadItems.push({ post: anchorPost, depth: 0 });
+
+    // 3. Collect replies below anchor (depth will be positive)
+    if (depthLimit > 0) {
+      // Get all posts in the thread
+      const rootUri = anchorPost.rootUri || anchorPost.uri;
+      const allThreadPosts = await storage.db
+        .select()
+        .from(storage.schema.posts)
+        .where(storage.sql.eq(storage.schema.posts.rootUri, rootUri));
+
+      // Build parent-to-children map
+      const replyMap = new Map<string, any[]>();
+      for (const post of allThreadPosts) {
+        if (post.parentUri) {
+          const siblings = replyMap.get(post.parentUri) || [];
+          siblings.push(post);
+          replyMap.set(post.parentUri, siblings);
+        }
+      }
+
+      // Apply sorting to reply arrays
+      const sortReplies = (replies: any[]) => {
+        if (sort === 'newest') {
+          return replies.sort(
+            (a, b) => b.createdAt.getTime() - a.createdAt.getTime()
+          );
+        } else if (sort === 'top') {
+          // TODO: Implement top sorting with engagement metrics
+          return replies.sort(
+            (a, b) => a.createdAt.getTime() - b.createdAt.getTime()
+          );
+        } else {
+          // oldest (default)
+          return replies.sort(
+            (a, b) => a.createdAt.getTime() - b.createdAt.getTime()
+          );
+        }
+      };
+
+      // Traverse reply tree with depth limits
+      const collectReplies = (postUri: string, currentDepth: number) => {
+        if (currentDepth >= depthLimit) return;
+
+        const children = replyMap.get(postUri) || [];
+        const sortedChildren = sortReplies([...children]);
+        const limitedChildren = sortedChildren.slice(0, branchingFactor);
+
+        for (const child of limitedChildren) {
+          threadItems.push({ post: child, depth: currentDepth + 1 });
+          collectReplies(child.uri, currentDepth + 1);
+        }
+      };
+
+      collectReplies(anchorPost.uri, 0);
+    }
+
+    // 4. Serialize all posts
+    const allPosts = threadItems.map((item) => item.post);
     const serialized = await (xrpcApi as any).serializePosts(
-      posts,
+      allPosts,
       viewerDid || undefined,
       req
     );
 
-    res.json({
-      hasOtherReplies: false,
-      thread: serialized.length
-        ? {
+    const postsByUri = new Map(serialized.map((p: any) => [p.uri, p]));
+
+    // 5. Build response items with depth
+    const items = threadItems
+      .map((item) => {
+        const serializedPost = postsByUri.get(item.post.uri);
+        if (!serializedPost) return null;
+
+        return {
+          uri: item.post.uri,
+          depth: item.depth,
+          value: {
             $type: 'app.bsky.unspecced.defs#threadItemPost',
-            post: serialized[0],
-          }
-        : null,
-      threadgate: null,
-    });
+            post: serializedPost,
+          },
+          hasOtherReplies: false, // TODO: Implement pagination detection
+        };
+      })
+      .filter(Boolean);
+
+    res.json({ items });
   } catch (error) {
     handleError(res, error, 'getPostThreadV2');
   }
 }
 
 /**
- * Get other thread replies (V2 - unspecced stub)
+ * Get other thread replies (V2 - unspecced)
  * GET /xrpc/app.bsky.unspecced.getPostThreadOtherV2
+ *
+ * IMPORTANT: This endpoint is experimental and marked as "unspecced" in the ATProto specification.
+ * Per the official lexicon: "this endpoint is under development and WILL change without notice."
+ *
+ * Returns additional replies that may be hidden by threadgate restrictions or pagination.
+ * Currently returns an empty array as pagination is not yet implemented.
  */
 export async function getPostThreadOtherV2(
   req: Request,
   res: Response
 ): Promise<void> {
   try {
-    getPostThreadOtherV2Schema.parse(req.query);
-    res.json({ hasOtherReplies: false, items: [] });
+    const params = getPostThreadOtherV2Schema.parse(req.query);
+
+    // TODO: Implement actual functionality for paginated/hidden replies
+    // For now, return empty array indicating no additional replies
+    res.json({ items: [] });
   } catch (error) {
     handleError(res, error, 'getPostThreadOtherV2');
   }

server/services/xrpc/services/unspecced-service.ts

···
 import type { Request, Response } from 'express';
 import { storage } from '../../../storage';
 import { handleError } from '../utils/error-handler';
-import { maybeAvatar } from '../utils/serializers';
-import { z } from 'zod';
-
-const unspeccedNoParamsSchema = z.object({
-  // No required params
-});
+import { getTrendsSchema, unspeccedNoParamsSchema } from '../schemas';
+import { xrpcApi } from '../../xrpc-api';
 
 /**
  * Get tagged suggestions (unspecced)
  * GET /xrpc/app.bsky.unspecced.getTaggedSuggestions
+ *
+ * IMPORTANT: This endpoint is experimental and marked as "unspecced" in the ATProto specification.
+ * Returns categorized suggestions for feeds and users with tags.
+ *
+ * Response format per spec:
+ * - tag: Category identifier (e.g., "popular", "tech", "news")
+ * - subjectType: "actor" or "feed"
+ * - subject: AT-URI of the suggested resource
  */
 export async function getTaggedSuggestions(
   req: Request,
···
   try {
     unspeccedNoParamsSchema.parse(req.query);
 
-    // Return recent users as generic suggestions
-    const users = await storage.getSuggestedUsers(undefined, 25);
+    const suggestions: Array<{
+      tag: string;
+      subjectType: 'actor' | 'feed';
+      subject: string;
+    }> = [];
+
+    // Get suggested users and tag them
+    const { users } = await storage.getSuggestedUsers(undefined, 10);
+    for (const user of users as { did: string }[]) {
+      suggestions.push({
+        tag: 'suggested-users',
+        subjectType: 'actor',
+        subject: user.did, // Using DID as subject (can be used to fetch full profile)
+      });
+    }
+
+    // Get suggested feeds and tag them
+    const { generators } = (await storage.getSuggestedFeeds(10)) as {
+      generators: { uri: string }[];
+    };
+    for (const generator of generators) {
+      suggestions.push({
+        tag: 'suggested-feeds',
+        subjectType: 'feed',
+        subject: generator.uri, // AT-URI of the feed generator
+      });
+    }
+
+    // TODO: Implement more sophisticated tagging logic
+    // - Categorize by topic (tech, news, sports, etc.)
+    // - Use trending/popular tags
+    // - Personalize based on user interests
+    // For now, we use generic "suggested-users" and "suggested-feeds" tags
 
-    res.json({
-      suggestions: users.map((u) => ({
-        did: u.did,
-        handle: u.handle,
-        displayName: u.displayName,
-        ...maybeAvatar(u.avatarUrl, u.did, req),
-      })),
-    });
+    res.json({ suggestions });
   } catch (error) {
     handleError(res, error, 'getTaggedSuggestions');
   }
···
 }
 
 /**
- * Get trends (unspecced stub)
+ * Get trends (unspecced)
  * GET /xrpc/app.bsky.unspecced.getTrends
+ *
+ * IMPORTANT: This endpoint is experimental and marked as "unspecced" in the ATProto specification.
+ * Returns trending topics with engagement metrics and associated user profiles.
+ *
+ * Response format per spec (trendView):
+ * - topic: Trend topic/hashtag
+ * - displayName: Display name for the trend
+ * - link: Link to the trend
+ * - startedAt: When the trend started
+ * - postCount: Number of posts in this trend
+ * - actors: Array of profileViewBasic objects
+ * - status: Optional "hot" indicator
+ * - category: Optional category
  */
 export async function getTrends(req: Request, res: Response): Promise<void> {
   try {
-    unspeccedNoParamsSchema.parse(req.query);
-    res.json({ trends: [{ topic: '#bluesky', count: 0 }] });
+    const params = getTrendsSchema.parse(req.query);
+
+    // TODO: Implement real trending logic based on:
+    // - Recent post counts by hashtag/topic
+    // - Velocity of engagement (likes, reposts, replies)
+    // - Time-based trending windows
+    // - Geographic/network-wide trends
+
+    // For now, return placeholder trends with proper structure
+    const placeholderTrends = [
+      {
+        topic: '#bluesky',
+        displayName: 'Bluesky',
+        category: 'social-media',
+      },
+      {
+        topic: '#atproto',
+        displayName: 'AT Protocol',
+        category: 'technology',
+      },
+    ];
+
+    const trends = await Promise.all(
+      placeholderTrends.slice(0, params.limit).map(async (trend) => {
+        // Get some users to associate with the trend (placeholder)
+        const { users } = await storage.getSuggestedUsers(undefined, 3);
+        const userDids = (users as { did: string }[]).map((u) => u.did);
+
+        // Hydrate user profiles
+        const actors =
+          userDids.length > 0
+            ? await (xrpcApi as any)._getProfiles(userDids, req)
+            : [];
+
+        return {
+          topic: trend.topic,
+          displayName: trend.displayName,
+          link: `https://bsky.app/search?q=${encodeURIComponent(trend.topic)}`,
+          startedAt: new Date(Date.now() - 3600000).toISOString(), // Started 1 hour ago
+          postCount: Math.floor(Math.random() * 1000) + 100, // Placeholder count
+          actors: actors.slice(0, 3), // Include up to 3 actors
+          status: 'hot',
+          category: trend.category,
+        };
+      })
+    );
+
+    res.json({ trends });
   } catch (error) {
     handleError(res, error, 'getTrends');
   }
···
 }
 
 /**
- * Get age assurance state (stub)
- * GET /xrpc/com.atproto.identity.getAgeAssuranceState
+ * Get age assurance state
+ * GET /xrpc/app.bsky.unspecced.getAgeAssuranceState
+ *
+ * IMPORTANT: This AppView will NEVER provide age assurance/verification services.
+ *
+ * Age verification is a sensitive legal and privacy matter that requires:
+ * - Compliance with varying international age verification laws (COPPA, GDPR, etc.)
+ * - Secure handling of personal identification documents
+ * - Legal liability and regulatory oversight
+ * - Infrastructure for identity verification
+ *
+ * This is an explicit architectural decision that age assurance is NOT and will NEVER
+ * be provided by this AppView under any circumstances. Users must handle age verification
+ * through their PDS or other appropriate identity services.
  */
 export async function getAgeAssuranceState(
   req: Request,
   res: Response
 ): Promise<void> {
   try {
-    res.json({ state: 'unknown' });
+    res.status(501).json({
+      error: 'NotImplemented',
+      message: 'This AppView does not and will never provide age assurance services. ' +
+               'Age verification is a sensitive legal matter requiring compliance with international laws, ' +
+               'secure handling of personal identification, and regulatory oversight. ' +
+               'Users must handle age verification through their PDS or appropriate identity services.',
+    });
   } catch (error) {
     handleError(res, error, 'getAgeAssuranceState');
   }
 }
 
 /**
- * Initialize age assurance (stub)
- * POST /xrpc/com.atproto.identity.initAgeAssurance
+ * Initialize age assurance
+ * POST /xrpc/app.bsky.unspecced.initAgeAssurance
+ *
+ * IMPORTANT: This AppView will NEVER provide age assurance/verification services.
+ *
+ * Age verification is a sensitive legal and privacy matter that requires:
+ * - Compliance with varying international age verification laws (COPPA, GDPR, etc.)
+ * - Secure handling of personal identification documents
+ * - Legal liability and regulatory oversight
+ * - Infrastructure for identity verification
+ *
+ * This is an explicit architectural decision that age assurance is NOT and will NEVER
+ * be provided by this AppView under any circumstances. Users must handle age verification
+ * through their PDS or other appropriate identity services.
  */
 export async function initAgeAssurance(
   req: Request,
   res: Response
 ): Promise<void> {
   try {
-    res.json({ ok: true });
+    res.status(501).json({
+      error: 'NotImplemented',
+      message: 'This AppView does not and will never provide age assurance services. ' +
+               'Age verification is a sensitive legal matter requiring compliance with international laws, ' +
+               'secure handling of personal identification, and regulatory oversight. ' +
+               'Users must handle age verification through their PDS or appropriate identity services.',
+    });
   } catch (error) {
     handleError(res, error, 'initAgeAssurance');
   }

server/services/xrpc/services/utility-service.ts

···
   getJobStatusSchema,
   sendInteractionsSchema,
 } from '../schemas/utility-schemas';
+import { xrpcApi } from '../../xrpc-api';
 
 /**
  * Get labeler services for given DIDs
···
     );
 
     // Flatten array of arrays
-    const services = allServices.flat();
+    const services = allServices.flat() as {
+      uri: string;
+      cid: string;
+      creatorDid: string;
+      likeCount: number;
+      indexedAt: Date;
+      policies?: unknown;
+    }[];
 
-    const views = await Promise.all(
-      services.map(async (service) => {
-        const creator = await storage.getUser(
-          (service as { creatorDid: string }).creatorDid
-        );
+    if (services.length === 0) {
+      return res.json({ views: [] });
+    }
 
-        // Skip services from creators without valid handles
-        if (!creator || !creator.handle) {
+    // Batch fetch all creator profiles
+    const creatorDids = [...new Set(services.map(s => s.creatorDid))];
+    const creatorProfiles = await (xrpcApi as any)._getProfiles(creatorDids, req);
+
+    // Create map for quick lookup
+    const profileMap = new Map(creatorProfiles.map((p: any) => [p.did, p]));
+
+    // Batch fetch labels for all services
+    const serviceUris = services.map(s => s.uri);
+    const allLabels = await storage.getLabelsForSubjects(serviceUris);
+
+    // Create labels map
+    const labelsMap = new Map<string, typeof allLabels>();
+    allLabels.forEach((label) => {
+      const existing = labelsMap.get(label.subject) || [];
+      existing.push(label);
+      labelsMap.set(label.subject, existing);
+    });
+
+    // Build views
+    const views = services
+      .map((service) => {
+        const creatorProfile = profileMap.get(service.creatorDid);
+        if (!creatorProfile) {
           console.warn(
-            `[XRPC] Skipping labeler service ${(service as { uri: string }).uri} - creator ${(service as { creatorDid: string }).creatorDid} has no handle`
+            `[XRPC] Skipping labeler service ${service.uri} - creator ${service.creatorDid} profile not found`
           );
           return null;
         }
 
-        const creatorView: {
-          did: string;
-          handle: string;
-          displayName?: string;
-          avatar?: string;
-        } = {
-          did: (service as { creatorDid: string }).creatorDid,
-          handle: creator.handle,
+        const view: any = {
+          uri: service.uri,
+          cid: service.cid,
+          creator: creatorProfile, // Full profileView
+          likeCount: service.likeCount || 0,
+          indexedAt: service.indexedAt.toISOString(),
         };
 
-        if (creator?.displayName) creatorView.displayName = creator.displayName;
-        if (creator?.avatarUrl) {
-          const avatarUri = transformBlobToCdnUrl(
-            creator.avatarUrl,
-            creator.did,
-            'avatar',
-            req
-          );
-          if (
-            avatarUri &&
-            typeof avatarUri === 'string' &&
-            avatarUri.trim() !== ''
-          ) {
-            creatorView.avatar = avatarUri;
-          }
+        // Add policies (required for detailed view, optional for basic view)
+        if (params.detailed && service.policies) {
+          view.policies = service.policies;
         }
 
-        const view: {
-          uri: string;
-          cid: string;
-          creator: typeof creatorView;
-          likeCount: number;
-          indexedAt: string;
-          policies?: unknown;
-          labels?: unknown[];
-        } = {
-          uri: (service as { uri: string }).uri,
-          cid: (service as { cid: string }).cid,
-          creator: creatorView,
-          likeCount: (service as { likeCount: number }).likeCount,
-          indexedAt: (service as { indexedAt: Date }).indexedAt.toISOString(),
-        };
-
-        // Add policies
-        if ((service as { policies?: unknown }).policies) {
-          view.policies = (service as { policies: unknown }).policies;
-        }
-
-        // Get labels applied to this labeler service
-        const labels = await storage.getLabelsForSubject(
-          (service as { uri: string }).uri
-        );
-        if (labels.length > 0) {
-          view.labels = labels.map((label) => {
-            const labelView: {
-              src: string;
-              uri: string;
-              val: string;
-              cts: string;
-              neg?: boolean;
-            } = {
-              src: (label as { src: string }).src,
-              uri: (label as { subject: string }).subject,
-              val: (label as { val: string }).val,
-              cts: (label as { createdAt: Date }).createdAt.toISOString(),
-            };
-            if ((label as { neg?: boolean }).neg) labelView.neg = true;
-            return labelView;
-          });
+        // Add labels
+        const serviceLabels = labelsMap.get(service.uri);
+        if (serviceLabels && serviceLabels.length > 0) {
+          view.labels = serviceLabels.map((label) => ({
+            src: label.src,
+            uri: label.subject,
+            val: label.val,
+            cts: label.createdAt.toISOString(),
+            ...(label.neg && { neg: true }),
+          }));
         }
 
         return view;
       })
-    );
-
-    // Filter out null entries (services from creators without valid handles)
-    const validViews = views.filter((view) => view !== null);
+      .filter(Boolean);
 
-    res.json({ views: validViews });
+    res.json({ views });
   } catch (error) {
     handleError(res, error, 'getServices');
   }
···
 /**
  * Get video job status
  * GET /xrpc/app.bsky.video.getJobStatus
+ *
+ * NOTE: This endpoint is for video processing services, not AppView.
+ * Per ATProto architecture, video processing is handled by dedicated video services
+ * (e.g., video.bsky.app) that manage video transcoding, storage, and job tracking.
+ *
+ * AppView aggregates public data but does not process videos or maintain video job state.
+ * Users should interact with video services directly or via PDS proxy using service auth.
  */
 export async function getJobStatus(req: Request, res: Response): Promise<void> {
   try {
-    const params = getJobStatusSchema.parse(req.query);
-
-    // Get video job
-    const job = await storage.getVideoJob(params.jobId);
-
-    if (!job) {
-      res.status(404).json({ error: 'Job not found' });
-      return;
-    }
-
-    // Build response
-    const response: {
-      jobId: string;
-      did: string;
-      state: string;
-      progress: number;
-      blob?: unknown;
-      error?: string;
-    } = {
-      jobId: (job as { jobId: string }).jobId,
-      did: (job as { userDid: string }).userDid,
-      state: (job as { state: string }).state,
-      progress: (job as { progress: number }).progress,
-    };
-
-    // Add optional fields
-    if ((job as { blobRef?: unknown }).blobRef) {
-      response.blob = (job as { blobRef: unknown }).blobRef;
-    }
+    getJobStatusSchema.parse(req.query);
 
-    if ((job as { error?: string }).error) {
-      response.error = (job as { error: string }).error;
-    }
-
-    res.json({ jobStatus: response });
+    res.status(501).json({
+      error: 'NotImplemented',
+      message: 'This endpoint is for video processing services, not AppView. ' +
+               'Video processing (upload, transcoding, job tracking) is handled by dedicated video services. ' +
+               'Please use a video service endpoint (e.g., video.bsky.app) directly or via PDS proxy with service auth.',
+    });
   } catch (error) {
     handleError(res, error, 'getJobStatus');
   }
···
 /**
  * Get video upload limits
  * GET /xrpc/app.bsky.video.getUploadLimits
+ *
+ * NOTE: This endpoint is for video processing services, not AppView.
+ * Per ATProto architecture, video upload quotas and limits are managed by dedicated
+ * video services (e.g., video.bsky.app) that handle video processing and storage.
+ *
+ * AppView aggregates public data but does not manage user-specific video upload quotas.
+ * Users should check upload limits via video service endpoint or via PDS proxy with service auth.
  */
 export async function getUploadLimits(
   req: Request,
···
     const userDid = await requireAuthDid(req, res);
     if (!userDid) return;
 
-    const DAILY_VIDEO_LIMIT = Number(process.env.VIDEO_DAILY_LIMIT || 10);
-    const DAILY_BYTES_LIMIT = Number(
-      process.env.VIDEO_DAILY_BYTES || 100 * 1024 * 1024
-    );
-
-    const todayJobs = await storage.getUserVideoJobs(userDid, 1000);
-    const today = new Date();
-    today.setHours(0, 0, 0, 0);
-    const usedVideos = todayJobs.filter(
-      (j) => (j as { createdAt: Date }).createdAt >= today
-    ).length;
-    const canUpload = usedVideos < DAILY_VIDEO_LIMIT;
-
-    res.json({
-      canUpload,
-      remainingDailyVideos: Math.max(0, DAILY_VIDEO_LIMIT - usedVideos),
-      remainingDailyBytes: DAILY_BYTES_LIMIT,
-      message: canUpload ? undefined : 'Daily upload limit reached',
-      error: undefined,
+    res.status(501).json({
+      error: 'NotImplemented',
+      message: 'This endpoint is for video processing services, not AppView. ' +
+               'Video upload limits are managed by dedicated video services. ' +
+               'Please use a video service endpoint (e.g., video.bsky.app) directly or via PDS proxy with service auth.',
     });
   } catch (error) {
     handleError(res, error, 'getUploadLimits');
···
 
     // Record basic metrics; future: persist interactions for ranking signals
     const { metricsService } = await import('../../metrics');
-    for (const _ of (body as { interactions: unknown[] }).interactions) {
+    for (const _ of body.interactions) {
       metricsService.recordApiRequest();
     }
 
-    res.json({ success: true });
+    // AT Protocol spec: return empty object
+    res.json({});
   } catch (error) {
     handleError(res, error, 'sendInteractions');
   }

server/services/xrpc/utils/cache.ts

···
   timestamp: number;
 }
 
+interface PdsEndpointCache {
+  endpoint: string;
+  timestamp: number;
+}
+
 export class CacheManager {
   // Preferences cache: DID -> { preferences: unknown[], timestamp: number }
   private preferencesCache = new Map<string, PreferencesCache>();
···
   private handleResolutionCache = new Map<string, HandleResolutionCache>();
   private readonly HANDLE_RESOLUTION_CACHE_TTL = 10 * 60 * 1000; // 10 minutes
 
+  // PDS endpoint cache: DID -> { endpoint: string, timestamp: number }
+  private pdsEndpointCache = new Map<string, PdsEndpointCache>();
+  private readonly PDS_ENDPOINT_CACHE_TTL = 30 * 60 * 1000; // 30 minutes
+
   constructor() {
     // Clear expired cache entries every minute
     setInterval(() => {
       this.cleanExpiredPreferencesCache();
       this.cleanExpiredHandleResolutionCache();
+      this.cleanExpiredPdsEndpointCache();
     }, 60 * 1000);
   }
 
···
 
     expiredHandles.forEach((handle) => {
       this.handleResolutionCache.delete(handle);
+    });
+  }
+
+  /**
+   * Get PDS endpoint from cache
+   */
+  getPdsEndpoint(userDid: string): string | null {
+    const cached = this.pdsEndpointCache.get(userDid);
+    if (cached && !this.isPdsEndpointCacheExpired(cached)) {
+      return cached.endpoint;
+    }
+    return null;
+  }
+
+  /**
+   * Cache PDS endpoint for a DID
+   */
+  cachePdsEndpoint(userDid: string, endpoint: string): void {
+    this.pdsEndpointCache.set(userDid, {
+      endpoint,
+      timestamp: Date.now(),
+    });
+  }
+
+  /**
+   * Check if PDS endpoint cache entry is expired
+   */
+  private isPdsEndpointCacheExpired(cached: PdsEndpointCache): boolean {
+    return Date.now() - cached.timestamp > this.PDS_ENDPOINT_CACHE_TTL;
+  }
+
+  /**
+   * Clean expired entries from PDS endpoint cache
+   */
+  private cleanExpiredPdsEndpointCache(): void {
+    const now = Date.now();
+    const expiredDids: string[] = [];
+
+    this.pdsEndpointCache.forEach((cached, did) => {
+      if (now - cached.timestamp > this.PDS_ENDPOINT_CACHE_TTL) {
+        expiredDids.push(did);
+      }
+    });
+
+    expiredDids.forEach((did) => {
+      this.pdsEndpointCache.delete(did);
     });
   }
 }

server/services/xrpc/utils/resolvers.ts

···
 }
 
 /**
+ * Known PDS providers and their endpoints
+ * Used as fallback when DID document resolution fails
+ */
+const KNOWN_PDS_PROVIDERS: Record<string, string> = {
+  'bsky.social': 'https://bsky.social',
+  'bsky.app': 'https://bsky.social',
+  'staging.bsky.dev': 'https://staging.bsky.dev',
+};
+
+/**
+ * Attempt to discover PDS endpoint via handle resolution
+ * Uses the ATProto handle resolution mechanism (DNS TXT record or HTTPS well-known)
+ */
+async function discoverPdsViaHandle(handle: string): Promise<string | null> {
+  try {
+    // Try HTTPS well-known endpoint for handle verification
+    // This may also contain PDS information in some implementations
+    const wellKnownUrl = `https://${handle}/.well-known/atproto-did`;
+    const response = await fetch(wellKnownUrl, {
+      method: 'GET',
+      headers: { 'User-Agent': 'PublicAppView/1.0' },
+      signal: AbortSignal.timeout(5000), // 5 second timeout
+    });
+
+    if (response.ok) {
+      const didFromHandle = (await response.text()).trim();
+      if (didFromHandle.startsWith('did:')) {
+        // We found the DID, but we need to resolve it to get the PDS
+        // This creates a recursive resolution attempt, which is intentional
+        console.log(
+          `[PDS_DISCOVERY] Handle ${handle} resolved to DID via well-known: ${didFromHandle}`
+        );
+        // Don't recurse here - just return null and let caller handle it
+        return null;
+      }
+    }
+  } catch (error) {
+    // Well-known resolution failed, which is expected for most handles
+    console.log(
+      `[PDS_DISCOVERY] Well-known resolution failed for handle ${handle} (this is normal)`
+    );
+  }
+
+  return null;
+}
+
+/**
+ * Extract domain from handle and validate it
+ * Returns null if handle format is invalid
+ */
+function extractDomainFromHandle(handle: string): string | null {
+  if (!handle || typeof handle !== 'string') {
+    return null;
+  }
+
+  // Handle must be a valid domain format
+  // Examples: alice.bsky.social, bob.example.com, charlie.co.uk
+  const parts = handle.toLowerCase().split('.');
+
+  if (parts.length < 2) {
+    return null; // Invalid handle format
+  }
+
+  // Check for known multi-part TLDs (e.g., .co.uk, .com.au)
+  const knownMultiPartTlds = [
+    'co.uk',
+    'com.au',
+    'co.nz',
+    'co.za',
+    'com.br',
+    'co.jp',
+    'ac.uk',
+    'gov.uk',
+  ];
+
+  // Try to extract domain intelligently
+  if (parts.length >= 3) {
+    const lastTwoParts = parts.slice(-2).join('.');
+    if (knownMultiPartTlds.includes(lastTwoParts)) {
+      // Handle multi-part TLD: take last 3 parts (subdomain.domain.co.uk -> domain.co.uk)
+      if (parts.length >= 3) {
+        return parts.slice(-3).join('.');
+      }
+    }
+  }
+
+  // Default: take last 2 parts (subdomain.domain.com -> domain.com)
+  return parts.slice(-2).join('.');
+}
+
+/**
  * Get PDS endpoint for a user DID
+ * Enhanced with improved fallback logic and better error handling
  */
 export async function getUserPdsEndpoint(
   userDid: string
 ): Promise<string | null> {
   try {
-    // Resolve DID document to find PDS endpoint
+    // Step 0: Check cache first
+    const cachedEndpoint = cacheManager.getPdsEndpoint(userDid);
+    if (cachedEndpoint) {
+      console.log(
+        `[PDS_DISCOVERY] ✓ Cache hit for ${userDid}: ${cachedEndpoint}`
+      );
+      return cachedEndpoint;
+    }
+
+    // Step 1: Resolve DID document to find PDS endpoint (primary method)
     const didDoc = await resolveDidDocument(userDid);
-    if (!didDoc) return null;
 
-    // Look for PDS endpoint in service endpoints
-    const services = (didDoc as { service?: unknown[] }).service || [];
-    const pdsService = services.find((service: unknown) => {
-      const svc = service as { type?: string; id?: string };
-      return (
-        svc.type === 'AtprotoPersonalDataServer' || svc.id === '#atproto_pds'
+    if (didDoc) {
+      // Look for PDS endpoint in service endpoints
+      const services = (didDoc as { service?: unknown[] }).service || [];
+      const pdsService = services.find((service: unknown) => {
+        const svc = service as { type?: string; id?: string };
+        return (
+          svc.type === 'AtprotoPersonalDataServer' || svc.id === '#atproto_pds'
+        );
+      });
+
+      if (
+        pdsService &&
+        (pdsService as { serviceEndpoint?: string }).serviceEndpoint
+      ) {
+        const endpoint = (pdsService as { serviceEndpoint: string })
+          .serviceEndpoint;
+
+        // SECURITY: Validate PDS endpoint to prevent SSRF attacks
+        // Malicious DID documents could point to internal services
+        if (!isUrlSafeToFetch(endpoint)) {
+          console.error(
+            `[PDS_DISCOVERY] SECURITY: Blocked unsafe PDS endpoint for ${userDid}: ${endpoint}`
+          );
+          // Don't return null immediately - try fallback methods
+        } else {
+          console.log(
+            `[PDS_DISCOVERY] ✓ Resolved PDS from DID document: ${endpoint}`
+          );
+          // Cache the successfully resolved endpoint
+          cacheManager.cachePdsEndpoint(userDid, endpoint);
+          return endpoint;
+        }
+      }
+    }
+
+    // Step 2: Fallback to handle-based resolution
+    console.log(
+      `[PDS_DISCOVERY] DID document resolution failed or missing PDS service, trying handle-based fallback for ${userDid}`
+    );
+
+    const user = await storage.getUser(userDid);
+    if (!user?.handle) {
+      console.warn(
+        `[PDS_DISCOVERY] No handle found for ${userDid}, cannot use fallback`
       );
-    });
+      return null;
+    }
 
-    if (
-      pdsService &&
-      (pdsService as { serviceEndpoint?: string }).serviceEndpoint
-    ) {
-      const endpoint = (pdsService as { serviceEndpoint: string })
-        .serviceEndpoint;
+    const handle = user.handle.toLowerCase();
+    console.log(`[PDS_DISCOVERY] Found handle: ${handle}`);
 
-      // SECURITY: Validate PDS endpoint to prevent SSRF attacks
-      // Malicious DID documents could point to internal services
-      if (!isUrlSafeToFetch(endpoint)) {
-        console.error(
-          `[XRPC] SECURITY: Blocked unsafe PDS endpoint for ${userDid}: ${endpoint}`
+    // Step 2a: Check known PDS providers (fast path)
+    for (const [domain, pdsEndpoint] of Object.entries(KNOWN_PDS_PROVIDERS)) {
+      if (handle.endsWith(`.${domain}`) || handle === domain) {
+        console.log(
+          `[PDS_DISCOVERY] ✓ Matched known provider: ${domain} -> ${pdsEndpoint}`
         );
-        return null;
+        // Cache the successfully resolved endpoint
+        cacheManager.cachePdsEndpoint(userDid, pdsEndpoint);
+        return pdsEndpoint;
       }
+    }
 
-      return endpoint;
+    // Step 2b: Try handle-based discovery (ATProto well-known)
+    const discoveredPds = await discoverPdsViaHandle(handle);
+    if (discoveredPds) {
+      // Validate before returning
+      if (isUrlSafeToFetch(discoveredPds)) {
+        console.log(
+          `[PDS_DISCOVERY] ✓ Discovered PDS via handle: ${discoveredPds}`
+        );
+        // Cache the successfully resolved endpoint
+        cacheManager.cachePdsEndpoint(userDid, discoveredPds);
+        return discoveredPds;
+      } else {
+        console.warn(
+          `[PDS_DISCOVERY] SECURITY: Blocked unsafe discovered PDS: ${discoveredPds}`
+        );
+      }
     }
 
-    // Fallback: try to construct PDS URL from handle if available
-    const user = await storage.getUser(userDid);
-    if (user?.handle) {
-      // For now, assume bsky.social PDS for handles ending in .bsky.social
-      if (user.handle.endsWith('.bsky.social')) {
-        return 'https://bsky.social';
+    // Step 2c: Extract domain from handle and construct PDS URL
+    const domain = extractDomainFromHandle(handle);
+    if (domain) {
+      const constructedPds = `https://${domain}`;
+
+      // Validate the constructed URL
+      if (isUrlSafeToFetch(constructedPds)) {
+        console.log(
+          `[PDS_DISCOVERY] ⚠ Using constructed PDS URL from handle domain (may be incorrect): ${constructedPds}`
+        );
+        console.log(
+          `[PDS_DISCOVERY] ⚠ This is a heuristic fallback - the PDS may not be at this domain`
+        );
+        // Cache the constructed endpoint with shorter TTL (since it's less reliable)
+        // Note: The cache uses a fixed TTL, but this could be enhanced to use different TTLs
+        cacheManager.cachePdsEndpoint(userDid, constructedPds);
+        return constructedPds;
+      } else {
+        console.warn(
+          `[PDS_DISCOVERY] SECURITY: Blocked unsafe constructed PDS: ${constructedPds}`
+        );
       }
-      // For other handles, try to construct PDS URL
-      // This is a simplified approach - in production you'd need more sophisticated PDS discovery
-      return `https://${user.handle.split('.').slice(-2).join('.')}`;
     }
 
+    // Step 3: All methods failed
+    console.error(
+      `[PDS_DISCOVERY] ✗ Failed to resolve PDS endpoint for ${userDid} (handle: ${handle})`
+    );
+    console.error(
+      `[PDS_DISCOVERY] Recommendation: Ensure DID document is properly configured with PDS service endpoint`
+    );
     return null;
   } catch (error) {
     console.error(
-      `[PREFERENCES] Error resolving PDS endpoint for ${userDid}:`,
+      `[PDS_DISCOVERY] Error resolving PDS endpoint for ${userDid}:`,
       error
     );
     return null;

server/storage.ts

···
   createUser(user: InsertUser): Promise<User>;
   updateUser(did: string, data: Partial<InsertUser>): Promise<User | undefined>;
   upsertUserHandle(did: string, handle: string): Promise<void>;
-  getSuggestedUsers(viewerDid?: string, limit?: number): Promise<User[]>;
+  getSuggestedUsers(
+    viewerDid?: string,
+    limit?: number,
+    cursor?: string
+  ): Promise<{ users: User[]; cursor?: string }>;
   getUserFollowerCount(did: string): Promise<number>;
   getUsersFollowerCounts(dids: string[]): Promise<Map<string, number>>;
   getUserFollowingCount(did: string): Promise<number>;
···
   // Thread mute operations
   createThreadMute(threadMute: InsertThreadMute): Promise<ThreadMute>;
   deleteThreadMute(uri: string): Promise<void>;
+  deleteThreadMuteByRoot(
+    muterDid: string,
+    threadRootUri: string
+  ): Promise<void>;
   getThreadMutes(
     muterDid: string,
     limit?: number,
···
   getNotifications(
     recipientDid: string,
     limit?: number,
-    cursor?: string
+    cursor?: string,
+    seenAt?: Date
   ): Promise<Notification[]>;
   getUnreadNotificationCount(recipientDid: string): Promise<number>;
   markNotificationsAsRead(recipientDid: string, seenAt?: Date): Promise<void>;
···
   deleteList(uri: string): Promise<void>;
   getList(uri: string): Promise<List | undefined>;
   getUserLists(creatorDid: string, limit?: number): Promise<List[]>;
+  getUserListsWithPagination(
+    creatorDid: string,
+    limit?: number,
+    cursor?: string,
+    purposes?: string[]
+  ): Promise<{ lists: List[]; cursor?: string }>;
 
   // List item operations
   createListItem(item: InsertListItem): Promise<ListItem>;
   deleteListItem(uri: string): Promise<void>;
   getListItems(listUri: string, limit?: number): Promise<ListItem[]>;
+  getListItemsWithPagination(
+    listUri: string,
+    limit?: number,
+    cursor?: string
+  ): Promise<{ items: ListItem[]; cursor?: string }>;
   getListFeed(
     listUri: string,
     limit?: number,
···
   ): Promise<PushSubscription>;
   deletePushSubscription(id: number): Promise<void>;
   deletePushSubscriptionByToken(token: string): Promise<void>;
+  deletePushSubscriptionByDetails(
+    userDid: string,
+    token: string,
+    platform: string,
+    appId: string
+  ): Promise<void>;
   getUserPushSubscriptions(userDid: string): Promise<PushSubscription[]>;
   getPushSubscription(id: number): Promise<PushSubscription | undefined>;
   updatePushSubscription(
···
     return await this.db.select().from(users).where(inArray(users.did, dids));
   }
 
-  async getSuggestedUsers(viewerDid?: string, limit = 25): Promise<User[]> {
+  async getSuggestedUsers(
+    viewerDid?: string,
+    limit = 25,
+    cursor?: string
+  ): Promise<{ users: User[]; cursor?: string }> {
+    const conditions: SQL<unknown>[] = [];
+
     if (viewerDid) {
       const followedDids = await db
         .select({ did: follows.followingDid })
···
 
       const followedDidList = followedDids.map((f) => f.did);
 
+      conditions.push(sql`${users.did} != ${viewerDid}`);
+
       if (followedDidList.length > 0) {
-        return await db
-          .select()
-          .from(users)
-          .where(
-            and(
-              sql`${users.did} != ${viewerDid}`,
-              sql`${users.did} NOT IN (${sql.join(
-                followedDidList.map((did) => sql`${did}`),
-                sql`, `
-              )})`
-            )
-          )
-          .orderBy(desc(users.createdAt))
-          .limit(limit);
+        conditions.push(
+          sql`${users.did} NOT IN (${sql.join(
+            followedDidList.map((did) => sql`${did}`),
+            sql`, `
+          )})`
+        );
       }
     }
 
-    return await db
+    // Add cursor condition for pagination
+    if (cursor) {
+      conditions.push(sql`${users.createdAt} < ${new Date(cursor)}`);
+    }
+
+    const query = db
       .select()
       .from(users)
       .orderBy(desc(users.createdAt))
-      .limit(limit);
+      .limit(limit + 1);
+
+    const results =
+      conditions.length > 0
+        ? await query.where(and(...conditions))
+        : await query;
+
+    const hasMore = results.length > limit;
+    const userResults = hasMore ? results.slice(0, limit) : results;
+    const nextCursor = hasMore
+      ? userResults[userResults.length - 1]?.createdAt.toISOString()
+      : undefined;
+
+    return {
+      users: userResults,
+      cursor: nextCursor,
+    };
   }
 
   async getUserFollowerCount(did: string): Promise<number> {
···
     await this.db.delete(threadMutes).where(eq(threadMutes.uri, uri));
   }
 
+  async deleteThreadMuteByRoot(
+    muterDid: string,
+    threadRootUri: string
+  ): Promise<void> {
+    await this.db
+      .delete(threadMutes)
+      .where(
+        and(
+          eq(threadMutes.muterDid, muterDid),
+          eq(threadMutes.threadRootUri, threadRootUri)
+        )
+      );
+  }
+
   async getThreadMutes(
     muterDid: string,
     limit = 100,
···
   async getNotifications(
     recipientDid: string,
     limit = 50,
-    cursor?: string
+    cursor?: string,
+    seenAt?: Date
   ): Promise<Notification[]> {
     const conditions = [eq(notifications.recipientDid, recipientDid)];
 
···
       conditions.push(sql`${notifications.indexedAt} < ${new Date(cursor)}`);
     }
 
+    // Filter by seenAt if provided (only return notifications before this time)
+    if (seenAt) {
+      conditions.push(sql`${notifications.indexedAt} <= ${seenAt}`);
+    }
+
     return await db
       .select()
       .from(notifications)
···
       .limit(limit);
   }
 
+  async getUserListsWithPagination(
+    creatorDid: string,
+    limit = 50,
+    cursor?: string,
+    purposes?: string[]
+  ): Promise<{ lists: List[]; cursor?: string }> {
+    const conditions = [eq(lists.creatorDid, creatorDid)];
+
+    if (cursor) {
+      conditions.push(sql`${lists.indexedAt} < ${new Date(cursor)}`);
+    }
+
+    if (purposes && purposes.length > 0) {
+      conditions.push(inArray(lists.purpose, purposes));
+    }
+
+    const results = await this.db
+      .select()
+      .from(lists)
+      .where(and(...conditions))
+      .orderBy(desc(lists.indexedAt))
+      .limit(limit + 1);
+
+    const hasMore = results.length > limit;
+    const listResults = hasMore ? results.slice(0, limit) : results;
+    const nextCursor = hasMore ? listResults[listResults.length - 1]?.indexedAt.toISOString() : undefined;
+
+    return {
+      lists: listResults,
+      cursor: nextCursor,
+    };
+  }
+
   async createListItem(item: InsertListItem): Promise<ListItem> {
     const [newItem] = await this.db
       .insert(listItems)
···
       .limit(limit);
   }
 
+  async getListItemsWithPagination(
+    listUri: string,
+    limit = 50,
+    cursor?: string
+  ): Promise<{ items: ListItem[]; cursor?: string }> {
+    const conditions = [eq(listItems.listUri, listUri)];
+
+    if (cursor) {
+      conditions.push(sql`${listItems.indexedAt} < ${new Date(cursor)}`);
+    }
+
+    const items = await this.db
+      .select()
+      .from(listItems)
+      .where(and(...conditions))
+      .orderBy(desc(listItems.indexedAt))
+      .limit(limit + 1);
+
+    const hasMore = items.length > limit;
+    const resultItems = hasMore ? items.slice(0, limit) : items;
+    const nextCursor = hasMore ? resultItems[resultItems.length - 1]?.indexedAt.toISOString() : undefined;
+
+    return {
+      items: resultItems,
+      cursor: nextCursor,
+    };
+  }
+
   async getListFeed(
     listUri: string,
     limit = 50,
     cursor?: string
   ): Promise<Post[]> {
-    const items = await this.getListItems(listUri, 500);
+    // Fetch all list members (no hardcoded limit)
+    // For very large lists, consider adding pagination or caching
+    const items = await this.db
+      .select()
+      .from(listItems)
+      .where(eq(listItems.listUri, listUri))
+      .orderBy(desc(listItems.indexedAt));
+
     const memberDids = items.map((item) => item.subjectDid);
 
     if (memberDids.length === 0) {
···
       conditions.push(sql`${posts.indexedAt} < ${new Date(cursor)}`);
     }
 
-    return await this.db
+    // Fetch limit + 1 to determine if more results exist
+    const results = await this.db
       .select()
       .from(posts)
       .where(and(...conditions))
       .orderBy(desc(posts.indexedAt))
-      .limit(limit);
+      .limit(limit + 1);
+
+    // Return only requested limit (endpoint will use length to determine cursor)
+    return results.slice(0, limit);
   }
 
   // Feed generator operations
···
     await this.db
       .delete(pushSubscriptions)
       .where(eq(pushSubscriptions.token, token));
+  }
+
+  async deletePushSubscriptionByDetails(
+    userDid: string,
+    token: string,
+    platform: string,
+    appId: string
+  ): Promise<void> {
+    await this.db
+      .delete(pushSubscriptions)
+      .where(
+        and(
+          eq(pushSubscriptions.userDid, userDid),
+          eq(pushSubscriptions.token, token),
+          eq(pushSubscriptions.platform, platform),
+          eq(pushSubscriptions.appId, appId)
+        )
+      );
   }
 
   async getUserPushSubscriptions(userDid: string): Promise<PushSubscription[]> {

shared/schema.ts

···
   savedFeeds: jsonb('saved_feeds').default([]).notNull(), // savedFeedsPrefV2 items
   notificationPriority: boolean('notification_priority')
     .default(false)
-    .notNull(), // Push notification priority
+    .notNull(), // Push notification priority (legacy)
+  notificationPreferencesV2: jsonb('notification_preferences_v2')
+    .default(
+      sql`'{
+      "chat": {"include": "accepted", "push": true},
+      "follow": {"list": true, "push": true, "include": "all"},
+      "like": {"list": true, "push": false, "include": "follows"},
+      "mention": {"list": true, "push": true, "include": "all"},
+      "reply": {"list": true, "push": true, "include": "all"},
+      "repost": {"list": true, "push": false, "include": "follows"},
+      "quote": {"list": true, "push": true, "include": "all"},
+      "likeViaRepost": {"list": false, "push": false, "include": "all"},
+      "repostViaRepost": {"list": false, "push": false, "include": "all"},
+      "starterpackJoined": {"list": true, "push": false},
+      "subscribedPost": {"list": true, "push": true},
+      "unverified": {"list": true, "push": false},
+      "verified": {"list": true, "push": true}
+    }'::jsonb`
+    )
+    .notNull(), // ATProto v2 notification preferences
   createdAt: timestamp('created_at').defaultNow().notNull(),
   updatedAt: timestamp('updated_at').defaultNow().notNull(),
 });