feat: make indiko compatible with the latest version of indieauth

src/client/admin-clients.ts

···
-const token = localStorage.getItem('indiko_session');
-const footer = document.getElementById('footer') as HTMLElement;
-const clientsList = document.getElementById('clientsList') as HTMLElement;
-const createClientBtn = document.getElementById('createClientBtn') as HTMLButtonElement;
-const clientModal = document.getElementById('clientModal') as HTMLElement;
-const modalClose = document.getElementById('modalClose') as HTMLButtonElement;
-const cancelBtn = document.getElementById('cancelBtn') as HTMLButtonElement;
-const clientForm = document.getElementById('clientForm') as HTMLFormElement;
-const modalTitle = document.getElementById('modalTitle') as HTMLElement;
-const addRedirectUriBtn = document.getElementById('addRedirectUriBtn') as HTMLButtonElement;
-const redirectUrisList = document.getElementById('redirectUrisList') as HTMLElement;
-const toast = document.getElementById('toast') as HTMLElement;
+const token = localStorage.getItem("indiko_session");
+const footer = document.getElementById("footer") as HTMLElement;
+const clientsList = document.getElementById("clientsList") as HTMLElement;
+const createClientBtn = document.getElementById(
+	"createClientBtn",
+) as HTMLButtonElement;
+const clientModal = document.getElementById("clientModal") as HTMLElement;
+const modalClose = document.getElementById("modalClose") as HTMLButtonElement;
+const cancelBtn = document.getElementById("cancelBtn") as HTMLButtonElement;
+const clientForm = document.getElementById("clientForm") as HTMLFormElement;
+const modalTitle = document.getElementById("modalTitle") as HTMLElement;
+const addRedirectUriBtn = document.getElementById(
+	"addRedirectUriBtn",
+) as HTMLButtonElement;
+const redirectUrisList = document.getElementById(
+	"redirectUrisList",
+) as HTMLElement;
+const toast = document.getElementById("toast") as HTMLElement;
 
-function showToast(message: string, type: 'success' | 'error' = 'success') {
+function showToast(message: string, type: "success" | "error" = "success") {
 	toast.textContent = message;
 	toast.className = `toast ${type} show`;
-	
+
 	setTimeout(() => {
-		toast.classList.remove('show');
+		toast.classList.remove("show");
 	}, 3000);
 }
 
 async function checkAuth() {
 	if (!token) {
-		window.location.href = '/login';
+		window.location.href = "/login";
 		return;
 	}
 
 	try {
-		const response = await fetch('/api/hello', {
+		const response = await fetch("/api/hello", {
 			headers: {
-				'Authorization': `Bearer ${token}`,
+				Authorization: `Bearer ${token}`,
 			},
 		});
 
 		if (response.status === 401 || response.status === 403) {
-			localStorage.removeItem('indiko_session');
-			window.location.href = '/login';
+			localStorage.removeItem("indiko_session");
+			window.location.href = "/login";
 			return;
 		}
 
···
 		footer.innerHTML = `admin • signed in as <strong><a href="/u/${data.username}">${data.username}</a></strong> • <a href="/login" id="logoutLink">sign out</a>
 		<div class="back-link"><a href="/">← back to dashboard</a></div>`;
 
-		document.getElementById('logoutLink')?.addEventListener('click', async (e) => {
-			e.preventDefault();
-			try {
-				await fetch('/auth/logout', {
-					method: 'POST',
-					headers: {
-						'Authorization': `Bearer ${token}`,
-					},
-				});
-			} catch {
-				// Ignore logout errors
-			}
-			localStorage.removeItem('indiko_session');
-			window.location.href = '/login';
-		});
+		document
+			.getElementById("logoutLink")
+			?.addEventListener("click", async (e) => {
+				e.preventDefault();
+				try {
+					await fetch("/auth/logout", {
+						method: "POST",
+						headers: {
+							Authorization: `Bearer ${token}`,
+						},
+					});
+				} catch {
+					// Ignore logout errors
+				}
+				localStorage.removeItem("indiko_session");
+				window.location.href = "/login";
+			});
 
 		if (!data.isAdmin) {
-			window.location.href = '/';
+			window.location.href = "/";
 			return;
 		}
 
 		loadClients();
 	} catch (error) {
-		console.error('Auth check failed:', error);
-		footer.textContent = 'error loading user info';
+		console.error("Auth check failed:", error);
+		footer.textContent = "error loading user info";
 		clientsList.innerHTML = '<div class="error">Failed to load clients</div>';
 	}
 }
···
 
 async function loadClients() {
 	try {
-		const response = await fetch('/api/admin/clients', {
+		const response = await fetch("/api/admin/clients", {
 			headers: {
-				'Authorization': `Bearer ${token}`,
+				Authorization: `Bearer ${token}`,
 			},
 		});
 
 		if (!response.ok) {
-			throw new Error('Failed to load clients');
+			throw new Error("Failed to load clients");
 		}
 
 		const data = await response.json();
 		displayClients(data.clients);
 	} catch (error) {
-		console.error('Failed to load clients:', error);
+		console.error("Failed to load clients:", error);
 		clientsList.innerHTML = '<div class="error">Failed to load clients</div>';
 	}
 }
 
 function displayClients(clients: Client[]) {
 	if (clients.length === 0) {
-		clientsList.innerHTML = '<div class="empty">No OAuth clients registered yet.</div>';
+		clientsList.innerHTML =
+			'<div class="empty">No OAuth clients registered yet.</div>';
 		return;
 	}
 
-	clientsList.innerHTML = clients.map((client) => {
-		const lastUsedDate = new Date(client.lastUsed * 1000).toLocaleDateString();
-		const firstSeenDate = new Date(client.firstSeen * 1000).toLocaleDateString();
-		
-		return `
+	clientsList.innerHTML = clients
+		.map((client) => {
+			const lastUsedDate = new Date(
+				client.lastUsed * 1000,
+			).toLocaleDateString();
+			const firstSeenDate = new Date(
+				client.firstSeen * 1000,
+			).toLocaleDateString();
+
+			return `
 			<div class="client-card" data-client-id="${client.clientId}">
 				<div class="client-header" onclick="toggleClient('${client.clientId}')">
 					<div class="client-logo">
-						${client.logoUrl 
-							? `<img src="${client.logoUrl}" alt="${client.name}" />`
-							: `<div class="client-logo-placeholder">🔐</div>`
+						${
+							client.logoUrl
+								? `<img src="${client.logoUrl}" alt="${client.name}" />`
+								: `<div class="client-logo-placeholder">🔐</div>`
 						}
 					</div>
 					<div class="client-info">
 						<div class="client-name">${client.name}</div>
 						<div class="client-id">${client.clientId}</div>
-						${client.description ? `<div class="client-description">${client.description}</div>` : ''}
+						${client.description ? `<div class="client-description">${client.description}</div>` : ""}
 						<div class="client-badges">
-							<span class="badge ${client.isPreregistered ? 'badge-preregistered' : 'badge-auto'}">
-								${client.isPreregistered ? 'pre-registered' : 'auto-registered'}
+							<span class="badge ${client.isPreregistered ? "badge-preregistered" : "badge-auto"}">
+								${client.isPreregistered ? "pre-registered" : "auto-registered"}
 							</span>
 							<span class="badge badge-auto">first seen ${firstSeenDate}</span>
 							<span class="badge badge-auto">last used ${lastUsedDate}</span>
 						</div>
 					</div>
 					<div class="client-actions" style="display: flex; gap: 0.5rem; align-items: center;">
-						${client.isPreregistered ? `
+						${
+							client.isPreregistered
+								? `
 							<button class="btn-edit" onclick="event.stopPropagation(); editClient('${client.clientId}')">edit</button>
 							<button class="btn-delete" onclick="event.stopPropagation(); deleteClient('${client.clientId}', event)">delete</button>
-						` : ''}
+						`
+								: ""
+						}
 						<span class="expand-indicator">details <span class="arrow">▼</span></span>
 					</div>
 				</div>
···
 				</div>
 			</div>
 		`;
-	}).join('');
+		})
+		.join("");
 }
 
-(window as any).toggleClient = async function(clientId: string) {
-	const card = document.querySelector(`[data-client-id="${clientId}"]`) as HTMLElement;
+(window as any).toggleClient = async (clientId: string) => {
+	const card = document.querySelector(
+		`[data-client-id="${clientId}"]`,
+	) as HTMLElement;
 	if (!card) return;
 
-	const isExpanded = card.classList.contains('expanded');
-	const arrow = card.querySelector('.arrow') as HTMLElement;
-	
+	const isExpanded = card.classList.contains("expanded");
+	const arrow = card.querySelector(".arrow") as HTMLElement;
+
 	if (isExpanded) {
-		card.classList.remove('expanded');
-		if (arrow) arrow.textContent = '▼';
+		card.classList.remove("expanded");
+		if (arrow) arrow.textContent = "▼";
 		return;
 	}
 
-	card.classList.add('expanded');
-	if (arrow) arrow.textContent = '▲';
-	
-	const detailsDiv = document.getElementById(`details-${encodeURIComponent(clientId)}`);
+	card.classList.add("expanded");
+	if (arrow) arrow.textContent = "▲";
+
+	const detailsDiv = document.getElementById(
+		`details-${encodeURIComponent(clientId)}`,
+	);
 	if (!detailsDiv) return;
 
-	if (detailsDiv.dataset.loaded === 'true') {
+	if (detailsDiv.dataset.loaded === "true") {
 		return;
 	}
 
 	try {
-		const response = await fetch(`/api/admin/clients/${encodeURIComponent(clientId)}`, {
-			headers: {
-				'Authorization': `Bearer ${token}`,
+		const response = await fetch(
+			`/api/admin/clients/${encodeURIComponent(clientId)}`,
+			{
+				headers: {
+					Authorization: `Bearer ${token}`,
+				},
 			},
-		});
+		);
 
 		if (!response.ok) {
-			throw new Error('Failed to load client details');
+			throw new Error("Failed to load client details");
 		}
 
 		const data = await response.json();
-		
+
 		detailsDiv.innerHTML = `
-			${data.client.isPreregistered ? `
+			${
+				data.client.isPreregistered
+					? `
 				<div class="detail-section">
 					<div class="detail-title">client secret</div>
 					<div class="secret-section">
···
 						<button class="btn-edit" onclick="event.stopPropagation(); regenerateSecret('${clientId}', event)">regenerate secret</button>
 					</div>
 				</div>
-			` : ''}
+			`
+					: ""
+			}
 			<div class="detail-section">
 				<div class="detail-title">redirect uris</div>
 				<div class="redirect-uris">
-					${data.client.redirectUris.map((uri: string) => `<div class="redirect-uri">${uri}</div>`).join('')}
+					${data.client.redirectUris.map((uri: string) => `<div class="redirect-uri">${uri}</div>`).join("")}
 				</div>
 			</div>
 			<div class="detail-section">
 				<div class="detail-title">authorized users (${data.users.length})</div>
-				${data.users.length === 0 
-					? '<div class="empty">No users have authorized this client yet</div>'
-					: `<div class="users-list">
-						${data.users.map((user: ClientUser) => {
-							const grantedDate = new Date(user.grantedAt * 1000).toLocaleDateString();
-							const lastUsedDate = new Date(user.lastUsed * 1000).toLocaleDateString();
-							
-							return `
+				${
+					data.users.length === 0
+						? '<div class="empty">No users have authorized this client yet</div>'
+						: `<div class="users-list">
+						${data.users
+							.map((user: ClientUser) => {
+								const grantedDate = new Date(
+									user.grantedAt * 1000,
+								).toLocaleDateString();
+								const lastUsedDate = new Date(
+									user.lastUsed * 1000,
+								).toLocaleDateString();
+
+								return `
 								<div class="user-item">
 									<div class="user-info">
 										<div class="user-name"><a href="/u/${user.username}" onclick="event.stopPropagation();" style="color: var(--lavender); text-decoration: none;">${user.name}</a> (<a href="/u/${user.username}" onclick="event.stopPropagation();" style="color: var(--old-rose); text-decoration: none;">@${user.username}</a>)</div>
-										${data.client.isPreregistered && data.client.availableRoles !== null ? `
+										${
+											data.client.isPreregistered &&
+											data.client.availableRoles !== null
+												? `
 											<div class="user-role-input">
-												<label style="color: var(--old-rose); font-size: 0.75rem;">ROLE${data.client.availableRoles.length > 0 ? '' : ' (OPTIONAL)'}:</label>
-												${data.client.availableRoles.length > 0 
-													? `<select data-username="${user.username}" data-client-id="${clientId}" style="padding: 0.5rem; background: rgba(0, 0, 0, 0.3); border: 1px solid var(--old-rose); color: var(--lavender); font-family: inherit; font-size: 0.875rem;">
+												<label style="color: var(--old-rose); font-size: 0.75rem;">ROLE${data.client.availableRoles.length > 0 ? "" : " (OPTIONAL)"}:</label>
+												${
+													data.client.availableRoles.length > 0
+														? `<select data-username="${user.username}" data-client-id="${clientId}" style="padding: 0.5rem; background: rgba(0, 0, 0, 0.3); border: 1px solid var(--old-rose); color: var(--lavender); font-family: inherit; font-size: 0.875rem;">
 														<option value="">No role</option>
-														${data.client.availableRoles.map((role: string) => `
-															<option value="${role}" ${user.role === role ? 'selected' : ''}>${role}</option>
-														`).join('')}
+														${data.client.availableRoles
+															.map(
+																(role: string) => `
+															<option value="${role}" ${user.role === role ? "selected" : ""}>${role}</option>
+														`,
+															)
+															.join("")}
 													</select>`
-													: `<input type="text" value="${user.role || ''}" placeholder="e.g. admin, editor, viewer" data-username="${user.username}" data-client-id="${clientId}" />`
+														: `<input type="text" value="${user.role || ""}" placeholder="e.g. admin, editor, viewer" data-username="${user.username}" data-client-id="${clientId}" />`
 												}
 												<button onclick="event.stopPropagation(); setUserRole('${clientId}', '${user.username}', this.previousElementSibling.value)">update</button>
 											</div>
-										` : ''}
+										`
+												: ""
+										}
 										<div class="user-meta">
-											Granted ${grantedDate} • Last used ${lastUsedDate} • Scopes: ${user.scopes.join(', ')}
+											Granted ${grantedDate} • Last used ${lastUsedDate} • Scopes: ${user.scopes.join(", ")}
 										</div>
 									</div>
 									<button class="revoke-btn" onclick="event.stopPropagation(); revokeUserPermission('${clientId}', '${user.username}', event)">revoke</button>
 								</div>
 							`;
-						}).join('')}
+							})
+							.join("")}
 					</div>`
 				}
 			</div>
 		`;
-		
-		detailsDiv.dataset.loaded = 'true';
+
+		detailsDiv.dataset.loaded = "true";
 	} catch (error) {
-		console.error('Failed to load client details:', error);
+		console.error("Failed to load client details:", error);
 		detailsDiv.innerHTML = '<div class="error">Failed to load details</div>';
 	}
 };
 
-(window as any).setUserRole = async function(clientId: string, username: string, role: string) {
+(window as any).setUserRole = async (
+	clientId: string,
+	username: string,
+	role: string,
+) => {
 	try {
-		const response = await fetch(`/api/admin/clients/${encodeURIComponent(clientId)}/users/${encodeURIComponent(username)}/role`, {
-			method: 'POST',
-			headers: {
-				'Authorization': `Bearer ${token}`,
-				'Content-Type': 'application/json',
+		const response = await fetch(
+			`/api/admin/clients/${encodeURIComponent(clientId)}/users/${encodeURIComponent(username)}/role`,
+			{
+				method: "POST",
+				headers: {
+					Authorization: `Bearer ${token}`,
+					"Content-Type": "application/json",
+				},
+				body: JSON.stringify({ role: role || null }),
 			},
-			body: JSON.stringify({ role: role || null }),
-		});
+		);
 
 		if (!response.ok) {
-			throw new Error('Failed to set user role');
+			throw new Error("Failed to set user role");
 		}
 
-		showToast('User role updated successfully');
+		showToast("User role updated successfully");
 	} catch (error) {
-		console.error('Failed to set user role:', error);
-		showToast('Failed to update user role. Please try again.', 'error');
+		console.error("Failed to set user role:", error);
+		showToast("Failed to update user role. Please try again.", "error");
 	}
 };
 
-(window as any).editClient = async function(clientId: string) {
+(window as any).editClient = async (clientId: string) => {
 	try {
-		const response = await fetch(`/api/admin/clients/${encodeURIComponent(clientId)}`, {
-			headers: {
-				'Authorization': `Bearer ${token}`,
+		const response = await fetch(
+			`/api/admin/clients/${encodeURIComponent(clientId)}`,
+			{
+				headers: {
+					Authorization: `Bearer ${token}`,
+				},
 			},
-		});
+		);
 
 		if (!response.ok) {
-			throw new Error('Failed to load client');
+			throw new Error("Failed to load client");
 		}
 
 		const data = await response.json();
 		const client = data.client;
 
-		modalTitle.textContent = 'Edit OAuth Client';
-		(document.getElementById('editClientId') as HTMLInputElement).value = clientId;
-		(document.getElementById('clientName') as HTMLInputElement).value = client.name || '';
-		(document.getElementById('logoUrl') as HTMLInputElement).value = client.logoUrl || '';
-		(document.getElementById('description') as HTMLTextAreaElement).value = client.description || '';
-		(document.getElementById('availableRoles') as HTMLTextAreaElement).value = client.availableRoles ? client.availableRoles.join('\n') : '';
-		(document.getElementById('defaultRole') as HTMLInputElement).value = client.defaultRole || '';
+		modalTitle.textContent = "Edit OAuth Client";
+		(document.getElementById("editClientId") as HTMLInputElement).value =
+			clientId;
+		(document.getElementById("clientName") as HTMLInputElement).value =
+			client.name || "";
+		(document.getElementById("logoUrl") as HTMLInputElement).value =
+			client.logoUrl || "";
+		(document.getElementById("description") as HTMLTextAreaElement).value =
+			client.description || "";
+		(document.getElementById("availableRoles") as HTMLTextAreaElement).value =
+			client.availableRoles ? client.availableRoles.join("\n") : "";
+		(document.getElementById("defaultRole") as HTMLInputElement).value =
+			client.defaultRole || "";
 
-		redirectUrisList.innerHTML = client.redirectUris.map((uri: string) => `
+		redirectUrisList.innerHTML = client.redirectUris
+			.map(
+				(uri: string) => `
 			<div class="redirect-uri-item">
 				<input type="url" class="form-input redirect-uri-input" value="${uri}" required />
 				<button type="button" class="btn-remove" onclick="removeRedirectUri(this)">remove</button>
 			</div>
-		`).join('');
+		`,
+			)
+			.join("");
 
-		clientModal.classList.add('active');
+		clientModal.classList.add("active");
 	} catch (error) {
-		console.error('Failed to load client:', error);
-		showToast('Failed to load client details', 'error');
+		console.error("Failed to load client:", error);
+		showToast("Failed to load client details", "error");
 	}
 };
 
-(window as any).deleteClient = async function(clientId: string, event?: Event) {
+(window as any).deleteClient = async (clientId: string, event?: Event) => {
 	const btn = event?.target as HTMLButtonElement | undefined;
-	
+
 	// Double-click confirmation pattern
-	if (btn?.dataset.confirmState === 'pending') {
+	if (btn?.dataset.confirmState === "pending") {
 		// Second click - execute delete
 		delete btn.dataset.confirmState;
 		btn.disabled = true;
-		btn.textContent = 'deleting...';
-		
+		btn.textContent = "deleting...";
+
 		try {
-			const response = await fetch(`/api/admin/clients/${encodeURIComponent(clientId)}`, {
-				method: 'DELETE',
-				headers: {
-					'Authorization': `Bearer ${token}`,
+			const response = await fetch(
+				`/api/admin/clients/${encodeURIComponent(clientId)}`,
+				{
+					method: "DELETE",
+					headers: {
+						Authorization: `Bearer ${token}`,
+					},
 				},
-			});
+			);
 
 			if (!response.ok) {
-				throw new Error('Failed to delete client');
+				throw new Error("Failed to delete client");
 			}
 
 			await loadClients();
 		} catch (error) {
-			console.error('Failed to delete client:', error);
-			showToast('Failed to delete client. Please try again.', 'error');
+			console.error("Failed to delete client:", error);
+			showToast("Failed to delete client. Please try again.", "error");
 			btn.disabled = false;
-			btn.textContent = 'delete';
+			btn.textContent = "delete";
 		}
 	} else {
 		// First click - set pending state
 		if (btn) {
 			const originalText = btn.textContent;
-			btn.dataset.confirmState = 'pending';
-			btn.textContent = 'you sure?';
-			
+			btn.dataset.confirmState = "pending";
+			btn.textContent = "you sure?";
+
 			// Reset after 3 seconds if not confirmed
 			setTimeout(() => {
-				if (btn.dataset.confirmState === 'pending') {
+				if (btn.dataset.confirmState === "pending") {
 					delete btn.dataset.confirmState;
 					btn.textContent = originalText;
 				}
···
 	}
 };
 
-createClientBtn.addEventListener('click', () => {
-	modalTitle.textContent = 'Create OAuth Client';
+createClientBtn.addEventListener("click", () => {
+	modalTitle.textContent = "Create OAuth Client";
 	clientForm.reset();
-	(document.getElementById('editClientId') as HTMLInputElement).value = '';
+	(document.getElementById("editClientId") as HTMLInputElement).value = "";
 	redirectUrisList.innerHTML = `
 		<div class="redirect-uri-item">
 			<input type="url" class="form-input redirect-uri-input" placeholder="https://example.com/auth/callback" required />
 			<button type="button" class="btn-remove" onclick="removeRedirectUri(this)">remove</button>
 		</div>
 	`;
-	clientModal.classList.add('active');
+	clientModal.classList.add("active");
 });
 
-modalClose.addEventListener('click', () => {
-	clientModal.classList.remove('active');
+modalClose.addEventListener("click", () => {
+	clientModal.classList.remove("active");
 });
 
-cancelBtn.addEventListener('click', () => {
-	clientModal.classList.remove('active');
+cancelBtn.addEventListener("click", () => {
+	clientModal.classList.remove("active");
 });
 
-addRedirectUriBtn.addEventListener('click', () => {
-	const newItem = document.createElement('div');
-	newItem.className = 'redirect-uri-item';
+addRedirectUriBtn.addEventListener("click", () => {
+	const newItem = document.createElement("div");
+	newItem.className = "redirect-uri-item";
 	newItem.innerHTML = `
 		<input type="url" class="form-input redirect-uri-input" placeholder="https://example.com/auth/callback" required />
 		<button type="button" class="btn-remove" onclick="removeRedirectUri(this)">remove</button>
···
 	redirectUrisList.appendChild(newItem);
 });
 
-(window as any).removeRedirectUri = function(btn: HTMLButtonElement) {
-	const items = redirectUrisList.querySelectorAll('.redirect-uri-item');
+(window as any).removeRedirectUri = (btn: HTMLButtonElement) => {
+	const items = redirectUrisList.querySelectorAll(".redirect-uri-item");
 	if (items.length > 1) {
 		btn.parentElement?.remove();
 	} else {
-		showToast('At least one redirect URI is required', 'error');
+		showToast("At least one redirect URI is required", "error");
 	}
 };
 
-clientForm.addEventListener('submit', async (e) => {
+clientForm.addEventListener("submit", async (e) => {
 	e.preventDefault();
 
-	const editClientId = (document.getElementById('editClientId') as HTMLInputElement).value;
-	const name = (document.getElementById('clientName') as HTMLInputElement).value;
-	const logoUrl = (document.getElementById('logoUrl') as HTMLInputElement).value;
-	const description = (document.getElementById('description') as HTMLTextAreaElement).value;
-	const availableRolesText = (document.getElementById('availableRoles') as HTMLTextAreaElement).value;
-	const defaultRole = (document.getElementById('defaultRole') as HTMLInputElement).value;
-	
-	const redirectUriInputs = Array.from(redirectUrisList.querySelectorAll('.redirect-uri-input')) as HTMLInputElement[];
-	const redirectUris = redirectUriInputs.map(input => input.value).filter(uri => uri.trim());
+	const editClientId = (
+		document.getElementById("editClientId") as HTMLInputElement
+	).value;
+	const name = (document.getElementById("clientName") as HTMLInputElement)
+		.value;
+	const logoUrl = (document.getElementById("logoUrl") as HTMLInputElement)
+		.value;
+	const description = (
+		document.getElementById("description") as HTMLTextAreaElement
+	).value;
+	const availableRolesText = (
+		document.getElementById("availableRoles") as HTMLTextAreaElement
+	).value;
+	const defaultRole = (
+		document.getElementById("defaultRole") as HTMLInputElement
+	).value;
+
+	const redirectUriInputs = Array.from(
+		redirectUrisList.querySelectorAll(".redirect-uri-input"),
+	) as HTMLInputElement[];
+	const redirectUris = redirectUriInputs
+		.map((input) => input.value)
+		.filter((uri) => uri.trim());
 
 	// Parse available roles from textarea (one per line)
 	const availableRoles = availableRolesText
-		.split('\n')
-		.map(r => r.trim())
-		.filter(r => r);
+		.split("\n")
+		.map((r) => r.trim())
+		.filter((r) => r);
 
 	// Validate default role is in available roles
-	if (defaultRole && availableRoles.length > 0 && !availableRoles.includes(defaultRole)) {
-		showToast('Default role must be one of the available roles', 'error');
+	if (
+		defaultRole &&
+		availableRoles.length > 0 &&
+		!availableRoles.includes(defaultRole)
+	) {
+		showToast("Default role must be one of the available roles", "error");
 		return;
 	}
 
 	if (redirectUris.length === 0) {
-		showToast('At least one redirect URI is required', 'error');
+		showToast("At least one redirect URI is required", "error");
 		return;
 	}
 
 	const isEdit = !!editClientId;
-	const url = isEdit 
+	const url = isEdit
 		? `/api/admin/clients/${encodeURIComponent(editClientId)}`
-		: '/api/admin/clients';
-	const method = isEdit ? 'PUT' : 'POST';
+		: "/api/admin/clients";
+	const method = isEdit ? "PUT" : "POST";
 
 	try {
 		const response = await fetch(url, {
 			method,
 			headers: {
-				'Authorization': `Bearer ${token}`,
-				'Content-Type': 'application/json',
+				Authorization: `Bearer ${token}`,
+				"Content-Type": "application/json",
 			},
 			body: JSON.stringify({
 				name,
···
 
 		if (!response.ok) {
 			const error = await response.json();
-			throw new Error(error.error || 'Failed to save client');
+			throw new Error(error.error || "Failed to save client");
 		}
 
-		clientModal.classList.remove('active');
-		
+		clientModal.classList.remove("active");
+
 		// If creating a new client, show the credentials in modal
 		if (!isEdit) {
 			const result = await response.json();
-			if (result.client && result.client.clientId && result.client.clientSecret) {
-				const secretModal = document.getElementById('secretModal') as HTMLElement;
-				const generatedClientId = document.getElementById('generatedClientId') as HTMLElement;
-				const generatedSecret = document.getElementById('generatedSecret') as HTMLElement;
-				
+			if (
+				result.client &&
+				result.client.clientId &&
+				result.client.clientSecret
+			) {
+				const secretModal = document.getElementById(
+					"secretModal",
+				) as HTMLElement;
+				const generatedClientId = document.getElementById(
+					"generatedClientId",
+				) as HTMLElement;
+				const generatedSecret = document.getElementById(
+					"generatedSecret",
+				) as HTMLElement;
+
 				if (generatedClientId && generatedSecret && secretModal) {
 					generatedClientId.textContent = result.client.clientId;
 					generatedSecret.textContent = result.client.clientSecret;
-					secretModal.classList.add('active');
+					secretModal.classList.add("active");
 				}
 			}
 		} else {
-			showToast('Client updated successfully');
+			showToast("Client updated successfully");
 		}
-		
+
 		await loadClients();
 	} catch (error) {
-		console.error('Failed to save client:', error);
-		showToast(`Failed to ${isEdit ? 'update' : 'create'} client: ${error instanceof Error ? error.message : 'Unknown error'}`, 'error');
+		console.error("Failed to save client:", error);
+		showToast(
+			`Failed to ${isEdit ? "update" : "create"} client: ${error instanceof Error ? error.message : "Unknown error"}`,
+			"error",
+		);
 	}
 });
 
-(window as any).regenerateSecret = async function(clientId: string, event?: Event) {
+(window as any).regenerateSecret = async (clientId: string, event?: Event) => {
 	const btn = event?.target as HTMLButtonElement | undefined;
-	
+
 	// Double-click confirmation pattern (same as delete)
-	if (btn?.dataset.confirmState === 'pending') {
+	if (btn?.dataset.confirmState === "pending") {
 		// Second click - execute regenerate
 		delete btn.dataset.confirmState;
 		btn.disabled = true;
-		btn.textContent = 'regenerating...';
-		
+		btn.textContent = "regenerating...";
+
 		try {
-			const response = await fetch(`/api/admin/clients/${encodeURIComponent(clientId)}/secret`, {
-				method: 'POST',
-				headers: {
-					'Authorization': `Bearer ${token}`,
+			const response = await fetch(
+				`/api/admin/clients/${encodeURIComponent(clientId)}/secret`,
+				{
+					method: "POST",
+					headers: {
+						Authorization: `Bearer ${token}`,
+					},
 				},
-			});
+			);
 
 			if (!response.ok) {
-				throw new Error('Failed to regenerate secret');
+				throw new Error("Failed to regenerate secret");
 			}
 
 			const data = await response.json();
-			
+
 			// Show the secret in modal
-			const secretModal = document.getElementById('secretModal') as HTMLElement;
-			const generatedClientId = document.getElementById('generatedClientId') as HTMLElement;
-			const generatedSecret = document.getElementById('generatedSecret') as HTMLElement;
-			
+			const secretModal = document.getElementById("secretModal") as HTMLElement;
+			const generatedClientId = document.getElementById(
+				"generatedClientId",
+			) as HTMLElement;
+			const generatedSecret = document.getElementById(
+				"generatedSecret",
+			) as HTMLElement;
+
 			if (generatedClientId && generatedSecret && secretModal) {
 				generatedClientId.textContent = clientId;
 				generatedSecret.textContent = data.clientSecret;
-				secretModal.classList.add('active');
+				secretModal.classList.add("active");
 			}
-			
+
 			btn.disabled = false;
-			btn.textContent = 'regenerate secret';
+			btn.textContent = "regenerate secret";
 		} catch (error) {
-			console.error('Failed to regenerate secret:', error);
-			showToast('Failed to regenerate client secret. Please try again.', 'error');
+			console.error("Failed to regenerate secret:", error);
+			showToast(
+				"Failed to regenerate client secret. Please try again.",
+				"error",
+			);
 			btn.disabled = false;
-			btn.textContent = 'regenerate secret';
+			btn.textContent = "regenerate secret";
 		}
 	} else {
 		// First click - set pending state
 		if (btn) {
 			const originalText = btn.textContent;
-			btn.dataset.confirmState = 'pending';
-			btn.textContent = 'you sure?';
-			
+			btn.dataset.confirmState = "pending";
+			btn.textContent = "you sure?";
+
 			// Reset after 3 seconds if not confirmed
 			setTimeout(() => {
-				if (btn.dataset.confirmState === 'pending') {
+				if (btn.dataset.confirmState === "pending") {
 					delete btn.dataset.confirmState;
 					btn.textContent = originalText;
 				}
···
 	}
 };
 
-(window as any).revokeUserPermission = async function(clientId: string, username: string, event?: Event) {
+(window as any).revokeUserPermission = async (
+	clientId: string,
+	username: string,
+	event?: Event,
+) => {
 	const btn = event?.target as HTMLButtonElement | undefined;
-	
+
 	// Double-click confirmation pattern
-	if (btn?.dataset.confirmState === 'pending') {
+	if (btn?.dataset.confirmState === "pending") {
 		// Second click - execute revoke
 		delete btn.dataset.confirmState;
 		btn.disabled = true;
-		btn.textContent = 'revoking...';
-		
+		btn.textContent = "revoking...";
+
 		try {
-			const response = await fetch(`/api/admin/apps/${encodeURIComponent(clientId)}/users/${encodeURIComponent(username)}`, {
-				method: 'DELETE',
-				headers: {
-					'Authorization': `Bearer ${token}`,
+			const response = await fetch(
+				`/api/admin/apps/${encodeURIComponent(clientId)}/users/${encodeURIComponent(username)}`,
+				{
+					method: "DELETE",
+					headers: {
+						Authorization: `Bearer ${token}`,
+					},
 				},
-			});
+			);
 
 			if (!response.ok) {
-				throw new Error('Failed to revoke permission');
+				throw new Error("Failed to revoke permission");
 			}
 
 			// Reload the client details
-			const detailsDiv = document.getElementById(`details-${encodeURIComponent(clientId)}`);
+			const detailsDiv = document.getElementById(
+				`details-${encodeURIComponent(clientId)}`,
+			);
 			if (detailsDiv) {
-				detailsDiv.dataset.loaded = 'false';
+				detailsDiv.dataset.loaded = "false";
 			}
 
-			const card = document.querySelector(`[data-client-id="${clientId}"]`) as HTMLElement;
+			const card = document.querySelector(
+				`[data-client-id="${clientId}"]`,
+			) as HTMLElement;
 			if (card) {
-				card.classList.remove('expanded');
+				card.classList.remove("expanded");
 			}
 
 			await loadClients();
 		} catch (error) {
-			console.error('Failed to revoke permission:', error);
-			showToast('Failed to revoke permission. Please try again.', 'error');
+			console.error("Failed to revoke permission:", error);
+			showToast("Failed to revoke permission. Please try again.", "error");
 			btn.disabled = false;
-			btn.textContent = 'revoke';
+			btn.textContent = "revoke";
 		}
 	} else {
 		// First click - set pending state
 		if (btn) {
 			const originalText = btn.textContent;
-			btn.dataset.confirmState = 'pending';
-			btn.textContent = 'you sure?';
-			
+			btn.dataset.confirmState = "pending";
+			btn.textContent = "you sure?";
+
 			// Reset after 3 seconds if not confirmed
 			setTimeout(() => {
-				if (btn.dataset.confirmState === 'pending') {
+				if (btn.dataset.confirmState === "pending") {
 					delete btn.dataset.confirmState;
 					btn.textContent = originalText;
 				}
···
 };
 
 // Secret modal handlers
-const secretModal = document.getElementById('secretModal') as HTMLElement;
-const secretModalClose = document.getElementById('secretModalClose') as HTMLButtonElement;
-const copyClientIdBtn = document.getElementById('copyClientIdBtn') as HTMLButtonElement;
-const copySecretBtn = document.getElementById('copySecretBtn') as HTMLButtonElement;
+const secretModal = document.getElementById("secretModal") as HTMLElement;
+const secretModalClose = document.getElementById(
+	"secretModalClose",
+) as HTMLButtonElement;
+const copyClientIdBtn = document.getElementById(
+	"copyClientIdBtn",
+) as HTMLButtonElement;
+const copySecretBtn = document.getElementById(
+	"copySecretBtn",
+) as HTMLButtonElement;
 
-secretModalClose?.addEventListener('click', () => {
-	secretModal?.classList.remove('active');
+secretModalClose?.addEventListener("click", () => {
+	secretModal?.classList.remove("active");
 });
 
-copyClientIdBtn?.addEventListener('click', async () => {
-	const generatedClientId = document.getElementById('generatedClientId') as HTMLElement;
+copyClientIdBtn?.addEventListener("click", async () => {
+	const generatedClientId = document.getElementById(
+		"generatedClientId",
+	) as HTMLElement;
 	if (generatedClientId) {
 		try {
-			await navigator.clipboard.writeText(generatedClientId.textContent || '');
+			await navigator.clipboard.writeText(generatedClientId.textContent || "");
 			const originalText = copyClientIdBtn.textContent;
-			copyClientIdBtn.textContent = 'copied! ✓';
+			copyClientIdBtn.textContent = "copied! ✓";
 			setTimeout(() => {
 				copyClientIdBtn.textContent = originalText;
 			}, 2000);
 		} catch (error) {
-			console.error('Failed to copy:', error);
-			showToast('Failed to copy to clipboard', 'error');
+			console.error("Failed to copy:", error);
+			showToast("Failed to copy to clipboard", "error");
 		}
 	}
 });
 
-copySecretBtn?.addEventListener('click', async () => {
-	const generatedSecret = document.getElementById('generatedSecret') as HTMLElement;
+copySecretBtn?.addEventListener("click", async () => {
+	const generatedSecret = document.getElementById(
+		"generatedSecret",
+	) as HTMLElement;
 	if (generatedSecret) {
 		try {
-			await navigator.clipboard.writeText(generatedSecret.textContent || '');
+			await navigator.clipboard.writeText(generatedSecret.textContent || "");
 			const originalText = copySecretBtn.textContent;
-			copySecretBtn.textContent = 'copied! ✓';
+			copySecretBtn.textContent = "copied! ✓";
 			setTimeout(() => {
 				copySecretBtn.textContent = originalText;
 			}, 2000);
 		} catch (error) {
-			console.error('Failed to copy:', error);
-			showToast('Failed to copy to clipboard', 'error');
+			console.error("Failed to copy:", error);
+			showToast("Failed to copy to clipboard", "error");
 		}
 	}
 });
 
 // Close modals on escape key
-document.addEventListener('keydown', (e) => {
-	if (e.key === 'Escape') {
-		clientModal?.classList.remove('active');
-		secretModal?.classList.remove('active');
+document.addEventListener("keydown", (e) => {
+	if (e.key === "Escape") {
+		clientModal?.classList.remove("active");
+		secretModal?.classList.remove("active");
 	}
 });
 
 // Close modals on outside click
-clientModal?.addEventListener('click', (e) => {
+clientModal?.addEventListener("click", (e) => {
 	if (e.target === clientModal) {
-		clientModal.classList.remove('active');
+		clientModal.classList.remove("active");
 	}
 });
 
-secretModal?.addEventListener('click', (e) => {
+secretModal?.addEventListener("click", (e) => {
 	if (e.target === secretModal) {
-		secretModal.classList.remove('active');
+		secretModal.classList.remove("active");
 	}
 });
 

src/client/admin-invites.ts

···
-const token = localStorage.getItem('indiko_session');
-const footer = document.getElementById('footer') as HTMLElement;
-const invitesList = document.getElementById('invitesList') as HTMLElement;
-const createInviteBtn = document.getElementById('createInviteBtn') as HTMLButtonElement;
+const token = localStorage.getItem("indiko_session");
+const footer = document.getElementById("footer") as HTMLElement;
+const invitesList = document.getElementById("invitesList") as HTMLElement;
+const createInviteBtn = document.getElementById(
+	"createInviteBtn",
+) as HTMLButtonElement;
 
 // Check auth and display user
 async function checkAuth() {
 	if (!token) {
-		window.location.href = '/login';
+		window.location.href = "/login";
 		return;
 	}
 
 	try {
-		const response = await fetch('/api/hello', {
+		const response = await fetch("/api/hello", {
 			headers: {
-				'Authorization': `Bearer ${token}`,
+				Authorization: `Bearer ${token}`,
 			},
 		});
 
 		if (response.status === 401 || response.status === 403) {
-			localStorage.removeItem('indiko_session');
-			window.location.href = '/login';
+			localStorage.removeItem("indiko_session");
+			window.location.href = "/login";
 			return;
 		}
 
···
 		<div class="back-link"><a href="/">← back to dashboard</a></div>`;
 
 		// Handle logout
-		document.getElementById('logoutLink')?.addEventListener('click', async (e) => {
-			e.preventDefault();
-			try {
-				await fetch('/auth/logout', {
-					method: 'POST',
-					headers: {
-						'Authorization': `Bearer ${token}`,
-					},
-				});
-			} catch {
-				// Ignore logout errors
-			}
-			localStorage.removeItem('indiko_session');
-			window.location.href = '/login';
-		});
+		document
+			.getElementById("logoutLink")
+			?.addEventListener("click", async (e) => {
+				e.preventDefault();
+				try {
+					await fetch("/auth/logout", {
+						method: "POST",
+						headers: {
+							Authorization: `Bearer ${token}`,
+						},
+					});
+				} catch {
+					// Ignore logout errors
+				}
+				localStorage.removeItem("indiko_session");
+				window.location.href = "/login";
+			});
 
 		// Check if admin
 		if (!data.isAdmin) {
-			window.location.href = '/';
+			window.location.href = "/";
 			return;
 		}
 
 		// Load invites
 		loadInvites();
 	} catch (error) {
-		console.error('Auth check failed:', error);
-		footer.textContent = 'error loading user info';
+		console.error("Auth check failed:", error);
+		footer.textContent = "error loading user info";
 		usersList.innerHTML = '<div class="error">Failed to load users</div>';
 	}
 }
 
 async function createInvite() {
 	// Show the create invite modal
-	const modal = document.getElementById('createInviteModal');
+	const modal = document.getElementById("createInviteModal");
 	if (modal) {
-		modal.style.display = 'flex';
+		modal.style.display = "flex";
 		// Load apps for role assignment
 		await loadAppsForInvite();
 	}
···
 
 async function loadAppsForInvite() {
 	try {
-		const response = await fetch('/api/admin/clients', {
+		const response = await fetch("/api/admin/clients", {
 			headers: {
-				'Authorization': `Bearer ${token}`,
+				Authorization: `Bearer ${token}`,
 			},
 		});
 
 		if (!response.ok) {
-			throw new Error('Failed to load apps');
+			throw new Error("Failed to load apps");
 		}
 
 		const data = await response.json();
-		const appRolesContainer = document.getElementById('appRolesContainer');
-		
+		const appRolesContainer = document.getElementById("appRolesContainer");
+
 		if (!appRolesContainer) return;
-		
+
 		if (data.clients.length === 0) {
-			appRolesContainer.innerHTML = '<p style="color: var(--old-rose); font-size: 0.875rem;">No pre-registered apps available</p>';
+			appRolesContainer.innerHTML =
+				'<p style="color: var(--old-rose); font-size: 0.875rem;">No pre-registered apps available</p>';
 			return;
 		}
 
 		appRolesContainer.innerHTML = data.clients
 			.filter((app: { isPreregistered: boolean }) => app.isPreregistered)
-			.map((app: { id: number; clientId: string; name: string; roles: string[] }) => {
-				const roleOptions = app.roles.length > 0
-					? app.roles.map(role => `<option value="${role}">${role}</option>`).join('')
-					: '<option value="" disabled>No roles defined yet</option>';
-				
-				const displayName = app.name || app.clientId;
-				
-				return `
+			.map(
+				(app: {
+					id: number;
+					clientId: string;
+					name: string;
+					roles: string[];
+				}) => {
+					const roleOptions =
+						app.roles.length > 0
+							? app.roles
+									.map((role) => `<option value="${role}">${role}</option>`)
+									.join("")
+							: '<option value="" disabled>No roles defined yet</option>';
+
+					const displayName = app.name || app.clientId;
+
+					return `
 				<div class="app-role-item">
 					<label>
 						<input type="checkbox" name="appRole" value="${app.id}" data-client-id="${app.clientId}">
···
 						${roleOptions}
 					</select>
 				</div>
-			`}).join('');
+			`;
+				},
+			)
+			.join("");
 
 		// Enable/disable role select when checkbox changes
-		const checkboxes = appRolesContainer.querySelectorAll('input[name="appRole"]');
+		const checkboxes = appRolesContainer.querySelectorAll(
+			'input[name="appRole"]',
+		);
 		checkboxes.forEach((checkbox) => {
-			checkbox.addEventListener('change', (e) => {
+			checkbox.addEventListener("change", (e) => {
 				const target = e.target as HTMLInputElement;
 				const appId = target.value;
-				const roleSelect = appRolesContainer.querySelector(`select.role-select[data-app-id="${appId}"]`) as HTMLSelectElement;
-				
+				const roleSelect = appRolesContainer.querySelector(
+					`select.role-select[data-app-id="${appId}"]`,
+				) as HTMLSelectElement;
+
 				if (roleSelect) {
 					roleSelect.disabled = !target.checked;
 					if (!target.checked) {
-						roleSelect.value = '';
+						roleSelect.value = "";
 					}
 				}
 			});
 		});
 	} catch (error) {
-		console.error('Failed to load apps:', error);
+		console.error("Failed to load apps:", error);
 	}
 }
 
 async function submitCreateInvite() {
-	const maxUsesInput = document.getElementById('maxUses') as HTMLInputElement;
-	const expiresAtInput = document.getElementById('expiresAt') as HTMLInputElement;
-	const noteInput = document.getElementById('inviteNote') as HTMLTextAreaElement;
-	const messageInput = document.getElementById('inviteMessage') as HTMLTextAreaElement;
-	const submitBtn = document.getElementById('submitInviteBtn') as HTMLButtonElement;
+	const maxUsesInput = document.getElementById("maxUses") as HTMLInputElement;
+	const expiresAtInput = document.getElementById(
+		"expiresAt",
+	) as HTMLInputElement;
+	const noteInput = document.getElementById(
+		"inviteNote",
+	) as HTMLTextAreaElement;
+	const messageInput = document.getElementById(
+		"inviteMessage",
+	) as HTMLTextAreaElement;
+	const submitBtn = document.getElementById(
+		"submitInviteBtn",
+	) as HTMLButtonElement;
 
 	const maxUses = maxUsesInput.value ? parseInt(maxUsesInput.value, 10) : 1;
-	const expiresAt = expiresAtInput.value ? Math.floor(new Date(expiresAtInput.value).getTime() / 1000) : null;
+	const expiresAt = expiresAtInput.value
+		? Math.floor(new Date(expiresAtInput.value).getTime() / 1000)
+		: null;
 	const note = noteInput.value.trim() || null;
 	const message = messageInput.value.trim() || null;
 
 	// Collect app roles
-	const appRolesContainer = document.getElementById('appRolesContainer');
+	const appRolesContainer = document.getElementById("appRolesContainer");
 	const appRoles: Array<{ appId: number; role: string }> = [];
-	
+
 	if (appRolesContainer) {
-		const checkedBoxes = appRolesContainer.querySelectorAll('input[name="appRole"]:checked');
+		const checkedBoxes = appRolesContainer.querySelectorAll(
+			'input[name="appRole"]:checked',
+		);
 		checkedBoxes.forEach((checkbox) => {
 			const appId = parseInt((checkbox as HTMLInputElement).value, 10);
-			const roleSelect = appRolesContainer.querySelector(`select.role-select[data-app-id="${appId}"]`) as HTMLSelectElement;
-			
-			let role = '';
+			const roleSelect = appRolesContainer.querySelector(
+				`select.role-select[data-app-id="${appId}"]`,
+			) as HTMLSelectElement;
+
+			let role = "";
 			if (roleSelect && roleSelect.value) {
 				role = roleSelect.value;
 			}
-			
+
 			if (role) {
 				appRoles.push({
 					appId,
···
 	}
 
 	submitBtn.disabled = true;
-	submitBtn.textContent = 'creating...';
+	submitBtn.textContent = "creating...";
 
 	try {
-		const response = await fetch('/api/invites/create', {
-			method: 'POST',
+		const response = await fetch("/api/invites/create", {
+			method: "POST",
 			headers: {
-				'Authorization': `Bearer ${token}`,
-				'Content-Type': 'application/json',
+				Authorization: `Bearer ${token}`,
+				"Content-Type": "application/json",
 			},
 			body: JSON.stringify({
 				maxUses,
···
 		});
 
 		if (!response.ok) {
-			throw new Error('Failed to create invite');
+			throw new Error("Failed to create invite");
 		}
 
 		await loadInvites();
 		closeCreateInviteModal();
 	} catch (error) {
-		console.error('Failed to create invite:', error);
-		alert('Failed to create invite');
+		console.error("Failed to create invite:", error);
+		alert("Failed to create invite");
 	} finally {
 		submitBtn.disabled = false;
-		submitBtn.textContent = 'create invite';
+		submitBtn.textContent = "create invite";
 	}
 }
 
 function closeCreateInviteModal() {
-	const modal = document.getElementById('createInviteModal');
+	const modal = document.getElementById("createInviteModal");
 	if (modal) {
-		modal.style.display = 'none';
+		modal.style.display = "none";
 		// Reset form
-		(document.getElementById('maxUses') as HTMLInputElement).value = '1';
-		(document.getElementById('expiresAt') as HTMLInputElement).value = '';
-		(document.getElementById('inviteNote') as HTMLTextAreaElement).value = '';
-		(document.getElementById('inviteMessage') as HTMLTextAreaElement).value = '';
-		const appRolesContainer = document.getElementById('appRolesContainer');
+		(document.getElementById("maxUses") as HTMLInputElement).value = "1";
+		(document.getElementById("expiresAt") as HTMLInputElement).value = "";
+		(document.getElementById("inviteNote") as HTMLTextAreaElement).value = "";
+		(document.getElementById("inviteMessage") as HTMLTextAreaElement).value =
+			"";
+		const appRolesContainer = document.getElementById("appRolesContainer");
 		if (appRolesContainer) {
-			appRolesContainer.querySelectorAll('input[type="checkbox"]').forEach((input) => {
-				(input as HTMLInputElement).checked = false;
-			});
-			appRolesContainer.querySelectorAll('select').forEach((select) => {
-				(select as HTMLSelectElement).value = '';
+			appRolesContainer
+				.querySelectorAll('input[type="checkbox"]')
+				.forEach((input) => {
+					(input as HTMLInputElement).checked = false;
+				});
+			appRolesContainer.querySelectorAll("select").forEach((select) => {
+				(select as HTMLSelectElement).value = "";
 				(select as HTMLSelectElement).disabled = true;
 			});
 		}
···
 
 async function loadInvites() {
 	try {
-		const response = await fetch('/api/invites', {
+		const response = await fetch("/api/invites", {
 			headers: {
-				'Authorization': `Bearer ${token}`,
+				Authorization: `Bearer ${token}`,
 			},
 		});
 
 		if (!response.ok) {
-			throw new Error('Failed to load invites');
+			throw new Error("Failed to load invites");
 		}
 
 		const data = await response.json();
-		
+
 		if (data.invites.length === 0) {
-			invitesList.innerHTML = '<div class="loading">No invites created yet</div>';
+			invitesList.innerHTML =
+				'<div class="loading">No invites created yet</div>';
 			return;
 		}
 
-		invitesList.innerHTML = data.invites.map((invite: {
-			id: number;
-			code: string;
-			maxUses: number;
-			currentUses: number;
-			isExpired: boolean;
-			isFullyUsed: boolean;
-			expiresAt: number | null;
-			note: string | null;
-			message: string | null;
-			createdAt: number;
-			createdBy: string;
-			inviteUrl: string;
-			appRoles: Array<{ clientId: string; name: string | null; role: string }>;
-			usedBy: Array<{ username: string; usedAt: number }>;
-		}) => {
-			const createdDate = new Date(invite.createdAt * 1000).toLocaleDateString();
-			
-			let status = `${invite.currentUses}/${invite.maxUses} used`;
-			if (invite.isExpired) {
-				status += ' (expired)';
-			} else if (invite.isFullyUsed) {
-				status += ' (fully used)';
-			}
-			
-			const expiryInfo = invite.expiresAt 
-				? `Expires: ${new Date(invite.expiresAt * 1000).toLocaleString()}` 
-				: 'No expiry';
-			
-			const roleInfo = invite.appRoles.length > 0
-				? `<div class="invite-roles">App roles: ${invite.appRoles.map(r => {
-					const appName = r.name || r.clientId;
-					return `${appName} (${r.role})`;
-				}).join(', ')}</div>`
-				: '';
-			
-			const usedByInfo = invite.usedBy.length > 0
-				? `<div class="invite-used-by">Used by: ${invite.usedBy.map(u => `${u.username} (${new Date(u.usedAt * 1000).toLocaleDateString()})`).join(', ')}</div>`
-				: '';
-			
-			const noteInfo = invite.note
-				? `<div class="invite-note">Internal note: ${invite.note}</div>`
-				: '';
-			
-			const messageInfo = invite.message
-				? `<div class="invite-message">Message to invitees: ${invite.message}</div>`
-				: '';
-			
-			const isActive = !invite.isExpired && !invite.isFullyUsed;
-			
-			return `
-				<div class="invite-item ${isActive ? '' : 'invite-inactive'}">
+		invitesList.innerHTML = data.invites
+			.map(
+				(invite: {
+					id: number;
+					code: string;
+					maxUses: number;
+					currentUses: number;
+					isExpired: boolean;
+					isFullyUsed: boolean;
+					expiresAt: number | null;
+					note: string | null;
+					message: string | null;
+					createdAt: number;
+					createdBy: string;
+					inviteUrl: string;
+					appRoles: Array<{
+						clientId: string;
+						name: string | null;
+						role: string;
+					}>;
+					usedBy: Array<{ username: string; usedAt: number }>;
+				}) => {
+					const createdDate = new Date(
+						invite.createdAt * 1000,
+					).toLocaleDateString();
+
+					let status = `${invite.currentUses}/${invite.maxUses} used`;
+					if (invite.isExpired) {
+						status += " (expired)";
+					} else if (invite.isFullyUsed) {
+						status += " (fully used)";
+					}
+
+					const expiryInfo = invite.expiresAt
+						? `Expires: ${new Date(invite.expiresAt * 1000).toLocaleString()}`
+						: "No expiry";
+
+					const roleInfo =
+						invite.appRoles.length > 0
+							? `<div class="invite-roles">App roles: ${invite.appRoles
+									.map((r) => {
+										const appName = r.name || r.clientId;
+										return `${appName} (${r.role})`;
+									})
+									.join(", ")}</div>`
+							: "";
+
+					const usedByInfo =
+						invite.usedBy.length > 0
+							? `<div class="invite-used-by">Used by: ${invite.usedBy.map((u) => `${u.username} (${new Date(u.usedAt * 1000).toLocaleDateString()})`).join(", ")}</div>`
+							: "";
+
+					const noteInfo = invite.note
+						? `<div class="invite-note">Internal note: ${invite.note}</div>`
+						: "";
+
+					const messageInfo = invite.message
+						? `<div class="invite-message">Message to invitees: ${invite.message}</div>`
+						: "";
+
+					const isActive = !invite.isExpired && !invite.isFullyUsed;
+
+					return `
+				<div class="invite-item ${isActive ? "" : "invite-inactive"}">
 					<div>
 						<div class="invite-code">${invite.code}</div>
 						<div class="invite-meta">Created by ${invite.createdBy} on ${createdDate} • ${status}</div>
···
 						<div class="invite-url">${invite.inviteUrl}</div>
 					</div>
 					<div class="invite-actions-btns">
-						<button class="btn-copy" data-invite-id="${invite.id}" data-invite-url="${invite.inviteUrl}" ${isActive ? '' : 'disabled'}>copy link</button>
-						<button class="btn-edit" onclick="editInvite(${invite.id})" ${isActive ? '' : 'disabled'}>edit</button>
+						<button class="btn-copy" data-invite-id="${invite.id}" data-invite-url="${invite.inviteUrl}" ${isActive ? "" : "disabled"}>copy link</button>
+						<button class="btn-edit" onclick="editInvite(${invite.id})" ${isActive ? "" : "disabled"}>edit</button>
 						<button class="btn-delete" onclick="deleteInvite(${invite.id}, event)">delete</button>
 					</div>
 				</div>
 			`;
-		}).join('');
+				},
+			)
+			.join("");
 
 		// Add copy button handlers
-		const copyButtons = invitesList.querySelectorAll('.btn-copy');
+		const copyButtons = invitesList.querySelectorAll(".btn-copy");
 		copyButtons.forEach((btn) => {
-			btn.addEventListener('click', async (e) => {
+			btn.addEventListener("click", async (e) => {
 				const button = e.target as HTMLButtonElement;
 				const url = button.dataset.inviteUrl;
 				if (!url) return;
···
 				try {
 					await navigator.clipboard.writeText(url);
 					const originalText = button.textContent;
-					button.textContent = 'copied!';
+					button.textContent = "copied!";
 					setTimeout(() => {
 						button.textContent = originalText;
 					}, 2000);
 				} catch (error) {
-					console.error('Failed to copy:', error);
+					console.error("Failed to copy:", error);
 				}
 			});
 		});
 	} catch (error) {
-		console.error('Failed to load invites:', error);
+		console.error("Failed to load invites:", error);
 		invitesList.innerHTML = '<div class="error">Failed to load invites</div>';
 	}
 }
 
 checkAuth();
 
-createInviteBtn.addEventListener('click', createInvite);
+createInviteBtn.addEventListener("click", createInvite);
 
 // Close modals on escape key
-document.addEventListener('keydown', (e) => {
-	if (e.key === 'Escape') {
+document.addEventListener("keydown", (e) => {
+	if (e.key === "Escape") {
 		closeCreateInviteModal();
 		closeEditInviteModal();
 	}
 });
 
 // Close modals on outside click
-document.getElementById('createInviteModal')?.addEventListener('click', (e) => {
+document.getElementById("createInviteModal")?.addEventListener("click", (e) => {
 	if (e.target === e.currentTarget) {
 		closeCreateInviteModal();
 	}
 });
 
-document.getElementById('editInviteModal')?.addEventListener('click', (e) => {
+document.getElementById("editInviteModal")?.addEventListener("click", (e) => {
 	if (e.target === e.currentTarget) {
 		closeEditInviteModal();
 	}
···
 // Make editInvite globally available for onclick handler
 (window as any).editInvite = async (inviteId: number) => {
 	try {
-		const response = await fetch('/api/invites', {
+		const response = await fetch("/api/invites", {
 			headers: {
-				'Authorization': `Bearer ${token}`,
+				Authorization: `Bearer ${token}`,
 			},
 		});
 
 		if (!response.ok) {
-			throw new Error('Failed to load invite');
+			throw new Error("Failed to load invite");
 		}
 
 		const data = await response.json();
-		const invite = data.invites.find((inv: { id: number }) => inv.id === inviteId);
-		
+		const invite = data.invites.find(
+			(inv: { id: number }) => inv.id === inviteId,
+		);
+
 		if (!invite) {
-			throw new Error('Invite not found');
+			throw new Error("Invite not found");
 		}
 
 		currentEditInviteId = inviteId;
 
 		// Populate form
-		(document.getElementById('editMaxUses') as HTMLInputElement).value = String(invite.maxUses);
-		(document.getElementById('editInviteNote') as HTMLTextAreaElement).value = invite.note || '';
-		(document.getElementById('editInviteMessage') as HTMLTextAreaElement).value = invite.message || '';
-		
+		(document.getElementById("editMaxUses") as HTMLInputElement).value = String(
+			invite.maxUses,
+		);
+		(document.getElementById("editInviteNote") as HTMLTextAreaElement).value =
+			invite.note || "";
+		(
+			document.getElementById("editInviteMessage") as HTMLTextAreaElement
+		).value = invite.message || "";
+
 		// Handle expiration date
-		const expiresAtInput = document.getElementById('editExpiresAt') as HTMLInputElement;
+		const expiresAtInput = document.getElementById(
+			"editExpiresAt",
+		) as HTMLInputElement;
 		if (invite.expiresAt) {
 			const date = new Date(invite.expiresAt * 1000);
-			const localDatetime = new Date(date.getTime() - date.getTimezoneOffset() * 60000).toISOString().slice(0, 16);
+			const localDatetime = new Date(
+				date.getTime() - date.getTimezoneOffset() * 60000,
+			)
+				.toISOString()
+				.slice(0, 16);
 			expiresAtInput.value = localDatetime;
 		} else {
-			expiresAtInput.value = '';
+			expiresAtInput.value = "";
 		}
 
 		// Show modal
-		const modal = document.getElementById('editInviteModal');
+		const modal = document.getElementById("editInviteModal");
 		if (modal) {
-			modal.style.display = 'flex';
+			modal.style.display = "flex";
 		}
 	} catch (error) {
-		console.error('Failed to load invite:', error);
-		alert('Failed to load invite');
+		console.error("Failed to load invite:", error);
+		alert("Failed to load invite");
 	}
 };
 
 (window as any).submitEditInvite = async () => {
 	if (currentEditInviteId === null) return;
 
-	const maxUsesInput = document.getElementById('editMaxUses') as HTMLInputElement;
-	const expiresAtInput = document.getElementById('editExpiresAt') as HTMLInputElement;
-	const noteInput = document.getElementById('editInviteNote') as HTMLTextAreaElement;
-	const messageInput = document.getElementById('editInviteMessage') as HTMLTextAreaElement;
-	const submitBtn = document.getElementById('submitEditInviteBtn') as HTMLButtonElement;
+	const maxUsesInput = document.getElementById(
+		"editMaxUses",
+	) as HTMLInputElement;
+	const expiresAtInput = document.getElementById(
+		"editExpiresAt",
+	) as HTMLInputElement;
+	const noteInput = document.getElementById(
+		"editInviteNote",
+	) as HTMLTextAreaElement;
+	const messageInput = document.getElementById(
+		"editInviteMessage",
+	) as HTMLTextAreaElement;
+	const submitBtn = document.getElementById(
+		"submitEditInviteBtn",
+	) as HTMLButtonElement;
 
 	const maxUses = maxUsesInput.value ? parseInt(maxUsesInput.value, 10) : null;
-	const expiresAt = expiresAtInput.value ? Math.floor(new Date(expiresAtInput.value).getTime() / 1000) : null;
+	const expiresAt = expiresAtInput.value
+		? Math.floor(new Date(expiresAtInput.value).getTime() / 1000)
+		: null;
 	const note = noteInput.value.trim() || null;
 	const message = messageInput.value.trim() || null;
 
 	submitBtn.disabled = true;
-	submitBtn.textContent = 'saving...';
+	submitBtn.textContent = "saving...";
 
 	try {
 		const response = await fetch(`/api/invites/${currentEditInviteId}`, {
-			method: 'PATCH',
+			method: "PATCH",
 			headers: {
-				'Authorization': `Bearer ${token}`,
-				'Content-Type': 'application/json',
+				Authorization: `Bearer ${token}`,
+				"Content-Type": "application/json",
 			},
 			body: JSON.stringify({ maxUses, expiresAt, note, message }),
 		});
 
 		if (!response.ok) {
-			throw new Error('Failed to update invite');
+			throw new Error("Failed to update invite");
 		}
 
 		await loadInvites();
 		closeEditInviteModal();
 	} catch (error) {
-		console.error('Failed to update invite:', error);
-		alert('Failed to update invite');
+		console.error("Failed to update invite:", error);
+		alert("Failed to update invite");
 	} finally {
 		submitBtn.disabled = false;
-		submitBtn.textContent = 'save changes';
+		submitBtn.textContent = "save changes";
 	}
 };
 
 (window as any).closeEditInviteModal = () => {
-	const modal = document.getElementById('editInviteModal');
+	const modal = document.getElementById("editInviteModal");
 	if (modal) {
-		modal.style.display = 'none';
+		modal.style.display = "none";
 		currentEditInviteId = null;
-		(document.getElementById('editMaxUses') as HTMLInputElement).value = '';
-		(document.getElementById('editExpiresAt') as HTMLInputElement).value = '';
-		(document.getElementById('editInviteNote') as HTMLTextAreaElement).value = '';
-		(document.getElementById('editInviteMessage') as HTMLTextAreaElement).value = '';
+		(document.getElementById("editMaxUses") as HTMLInputElement).value = "";
+		(document.getElementById("editExpiresAt") as HTMLInputElement).value = "";
+		(document.getElementById("editInviteNote") as HTMLTextAreaElement).value =
+			"";
+		(
+			document.getElementById("editInviteMessage") as HTMLTextAreaElement
+		).value = "";
 	}
 };
 
 (window as any).deleteInvite = async (inviteId: number, event?: Event) => {
 	const btn = event?.target as HTMLButtonElement | undefined;
-	
+
 	// Double-click confirmation pattern
-	if (btn?.dataset.confirmState === 'pending') {
+	if (btn?.dataset.confirmState === "pending") {
 		// Second click - execute delete
 		delete btn.dataset.confirmState;
-		btn.textContent = 'deleting...';
+		btn.textContent = "deleting...";
 		btn.disabled = true;
-		
+
 		try {
 			const response = await fetch(`/api/invites/${inviteId}`, {
-				method: 'DELETE',
+				method: "DELETE",
 				headers: {
-					'Authorization': `Bearer ${token}`,
+					Authorization: `Bearer ${token}`,
 				},
 			});
 
 			if (!response.ok) {
-				throw new Error('Failed to delete invite');
+				throw new Error("Failed to delete invite");
 			}
 
 			await loadInvites();
 		} catch (error) {
-			console.error('Failed to delete invite:', error);
-			alert('Failed to delete invite');
-			btn.textContent = 'delete';
+			console.error("Failed to delete invite:", error);
+			alert("Failed to delete invite");
+			btn.textContent = "delete";
 			btn.disabled = false;
 		}
 	} else {
 		// First click - set pending state
 		if (btn) {
 			const originalText = btn.textContent;
-			btn.dataset.confirmState = 'pending';
-			btn.textContent = 'you sure?';
-			
+			btn.dataset.confirmState = "pending";
+			btn.textContent = "you sure?";
+
 			// Reset after 3 seconds if not confirmed
 			setTimeout(() => {
-				if (btn.dataset.confirmState === 'pending') {
+				if (btn.dataset.confirmState === "pending") {
 					delete btn.dataset.confirmState;
 					btn.textContent = originalText;
 				}

src/client/admin.ts

···
-const token = localStorage.getItem('indiko_session');
-const footer = document.getElementById('footer') as HTMLElement;
-const usersList = document.getElementById('usersList') as HTMLElement;
+const token = localStorage.getItem("indiko_session");
+const footer = document.getElementById("footer") as HTMLElement;
+const usersList = document.getElementById("usersList") as HTMLElement;
 let currentUserId: number;
 
 // Check auth and display user
 async function checkAuth() {
 	if (!token) {
-		window.location.href = '/login';
+		window.location.href = "/login";
 		return;
 	}
 
 	try {
-		const response = await fetch('/api/hello', {
+		const response = await fetch("/api/hello", {
 			headers: {
-				'Authorization': `Bearer ${token}`,
+				Authorization: `Bearer ${token}`,
 			},
 		});
 
 		if (response.status === 401 || response.status === 403) {
-			localStorage.removeItem('indiko_session');
-			window.location.href = '/login';
+			localStorage.removeItem("indiko_session");
+			window.location.href = "/login";
 			return;
 		}
 
···
 		<div class="back-link"><a href="/">← back to dashboard</a></div>`;
 
 		// Handle logout
-		document.getElementById('logoutLink')?.addEventListener('click', async (e) => {
-			e.preventDefault();
-			try {
-				await fetch('/auth/logout', {
-					method: 'POST',
-					headers: {
-						'Authorization': `Bearer ${token}`,
-					},
-				});
-			} catch {
-				// Ignore logout errors
-			}
-			localStorage.removeItem('indiko_session');
-			window.location.href = '/login';
-		});
+		document
+			.getElementById("logoutLink")
+			?.addEventListener("click", async (e) => {
+				e.preventDefault();
+				try {
+					await fetch("/auth/logout", {
+						method: "POST",
+						headers: {
+							Authorization: `Bearer ${token}`,
+						},
+					});
+				} catch {
+					// Ignore logout errors
+				}
+				localStorage.removeItem("indiko_session");
+				window.location.href = "/login";
+			});
 
 		// Check if admin
 		if (!data.isAdmin) {
-			window.location.href = '/';
+			window.location.href = "/";
 			return;
 		}
 
 		// Load users if admin
 		loadUsers();
 	} catch (error) {
-		console.error('Auth check failed:', error);
-		footer.textContent = 'error loading user info';
+		console.error("Auth check failed:", error);
+		footer.textContent = "error loading user info";
 		usersList.innerHTML = '<div class="error">Failed to load users</div>';
 	}
 }
 
 async function loadUsers() {
 	try {
-		const response = await fetch('/api/users', {
+		const response = await fetch("/api/users", {
 			headers: {
-				'Authorization': `Bearer ${token}`,
+				Authorization: `Bearer ${token}`,
 			},
 		});
 
 		if (!response.ok) {
-			throw new Error('Failed to load users');
+			throw new Error("Failed to load users");
 		}
 
 		const data = await response.json();
-		
+
 		if (data.users.length === 0) {
 			usersList.innerHTML = '<div class="loading">No users found</div>';
 			return;
 		}
 
-		usersList.innerHTML = data.users.map((user: {
-			id: number;
-			username: string;
-			name: string;
-			email: string | null;
-			photo: string | null;
-			status: string;
-			role: string;
-			isAdmin: boolean;
-			createdAt: number;
-			credentialCount: number;
-		}) => {
-			const createdDate = new Date(user.createdAt * 1000).toLocaleDateString();
-			const initials = user.username.substring(0, 2).toUpperCase();
-			const avatarContent = user.photo 
-				? `<img src="${user.photo}" alt="${user.username}" />`
-				: initials;
-			const isSelf = user.id === currentUserId;
-			
-			return `
-				<div class="user-card ${user.status === 'suspended' ? 'user-suspended' : ''}" data-user-id="${user.id}">
+		usersList.innerHTML = data.users
+			.map(
+				(user: {
+					id: number;
+					username: string;
+					name: string;
+					email: string | null;
+					photo: string | null;
+					status: string;
+					role: string;
+					isAdmin: boolean;
+					createdAt: number;
+					credentialCount: number;
+				}) => {
+					const createdDate = new Date(
+						user.createdAt * 1000,
+					).toLocaleDateString();
+					const initials = user.username.substring(0, 2).toUpperCase();
+					const avatarContent = user.photo
+						? `<img src="${user.photo}" alt="${user.username}" />`
+						: initials;
+					const isSelf = user.id === currentUserId;
+
+					return `
+				<div class="user-card ${user.status === "suspended" ? "user-suspended" : ""}" data-user-id="${user.id}">
 					<div class="user-avatar">${avatarContent}</div>
 					<div class="user-info">
-						<div class="user-name">${user.username}${isSelf ? ' (you)' : ''}</div>
+						<div class="user-name">${user.username}${isSelf ? " (you)" : ""}</div>
 						<div class="user-meta">
-							<span class="user-meta-item">${user.credentialCount} passkey${user.credentialCount !== 1 ? 's' : ''}</span>
+							<span class="user-meta-item">${user.credentialCount} passkey${user.credentialCount !== 1 ? "s" : ""}</span>
 							<span class="user-meta-item">joined ${createdDate}</span>
-							${user.email ? `<span class="user-meta-item">${user.email}</span>` : ''}
+							${user.email ? `<span class="user-meta-item">${user.email}</span>` : ""}
 						</div>
 					</div>
 					<div class="user-badges">
···
 						<span class="user-badge badge-role">${user.role}</span>
 					</div>
 					<div class="user-actions">
-						${!isSelf ? (user.status === 'suspended' 
-							? `<button class="btn-edit" data-action="enable" data-user-id="${user.id}">enable</button>` 
-							: `<button class="btn-disable" data-action="disable" data-user-id="${user.id}">disable</button>`
-						) : ''}
-						${!isSelf ? `<button class="btn-delete" data-action="delete" data-user-id="${user.id}">delete</button>` : ''}
+						${
+							!isSelf
+								? user.status === "suspended"
+									? `<button class="btn-edit" data-action="enable" data-user-id="${user.id}">enable</button>`
+									: `<button class="btn-disable" data-action="disable" data-user-id="${user.id}">disable</button>`
+								: ""
+						}
+						${!isSelf ? `<button class="btn-delete" data-action="delete" data-user-id="${user.id}">delete</button>` : ""}
 					</div>
 				</div>
 			`;
-		}).join('');
+				},
+			)
+			.join("");
 
 		// Add event listeners for action buttons
-		document.querySelectorAll('button[data-action]').forEach(btn => {
-			btn.addEventListener('click', handleUserAction);
+		document.querySelectorAll("button[data-action]").forEach((btn) => {
+			btn.addEventListener("click", handleUserAction);
 		});
 	} catch (error) {
-		console.error('Failed to load users:', error);
+		console.error("Failed to load users:", error);
 		usersList.innerHTML = '<div class="error">Failed to load users</div>';
 	}
 }
···
 	const btn = e.target as HTMLButtonElement;
 	const action = btn.dataset.action;
 	const userId = btn.dataset.userId;
-	
+
 	if (!userId || !action) return;
 
 	// Check if already in confirmation state
-	if (btn.dataset.confirmState === 'pending') {
+	if (btn.dataset.confirmState === "pending") {
 		// Second click - perform action
-		btn.dataset.confirmState = '';
+		btn.dataset.confirmState = "";
 		btn.disabled = true;
-		
+
 		try {
-			let endpoint = '';
-			let method = 'POST';
-			
-			if (action === 'delete') {
+			let endpoint = "";
+			let method = "POST";
+
+			if (action === "delete") {
 				endpoint = `/api/admin/users/${userId}/delete`;
-				method = 'DELETE';
-			} else if (action === 'disable') {
+				method = "DELETE";
+			} else if (action === "disable") {
 				endpoint = `/api/admin/users/${userId}/disable`;
-			} else if (action === 'enable') {
+			} else if (action === "enable") {
 				endpoint = `/api/admin/users/${userId}/enable`;
 			}
 
 			const response = await fetch(endpoint, {
 				method,
 				headers: {
-					'Authorization': `Bearer ${token}`,
+					Authorization: `Bearer ${token}`,
 				},
 			});
 
 			if (!response.ok) {
 				const error = await response.json();
-				throw new Error(error.error || 'Failed to perform action');
+				throw new Error(error.error || "Failed to perform action");
 			}
 
 			// Reload users list
 			loadUsers();
 		} catch (error) {
 			console.error(`Failed to ${action} user:`, error);
-			alert(`Failed to ${action} user: ${error instanceof Error ? error.message : 'Unknown error'}`);
+			alert(
+				`Failed to ${action} user: ${error instanceof Error ? error.message : "Unknown error"}`,
+			);
 			btn.disabled = false;
 		}
 	} else {
 		// First click - set confirmation state
 		const originalText = btn.textContent;
-		btn.dataset.confirmState = 'pending';
-		btn.dataset.originalText = originalText || '';
-		btn.textContent = 'you sure?';
-		
+		btn.dataset.confirmState = "pending";
+		btn.dataset.originalText = originalText || "";
+		btn.textContent = "you sure?";
+
 		// Reset after 3 seconds if not clicked again
 		setTimeout(() => {
-			if (btn.dataset.confirmState === 'pending') {
-				btn.dataset.confirmState = '';
+			if (btn.dataset.confirmState === "pending") {
+				btn.dataset.confirmState = "";
 				btn.textContent = btn.dataset.originalText || originalText;
 			}
 		}, 3000);

src/client/apps.ts

···
-const token = localStorage.getItem('indiko_session');
-const appsList = document.getElementById('appsList') as HTMLElement;
+const token = localStorage.getItem("indiko_session");
+const appsList = document.getElementById("appsList") as HTMLElement;
 
 if (!token) {
-	window.location.href = '/login';
+	window.location.href = "/login";
 }
 
 interface App {
···
 
 async function loadApps() {
 	try {
-		const response = await fetch('/api/apps', {
+		const response = await fetch("/api/apps", {
 			headers: {
-				'Authorization': `Bearer ${token}`,
+				Authorization: `Bearer ${token}`,
 			},
 		});
 
 		if (response.status === 401 || response.status === 403) {
-			localStorage.removeItem('indiko_session');
-			window.location.href = '/login';
+			localStorage.removeItem("indiko_session");
+			window.location.href = "/login";
 			return;
 		}
 
 		if (!response.ok) {
-			throw new Error('Failed to load apps');
+			throw new Error("Failed to load apps");
 		}
 
 		const data = await response.json();
 		displayApps(data.apps);
 	} catch (error) {
-		console.error('Failed to load apps:', error);
-		appsList.innerHTML = '<div class="error">Failed to load authorized apps</div>';
+		console.error("Failed to load apps:", error);
+		appsList.innerHTML =
+			'<div class="error">Failed to load authorized apps</div>';
 	}
 }
 
 function displayApps(apps: App[]) {
 	if (apps.length === 0) {
-		appsList.innerHTML = '<div class="empty">No authorized apps yet. Apps will appear here after you grant them access.</div>';
+		appsList.innerHTML =
+			'<div class="empty">No authorized apps yet. Apps will appear here after you grant them access.</div>';
 		return;
 	}
 
-	appsList.innerHTML = apps.map((app) => {
-		const lastUsedDate = new Date(app.lastUsed * 1000).toLocaleDateString();
-		const grantedDate = new Date(app.grantedAt * 1000).toLocaleDateString();
-		
-		return `
+	appsList.innerHTML = apps
+		.map((app) => {
+			const lastUsedDate = new Date(app.lastUsed * 1000).toLocaleDateString();
+			const grantedDate = new Date(app.grantedAt * 1000).toLocaleDateString();
+
+			return `
 			<div class="app-card" data-client-id="${app.clientId}">
 				<div class="app-header">
 					<div>
···
 				<div class="scopes">
 					<div class="scope-title">permissions</div>
 					<div class="scope-list">
-						${app.scopes.map(scope => `<span class="scope-badge">${scope}</span>`).join('')}
+						${app.scopes.map((scope) => `<span class="scope-badge">${scope}</span>`).join("")}
 					</div>
 				</div>
 			</div>
 		`;
-	}).join('');
+		})
+		.join("");
 }
 
-(window as any).revokeApp = async function(clientId: string, event?: Event) {
+(window as any).revokeApp = async (clientId: string, event?: Event) => {
 	const btn = event?.target as HTMLButtonElement | undefined;
-	
+
 	// Double-click confirmation pattern
-	if (btn?.dataset.confirmState === 'pending') {
+	if (btn?.dataset.confirmState === "pending") {
 		// Second click - execute revoke
 		delete btn.dataset.confirmState;
 		btn.disabled = true;
-		btn.textContent = 'revoking...';
-		
+		btn.textContent = "revoking...";
+
 		const card = document.querySelector(`[data-client-id="${clientId}"]`);
 
 		try {
-			const response = await fetch(`/api/apps/${encodeURIComponent(clientId)}`, {
-				method: 'DELETE',
-				headers: {
-					'Authorization': `Bearer ${token}`,
+			const response = await fetch(
+				`/api/apps/${encodeURIComponent(clientId)}`,
+				{
+					method: "DELETE",
+					headers: {
+						Authorization: `Bearer ${token}`,
+					},
 				},
-			});
+			);
 
 			if (!response.ok) {
-				throw new Error('Failed to revoke app');
+				throw new Error("Failed to revoke app");
 			}
 
 			// Remove from UI
 			card?.remove();
 
 			// Check if list is now empty
-			const remaining = document.querySelectorAll('.app-card');
+			const remaining = document.querySelectorAll(".app-card");
 			if (remaining.length === 0) {
-				appsList.innerHTML = '<div class="empty">No authorized apps yet. Apps will appear here after you grant them access.</div>';
+				appsList.innerHTML =
+					'<div class="empty">No authorized apps yet. Apps will appear here after you grant them access.</div>';
 			}
 		} catch (error) {
-			console.error('Failed to revoke app:', error);
-			alert('Failed to revoke app access. Please try again.');
+			console.error("Failed to revoke app:", error);
+			alert("Failed to revoke app access. Please try again.");
 			if (btn) {
 				btn.disabled = false;
-				btn.textContent = 'revoke';
+				btn.textContent = "revoke";
 			}
 		}
 	} else {
 		// First click - set pending state
 		if (btn) {
 			const originalText = btn.textContent;
-			btn.dataset.confirmState = 'pending';
-			btn.textContent = 'you sure?';
-			
+			btn.dataset.confirmState = "pending";
+			btn.textContent = "you sure?";
+
 			// Reset after 3 seconds if not confirmed
 			setTimeout(() => {
-				if (btn.dataset.confirmState === 'pending') {
+				if (btn.dataset.confirmState === "pending") {
 					delete btn.dataset.confirmState;
 					btn.textContent = originalText;
 				}

src/client/docs.ts

···
 // JSON syntax highlighter
 function highlightJSON(json: string): string {
 	return json
-		.replace(/&/g, '&')
-		.replace(/</g, '&lt;')
-		.replace(/>/g, '&gt;')
+		.replace(/&/g, "&amp;")
+		.replace(/</g, "&lt;")
+		.replace(/>/g, "&gt;")
 		.replace(/"([^"]+)":/g, '<span class="json-key">"$1"</span>:')
 		.replace(/: "([^"]*)"/g, ': <span class="json-string">"$1"</span>')
 		.replace(/: (\d+\.?\d*)/g, ': <span class="json-number">$1</span>')
···
 function highlightHTMLCSS(code: string): string {
 	// First escape HTML entities
 	let highlighted = code
-		.replace(/&/g, '&amp;')
-		.replace(/</g, '&lt;')
-		.replace(/>/g, '&gt;');
-	
+		.replace(/&/g, "&amp;")
+		.replace(/</g, "&lt;")
+		.replace(/>/g, "&gt;");
+
 	// HTML comments
-	highlighted = highlighted.replace(/&lt;!--(.*?)--&gt;/g, '<span class="html-comment">&lt;!--$1--&gt;</span>');
-	
+	highlighted = highlighted.replace(
+		/&lt;!--(.*?)--&gt;/g,
+		'<span class="html-comment">&lt;!--$1--&gt;</span>',
+	);
+
 	// Split by <style> tags to handle CSS separately
 	const parts = highlighted.split(/(&lt;style&gt;[\s\S]*?&lt;\/style&gt;)/g);
-	
-	highlighted = parts.map((part, index) => {
-		// Even indices are HTML, odd indices are CSS blocks
-		if (index % 2 === 0) {
-			// Process HTML
-			return part.replace(/&lt;(\/?)([\w-]+)([\s\S]*?)&gt;/g, (_match, slash, tag, attrs) => {
-				let result = `&lt;${slash}<span class="html-tag">${tag}</span>`;
-				
-				if (attrs) {
-					attrs = attrs.replace(/([\w-]+)="([^"]*)"/g, '<span class="html-attr">$1</span>="<span class="html-string">$2</span>"');
-					attrs = attrs.replace(/(?<=\s)([\w-]+)(?=\s|$)/g, '<span class="html-attr">$1</span>');
-				}
-				
-				result += attrs + '&gt;';
-				return result;
-			});
-		} else {
-			// Process CSS (inside <style> tags)
-			return part
-				.replace(/&lt;style&gt;/g, '&lt;<span class="html-tag">style</span>&gt;')
-				.replace(/&lt;\/style&gt;/g, '&lt;/<span class="html-tag">style</span>&gt;')
-				// CSS selectors (anything before { including pseudo-selectors)
-				.replace(/^(\s*)([\w.-]+(?::+[\w-]+(?:\([^)]*\))?)*)\s*\{/gm, '$1<span class="css-selector">$2</span> {')
-				// CSS properties (word followed by colon, but not :: for pseudo-elements)
-				.replace(/^(\s+)([\w-]+):\s+/gm, '$1<span class="css-property">$2</span>: ')
-				// CSS values (everything between property: and ;)
-				.replace(/(<span class="css-property">[\w-]+<\/span>:\s+)([^;]+);/g, (_match, prop, value) => {
-					const highlightedValue = value
-						.replace(/(#[0-9a-fA-F]{3,6})/g, '<span class="css-value">$1</span>')
-						.replace(/([\d.]+(?:px|rem|em|s|%))/g, '<span class="css-value">$1</span>')
-						.replace(/('.*?')/g, '<span class="css-value">$1</span>')
-						.replace(/([\w-]+\([^)]*\))/g, '<span class="css-value">$1</span>');
-					return `${prop}${highlightedValue};`;
-				});
-		}
-	}).join('');
+
+	highlighted = parts
+		.map((part, index) => {
+			// Even indices are HTML, odd indices are CSS blocks
+			if (index % 2 === 0) {
+				// Process HTML
+				return part.replace(
+					/&lt;(\/?)([\w-]+)([\s\S]*?)&gt;/g,
+					(_match, slash, tag, attrs) => {
+						let result = `&lt;${slash}<span class="html-tag">${tag}</span>`;
+
+						if (attrs) {
+							attrs = attrs.replace(
+								/([\w-]+)="([^"]*)"/g,
+								'<span class="html-attr">$1</span>="<span class="html-string">$2</span>"',
+							);
+							attrs = attrs.replace(
+								/(?<=\s)([\w-]+)(?=\s|$)/g,
+								'<span class="html-attr">$1</span>',
+							);
+						}
+
+						result += attrs + "&gt;";
+						return result;
+					},
+				);
+			} else {
+				// Process CSS (inside <style> tags)
+				return (
+					part
+						.replace(
+							/&lt;style&gt;/g,
+							'&lt;<span class="html-tag">style</span>&gt;',
+						)
+						.replace(
+							/&lt;\/style&gt;/g,
+							'&lt;/<span class="html-tag">style</span>&gt;',
+						)
+						// CSS selectors (anything before { including pseudo-selectors)
+						.replace(
+							/^(\s*)([\w.-]+(?::+[\w-]+(?:\([^)]*\))?)*)\s*\{/gm,
+							'$1<span class="css-selector">$2</span> {',
+						)
+						// CSS properties (word followed by colon, but not :: for pseudo-elements)
+						.replace(
+							/^(\s+)([\w-]+):\s+/gm,
+							'$1<span class="css-property">$2</span>: ',
+						)
+						// CSS values (everything between property: and ;)
+						.replace(
+							/(<span class="css-property">[\w-]+<\/span>:\s+)([^;]+);/g,
+							(_match, prop, value) => {
+								const highlightedValue = value
+									.replace(
+										/(#[0-9a-fA-F]{3,6})/g,
+										'<span class="css-value">$1</span>',
+									)
+									.replace(
+										/([\d.]+(?:px|rem|em|s|%))/g,
+										'<span class="css-value">$1</span>',
+									)
+									.replace(/('.*?')/g, '<span class="css-value">$1</span>')
+									.replace(
+										/([\w-]+\([^)]*\))/g,
+										'<span class="css-value">$1</span>',
+									);
+								return `${prop}${highlightedValue};`;
+							},
+						)
+				);
+			}
+		})
+		.join("");
 
 	return highlighted;
 }
···
 	const array = new Uint8Array(length);
 	crypto.getRandomValues(array);
 	return btoa(String.fromCharCode(...array))
-		.replace(/\+/g, '-')
-		.replace(/\//g, '_')
-		.replace(/=/g, '');
+		.replace(/\+/g, "-")
+		.replace(/\//g, "_")
+		.replace(/=/g, "");
 }
 
 async function sha256(plain: string): Promise<string> {
 	const encoder = new TextEncoder();
 	const data = encoder.encode(plain);
-	const hash = await crypto.subtle.digest('SHA-256', data);
+	const hash = await crypto.subtle.digest("SHA-256", data);
 	const hashArray = Array.from(new Uint8Array(hash));
 	return btoa(String.fromCharCode(...hashArray))
-		.replace(/\+/g, '-')
-		.replace(/\//g, '_')
-		.replace(/=/g, '');
+		.replace(/\+/g, "-")
+		.replace(/\//g, "_")
+		.replace(/=/g, "");
 }
 
 // Elements
-const clientIdInput = document.getElementById('clientId') as HTMLInputElement;
-const redirectUriInput = document.getElementById('redirectUri') as HTMLInputElement;
-const startBtn = document.getElementById('startBtn') as HTMLButtonElement;
-const callbackSection = document.getElementById('callbackSection') as HTMLElement;
-const callbackInfo = document.getElementById('callbackInfo') as HTMLElement;
-const exchangeBtn = document.getElementById('exchangeBtn') as HTMLButtonElement;
-const resultSection = document.getElementById('resultSection') as HTMLElement;
-const resultDiv = document.getElementById('result') as HTMLElement;
-const copyMarkdownBtn = document.getElementById('copyMarkdownBtn') as HTMLButtonElement;
-const copyButtonCodeBtn = document.getElementById('copyButtonCode') as HTMLButtonElement;
-const demoButton = document.getElementById('demoButton') as HTMLAnchorElement;
-const buttonCodeEl = document.getElementById('buttonCode') as HTMLElement;
+const clientIdInput = document.getElementById("clientId") as HTMLInputElement;
+const redirectUriInput = document.getElementById(
+	"redirectUri",
+) as HTMLInputElement;
+const startBtn = document.getElementById("startBtn") as HTMLButtonElement;
+const callbackSection = document.getElementById(
+	"callbackSection",
+) as HTMLElement;
+const callbackInfo = document.getElementById("callbackInfo") as HTMLElement;
+const exchangeBtn = document.getElementById("exchangeBtn") as HTMLButtonElement;
+const resultSection = document.getElementById("resultSection") as HTMLElement;
+const resultDiv = document.getElementById("result") as HTMLElement;
+const copyMarkdownBtn = document.getElementById(
+	"copyMarkdownBtn",
+) as HTMLButtonElement;
+const copyButtonCodeBtn = document.getElementById(
+	"copyButtonCode",
+) as HTMLButtonElement;
+const demoButton = document.getElementById("demoButton") as HTMLAnchorElement;
+const buttonCodeEl = document.getElementById("buttonCode") as HTMLElement;
 
 // Populate and highlight button code
 const buttonCodeRaw = `<!-- Add Google Fonts to your <head> -->
···
 
 // Update documentation examples with current origin
 const origin = window.location.origin;
-const authUrlEl = document.getElementById('authUrl');
-const tokenUrlEl = document.getElementById('tokenUrl');
-const profileMeUrlEl = document.getElementById('profileMeUrl');
+const authUrlEl = document.getElementById("authUrl");
+const tokenUrlEl = document.getElementById("tokenUrl");
+const profileMeUrlEl = document.getElementById("profileMeUrl");
 
 if (authUrlEl) authUrlEl.textContent = `${origin}/auth/authorize`;
 if (tokenUrlEl) tokenUrlEl.textContent = `${origin}/auth/token`;
···
 
 // Check if we're handling a callback
 const urlParams = new URLSearchParams(window.location.search);
-const code = urlParams.get('code');
-const state = urlParams.get('state');
-const error = urlParams.get('error');
+const code = urlParams.get("code");
+const state = urlParams.get("state");
+const error = urlParams.get("error");
 
 if (error) {
 	// OAuth error response
-	showResult(`Error: ${error}\n${urlParams.get('error_description') || ''}`, 'error');
-	resultSection.style.display = 'block';
+	showResult(
+		`Error: ${error}\n${urlParams.get("error_description") || ""}`,
+		"error",
+	);
+	resultSection.style.display = "block";
 } else if (code && state) {
 	// We have a callback with authorization code
 	handleCallback(code, state);
 }
 
 // Start OAuth flow
-startBtn.addEventListener('click', async () => {
+startBtn.addEventListener("click", async () => {
 	const clientId = clientIdInput.value.trim();
 	const redirectUri = redirectUriInput.value.trim();
 
 	if (!clientId || !redirectUri) {
-		alert('Please fill in client ID and redirect URI');
+		alert("Please fill in client ID and redirect URI");
 		return;
 	}
 
 	// Get selected scopes
-	const scopeCheckboxes = document.querySelectorAll('input[name="scope"]:checked');
-	const scopes = Array.from(scopeCheckboxes).map((cb) => (cb as HTMLInputElement).value);
+	const scopeCheckboxes = document.querySelectorAll(
+		'input[name="scope"]:checked',
+	);
+	const scopes = Array.from(scopeCheckboxes).map(
+		(cb) => (cb as HTMLInputElement).value,
+	);
 
 	if (scopes.length === 0) {
-		alert('Please select at least one scope');
+		alert("Please select at least one scope");
 		return;
 	}
 
···
 	const state = generateRandomString(32);
 
 	// Store PKCE values in localStorage for callback
-	localStorage.setItem('oauth_code_verifier', codeVerifier);
-	localStorage.setItem('oauth_state', state);
-	localStorage.setItem('oauth_client_id', clientId);
-	localStorage.setItem('oauth_redirect_uri', redirectUri);
+	localStorage.setItem("oauth_code_verifier", codeVerifier);
+	localStorage.setItem("oauth_state", state);
+	localStorage.setItem("oauth_client_id", clientId);
+	localStorage.setItem("oauth_redirect_uri", redirectUri);
 
 	// Build authorization URL
-	const authUrl = new URL('/auth/authorize', window.location.origin);
-	authUrl.searchParams.set('response_type', 'code');
-	authUrl.searchParams.set('client_id', clientId);
-	authUrl.searchParams.set('redirect_uri', redirectUri);
-	authUrl.searchParams.set('state', state);
-	authUrl.searchParams.set('code_challenge', codeChallenge);
-	authUrl.searchParams.set('code_challenge_method', 'S256');
-	authUrl.searchParams.set('scope', scopes.join(' '));
+	const authUrl = new URL("/auth/authorize", window.location.origin);
+	authUrl.searchParams.set("response_type", "code");
+	authUrl.searchParams.set("client_id", clientId);
+	authUrl.searchParams.set("redirect_uri", redirectUri);
+	authUrl.searchParams.set("state", state);
+	authUrl.searchParams.set("code_challenge", codeChallenge);
+	authUrl.searchParams.set("code_challenge_method", "S256");
+	authUrl.searchParams.set("scope", scopes.join(" "));
 
 	// Redirect to authorization endpoint
 	window.location.href = authUrl.toString();
···
 
 // Handle OAuth callback
 function handleCallback(code: string, state: string) {
-	const storedState = localStorage.getItem('oauth_state');
+	const storedState = localStorage.getItem("oauth_state");
 
 	if (state !== storedState) {
-		showResult('Error: State mismatch (CSRF attack?)', 'error');
-		resultSection.style.display = 'block';
+		showResult("Error: State mismatch (CSRF attack?)", "error");
+		resultSection.style.display = "block";
 		return;
 	}
 
-	callbackSection.style.display = 'block';
+	callbackSection.style.display = "block";
 	callbackInfo.innerHTML = `
 		<p style="margin-bottom: 1rem;"><strong>Authorization Code:</strong><br><code style="word-break: break-all;">${code}</code></p>
 		<p><strong>State:</strong> <code>${state}</code> ✓ (verified)</p>
 	`;
 
 	// Scroll to callback section
-	callbackSection.scrollIntoView({ behavior: 'smooth' });
+	callbackSection.scrollIntoView({ behavior: "smooth" });
 }
 
 // Exchange authorization code for user profile
-exchangeBtn.addEventListener('click', async () => {
-	const code = urlParams.get('code');
-	const codeVerifier = localStorage.getItem('oauth_code_verifier');
-	const clientId = localStorage.getItem('oauth_client_id');
-	const redirectUri = localStorage.getItem('oauth_redirect_uri');
+exchangeBtn.addEventListener("click", async () => {
+	const code = urlParams.get("code");
+	const codeVerifier = localStorage.getItem("oauth_code_verifier");
+	const clientId = localStorage.getItem("oauth_client_id");
+	const redirectUri = localStorage.getItem("oauth_redirect_uri");
 
 	if (!code || !codeVerifier || !clientId || !redirectUri) {
-		showResult('Error: Missing OAuth parameters', 'error');
-		resultSection.style.display = 'block';
+		showResult("Error: Missing OAuth parameters", "error");
+		resultSection.style.display = "block";
 		return;
 	}
 
 	exchangeBtn.disabled = true;
-	exchangeBtn.textContent = 'exchanging...';
+	exchangeBtn.textContent = "exchanging...";
 
 	try {
-		const response = await fetch('/auth/token', {
-			method: 'POST',
+		const response = await fetch("/auth/token", {
+			method: "POST",
 			headers: {
-				'Content-Type': 'application/json',
+				"Content-Type": "application/json",
 			},
 			body: JSON.stringify({
-				grant_type: 'authorization_code',
+				grant_type: "authorization_code",
 				code,
 				client_id: clientId,
 				redirect_uri: redirectUri,
···
 
 		if (!response.ok) {
 			showResult(
-				`Error: ${data.error}\n${data.error_description || ''}`,
-				'error'
+				`Error: ${data.error}\n${data.error_description || ""}`,
+				"error",
 			);
 		} else {
 			showResult(
 				`Success! User authenticated:\n\n${JSON.stringify(data, null, 2)}`,
-				'success'
+				"success",
 			);
 
 			// Clean up localStorage
-			localStorage.removeItem('oauth_code_verifier');
-			localStorage.removeItem('oauth_state');
-			localStorage.removeItem('oauth_client_id');
-			localStorage.removeItem('oauth_redirect_uri');
+			localStorage.removeItem("oauth_code_verifier");
+			localStorage.removeItem("oauth_state");
+			localStorage.removeItem("oauth_client_id");
+			localStorage.removeItem("oauth_redirect_uri");
 		}
 	} catch (error) {
-		showResult(`Error: ${(error as Error).message}`, 'error');
+		showResult(`Error: ${(error as Error).message}`, "error");
 	} finally {
 		exchangeBtn.disabled = false;
-		exchangeBtn.textContent = 'exchange code for profile';
-		resultSection.style.display = 'block';
-		resultSection.scrollIntoView({ behavior: 'smooth' });
+		exchangeBtn.textContent = "exchange code for profile";
+		resultSection.style.display = "block";
+		resultSection.scrollIntoView({ behavior: "smooth" });
 	}
 });
 
-function showResult(text: string, type: 'success' | 'error') {
-	if (type === 'success' && text.includes('{')) {
+function showResult(text: string, type: "success" | "error") {
+	if (type === "success" && text.includes("{")) {
 		// Extract and parse JSON from success message
-		const jsonStart = text.indexOf('{');
+		const jsonStart = text.indexOf("{");
 		const jsonStr = text.substring(jsonStart);
 		const prefix = text.substring(0, jsonStart).trim();
-		
+
 		try {
 			const data = JSON.parse(jsonStr);
 			const formattedJson = JSON.stringify(data, null, 2);
-			
+
 			// Apply custom JSON syntax highlighting
 			const highlightedJson = highlightJSON(formattedJson);
-			
+
 			resultDiv.innerHTML = `<strong style="color: var(--berry-crush); font-size: 1.125rem; display: block; margin-bottom: 1rem;">${prefix}</strong><pre style="margin: 0;"><code>${highlightedJson}</code></pre>`;
 		} catch {
 			resultDiv.textContent = text;
···
 // Convert HTML documentation to Markdown by parsing the DOM
 function extractMarkdown(): string {
 	const lines: string[] = [];
-	
+
 	// Get title and subtitle from header
-	const h1 = document.querySelector('header h1');
-	const subtitle = document.querySelector('header .subtitle');
-	
+	const h1 = document.querySelector("header h1");
+	const subtitle = document.querySelector("header .subtitle");
+
 	if (h1) {
 		lines.push(`# ${h1.textContent}`);
-		lines.push('');
+		lines.push("");
 	}
-	
+
 	if (subtitle) {
-		lines.push(subtitle.textContent || '');
-		lines.push('');
+		lines.push(subtitle.textContent || "");
+		lines.push("");
 	}
-	
+
 	// Process each section (skip TOC and OAuth tester)
-	const sections = document.querySelectorAll('.section');
-	
+	const sections = document.querySelectorAll(".section");
+
 	sections.forEach((section) => {
 		// Skip the OAuth tester section
-		if (section.id === 'tester') return;
-		
+		if (section.id === "tester") return;
+
 		processElement(section, lines);
-		lines.push('');
+		lines.push("");
 	});
-	
-	return lines.join('\n');
+
+	return lines.join("\n");
 }
 
 function processElement(el: Element, lines: string[], indent = 0): void {
 	const tag = el.tagName.toLowerCase();
-	
+
 	// Headers
-	if (tag === 'h2') {
+	if (tag === "h2") {
 		lines.push(`## ${el.textContent}`);
-		lines.push('');
-	} else if (tag === 'h3') {
+		lines.push("");
+	} else if (tag === "h3") {
 		lines.push(`### ${el.textContent}`);
-		lines.push('');
+		lines.push("");
 	}
 	// Paragraphs
-	else if (tag === 'p') {
-		lines.push(el.textContent || '');
-		lines.push('');
+	else if (tag === "p") {
+		lines.push(el.textContent || "");
+		lines.push("");
 	}
 	// Lists
-	else if (tag === 'ul' || tag === 'ol') {
-		const items = el.querySelectorAll(':scope > li');
+	else if (tag === "ul" || tag === "ol") {
+		const items = el.querySelectorAll(":scope > li");
 		items.forEach((li, i) => {
-			const prefix = tag === 'ol' ? `${i + 1}. ` : '- ';
+			const prefix = tag === "ol" ? `${i + 1}. ` : "- ";
 			const text = getTextContent(li);
 			lines.push(`${prefix}${text}`);
 		});
-		lines.push('');
+		lines.push("");
 	}
 	// Tables
-	else if (tag === 'table') {
+	else if (tag === "table") {
 		const headers: string[] = [];
 		const rows: string[][] = [];
-		
+
 		// Get headers
-		el.querySelectorAll('thead th').forEach((th) => {
-			headers.push(th.textContent?.trim() || '');
+		el.querySelectorAll("thead th").forEach((th) => {
+			headers.push(th.textContent?.trim() || "");
 		});
-		
+
 		// Get rows
-		el.querySelectorAll('tbody tr').forEach((tr) => {
+		el.querySelectorAll("tbody tr").forEach((tr) => {
 			const row: string[] = [];
-			tr.querySelectorAll('td').forEach((td) => {
-				row.push(td.textContent?.trim() || '');
+			tr.querySelectorAll("td").forEach((td) => {
+				row.push(td.textContent?.trim() || "");
 			});
 			rows.push(row);
 		});
-		
+
 		// Format as markdown table
 		if (headers.length > 0) {
-			lines.push(`| ${headers.join(' | ')} |`);
-			lines.push(`|${headers.map(() => '-------').join('|')}|`);
+			lines.push(`| ${headers.join(" | ")} |`);
+			lines.push(`|${headers.map(() => "-------").join("|")}|`);
 			rows.forEach((row) => {
-				lines.push(`| ${row.join(' | ')} |`);
+				lines.push(`| ${row.join(" | ")} |`);
 			});
-			lines.push('');
+			lines.push("");
 		}
 	}
 	// Code blocks
-	else if (tag === 'pre') {
-		const code = el.querySelector('code');
+	else if (tag === "pre") {
+		const code = el.querySelector("code");
 		if (code) {
 			// Detect language from class or content
-			let lang = '';
-			const text = code.textContent || '';
-			
-			if (text.includes('GET ') || text.includes('POST ')) {
-				lang = 'http';
-			} else if (text.includes('{') && text.includes('"')) {
-				lang = 'json';
+			let lang = "";
+			const text = code.textContent || "";
+
+			if (text.includes("GET ") || text.includes("POST ")) {
+				lang = "http";
+			} else if (text.includes("{") && text.includes('"')) {
+				lang = "json";
 			}
-			
+
 			lines.push(`\`\`\`${lang}`);
 			lines.push(text.trim());
-			lines.push('```');
-			lines.push('');
+			lines.push("```");
+			lines.push("");
 		}
 	}
 	// Info boxes
-	else if (el.classList.contains('info-box')) {
-		const strong = el.querySelector('strong');
-		const text = el.textContent?.trim() || '';
-		
+	else if (el.classList.contains("info-box")) {
+		const strong = el.querySelector("strong");
+		const text = el.textContent?.trim() || "";
+
 		if (strong) {
 			// Extract content after the strong tag
-			const afterStrong = text.substring(strong.textContent?.length || 0).trim();
+			const afterStrong = text
+				.substring(strong.textContent?.length || 0)
+				.trim();
 			lines.push(`> **${strong.textContent}** ${afterStrong}`);
 		} else {
 			lines.push(`> ${text}`);
 		}
-		lines.push('');
+		lines.push("");
 	}
 	// Process children for sections and divs
-	else if (tag === 'section' || tag === 'div') {
+	else if (tag === "section" || tag === "div") {
 		Array.from(el.children).forEach((child) => {
 			processElement(child, lines, indent);
 		});
···
 
 // Get text content, preserving inline code formatting
 function getTextContent(el: Element): string {
-	let text = '';
-	
+	let text = "";
+
 	el.childNodes.forEach((node) => {
 		if (node.nodeType === Node.TEXT_NODE) {
 			text += node.textContent;
 		} else if (node.nodeType === Node.ELEMENT_NODE) {
 			const elem = node as Element;
-			if (elem.tagName.toLowerCase() === 'code') {
+			if (elem.tagName.toLowerCase() === "code") {
 				text += `\`${elem.textContent}\``;
-			} else if (elem.tagName.toLowerCase() === 'strong') {
+			} else if (elem.tagName.toLowerCase() === "strong") {
 				text += `**${elem.textContent}**`;
 			} else {
 				text += elem.textContent;
 			}
 		}
 	});
-	
+
 	return text.trim();
 }
 
 // Copy markdown to clipboard
-copyMarkdownBtn.addEventListener('click', async () => {
+copyMarkdownBtn.addEventListener("click", async () => {
 	const markdown = extractMarkdown();
-	
+
 	try {
 		await navigator.clipboard.writeText(markdown);
-		copyMarkdownBtn.textContent = 'copied! ✓';
+		copyMarkdownBtn.textContent = "copied! ✓";
 		setTimeout(() => {
-			copyMarkdownBtn.textContent = 'copy as markdown';
+			copyMarkdownBtn.textContent = "copy as markdown";
 		}, 2000);
 	} catch (error) {
-		console.error('Failed to copy:', error);
-		alert('Failed to copy to clipboard');
+		console.error("Failed to copy:", error);
+		alert("Failed to copy to clipboard");
 	}
 });
 
 // Copy button code to clipboard
-copyButtonCodeBtn.addEventListener('click', async () => {
+copyButtonCodeBtn.addEventListener("click", async () => {
 	try {
 		await navigator.clipboard.writeText(buttonCodeRaw);
-		copyButtonCodeBtn.textContent = 'copied! ✓';
+		copyButtonCodeBtn.textContent = "copied! ✓";
 		setTimeout(() => {
-			copyButtonCodeBtn.textContent = 'copy button code';
+			copyButtonCodeBtn.textContent = "copy button code";
 		}, 2000);
 	} catch (error) {
-		console.error('Failed to copy:', error);
-		alert('Failed to copy to clipboard');
+		console.error("Failed to copy:", error);
+		alert("Failed to copy to clipboard");
 	}
 });
 
 // Add interactive hover effect to demo button
-demoButton.addEventListener('click', (e) => {
+demoButton.addEventListener("click", (e) => {
 	e.preventDefault();
 });
-

src/client/index.ts

···
-const token = localStorage.getItem('indiko_session');
-const footer = document.getElementById('footer') as HTMLElement;
-const welcome = document.getElementById('welcome') as HTMLElement;
-const subtitle = document.getElementById('subtitle') as HTMLElement;
-const recentApps = document.getElementById('recentApps') as HTMLElement;
-const toast = document.getElementById('toast') as HTMLElement;
+const token = localStorage.getItem("indiko_session");
+const footer = document.getElementById("footer") as HTMLElement;
+const welcome = document.getElementById("welcome") as HTMLElement;
+const subtitle = document.getElementById("subtitle") as HTMLElement;
+const recentApps = document.getElementById("recentApps") as HTMLElement;
+const toast = document.getElementById("toast") as HTMLElement;
 
 // Profile form elements
-const profileForm = document.getElementById('profileForm') as HTMLFormElement;
-const avatarPreview = document.getElementById('avatarPreview') as HTMLElement;
-const usernameInput = document.getElementById('username') as HTMLInputElement;
-const nameInput = document.getElementById('name') as HTMLInputElement;
-const emailInput = document.getElementById('email') as HTMLInputElement;
-const photoInput = document.getElementById('photo') as HTMLInputElement;
-const urlInput = document.getElementById('url') as HTMLInputElement;
-const saveBtn = document.getElementById('saveBtn') as HTMLButtonElement;
-const deleteAccountBtn = document.getElementById('deleteAccountBtn') as HTMLButtonElement;
-const dangerZone = document.getElementById('dangerZone') as HTMLElement;
+const profileForm = document.getElementById("profileForm") as HTMLFormElement;
+const avatarPreview = document.getElementById("avatarPreview") as HTMLElement;
+const usernameInput = document.getElementById("username") as HTMLInputElement;
+const nameInput = document.getElementById("name") as HTMLInputElement;
+const emailInput = document.getElementById("email") as HTMLInputElement;
+const photoInput = document.getElementById("photo") as HTMLInputElement;
+const urlInput = document.getElementById("url") as HTMLInputElement;
+const saveBtn = document.getElementById("saveBtn") as HTMLButtonElement;
+const deleteAccountBtn = document.getElementById(
+	"deleteAccountBtn",
+) as HTMLButtonElement;
+const dangerZone = document.getElementById("dangerZone") as HTMLElement;
 
 let isAdmin = false;
 
 if (!token) {
-	window.location.href = '/login';
+	window.location.href = "/login";
 }
 
 interface App {
···
 	isAdmin?: boolean;
 }
 
-function showToast(message: string, type: 'success' | 'error' = 'success') {
+function showToast(message: string, type: "success" | "error" = "success") {
 	toast.textContent = message;
 	toast.className = `toast ${type} show`;
-	
+
 	setTimeout(() => {
-		toast.classList.remove('show');
+		toast.classList.remove("show");
 	}, 3000);
 }
 
···
 // Check auth and display user
 async function checkAuth() {
 	if (!token) {
-		window.location.href = '/login';
+		window.location.href = "/login";
 		return;
 	}
 
 	try {
-		const response = await fetch('/api/hello', {
+		const response = await fetch("/api/hello", {
 			headers: {
-				'Authorization': `Bearer ${token}`,
+				Authorization: `Bearer ${token}`,
 			},
 		});
 
 		if (response.status === 401 || response.status === 403) {
-			localStorage.removeItem('indiko_session');
-			window.location.href = '/login';
+			localStorage.removeItem("indiko_session");
+			window.location.href = "/login";
 			return;
 		}
 
 		const data = await response.json();
-		
+
 		// Update welcome message
 		welcome.textContent = `welcome, ${data.username}`;
-		subtitle.textContent = 'your identity dashboard';
+		subtitle.textContent = "your identity dashboard";
 
 		// Build footer with conditional admin link
-		const adminLink = data.isAdmin ? ' • <a href="/admin">admin</a>' : '';
+		const adminLink = data.isAdmin ? ' • <a href="/admin">admin</a>' : "";
 		footer.innerHTML = `signed in as <strong><a href="/u/${data.username}">${data.username}</a></strong> • <a href="/apps">apps</a> • <a href="/docs">docs</a>${adminLink} • <a href="/login" id="logoutLink">sign out</a>`;
 
 		// Handle logout
-		document.getElementById('logoutLink')?.addEventListener('click', async (e) => {
-			e.preventDefault();
-			try {
-				await fetch('/auth/logout', {
-					method: 'POST',
-					headers: {
-						'Authorization': `Bearer ${token}`,
-					},
-				});
-			} catch {
-				// Ignore logout errors
-			}
-			localStorage.removeItem('indiko_session');
-			window.location.href = '/login';
-		});
+		document
+			.getElementById("logoutLink")
+			?.addEventListener("click", async (e) => {
+				e.preventDefault();
+				try {
+					await fetch("/auth/logout", {
+						method: "POST",
+						headers: {
+							Authorization: `Bearer ${token}`,
+						},
+					});
+				} catch {
+					// Ignore logout errors
+				}
+				localStorage.removeItem("indiko_session");
+				window.location.href = "/login";
+			});
 
 		// Load profile and apps
 		loadProfile();
 		loadRecentApps();
 	} catch (error) {
-		console.error('Auth check failed:', error);
-		footer.textContent = 'error loading user info';
+		console.error("Auth check failed:", error);
+		footer.textContent = "error loading user info";
 	}
 }
 
 async function loadProfile() {
 	try {
-		const response = await fetch('/api/profile', {
+		const response = await fetch("/api/profile", {
 			headers: {
-				'Authorization': `Bearer ${token}`,
+				Authorization: `Bearer ${token}`,
 			},
 		});
 
 		if (!response.ok) {
-			throw new Error('Failed to load profile');
+			throw new Error("Failed to load profile");
 		}
 
-		const profile = await response.json() as Profile;
+		const profile = (await response.json()) as Profile;
 
 		// Track admin status to hide delete button for admins
 		isAdmin = profile.isAdmin || false;
 		if (!isAdmin) {
-			dangerZone.style.display = 'block';
+			dangerZone.style.display = "block";
 		}
 
 		// Populate form
 		usernameInput.value = profile.username;
-		nameInput.value = profile.name || '';
-		emailInput.value = profile.email || '';
-		photoInput.value = profile.photo || '';
-		urlInput.value = profile.url || '';
+		nameInput.value = profile.name || "";
+		emailInput.value = profile.email || "";
+		photoInput.value = profile.photo || "";
+		urlInput.value = profile.url || "";
 
 		updateAvatarPreview(profile.photo, profile.username);
 
 		// Update avatar preview when photo URL changes
-		photoInput.addEventListener('input', () => {
+		photoInput.addEventListener("input", () => {
 			updateAvatarPreview(photoInput.value || null, profile.username);
 		});
 	} catch (error) {
-		console.error('Failed to load profile:', error);
-		showToast('Failed to load profile', 'error');
+		console.error("Failed to load profile:", error);
+		showToast("Failed to load profile", "error");
 	}
 }
 
 async function loadRecentApps() {
 	try {
-		const response = await fetch('/api/apps', {
+		const response = await fetch("/api/apps", {
 			headers: {
-				'Authorization': `Bearer ${token}`,
+				Authorization: `Bearer ${token}`,
 			},
 		});
 
 		if (!response.ok) {
-			throw new Error('Failed to load apps');
+			throw new Error("Failed to load apps");
 		}
 
 		const data = await response.json();
 		const apps = data.apps as App[];
-		
+
 		if (apps.length === 0) {
 			recentApps.innerHTML = '<div class="empty">No authorized apps yet</div>';
 			return;
···
 
 		// Show top 7 most recent
 		const recent = apps.slice(0, 7);
-		
-		recentApps.innerHTML = recent.map((app) => {
-			const lastUsedDate = new Date(app.lastUsed * 1000).toLocaleDateString();
-			
-			return `
+
+		recentApps.innerHTML = recent
+			.map((app) => {
+				const lastUsedDate = new Date(app.lastUsed * 1000).toLocaleDateString();
+
+				return `
 				<div class="app-item">
 					<div class="app-name">${app.name}</div>
 					<div class="app-date">${lastUsedDate}</div>
 				</div>
 			`;
-		}).join('');
+			})
+			.join("");
 
 		if (apps.length > 7) {
-			recentApps.innerHTML += '<a href="/apps" class="view-all">view all apps →</a>';
+			recentApps.innerHTML +=
+				'<a href="/apps" class="view-all">view all apps →</a>';
 		}
 	} catch (error) {
-		console.error('Failed to load apps:', error);
+		console.error("Failed to load apps:", error);
 		recentApps.innerHTML = '<div class="empty">Failed to load apps</div>';
 	}
 }
 
 // Profile form submission
-profileForm.addEventListener('submit', async (e) => {
+profileForm.addEventListener("submit", async (e) => {
 	e.preventDefault();
 
 	saveBtn.disabled = true;
-	saveBtn.textContent = 'saving...';
+	saveBtn.textContent = "saving...";
 
 	try {
-		const response = await fetch('/api/profile', {
-			method: 'PUT',
+		const response = await fetch("/api/profile", {
+			method: "PUT",
 			headers: {
-				'Authorization': `Bearer ${token}`,
-				'Content-Type': 'application/json',
+				Authorization: `Bearer ${token}`,
+				"Content-Type": "application/json",
 			},
 			body: JSON.stringify({
 				name: nameInput.value,
···
 
 		if (!response.ok) {
 			const error = await response.json();
-			throw new Error(error.error || 'Failed to update profile');
+			throw new Error(error.error || "Failed to update profile");
 		}
 
-		showToast('Profile updated successfully!', 'success');
+		showToast("Profile updated successfully!", "success");
 	} catch (error) {
-		showToast((error as Error).message || 'Failed to update profile', 'error');
+		showToast((error as Error).message || "Failed to update profile", "error");
 	} finally {
 		saveBtn.disabled = false;
-		saveBtn.textContent = 'save changes';
+		saveBtn.textContent = "save changes";
 	}
 });
 
 // Delete account handler
-deleteAccountBtn.addEventListener('click', async () => {
-	const confirmMessage = 'Are you absolutely sure you want to delete your account?\n\n' +
-		'This will permanently delete:\n' +
-		'• Your profile and credentials\n' +
-		'• All authorized apps\n' +
-		'• All active sessions\n\n' +
-		'This action CANNOT be undone.\n\n' +
+deleteAccountBtn.addEventListener("click", async () => {
+	const confirmMessage =
+		"Are you absolutely sure you want to delete your account?\n\n" +
+		"This will permanently delete:\n" +
+		"• Your profile and credentials\n" +
+		"• All authorized apps\n" +
+		"• All active sessions\n\n" +
+		"This action CANNOT be undone.\n\n" +
 		'Type "DELETE" to confirm:';
-	
+
 	const confirmation = prompt(confirmMessage);
-	
-	if (confirmation !== 'DELETE') {
+
+	if (confirmation !== "DELETE") {
 		if (confirmation !== null) {
-			showToast('Account deletion cancelled. You must type "DELETE" exactly.', 'error');
+			showToast(
+				'Account deletion cancelled. You must type "DELETE" exactly.',
+				"error",
+			);
 		}
 		return;
 	}
 
 	deleteAccountBtn.disabled = true;
-	deleteAccountBtn.textContent = 'deleting...';
+	deleteAccountBtn.textContent = "deleting...";
 
 	try {
-		const response = await fetch('/api/profile', {
-			method: 'DELETE',
+		const response = await fetch("/api/profile", {
+			method: "DELETE",
 			headers: {
-				'Authorization': `Bearer ${token}`,
+				Authorization: `Bearer ${token}`,
 			},
 		});
 
 		if (!response.ok) {
 			const error = await response.json();
-			throw new Error(error.error || 'Failed to delete account');
+			throw new Error(error.error || "Failed to delete account");
 		}
 
 		// Clear session and redirect
-		localStorage.removeItem('indiko_session');
-		showToast('Account deleted successfully. Redirecting...', 'success');
+		localStorage.removeItem("indiko_session");
+		showToast("Account deleted successfully. Redirecting...", "success");
 		setTimeout(() => {
-			window.location.href = '/login';
+			window.location.href = "/login";
 		}, 2000);
 	} catch (error) {
-		showToast((error as Error).message || 'Failed to delete account', 'error');
+		showToast((error as Error).message || "Failed to delete account", "error");
 		deleteAccountBtn.disabled = false;
-		deleteAccountBtn.textContent = 'delete my account';
+		deleteAccountBtn.textContent = "delete my account";
 	}
 });
 

src/client/login.ts

···
-import { startAuthentication, startRegistration } from '@simplewebauthn/browser';
+import {
+	startAuthentication,
+	startRegistration,
+} from "@simplewebauthn/browser";
 
-const loginForm = document.getElementById('loginForm') as HTMLFormElement;
-const registerForm = document.getElementById('registerForm') as HTMLFormElement;
-const message = document.getElementById('message') as HTMLDivElement;
+const loginForm = document.getElementById("loginForm") as HTMLFormElement;
+const registerForm = document.getElementById("registerForm") as HTMLFormElement;
+const message = document.getElementById("message") as HTMLDivElement;
 
 // Check if registration is allowed on page load
 async function checkRegistrationAllowed() {
 	try {
 		// Check for invite code in URL
 		const urlParams = new URLSearchParams(window.location.search);
-		const inviteCode = urlParams.get('invite');
+		const inviteCode = urlParams.get("invite");
 
 		if (inviteCode) {
 			// Fetch invite details to show message
 			try {
-				const response = await fetch('/auth/register/options', {
-					method: 'POST',
-					headers: {'Content-Type': 'application/json'},
-					body: JSON.stringify({username: 'temp', inviteCode})
+				const response = await fetch("/auth/register/options", {
+					method: "POST",
+					headers: { "Content-Type": "application/json" },
+					body: JSON.stringify({ username: "temp", inviteCode }),
 				});
 
 				if (response.ok) {
 					const data = await response.json();
 					if (data.inviteMessage) {
-						showMessage(data.inviteMessage, 'success', true);
+						showMessage(data.inviteMessage, "success", true);
 					}
 				}
 			} catch {
···
 			}
 
 			// Show registration form with invite
-			const subtitleElement = document.querySelector('.subtitle');
+			const subtitleElement = document.querySelector(".subtitle");
 			if (subtitleElement) {
-				subtitleElement.textContent = 'create your account';
+				subtitleElement.textContent = "create your account";
 			}
-			(document.getElementById('registerUsername') as HTMLInputElement).placeholder = 'choose username';
-			(document.getElementById('registerBtn') as HTMLButtonElement).textContent = 'create account';
-			loginForm.style.display = 'none';
-			registerForm.style.display = 'block';
+			(
+				document.getElementById("registerUsername") as HTMLInputElement
+			).placeholder = "choose username";
+			(
+				document.getElementById("registerBtn") as HTMLButtonElement
+			).textContent = "create account";
+			loginForm.style.display = "none";
+			registerForm.style.display = "block";
 			return;
 		}
 
-		const response = await fetch('/auth/can-register');
-		const {canRegister} = await response.json();
+		const response = await fetch("/auth/can-register");
+		const { canRegister } = await response.json();
 
 		if (canRegister) {
 			// First user - show as admin registration
-			const subtitleElement = document.querySelector('.subtitle');
+			const subtitleElement = document.querySelector(".subtitle");
 			if (subtitleElement) {
-				subtitleElement.textContent = 'create admin account';
+				subtitleElement.textContent = "create admin account";
 			}
-			(document.getElementById('registerUsername') as HTMLInputElement).placeholder = 'admin username';
-			(document.getElementById('registerBtn') as HTMLButtonElement).textContent = 'create admin account';
+			(
+				document.getElementById("registerUsername") as HTMLInputElement
+			).placeholder = "admin username";
+			(
+				document.getElementById("registerBtn") as HTMLButtonElement
+			).textContent = "create admin account";
 			// Hide login form for first setup
-			loginForm.style.display = 'none';
-			registerForm.style.display = 'block';
+			loginForm.style.display = "none";
+			registerForm.style.display = "block";
 		}
 	} catch (error) {
-		console.error('Failed to check registration status:', error);
+		console.error("Failed to check registration status:", error);
 	}
 }
 
 checkRegistrationAllowed();
 
-function showMessage(text: string, type: 'error' | 'success' = 'error', persist = false) {
+function showMessage(
+	text: string,
+	type: "error" | "success" = "error",
+	persist = false,
+) {
 	message.textContent = text;
 	message.className = `message show ${type}`;
 	if (!persist) {
-		setTimeout(() => message.classList.remove('show'), 5000);
+		setTimeout(() => message.classList.remove("show"), 5000);
 	}
 }
 
 // Login flow
-loginForm.addEventListener('submit', async (e) => {
+loginForm.addEventListener("submit", async (e) => {
 	e.preventDefault();
-	const username = (document.getElementById('username') as HTMLInputElement).value;
-	const loginBtn = document.getElementById('loginBtn') as HTMLButtonElement;
+	const username = (document.getElementById("username") as HTMLInputElement)
+		.value;
+	const loginBtn = document.getElementById("loginBtn") as HTMLButtonElement;
 
 	try {
 		loginBtn.disabled = true;
-		loginBtn.textContent = 'preparing...';
+		loginBtn.textContent = "preparing...";
 
 		// Get authentication options
-		const optionsRes = await fetch('/auth/login/options', {
-			method: 'POST',
-			headers: {'Content-Type': 'application/json'},
-			body: JSON.stringify({username})
+		const optionsRes = await fetch("/auth/login/options", {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify({ username }),
 		});
 
 		if (!optionsRes.ok) {
 			const error = await optionsRes.json();
-			throw new Error(error.error || 'Failed to get auth options');
+			throw new Error(error.error || "Failed to get auth options");
 		}
 
 		const options = await optionsRes.json();
 
-		loginBtn.textContent = 'use your passkey...';
+		loginBtn.textContent = "use your passkey...";
 
 		// Start authentication
 		const authResponse = await startAuthentication(options);
 
-		loginBtn.textContent = 'verifying...';
+		loginBtn.textContent = "verifying...";
 
 		// Verify authentication
-		const verifyRes = await fetch('/auth/login/verify', {
-			method: 'POST',
-			headers: {'Content-Type': 'application/json'},
-			body: JSON.stringify({username, response: authResponse})
+		const verifyRes = await fetch("/auth/login/verify", {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify({ username, response: authResponse }),
 		});
 
 		if (!verifyRes.ok) {
 			const error = await verifyRes.json();
-			throw new Error(error.error || 'Authentication failed');
+			throw new Error(error.error || "Authentication failed");
 		}
 
-		const {token} = await verifyRes.json();
-		localStorage.setItem('indiko_session', token);
+		const { token } = await verifyRes.json();
+		localStorage.setItem("indiko_session", token);
 
-		showMessage('Login successful!', 'success');
-		
+		showMessage("Login successful!", "success");
+
 		// Check for return URL parameter
 		const urlParams = new URLSearchParams(window.location.search);
-		const returnUrl = urlParams.get('return') || '/';
-		
+		const returnUrl = urlParams.get("return") || "/";
+
 		const redirectTimer = setTimeout(() => {
 			window.location.href = returnUrl;
 		}, 1000);
-		(redirectTimer as unknown as number);
-
+		redirectTimer as unknown as number;
 	} catch (error) {
-		showMessage((error as Error).message || 'Authentication failed');
+		showMessage((error as Error).message || "Authentication failed");
 		loginBtn.disabled = false;
-		loginBtn.textContent = 'sign in';
+		loginBtn.textContent = "sign in";
 	}
 });
 
 // Registration flow
-registerForm.addEventListener('submit', async (e) => {
+registerForm.addEventListener("submit", async (e) => {
 	e.preventDefault();
-	const username = (document.getElementById('registerUsername') as HTMLInputElement).value;
-	const registerBtn = document.getElementById('registerBtn') as HTMLButtonElement;
+	const username = (
+		document.getElementById("registerUsername") as HTMLInputElement
+	).value;
+	const registerBtn = document.getElementById(
+		"registerBtn",
+	) as HTMLButtonElement;
 
 	try {
 		registerBtn.disabled = true;
-		registerBtn.textContent = 'preparing...';
+		registerBtn.textContent = "preparing...";
 
 		// Get invite code from URL if present
 		const urlParams = new URLSearchParams(window.location.search);
-		const inviteCode = urlParams.get('invite');
+		const inviteCode = urlParams.get("invite");
 
 		// Get registration options
-		const optionsRes = await fetch('/auth/register/options', {
-			method: 'POST',
-			headers: {'Content-Type': 'application/json'},
-			body: JSON.stringify({username, inviteCode})
+		const optionsRes = await fetch("/auth/register/options", {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify({ username, inviteCode }),
 		});
 
 		if (!optionsRes.ok) {
 			const error = await optionsRes.json();
-			throw new Error(error.error || 'Failed to get registration options');
+			throw new Error(error.error || "Failed to get registration options");
 		}
 
 		const options = await optionsRes.json();
 
-		registerBtn.textContent = 'create your passkey...';
+		registerBtn.textContent = "create your passkey...";
 
 		// Start registration
 		const regResponse = await startRegistration(options);
 
-		registerBtn.textContent = 'verifying...';
+		registerBtn.textContent = "verifying...";
 
 		// Verify registration
-		const verifyRes = await fetch('/auth/register/verify', {
-			method: 'POST',
-			headers: {'Content-Type': 'application/json'},
-			body: JSON.stringify({username, response: regResponse, challenge: options.challenge, inviteCode})
+		const verifyRes = await fetch("/auth/register/verify", {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify({
+				username,
+				response: regResponse,
+				challenge: options.challenge,
+				inviteCode,
+			}),
 		});
 
 		if (!verifyRes.ok) {
 			const error = await verifyRes.json();
-			throw new Error(error.error || 'Registration failed');
+			throw new Error(error.error || "Registration failed");
 		}
 
-		const {token} = await verifyRes.json();
-		localStorage.setItem('indiko_session', token);
+		const { token } = await verifyRes.json();
+		localStorage.setItem("indiko_session", token);
+
+		showMessage("Registration successful!", "success");
 
-		showMessage('Registration successful!', 'success');
-		
 		// Check for return URL parameter
-		const returnUrl = urlParams.get('return') || '/';
-		
+		const returnUrl = urlParams.get("return") || "/";
+
 		const redirectTimer = setTimeout(() => {
 			window.location.href = returnUrl;
 		}, 1000);
-		(redirectTimer as unknown as number);
-
+		redirectTimer as unknown as number;
 	} catch (error) {
-		showMessage((error as Error).message || 'Registration failed');
+		showMessage((error as Error).message || "Registration failed");
 		registerBtn.disabled = false;
-		registerBtn.textContent = 'register passkey';
+		registerBtn.textContent = "register passkey";
 	}
 });

src/client/oauth-test.ts

···
 	const array = new Uint8Array(length);
 	crypto.getRandomValues(array);
 	return btoa(String.fromCharCode(...array))
-		.replace(/\+/g, '-')
-		.replace(/\//g, '_')
-		.replace(/=/g, '');
+		.replace(/\+/g, "-")
+		.replace(/\//g, "_")
+		.replace(/=/g, "");
 }
 
 async function sha256(plain: string): Promise<string> {
 	const encoder = new TextEncoder();
 	const data = encoder.encode(plain);
-	const hash = await crypto.subtle.digest('SHA-256', data);
+	const hash = await crypto.subtle.digest("SHA-256", data);
 	const hashArray = Array.from(new Uint8Array(hash));
 	return btoa(String.fromCharCode(...hashArray))
-		.replace(/\+/g, '-')
-		.replace(/\//g, '_')
-		.replace(/=/g, '');
+		.replace(/\+/g, "-")
+		.replace(/\//g, "_")
+		.replace(/=/g, "");
 }
 
 // Elements
-const clientIdInput = document.getElementById('clientId') as HTMLInputElement;
-const redirectUriInput = document.getElementById('redirectUri') as HTMLInputElement;
-const startBtn = document.getElementById('startBtn') as HTMLButtonElement;
-const callbackSection = document.getElementById('callbackSection') as HTMLElement;
-const callbackInfo = document.getElementById('callbackInfo') as HTMLElement;
-const exchangeBtn = document.getElementById('exchangeBtn') as HTMLButtonElement;
-const resultSection = document.getElementById('resultSection') as HTMLElement;
-const resultDiv = document.getElementById('result') as HTMLElement;
+const clientIdInput = document.getElementById("clientId") as HTMLInputElement;
+const redirectUriInput = document.getElementById(
+	"redirectUri",
+) as HTMLInputElement;
+const startBtn = document.getElementById("startBtn") as HTMLButtonElement;
+const callbackSection = document.getElementById(
+	"callbackSection",
+) as HTMLElement;
+const callbackInfo = document.getElementById("callbackInfo") as HTMLElement;
+const exchangeBtn = document.getElementById("exchangeBtn") as HTMLButtonElement;
+const resultSection = document.getElementById("resultSection") as HTMLElement;
+const resultDiv = document.getElementById("result") as HTMLElement;
 
 // Auto-fill redirect URI with current page URL
 const currentUrl = window.location.origin + window.location.pathname;
···
 
 // Check if we're handling a callback
 const urlParams = new URLSearchParams(window.location.search);
-const code = urlParams.get('code');
-const state = urlParams.get('state');
-const error = urlParams.get('error');
+const code = urlParams.get("code");
+const state = urlParams.get("state");
+const error = urlParams.get("error");
 
 if (error) {
 	// OAuth error response
-	showResult(`Error: ${error}\n${urlParams.get('error_description') || ''}`, 'error');
-	resultSection.style.display = 'block';
+	showResult(
+		`Error: ${error}\n${urlParams.get("error_description") || ""}`,
+		"error",
+	);
+	resultSection.style.display = "block";
 } else if (code && state) {
 	// We have a callback with authorization code
 	handleCallback(code, state);
 }
 
 // Start OAuth flow
-startBtn.addEventListener('click', async () => {
+startBtn.addEventListener("click", async () => {
 	const clientId = clientIdInput.value.trim();
 	const redirectUri = redirectUriInput.value.trim();
 
 	if (!clientId || !redirectUri) {
-		alert('Please fill in client ID and redirect URI');
+		alert("Please fill in client ID and redirect URI");
 		return;
 	}
 
 	// Get selected scopes
-	const scopeCheckboxes = document.querySelectorAll('input[name="scope"]:checked');
-	const scopes = Array.from(scopeCheckboxes).map((cb) => (cb as HTMLInputElement).value);
+	const scopeCheckboxes = document.querySelectorAll(
+		'input[name="scope"]:checked',
+	);
+	const scopes = Array.from(scopeCheckboxes).map(
+		(cb) => (cb as HTMLInputElement).value,
+	);
 
 	if (scopes.length === 0) {
-		alert('Please select at least one scope');
+		alert("Please select at least one scope");
 		return;
 	}
 
···
 	const state = generateRandomString(32);
 
 	// Store PKCE values in localStorage for callback
-	localStorage.setItem('oauth_code_verifier', codeVerifier);
-	localStorage.setItem('oauth_state', state);
-	localStorage.setItem('oauth_client_id', clientId);
-	localStorage.setItem('oauth_redirect_uri', redirectUri);
+	localStorage.setItem("oauth_code_verifier", codeVerifier);
+	localStorage.setItem("oauth_state", state);
+	localStorage.setItem("oauth_client_id", clientId);
+	localStorage.setItem("oauth_redirect_uri", redirectUri);
 
 	// Build authorization URL
-	const authUrl = new URL('/auth/authorize', window.location.origin);
-	authUrl.searchParams.set('response_type', 'code');
-	authUrl.searchParams.set('client_id', clientId);
-	authUrl.searchParams.set('redirect_uri', redirectUri);
-	authUrl.searchParams.set('state', state);
-	authUrl.searchParams.set('code_challenge', codeChallenge);
-	authUrl.searchParams.set('code_challenge_method', 'S256');
-	authUrl.searchParams.set('scope', scopes.join(' '));
+	const authUrl = new URL("/auth/authorize", window.location.origin);
+	authUrl.searchParams.set("response_type", "code");
+	authUrl.searchParams.set("client_id", clientId);
+	authUrl.searchParams.set("redirect_uri", redirectUri);
+	authUrl.searchParams.set("state", state);
+	authUrl.searchParams.set("code_challenge", codeChallenge);
+	authUrl.searchParams.set("code_challenge_method", "S256");
+	authUrl.searchParams.set("scope", scopes.join(" "));
 
 	// Redirect to authorization endpoint
 	window.location.href = authUrl.toString();
···
 
 // Handle OAuth callback
 function handleCallback(code: string, state: string) {
-	const storedState = localStorage.getItem('oauth_state');
+	const storedState = localStorage.getItem("oauth_state");
 
 	if (state !== storedState) {
-		showResult('Error: State mismatch (CSRF attack?)', 'error');
-		resultSection.style.display = 'block';
+		showResult("Error: State mismatch (CSRF attack?)", "error");
+		resultSection.style.display = "block";
 		return;
 	}
 
-	callbackSection.style.display = 'block';
+	callbackSection.style.display = "block";
 	callbackInfo.innerHTML = `
 		<p style="margin-bottom: 1rem;"><strong>Authorization Code:</strong><br><code style="word-break: break-all;">${code}</code></p>
 		<p><strong>State:</strong> <code>${state}</code> ✓ (verified)</p>
 	`;
 
 	// Scroll to callback section
-	callbackSection.scrollIntoView({ behavior: 'smooth' });
+	callbackSection.scrollIntoView({ behavior: "smooth" });
 }
 
 // Exchange authorization code for user profile
-exchangeBtn.addEventListener('click', async () => {
-	const code = urlParams.get('code');
-	const codeVerifier = localStorage.getItem('oauth_code_verifier');
-	const clientId = localStorage.getItem('oauth_client_id');
-	const redirectUri = localStorage.getItem('oauth_redirect_uri');
+exchangeBtn.addEventListener("click", async () => {
+	const code = urlParams.get("code");
+	const codeVerifier = localStorage.getItem("oauth_code_verifier");
+	const clientId = localStorage.getItem("oauth_client_id");
+	const redirectUri = localStorage.getItem("oauth_redirect_uri");
 
 	if (!code || !codeVerifier || !clientId || !redirectUri) {
-		showResult('Error: Missing OAuth parameters', 'error');
-		resultSection.style.display = 'block';
+		showResult("Error: Missing OAuth parameters", "error");
+		resultSection.style.display = "block";
 		return;
 	}
 
 	exchangeBtn.disabled = true;
-	exchangeBtn.textContent = 'exchanging...';
+	exchangeBtn.textContent = "exchanging...";
 
 	try {
-		const response = await fetch('/auth/token', {
-			method: 'POST',
+		const response = await fetch("/auth/token", {
+			method: "POST",
 			headers: {
-				'Content-Type': 'application/json',
+				"Content-Type": "application/json",
 			},
 			body: JSON.stringify({
-				grant_type: 'authorization_code',
+				grant_type: "authorization_code",
 				code,
 				client_id: clientId,
 				redirect_uri: redirectUri,
···
 
 		if (!response.ok) {
 			showResult(
-				`Error: ${data.error}\n${data.error_description || ''}`,
-				'error'
+				`Error: ${data.error}\n${data.error_description || ""}`,
+				"error",
 			);
 		} else {
 			showResult(
 				`Success! User authenticated:\n\n${JSON.stringify(data, null, 2)}`,
-				'success'
+				"success",
 			);
 
 			// Clean up localStorage
-			localStorage.removeItem('oauth_code_verifier');
-			localStorage.removeItem('oauth_state');
-			localStorage.removeItem('oauth_client_id');
-			localStorage.removeItem('oauth_redirect_uri');
+			localStorage.removeItem("oauth_code_verifier");
+			localStorage.removeItem("oauth_state");
+			localStorage.removeItem("oauth_client_id");
+			localStorage.removeItem("oauth_redirect_uri");
 		}
 	} catch (error) {
-		showResult(`Error: ${(error as Error).message}`, 'error');
+		showResult(`Error: ${(error as Error).message}`, "error");
 	} finally {
 		exchangeBtn.disabled = false;
-		exchangeBtn.textContent = 'exchange code for profile';
-		resultSection.style.display = 'block';
-		resultSection.scrollIntoView({ behavior: 'smooth' });
+		exchangeBtn.textContent = "exchange code for profile";
+		resultSection.style.display = "block";
+		resultSection.scrollIntoView({ behavior: "smooth" });
 	}
 });
 
-function showResult(text: string, type: 'success' | 'error') {
-	if (type === 'success' && text.includes('{')) {
+function showResult(text: string, type: "success" | "error") {
+	if (type === "success" && text.includes("{")) {
 		// Extract and parse JSON from success message
-		const jsonStart = text.indexOf('{');
+		const jsonStart = text.indexOf("{");
 		const jsonStr = text.substring(jsonStart);
 		const prefix = text.substring(0, jsonStart);
-		
+
 		try {
 			const data = JSON.parse(jsonStr);
 			resultDiv.innerHTML = `${prefix}<pre style="margin: 0; font-family: 'Space Grotesk', monospace;">${syntaxHighlightJSON(data)}</pre>`;
···
 
 function syntaxHighlightJSON(obj: any): string {
 	const json = JSON.stringify(obj, null, 2);
-	return json.replace(/("(\\u[a-zA-Z0-9]{4}|\\[^u]|[^\\"])*"(\s*:)?|\b(true|false|null)\b|-?\d+(?:\.\d*)?(?:[eE][+\-]?\d+)?)/g, (match) => {
-		let cls = 'json-number';
-		if (/^"/.test(match)) {
-			if (/:$/.test(match)) {
-				cls = 'json-key';
-			} else {
-				cls = 'json-string';
+	return json.replace(
+		/("(\\u[a-zA-Z0-9]{4}|\\[^u]|[^\\"])*"(\s*:)?|\b(true|false|null)\b|-?\d+(?:\.\d*)?(?:[eE][+-]?\d+)?)/g,
+		(match) => {
+			let cls = "json-number";
+			if (/^"/.test(match)) {
+				if (/:$/.test(match)) {
+					cls = "json-key";
+				} else {
+					cls = "json-string";
+				}
+			} else if (/true|false/.test(match)) {
+				cls = "json-boolean";
+			} else if (/null/.test(match)) {
+				cls = "json-null";
 			}
-		} else if (/true|false/.test(match)) {
-			cls = 'json-boolean';
-		} else if (/null/.test(match)) {
-			cls = 'json-null';
-		}
-		return `<span class="${cls}">${match}</span>`;
-	});
+			return `<span class="${cls}">${match}</span>`;
+		},
+	);
 }

src/index.ts

···
 	authorizePost,
 	createInvite,
 	deleteInvite,
+	indieauthMetadata,
 	listInvites,
 	logout,
 	token,
···
 				},
 			);
 		},
+		"/.well-known/oauth-authorization-server": indieauthMetadata,
 		// API endpoints
 		"/api/hello": hello,
 		"/api/users": listUsers,

src/routes/api.ts

···
 import { db } from "../db";
 
-function getSessionUser(req: Request): { username: string; userId: number; is_admin: boolean } | Response {
+function getSessionUser(
+	req: Request,
+): { username: string; userId: number; is_admin: boolean } | Response {
 	const authHeader = req.headers.get("Authorization");
 
 	if (!authHeader || !authHeader.startsWith("Bearer ")) {
···
 			WHERE s.token = ?`,
 		)
 		.get(token) as
-		| { expires_at: number; user_id: number; username: string; is_admin: number; status: string }
+		| {
+				expires_at: number;
+				user_id: number;
+				username: string;
+				is_admin: number;
+				status: string;
+		  }
 		| undefined;
 
 	if (!session) {
···
 		return Response.json({ error: "Session expired" }, { status: 401 });
 	}
 
-	if (session.status !== 'active') {
+	if (session.status !== "active") {
 		return Response.json({ error: "Account is suspended" }, { status: 403 });
 	}
 
···
 		return Response.json({ success: true });
 	} catch (error) {
 		console.error("Update profile error:", error);
-		return Response.json({ error: "Failed to update profile" }, { status: 500 });
+		return Response.json(
+			{ error: "Failed to update profile" },
+			{ status: 500 },
+		);
 	}
 }
 
···
 
 	// Prevent disabling self
 	if (targetUserId === user.id) {
-		return Response.json({ error: "Cannot disable your own account" }, { status: 400 });
+		return Response.json(
+			{ error: "Cannot disable your own account" },
+			{ status: 400 },
+		);
 	}
 
 	const targetUser = db
···
 		return Response.json({ error: "User not found" }, { status: 404 });
 	}
 
-	db.query("UPDATE users SET status = 'suspended' WHERE id = ?").run(targetUserId);
+	db.query("UPDATE users SET status = 'suspended' WHERE id = ?").run(
+		targetUserId,
+	);
 
 	db.query("DELETE FROM sessions WHERE user_id = ?").run(targetUserId);
 
···
 	}
 
 	if (targetUserId === user.userId) {
-		return Response.json({ error: "Cannot delete your own account" }, { status: 400 });
+		return Response.json(
+			{ error: "Cannot delete your own account" },
+			{ status: 400 },
+		);
 	}
 
 	const targetUser = db
···
 
 	// Prevent admins from deleting other admin accounts
 	if (targetUser.is_admin === 1) {
-		return Response.json({ error: "Cannot delete admin accounts" }, { status: 403 });
+		return Response.json(
+			{ error: "Cannot delete admin accounts" },
+			{ status: 403 },
+		);
 	}
 
 	db.query("DELETE FROM sessions WHERE user_id = ?").run(targetUserId);
···
 
 	// Prevent admins from deleting their own accounts
 	if (user.is_admin) {
-		return Response.json({ 
-			error: "Admin accounts cannot be self-deleted. Contact another admin for account deletion." 
-		}, { status: 403 });
+		return Response.json(
+			{
+				error:
+					"Admin accounts cannot be self-deleted. Contact another admin for account deletion.",
+			},
+			{ status: 403 },
+		);
 	}
 
 	// Delete all user data

src/routes/auth.ts

···
-import { db } from "../db";
 import {
-	generateRegistrationOptions,
-	verifyRegistrationResponse,
+	type AuthenticationResponseJSON,
 	generateAuthenticationOptions,
-	verifyAuthenticationResponse,
-	type VerifiedRegistrationResponse,
-	type VerifiedAuthenticationResponse,
+	generateRegistrationOptions,
 	type PublicKeyCredentialCreationOptionsJSON,
+	type PublicKeyCredentialRequestOptionsJSON,
 	type RegistrationResponseJSON,
-	type PublicKeyCredentialRequestOptionsJSON,
-	type AuthenticationResponseJSON,
+	type VerifiedAuthenticationResponse,
+	type VerifiedRegistrationResponse,
+	verifyAuthenticationResponse,
+	verifyRegistrationResponse,
 } from "@simplewebauthn/server";
+import { db } from "../db";
 
 const RP_NAME = "Indiko";
 
 export function canRegister(req: Request): Response {
-	const userCount = db
-		.query("SELECT COUNT(*) as count FROM users")
-		.get() as { count: number };
+	const userCount = db.query("SELECT COUNT(*) as count FROM users").get() as {
+		count: number;
+	};
 
 	return Response.json({
 		canRegister: userCount.count === 0,
···
 		}
 
 		// Check if this is bootstrap (first user)
-		const userCount = db
-			.query("SELECT COUNT(*) as count FROM users")
-			.get() as { count: number };
+		const userCount = db.query("SELECT COUNT(*) as count FROM users").get() as {
+			count: number;
+		};
 
 		const isBootstrap = userCount.count === 0;
 		let inviteMessage: string | null = null;
···
 		// If not bootstrap, require valid invite code
 		if (!isBootstrap) {
 			if (!inviteCode) {
-				return Response.json({ error: "Invite code required" }, { status: 403 });
+				return Response.json(
+					{ error: "Invite code required" },
+					{ status: 403 },
+				);
 			}
 
 			// Validate invite code
 			const invite = db
-				.query("SELECT id, max_uses, current_uses, expires_at, message FROM invites WHERE code = ?")
-				.get(inviteCode) as { id: number; max_uses: number; current_uses: number; expires_at: number | null; message: string | null } | undefined;
+				.query(
+					"SELECT id, max_uses, current_uses, expires_at, message FROM invites WHERE code = ?",
+				)
+				.get(inviteCode) as
+				| {
+						id: number;
+						max_uses: number;
+						current_uses: number;
+						expires_at: number | null;
+						message: string | null;
+				  }
+				| undefined;
 
 			if (!invite) {
 				return Response.json({ error: "Invalid invite code" }, { status: 403 });
···
 			}
 
 			if (invite.current_uses >= invite.max_uses) {
-				return Response.json({ error: "Invite code fully used" }, { status: 403 });
+				return Response.json(
+					{ error: "Invite code fully used" },
+					{ status: 403 },
+				);
 			}
-			
+
 			// Store invite message to return with options
 			inviteMessage = invite.message;
 		}
···
 export async function registerVerify(req: Request): Promise<Response> {
 	try {
 		const body = await req.json();
-		const { username, response, challenge: expectedChallenge, inviteCode } = body as {
+		const {
+			username,
+			response,
+			challenge: expectedChallenge,
+			inviteCode,
+		} = body as {
 			username: string;
 			response: RegistrationResponseJSON;
 			challenge?: string;
···
 		}
 
 		// Check if this is bootstrap (first user)
-		const userCount = db
-			.query("SELECT COUNT(*) as count FROM users")
-			.get() as { count: number };
+		const userCount = db.query("SELECT COUNT(*) as count FROM users").get() as {
+			count: number;
+		};
 
 		const isBootstrap = userCount.count === 0;
 
···
 		let inviteRoles: Array<{ app_id: number; role: string }> = [];
 		if (!isBootstrap) {
 			if (!inviteCode) {
-				return Response.json({ error: "Invite code required" }, { status: 403 });
+				return Response.json(
+					{ error: "Invite code required" },
+					{ status: 403 },
+				);
 			}
 
 			const invite = db
-				.query("SELECT id, max_uses, current_uses, expires_at FROM invites WHERE code = ?")
-				.get(inviteCode) as { id: number; max_uses: number; current_uses: number; expires_at: number | null } | undefined;
+				.query(
+					"SELECT id, max_uses, current_uses, expires_at FROM invites WHERE code = ?",
+				)
+				.get(inviteCode) as
+				| {
+						id: number;
+						max_uses: number;
+						current_uses: number;
+						expires_at: number | null;
+				  }
+				| undefined;
 
 			if (!invite) {
 				return Response.json({ error: "Invalid invite code" }, { status: 403 });
···
 			}
 
 			if (invite.current_uses >= invite.max_uses) {
-				return Response.json({ error: "Invite code fully used" }, { status: 403 });
+				return Response.json(
+					{ error: "Invite code fully used" },
+					{ status: 403 },
+				);
 			}
 
 			inviteId = invite.id;
 
 			// Get app role assignments for this invite
-			inviteRoles = db.query(
-				"SELECT app_id, role FROM invite_roles WHERE invite_id = ?"
-			).all(inviteId) as Array<{ app_id: number; role: string }>;
+			inviteRoles = db
+				.query("SELECT app_id, role FROM invite_roles WHERE invite_id = ?")
+				.all(inviteId) as Array<{ app_id: number; role: string }>;
 		}
 
 		// Verify WebAuthn response
···
 			});
 		} catch (error) {
 			console.error("WebAuthn verification failed:", error);
-			return Response.json(
-				{ error: "Verification failed" },
-				{ status: 400 },
-			);
+			return Response.json({ error: "Verification failed" }, { status: 400 });
 		}
 
 		if (!verification.verified || !verification.registrationInfo) {
-			return Response.json(
-				{ error: "Verification failed" },
-				{ status: 400 },
-			);
+			return Response.json({ error: "Verification failed" }, { status: 400 });
 		}
 
 		const { credential } = verification.registrationInfo;
···
 		const insertUser = db.query(
 			"INSERT INTO users (username, name, is_admin, role) VALUES (?, ?, ?, ?) RETURNING id",
 		);
-		const user = insertUser.get(username, username, isBootstrap ? 1 : 0, isBootstrap ? 'admin' : 'user') as {
+		const user = insertUser.get(
+			username,
+			username,
+			isBootstrap ? 1 : 0,
+			isBootstrap ? "admin" : "user",
+		) as {
 			id: number;
 		};
 
···
 		// Mark invite as used if applicable
 		if (inviteId) {
 			const usedAt = Math.floor(Date.now() / 1000);
-			
+
 			// Increment invite usage counter
 			db.query(
 				"UPDATE invites SET current_uses = current_uses + 1 WHERE id = ?",
 			).run(inviteId);
-			
+
 			// Record this invite use
 			db.query(
 				"INSERT INTO invite_uses (invite_id, user_id, used_at) VALUES (?, ?, ?)",
 			).run(inviteId, user.id, usedAt);
-			
+
 			// Assign app roles to the new user
 			if (inviteRoles.length > 0) {
 				const insertPermission = db.query(
···
 			return Response.json({ error: "User not found" }, { status: 404 });
 		}
 
-		if (user.status !== 'active') {
+		if (user.status !== "active") {
 			return Response.json({ error: "Account is suspended" }, { status: 403 });
 		}
 
···
 			.all(user.id) as { credential_id: Buffer }[];
 
 		if (credentials.length === 0) {
-			return Response.json(
-				{ error: "No credentials found" },
-				{ status: 404 },
-			);
+			return Response.json({ error: "No credentials found" }, { status: 404 });
 		}
 
 		// Generate authentication options
···
 
 		// Look up credential by ID to discover the username
 		const credentialIdString = response.id;
-		
+
 		const credentialWithUser = db
 			.query(
 				"SELECT c.credential_id, c.public_key, c.counter, c.user_id, u.username, u.status FROM credentials c JOIN users u ON c.user_id = u.id WHERE c.credential_id = ?",
 			)
 			.get(Buffer.from(credentialIdString)) as
-			| { credential_id: Buffer; public_key: Buffer; counter: number; user_id: number; username: string; status: string }
+			| {
+					credential_id: Buffer;
+					public_key: Buffer;
+					counter: number;
+					user_id: number;
+					username: string;
+					status: string;
+			  }
 			| undefined;
 
 		if (!credentialWithUser) {
-			return Response.json(
-				{ error: "Credential not found" },
-				{ status: 404 },
-			);
+			return Response.json({ error: "Credential not found" }, { status: 404 });
 		}
 
 		// Check if user account is active
-		if (credentialWithUser.status !== 'active') {
-			return Response.json(
-				{ error: "Account is suspended" },
-				{ status: 403 },
-			);
+		if (credentialWithUser.status !== "active") {
+			return Response.json({ error: "Account is suspended" }, { status: 403 });
 		}
 
 		// Verify the username matches
···
 			.query(
 				"SELECT challenge, expires_at FROM challenges WHERE username = ? AND type = 'authentication' ORDER BY created_at DESC LIMIT 1",
 			)
-			.get(username) as
-			| { challenge: string; expires_at: number }
-			| undefined;
+			.get(username) as { challenge: string; expires_at: number } | undefined;
 
 		if (!challenge) {
 			return Response.json({ error: "Invalid challenge" }, { status: 400 });
···
 			});
 		} catch (error) {
 			console.error("WebAuthn verification failed:", error);
-			return Response.json(
-				{ error: "Verification failed" },
-				{ status: 400 },
-			);
+			return Response.json({ error: "Verification failed" }, { status: 400 });
 		}
 
 		if (!verification.verified) {
-			return Response.json(
-				{ error: "Verification failed" },
-				{ status: 400 },
-			);
+			return Response.json({ error: "Verification failed" }, { status: 400 });
 		}
 
 		// Update credential counter
-		db.query("UPDATE credentials SET counter = ? WHERE user_id = ? AND credential_id = ?").run(
+		db.query(
+			"UPDATE credentials SET counter = ? WHERE user_id = ? AND credential_id = ?",
+		).run(
 			verification.authenticationInfo.newCounter,
 			user.id,
 			credential.credential_id,

src/routes/clients.ts

···
-import { db } from "../db";
 import crypto from "crypto";
 import { nanoid } from "nanoid";
+import { db } from "../db";
 
 function hashSecret(secret: string): string {
 	return crypto.createHash("sha256").update(secret).digest("hex");
···
 	return `ikc_${nanoid(21)}`; // indiko client
 }
 
-function getSessionUser(req: Request): { username: string; userId: number; is_admin: boolean } | Response {
+function getSessionUser(
+	req: Request,
+): { username: string; userId: number; is_admin: boolean } | Response {
 	const authHeader = req.headers.get("Authorization");
 
 	if (!authHeader || !authHeader.startsWith("Bearer ")) {
···
 			WHERE s.token = ?`,
 		)
 		.get(token) as
-		| { expires_at: number; user_id: number; username: string; is_admin: number; status: string }
+		| {
+				expires_at: number;
+				user_id: number;
+				username: string;
+				is_admin: number;
+				status: string;
+		  }
 		| undefined;
 
 	if (!session) {
···
 		return Response.json({ error: "Session expired" }, { status: 401 });
 	}
 
-	if (session.status !== 'active') {
+	if (session.status !== "active") {
 		return Response.json({ error: "Account is suspended" }, { status: 403 });
 	}
 
···
 
 	try {
 		const body = await req.json();
-		const { name, logoUrl, description, redirectUris, availableRoles, defaultRole } = body;
+		const {
+			name,
+			logoUrl,
+			description,
+			redirectUris,
+			availableRoles,
+			defaultRole,
+		} = body;
 
-		if (!redirectUris || !Array.isArray(redirectUris) || redirectUris.length === 0) {
-			return Response.json({ error: "At least one redirect URI is required" }, { status: 400 });
+		if (
+			!redirectUris ||
+			!Array.isArray(redirectUris) ||
+			redirectUris.length === 0
+		) {
+			return Response.json(
+				{ error: "At least one redirect URI is required" },
+				{ status: 400 },
+			);
 		}
 
 		for (const uri of redirectUris) {
 			try {
 				new URL(uri);
 			} catch {
-				return Response.json({ error: `Invalid redirect URI: ${uri}` }, { status: 400 });
+				return Response.json(
+					{ error: `Invalid redirect URI: ${uri}` },
+					{ status: 400 },
+				);
 			}
 		}
 
···
 		let rolesArray: string[] = [];
 		if (availableRoles) {
 			if (!Array.isArray(availableRoles)) {
-				return Response.json({ error: "Available roles must be an array" }, { status: 400 });
+				return Response.json(
+					{ error: "Available roles must be an array" },
+					{ status: 400 },
+				);
 			}
-			rolesArray = availableRoles.filter((r: unknown) => typeof r === 'string' && r.trim());
+			rolesArray = availableRoles.filter(
+				(r: unknown) => typeof r === "string" && r.trim(),
+			);
 		}
 
 		// Validate default role is in available roles
-		if (defaultRole && rolesArray.length > 0 && !rolesArray.includes(defaultRole)) {
-			return Response.json({ error: "Default role must be one of the available roles" }, { status: 400 });
+		if (
+			defaultRole &&
+			rolesArray.length > 0 &&
+			!rolesArray.includes(defaultRole)
+		) {
+			return Response.json(
+				{ error: "Default role must be one of the available roles" },
+				{ status: 400 },
+			);
 		}
 
 		const result = db
···
 			description: client.description,
 			redirectUris: JSON.parse(client.redirect_uris) as string[],
 			isPreregistered: client.is_preregistered === 1,
-			availableRoles: client.available_roles ? JSON.parse(client.available_roles) as string[] : null,
+			availableRoles: client.available_roles
+				? (JSON.parse(client.available_roles) as string[])
+				: null,
 			defaultRole: client.default_role,
 			firstSeen: client.first_seen,
 			lastUsed: client.last_used,
···
 	});
 }
 
-export async function updateClient(req: Request, clientId: string): Promise<Response> {
+export async function updateClient(
+	req: Request,
+	clientId: string,
+): Promise<Response> {
 	const user = getSessionUser(req);
 	if (user instanceof Response) {
 		return user;
···
 
 	try {
 		const body = await req.json();
-		const { name, logoUrl, description, redirectUris, availableRoles, defaultRole } = body;
+		const {
+			name,
+			logoUrl,
+			description,
+			redirectUris,
+			availableRoles,
+			defaultRole,
+		} = body;
 
 		const existing = db
 			.query("SELECT id, is_preregistered FROM apps WHERE client_id = ?")
···
 
 		if (redirectUris) {
 			if (!Array.isArray(redirectUris) || redirectUris.length === 0) {
-				return Response.json({ error: "At least one redirect URI is required" }, { status: 400 });
+				return Response.json(
+					{ error: "At least one redirect URI is required" },
+					{ status: 400 },
+				);
 			}
 
 			for (const uri of redirectUris) {
 				try {
 					new URL(uri);
 				} catch {
-					return Response.json({ error: `Invalid redirect URI: ${uri}` }, { status: 400 });
+					return Response.json(
+						{ error: `Invalid redirect URI: ${uri}` },
+						{ status: 400 },
+					);
 				}
 			}
 		}
···
 				// Explicitly disable roles
 				rolesArray = null;
 			} else if (Array.isArray(availableRoles)) {
-				rolesArray = availableRoles.filter((r: unknown) => typeof r === 'string' && r.trim());
+				rolesArray = availableRoles.filter(
+					(r: unknown) => typeof r === "string" && r.trim(),
+				);
 			} else {
-				return Response.json({ error: "Available roles must be an array or null" }, { status: 400 });
+				return Response.json(
+					{ error: "Available roles must be an array or null" },
+					{ status: 400 },
+				);
 			}
 		}
 
 		// Validate default role is in available roles
-		if (defaultRole && rolesArray && rolesArray.length > 0 && !rolesArray.includes(defaultRole)) {
-			return Response.json({ error: "Default role must be one of the available roles" }, { status: 400 });
+		if (
+			defaultRole &&
+			rolesArray &&
+			rolesArray.length > 0 &&
+			!rolesArray.includes(defaultRole)
+		) {
+			return Response.json(
+				{ error: "Default role must be one of the available roles" },
+				{ status: 400 },
+			);
 		}
 
 		db.query(
···
 			logoUrl || null,
 			description || null,
 			redirectUris ? JSON.stringify(redirectUris) : null,
-			rolesArray !== null ? (rolesArray.length > 0 ? JSON.stringify(rolesArray) : null) : null,
+			rolesArray !== null
+				? rolesArray.length > 0
+					? JSON.stringify(rolesArray)
+					: null
+				: null,
 			defaultRole || null,
 			clientId,
 		);
···
 
 		const client = db
 			.query("SELECT id, available_roles FROM apps WHERE client_id = ?")
-			.get(clientId) as { id: number; available_roles: string | null } | undefined;
+			.get(clientId) as
+			| { id: number; available_roles: string | null }
+			| undefined;
 
 		if (!client) {
 			return Response.json({ error: "Client not found" }, { status: 404 });
···
 		if (role && client.available_roles) {
 			const availableRoles = JSON.parse(client.available_roles) as string[];
 			if (!availableRoles.includes(role)) {
-				return Response.json({ 
-					error: `Role must be one of: ${availableRoles.join(', ')}` 
-				}, { status: 400 });
+				return Response.json(
+					{
+						error: `Role must be one of: ${availableRoles.join(", ")}`,
+					},
+					{ status: 400 },
+				);
 			}
 		}
 
···
 			.get(targetUser.id, clientId) as { id: number } | undefined;
 
 		if (!permission) {
-			return Response.json({ error: "User has not authorized this client" }, { status: 404 });
+			return Response.json(
+				{ error: "User has not authorized this client" },
+				{ status: 404 },
+			);
 		}
 
-		db.query("UPDATE permissions SET role = ? WHERE user_id = ? AND client_id = ?").run(
-			role || null,
-			targetUser.id,
-			clientId,
-		);
+		db.query(
+			"UPDATE permissions SET role = ? WHERE user_id = ? AND client_id = ?",
+		).run(role || null, targetUser.id, clientId);
 
 		return Response.json({ success: true });
 	} catch (error) {
···
 	}
 }
 
-export function regenerateClientSecret(req: Request, clientId: string): Response {
+export function regenerateClientSecret(
+	req: Request,
+	clientId: string,
+): Response {
 	const user = getSessionUser(req);
 	if (user instanceof Response) {
 		return user;

src/routes/indieauth.ts

···
-import { db } from "../db";
 import crypto from "crypto";
+import { db } from "../db";
 
 interface SessionUser {
 	username: string;
···
 			WHERE s.token = ?`,
 		)
 		.get(token) as
-		| { expires_at: number; id: number; username: string; is_admin: number; status: string }
+		| {
+				expires_at: number;
+				id: number;
+				username: string;
+				is_admin: number;
+				status: string;
+		  }
 		| undefined;
 
 	if (!session) {
···
 		return Response.json({ error: "Session expired" }, { status: 401 });
 	}
 
-	if (session.status !== 'active') {
+	if (session.status !== "active") {
 		return Response.json({ error: "Account is suspended" }, { status: 403 });
 	}
 
···
 			WHERE s.token = ?`,
 		)
 		.get(sessionToken) as
-		| { expires_at: number; id: number; username: string; is_admin: number; status: string }
+		| {
+				expires_at: number;
+				id: number;
+				username: string;
+				is_admin: number;
+				status: string;
+		  }
 		| undefined;
 
 	if (!session) return null;
···
 	const now = Math.floor(Date.now() / 1000);
 	if (session.expires_at < now) return null;
 
-	if (session.status !== 'active') return null;
+	if (session.status !== "active") return null;
 
 	return {
 		username: session.username,
···
 }
 
 // Auto-register app if it doesn't exist (only for valid URLs, not generated client_ids)
-function ensureApp(clientId: string, redirectUri: string): { error?: string; app?: { name: string | null; redirect_uris: string } } {
+function ensureApp(
+	clientId: string,
+	redirectUri: string,
+): { error?: string; app?: { name: string | null; redirect_uris: string } } {
 	const existing = db
 		.query("SELECT name, redirect_uris FROM apps WHERE client_id = ?")
-		.get(clientId) as { name: string | null; redirect_uris: string } | undefined;
+		.get(clientId) as
+		| { name: string | null; redirect_uris: string }
+		| undefined;
 
 	if (!existing) {
 		// Only allow auto-registration for valid URLs (IndieAuth standard)
···
 		try {
 			new URL(clientId);
 		} catch {
-			return { error: "Client ID must be a valid URL for auto-registration. Non-URL clients must be pre-registered by an admin." };
+			return {
+				error:
+					"Client ID must be a valid URL for auto-registration. Non-URL clients must be pre-registered by an admin.",
+			};
 		}
 
 		// New app - auto-register (without pre-registration, no client secret or role)
 		db.query(
 			"INSERT INTO apps (client_id, redirect_uris, is_preregistered, first_seen, last_used) VALUES (?, ?, 0, ?, ?)",
-		).run(clientId, JSON.stringify([redirectUri]), Math.floor(Date.now() / 1000), Math.floor(Date.now() / 1000));
+		).run(
+			clientId,
+			JSON.stringify([redirectUri]),
+			Math.floor(Date.now() / 1000),
+			Math.floor(Date.now() / 1000),
+		);
 
 		// Fetch the newly created app
 		const newApp = db
 			.query("SELECT name, redirect_uris FROM apps WHERE client_id = ?")
 			.get(clientId) as { name: string | null; redirect_uris: string };
-		
+
 		return { app: newApp };
 	}
 
···
 	</div>
 </body>
 </html>`,
-			{ 
+			{
 				status: 400,
-				headers: { "Content-Type": "text/html" }
-			}
+				headers: { "Content-Type": "text/html" },
+			},
 		);
 	}
 
···
 
 	// Verify app is registered
 	const appResult = ensureApp(clientId, redirectUri);
-	
+
 	if (appResult.error) {
 		return new Response(
 			`<!DOCTYPE html>
···
 	</div>
 </body>
 </html>`,
-			{ 
+			{
 				status: 400,
-				headers: { "Content-Type": "text/html" }
-			}
+				headers: { "Content-Type": "text/html" },
+			},
 		);
 	}
-	
+
 	const app = appResult.app!;
 
 	const allowedRedirects = JSON.parse(app.redirect_uris) as string[];
···
 	</div>
 </body>
 </html>`,
-			{ 
+			{
 				status: 400,
-				headers: { "Content-Type": "text/html" }
-			}
+				headers: { "Content-Type": "text/html" },
+			},
 		);
 	}
 
···
 
 	// Verify app is registered
 	const appCheckResult = ensureApp(clientId, redirectUri);
-	
+
 	if (appCheckResult.error) {
 		return new Response(appCheckResult.error, { status: 400 });
 	}
 
 	// Check if user has previously granted permission to this app
 	const permission = db
-		.query(
-			"SELECT scopes FROM permissions WHERE user_id = ? AND client_id = ?",
-		)
+		.query("SELECT scopes FROM permissions WHERE user_id = ? AND client_id = ?")
 		.get(user.userId, clientId) as { scopes: string } | undefined;
 
 	const requestedScopes = scope.split(" ").filter(Boolean);
···
 	// If permission exists and covers all requested scopes, auto-approve
 	if (permission) {
 		const grantedScopes = JSON.parse(permission.scopes) as string[];
-		const hasAllScopes = requestedScopes.every((s) => grantedScopes.includes(s));
+		const hasAllScopes = requestedScopes.every((s) =>
+			grantedScopes.includes(s),
+		);
 
 		if (hasAllScopes) {
 			// Auto-approve - create auth code and redirect
···
 	// Load app metadata if pre-registered
 	const appData = db
 		.query("SELECT name, logo_url, description FROM apps WHERE client_id = ?")
-		.get(clientId) as { name: string | null; logo_url: string | null; description: string | null } | undefined;
-	
+		.get(clientId) as
+		| {
+				name: string | null;
+				logo_url: string | null;
+				description: string | null;
+		  }
+		| undefined;
+
 	// Determine app name and URL - custom apps have ikc_ prefix and should use name from DB
 	let appName: string;
 	let appUrl: string | null = null;
-	
-	if (clientId.startsWith('ikc_')) {
+
+	if (clientId.startsWith("ikc_")) {
 		// Custom app with generated ID
 		appName = appData?.name || clientId;
 	} else {
···
 			appName = appData?.name || clientId;
 		}
 	}
-	
+
 	const appLogo = appData?.logo_url;
 	const appDescription = appData?.description;
 
···
 
     <div class="app-header">
       <div class="app-logo">
-        ${appLogo ? `<img src="${appLogo}" alt="${appName}" />` : '🔐'}
+        ${appLogo ? `<img src="${appLogo}" alt="${appName}" />` : "🔐"}
       </div>
       <div class="app-info">
         <div class="app-name">${appName}</div>
-        ${appUrl ? `<div class="app-url">${appUrl}</div>` : ''}
-        ${appDescription ? `<div class="app-description">${appDescription}</div>` : ''}
+        ${appUrl ? `<div class="app-url">${appUrl}</div>` : ""}
+        ${appDescription ? `<div class="app-description">${appDescription}</div>` : ""}
       </div>
     </div>
 
···
       <div class="scope-title">requested permissions</div>
       <ul class="scope-list">
         ${scopes
-					.map(
-						(scope) => {
-							const isProfile = scope === "profile";
-							const description = scope === "profile" ? "Your profile (name, photo, URL)" : scope === "email" ? "Your email address" : scope;
-							const required = isProfile ? ' <span style="color: var(--old-rose); font-size: 0.875rem; margin-left: 0.5rem;">(required)</span>' : '';
-							return `
+					.map((scope) => {
+						const isProfile = scope === "profile";
+						const description =
+							scope === "profile"
+								? "Your profile (name, photo, URL)"
+								: scope === "email"
+									? "Your email address"
+									: scope;
+						const required = isProfile
+							? ' <span style="color: var(--old-rose); font-size: 0.875rem; margin-left: 0.5rem;">(required)</span>'
+							: "";
+						return `
           <li>
             <label>
-              <input type="checkbox" name="scope" value="${scope}" ${isProfile ? 'checked disabled' : 'checked'} />
+              <input type="checkbox" name="scope" value="${scope}" ${isProfile ? "checked disabled" : "checked"} />
               <span>${description}${required}</span>
             </label>
           </li>
         `;
-						},
-					)
+					})
 					.join("")}
       </ul>
     </div>
···
 	if (existing) {
 		db.query(
 			"UPDATE permissions SET scopes = ?, last_used = ? WHERE user_id = ? AND client_id = ?",
-		).run(JSON.stringify(approvedScopes), Math.floor(Date.now() / 1000), user.userId, clientId);
+		).run(
+			JSON.stringify(approvedScopes),
+			Math.floor(Date.now() / 1000),
+			user.userId,
+			clientId,
+		);
 	} else {
 		// Get app's default role for new permissions
 		const app = db
 			.query("SELECT default_role FROM apps WHERE client_id = ?")
 			.get(clientId) as { default_role: string | null } | undefined;
-		
+
 		db.query(
 			"INSERT INTO permissions (user_id, client_id, scopes, role) VALUES (?, ?, ?, ?)",
-		).run(user.userId, clientId, JSON.stringify(approvedScopes), app?.default_role || null);
+		).run(
+			user.userId,
+			clientId,
+			JSON.stringify(approvedScopes),
+			app?.default_role || null,
+		);
 	}
 
 	// Update app last_used
···
 		clientId,
 	);
 
-	return Response.redirect(`${redirectUri}?code=${code}&state=${state}`);
+	const origin = process.env.ORIGIN || "http://localhost:3000";
+	return Response.redirect(
+		`${redirectUri}?code=${code}&state=${state}&iss=${encodeURIComponent(origin)}`,
+	);
 }
 
 // POST /auth/token - Exchange authorization code for user identity
···
 	try {
 		const contentType = req.headers.get("Content-Type");
 		let body: Record<string, string>;
-		
+
 		// Support both JSON and form-encoded requests
 		if (contentType?.includes("application/json")) {
 			body = await req.json();
···
 			return Response.json(
 				{
 					error: "invalid_request",
-					error_description: "Content-Type must be application/json or application/x-www-form-urlencoded",
+					error_description:
+						"Content-Type must be application/json or application/x-www-form-urlencoded",
 				},
 				{ status: 400 },
 			);
 		}
-		
+
 		const {
-		grant_type,
-		code,
-		client_id,
-		client_secret,
-		redirect_uri,
-		 code_verifier,
-	} = body;
+			grant_type,
+			code,
+			client_id,
+			client_secret,
+			redirect_uri,
+			code_verifier,
+		} = body;
 
 		if (grant_type !== "authorization_code") {
-		return Response.json(
-		{
-		error: "unsupported_grant_type",
-		 error_description: "Only authorization_code grant type is supported",
-		},
-		 { status: 400 },
-		 );
-	}
+			return Response.json(
+				{
+					error: "unsupported_grant_type",
+					error_description: "Only authorization_code grant type is supported",
+				},
+				{ status: 400 },
+			);
+		}
 
 		// Check if client is pre-registered and requires secret
 		const app = db
-		.query("SELECT is_preregistered, client_secret_hash FROM apps WHERE client_id = ?")
-		.get(client_id) as
-		| { is_preregistered: number; client_secret_hash: string | null }
-		| undefined;
+			.query(
+				"SELECT is_preregistered, client_secret_hash FROM apps WHERE client_id = ?",
+			)
+			.get(client_id) as
+			| { is_preregistered: number; client_secret_hash: string | null }
+			| undefined;
 
 		// If client is pre-registered, verify client secret
 		if (app && app.is_preregistered === 1) {
-		if (!client_secret) {
-			return Response.json(
-				{
-					error: "invalid_client",
-					error_description: "client_secret is required for pre-registered clients",
-				},
-				{ status: 401 },
-			);
+			if (!client_secret) {
+				return Response.json(
+					{
+						error: "invalid_client",
+						error_description:
+							"client_secret is required for pre-registered clients",
+					},
+					{ status: 401 },
+				);
+			}
+
+			if (!app.client_secret_hash) {
+				return Response.json(
+					{
+						error: "server_error",
+						error_description: "Client secret not configured",
+					},
+					{ status: 500 },
+				);
+			}
+
+			// Verify client secret
+			const providedSecretHash = crypto
+				.createHash("sha256")
+				.update(client_secret)
+				.digest("hex");
+
+			if (providedSecretHash !== app.client_secret_hash) {
+				return Response.json(
+					{
+						error: "invalid_client",
+						error_description: "Invalid client_secret",
+					},
+					{ status: 401 },
+				);
+			}
 		}
 
-		if (!app.client_secret_hash) {
+		if (!code || !client_id || !redirect_uri) {
+			console.error("Token endpoint: missing parameters", {
+				code: !!code,
+				client_id: !!client_id,
+				redirect_uri: !!redirect_uri,
+			});
 			return Response.json(
 				{
-					error: "server_error",
-					error_description: "Client secret not configured",
+					error: "invalid_request",
+					error_description: "Missing required parameters",
 				},
-				{ status: 500 },
+				{ status: 400 },
 			);
 		}
 
-		// Verify client secret
-		const providedSecretHash = crypto
-			.createHash("sha256")
-			.update(client_secret)
-			.digest("hex");
-
-		if (providedSecretHash !== app.client_secret_hash) {
+		// PKCE is required for all clients per IndieAuth spec
+		if (!code_verifier) {
 			return Response.json(
 				{
-					error: "invalid_client",
-					error_description: "Invalid client_secret",
+					error: "invalid_request",
+					error_description: "code_verifier is required (PKCE)",
 				},
-				{ status: 401 },
+				{ status: 400 },
 			);
 		}
-	}
-
-	if (!code || !client_id || !redirect_uri) {
-		console.error("Token endpoint: missing parameters", { code: !!code, client_id: !!client_id, redirect_uri: !!redirect_uri });
-		return Response.json(
-			{
-				error: "invalid_request",
-				error_description: "Missing required parameters",
-			},
-			{ status: 400 },
-		);
-	}
-
-	// For auto-registered clients, code_verifier (PKCE) is still required
-	if ((!app || app.is_preregistered === 0) && !code_verifier) {
-		return Response.json(
-			{
-				error: "invalid_request",
-				error_description: "code_verifier is required for public clients",
-			},
-			{ status: 400 },
-		);
-	}
 
 		// Look up authorization code
 		const authcode = db
···
 			);
 		}
 
-		// Verify PKCE code_verifier (only for public clients)
-		if ((!app || app.is_preregistered === 0) && code_verifier) {
+		// Verify PKCE code_verifier (required for all clients per IndieAuth spec)
 		if (!verifyPKCE(code_verifier, authcode.code_challenge)) {
-		return Response.json(
-		{
-		 error: "invalid_grant",
-		  error_description: "Invalid code_verifier",
-		 },
-		  { status: 400 },
-		  );
+			return Response.json(
+				{
+					error: "invalid_grant",
+					error_description: "Invalid code_verifier",
+				},
+				{ status: 400 },
+			);
 		}
-	}
 
 		// Mark code as used
 		db.query("UPDATE authcodes SET used = 1 WHERE code = ?").run(code);
 
 		// Get user profile
 		const user = db
-			.query(
-				"SELECT username, name, email, photo, url FROM users WHERE id = ?",
-			)
+			.query("SELECT username, name, email, photo, url FROM users WHERE id = ?")
 			.get(authcode.user_id) as
 			| {
 					username: string;
···
 	if (!username) {
 		return new Response("Username required", { status: 400 });
 	}
-	
+
 	const user = db
-		.query("SELECT username, name, email, photo, url FROM users WHERE username = ?")
+		.query(
+			"SELECT username, name, email, photo, url FROM users WHERE username = ?",
+		)
 		.get(username) as
 		| {
 				username: string;
···
   <title>${user.name} • indiko</title>
   <meta name="description" content="${user.name}'s profile on Indiko${user.url ? ` - ${user.url}` : ""}" />
   <link rel="icon" href="/favicon.svg" type="image/svg+xml" />
+  <link rel="indieauth-metadata" href="${process.env.ORIGIN}/.well-known/oauth-authorization-server" />
   <link rel="authorization_endpoint" href="${process.env.ORIGIN}/auth/authorize" />
   <link rel="token_endpoint" href="${process.env.ORIGIN}/auth/token" />
   ${user.url ? `<link rel="me" href="${user.url}" />` : ""}
···
       <p>
         You can delegate IndieAuth to this server from your own website. Add these tags to your site's <code>&lt;head&gt;</code>:
       </p>
-      <div class="code-box"><span class="html-tag">&lt;link</span> <span class="html-attr">rel</span>=<span class="html-value">"authorization_endpoint"</span> <span class="html-attr">href</span>=<span class="html-value">"${process.env.ORIGIN}/auth/authorize"</span> <span class="html-tag">/&gt;</span>
+      <div class="code-box"><span class="html-tag">&lt;link</span> <span class="html-attr">rel</span>=<span class="html-value">"indieauth-metadata"</span> <span class="html-attr">href</span>=<span class="html-value">"${process.env.ORIGIN}/.well-known/oauth-authorization-server"</span> <span class="html-tag">/&gt;</span>
+<span class="html-tag">&lt;link</span> <span class="html-attr">rel</span>=<span class="html-value">"authorization_endpoint"</span> <span class="html-attr">href</span>=<span class="html-value">"${process.env.ORIGIN}/auth/authorize"</span> <span class="html-tag">/&gt;</span>
 <span class="html-tag">&lt;link</span> <span class="html-attr">rel</span>=<span class="html-value">"token_endpoint"</span> <span class="html-attr">href</span>=<span class="html-value">"${process.env.ORIGIN}/auth/token"</span> <span class="html-tag">/&gt;</span>
 <span class="html-tag">&lt;link</span> <span class="html-attr">rel</span>=<span class="html-value">"me"</span> <span class="html-attr">href</span>=<span class="html-value">"${process.env.ORIGIN}/u/${user.username}"</span> <span class="html-tag">/&gt;</span></div>
       <p>
···
 </body>
 </html>`;
 
+	const origin = process.env.ORIGIN || "http://localhost:3000";
 	return new Response(html, {
-		headers: { "Content-Type": "text/html" },
+		headers: {
+			"Content-Type": "text/html",
+			Link: `<${origin}/.well-known/oauth-authorization-server>; rel="indieauth-metadata"`,
+		},
 	});
 }
 
···
 		return Response.json({ error: "Admin access required" }, { status: 403 });
 	}
 
-	const body = await req.json() as {
+	const body = (await req.json()) as {
 		maxUses?: number;
 		expiresAt?: number | null;
 		note?: string | null;
···
 	const note = body.note || null;
 	const message = body.message || null;
 
-	const result = db.query(
-		"INSERT INTO invites (code, created_by, max_uses, expires_at, note, message) VALUES (?, ?, ?, ?, ?, ?)",
-	).run(inviteCode, user.userId, maxUses, expiresAt, note, message);
+	const result = db
+		.query(
+			"INSERT INTO invites (code, created_by, max_uses, expires_at, note, message) VALUES (?, ?, ?, ?, ?, ?)",
+		)
+		.run(inviteCode, user.userId, maxUses, expiresAt, note, message);
 
 	const inviteId = Number(result.lastInsertRowid);
 
···
 		return Response.json({ error: "Admin access required" }, { status: 403 });
 	}
 
-	const invites = db.query(`
+	const invites = db
+		.query(`
 		SELECT i.id, i.code, i.max_uses, i.current_uses, i.expires_at, i.note, i.message, i.created_at,
 			creator.username as created_by_username
 		FROM invites i
 		LEFT JOIN users creator ON i.created_by = creator.id
 		ORDER BY i.created_at DESC
-	`).all() as Array<{
+	`)
+		.all() as Array<{
 		id: number;
 		code: string;
 		max_uses: number;
···
 	}>;
 
 	// Get app roles for each invite
-	const inviteRoles = db.query(`
+	const inviteRoles = db
+		.query(`
 		SELECT ir.invite_id, ir.app_id, ir.role, a.client_id, a.name
 		FROM invite_roles ir
 		JOIN apps a ON ir.app_id = a.id
-	`).all() as Array<{
+	`)
+		.all() as Array<{
 		invite_id: number;
 		app_id: number;
 		role: string;
···
 	}>;
 
 	// Get users who used each invite
-	const inviteUses = db.query(`
+	const inviteUses = db
+		.query(`
 		SELECT iu.invite_id, iu.used_at, u.username
 		FROM invite_uses iu
 		JOIN users u ON iu.user_id = u.id
 		ORDER BY iu.used_at DESC
-	`).all() as Array<{
+	`)
+		.all() as Array<{
 		invite_id: number;
 		used_at: number;
 		username: string;
···
 		return Response.json({ error: "Invalid invite ID" }, { status: 400 });
 	}
 
-	const body = await req.json() as {
+	const body = (await req.json()) as {
 		maxUses?: number | null;
 		expiresAt?: number | null;
 		note?: string | null;
···
 
 	values.push(inviteId);
 
-	db.query(`UPDATE invites SET ${updates.join(", ")} WHERE id = ?`).run(...values);
+	db.query(`UPDATE invites SET ${updates.join(", ")} WHERE id = ?`).run(
+		...values,
+	);
 
 	return Response.json({ success: true });
 }
···
 	return Response.json({ success: true });
 }
 
+// GET /.well-known/oauth-authorization-server - IndieAuth metadata endpoint
+export function indieauthMetadata(): Response {
+	const origin = process.env.ORIGIN || "http://localhost:3000";
+
+	const metadata = {
+		issuer: origin,
+		authorization_endpoint: `${origin}/auth/authorize`,
+		token_endpoint: `${origin}/auth/token`,
+		code_challenge_methods_supported: ["S256"],
+		scopes_supported: ["profile", "email"],
+		response_types_supported: ["code"],
+		grant_types_supported: ["authorization_code"],
+		service_documentation: `${origin}/docs`,
+	};
+
+	return Response.json(metadata, {
+		headers: {
+			"Content-Type": "application/json",
+			"Access-Control-Allow-Origin": "*",
+		},
+	});
+}

src/styles.css

···
 h1 {
 	font-size: 2rem;
 	font-weight: 700;
-	background: linear-gradient(135deg, var(--old-rose), var(--berry-crush), var(--rosewood));
+	background: linear-gradient(
+		135deg,
+		var(--old-rose),
+		var(--berry-crush),
+		var(--rosewood)
+	);
 	-webkit-background-clip: text;
 	-webkit-text-fill-color: transparent;
 	background-clip: text;
···
 }
 
 button::before {
-	content: '';
+	content: "";
 	position: absolute;
 	top: -4px;
 	left: -4px;
···
 
 .divider::before,
 .divider::after {
-	content: '';
+	content: "";
 	flex: 1;
 	border-bottom: 1px solid rgba(188, 141, 160, 0.3);
 }