Typechecks and linting

Cargo.toml

···
 version = "0.1.0"
 edition = "2024"
 license = "AGPL-3.0-or-later"
-license-file = "LICENSE-AGPL-3.0-or-later"
 [dependencies]
 anyhow = "1.0.100"
 async-trait = "0.1.89"

frontend/deno.json

···
     "dev": "deno run -A npm:vite",
     "build": "deno run -A npm:vite build",
     "preview": "deno run -A npm:vite preview",
+    "check": "deno run -A npm:svelte-check --tsconfig ./tsconfig.json",
     "test": "deno run -A npm:vitest",
     "test:run": "deno run -A npm:vitest run",
     "test:watch": "deno run -A npm:vitest watch",

frontend/deno.lock

···
     "npm:@testing-library/user-event@^14.6.1": "14.6.1_@testing-library+dom@10.4.1",
     "npm:jsdom@^25.0.1": "25.0.1",
     "npm:multiformats@^13.4.2": "13.4.2",
+    "npm:svelte-check@*": "4.3.5_svelte@5.46.1__acorn@8.15.0_typescript@5.9.3",
+    "npm:svelte-check@^4.3.5": "4.3.5_svelte@5.46.1__acorn@8.15.0_typescript@5.9.3",
     "npm:svelte-i18n@^4.0.1": "4.0.1_svelte@5.46.1__acorn@8.15.0",
     "npm:svelte@^5.46.1": "5.46.1_acorn@8.15.0",
+    "npm:typescript@^5.9.3": "5.9.3",
     "npm:vite@*": "7.3.0_picomatch@4.0.3",
     "npm:vite@^7.3.0": "7.3.0_picomatch@4.0.3",
     "npm:vitest@*": "4.0.16_jsdom@25.0.1_vite@7.3.0__picomatch@4.0.3",
···
     "chai@6.2.2": {
       "integrity": "sha512-NUPRluOfOiTKBKvWPtSD4PhFvWCqOi0BGStNWs57X9js7XGTprSmFoz5F0tWhR4WPjNeR9jXqdC7/UpSJTnlRg=="
     },
+    "chokidar@4.0.3": {
+      "integrity": "sha512-Qgzu8kfBvo+cA4962jnP1KkS6Dop5NS6g7R5LFYJr4b8Ub94PPQXUksCw9PvXoeXPRRddRNC5C1JQUR2SMGtnA==",
+      "dependencies": [
+        "readdirp"
+      ]
+    },
     "cli-color@2.0.4": {
       "integrity": "sha512-zlnpg0jNcibNrO7GG9IeHH7maWFeCz+Ja1wx/7tZNU5ASSSSZ+/qZciM0/LHCYxSdqv5h2sdbQ/PXYdOuetXvA==",
       "dependencies": [
···
     "react-is@17.0.2": {
       "integrity": "sha512-w2GsyukL62IJnlaff/nRegPQR94C/XXamvMWmSHRJ4y7Ts/4ocGRmTHvOs8PSE6pB3dWOrD/nueuU5sduBsQ4w=="
     },
+    "readdirp@4.1.2": {
+      "integrity": "sha512-GDhwkLfywWL2s6vEjyhri+eXmfH6j1L7JE27WhqLeYzoh/A3DBaYGEj2H/HFZCn/kMfim73FXxEJTw06WtxQwg=="
+    },
     "redent@3.0.0": {
       "integrity": "sha512-6tDA8g98We0zd0GvVeMT9arEOnTw9qM03L9cJXaCjrip1OO764RDBLBfrB4cwzNGDj5OA5ioymC9GkizgWJDUg==",
       "dependencies": [
···
         "min-indent"
       ]
     },
+    "svelte-check@4.3.5_svelte@5.46.1__acorn@8.15.0_typescript@5.9.3": {
+      "integrity": "sha512-e4VWZETyXaKGhpkxOXP+B/d0Fp/zKViZoJmneZWe/05Y2aqSKj3YN2nLfYPJBQ87WEiY4BQCQ9hWGu9mPT1a1Q==",
+      "dependencies": [
+        "@jridgewell/trace-mapping",
+        "chokidar",
+        "fdir",
+        "picocolors",
+        "sade",
+        "svelte",
+        "typescript"
+      ],
+      "bin": true
+    },
     "svelte-i18n@4.0.1_svelte@5.46.1__acorn@8.15.0": {
       "integrity": "sha512-jaykGlGT5PUaaq04JWbJREvivlCnALtT+m87Kbm0fxyYHynkQaxQMnIKHLm2WeIuBRoljzwgyvz0Z6/CMwfdmQ==",
       "dependencies": [
···
     },
     "type@2.7.3": {
       "integrity": "sha512-8j+1QmAbPvLZow5Qpi6NCaN8FB60p/6x8/vfNqOk/hC+HuvFZhL4+WfekuhQLiqFZXOgQdrs3B+XxEmCc6b3FQ=="
+    },
+    "typescript@5.9.3": {
+      "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
+      "bin": true
     },
     "unicode-segmenter@0.14.5": {
       "integrity": "sha512-jHGmj2LUuqDcX3hqY12Ql+uhUTn8huuxNZGq7GvtF6bSybzH3aFgedYu/KTzQStEgt1Ra2F3HxadNXsNjb3m3g=="
···
         "npm:@testing-library/user-event@^14.6.1",
         "npm:jsdom@^25.0.1",
         "npm:multiformats@^13.4.2",
+        "npm:svelte-check@^4.3.5",
         "npm:svelte-i18n@^4.0.1",
         "npm:svelte@^5.46.1",
+        "npm:typescript@^5.9.3",
         "npm:vite@^7.3.0",
         "npm:vitest@^4.0.16",
         "npm:zod@^4.3.5"

frontend/package.json

···
     "@testing-library/user-event": "^14.6.1",
     "jsdom": "^25.0.1",
     "svelte": "^5.46.1",
+    "svelte-check": "^4.3.5",
+    "typescript": "^5.9.3",
     "vite": "^7.3.0",
     "vitest": "^4.0.16"
   }

frontend/src/App.svelte

···
     initServerConfig()
     initAuth().then(({ oauthLoginCompleted }) => {
       if (oauthLoginCompleted) {
-        navigate('/dashboard', true)
+        navigate('/dashboard', { replace: true })
       }
       oauthCallbackPending = false
     })
···
     const path = getCurrentPath()
     if (path === '/') {
       if (auth.kind === 'authenticated') {
-        navigate('/dashboard', true)
+        navigate('/dashboard', { replace: true })
       } else {
-        navigate('/login', true)
+        navigate('/login', { replace: true })
       }
     }
   })

frontend/src/components/ReauthModal.svelte

···
         return
       }
       const { options } = await api.reauthPasskeyStart(token)
-      const publicKeyOptions = prepareRequestOptions(options as WebAuthnRequestOptionsResponse)
+      const publicKeyOptions = prepareRequestOptions(options as unknown as WebAuthnRequestOptionsResponse)
       const credential = await navigator.credentials.get({
         publicKey: publicKeyOptions
       })

frontend/src/components/migration/InboundWizard.svelte

···
       }, 3000)
       return () => clearInterval(interval)
     }
+    return undefined
   })
 
   async function loadServerInfo() {

frontend/src/components/migration/OfflineInboundWizard.svelte

···
       }, 3000)
       return () => clearInterval(interval)
     }
+    return undefined
   })
 
   async function loadServerInfo() {

frontend/src/lib/api-validated.ts

···
-import { z } from 'zod'
-import { ok, err, type Result } from './types/result'
-import { ApiError } from './api'
-import type { AccessToken, RefreshToken, Did, Handle, Nsid, Rkey } from './types/branded'
+import { z } from "zod";
+import { err, ok, type Result } from "./types/result.ts";
+import { ApiError } from "./api.ts";
+import type {
+  AccessToken,
+  Did,
+  Nsid,
+  RefreshToken,
+  Rkey,
+} from "./types/branded.ts";
 import {
-  sessionSchema,
-  serverDescriptionSchema,
+  accountInfoSchema,
   appPasswordSchema,
+  createBackupResponseSchema,
   createdAppPasswordSchema,
-  listSessionsResponseSchema,
-  totpStatusSchema,
-  totpSecretSchema,
+  createRecordResponseSchema,
+  didDocumentSchema,
   enableTotpResponseSchema,
+  legacyLoginPreferenceSchema,
+  listBackupsResponseSchema,
   listPasskeysResponseSchema,
+  listRecordsResponseSchema,
+  listSessionsResponseSchema,
   listTrustedDevicesResponseSchema,
+  notificationPrefsSchema,
+  passwordStatusSchema,
   reauthStatusSchema,
-  notificationPrefsSchema,
-  didDocumentSchema,
+  recordResponseSchema,
   repoDescriptionSchema,
-  listRecordsResponseSchema,
-  recordResponseSchema,
-  createRecordResponseSchema,
+  searchAccountsResponseSchema,
+  serverConfigSchema,
+  serverDescriptionSchema,
   serverStatsSchema,
-  serverConfigSchema,
-  passwordStatusSchema,
+  sessionSchema,
   successResponseSchema,
-  legacyLoginPreferenceSchema,
-  accountInfoSchema,
-  searchAccountsResponseSchema,
-  listBackupsResponseSchema,
-  createBackupResponseSchema,
-  type ValidatedSession,
-  type ValidatedServerDescription,
-  type ValidatedListSessionsResponse,
-  type ValidatedTotpStatus,
-  type ValidatedTotpSecret,
+  totpSecretSchema,
+  totpStatusSchema,
+  type ValidatedAccountInfo,
+  type ValidatedAppPassword,
+  type ValidatedCreateBackupResponse,
+  type ValidatedCreatedAppPassword,
+  type ValidatedCreateRecordResponse,
+  type ValidatedDidDocument,
   type ValidatedEnableTotpResponse,
+  type ValidatedLegacyLoginPreference,
+  type ValidatedListBackupsResponse,
   type ValidatedListPasskeysResponse,
+  type ValidatedListRecordsResponse,
+  type ValidatedListSessionsResponse,
   type ValidatedListTrustedDevicesResponse,
-  type ValidatedReauthStatus,
   type ValidatedNotificationPrefs,
-  type ValidatedDidDocument,
+  type ValidatedPasswordStatus,
+  type ValidatedReauthStatus,
+  type ValidatedRecordResponse,
   type ValidatedRepoDescription,
-  type ValidatedListRecordsResponse,
-  type ValidatedRecordResponse,
-  type ValidatedCreateRecordResponse,
-  type ValidatedServerStats,
+  type ValidatedSearchAccountsResponse,
   type ValidatedServerConfig,
-  type ValidatedPasswordStatus,
+  type ValidatedServerDescription,
+  type ValidatedServerStats,
+  type ValidatedSession,
   type ValidatedSuccessResponse,
-  type ValidatedLegacyLoginPreference,
-  type ValidatedAccountInfo,
-  type ValidatedSearchAccountsResponse,
-  type ValidatedListBackupsResponse,
-  type ValidatedCreateBackupResponse,
-  type ValidatedCreatedAppPassword,
-  type ValidatedAppPassword,
-} from './types/schemas'
+  type ValidatedTotpSecret,
+  type ValidatedTotpStatus,
+} from "./types/schemas.ts";
 
-const API_BASE = '/xrpc'
+const API_BASE = "/xrpc";
 
 interface XrpcOptions {
-  method?: 'GET' | 'POST'
-  params?: Record<string, string>
-  body?: unknown
-  token?: string
+  method?: "GET" | "POST";
+  params?: Record<string, string>;
+  body?: unknown;
+  token?: string;
 }
 
 class ValidationError extends Error {
   constructor(
     public issues: z.ZodIssue[],
-    message: string = 'API response validation failed'
+    message: string = "API response validation failed",
   ) {
-    super(message)
-    this.name = 'ValidationError'
+    super(message);
+    this.name = "ValidationError";
   }
 }
 
 async function xrpcValidated<T>(
   method: string,
   schema: z.ZodType<T>,
-  options?: XrpcOptions
+  options?: XrpcOptions,
 ): Promise<Result<T, ApiError | ValidationError>> {
-  const { method: httpMethod = 'GET', params, body, token } = options ?? {}
-  let url = `${API_BASE}/${method}`
+  const { method: httpMethod = "GET", params, body, token } = options ?? {};
+  let url = `${API_BASE}/${method}`;
   if (params) {
-    const searchParams = new URLSearchParams(params)
-    url += `?${searchParams}`
+    const searchParams = new URLSearchParams(params);
+    url += `?${searchParams}`;
   }
-  const headers: Record<string, string> = {}
+  const headers: Record<string, string> = {};
   if (token) {
-    headers['Authorization'] = `Bearer ${token}`
+    headers["Authorization"] = `Bearer ${token}`;
   }
   if (body) {
-    headers['Content-Type'] = 'application/json'
+    headers["Content-Type"] = "application/json";
   }
 
   try {
···
       method: httpMethod,
       headers,
       body: body ? JSON.stringify(body) : undefined,
-    })
+    });
 
     if (!res.ok) {
       const errData = await res.json().catch(() => ({
-        error: 'Unknown',
+        error: "Unknown",
         message: res.statusText,
-      }))
-      return err(new ApiError(res.status, errData.error, errData.message))
+      }));
+      return err(new ApiError(res.status, errData.error, errData.message));
     }
 
-    const data = await res.json()
-    const parsed = schema.safeParse(data)
+    const data = await res.json();
+    const parsed = schema.safeParse(data);
 
     if (!parsed.success) {
-      return err(new ValidationError(parsed.error.issues))
+      return err(new ValidationError(parsed.error.issues));
     }
 
-    return ok(parsed.data)
+    return ok(parsed.data);
   } catch (e) {
     if (e instanceof ApiError || e instanceof ValidationError) {
-      return err(e)
+      return err(e);
     }
-    return err(new ApiError(0, 'Unknown', e instanceof Error ? e.message : String(e)))
+    return err(
+      new ApiError(0, "Unknown", e instanceof Error ? e.message : String(e)),
+    );
   }
 }
 
 export const validatedApi = {
-  getSession(token: AccessToken): Promise<Result<ValidatedSession, ApiError | ValidationError>> {
-    return xrpcValidated('com.atproto.server.getSession', sessionSchema, { token })
+  getSession(
+    token: AccessToken,
+  ): Promise<Result<ValidatedSession, ApiError | ValidationError>> {
+    return xrpcValidated("com.atproto.server.getSession", sessionSchema, {
+      token,
+    });
   },
 
-  refreshSession(refreshJwt: RefreshToken): Promise<Result<ValidatedSession, ApiError | ValidationError>> {
-    return xrpcValidated('com.atproto.server.refreshSession', sessionSchema, {
-      method: 'POST',
+  refreshSession(
+    refreshJwt: RefreshToken,
+  ): Promise<Result<ValidatedSession, ApiError | ValidationError>> {
+    return xrpcValidated("com.atproto.server.refreshSession", sessionSchema, {
+      method: "POST",
       token: refreshJwt,
-    })
+    });
   },
 
   createSession(
     identifier: string,
-    password: string
+    password: string,
   ): Promise<Result<ValidatedSession, ApiError | ValidationError>> {
-    return xrpcValidated('com.atproto.server.createSession', sessionSchema, {
-      method: 'POST',
+    return xrpcValidated("com.atproto.server.createSession", sessionSchema, {
+      method: "POST",
       body: { identifier, password },
-    })
+    });
   },
 
-  describeServer(): Promise<Result<ValidatedServerDescription, ApiError | ValidationError>> {
-    return xrpcValidated('com.atproto.server.describeServer', serverDescriptionSchema)
+  describeServer(): Promise<
+    Result<ValidatedServerDescription, ApiError | ValidationError>
+  > {
+    return xrpcValidated(
+      "com.atproto.server.describeServer",
+      serverDescriptionSchema,
+    );
   },
 
   listAppPasswords(
-    token: AccessToken
-  ): Promise<Result<{ passwords: ValidatedAppPassword[] }, ApiError | ValidationError>> {
+    token: AccessToken,
+  ): Promise<
+    Result<{ passwords: ValidatedAppPassword[] }, ApiError | ValidationError>
+  > {
     return xrpcValidated(
-      'com.atproto.server.listAppPasswords',
+      "com.atproto.server.listAppPasswords",
       z.object({ passwords: z.array(appPasswordSchema) }),
-      { token }
-    )
+      { token },
+    );
   },
 
   createAppPassword(
     token: AccessToken,
     name: string,
-    scopes?: string
+    scopes?: string,
   ): Promise<Result<ValidatedCreatedAppPassword, ApiError | ValidationError>> {
-    return xrpcValidated('com.atproto.server.createAppPassword', createdAppPasswordSchema, {
-      method: 'POST',
-      token,
-      body: { name, scopes },
-    })
+    return xrpcValidated(
+      "com.atproto.server.createAppPassword",
+      createdAppPasswordSchema,
+      {
+        method: "POST",
+        token,
+        body: { name, scopes },
+      },
+    );
   },
 
-  listSessions(token: AccessToken): Promise<Result<ValidatedListSessionsResponse, ApiError | ValidationError>> {
-    return xrpcValidated('_account.listSessions', listSessionsResponseSchema, { token })
+  listSessions(
+    token: AccessToken,
+  ): Promise<
+    Result<ValidatedListSessionsResponse, ApiError | ValidationError>
+  > {
+    return xrpcValidated("_account.listSessions", listSessionsResponseSchema, {
+      token,
+    });
   },
 
-  getTotpStatus(token: AccessToken): Promise<Result<ValidatedTotpStatus, ApiError | ValidationError>> {
-    return xrpcValidated('com.atproto.server.getTotpStatus', totpStatusSchema, { token })
+  getTotpStatus(
+    token: AccessToken,
+  ): Promise<Result<ValidatedTotpStatus, ApiError | ValidationError>> {
+    return xrpcValidated("com.atproto.server.getTotpStatus", totpStatusSchema, {
+      token,
+    });
   },
 
-  createTotpSecret(token: AccessToken): Promise<Result<ValidatedTotpSecret, ApiError | ValidationError>> {
-    return xrpcValidated('com.atproto.server.createTotpSecret', totpSecretSchema, {
-      method: 'POST',
-      token,
-    })
+  createTotpSecret(
+    token: AccessToken,
+  ): Promise<Result<ValidatedTotpSecret, ApiError | ValidationError>> {
+    return xrpcValidated(
+      "com.atproto.server.createTotpSecret",
+      totpSecretSchema,
+      {
+        method: "POST",
+        token,
+      },
+    );
   },
 
   enableTotp(
     token: AccessToken,
-    code: string
+    code: string,
   ): Promise<Result<ValidatedEnableTotpResponse, ApiError | ValidationError>> {
-    return xrpcValidated('com.atproto.server.enableTotp', enableTotpResponseSchema, {
-      method: 'POST',
-      token,
-      body: { code },
-    })
+    return xrpcValidated(
+      "com.atproto.server.enableTotp",
+      enableTotpResponseSchema,
+      {
+        method: "POST",
+        token,
+        body: { code },
+      },
+    );
   },
 
-  listPasskeys(token: AccessToken): Promise<Result<ValidatedListPasskeysResponse, ApiError | ValidationError>> {
-    return xrpcValidated('com.atproto.server.listPasskeys', listPasskeysResponseSchema, { token })
+  listPasskeys(
+    token: AccessToken,
+  ): Promise<
+    Result<ValidatedListPasskeysResponse, ApiError | ValidationError>
+  > {
+    return xrpcValidated(
+      "com.atproto.server.listPasskeys",
+      listPasskeysResponseSchema,
+      { token },
+    );
   },
 
   listTrustedDevices(
-    token: AccessToken
-  ): Promise<Result<ValidatedListTrustedDevicesResponse, ApiError | ValidationError>> {
-    return xrpcValidated('_account.listTrustedDevices', listTrustedDevicesResponseSchema, { token })
+    token: AccessToken,
+  ): Promise<
+    Result<ValidatedListTrustedDevicesResponse, ApiError | ValidationError>
+  > {
+    return xrpcValidated(
+      "_account.listTrustedDevices",
+      listTrustedDevicesResponseSchema,
+      { token },
+    );
   },
 
-  getReauthStatus(token: AccessToken): Promise<Result<ValidatedReauthStatus, ApiError | ValidationError>> {
-    return xrpcValidated('_account.getReauthStatus', reauthStatusSchema, { token })
+  getReauthStatus(
+    token: AccessToken,
+  ): Promise<Result<ValidatedReauthStatus, ApiError | ValidationError>> {
+    return xrpcValidated("_account.getReauthStatus", reauthStatusSchema, {
+      token,
+    });
   },
 
   getNotificationPrefs(
-    token: AccessToken
+    token: AccessToken,
   ): Promise<Result<ValidatedNotificationPrefs, ApiError | ValidationError>> {
-    return xrpcValidated('_account.getNotificationPrefs', notificationPrefsSchema, { token })
+    return xrpcValidated(
+      "_account.getNotificationPrefs",
+      notificationPrefsSchema,
+      { token },
+    );
   },
 
-  getDidDocument(token: AccessToken): Promise<Result<ValidatedDidDocument, ApiError | ValidationError>> {
-    return xrpcValidated('_account.getDidDocument', didDocumentSchema, { token })
+  getDidDocument(
+    token: AccessToken,
+  ): Promise<Result<ValidatedDidDocument, ApiError | ValidationError>> {
+    return xrpcValidated("_account.getDidDocument", didDocumentSchema, {
+      token,
+    });
   },
 
   describeRepo(
     token: AccessToken,
-    repo: Did
+    repo: Did,
   ): Promise<Result<ValidatedRepoDescription, ApiError | ValidationError>> {
-    return xrpcValidated('com.atproto.repo.describeRepo', repoDescriptionSchema, {
-      token,
-      params: { repo },
-    })
+    return xrpcValidated(
+      "com.atproto.repo.describeRepo",
+      repoDescriptionSchema,
+      {
+        token,
+        params: { repo },
+      },
+    );
   },
 
   listRecords(
     token: AccessToken,
     repo: Did,
     collection: Nsid,
-    options?: { limit?: number; cursor?: string; reverse?: boolean }
+    options?: { limit?: number; cursor?: string; reverse?: boolean },
   ): Promise<Result<ValidatedListRecordsResponse, ApiError | ValidationError>> {
-    const params: Record<string, string> = { repo, collection }
-    if (options?.limit) params.limit = String(options.limit)
-    if (options?.cursor) params.cursor = options.cursor
-    if (options?.reverse) params.reverse = 'true'
-    return xrpcValidated('com.atproto.repo.listRecords', listRecordsResponseSchema, {
-      token,
-      params,
-    })
+    const params: Record<string, string> = { repo, collection };
+    if (options?.limit) params.limit = String(options.limit);
+    if (options?.cursor) params.cursor = options.cursor;
+    if (options?.reverse) params.reverse = "true";
+    return xrpcValidated(
+      "com.atproto.repo.listRecords",
+      listRecordsResponseSchema,
+      {
+        token,
+        params,
+      },
+    );
   },
 
   getRecord(
     token: AccessToken,
     repo: Did,
     collection: Nsid,
-    rkey: Rkey
+    rkey: Rkey,
   ): Promise<Result<ValidatedRecordResponse, ApiError | ValidationError>> {
-    return xrpcValidated('com.atproto.repo.getRecord', recordResponseSchema, {
+    return xrpcValidated("com.atproto.repo.getRecord", recordResponseSchema, {
       token,
       params: { repo, collection, rkey },
-    })
+    });
   },
 
   createRecord(
···
     repo: Did,
     collection: Nsid,
     record: unknown,
-    rkey?: Rkey
-  ): Promise<Result<ValidatedCreateRecordResponse, ApiError | ValidationError>> {
-    return xrpcValidated('com.atproto.repo.createRecord', createRecordResponseSchema, {
-      method: 'POST',
-      token,
-      body: { repo, collection, record, rkey },
-    })
+    rkey?: Rkey,
+  ): Promise<
+    Result<ValidatedCreateRecordResponse, ApiError | ValidationError>
+  > {
+    return xrpcValidated(
+      "com.atproto.repo.createRecord",
+      createRecordResponseSchema,
+      {
+        method: "POST",
+        token,
+        body: { repo, collection, record, rkey },
+      },
+    );
   },
 
-  getServerStats(token: AccessToken): Promise<Result<ValidatedServerStats, ApiError | ValidationError>> {
-    return xrpcValidated('_admin.getServerStats', serverStatsSchema, { token })
+  getServerStats(
+    token: AccessToken,
+  ): Promise<Result<ValidatedServerStats, ApiError | ValidationError>> {
+    return xrpcValidated("_admin.getServerStats", serverStatsSchema, { token });
   },
 
-  getServerConfig(): Promise<Result<ValidatedServerConfig, ApiError | ValidationError>> {
-    return xrpcValidated('_server.getConfig', serverConfigSchema)
+  getServerConfig(): Promise<
+    Result<ValidatedServerConfig, ApiError | ValidationError>
+  > {
+    return xrpcValidated("_server.getConfig", serverConfigSchema);
   },
 
-  getPasswordStatus(token: AccessToken): Promise<Result<ValidatedPasswordStatus, ApiError | ValidationError>> {
-    return xrpcValidated('_account.getPasswordStatus', passwordStatusSchema, { token })
+  getPasswordStatus(
+    token: AccessToken,
+  ): Promise<Result<ValidatedPasswordStatus, ApiError | ValidationError>> {
+    return xrpcValidated("_account.getPasswordStatus", passwordStatusSchema, {
+      token,
+    });
   },
 
   changePassword(
     token: AccessToken,
     currentPassword: string,
-    newPassword: string
+    newPassword: string,
   ): Promise<Result<ValidatedSuccessResponse, ApiError | ValidationError>> {
-    return xrpcValidated('_account.changePassword', successResponseSchema, {
-      method: 'POST',
+    return xrpcValidated("_account.changePassword", successResponseSchema, {
+      method: "POST",
       token,
       body: { currentPassword, newPassword },
-    })
+    });
   },
 
   getLegacyLoginPreference(
-    token: AccessToken
-  ): Promise<Result<ValidatedLegacyLoginPreference, ApiError | ValidationError>> {
-    return xrpcValidated('_account.getLegacyLoginPreference', legacyLoginPreferenceSchema, { token })
+    token: AccessToken,
+  ): Promise<
+    Result<ValidatedLegacyLoginPreference, ApiError | ValidationError>
+  > {
+    return xrpcValidated(
+      "_account.getLegacyLoginPreference",
+      legacyLoginPreferenceSchema,
+      { token },
+    );
   },
 
   getAccountInfo(
     token: AccessToken,
-    did: Did
+    did: Did,
   ): Promise<Result<ValidatedAccountInfo, ApiError | ValidationError>> {
-    return xrpcValidated('com.atproto.admin.getAccountInfo', accountInfoSchema, {
-      token,
-      params: { did },
-    })
+    return xrpcValidated(
+      "com.atproto.admin.getAccountInfo",
+      accountInfoSchema,
+      {
+        token,
+        params: { did },
+      },
+    );
   },
 
   searchAccounts(
     token: AccessToken,
-    options?: { handle?: string; cursor?: string; limit?: number }
-  ): Promise<Result<ValidatedSearchAccountsResponse, ApiError | ValidationError>> {
-    const params: Record<string, string> = {}
-    if (options?.handle) params.handle = options.handle
-    if (options?.cursor) params.cursor = options.cursor
-    if (options?.limit) params.limit = String(options.limit)
-    return xrpcValidated('com.atproto.admin.searchAccounts', searchAccountsResponseSchema, {
-      token,
-      params,
-    })
+    options?: { handle?: string; cursor?: string; limit?: number },
+  ): Promise<
+    Result<ValidatedSearchAccountsResponse, ApiError | ValidationError>
+  > {
+    const params: Record<string, string> = {};
+    if (options?.handle) params.handle = options.handle;
+    if (options?.cursor) params.cursor = options.cursor;
+    if (options?.limit) params.limit = String(options.limit);
+    return xrpcValidated(
+      "com.atproto.admin.searchAccounts",
+      searchAccountsResponseSchema,
+      {
+        token,
+        params,
+      },
+    );
   },
 
-  listBackups(token: AccessToken): Promise<Result<ValidatedListBackupsResponse, ApiError | ValidationError>> {
-    return xrpcValidated('_backup.listBackups', listBackupsResponseSchema, { token })
+  listBackups(
+    token: AccessToken,
+  ): Promise<Result<ValidatedListBackupsResponse, ApiError | ValidationError>> {
+    return xrpcValidated("_backup.listBackups", listBackupsResponseSchema, {
+      token,
+    });
   },
 
-  createBackup(token: AccessToken): Promise<Result<ValidatedCreateBackupResponse, ApiError | ValidationError>> {
-    return xrpcValidated('_backup.createBackup', createBackupResponseSchema, {
-      method: 'POST',
+  createBackup(
+    token: AccessToken,
+  ): Promise<
+    Result<ValidatedCreateBackupResponse, ApiError | ValidationError>
+  > {
+    return xrpcValidated("_backup.createBackup", createBackupResponseSchema, {
+      method: "POST",
       token,
-    })
+    });
   },
-}
+};
 
-export { ValidationError }
+export { ValidationError };

frontend/src/lib/api.ts

···
-import { ok, err, type Result } from './types/result'
+import { err, ok, type Result } from "./types/result.ts";
 import type {
+  AccessToken,
   Did,
+  EmailAddress,
   Handle,
-  AccessToken,
+  Nsid,
   RefreshToken,
-  Cid,
   Rkey,
-  AtUri,
-  Nsid,
-  ISODateString,
-  EmailAddress,
-  InviteCode as InviteCodeBrand,
-} from './types/branded'
+} from "./types/branded.ts";
 import {
+  unsafeAsAccessToken,
   unsafeAsDid,
+  unsafeAsEmail,
   unsafeAsHandle,
-  unsafeAsAccessToken,
-  unsafeAsRefreshToken,
-  unsafeAsCid,
   unsafeAsISODate,
-  unsafeAsEmail,
-  unsafeAsInviteCode,
-} from './types/branded'
+  unsafeAsRefreshToken,
+} from "./types/branded.ts";
 import type {
-  Session,
-  DidDocument,
+  AccountInfo,
+  ApiErrorCode,
   AppPassword,
+  CompletePasskeySetupResponse,
+  ConfirmSignupResult,
+  CreateAccountParams,
+  CreateAccountResult,
+  CreateBackupResponse,
   CreatedAppPassword,
-  InviteCodeInfo,
-  ServerDescription,
-  NotificationPrefs,
-  NotificationHistoryResponse,
-  ServerStats,
-  ServerConfig,
-  UploadBlobResponse,
-  ListSessionsResponse,
-  SearchAccountsResponse,
-  GetInviteCodesResponse,
-  AccountInfo,
-  RepoDescription,
-  ListRecordsResponse,
-  RecordResponse,
   CreateRecordResponse,
-  TotpStatus,
-  TotpSecret,
+  DidDocument,
+  DidType,
+  EmailUpdateResponse,
   EnableTotpResponse,
-  RegenerateBackupCodesResponse,
-  ListPasskeysResponse,
-  StartPasskeyRegistrationResponse,
   FinishPasskeyRegistrationResponse,
+  GetInviteCodesResponse,
+  InviteCodeInfo,
+  LegacyLoginPreference,
+  ListBackupsResponse,
+  ListPasskeysResponse,
+  ListRecordsResponse,
+  ListReposResponse,
+  ListSessionsResponse,
   ListTrustedDevicesResponse,
+  NotificationHistoryResponse,
+  NotificationPrefs,
+  PasskeyAccountCreateResponse,
+  PasswordStatus,
+  ReauthPasskeyStartResponse,
+  ReauthResponse,
   ReauthStatus,
-  ReauthResponse,
-  ReauthPasskeyStartResponse,
+  RecommendedDidCredentials,
+  RecordResponse,
+  RegenerateBackupCodesResponse,
+  RepoDescription,
+  ResendMigrationVerificationResponse,
   ReserveSigningKeyResponse,
-  RecommendedDidCredentials,
-  PasskeyAccountCreateResponse,
-  CompletePasskeySetupResponse,
-  VerifyTokenResponse,
-  ListBackupsResponse,
-  CreateBackupResponse,
+  SearchAccountsResponse,
+  ServerConfig,
+  ServerDescription,
+  ServerStats,
+  Session,
   SetBackupEnabledResponse,
-  EmailUpdateResponse,
-  LegacyLoginPreference,
+  StartPasskeyRegistrationResponse,
+  SuccessResponse,
+  TotpSecret,
+  TotpStatus,
   UpdateLegacyLoginResponse,
   UpdateLocaleResponse,
-  PasswordStatus,
-  SuccessResponse,
-  CheckEmailVerifiedResponse,
-  VerifyMigrationEmailResponse,
-  ResendMigrationVerificationResponse,
-  ListReposResponse,
+  UploadBlobResponse,
   VerificationChannel,
-  DidType,
-  ApiErrorCode,
-  VerificationMethod as VerificationMethodType,
-  CreateAccountParams,
-  CreateAccountResult,
-  ConfirmSignupResult,
-} from './types/api'
+  VerifyMigrationEmailResponse,
+  VerifyTokenResponse,
+} from "./types/api.ts";
 
-const API_BASE = '/xrpc'
+const API_BASE = "/xrpc";
 
 export class ApiError extends Error {
-  public did?: Did
-  public reauthMethods?: string[]
+  public did?: Did;
+  public reauthMethods?: string[];
   constructor(
     public status: number,
     public error: ApiErrorCode,
···
     did?: string,
     reauthMethods?: string[],
   ) {
-    super(message)
-    this.name = 'ApiError'
-    this.did = did ? unsafeAsDid(did) : undefined
-    this.reauthMethods = reauthMethods
+    super(message);
+    this.name = "ApiError";
+    this.did = did ? unsafeAsDid(did) : undefined;
+    this.reauthMethods = reauthMethods;
   }
 }
 
-let tokenRefreshCallback: (() => Promise<string | null>) | null = null
+let tokenRefreshCallback: (() => Promise<string | null>) | null = null;
 
 export function setTokenRefreshCallback(
   callback: () => Promise<string | null>,
 ) {
-  tokenRefreshCallback = callback
+  tokenRefreshCallback = callback;
 }
 
 interface XrpcOptions {
-  method?: 'GET' | 'POST'
-  params?: Record<string, string>
-  body?: unknown
-  token?: string
-  skipRetry?: boolean
+  method?: "GET" | "POST";
+  params?: Record<string, string>;
+  body?: unknown;
+  token?: string;
+  skipRetry?: boolean;
 }
 
 async function xrpc<T>(method: string, options?: XrpcOptions): Promise<T> {
-  const { method: httpMethod = 'GET', params, body, token, skipRetry } =
-    options ?? {}
-  let url = `${API_BASE}/${method}`
+  const { method: httpMethod = "GET", params, body, token, skipRetry } =
+    options ?? {};
+  let url = `${API_BASE}/${method}`;
   if (params) {
-    const searchParams = new URLSearchParams(params)
-    url += `?${searchParams}`
+    const searchParams = new URLSearchParams(params);
+    url += `?${searchParams}`;
   }
-  const headers: Record<string, string> = {}
+  const headers: Record<string, string> = {};
   if (token) {
-    headers['Authorization'] = `Bearer ${token}`
+    headers["Authorization"] = `Bearer ${token}`;
   }
   if (body) {
-    headers['Content-Type'] = 'application/json'
+    headers["Content-Type"] = "application/json";
   }
   const res = await fetch(url, {
     method: httpMethod,
     headers,
     body: body ? JSON.stringify(body) : undefined,
-  })
+  });
   if (!res.ok) {
     const errData = await res.json().catch(() => ({
-      error: 'Unknown',
+      error: "Unknown",
       message: res.statusText,
-    }))
+    }));
     if (
       res.status === 401 &&
-      (errData.error === 'AuthenticationFailed' || errData.error === 'ExpiredToken') &&
+      (errData.error === "AuthenticationFailed" ||
+        errData.error === "ExpiredToken") &&
       token && tokenRefreshCallback && !skipRetry
     ) {
-      const newToken = await tokenRefreshCallback()
+      const newToken = await tokenRefreshCallback();
       if (newToken && newToken !== token) {
-        return xrpc(method, { ...options, token: newToken, skipRetry: true })
+        return xrpc(method, { ...options, token: newToken, skipRetry: true });
       }
     }
     throw new ApiError(
···
       errData.message,
       errData.did,
       errData.reauthMethods,
-    )
+    );
   }
-  return res.json()
+  return res.json();
 }
 
 async function xrpcResult<T>(
   method: string,
-  options?: XrpcOptions
+  options?: XrpcOptions,
 ): Promise<Result<T, ApiError>> {
   try {
-    const value = await xrpc<T>(method, options)
-    return ok(value)
+    const value = await xrpc<T>(method, options);
+    return ok(value);
   } catch (e) {
     if (e instanceof ApiError) {
-      return err(e)
+      return err(e);
     }
-    return err(new ApiError(0, 'Unknown', e instanceof Error ? e.message : String(e)))
+    return err(
+      new ApiError(0, "Unknown", e instanceof Error ? e.message : String(e)),
+    );
   }
 }
 
 export interface VerificationMethod {
-  id: string
-  type: string
-  publicKeyMultibase: string
+  id: string;
+  type: string;
+  publicKeyMultibase: string;
 }
 
-export type { Session, DidDocument, AppPassword, InviteCodeInfo as InviteCode }
-export type { VerificationChannel, DidType, CreateAccountParams, CreateAccountResult, ConfirmSignupResult }
+export type { AppPassword, DidDocument, InviteCodeInfo as InviteCode, Session };
+export type {
+  ConfirmSignupResult,
+  CreateAccountParams,
+  CreateAccountResult,
+  DidType,
+  VerificationChannel,
+};
 
 function castSession(raw: unknown): Session {
-  const s = raw as Record<string, unknown>
+  const s = raw as Record<string, unknown>;
   return {
     did: unsafeAsDid(s.did as string),
     handle: unsafeAsHandle(s.handle as string),
···
     preferredChannelVerified: s.preferredChannelVerified as boolean | undefined,
     isAdmin: s.isAdmin as boolean | undefined,
     active: s.active as boolean | undefined,
-    status: s.status as Session['status'],
+    status: s.status as Session["status"],
     migratedToPds: s.migratedToPds as string | undefined,
-    migratedAt: s.migratedAt ? unsafeAsISODate(s.migratedAt as string) : undefined,
+    migratedAt: s.migratedAt
+      ? unsafeAsISODate(s.migratedAt as string)
+      : undefined,
     accessJwt: unsafeAsAccessToken(s.accessJwt as string),
     refreshJwt: unsafeAsRefreshToken(s.refreshJwt as string),
-  }
+  };
 }
 
 export const api = {
···
     params: CreateAccountParams,
     byodToken?: string,
   ): Promise<CreateAccountResult> {
-    const url = `${API_BASE}/com.atproto.server.createAccount`
+    const url = `${API_BASE}/com.atproto.server.createAccount`;
     const headers: Record<string, string> = {
-      'Content-Type': 'application/json',
-    }
+      "Content-Type": "application/json",
+    };
     if (byodToken) {
-      headers['Authorization'] = `Bearer ${byodToken}`
+      headers["Authorization"] = `Bearer ${byodToken}`;
     }
     const response = await fetch(url, {
-      method: 'POST',
+      method: "POST",
       headers,
       body: JSON.stringify({
         handle: params.handle,
···
         telegramUsername: params.telegramUsername,
         signalNumber: params.signalNumber,
       }),
-    })
-    const data = await response.json()
+    });
+    const data = await response.json();
     if (!response.ok) {
-      throw new ApiError(response.status, data.error, data.message)
+      throw new ApiError(response.status, data.error, data.message);
     }
-    return data
+    return data;
   },
 
   async createAccountWithServiceAuth(
     serviceAuthToken: string,
     params: {
-      did: Did
-      handle: Handle
-      email: EmailAddress
-      password: string
-      inviteCode?: string
+      did: Did;
+      handle: Handle;
+      email: EmailAddress;
+      password: string;
+      inviteCode?: string;
     },
   ): Promise<Session> {
-    const url = `${API_BASE}/com.atproto.server.createAccount`
+    const url = `${API_BASE}/com.atproto.server.createAccount`;
     const response = await fetch(url, {
-      method: 'POST',
+      method: "POST",
       headers: {
-        'Content-Type': 'application/json',
-        'Authorization': `Bearer ${serviceAuthToken}`,
+        "Content-Type": "application/json",
+        "Authorization": `Bearer ${serviceAuthToken}`,
       },
       body: JSON.stringify({
         did: params.did,
···
         password: params.password,
         inviteCode: params.inviteCode,
       }),
-    })
-    const data = await response.json()
+    });
+    const data = await response.json();
     if (!response.ok) {
-      throw new ApiError(response.status, data.error, data.message)
+      throw new ApiError(response.status, data.error, data.message);
     }
-    return castSession(data)
+    return castSession(data);
   },
 
   confirmSignup(
     did: Did,
     verificationCode: string,
   ): Promise<ConfirmSignupResult> {
-    return xrpc('com.atproto.server.confirmSignup', {
-      method: 'POST',
+    return xrpc("com.atproto.server.confirmSignup", {
+      method: "POST",
       body: { did, verificationCode },
-    })
+    });
   },
 
   resendVerification(did: Did): Promise<{ success: boolean }> {
-    return xrpc('com.atproto.server.resendVerification', {
-      method: 'POST',
+    return xrpc("com.atproto.server.resendVerification", {
+      method: "POST",
       body: { did },
-    })
+    });
   },
 
   async createSession(identifier: string, password: string): Promise<Session> {
-    const raw = await xrpc<unknown>('com.atproto.server.createSession', {
-      method: 'POST',
+    const raw = await xrpc<unknown>("com.atproto.server.createSession", {
+      method: "POST",
       body: { identifier, password },
-    })
-    return castSession(raw)
+    });
+    return castSession(raw);
   },
 
   checkEmailVerified(identifier: string): Promise<{ verified: boolean }> {
-    return xrpc('_checkEmailVerified', {
-      method: 'POST',
+    return xrpc("_checkEmailVerified", {
+      method: "POST",
       body: { identifier },
-    })
+    });
   },
 
   async getSession(token: AccessToken): Promise<Session> {
-    const raw = await xrpc<unknown>('com.atproto.server.getSession', { token })
-    return castSession(raw)
+    const raw = await xrpc<unknown>("com.atproto.server.getSession", { token });
+    return castSession(raw);
   },
 
   async refreshSession(refreshJwt: RefreshToken): Promise<Session> {
-    const raw = await xrpc<unknown>('com.atproto.server.refreshSession', {
-      method: 'POST',
+    const raw = await xrpc<unknown>("com.atproto.server.refreshSession", {
+      method: "POST",
       token: refreshJwt,
-    })
-    return castSession(raw)
+    });
+    return castSession(raw);
   },
 
   async deleteSession(token: AccessToken): Promise<void> {
-    await xrpc('com.atproto.server.deleteSession', {
-      method: 'POST',
+    await xrpc("com.atproto.server.deleteSession", {
+      method: "POST",
       token,
-    })
+    });
   },
 
   listAppPasswords(token: AccessToken): Promise<{ passwords: AppPassword[] }> {
-    return xrpc('com.atproto.server.listAppPasswords', { token })
+    return xrpc("com.atproto.server.listAppPasswords", { token });
   },
 
   createAppPassword(
···
     name: string,
     scopes?: string,
   ): Promise<CreatedAppPassword> {
-    return xrpc('com.atproto.server.createAppPassword', {
-      method: 'POST',
+    return xrpc("com.atproto.server.createAppPassword", {
+      method: "POST",
       token,
       body: { name, scopes },
-    })
+    });
   },
 
   async revokeAppPassword(token: AccessToken, name: string): Promise<void> {
-    await xrpc('com.atproto.server.revokeAppPassword', {
-      method: 'POST',
+    await xrpc("com.atproto.server.revokeAppPassword", {
+      method: "POST",
       token,
       body: { name },
-    })
+    });
   },
 
-  getAccountInviteCodes(token: AccessToken): Promise<{ codes: InviteCodeInfo[] }> {
-    return xrpc('com.atproto.server.getAccountInviteCodes', { token })
+  getAccountInviteCodes(
+    token: AccessToken,
+  ): Promise<{ codes: InviteCodeInfo[] }> {
+    return xrpc("com.atproto.server.getAccountInviteCodes", { token });
   },
 
   createInviteCode(
     token: AccessToken,
     useCount: number = 1,
   ): Promise<{ code: string }> {
-    return xrpc('com.atproto.server.createInviteCode', {
-      method: 'POST',
+    return xrpc("com.atproto.server.createInviteCode", {
+      method: "POST",
       token,
       body: { useCount },
-    })
+    });
   },
 
   async requestPasswordReset(email: EmailAddress): Promise<void> {
-    await xrpc('com.atproto.server.requestPasswordReset', {
-      method: 'POST',
+    await xrpc("com.atproto.server.requestPasswordReset", {
+      method: "POST",
       body: { email },
-    })
+    });
   },
 
   async resetPassword(token: string, password: string): Promise<void> {
-    await xrpc('com.atproto.server.resetPassword', {
-      method: 'POST',
+    await xrpc("com.atproto.server.resetPassword", {
+      method: "POST",
       body: { token, password },
-    })
+    });
   },
 
   requestEmailUpdate(token: AccessToken): Promise<EmailUpdateResponse> {
-    return xrpc('com.atproto.server.requestEmailUpdate', {
-      method: 'POST',
+    return xrpc("com.atproto.server.requestEmailUpdate", {
+      method: "POST",
       token,
-    })
+    });
   },
 
   async updateEmail(
···
     email: string,
     emailToken?: string,
   ): Promise<void> {
-    await xrpc('com.atproto.server.updateEmail', {
-      method: 'POST',
+    await xrpc("com.atproto.server.updateEmail", {
+      method: "POST",
       token,
       body: { email, token: emailToken },
-    })
+    });
   },
 
   async updateHandle(token: AccessToken, handle: Handle): Promise<void> {
-    await xrpc('com.atproto.identity.updateHandle', {
-      method: 'POST',
+    await xrpc("com.atproto.identity.updateHandle", {
+      method: "POST",
       token,
       body: { handle },
-    })
+    });
   },
 
   async requestAccountDelete(token: AccessToken): Promise<void> {
-    await xrpc('com.atproto.server.requestAccountDelete', {
-      method: 'POST',
+    await xrpc("com.atproto.server.requestAccountDelete", {
+      method: "POST",
       token,
-    })
+    });
   },
 
   async deleteAccount(
···
     password: string,
     deleteToken: string,
   ): Promise<void> {
-    await xrpc('com.atproto.server.deleteAccount', {
-      method: 'POST',
+    await xrpc("com.atproto.server.deleteAccount", {
+      method: "POST",
       body: { did, password, token: deleteToken },
-    })
+    });
   },
 
   describeServer(): Promise<ServerDescription> {
-    return xrpc('com.atproto.server.describeServer')
+    return xrpc("com.atproto.server.describeServer");
   },
 
   listRepos(limit?: number): Promise<ListReposResponse> {
-    const params: Record<string, string> = {}
-    if (limit) params.limit = String(limit)
-    return xrpc('com.atproto.sync.listRepos', { params })
+    const params: Record<string, string> = {};
+    if (limit) params.limit = String(limit);
+    return xrpc("com.atproto.sync.listRepos", { params });
   },
 
   getNotificationPrefs(token: AccessToken): Promise<NotificationPrefs> {
-    return xrpc('_account.getNotificationPrefs', { token })
+    return xrpc("_account.getNotificationPrefs", { token });
   },
 
   updateNotificationPrefs(token: AccessToken, prefs: {
-    preferredChannel?: string
-    discordId?: string
-    telegramUsername?: string
-    signalNumber?: string
+    preferredChannel?: string;
+    discordId?: string;
+    telegramUsername?: string;
+    signalNumber?: string;
   }): Promise<SuccessResponse> {
-    return xrpc('_account.updateNotificationPrefs', {
-      method: 'POST',
+    return xrpc("_account.updateNotificationPrefs", {
+      method: "POST",
       token,
       body: prefs,
-    })
+    });
   },
 
   confirmChannelVerification(
···
     identifier: string,
     code: string,
   ): Promise<SuccessResponse> {
-    return xrpc('_account.confirmChannelVerification', {
-      method: 'POST',
+    return xrpc("_account.confirmChannelVerification", {
+      method: "POST",
       token,
       body: { channel, identifier, code },
-    })
+    });
   },
 
-  getNotificationHistory(token: AccessToken): Promise<NotificationHistoryResponse> {
-    return xrpc('_account.getNotificationHistory', { token })
+  getNotificationHistory(
+    token: AccessToken,
+  ): Promise<NotificationHistoryResponse> {
+    return xrpc("_account.getNotificationHistory", { token });
   },
 
   getServerStats(token: AccessToken): Promise<ServerStats> {
-    return xrpc('_admin.getServerStats', { token })
+    return xrpc("_admin.getServerStats", { token });
   },
 
   getServerConfig(): Promise<ServerConfig> {
-    return xrpc('_server.getConfig')
+    return xrpc("_server.getConfig");
   },
 
   updateServerConfig(
     token: AccessToken,
     config: {
-      serverName?: string
-      primaryColor?: string
-      primaryColorDark?: string
-      secondaryColor?: string
-      secondaryColorDark?: string
-      logoCid?: string
+      serverName?: string;
+      primaryColor?: string;
+      primaryColorDark?: string;
+      secondaryColor?: string;
+      secondaryColorDark?: string;
+      logoCid?: string;
     },
   ): Promise<SuccessResponse> {
-    return xrpc('_admin.updateServerConfig', {
-      method: 'POST',
+    return xrpc("_admin.updateServerConfig", {
+      method: "POST",
       token,
       body: config,
-    })
+    });
   },
 
-  async uploadBlob(token: AccessToken, file: File): Promise<UploadBlobResponse> {
-    const res = await fetch('/xrpc/com.atproto.repo.uploadBlob', {
-      method: 'POST',
+  async uploadBlob(
+    token: AccessToken,
+    file: File,
+  ): Promise<UploadBlobResponse> {
+    const res = await fetch("/xrpc/com.atproto.repo.uploadBlob", {
+      method: "POST",
       headers: {
-        'Authorization': `Bearer ${token}`,
-        'Content-Type': file.type,
+        "Authorization": `Bearer ${token}`,
+        "Content-Type": file.type,
       },
       body: file,
-    })
+    });
     if (!res.ok) {
       const errData = await res.json().catch(() => ({
-        error: 'Unknown',
+        error: "Unknown",
         message: res.statusText,
-      }))
-      throw new ApiError(res.status, errData.error, errData.message)
+      }));
+      throw new ApiError(res.status, errData.error, errData.message);
     }
-    return res.json()
+    return res.json();
   },
 
   async changePassword(
···
     currentPassword: string,
     newPassword: string,
   ): Promise<void> {
-    await xrpc('_account.changePassword', {
-      method: 'POST',
+    await xrpc("_account.changePassword", {
+      method: "POST",
       token,
       body: { currentPassword, newPassword },
-    })
+    });
   },
 
   removePassword(token: AccessToken): Promise<SuccessResponse> {
-    return xrpc('_account.removePassword', {
-      method: 'POST',
+    return xrpc("_account.removePassword", {
+      method: "POST",
       token,
-    })
+    });
   },
 
   getPasswordStatus(token: AccessToken): Promise<PasswordStatus> {
-    return xrpc('_account.getPasswordStatus', { token })
+    return xrpc("_account.getPasswordStatus", { token });
   },
 
   getLegacyLoginPreference(token: AccessToken): Promise<LegacyLoginPreference> {
-    return xrpc('_account.getLegacyLoginPreference', { token })
+    return xrpc("_account.getLegacyLoginPreference", { token });
   },
 
   updateLegacyLoginPreference(
     token: AccessToken,
     allowLegacyLogin: boolean,
   ): Promise<UpdateLegacyLoginResponse> {
-    return xrpc('_account.updateLegacyLoginPreference', {
-      method: 'POST',
+    return xrpc("_account.updateLegacyLoginPreference", {
+      method: "POST",
       token,
       body: { allowLegacyLogin },
-    })
+    });
   },
 
-  updateLocale(token: AccessToken, preferredLocale: string): Promise<UpdateLocaleResponse> {
-    return xrpc('_account.updateLocale', {
-      method: 'POST',
+  updateLocale(
+    token: AccessToken,
+    preferredLocale: string,
+  ): Promise<UpdateLocaleResponse> {
+    return xrpc("_account.updateLocale", {
+      method: "POST",
       token,
       body: { preferredLocale },
-    })
+    });
   },
 
   listSessions(token: AccessToken): Promise<ListSessionsResponse> {
-    return xrpc('_account.listSessions', { token })
+    return xrpc("_account.listSessions", { token });
   },
 
   async revokeSession(token: AccessToken, sessionId: string): Promise<void> {
-    await xrpc('_account.revokeSession', {
-      method: 'POST',
+    await xrpc("_account.revokeSession", {
+      method: "POST",
       token,
       body: { sessionId },
-    })
+    });
   },
 
   revokeAllSessions(token: AccessToken): Promise<{ revokedCount: number }> {
-    return xrpc('_account.revokeAllSessions', {
-      method: 'POST',
+    return xrpc("_account.revokeAllSessions", {
+      method: "POST",
       token,
-    })
+    });
   },
 
   searchAccounts(token: AccessToken, options?: {
-    handle?: string
-    cursor?: string
-    limit?: number
+    handle?: string;
+    cursor?: string;
+    limit?: number;
   }): Promise<SearchAccountsResponse> {
-    const params: Record<string, string> = {}
-    if (options?.handle) params.handle = options.handle
-    if (options?.cursor) params.cursor = options.cursor
-    if (options?.limit) params.limit = String(options.limit)
-    return xrpc('com.atproto.admin.searchAccounts', { token, params })
+    const params: Record<string, string> = {};
+    if (options?.handle) params.handle = options.handle;
+    if (options?.cursor) params.cursor = options.cursor;
+    if (options?.limit) params.limit = String(options.limit);
+    return xrpc("com.atproto.admin.searchAccounts", { token, params });
   },
 
   getInviteCodes(token: AccessToken, options?: {
-    sort?: 'recent' | 'usage'
-    cursor?: string
-    limit?: number
+    sort?: "recent" | "usage";
+    cursor?: string;
+    limit?: number;
   }): Promise<GetInviteCodesResponse> {
-    const params: Record<string, string> = {}
-    if (options?.sort) params.sort = options.sort
-    if (options?.cursor) params.cursor = options.cursor
-    if (options?.limit) params.limit = String(options.limit)
-    return xrpc('com.atproto.admin.getInviteCodes', { token, params })
+    const params: Record<string, string> = {};
+    if (options?.sort) params.sort = options.sort;
+    if (options?.cursor) params.cursor = options.cursor;
+    if (options?.limit) params.limit = String(options.limit);
+    return xrpc("com.atproto.admin.getInviteCodes", { token, params });
   },
 
   async disableInviteCodes(
···
     codes?: string[],
     accounts?: string[],
   ): Promise<void> {
-    await xrpc('com.atproto.admin.disableInviteCodes', {
-      method: 'POST',
+    await xrpc("com.atproto.admin.disableInviteCodes", {
+      method: "POST",
       token,
       body: { codes, accounts },
-    })
+    });
   },
 
   getAccountInfo(token: AccessToken, did: Did): Promise<AccountInfo> {
-    return xrpc('com.atproto.admin.getAccountInfo', { token, params: { did } })
+    return xrpc("com.atproto.admin.getAccountInfo", { token, params: { did } });
   },
 
   async disableAccountInvites(token: AccessToken, account: Did): Promise<void> {
-    await xrpc('com.atproto.admin.disableAccountInvites', {
-      method: 'POST',
+    await xrpc("com.atproto.admin.disableAccountInvites", {
+      method: "POST",
       token,
       body: { account },
-    })
+    });
   },
 
   async enableAccountInvites(token: AccessToken, account: Did): Promise<void> {
-    await xrpc('com.atproto.admin.enableAccountInvites', {
-      method: 'POST',
+    await xrpc("com.atproto.admin.enableAccountInvites", {
+      method: "POST",
       token,
       body: { account },
-    })
+    });
   },
 
   async adminDeleteAccount(token: AccessToken, did: Did): Promise<void> {
-    await xrpc('com.atproto.admin.deleteAccount', {
-      method: 'POST',
+    await xrpc("com.atproto.admin.deleteAccount", {
+      method: "POST",
       token,
       body: { did },
-    })
+    });
   },
 
   describeRepo(token: AccessToken, repo: Did): Promise<RepoDescription> {
-    return xrpc('com.atproto.repo.describeRepo', {
+    return xrpc("com.atproto.repo.describeRepo", {
       token,
       params: { repo },
-    })
+    });
   },
 
   listRecords(token: AccessToken, repo: Did, collection: Nsid, options?: {
-    limit?: number
-    cursor?: string
-    reverse?: boolean
+    limit?: number;
+    cursor?: string;
+    reverse?: boolean;
   }): Promise<ListRecordsResponse> {
-    const params: Record<string, string> = { repo, collection }
-    if (options?.limit) params.limit = String(options.limit)
-    if (options?.cursor) params.cursor = options.cursor
-    if (options?.reverse) params.reverse = 'true'
-    return xrpc('com.atproto.repo.listRecords', { token, params })
+    const params: Record<string, string> = { repo, collection };
+    if (options?.limit) params.limit = String(options.limit);
+    if (options?.cursor) params.cursor = options.cursor;
+    if (options?.reverse) params.reverse = "true";
+    return xrpc("com.atproto.repo.listRecords", { token, params });
   },
 
   getRecord(
···
     collection: Nsid,
     rkey: Rkey,
   ): Promise<RecordResponse> {
-    return xrpc('com.atproto.repo.getRecord', {
+    return xrpc("com.atproto.repo.getRecord", {
       token,
       params: { repo, collection, rkey },
-    })
+    });
   },
 
   createRecord(
···
     record: unknown,
     rkey?: Rkey,
   ): Promise<CreateRecordResponse> {
-    return xrpc('com.atproto.repo.createRecord', {
-      method: 'POST',
+    return xrpc("com.atproto.repo.createRecord", {
+      method: "POST",
       token,
       body: { repo, collection, record, rkey },
-    })
+    });
   },
 
   putRecord(
···
     rkey: Rkey,
     record: unknown,
   ): Promise<CreateRecordResponse> {
-    return xrpc('com.atproto.repo.putRecord', {
-      method: 'POST',
+    return xrpc("com.atproto.repo.putRecord", {
+      method: "POST",
       token,
       body: { repo, collection, rkey, record },
-    })
+    });
   },
 
   async deleteRecord(
···
     collection: Nsid,
     rkey: Rkey,
   ): Promise<void> {
-    await xrpc('com.atproto.repo.deleteRecord', {
-      method: 'POST',
+    await xrpc("com.atproto.repo.deleteRecord", {
+      method: "POST",
       token,
       body: { repo, collection, rkey },
-    })
+    });
   },
 
   getTotpStatus(token: AccessToken): Promise<TotpStatus> {
-    return xrpc('com.atproto.server.getTotpStatus', { token })
+    return xrpc("com.atproto.server.getTotpStatus", { token });
   },
 
   createTotpSecret(token: AccessToken): Promise<TotpSecret> {
-    return xrpc('com.atproto.server.createTotpSecret', {
-      method: 'POST',
+    return xrpc("com.atproto.server.createTotpSecret", {
+      method: "POST",
       token,
-    })
+    });
   },
 
   enableTotp(token: AccessToken, code: string): Promise<EnableTotpResponse> {
-    return xrpc('com.atproto.server.enableTotp', {
-      method: 'POST',
+    return xrpc("com.atproto.server.enableTotp", {
+      method: "POST",
       token,
       body: { code },
-    })
+    });
   },
 
   disableTotp(
···
     password: string,
     code: string,
   ): Promise<SuccessResponse> {
-    return xrpc('com.atproto.server.disableTotp', {
-      method: 'POST',
+    return xrpc("com.atproto.server.disableTotp", {
+      method: "POST",
       token,
       body: { password, code },
-    })
+    });
   },
 
   regenerateBackupCodes(
···
     password: string,
     code: string,
   ): Promise<RegenerateBackupCodesResponse> {
-    return xrpc('com.atproto.server.regenerateBackupCodes', {
-      method: 'POST',
+    return xrpc("com.atproto.server.regenerateBackupCodes", {
+      method: "POST",
       token,
       body: { password, code },
-    })
+    });
   },
 
   startPasskeyRegistration(
     token: AccessToken,
     friendlyName?: string,
   ): Promise<StartPasskeyRegistrationResponse> {
-    return xrpc('com.atproto.server.startPasskeyRegistration', {
-      method: 'POST',
+    return xrpc("com.atproto.server.startPasskeyRegistration", {
+      method: "POST",
       token,
       body: { friendlyName },
-    })
+    });
   },
 
   finishPasskeyRegistration(
···
     credential: unknown,
     friendlyName?: string,
   ): Promise<FinishPasskeyRegistrationResponse> {
-    return xrpc('com.atproto.server.finishPasskeyRegistration', {
-      method: 'POST',
+    return xrpc("com.atproto.server.finishPasskeyRegistration", {
+      method: "POST",
       token,
       body: { credential, friendlyName },
-    })
+    });
   },
 
   listPasskeys(token: AccessToken): Promise<ListPasskeysResponse> {
-    return xrpc('com.atproto.server.listPasskeys', { token })
+    return xrpc("com.atproto.server.listPasskeys", { token });
   },
 
   async deletePasskey(token: AccessToken, id: string): Promise<void> {
-    await xrpc('com.atproto.server.deletePasskey', {
-      method: 'POST',
+    await xrpc("com.atproto.server.deletePasskey", {
+      method: "POST",
       token,
       body: { id },
-    })
+    });
   },
 
   async updatePasskey(
···
     id: string,
     friendlyName: string,
   ): Promise<void> {
-    await xrpc('com.atproto.server.updatePasskey', {
-      method: 'POST',
+    await xrpc("com.atproto.server.updatePasskey", {
+      method: "POST",
       token,
       body: { id, friendlyName },
-    })
+    });
   },
 
   listTrustedDevices(token: AccessToken): Promise<ListTrustedDevicesResponse> {
-    return xrpc('_account.listTrustedDevices', { token })
+    return xrpc("_account.listTrustedDevices", { token });
   },
 
-  revokeTrustedDevice(token: AccessToken, deviceId: string): Promise<SuccessResponse> {
-    return xrpc('_account.revokeTrustedDevice', {
-      method: 'POST',
+  revokeTrustedDevice(
+    token: AccessToken,
+    deviceId: string,
+  ): Promise<SuccessResponse> {
+    return xrpc("_account.revokeTrustedDevice", {
+      method: "POST",
       token,
       body: { deviceId },
-    })
+    });
   },
 
   updateTrustedDevice(
···
     deviceId: string,
     friendlyName: string,
   ): Promise<SuccessResponse> {
-    return xrpc('_account.updateTrustedDevice', {
-      method: 'POST',
+    return xrpc("_account.updateTrustedDevice", {
+      method: "POST",
       token,
       body: { deviceId, friendlyName },
-    })
+    });
   },
 
   getReauthStatus(token: AccessToken): Promise<ReauthStatus> {
-    return xrpc('_account.getReauthStatus', { token })
+    return xrpc("_account.getReauthStatus", { token });
   },
 
-  reauthPassword(token: AccessToken, password: string): Promise<ReauthResponse> {
-    return xrpc('_account.reauthPassword', {
-      method: 'POST',
+  reauthPassword(
+    token: AccessToken,
+    password: string,
+  ): Promise<ReauthResponse> {
+    return xrpc("_account.reauthPassword", {
+      method: "POST",
       token,
       body: { password },
-    })
+    });
   },
 
   reauthTotp(token: AccessToken, code: string): Promise<ReauthResponse> {
-    return xrpc('_account.reauthTotp', {
-      method: 'POST',
+    return xrpc("_account.reauthTotp", {
+      method: "POST",
       token,
       body: { code },
-    })
+    });
   },
 
   reauthPasskeyStart(token: AccessToken): Promise<ReauthPasskeyStartResponse> {
-    return xrpc('_account.reauthPasskeyStart', {
-      method: 'POST',
+    return xrpc("_account.reauthPasskeyStart", {
+      method: "POST",
       token,
-    })
+    });
   },
 
-  reauthPasskeyFinish(token: AccessToken, credential: unknown): Promise<ReauthResponse> {
-    return xrpc('_account.reauthPasskeyFinish', {
-      method: 'POST',
+  reauthPasskeyFinish(
+    token: AccessToken,
+    credential: unknown,
+  ): Promise<ReauthResponse> {
+    return xrpc("_account.reauthPasskeyFinish", {
+      method: "POST",
       token,
       body: { credential },
-    })
+    });
   },
 
   reserveSigningKey(did?: Did): Promise<ReserveSigningKeyResponse> {
-    return xrpc('com.atproto.server.reserveSigningKey', {
-      method: 'POST',
+    return xrpc("com.atproto.server.reserveSigningKey", {
+      method: "POST",
       body: { did },
-    })
+    });
   },
 
-  getRecommendedDidCredentials(token: AccessToken): Promise<RecommendedDidCredentials> {
-    return xrpc('com.atproto.identity.getRecommendedDidCredentials', { token })
+  getRecommendedDidCredentials(
+    token: AccessToken,
+  ): Promise<RecommendedDidCredentials> {
+    return xrpc("com.atproto.identity.getRecommendedDidCredentials", { token });
   },
 
   async activateAccount(token: AccessToken): Promise<void> {
-    await xrpc('com.atproto.server.activateAccount', {
-      method: 'POST',
+    await xrpc("com.atproto.server.activateAccount", {
+      method: "POST",
       token,
-    })
+    });
   },
 
   async createPasskeyAccount(params: {
-    handle: Handle
-    email?: EmailAddress
-    inviteCode?: string
-    didType?: DidType
-    did?: Did
-    signingKey?: string
-    verificationChannel?: VerificationChannel
-    discordId?: string
-    telegramUsername?: string
-    signalNumber?: string
+    handle: Handle;
+    email?: EmailAddress;
+    inviteCode?: string;
+    didType?: DidType;
+    did?: Did;
+    signingKey?: string;
+    verificationChannel?: VerificationChannel;
+    discordId?: string;
+    telegramUsername?: string;
+    signalNumber?: string;
   }, byodToken?: string): Promise<PasskeyAccountCreateResponse> {
-    const url = `${API_BASE}/_account.createPasskeyAccount`
+    const url = `${API_BASE}/_account.createPasskeyAccount`;
     const headers: Record<string, string> = {
-      'Content-Type': 'application/json',
-    }
+      "Content-Type": "application/json",
+    };
     if (byodToken) {
-      headers['Authorization'] = `Bearer ${byodToken}`
+      headers["Authorization"] = `Bearer ${byodToken}`;
     }
     const res = await fetch(url, {
-      method: 'POST',
+      method: "POST",
       headers,
       body: JSON.stringify(params),
-    })
+    });
     if (!res.ok) {
       const errData = await res.json().catch(() => ({
-        error: 'Unknown',
+        error: "Unknown",
         message: res.statusText,
-      }))
-      throw new ApiError(res.status, errData.error, errData.message)
+      }));
+      throw new ApiError(res.status, errData.error, errData.message);
     }
-    return res.json()
+    return res.json();
   },
 
   startPasskeyRegistrationForSetup(
···
     setupToken: string,
     friendlyName?: string,
   ): Promise<StartPasskeyRegistrationResponse> {
-    return xrpc('_account.startPasskeyRegistrationForSetup', {
-      method: 'POST',
+    return xrpc("_account.startPasskeyRegistrationForSetup", {
+      method: "POST",
       body: { did, setupToken, friendlyName },
-    })
+    });
   },
 
   completePasskeySetup(
···
     passkeyCredential: unknown,
     passkeyFriendlyName?: string,
   ): Promise<CompletePasskeySetupResponse> {
-    return xrpc('_account.completePasskeySetup', {
-      method: 'POST',
+    return xrpc("_account.completePasskeySetup", {
+      method: "POST",
       body: { did, setupToken, passkeyCredential, passkeyFriendlyName },
-    })
+    });
   },
 
   requestPasskeyRecovery(email: EmailAddress): Promise<SuccessResponse> {
-    return xrpc('_account.requestPasskeyRecovery', {
-      method: 'POST',
+    return xrpc("_account.requestPasskeyRecovery", {
+      method: "POST",
       body: { email },
-    })
+    });
   },
 
   recoverPasskeyAccount(
···
     recoveryToken: string,
     newPassword: string,
   ): Promise<SuccessResponse> {
-    return xrpc('_account.recoverPasskeyAccount', {
-      method: 'POST',
+    return xrpc("_account.recoverPasskeyAccount", {
+      method: "POST",
       body: { did, recoveryToken, newPassword },
-    })
+    });
   },
 
-  verifyMigrationEmail(token: string, email: EmailAddress): Promise<VerifyMigrationEmailResponse> {
-    return xrpc('com.atproto.server.verifyMigrationEmail', {
-      method: 'POST',
+  verifyMigrationEmail(
+    token: string,
+    email: EmailAddress,
+  ): Promise<VerifyMigrationEmailResponse> {
+    return xrpc("com.atproto.server.verifyMigrationEmail", {
+      method: "POST",
       body: { token, email },
-    })
+    });
   },
 
-  resendMigrationVerification(email: EmailAddress): Promise<ResendMigrationVerificationResponse> {
-    return xrpc('com.atproto.server.resendMigrationVerification', {
-      method: 'POST',
+  resendMigrationVerification(
+    email: EmailAddress,
+  ): Promise<ResendMigrationVerificationResponse> {
+    return xrpc("com.atproto.server.resendMigrationVerification", {
+      method: "POST",
       body: { email },
-    })
+    });
   },
 
   verifyToken(
···
     identifier: string,
     accessToken?: AccessToken,
   ): Promise<VerifyTokenResponse> {
-    return xrpc('_account.verifyToken', {
-      method: 'POST',
+    return xrpc("_account.verifyToken", {
+      method: "POST",
       body: { token, identifier },
       token: accessToken,
-    })
+    });
   },
 
   getDidDocument(token: AccessToken): Promise<DidDocument> {
-    return xrpc('_account.getDidDocument', { token })
+    return xrpc("_account.getDidDocument", { token });
   },
 
   updateDidDocument(
     token: AccessToken,
     params: {
-      verificationMethods?: VerificationMethod[]
-      alsoKnownAs?: string[]
-      serviceEndpoint?: string
+      verificationMethods?: VerificationMethod[];
+      alsoKnownAs?: string[];
+      serviceEndpoint?: string;
     },
   ): Promise<SuccessResponse> {
-    return xrpc('_account.updateDidDocument', {
-      method: 'POST',
+    return xrpc("_account.updateDidDocument", {
+      method: "POST",
       token,
       body: params,
-    })
+    });
   },
 
-  async deactivateAccount(token: AccessToken, deleteAfter?: string): Promise<void> {
-    await xrpc('com.atproto.server.deactivateAccount', {
-      method: 'POST',
+  async deactivateAccount(
+    token: AccessToken,
+    deleteAfter?: string,
+  ): Promise<void> {
+    await xrpc("com.atproto.server.deactivateAccount", {
+      method: "POST",
       token,
       body: { deleteAfter },
-    })
+    });
   },
 
   async getRepo(token: AccessToken, did: Did): Promise<ArrayBuffer> {
-    const url = `${API_BASE}/com.atproto.sync.getRepo?did=${encodeURIComponent(did)}`
+    const url = `${API_BASE}/com.atproto.sync.getRepo?did=${
+      encodeURIComponent(did)
+    }`;
     const res = await fetch(url, {
       headers: { Authorization: `Bearer ${token}` },
-    })
+    });
     if (!res.ok) {
       const errData = await res.json().catch(() => ({
-        error: 'Unknown',
+        error: "Unknown",
         message: res.statusText,
-      }))
-      throw new ApiError(res.status, errData.error, errData.message)
+      }));
+      throw new ApiError(res.status, errData.error, errData.message);
     }
-    return res.arrayBuffer()
+    return res.arrayBuffer();
   },
 
   listBackups(token: AccessToken): Promise<ListBackupsResponse> {
-    return xrpc('_backup.listBackups', { token })
+    return xrpc("_backup.listBackups", { token });
   },
 
   async getBackup(token: AccessToken, id: string): Promise<Blob> {
-    const url = `${API_BASE}/_backup.getBackup?id=${encodeURIComponent(id)}`
+    const url = `${API_BASE}/_backup.getBackup?id=${encodeURIComponent(id)}`;
     const res = await fetch(url, {
       headers: { Authorization: `Bearer ${token}` },
-    })
+    });
     if (!res.ok) {
       const errData = await res.json().catch(() => ({
-        error: 'Unknown',
+        error: "Unknown",
         message: res.statusText,
-      }))
-      throw new ApiError(res.status, errData.error, errData.message)
+      }));
+      throw new ApiError(res.status, errData.error, errData.message);
     }
-    return res.blob()
+    return res.blob();
   },
 
   createBackup(token: AccessToken): Promise<CreateBackupResponse> {
-    return xrpc('_backup.createBackup', {
-      method: 'POST',
+    return xrpc("_backup.createBackup", {
+      method: "POST",
       token,
-    })
+    });
   },
 
   async deleteBackup(token: AccessToken, id: string): Promise<void> {
-    await xrpc('_backup.deleteBackup', {
-      method: 'POST',
+    await xrpc("_backup.deleteBackup", {
+      method: "POST",
       token,
       params: { id },
-    })
+    });
   },
 
-  setBackupEnabled(token: AccessToken, enabled: boolean): Promise<SetBackupEnabledResponse> {
-    return xrpc('_backup.setEnabled', {
-      method: 'POST',
+  setBackupEnabled(
+    token: AccessToken,
+    enabled: boolean,
+  ): Promise<SetBackupEnabledResponse> {
+    return xrpc("_backup.setEnabled", {
+      method: "POST",
       token,
       body: { enabled },
-    })
+    });
   },
 
   async importRepo(token: AccessToken, car: Uint8Array): Promise<void> {
-    const url = `${API_BASE}/com.atproto.repo.importRepo`
+    const url = `${API_BASE}/com.atproto.repo.importRepo`;
     const res = await fetch(url, {
-      method: 'POST',
+      method: "POST",
       headers: {
         Authorization: `Bearer ${token}`,
-        'Content-Type': 'application/vnd.ipld.car',
+        "Content-Type": "application/vnd.ipld.car",
       },
-      body: car,
-    })
+      body: car as unknown as BodyInit,
+    });
     if (!res.ok) {
       const errData = await res.json().catch(() => ({
-        error: 'Unknown',
+        error: "Unknown",
         message: res.statusText,
-      }))
-      throw new ApiError(res.status, errData.error, errData.message)
+      }));
+      throw new ApiError(res.status, errData.error, errData.message);
     }
   },
-}
+};
 
 export const typedApi = {
   createSession(
     identifier: string,
-    password: string
+    password: string,
   ): Promise<Result<Session, ApiError>> {
-    return xrpcResult<Session>('com.atproto.server.createSession', {
-      method: 'POST',
+    return xrpcResult<Session>("com.atproto.server.createSession", {
+      method: "POST",
       body: { identifier, password },
-    }).then(r => r.ok ? ok(castSession(r.value)) : r)
+    }).then((r) => r.ok ? ok(castSession(r.value)) : r);
   },
 
   getSession(token: AccessToken): Promise<Result<Session, ApiError>> {
-    return xrpcResult<Session>('com.atproto.server.getSession', { token })
-      .then(r => r.ok ? ok(castSession(r.value)) : r)
+    return xrpcResult<Session>("com.atproto.server.getSession", { token })
+      .then((r) => r.ok ? ok(castSession(r.value)) : r);
   },
 
   refreshSession(refreshJwt: RefreshToken): Promise<Result<Session, ApiError>> {
-    return xrpcResult<Session>('com.atproto.server.refreshSession', {
-      method: 'POST',
+    return xrpcResult<Session>("com.atproto.server.refreshSession", {
+      method: "POST",
       token: refreshJwt,
-    }).then(r => r.ok ? ok(castSession(r.value)) : r)
+    }).then((r) => r.ok ? ok(castSession(r.value)) : r);
   },
 
   describeServer(): Promise<Result<ServerDescription, ApiError>> {
-    return xrpcResult('com.atproto.server.describeServer')
+    return xrpcResult("com.atproto.server.describeServer");
   },
 
-  listAppPasswords(token: AccessToken): Promise<Result<{ passwords: AppPassword[] }, ApiError>> {
-    return xrpcResult('com.atproto.server.listAppPasswords', { token })
+  listAppPasswords(
+    token: AccessToken,
+  ): Promise<Result<{ passwords: AppPassword[] }, ApiError>> {
+    return xrpcResult("com.atproto.server.listAppPasswords", { token });
   },
 
   createAppPassword(
     token: AccessToken,
     name: string,
-    scopes?: string
+    scopes?: string,
   ): Promise<Result<CreatedAppPassword, ApiError>> {
-    return xrpcResult('com.atproto.server.createAppPassword', {
-      method: 'POST',
+    return xrpcResult("com.atproto.server.createAppPassword", {
+      method: "POST",
       token,
       body: { name, scopes },
-    })
+    });
   },
 
-  revokeAppPassword(token: AccessToken, name: string): Promise<Result<void, ApiError>> {
-    return xrpcResult<void>('com.atproto.server.revokeAppPassword', {
-      method: 'POST',
+  revokeAppPassword(
+    token: AccessToken,
+    name: string,
+  ): Promise<Result<void, ApiError>> {
+    return xrpcResult<void>("com.atproto.server.revokeAppPassword", {
+      method: "POST",
       token,
       body: { name },
-    })
+    });
   },
 
-  listSessions(token: AccessToken): Promise<Result<ListSessionsResponse, ApiError>> {
-    return xrpcResult('_account.listSessions', { token })
+  listSessions(
+    token: AccessToken,
+  ): Promise<Result<ListSessionsResponse, ApiError>> {
+    return xrpcResult("_account.listSessions", { token });
   },
 
-  revokeSession(token: AccessToken, sessionId: string): Promise<Result<void, ApiError>> {
-    return xrpcResult<void>('_account.revokeSession', {
-      method: 'POST',
+  revokeSession(
+    token: AccessToken,
+    sessionId: string,
+  ): Promise<Result<void, ApiError>> {
+    return xrpcResult<void>("_account.revokeSession", {
+      method: "POST",
       token,
       body: { sessionId },
-    })
+    });
   },
 
   getTotpStatus(token: AccessToken): Promise<Result<TotpStatus, ApiError>> {
-    return xrpcResult('com.atproto.server.getTotpStatus', { token })
+    return xrpcResult("com.atproto.server.getTotpStatus", { token });
   },
 
   createTotpSecret(token: AccessToken): Promise<Result<TotpSecret, ApiError>> {
-    return xrpcResult('com.atproto.server.createTotpSecret', {
-      method: 'POST',
+    return xrpcResult("com.atproto.server.createTotpSecret", {
+      method: "POST",
       token,
-    })
+    });
   },
 
-  enableTotp(token: AccessToken, code: string): Promise<Result<EnableTotpResponse, ApiError>> {
-    return xrpcResult('com.atproto.server.enableTotp', {
-      method: 'POST',
+  enableTotp(
+    token: AccessToken,
+    code: string,
+  ): Promise<Result<EnableTotpResponse, ApiError>> {
+    return xrpcResult("com.atproto.server.enableTotp", {
+      method: "POST",
       token,
       body: { code },
-    })
+    });
   },
 
   disableTotp(
     token: AccessToken,
     password: string,
-    code: string
+    code: string,
   ): Promise<Result<SuccessResponse, ApiError>> {
-    return xrpcResult('com.atproto.server.disableTotp', {
-      method: 'POST',
+    return xrpcResult("com.atproto.server.disableTotp", {
+      method: "POST",
       token,
       body: { password, code },
-    })
+    });
   },
 
-  listPasskeys(token: AccessToken): Promise<Result<ListPasskeysResponse, ApiError>> {
-    return xrpcResult('com.atproto.server.listPasskeys', { token })
+  listPasskeys(
+    token: AccessToken,
+  ): Promise<Result<ListPasskeysResponse, ApiError>> {
+    return xrpcResult("com.atproto.server.listPasskeys", { token });
   },
 
-  deletePasskey(token: AccessToken, id: string): Promise<Result<void, ApiError>> {
-    return xrpcResult<void>('com.atproto.server.deletePasskey', {
-      method: 'POST',
+  deletePasskey(
+    token: AccessToken,
+    id: string,
+  ): Promise<Result<void, ApiError>> {
+    return xrpcResult<void>("com.atproto.server.deletePasskey", {
+      method: "POST",
       token,
       body: { id },
-    })
+    });
   },
 
-  listTrustedDevices(token: AccessToken): Promise<Result<ListTrustedDevicesResponse, ApiError>> {
-    return xrpcResult('_account.listTrustedDevices', { token })
+  listTrustedDevices(
+    token: AccessToken,
+  ): Promise<Result<ListTrustedDevicesResponse, ApiError>> {
+    return xrpcResult("_account.listTrustedDevices", { token });
   },
 
   getReauthStatus(token: AccessToken): Promise<Result<ReauthStatus, ApiError>> {
-    return xrpcResult('_account.getReauthStatus', { token })
+    return xrpcResult("_account.getReauthStatus", { token });
   },
 
-  getNotificationPrefs(token: AccessToken): Promise<Result<NotificationPrefs, ApiError>> {
-    return xrpcResult('_account.getNotificationPrefs', { token })
+  getNotificationPrefs(
+    token: AccessToken,
+  ): Promise<Result<NotificationPrefs, ApiError>> {
+    return xrpcResult("_account.getNotificationPrefs", { token });
   },
 
-  updateHandle(token: AccessToken, handle: Handle): Promise<Result<void, ApiError>> {
-    return xrpcResult<void>('com.atproto.identity.updateHandle', {
-      method: 'POST',
+  updateHandle(
+    token: AccessToken,
+    handle: Handle,
+  ): Promise<Result<void, ApiError>> {
+    return xrpcResult<void>("com.atproto.identity.updateHandle", {
+      method: "POST",
       token,
       body: { handle },
-    })
+    });
   },
 
-  describeRepo(token: AccessToken, repo: Did): Promise<Result<RepoDescription, ApiError>> {
-    return xrpcResult('com.atproto.repo.describeRepo', {
+  describeRepo(
+    token: AccessToken,
+    repo: Did,
+  ): Promise<Result<RepoDescription, ApiError>> {
+    return xrpcResult("com.atproto.repo.describeRepo", {
       token,
       params: { repo },
-    })
+    });
   },
 
   listRecords(
     token: AccessToken,
     repo: Did,
     collection: Nsid,
-    options?: { limit?: number; cursor?: string; reverse?: boolean }
+    options?: { limit?: number; cursor?: string; reverse?: boolean },
   ): Promise<Result<ListRecordsResponse, ApiError>> {
-    const params: Record<string, string> = { repo, collection }
-    if (options?.limit) params.limit = String(options.limit)
-    if (options?.cursor) params.cursor = options.cursor
-    if (options?.reverse) params.reverse = 'true'
-    return xrpcResult('com.atproto.repo.listRecords', { token, params })
+    const params: Record<string, string> = { repo, collection };
+    if (options?.limit) params.limit = String(options.limit);
+    if (options?.cursor) params.cursor = options.cursor;
+    if (options?.reverse) params.reverse = "true";
+    return xrpcResult("com.atproto.repo.listRecords", { token, params });
   },
 
   getRecord(
     token: AccessToken,
     repo: Did,
     collection: Nsid,
-    rkey: Rkey
+    rkey: Rkey,
   ): Promise<Result<RecordResponse, ApiError>> {
-    return xrpcResult('com.atproto.repo.getRecord', {
+    return xrpcResult("com.atproto.repo.getRecord", {
       token,
       params: { repo, collection, rkey },
-    })
+    });
   },
 
   deleteRecord(
     token: AccessToken,
     repo: Did,
     collection: Nsid,
-    rkey: Rkey
+    rkey: Rkey,
   ): Promise<Result<void, ApiError>> {
-    return xrpcResult<void>('com.atproto.repo.deleteRecord', {
-      method: 'POST',
+    return xrpcResult<void>("com.atproto.repo.deleteRecord", {
+      method: "POST",
       token,
       body: { repo, collection, rkey },
-    })
+    });
   },
 
   searchAccounts(
     token: AccessToken,
-    options?: { handle?: string; cursor?: string; limit?: number }
+    options?: { handle?: string; cursor?: string; limit?: number },
   ): Promise<Result<SearchAccountsResponse, ApiError>> {
-    const params: Record<string, string> = {}
-    if (options?.handle) params.handle = options.handle
-    if (options?.cursor) params.cursor = options.cursor
-    if (options?.limit) params.limit = String(options.limit)
-    return xrpcResult('com.atproto.admin.searchAccounts', { token, params })
+    const params: Record<string, string> = {};
+    if (options?.handle) params.handle = options.handle;
+    if (options?.cursor) params.cursor = options.cursor;
+    if (options?.limit) params.limit = String(options.limit);
+    return xrpcResult("com.atproto.admin.searchAccounts", { token, params });
   },
 
-  getAccountInfo(token: AccessToken, did: Did): Promise<Result<AccountInfo, ApiError>> {
-    return xrpcResult('com.atproto.admin.getAccountInfo', { token, params: { did } })
+  getAccountInfo(
+    token: AccessToken,
+    did: Did,
+  ): Promise<Result<AccountInfo, ApiError>> {
+    return xrpcResult("com.atproto.admin.getAccountInfo", {
+      token,
+      params: { did },
+    });
   },
 
   getServerStats(token: AccessToken): Promise<Result<ServerStats, ApiError>> {
-    return xrpcResult('_admin.getServerStats', { token })
+    return xrpcResult("_admin.getServerStats", { token });
   },
 
-  listBackups(token: AccessToken): Promise<Result<ListBackupsResponse, ApiError>> {
-    return xrpcResult('_backup.listBackups', { token })
+  listBackups(
+    token: AccessToken,
+  ): Promise<Result<ListBackupsResponse, ApiError>> {
+    return xrpcResult("_backup.listBackups", { token });
   },
 
-  createBackup(token: AccessToken): Promise<Result<CreateBackupResponse, ApiError>> {
-    return xrpcResult('_backup.createBackup', {
-      method: 'POST',
+  createBackup(
+    token: AccessToken,
+  ): Promise<Result<CreateBackupResponse, ApiError>> {
+    return xrpcResult("_backup.createBackup", {
+      method: "POST",
       token,
-    })
+    });
   },
 
   getDidDocument(token: AccessToken): Promise<Result<DidDocument, ApiError>> {
-    return xrpcResult('_account.getDidDocument', { token })
+    return xrpcResult("_account.getDidDocument", { token });
   },
 
   deleteSession(token: AccessToken): Promise<Result<void, ApiError>> {
-    return xrpcResult<void>('com.atproto.server.deleteSession', {
-      method: 'POST',
+    return xrpcResult<void>("com.atproto.server.deleteSession", {
+      method: "POST",
       token,
-    })
+    });
   },
 
-  revokeAllSessions(token: AccessToken): Promise<Result<{ revokedCount: number }, ApiError>> {
-    return xrpcResult('_account.revokeAllSessions', {
-      method: 'POST',
+  revokeAllSessions(
+    token: AccessToken,
+  ): Promise<Result<{ revokedCount: number }, ApiError>> {
+    return xrpcResult("_account.revokeAllSessions", {
+      method: "POST",
       token,
-    })
+    });
   },
 
-  getAccountInviteCodes(token: AccessToken): Promise<Result<{ codes: InviteCodeInfo[] }, ApiError>> {
-    return xrpcResult('com.atproto.server.getAccountInviteCodes', { token })
+  getAccountInviteCodes(
+    token: AccessToken,
+  ): Promise<Result<{ codes: InviteCodeInfo[] }, ApiError>> {
+    return xrpcResult("com.atproto.server.getAccountInviteCodes", { token });
   },
 
-  createInviteCode(token: AccessToken, useCount: number = 1): Promise<Result<{ code: string }, ApiError>> {
-    return xrpcResult('com.atproto.server.createInviteCode', {
-      method: 'POST',
+  createInviteCode(
+    token: AccessToken,
+    useCount: number = 1,
+  ): Promise<Result<{ code: string }, ApiError>> {
+    return xrpcResult("com.atproto.server.createInviteCode", {
+      method: "POST",
       token,
       body: { useCount },
-    })
+    });
   },
 
   changePassword(
     token: AccessToken,
     currentPassword: string,
-    newPassword: string
+    newPassword: string,
   ): Promise<Result<void, ApiError>> {
-    return xrpcResult<void>('_account.changePassword', {
-      method: 'POST',
+    return xrpcResult<void>("_account.changePassword", {
+      method: "POST",
       token,
       body: { currentPassword, newPassword },
-    })
+    });
   },
 
-  getPasswordStatus(token: AccessToken): Promise<Result<PasswordStatus, ApiError>> {
-    return xrpcResult('_account.getPasswordStatus', { token })
+  getPasswordStatus(
+    token: AccessToken,
+  ): Promise<Result<PasswordStatus, ApiError>> {
+    return xrpcResult("_account.getPasswordStatus", { token });
   },
 
   getServerConfig(): Promise<Result<ServerConfig, ApiError>> {
-    return xrpcResult('_server.getConfig')
+    return xrpcResult("_server.getConfig");
   },
 
-  getLegacyLoginPreference(token: AccessToken): Promise<Result<LegacyLoginPreference, ApiError>> {
-    return xrpcResult('_account.getLegacyLoginPreference', { token })
+  getLegacyLoginPreference(
+    token: AccessToken,
+  ): Promise<Result<LegacyLoginPreference, ApiError>> {
+    return xrpcResult("_account.getLegacyLoginPreference", { token });
   },
 
   updateLegacyLoginPreference(
     token: AccessToken,
-    allowLegacyLogin: boolean
+    allowLegacyLogin: boolean,
   ): Promise<Result<UpdateLegacyLoginResponse, ApiError>> {
-    return xrpcResult('_account.updateLegacyLoginPreference', {
-      method: 'POST',
+    return xrpcResult("_account.updateLegacyLoginPreference", {
+      method: "POST",
       token,
       body: { allowLegacyLogin },
-    })
+    });
   },
 
-  getNotificationHistory(token: AccessToken): Promise<Result<NotificationHistoryResponse, ApiError>> {
-    return xrpcResult('_account.getNotificationHistory', { token })
+  getNotificationHistory(
+    token: AccessToken,
+  ): Promise<Result<NotificationHistoryResponse, ApiError>> {
+    return xrpcResult("_account.getNotificationHistory", { token });
   },
 
   updateNotificationPrefs(
     token: AccessToken,
     prefs: {
-      preferredChannel?: string
-      discordId?: string
-      telegramUsername?: string
-      signalNumber?: string
-    }
+      preferredChannel?: string;
+      discordId?: string;
+      telegramUsername?: string;
+      signalNumber?: string;
+    },
   ): Promise<Result<SuccessResponse, ApiError>> {
-    return xrpcResult('_account.updateNotificationPrefs', {
-      method: 'POST',
+    return xrpcResult("_account.updateNotificationPrefs", {
+      method: "POST",
       token,
       body: prefs,
-    })
+    });
   },
 
-  revokeTrustedDevice(token: AccessToken, deviceId: string): Promise<Result<SuccessResponse, ApiError>> {
-    return xrpcResult('_account.revokeTrustedDevice', {
-      method: 'POST',
+  revokeTrustedDevice(
+    token: AccessToken,
+    deviceId: string,
+  ): Promise<Result<SuccessResponse, ApiError>> {
+    return xrpcResult("_account.revokeTrustedDevice", {
+      method: "POST",
       token,
       body: { deviceId },
-    })
+    });
   },
 
   updateTrustedDevice(
     token: AccessToken,
     deviceId: string,
-    friendlyName: string
+    friendlyName: string,
   ): Promise<Result<SuccessResponse, ApiError>> {
-    return xrpcResult('_account.updateTrustedDevice', {
-      method: 'POST',
+    return xrpcResult("_account.updateTrustedDevice", {
+      method: "POST",
       token,
       body: { deviceId, friendlyName },
-    })
+    });
   },
 
-  reauthPassword(token: AccessToken, password: string): Promise<Result<ReauthResponse, ApiError>> {
-    return xrpcResult('_account.reauthPassword', {
-      method: 'POST',
+  reauthPassword(
+    token: AccessToken,
+    password: string,
+  ): Promise<Result<ReauthResponse, ApiError>> {
+    return xrpcResult("_account.reauthPassword", {
+      method: "POST",
       token,
       body: { password },
-    })
+    });
   },
 
-  reauthTotp(token: AccessToken, code: string): Promise<Result<ReauthResponse, ApiError>> {
-    return xrpcResult('_account.reauthTotp', {
-      method: 'POST',
+  reauthTotp(
+    token: AccessToken,
+    code: string,
+  ): Promise<Result<ReauthResponse, ApiError>> {
+    return xrpcResult("_account.reauthTotp", {
+      method: "POST",
       token,
       body: { code },
-    })
+    });
   },
 
-  reauthPasskeyStart(token: AccessToken): Promise<Result<ReauthPasskeyStartResponse, ApiError>> {
-    return xrpcResult('_account.reauthPasskeyStart', {
-      method: 'POST',
+  reauthPasskeyStart(
+    token: AccessToken,
+  ): Promise<Result<ReauthPasskeyStartResponse, ApiError>> {
+    return xrpcResult("_account.reauthPasskeyStart", {
+      method: "POST",
       token,
-    })
+    });
   },
 
-  reauthPasskeyFinish(token: AccessToken, credential: unknown): Promise<Result<ReauthResponse, ApiError>> {
-    return xrpcResult('_account.reauthPasskeyFinish', {
-      method: 'POST',
+  reauthPasskeyFinish(
+    token: AccessToken,
+    credential: unknown,
+  ): Promise<Result<ReauthResponse, ApiError>> {
+    return xrpcResult("_account.reauthPasskeyFinish", {
+      method: "POST",
       token,
       body: { credential },
-    })
+    });
   },
 
-  confirmSignup(did: Did, verificationCode: string): Promise<Result<ConfirmSignupResult, ApiError>> {
-    return xrpcResult('com.atproto.server.confirmSignup', {
-      method: 'POST',
+  confirmSignup(
+    did: Did,
+    verificationCode: string,
+  ): Promise<Result<ConfirmSignupResult, ApiError>> {
+    return xrpcResult("com.atproto.server.confirmSignup", {
+      method: "POST",
       body: { did, verificationCode },
-    })
+    });
   },
 
-  resendVerification(did: Did): Promise<Result<{ success: boolean }, ApiError>> {
-    return xrpcResult('com.atproto.server.resendVerification', {
-      method: 'POST',
+  resendVerification(
+    did: Did,
+  ): Promise<Result<{ success: boolean }, ApiError>> {
+    return xrpcResult("com.atproto.server.resendVerification", {
+      method: "POST",
       body: { did },
-    })
+    });
   },
 
-  requestEmailUpdate(token: AccessToken): Promise<Result<EmailUpdateResponse, ApiError>> {
-    return xrpcResult('com.atproto.server.requestEmailUpdate', {
-      method: 'POST',
+  requestEmailUpdate(
+    token: AccessToken,
+  ): Promise<Result<EmailUpdateResponse, ApiError>> {
+    return xrpcResult("com.atproto.server.requestEmailUpdate", {
+      method: "POST",
       token,
-    })
+    });
   },
 
-  updateEmail(token: AccessToken, email: string, emailToken?: string): Promise<Result<void, ApiError>> {
-    return xrpcResult<void>('com.atproto.server.updateEmail', {
-      method: 'POST',
+  updateEmail(
+    token: AccessToken,
+    email: string,
+    emailToken?: string,
+  ): Promise<Result<void, ApiError>> {
+    return xrpcResult<void>("com.atproto.server.updateEmail", {
+      method: "POST",
       token,
       body: { email, token: emailToken },
-    })
+    });
   },
 
   requestAccountDelete(token: AccessToken): Promise<Result<void, ApiError>> {
-    return xrpcResult<void>('com.atproto.server.requestAccountDelete', {
-      method: 'POST',
+    return xrpcResult<void>("com.atproto.server.requestAccountDelete", {
+      method: "POST",
       token,
-    })
+    });
   },
 
-  deleteAccount(did: Did, password: string, deleteToken: string): Promise<Result<void, ApiError>> {
-    return xrpcResult<void>('com.atproto.server.deleteAccount', {
-      method: 'POST',
+  deleteAccount(
+    did: Did,
+    password: string,
+    deleteToken: string,
+  ): Promise<Result<void, ApiError>> {
+    return xrpcResult<void>("com.atproto.server.deleteAccount", {
+      method: "POST",
       body: { did, password, token: deleteToken },
-    })
+    });
   },
 
   updateDidDocument(
     token: AccessToken,
     params: {
-      verificationMethods?: VerificationMethod[]
-      alsoKnownAs?: string[]
-      serviceEndpoint?: string
-    }
+      verificationMethods?: VerificationMethod[];
+      alsoKnownAs?: string[];
+      serviceEndpoint?: string;
+    },
   ): Promise<Result<SuccessResponse, ApiError>> {
-    return xrpcResult('_account.updateDidDocument', {
-      method: 'POST',
+    return xrpcResult("_account.updateDidDocument", {
+      method: "POST",
       token,
       body: params,
-    })
+    });
   },
 
-  deactivateAccount(token: AccessToken, deleteAfter?: string): Promise<Result<void, ApiError>> {
-    return xrpcResult<void>('com.atproto.server.deactivateAccount', {
-      method: 'POST',
+  deactivateAccount(
+    token: AccessToken,
+    deleteAfter?: string,
+  ): Promise<Result<void, ApiError>> {
+    return xrpcResult<void>("com.atproto.server.deactivateAccount", {
+      method: "POST",
       token,
       body: { deleteAfter },
-    })
+    });
   },
 
   activateAccount(token: AccessToken): Promise<Result<void, ApiError>> {
-    return xrpcResult<void>('com.atproto.server.activateAccount', {
-      method: 'POST',
+    return xrpcResult<void>("com.atproto.server.activateAccount", {
+      method: "POST",
       token,
-    })
+    });
   },
 
-  setBackupEnabled(token: AccessToken, enabled: boolean): Promise<Result<SetBackupEnabledResponse, ApiError>> {
-    return xrpcResult('_backup.setEnabled', {
-      method: 'POST',
+  setBackupEnabled(
+    token: AccessToken,
+    enabled: boolean,
+  ): Promise<Result<SetBackupEnabledResponse, ApiError>> {
+    return xrpcResult("_backup.setEnabled", {
+      method: "POST",
       token,
       body: { enabled },
-    })
+    });
   },
 
-  deleteBackup(token: AccessToken, id: string): Promise<Result<void, ApiError>> {
-    return xrpcResult<void>('_backup.deleteBackup', {
-      method: 'POST',
+  deleteBackup(
+    token: AccessToken,
+    id: string,
+  ): Promise<Result<void, ApiError>> {
+    return xrpcResult<void>("_backup.deleteBackup", {
+      method: "POST",
       token,
       params: { id },
-    })
+    });
   },
 
   createRecord(
···
     repo: Did,
     collection: Nsid,
     record: unknown,
-    rkey?: Rkey
+    rkey?: Rkey,
   ): Promise<Result<CreateRecordResponse, ApiError>> {
-    return xrpcResult('com.atproto.repo.createRecord', {
-      method: 'POST',
+    return xrpcResult("com.atproto.repo.createRecord", {
+      method: "POST",
       token,
       body: { repo, collection, record, rkey },
-    })
+    });
   },
 
   putRecord(
···
     repo: Did,
     collection: Nsid,
     rkey: Rkey,
-    record: unknown
+    record: unknown,
   ): Promise<Result<CreateRecordResponse, ApiError>> {
-    return xrpcResult('com.atproto.repo.putRecord', {
-      method: 'POST',
+    return xrpcResult("com.atproto.repo.putRecord", {
+      method: "POST",
       token,
       body: { repo, collection, rkey, record },
-    })
+    });
   },
 
   getInviteCodes(
     token: AccessToken,
-    options?: { sort?: 'recent' | 'usage'; cursor?: string; limit?: number }
+    options?: { sort?: "recent" | "usage"; cursor?: string; limit?: number },
   ): Promise<Result<GetInviteCodesResponse, ApiError>> {
-    const params: Record<string, string> = {}
-    if (options?.sort) params.sort = options.sort
-    if (options?.cursor) params.cursor = options.cursor
-    if (options?.limit) params.limit = String(options.limit)
-    return xrpcResult('com.atproto.admin.getInviteCodes', { token, params })
+    const params: Record<string, string> = {};
+    if (options?.sort) params.sort = options.sort;
+    if (options?.cursor) params.cursor = options.cursor;
+    if (options?.limit) params.limit = String(options.limit);
+    return xrpcResult("com.atproto.admin.getInviteCodes", { token, params });
   },
 
-  disableAccountInvites(token: AccessToken, account: Did): Promise<Result<void, ApiError>> {
-    return xrpcResult<void>('com.atproto.admin.disableAccountInvites', {
-      method: 'POST',
+  disableAccountInvites(
+    token: AccessToken,
+    account: Did,
+  ): Promise<Result<void, ApiError>> {
+    return xrpcResult<void>("com.atproto.admin.disableAccountInvites", {
+      method: "POST",
       token,
       body: { account },
-    })
+    });
   },
 
-  enableAccountInvites(token: AccessToken, account: Did): Promise<Result<void, ApiError>> {
-    return xrpcResult<void>('com.atproto.admin.enableAccountInvites', {
-      method: 'POST',
+  enableAccountInvites(
+    token: AccessToken,
+    account: Did,
+  ): Promise<Result<void, ApiError>> {
+    return xrpcResult<void>("com.atproto.admin.enableAccountInvites", {
+      method: "POST",
       token,
       body: { account },
-    })
+    });
   },
 
-  adminDeleteAccount(token: AccessToken, did: Did): Promise<Result<void, ApiError>> {
-    return xrpcResult<void>('com.atproto.admin.deleteAccount', {
-      method: 'POST',
+  adminDeleteAccount(
+    token: AccessToken,
+    did: Did,
+  ): Promise<Result<void, ApiError>> {
+    return xrpcResult<void>("com.atproto.admin.deleteAccount", {
+      method: "POST",
       token,
       body: { did },
-    })
+    });
   },
 
   startPasskeyRegistration(
     token: AccessToken,
-    friendlyName?: string
+    friendlyName?: string,
   ): Promise<Result<StartPasskeyRegistrationResponse, ApiError>> {
-    return xrpcResult('com.atproto.server.startPasskeyRegistration', {
-      method: 'POST',
+    return xrpcResult("com.atproto.server.startPasskeyRegistration", {
+      method: "POST",
       token,
       body: { friendlyName },
-    })
+    });
   },
 
   finishPasskeyRegistration(
     token: AccessToken,
     credential: unknown,
-    friendlyName?: string
+    friendlyName?: string,
   ): Promise<Result<FinishPasskeyRegistrationResponse, ApiError>> {
-    return xrpcResult('com.atproto.server.finishPasskeyRegistration', {
-      method: 'POST',
+    return xrpcResult("com.atproto.server.finishPasskeyRegistration", {
+      method: "POST",
       token,
       body: { credential, friendlyName },
-    })
+    });
   },
 
   updatePasskey(
     token: AccessToken,
     id: string,
-    friendlyName: string
+    friendlyName: string,
   ): Promise<Result<void, ApiError>> {
-    return xrpcResult<void>('com.atproto.server.updatePasskey', {
-      method: 'POST',
+    return xrpcResult<void>("com.atproto.server.updatePasskey", {
+      method: "POST",
       token,
       body: { id, friendlyName },
-    })
+    });
   },
 
   regenerateBackupCodes(
     token: AccessToken,
     password: string,
-    code: string
+    code: string,
   ): Promise<Result<RegenerateBackupCodesResponse, ApiError>> {
-    return xrpcResult('com.atproto.server.regenerateBackupCodes', {
-      method: 'POST',
+    return xrpcResult("com.atproto.server.regenerateBackupCodes", {
+      method: "POST",
       token,
       body: { password, code },
-    })
+    });
   },
 
-  updateLocale(token: AccessToken, preferredLocale: string): Promise<Result<UpdateLocaleResponse, ApiError>> {
-    return xrpcResult('_account.updateLocale', {
-      method: 'POST',
+  updateLocale(
+    token: AccessToken,
+    preferredLocale: string,
+  ): Promise<Result<UpdateLocaleResponse, ApiError>> {
+    return xrpcResult("_account.updateLocale", {
+      method: "POST",
       token,
       body: { preferredLocale },
-    })
+    });
   },
 
   confirmChannelVerification(
     token: AccessToken,
     channel: string,
     identifier: string,
-    code: string
+    code: string,
   ): Promise<Result<SuccessResponse, ApiError>> {
-    return xrpcResult('_account.confirmChannelVerification', {
-      method: 'POST',
+    return xrpcResult("_account.confirmChannelVerification", {
+      method: "POST",
       token,
       body: { channel, identifier, code },
-    })
+    });
   },
 
-  removePassword(token: AccessToken): Promise<Result<SuccessResponse, ApiError>> {
-    return xrpcResult('_account.removePassword', {
-      method: 'POST',
+  removePassword(
+    token: AccessToken,
+  ): Promise<Result<SuccessResponse, ApiError>> {
+    return xrpcResult("_account.removePassword", {
+      method: "POST",
       token,
-    })
+    });
   },
-}
+};

frontend/src/lib/auth.svelte.ts

···
 import {
   api,
   ApiError,
-  typedApi,
   type CreateAccountParams,
   type CreateAccountResult,
-} from "./api";
-import type { Session } from "./types/api";
+  typedApi,
+} from "./api.ts";
+import type { Session } from "./types/api.ts";
 import {
+  type AccessToken,
   type Did,
   type Handle,
-  type AccessToken,
   type RefreshToken,
+  unsafeAsAccessToken,
   unsafeAsDid,
   unsafeAsHandle,
-  unsafeAsAccessToken,
   unsafeAsRefreshToken,
-} from "./types/branded";
-import { type Result, ok, err, isOk, isErr, map } from "./types/result";
-import { assertNever } from "./types/exhaustive";
+} from "./types/branded.ts";
+import { err, isErr, isOk, ok, type Result } from "./types/result.ts";
+import { assertNever } from "./types/exhaustive.ts";
 import {
   checkForOAuthCallback,
   clearOAuthCallbackParams,
   handleOAuthCallback,
   refreshOAuthToken,
   startOAuthLogin,
-} from "./oauth";
-import { setLocale, type SupportedLocale } from "./i18n";
+} from "./oauth.ts";
+import { setLocale, type SupportedLocale } from "./i18n.ts";
 
 const STORAGE_KEY = "tranquil_pds_session";
 const ACCOUNTS_KEY = "tranquil_pds_accounts";
···
 
 export type AuthState =
   | {
-      readonly kind: "unauthenticated";
-      readonly savedAccounts: readonly SavedAccount[];
-    }
+    readonly kind: "unauthenticated";
+    readonly savedAccounts: readonly SavedAccount[];
+  }
   | {
-      readonly kind: "loading";
-      readonly savedAccounts: readonly SavedAccount[];
-      readonly previousSession: Session | null;
-    }
+    readonly kind: "loading";
+    readonly savedAccounts: readonly SavedAccount[];
+    readonly previousSession: Session | null;
+  }
   | {
-      readonly kind: "authenticated";
-      readonly session: Session;
-      readonly savedAccounts: readonly SavedAccount[];
-    }
+    readonly kind: "authenticated";
+    readonly session: Session;
+    readonly savedAccounts: readonly SavedAccount[];
+  }
   | {
-      readonly kind: "error";
-      readonly error: AuthError;
-      readonly savedAccounts: readonly SavedAccount[];
-    };
+    readonly kind: "error";
+    readonly error: AuthError;
+    readonly savedAccounts: readonly SavedAccount[];
+  };
 
 function createUnauthenticated(
   savedAccounts: readonly SavedAccount[],
···
     }
     const accounts: SavedAccount[] = parsed
       .filter(
-        (a): a is { did: string; handle: string; accessJwt: string; refreshJwt: string } =>
+        (
+          a,
+        ): a is {
+          did: string;
+          handle: string;
+          accessJwt: string;
+          refreshJwt: string;
+        } =>
           typeof a === "object" &&
           a !== null &&
           typeof a.did === "string" &&
···
   const currentSession = state.current.session;
   try {
     const tokens = await refreshOAuthToken(currentSession.refreshJwt);
-    const sessionInfo = await api.getSession(tokens.access_token);
+    const sessionInfo = await api.getSession(
+      unsafeAsAccessToken(tokens.access_token),
+    );
     const session: Session = {
       ...sessionInfo,
-      accessJwt: tokens.access_token,
-      refreshJwt: tokens.refresh_token || currentSession.refreshJwt,
+      accessJwt: unsafeAsAccessToken(tokens.access_token),
+      refreshJwt: tokens.refresh_token
+        ? unsafeAsRefreshToken(tokens.refresh_token)
+        : currentSession.refreshJwt,
     };
     setAuthenticated(session);
     return session.accessJwt;
···
   }
 }
 
-import { setTokenRefreshCallback } from "./api";
+import { setTokenRefreshCallback } from "./api.ts";
 
 export async function initAuth(): Promise<{ oauthLoginCompleted: boolean }> {
   setTokenRefreshCallback(tryRefreshToken);
···
         oauthCallback.code,
         oauthCallback.state,
       );
-      const sessionInfo = await api.getSession(tokens.access_token);
+      const sessionInfo = await api.getSession(
+        unsafeAsAccessToken(tokens.access_token),
+      );
       const session: Session = {
         ...sessionInfo,
-        accessJwt: tokens.access_token,
-        refreshJwt: tokens.refresh_token || "",
+        accessJwt: unsafeAsAccessToken(tokens.access_token),
+        refreshJwt: unsafeAsRefreshToken(tokens.refresh_token || ""),
       };
       setAuthenticated(session);
-      applyLocaleFromSession(sessionInfo);
+      applyLocaleFromSession(session);
       return { oauthLoginCompleted: true };
     } catch (e) {
-      setError({ type: "oauth", message: e instanceof Error ? e.message : "OAuth login failed" });
+      setError({
+        type: "oauth",
+        message: e instanceof Error ? e.message : "OAuth login failed",
+      });
       return { oauthLoginCompleted: false };
     }
   }
···
   const stored = loadSessionFromStorage();
   if (stored) {
     try {
-      const sessionInfo = await api.getSession(stored.accessJwt);
+      const sessionInfo = await api.getSession(
+        unsafeAsAccessToken(stored.accessJwt),
+      );
       const session: Session = {
         ...sessionInfo,
-        accessJwt: stored.accessJwt,
-        refreshJwt: stored.refreshJwt,
+        accessJwt: unsafeAsAccessToken(stored.accessJwt),
+        refreshJwt: unsafeAsRefreshToken(stored.refreshJwt),
       };
       setAuthenticated(session);
-      applyLocaleFromSession(sessionInfo);
+      applyLocaleFromSession(session);
     } catch (e) {
       if (e instanceof ApiError && e.status === 401) {
         try {
           const tokens = await refreshOAuthToken(stored.refreshJwt);
-          const sessionInfo = await api.getSession(tokens.access_token);
+          const sessionInfo = await api.getSession(
+            unsafeAsAccessToken(tokens.access_token),
+          );
           const session: Session = {
             ...sessionInfo,
-            accessJwt: tokens.access_token,
-            refreshJwt: tokens.refresh_token || stored.refreshJwt,
+            accessJwt: unsafeAsAccessToken(tokens.access_token),
+            refreshJwt: tokens.refresh_token
+              ? unsafeAsRefreshToken(tokens.refresh_token)
+              : unsafeAsRefreshToken(stored.refreshJwt),
           };
           setAuthenticated(session);
-          applyLocaleFromSession(sessionInfo);
+          applyLocaleFromSession(session);
         } catch (refreshError) {
           console.error("Token refresh failed during init:", refreshError);
           setUnauthenticated();
···
   password: string,
 ): Promise<Result<Session, AuthError>> {
   const currentState = state.current;
-  const previousSession =
-    currentState.kind === "authenticated" ? currentState.session : null;
+  const previousSession = currentState.kind === "authenticated"
+    ? currentState.session
+    : null;
   setLoading(previousSession);
 
   const result = await typedApi.createSession(identifier, password);
···
 }
 
 export async function confirmSignup(
-  did: string,
+  did: Did,
   verificationCode: string,
 ): Promise<Result<Session, AuthError>> {
   setLoading();
   try {
     const result = await api.confirmSignup(did, verificationCode);
-    const session: Session = {
-      did: result.did,
-      handle: result.handle,
-      accessJwt: result.accessJwt,
-      refreshJwt: result.refreshJwt,
-      email: result.email,
-      emailConfirmed: result.emailConfirmed,
-      preferredChannel: result.preferredChannel,
-      preferredChannelVerified: result.preferredChannelVerified,
-    };
-    setAuthenticated(session);
-    return ok(session);
+    setAuthenticated(result);
+    return ok(result);
   } catch (e) {
     const error = toAuthError(e);
     setError(error);
···
 }
 
 export async function resendVerification(
-  did: string,
+  did: Did,
 ): Promise<Result<void, AuthError>> {
   try {
     await api.resendVerification(did);
···
   refreshJwt: string;
 }): void {
   const newSession: Session = {
-    did: session.did,
-    handle: session.handle,
-    accessJwt: session.accessJwt,
-    refreshJwt: session.refreshJwt,
+    did: unsafeAsDid(session.did),
+    handle: unsafeAsHandle(session.handle),
+    accessJwt: unsafeAsAccessToken(session.accessJwt),
+    refreshJwt: unsafeAsRefreshToken(session.refreshJwt),
   };
   setAuthenticated(newSession);
 }
···
   setLoading();
 
   try {
-    const sessionInfo = await api.getSession(account.accessJwt as string);
+    const sessionInfo = await api.getSession(account.accessJwt);
     const session: Session = {
       ...sessionInfo,
-      accessJwt: account.accessJwt as string,
-      refreshJwt: account.refreshJwt as string,
+      accessJwt: account.accessJwt,
+      refreshJwt: account.refreshJwt,
     };
     setAuthenticated(session);
     return ok(session);
   } catch (e) {
     if (e instanceof ApiError && e.status === 401) {
       try {
-        const tokens = await refreshOAuthToken(account.refreshJwt as string);
-        const sessionInfo = await api.getSession(tokens.access_token);
+        const tokens = await refreshOAuthToken(account.refreshJwt);
+        const sessionInfo = await api.getSession(
+          unsafeAsAccessToken(tokens.access_token),
+        );
         const session: Session = {
           ...sessionInfo,
-          accessJwt: tokens.access_token,
-          refreshJwt: tokens.refresh_token || (account.refreshJwt as string),
+          accessJwt: unsafeAsAccessToken(tokens.access_token),
+          refreshJwt: tokens.refresh_token
+            ? unsafeAsRefreshToken(tokens.refresh_token)
+            : account.refreshJwt,
         };
         setAuthenticated(session);
         return ok(session);
···
 
 export function getToken(): AccessToken | null {
   if (state.current.kind === "authenticated") {
-    return unsafeAsAccessToken(state.current.session.accessJwt);
+    return state.current.session.accessJwt;
   }
   return null;
 }
···
   const currentSession = state.current.session;
   try {
     await api.getSession(currentSession.accessJwt);
-    return unsafeAsAccessToken(currentSession.accessJwt);
+    return currentSession.accessJwt;
   } catch (e) {
     if (e instanceof ApiError && e.status === 401) {
       try {
         const tokens = await refreshOAuthToken(currentSession.refreshJwt);
-        const sessionInfo = await api.getSession(tokens.access_token);
+        const sessionInfo = await api.getSession(
+          unsafeAsAccessToken(tokens.access_token),
+        );
         const session: Session = {
           ...sessionInfo,
-          accessJwt: tokens.access_token,
-          refreshJwt: tokens.refresh_token || currentSession.refreshJwt,
+          accessJwt: unsafeAsAccessToken(tokens.access_token),
+          refreshJwt: tokens.refresh_token
+            ? unsafeAsRefreshToken(tokens.refresh_token)
+            : currentSession.refreshJwt,
         };
         setAuthenticated(session);
-        return unsafeAsAccessToken(session.accessJwt);
+        return session.accessJwt;
       } catch {
         return null;
       }
···
 
 export function matchAuthState<T>(handlers: {
   unauthenticated: (accounts: readonly SavedAccount[]) => T;
-  loading: (accounts: readonly SavedAccount[], previousSession: Session | null) => T;
+  loading: (
+    accounts: readonly SavedAccount[],
+    previousSession: Session | null,
+  ) => T;
   authenticated: (session: Session, accounts: readonly SavedAccount[]) => T;
   error: (error: AuthError, accounts: readonly SavedAccount[]) => T;
 }): T {
···
   if (newState.loading) {
     setState(createLoading(accounts, newState.session));
   } else if (newState.error) {
-    setState(createError({ type: "unknown", message: newState.error }, accounts));
+    setState(
+      createError({ type: "unknown", message: newState.error }, accounts),
+    );
   } else if (newState.session) {
     setState(createAuthenticated(newState.session, accounts));
   } else {

frontend/src/lib/crypto.ts

···
 }
 
 export function generateKeypair(): Keypair {
-  const privateKey = secp.utils.randomPrivateKey();
+  const privateKey = secp.utils.randomSecretKey();
   const publicKey = secp.getPublicKey(privateKey, true);
 
   const multicodecKey = new Uint8Array(
···
   const bytes = typeof data === "string"
     ? new TextEncoder().encode(data)
     : data;
-  const binary = Array.from(bytes, (byte) => String.fromCharCode(byte)).join('')
+  const binary = Array.from(bytes, (byte) => String.fromCharCode(byte)).join(
+    "",
+  );
   return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
 }
 
···
   const msgBytes = new TextEncoder().encode(message);
   const hashBuffer = await crypto.subtle.digest("SHA-256", msgBytes);
   const msgHash = new Uint8Array(hashBuffer);
-  const signature = await secp.signAsync(msgHash, privateKey);
-  const sigBytes = signature.toCompactRawBytes();
+  const sigBytes = await secp.signAsync(msgHash, privateKey, {
+    prehash: false,
+  });
   const signatureEncoded = base64UrlEncode(sigBytes);
 
   return `${message}.${signatureEncoded}`;

frontend/src/lib/migration/atproto-client.ts

···
   ServerDescription,
   Session,
   StartPasskeyRegistrationResponse,
-} from "./types";
+} from "./types.ts";
 
 function apiLog(
   method: string,
···
       let requestBody: BodyInit | undefined;
       if (rawBody) {
         headers["Content-Type"] = contentType ?? "application/octet-stream";
-        requestBody = rawBody;
+        requestBody = rawBody as BodyInit;
       } else if (body) {
         headers["Content-Type"] = "application/json";
         requestBody = JSON.stringify(body);
···
     did: string,
     cid: string,
   ): Promise<{ data: Uint8Array; contentType: string }> {
-    const url = `${this.baseUrl}/xrpc/com.atproto.sync.getBlob?did=${encodeURIComponent(did)}&cid=${encodeURIComponent(cid)}`;
+    const url = `${this.baseUrl}/xrpc/com.atproto.sync.getBlob?did=${
+      encodeURIComponent(did)
+    }&cid=${encodeURIComponent(cid)}`;
     const headers: Record<string, string> = {};
     if (this.accessToken) {
       headers["Authorization"] = `Bearer ${this.accessToken}`;
···
       }));
       throw new Error(err.message || err.error || res.statusText);
     }
-    const contentType = res.headers.get("content-type") || "application/octet-stream";
+    const contentType = res.headers.get("content-type") ||
+      "application/octet-stream";
     const data = new Uint8Array(await res.arrayBuffer());
     return { data, contentType };
   }
···
 
 export function base64UrlEncode(buffer: Uint8Array | ArrayBuffer): string {
   const bytes = buffer instanceof ArrayBuffer ? new Uint8Array(buffer) : buffer;
-  const binary = Array.from(bytes, (byte) => String.fromCharCode(byte)).join('')
+  const binary = Array.from(bytes, (byte) => String.fromCharCode(byte)).join(
+    "",
+  );
   return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(
     /=+$/,
     "",
···
           id: base64UrlDecode(cred.id as string),
         }),
       ),
-  } as PublicKeyCredentialCreationOptions;
+  } as unknown as PublicKeyCredentialCreationOptions;
 }
 
 async function computeAccessTokenHash(accessToken: string): Promise<string> {

frontend/src/lib/migration/blob-migration.ts

···
-import type { AtprotoClient } from "./atproto-client";
-import type { MigrationProgress } from "./types";
+import type { AtprotoClient } from "./atproto-client.ts";
+import type { MigrationProgress } from "./types.ts";
 
 export interface BlobMigrationResult {
   migrated: number;
···
       });
 
       console.log("[blob-migration] Fetching blob", cid, "from source");
-      const { data: blobData, contentType } = await sourceClient.getBlobWithContentType(userDid, cid);
+      const { data: blobData, contentType } = await sourceClient
+        .getBlobWithContentType(userDid, cid);
       console.log(
         "[blob-migration] Got blob",
         cid,
···
         contentType,
       );
       await localClient.uploadBlob(blobData, contentType);
-      console.log("[blob-migration] Uploaded blob", cid, "with contentType:", contentType);
+      console.log(
+        "[blob-migration] Uploaded blob",
+        cid,
+        "with contentType:",
+        contentType,
+      );
       migrated++;
       onProgress({ blobsMigrated: migrated });
     } catch (e) {

frontend/src/lib/migration/flow.svelte.ts

···
   PasskeyAccountSetup,
   ServerDescription,
   StoredMigrationState,
-} from "./types";
+} from "./types.ts";
 import {
   AtprotoClient,
   clearDPoPKey,
···
   loadDPoPKey,
   resolvePdsUrl,
   saveDPoPKey,
-} from "./atproto-client";
+} from "./atproto-client.ts";
 import {
   clearMigrationState,
   saveMigrationState,
   updateProgress,
   updateStep,
-} from "./storage";
-import { migrateBlobs as migrateBlobsUtil } from "./blob-migration";
+} from "./storage.ts";
+import { migrateBlobs as migrateBlobsUtil } from "./blob-migration.ts";
 
 function migrationLog(stage: string, data?: Record<string, unknown>) {
   const timestamp = new Date().toISOString();
···
     }
   }
 
-  function setError(error: string) {
+  function setError(error: string | null) {
     state.error = error;
     saveMigrationState(state);
   }

frontend/src/lib/migration/offline-flow.svelte.ts

···
   OfflineInboundMigrationState,
   OfflineInboundStep,
   ServerDescription,
-} from "./types";
+} from "./types.ts";
 import {
   AtprotoClient,
   base64UrlEncode,
   createLocalClient,
   prepareWebAuthnCreationOptions,
-} from "./atproto-client";
-import { api } from "../api";
-import { type KeypairInfo, plcOps, type PrivateKey } from "./plc-ops";
-import { migrateBlobs as migrateBlobsUtil } from "./blob-migration";
+} from "./atproto-client.ts";
+import { api } from "../api.ts";
+import { type KeypairInfo, plcOps, type PrivateKey } from "./plc-ops.ts";
+import { migrateBlobs as migrateBlobsUtil } from "./blob-migration.ts";
 import { Secp256k1PrivateKeyExportable } from "@atcute/crypto";
+import {
+  unsafeAsAccessToken,
+  unsafeAsDid,
+  unsafeAsEmail,
+  unsafeAsHandle,
+} from "../types/branded.ts";
 
 const OFFLINE_STORAGE_KEY = "tranquil_offline_migration_state";
 const MAX_AGE_MS = 24 * 60 * 60 * 1000;
···
     const createResult = await api.createAccountWithServiceAuth(
       serviceAuthToken,
       {
-        did: state.userDid,
-        handle: fullHandle,
-        email: state.targetEmail,
+        did: unsafeAsDid(state.userDid),
+        handle: unsafeAsHandle(fullHandle),
+        email: unsafeAsEmail(state.targetEmail),
         password: state.targetPassword,
         inviteCode: state.inviteCode || undefined,
       },
···
       : `${state.targetHandle}.${serverInfo.availableUserDomains[0]}`;
 
     const createResult = await api.createPasskeyAccount({
-      did: state.userDid,
-      handle: fullHandle,
-      email: state.targetEmail,
+      did: unsafeAsDid(state.userDid),
+      handle: unsafeAsHandle(fullHandle),
+      email: unsafeAsEmail(state.targetEmail),
       inviteCode: state.inviteCode || undefined,
     }, serviceAuthToken);
 
···
     const prevCid = base.cid;
 
     const credentials = await api.getRecommendedDidCredentials(
-      state.localAccessToken,
+      unsafeAsAccessToken(state.localAccessToken),
     );
 
     await plcOps.signPlcOperationWithCredentials(
···
     }
 
     setProgress({ currentOperation: "Importing repository..." });
-    await api.importRepo(state.localAccessToken, state.carFile);
+    await api.importRepo(
+      unsafeAsAccessToken(state.localAccessToken),
+      state.carFile,
+    );
     setProgress({ repoImported: true });
   }
 
···
     }
 
     const localClient = createLocalClient();
-    localClient.setAccessToken(state.localAccessToken);
+    localClient.setAccessToken(unsafeAsAccessToken(state.localAccessToken));
 
     if (state.oldPdsUrl) {
       setProgress({
···
     }
 
     setProgress({ currentOperation: "Activating account..." });
-    await api.activateAccount(state.localAccessToken);
+    await api.activateAccount(unsafeAsAccessToken(state.localAccessToken));
     setProgress({ activated: true });
   }
 
···
     setError(null);
 
     try {
-      await api.verifyMigrationEmail(token, state.targetEmail);
+      await api.verifyMigrationEmail(token, unsafeAsEmail(state.targetEmail));
 
       if (state.authMethod === "passkey") {
         setStep("passkey-setup");
···
   }
 
   async function resendEmailVerification(): Promise<void> {
-    await api.resendMigrationVerification(state.targetEmail);
+    await api.resendMigrationVerification(unsafeAsEmail(state.targetEmail));
   }
 
   let checkingEmailVerification = false;
···
     }
 
     return api.startPasskeyRegistrationForSetup(
-      state.userDid,
+      unsafeAsDid(state.userDid),
       state.passkeySetupToken,
     );
   }
···
     };
 
     const result = await api.completePasskeySetup(
-      state.userDid,
+      unsafeAsDid(state.userDid),
       state.passkeySetupToken,
       credentialData,
       passkeyName,

frontend/src/lib/migration/plc-ops.ts

···
 
 export interface PlcOperationData {
   type: "plc_operation";
-  prev: string;
+  prev: string | null;
   alsoKnownAs: string[];
   rotationKeys: string[];
   services: Record<string, PlcService>;
···
     const lastOp = logs.at(-1);
     if (!lastOp) {
       throw new Error("No PLC operations found for this DID");
+    }
+    if (lastOp.operation.type === "plc_tombstone") {
+      throw new Error("DID has been tombstoned");
     }
     return { lastOperation: normalizeOp(lastOp.operation), base: lastOp };
   }
···
       } else if (match.type === "secp256k1") {
         keypair = await Secp256k1PrivateKey.importRaw(privateKeyBytes);
       } else {
-        throw new Error(`Unsupported key type: ${match.type}`);
+        throw new Error(
+          `Unsupported key type: ${(match as { type: string }).type}`,
+        );
       }
     } else {
       throw new Error(

frontend/src/lib/migration/storage.ts

···
   MigrationDirection,
   MigrationState,
   StoredMigrationState,
-} from "./types";
-import { clearDPoPKey } from "./atproto-client";
+} from "./types.ts";
+import { clearDPoPKey } from "./atproto-client.ts";
 
 const STORAGE_KEY = "tranquil_migration_state";
 const MAX_AGE_MS = 24 * 60 * 60 * 1000;
···
   const storedState: StoredMigrationState = {
     version: 1,
     direction: state.direction,
-    step: state.direction === "inbound" ? state.step : state.step,
+    step: state.step,
     startedAt: new Date().toISOString(),
-    sourcePdsUrl: state.direction === "inbound"
-      ? state.sourcePdsUrl
-      : globalThis.location.origin,
-    targetPdsUrl: state.direction === "inbound"
-      ? globalThis.location.origin
-      : state.targetPdsUrl,
-    sourceDid: state.direction === "inbound" ? state.sourceDid : "",
-    sourceHandle: state.direction === "inbound" ? state.sourceHandle : "",
+    sourcePdsUrl: state.sourcePdsUrl,
+    targetPdsUrl: globalThis.location.origin,
+    sourceDid: state.sourceDid,
+    sourceHandle: state.sourceHandle,
     targetHandle: state.targetHandle,
     targetEmail: state.targetEmail,
-    authMethod: state.direction === "inbound" ? state.authMethod : undefined,
-    passkeySetupToken: state.direction === "inbound"
-      ? state.passkeySetupToken ?? undefined
-      : undefined,
+    authMethod: state.authMethod,
+    passkeySetupToken: state.passkeySetupToken ?? undefined,
     progress: {
       repoExported: state.progress.repoExported,
       repoImported: state.progress.repoImported,

frontend/src/lib/oauth.ts

···
 
 function base64UrlEncode(buffer: ArrayBuffer): string {
   const bytes = new Uint8Array(buffer);
-  const binary = Array.from(bytes, (byte) => String.fromCharCode(byte)).join('')
+  const binary = Array.from(bytes, (byte) => String.fromCharCode(byte)).join(
+    "",
+  );
   return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(
     /=+$/,
     "",

frontend/src/lib/registration/flow.svelte.ts

···
-import { api, ApiError } from "../api";
-import { setSession } from "../auth.svelte";
+import { api, ApiError } from "../api.ts";
+import { setSession } from "../auth.svelte.ts";
 import {
   createServiceJwt,
   generateDidDocument,
   generateKeypair,
-} from "../crypto";
+} from "../crypto.ts";
+import {
+  unsafeAsDid,
+  unsafeAsEmail,
+  unsafeAsHandle,
+} from "../types/branded.ts";
 import type {
   AccountResult,
   ExternalDidWebState,
···
   RegistrationMode,
   RegistrationStep,
   SessionState,
-} from "./types";
+} from "./types.ts";
 
 export interface RegistrationFlowState {
   mode: RegistrationMode;
···
 
       if (keyMode === "reserved") {
         const result = await api.reserveSigningKey(
-          state.info.externalDid!.trim(),
+          unsafeAsDid(state.info.externalDid!.trim()),
         );
         state.externalDidWeb.reservedSigningKey = result.signingKey;
         publicKeyMultibase = result.signingKey.replace("did:key:", "");
···
       }
 
       const result = await api.createPasskeyAccount({
-        handle: state.info.handle.trim(),
-        email: state.info.email?.trim() || undefined,
+        handle: unsafeAsHandle(state.info.handle.trim()),
+        email: state.info.email?.trim()
+          ? unsafeAsEmail(state.info.email.trim())
+          : undefined,
         inviteCode: state.info.inviteCode?.trim() || undefined,
         didType: state.info.didType,
         did: state.info.didType === "web-external"
-          ? state.info.externalDid!.trim()
+          ? unsafeAsDid(state.info.externalDid!.trim())
           : undefined,
         signingKey: state.info.didType === "web-external" &&
             state.externalDidWeb.keyMode === "reserved"

frontend/src/lib/registration/types.ts

···
-import type { DidType, VerificationChannel } from "../api";
+import type { DidType, VerificationChannel } from "../api.ts";
+import type {
+  AccessToken,
+  Did,
+  Handle,
+  RefreshToken,
+} from "../types/branded.ts";
 
 export type RegistrationMode = "password" | "passkey";
 
···
 }
 
 export interface AccountResult {
-  did: string;
-  handle: string;
+  did: Did;
+  handle: Handle;
   setupToken?: string;
   appPassword?: string;
   appPasswordName?: string;
 }
 
 export interface SessionState {
-  accessJwt: string;
-  refreshJwt: string;
+  accessJwt: AccessToken;
+  refreshJwt: RefreshToken;
 }

frontend/src/lib/router.svelte.ts

···
 import {
-  routes,
+  buildUrl,
+  isValidRoute,
+  parseRouteParams,
   type Route,
   type RouteParams,
+  routes,
   type RoutesWithParams,
-  buildUrl,
-  parseRouteParams,
-  isValidRoute,
-} from "./types/routes";
+} from "./types/routes.ts";
 
 const APP_BASE = "/app";
 
···
 }
 
 export type RouteMatch =
-  | { readonly matched: true; readonly route: Route; readonly params: URLSearchParams }
+  | {
+    readonly matched: true;
+    readonly route: Route;
+    readonly params: URLSearchParams;
+  }
   | { readonly matched: false };
 
 export function match(): RouteMatch {
···
   return { matched: false };
 }
 
-export { routes, type Route, type RouteParams, type RoutesWithParams };
+export { type Route, type RouteParams, routes, type RoutesWithParams };

frontend/src/lib/toast.svelte.ts

···
-export type ToastType = 'success' | 'error' | 'warning' | 'info'
+export type ToastType = "success" | "error" | "warning" | "info";
 
 export interface Toast {
-  id: number
-  type: ToastType
-  message: string
-  duration: number
-  dismissing?: boolean
+  id: number;
+  type: ToastType;
+  message: string;
+  duration: number;
+  dismissing?: boolean;
 }
 
-let nextId = 0
-let toasts = $state<Toast[]>([])
+let nextId = 0;
+let toasts = $state<Toast[]>([]);
 
 export function getToasts(): readonly Toast[] {
-  return toasts
+  return toasts;
 }
 
 export function showToast(
   type: ToastType,
   message: string,
-  duration = 5000
+  duration = 5000,
 ): number {
-  const id = nextId++
-  toasts = [...toasts, { id, type, message, duration }]
+  const id = nextId++;
+  toasts = [...toasts, { id, type, message, duration }];
 
   if (duration > 0) {
     setTimeout(() => {
-      dismissToast(id)
-    }, duration)
+      dismissToast(id);
+    }, duration);
   }
 
-  return id
+  return id;
 }
 
 export function dismissToast(id: number): void {
-  const toast = toasts.find(t => t.id === id)
-  if (!toast || toast.dismissing) return
+  const toast = toasts.find((t) => t.id === id);
+  if (!toast || toast.dismissing) return;
 
-  toasts = toasts.map(t => t.id === id ? { ...t, dismissing: true } : t)
+  toasts = toasts.map((t) => t.id === id ? { ...t, dismissing: true } : t);
 
   setTimeout(() => {
-    toasts = toasts.filter(t => t.id !== id)
-  }, 150)
+    toasts = toasts.filter((t) => t.id !== id);
+  }, 150);
 }
 
 export function clearAllToasts(): void {
-  toasts = []
+  toasts = [];
 }
 
 export function success(message: string, duration?: number): number {
-  return showToast('success', message, duration)
+  return showToast("success", message, duration);
 }
 
 export function error(message: string, duration?: number): number {
-  return showToast('error', message, duration)
+  return showToast("error", message, duration);
 }
 
 export function warning(message: string, duration?: number): number {
-  return showToast('warning', message, duration)
+  return showToast("warning", message, duration);
 }
 
 export function info(message: string, duration?: number): number {
-  return showToast('info', message, duration)
+  return showToast("info", message, duration);
 }
 
 export const toast = {
···
   info,
   dismiss: dismissToast,
   clear: clearAllToasts,
-}
+};

frontend/src/lib/types/api.ts

···
 import type {
-  Did,
-  Handle,
   AccessToken,
-  RefreshToken,
+  AtUri,
   Cid,
-  Rkey,
-  AtUri,
-  Nsid,
-  ISODateString,
+  Did,
   EmailAddress,
+  Handle,
   InviteCode as InviteCodeBrand,
+  ISODateString,
+  Nsid,
   PublicKeyMultibase,
-} from './branded'
+  RefreshToken,
+} from "./branded.ts";
 
 export type ApiErrorCode =
-  | 'InvalidRequest'
-  | 'AuthenticationRequired'
-  | 'ExpiredToken'
-  | 'InvalidToken'
-  | 'AccountNotFound'
-  | 'HandleNotAvailable'
-  | 'InvalidHandle'
-  | 'InvalidPassword'
-  | 'RateLimitExceeded'
-  | 'InternalServerError'
-  | 'AccountTakedown'
-  | 'AccountDeactivated'
-  | 'AccountNotVerified'
-  | 'RepoNotFound'
-  | 'RecordNotFound'
-  | 'BlobNotFound'
-  | 'InvalidInviteCode'
-  | 'DuplicateCreate'
-  | 'Unknown'
+  | "InvalidRequest"
+  | "AuthenticationRequired"
+  | "ExpiredToken"
+  | "InvalidToken"
+  | "AccountNotFound"
+  | "HandleNotAvailable"
+  | "InvalidHandle"
+  | "InvalidPassword"
+  | "RateLimitExceeded"
+  | "InternalServerError"
+  | "AccountTakedown"
+  | "AccountDeactivated"
+  | "AccountNotVerified"
+  | "RepoNotFound"
+  | "RecordNotFound"
+  | "BlobNotFound"
+  | "InvalidInviteCode"
+  | "DuplicateCreate"
+  | "ReauthRequired"
+  | "MfaVerificationRequired"
+  | "RecoveryLinkExpired"
+  | "InvalidRecoveryLink"
+  | "Unknown";
 
-export type AccountStatus = 'active' | 'deactivated' | 'migrated' | 'suspended' | 'deleted'
+export type AccountStatus =
+  | "active"
+  | "deactivated"
+  | "migrated"
+  | "suspended"
+  | "deleted";
 
-export type SessionType = 'oauth' | 'legacy' | 'app_password'
+export type SessionType = "oauth" | "legacy" | "app_password";
 
-export type VerificationChannel = 'email' | 'discord' | 'telegram' | 'signal'
+export type VerificationChannel = "email" | "discord" | "telegram" | "signal";
 
-export type DidType = 'plc' | 'web' | 'web-external'
+export type DidType = "plc" | "web" | "web-external";
 
-export type ReauthMethod = 'password' | 'totp' | 'passkey'
+export type ReauthMethod = "password" | "totp" | "passkey";
 
 export interface Session {
-  did: Did
-  handle: Handle
-  email?: EmailAddress
-  emailConfirmed?: boolean
-  preferredChannel?: VerificationChannel
-  preferredChannelVerified?: boolean
-  isAdmin?: boolean
-  active?: boolean
-  status?: AccountStatus
-  migratedToPds?: string
-  migratedAt?: ISODateString
-  accessJwt: AccessToken
-  refreshJwt: RefreshToken
+  did: Did;
+  handle: Handle;
+  email?: EmailAddress;
+  emailConfirmed?: boolean;
+  preferredChannel?: VerificationChannel;
+  preferredChannelVerified?: boolean;
+  preferredLocale?: string | null;
+  isAdmin?: boolean;
+  active?: boolean;
+  status?: AccountStatus;
+  migratedToPds?: string;
+  migratedAt?: ISODateString;
+  accessJwt: AccessToken;
+  refreshJwt: RefreshToken;
 }
 
 export interface VerificationMethod {
-  id: string
-  type: string
-  controller: string
-  publicKeyMultibase: PublicKeyMultibase
+  id: string;
+  type: string;
+  controller: string;
+  publicKeyMultibase: PublicKeyMultibase;
 }
 
 export interface ServiceEndpoint {
-  id: string
-  type: string
-  serviceEndpoint: string
+  id: string;
+  type: string;
+  serviceEndpoint: string;
 }
 
 export interface DidDocument {
-  '@context': string[]
-  id: Did
-  alsoKnownAs: string[]
-  verificationMethod: VerificationMethod[]
-  service: ServiceEndpoint[]
+  "@context": string[];
+  id: Did;
+  alsoKnownAs: string[];
+  verificationMethod: VerificationMethod[];
+  service: ServiceEndpoint[];
 }
 
 export interface AppPassword {
-  name: string
-  createdAt: ISODateString
-  scopes?: string
-  createdByController?: string
+  name: string;
+  createdAt: ISODateString;
+  scopes?: string;
+  createdByController?: string;
 }
 
 export interface CreatedAppPassword {
-  name: string
-  password: string
-  createdAt: ISODateString
-  scopes?: string
+  name: string;
+  password: string;
+  createdAt: ISODateString;
+  scopes?: string;
 }
 
 export interface InviteCodeUse {
-  usedBy: Did
-  usedByHandle?: Handle
-  usedAt: ISODateString
+  usedBy: Did;
+  usedByHandle?: Handle;
+  usedAt: ISODateString;
 }
 
 export interface InviteCodeInfo {
-  code: InviteCodeBrand
-  available: number
-  disabled: boolean
-  forAccount: Did
-  createdBy: Did
-  createdAt: ISODateString
-  uses: InviteCodeUse[]
+  code: InviteCodeBrand;
+  available: number;
+  disabled: boolean;
+  forAccount: Did;
+  createdBy: Did;
+  createdAt: ISODateString;
+  uses: InviteCodeUse[];
 }
 
 export interface CreateAccountParams {
-  handle: string
-  email: string
-  password: string
-  inviteCode?: string
-  didType?: DidType
-  did?: string
-  signingKey?: string
-  verificationChannel?: VerificationChannel
-  discordId?: string
-  telegramUsername?: string
-  signalNumber?: string
+  handle: string;
+  email: string;
+  password: string;
+  inviteCode?: string;
+  didType?: DidType;
+  did?: string;
+  signingKey?: string;
+  verificationChannel?: VerificationChannel;
+  discordId?: string;
+  telegramUsername?: string;
+  signalNumber?: string;
 }
 
 export interface CreateAccountResult {
-  handle: Handle
-  did: Did
-  verificationRequired: boolean
-  verificationChannel: VerificationChannel
+  handle: Handle;
+  did: Did;
+  verificationRequired: boolean;
+  verificationChannel: VerificationChannel;
 }
 
 export interface ConfirmSignupResult {
-  accessJwt: AccessToken
-  refreshJwt: RefreshToken
-  handle: Handle
-  did: Did
-  email?: EmailAddress
-  emailConfirmed?: boolean
-  preferredChannel?: VerificationChannel
-  preferredChannelVerified?: boolean
+  accessJwt: AccessToken;
+  refreshJwt: RefreshToken;
+  handle: Handle;
+  did: Did;
+  email?: EmailAddress;
+  emailConfirmed?: boolean;
+  preferredChannel?: VerificationChannel;
+  preferredChannelVerified?: boolean;
 }
 
 export interface ListAppPasswordsResponse {
-  passwords: AppPassword[]
+  passwords: AppPassword[];
 }
 
 export interface AccountInviteCodesResponse {
-  codes: InviteCodeInfo[]
+  codes: InviteCodeInfo[];
 }
 
 export interface CreateInviteCodeResponse {
-  code: InviteCodeBrand
+  code: InviteCodeBrand;
 }
 
 export interface ServerLinks {
-  privacyPolicy?: string
-  termsOfService?: string
+  privacyPolicy?: string;
+  termsOfService?: string;
 }
 
 export interface ServerDescription {
-  availableUserDomains: string[]
-  inviteCodeRequired: boolean
-  links?: ServerLinks
-  version?: string
-  availableCommsChannels?: VerificationChannel[]
-  selfHostedDidWebEnabled?: boolean
+  availableUserDomains: string[];
+  inviteCodeRequired: boolean;
+  links?: ServerLinks;
+  version?: string;
+  availableCommsChannels?: VerificationChannel[];
+  selfHostedDidWebEnabled?: boolean;
 }
 
 export interface RepoInfo {
-  did: Did
-  head: Cid
-  rev: string
+  did: Did;
+  head: Cid;
+  rev: string;
 }
 
 export interface ListReposResponse {
-  repos: RepoInfo[]
-  cursor?: string
+  repos: RepoInfo[];
+  cursor?: string;
 }
 
 export interface NotificationPrefs {
-  preferredChannel: VerificationChannel
-  email: EmailAddress
-  discordId: string | null
-  discordVerified: boolean
-  telegramUsername: string | null
-  telegramVerified: boolean
-  signalNumber: string | null
-  signalVerified: boolean
+  preferredChannel: VerificationChannel;
+  email: EmailAddress;
+  discordId: string | null;
+  discordVerified: boolean;
+  telegramUsername: string | null;
+  telegramVerified: boolean;
+  signalNumber: string | null;
+  signalVerified: boolean;
 }
 
 export interface NotificationHistoryItem {
-  createdAt: ISODateString
-  channel: VerificationChannel
-  notificationType: string
-  status: string
-  subject: string | null
-  body: string
+  createdAt: ISODateString;
+  channel: VerificationChannel;
+  notificationType: string;
+  status: string;
+  subject: string | null;
+  body: string;
 }
 
 export interface NotificationHistoryResponse {
-  notifications: NotificationHistoryItem[]
+  notifications: NotificationHistoryItem[];
 }
 
 export interface ServerStats {
-  userCount: number
-  repoCount: number
-  recordCount: number
-  blobStorageBytes: number
+  userCount: number;
+  repoCount: number;
+  recordCount: number;
+  blobStorageBytes: number;
 }
 
 export interface ServerConfig {
-  serverName: string
-  primaryColor: string | null
-  primaryColorDark: string | null
-  secondaryColor: string | null
-  secondaryColorDark: string | null
-  logoCid: Cid | null
+  serverName: string;
+  primaryColor: string | null;
+  primaryColorDark: string | null;
+  secondaryColor: string | null;
+  secondaryColorDark: string | null;
+  logoCid: Cid | null;
 }
 
 export interface BlobRef {
-  $type: 'blob'
-  ref: { $link: Cid }
-  mimeType: string
-  size: number
+  $type: "blob";
+  ref: { $link: Cid };
+  mimeType: string;
+  size: number;
 }
 
 export interface UploadBlobResponse {
-  blob: BlobRef
+  blob: BlobRef;
 }
 
 export interface SessionInfo {
-  id: string
-  sessionType: SessionType
-  clientName: string | null
-  createdAt: ISODateString
-  expiresAt: ISODateString
-  isCurrent: boolean
+  id: string;
+  sessionType: SessionType;
+  clientName: string | null;
+  createdAt: ISODateString;
+  expiresAt: ISODateString;
+  isCurrent: boolean;
 }
 
 export interface ListSessionsResponse {
-  sessions: SessionInfo[]
+  sessions: SessionInfo[];
 }
 
 export interface RevokeAllSessionsResponse {
-  revokedCount: number
+  revokedCount: number;
 }
 
 export interface AccountSearchResult {
-  did: Did
-  handle: Handle
-  email?: EmailAddress
-  indexedAt: ISODateString
-  emailConfirmedAt?: ISODateString
-  deactivatedAt?: ISODateString
+  did: Did;
+  handle: Handle;
+  email?: EmailAddress;
+  indexedAt: ISODateString;
+  emailConfirmedAt?: ISODateString;
+  deactivatedAt?: ISODateString;
 }
 
 export interface SearchAccountsResponse {
-  cursor?: string
-  accounts: AccountSearchResult[]
+  cursor?: string;
+  accounts: AccountSearchResult[];
 }
 
 export interface AdminInviteCodeUse {
-  usedBy: Did
-  usedAt: ISODateString
+  usedBy: Did;
+  usedAt: ISODateString;
 }
 
 export interface AdminInviteCode {
-  code: InviteCodeBrand
-  available: number
-  disabled: boolean
-  forAccount: Did
-  createdBy: Did
-  createdAt: ISODateString
-  uses: AdminInviteCodeUse[]
+  code: InviteCodeBrand;
+  available: number;
+  disabled: boolean;
+  forAccount: Did;
+  createdBy: Did;
+  createdAt: ISODateString;
+  uses: AdminInviteCodeUse[];
 }
 
 export interface GetInviteCodesResponse {
-  cursor?: string
-  codes: AdminInviteCode[]
+  cursor?: string;
+  codes: AdminInviteCode[];
 }
 
 export interface AccountInfo {
-  did: Did
-  handle: Handle
-  email?: EmailAddress
-  indexedAt: ISODateString
-  emailConfirmedAt?: ISODateString
-  invitesDisabled?: boolean
-  deactivatedAt?: ISODateString
+  did: Did;
+  handle: Handle;
+  email?: EmailAddress;
+  indexedAt: ISODateString;
+  emailConfirmedAt?: ISODateString;
+  invitesDisabled?: boolean;
+  deactivatedAt?: ISODateString;
 }
 
 export interface RepoDescription {
-  handle: Handle
-  did: Did
-  didDoc: DidDocument
-  collections: Nsid[]
-  handleIsCorrect: boolean
+  handle: Handle;
+  did: Did;
+  didDoc: DidDocument;
+  collections: Nsid[];
+  handleIsCorrect: boolean;
 }
 
 export interface RecordInfo {
-  uri: AtUri
-  cid: Cid
-  value: unknown
+  uri: AtUri;
+  cid: Cid;
+  value: unknown;
 }
 
 export interface ListRecordsResponse {
-  records: RecordInfo[]
-  cursor?: string
+  records: RecordInfo[];
+  cursor?: string;
 }
 
 export interface RecordResponse {
-  uri: AtUri
-  cid: Cid
-  value: unknown
+  uri: AtUri;
+  cid: Cid;
+  value: unknown;
 }
 
 export interface CreateRecordResponse {
-  uri: AtUri
-  cid: Cid
+  uri: AtUri;
+  cid: Cid;
 }
 
 export interface TotpStatus {
-  enabled: boolean
-  hasBackupCodes: boolean
+  enabled: boolean;
+  hasBackupCodes: boolean;
 }
 
 export interface TotpSecret {
-  uri: string
-  qrBase64: string
+  uri: string;
+  qrBase64: string;
 }
 
 export interface EnableTotpResponse {
-  success: boolean
-  backupCodes: string[]
+  success: boolean;
+  backupCodes: string[];
 }
 
 export interface RegenerateBackupCodesResponse {
-  backupCodes: string[]
+  backupCodes: string[];
 }
 
 export interface PasskeyInfo {
-  id: string
-  credentialId: string
-  friendlyName: string | null
-  createdAt: ISODateString
-  lastUsed: ISODateString | null
+  id: string;
+  credentialId: string;
+  friendlyName: string | null;
+  createdAt: ISODateString;
+  lastUsed: ISODateString | null;
 }
 
 export interface ListPasskeysResponse {
-  passkeys: PasskeyInfo[]
+  passkeys: PasskeyInfo[];
 }
 
 export interface StartPasskeyRegistrationResponse {
-  options: PublicKeyCredentialCreationOptions
+  options: PublicKeyCredentialCreationOptions;
 }
 
 export interface FinishPasskeyRegistrationResponse {
-  id: string
-  credentialId: string
+  id: string;
+  credentialId: string;
 }
 
 export interface TrustedDevice {
-  id: string
-  userAgent: string | null
-  friendlyName: string | null
-  trustedAt: ISODateString | null
-  trustedUntil: ISODateString | null
-  lastSeenAt: ISODateString
+  id: string;
+  userAgent: string | null;
+  friendlyName: string | null;
+  trustedAt: ISODateString | null;
+  trustedUntil: ISODateString | null;
+  lastSeenAt: ISODateString;
 }
 
 export interface ListTrustedDevicesResponse {
-  devices: TrustedDevice[]
+  devices: TrustedDevice[];
 }
 
 export interface ReauthStatus {
-  requiresReauth: boolean
-  lastReauthAt: ISODateString | null
-  availableMethods: ReauthMethod[]
+  requiresReauth: boolean;
+  lastReauthAt: ISODateString | null;
+  availableMethods: ReauthMethod[];
 }
 
 export interface ReauthResponse {
-  success: boolean
-  reauthAt: ISODateString
+  success: boolean;
+  reauthAt: ISODateString;
 }
 
 export interface ReauthPasskeyStartResponse {
-  options: PublicKeyCredentialRequestOptions
+  options: PublicKeyCredentialRequestOptions;
 }
 
 export interface ReserveSigningKeyResponse {
-  signingKey: PublicKeyMultibase
+  signingKey: PublicKeyMultibase;
 }
 
 export interface RecommendedDidCredentials {
-  rotationKeys?: PublicKeyMultibase[]
-  alsoKnownAs?: string[]
-  verificationMethods?: { atproto?: PublicKeyMultibase }
-  services?: { atproto_pds?: { type: string; endpoint: string } }
+  rotationKeys?: PublicKeyMultibase[];
+  alsoKnownAs?: string[];
+  verificationMethods?: { atproto?: PublicKeyMultibase };
+  services?: { atproto_pds?: { type: string; endpoint: string } };
 }
 
 export interface PasskeyAccountCreateResponse {
-  did: Did
-  handle: Handle
-  setupToken: string
-  setupExpiresAt: ISODateString
+  did: Did;
+  handle: Handle;
+  setupToken: string;
+  setupExpiresAt: ISODateString;
 }
 
 export interface CompletePasskeySetupResponse {
-  did: Did
-  handle: Handle
-  appPassword: string
-  appPasswordName: string
+  did: Did;
+  handle: Handle;
+  appPassword: string;
+  appPasswordName: string;
 }
 
 export interface VerifyTokenResponse {
-  success: boolean
-  did: Did
-  purpose: string
-  channel: VerificationChannel
+  success: boolean;
+  did: Did;
+  purpose: string;
+  channel: VerificationChannel;
 }
 
 export interface BackupInfo {
-  id: string
-  repoRev: string
-  repoRootCid: Cid
-  blockCount: number
-  sizeBytes: number
-  createdAt: ISODateString
+  id: string;
+  repoRev: string;
+  repoRootCid: Cid;
+  blockCount: number;
+  sizeBytes: number;
+  createdAt: ISODateString;
 }
 
 export interface ListBackupsResponse {
-  backups: BackupInfo[]
-  backupEnabled: boolean
+  backups: BackupInfo[];
+  backupEnabled: boolean;
 }
 
 export interface CreateBackupResponse {
-  id: string
-  repoRev: string
-  sizeBytes: number
-  blockCount: number
+  id: string;
+  repoRev: string;
+  sizeBytes: number;
+  blockCount: number;
 }
 
 export interface SetBackupEnabledResponse {
-  enabled: boolean
+  enabled: boolean;
 }
 
 export interface EmailUpdateResponse {
-  tokenRequired: boolean
+  tokenRequired: boolean;
 }
 
 export interface LegacyLoginPreference {
-  allowLegacyLogin: boolean
-  hasMfa: boolean
+  allowLegacyLogin: boolean;
+  hasMfa: boolean;
 }
 
 export interface UpdateLegacyLoginResponse {
-  allowLegacyLogin: boolean
+  allowLegacyLogin: boolean;
 }
 
 export interface UpdateLocaleResponse {
-  preferredLocale: string
+  preferredLocale: string;
 }
 
 export interface PasswordStatus {
-  hasPassword: boolean
+  hasPassword: boolean;
 }
 
 export interface SuccessResponse {
-  success: boolean
+  success: boolean;
 }
 
 export interface CheckEmailVerifiedResponse {
-  verified: boolean
+  verified: boolean;
 }
 
 export interface VerifyMigrationEmailResponse {
-  success: boolean
-  did: Did
+  success: boolean;
+  did: Did;
 }
 
 export interface ResendMigrationVerificationResponse {
-  sent: boolean
+  sent: boolean;
 }

frontend/src/lib/types/branded.ts

···
-declare const __brand: unique symbol
+declare const __brand: unique symbol;
 
-type Brand<T, B extends string> = T & { readonly [__brand]: B }
+type Brand<T, B extends string> = T & { readonly [__brand]: B };
 
-export type Did = Brand<string, 'Did'>
-export type DidPlc = Brand<Did, 'DidPlc'>
-export type DidWeb = Brand<Did, 'DidWeb'>
+export type Did = Brand<string, "Did">;
+export type DidPlc = Brand<Did, "DidPlc">;
+export type DidWeb = Brand<Did, "DidWeb">;
 
-export type Handle = Brand<string, 'Handle'>
-export type AccessToken = Brand<string, 'AccessToken'>
-export type RefreshToken = Brand<string, 'RefreshToken'>
-export type ServiceToken = Brand<string, 'ServiceToken'>
-export type SetupToken = Brand<string, 'SetupToken'>
+export type Handle = Brand<string, "Handle">;
+export type AccessToken = Brand<string, "AccessToken">;
+export type RefreshToken = Brand<string, "RefreshToken">;
+export type ServiceToken = Brand<string, "ServiceToken">;
+export type SetupToken = Brand<string, "SetupToken">;
 
-export type Cid = Brand<string, 'Cid'>
-export type Rkey = Brand<string, 'Rkey'>
-export type AtUri = Brand<string, 'AtUri'>
-export type Nsid = Brand<string, 'Nsid'>
+export type Cid = Brand<string, "Cid">;
+export type Rkey = Brand<string, "Rkey">;
+export type AtUri = Brand<string, "AtUri">;
+export type Nsid = Brand<string, "Nsid">;
 
-export type ISODateString = Brand<string, 'ISODateString'>
-export type EmailAddress = Brand<string, 'EmailAddress'>
-export type InviteCode = Brand<string, 'InviteCode'>
+export type ISODateString = Brand<string, "ISODateString">;
+export type EmailAddress = Brand<string, "EmailAddress">;
+export type InviteCode = Brand<string, "InviteCode">;
 
-export type PublicKeyMultibase = Brand<string, 'PublicKeyMultibase'>
-export type DidKeyString = Brand<string, 'DidKeyString'>
+export type PublicKeyMultibase = Brand<string, "PublicKeyMultibase">;
+export type DidKeyString = Brand<string, "DidKeyString">;
 
-const DID_PLC_REGEX = /^did:plc:[a-z2-7]{24}$/
-const DID_WEB_REGEX = /^did:web:.+$/
-const HANDLE_REGEX = /^([a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?$/
-const AT_URI_REGEX = /^at:\/\/[^/]+\/[^/]+\/[^/]+$/
-const CID_REGEX = /^[a-z2-7]{59}$|^baf[a-z2-7]+$/
-const NSID_REGEX = /^[a-z]([a-z0-9-]*[a-z0-9])?(\.[a-z]([a-z0-9-]*[a-z0-9])?)+$/
-const EMAIL_REGEX = /^[^\s@]+@[^\s@]+\.[^\s@]+$/
-const ISO_DATE_REGEX = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?(Z|[+-]\d{2}:\d{2})$/
+const DID_PLC_REGEX = /^did:plc:[a-z2-7]{24}$/;
+const DID_WEB_REGEX = /^did:web:.+$/;
+const HANDLE_REGEX =
+  /^([a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?$/;
+const AT_URI_REGEX = /^at:\/\/[^/]+\/[^/]+\/[^/]+$/;
+const CID_REGEX = /^[a-z2-7]{59}$|^baf[a-z2-7]+$/;
+const NSID_REGEX =
+  /^[a-z]([a-z0-9-]*[a-z0-9])?(\.[a-z]([a-z0-9-]*[a-z0-9])?)+$/;
+const EMAIL_REGEX = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+const ISO_DATE_REGEX =
+  /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?(Z|[+-]\d{2}:\d{2})$/;
 
 export function isDid(s: string): s is Did {
-  return s.startsWith('did:plc:') || s.startsWith('did:web:')
+  return s.startsWith("did:plc:") || s.startsWith("did:web:");
 }
 
 export function isDidPlc(s: string): s is DidPlc {
-  return DID_PLC_REGEX.test(s)
+  return DID_PLC_REGEX.test(s);
 }
 
 export function isDidWeb(s: string): s is DidWeb {
-  return DID_WEB_REGEX.test(s)
+  return DID_WEB_REGEX.test(s);
 }
 
 export function isHandle(s: string): s is Handle {
-  return HANDLE_REGEX.test(s) && s.length <= 253
+  return HANDLE_REGEX.test(s) && s.length <= 253;
 }
 
 export function isAtUri(s: string): s is AtUri {
-  return AT_URI_REGEX.test(s)
+  return AT_URI_REGEX.test(s);
 }
 
 export function isCid(s: string): s is Cid {
-  return CID_REGEX.test(s)
+  return CID_REGEX.test(s);
 }
 
 export function isNsid(s: string): s is Nsid {
-  return NSID_REGEX.test(s)
+  return NSID_REGEX.test(s);
 }
 
 export function isEmail(s: string): s is EmailAddress {
-  return EMAIL_REGEX.test(s)
+  return EMAIL_REGEX.test(s);
 }
 
 export function isISODate(s: string): s is ISODateString {
-  return ISO_DATE_REGEX.test(s)
+  return ISO_DATE_REGEX.test(s);
 }
 
 export function asDid(s: string): Did {
-  if (!isDid(s)) throw new TypeError(`Invalid DID: ${s}`)
-  return s
+  if (!isDid(s)) throw new TypeError(`Invalid DID: ${s}`);
+  return s;
 }
 
 export function asDidPlc(s: string): DidPlc {
-  if (!isDidPlc(s)) throw new TypeError(`Invalid DID:PLC: ${s}`)
-  return s as DidPlc
+  if (!isDidPlc(s)) throw new TypeError(`Invalid DID:PLC: ${s}`);
+  return s as DidPlc;
 }
 
 export function asDidWeb(s: string): DidWeb {
-  if (!isDidWeb(s)) throw new TypeError(`Invalid DID:WEB: ${s}`)
-  return s as DidWeb
+  if (!isDidWeb(s)) throw new TypeError(`Invalid DID:WEB: ${s}`);
+  return s as DidWeb;
 }
 
 export function asHandle(s: string): Handle {
-  if (!isHandle(s)) throw new TypeError(`Invalid handle: ${s}`)
-  return s
+  if (!isHandle(s)) throw new TypeError(`Invalid handle: ${s}`);
+  return s;
 }
 
 export function asAtUri(s: string): AtUri {
-  if (!isAtUri(s)) throw new TypeError(`Invalid AT-URI: ${s}`)
-  return s
+  if (!isAtUri(s)) throw new TypeError(`Invalid AT-URI: ${s}`);
+  return s;
 }
 
 export function asCid(s: string): Cid {
-  if (!isCid(s)) throw new TypeError(`Invalid CID: ${s}`)
-  return s
+  if (!isCid(s)) throw new TypeError(`Invalid CID: ${s}`);
+  return s;
 }
 
 export function asNsid(s: string): Nsid {
-  if (!isNsid(s)) throw new TypeError(`Invalid NSID: ${s}`)
-  return s
+  if (!isNsid(s)) throw new TypeError(`Invalid NSID: ${s}`);
+  return s;
 }
 
 export function asEmail(s: string): EmailAddress {
-  if (!isEmail(s)) throw new TypeError(`Invalid email: ${s}`)
-  return s
+  if (!isEmail(s)) throw new TypeError(`Invalid email: ${s}`);
+  return s;
 }
 
 export function asISODate(s: string): ISODateString {
-  if (!isISODate(s)) throw new TypeError(`Invalid ISO date: ${s}`)
-  return s
+  if (!isISODate(s)) throw new TypeError(`Invalid ISO date: ${s}`);
+  return s;
 }
 
 export function unsafeAsDid(s: string): Did {
-  return s as Did
+  return s as Did;
 }
 
 export function unsafeAsHandle(s: string): Handle {
-  return s as Handle
+  return s as Handle;
 }
 
 export function unsafeAsAccessToken(s: string): AccessToken {
-  return s as AccessToken
+  return s as AccessToken;
 }
 
 export function unsafeAsRefreshToken(s: string): RefreshToken {
-  return s as RefreshToken
+  return s as RefreshToken;
 }
 
 export function unsafeAsServiceToken(s: string): ServiceToken {
-  return s as ServiceToken
+  return s as ServiceToken;
 }
 
 export function unsafeAsSetupToken(s: string): SetupToken {
-  return s as SetupToken
+  return s as SetupToken;
 }
 
 export function unsafeAsCid(s: string): Cid {
-  return s as Cid
+  return s as Cid;
 }
 
 export function unsafeAsRkey(s: string): Rkey {
-  return s as Rkey
+  return s as Rkey;
 }
 
 export function unsafeAsAtUri(s: string): AtUri {
-  return s as AtUri
+  return s as AtUri;
 }
 
 export function unsafeAsNsid(s: string): Nsid {
-  return s as Nsid
+  return s as Nsid;
 }
 
 export function unsafeAsISODate(s: string): ISODateString {
-  return s as ISODateString
+  return s as ISODateString;
 }
 
+export const unsafeAsISODateString = unsafeAsISODate;
+
 export function unsafeAsEmail(s: string): EmailAddress {
-  return s as EmailAddress
+  return s as EmailAddress;
 }
 
 export function unsafeAsInviteCode(s: string): InviteCode {
-  return s as InviteCode
+  return s as InviteCode;
 }
 
 export function unsafeAsPublicKeyMultibase(s: string): PublicKeyMultibase {
-  return s as PublicKeyMultibase
+  return s as PublicKeyMultibase;
 }
 
 export function unsafeAsDidKey(s: string): DidKeyString {
-  return s as DidKeyString
+  return s as DidKeyString;
 }
 
-export function parseAtUri(uri: AtUri): { repo: Did; collection: Nsid; rkey: Rkey } {
-  const parts = uri.replace('at://', '').split('/')
+export function parseAtUri(
+  uri: AtUri,
+): { repo: Did; collection: Nsid; rkey: Rkey } {
+  const parts = uri.replace("at://", "").split("/");
   return {
     repo: unsafeAsDid(parts[0]),
     collection: unsafeAsNsid(parts[1]),
     rkey: unsafeAsRkey(parts[2]),
-  }
+  };
 }
 
 export function makeAtUri(repo: Did, collection: Nsid, rkey: Rkey): AtUri {
-  return `at://${repo}/${collection}/${rkey}` as AtUri
+  return `at://${repo}/${collection}/${rkey}` as AtUri;
 }

frontend/src/lib/types/exhaustive.ts

···
 export function assertNever(x: never, message?: string): never {
-  throw new Error(message ?? `Unexpected value: ${JSON.stringify(x)}`)
+  throw new Error(message ?? `Unexpected value: ${JSON.stringify(x)}`);
 }
 
 export function exhaustive<T extends string | number | symbol>(
   value: T,
-  handlers: Record<T, () => void>
+  handlers: Record<T, () => void>,
 ): void {
-  const handler = handlers[value]
+  const handler = handlers[value];
   if (handler) {
-    handler()
+    handler();
   } else {
-    assertNever(value as never, `Unhandled case: ${String(value)}`)
+    assertNever(value as never, `Unhandled case: ${String(value)}`);
   }
 }
 
 export function exhaustiveMap<T extends string | number | symbol, R>(
   value: T,
-  handlers: Record<T, () => R>
+  handlers: Record<T, () => R>,
 ): R {
-  const handler = handlers[value]
+  const handler = handlers[value];
   if (handler) {
-    return handler()
+    return handler();
   }
-  return assertNever(value as never, `Unhandled case: ${String(value)}`)
+  return assertNever(value as never, `Unhandled case: ${String(value)}`);
 }
 
 export async function exhaustiveAsync<T extends string | number | symbol>(
   value: T,
-  handlers: Record<T, () => Promise<void>>
+  handlers: Record<T, () => Promise<void>>,
 ): Promise<void> {
-  const handler = handlers[value]
+  const handler = handlers[value];
   if (handler) {
-    await handler()
+    await handler();
   } else {
-    assertNever(value as never, `Unhandled case: ${String(value)}`)
+    assertNever(value as never, `Unhandled case: ${String(value)}`);
   }
 }
 
 export async function exhaustiveMapAsync<T extends string | number | symbol, R>(
   value: T,
-  handlers: Record<T, () => Promise<R>>
+  handlers: Record<T, () => Promise<R>>,
 ): Promise<R> {
-  const handler = handlers[value]
+  const handler = handlers[value];
   if (handler) {
-    return handler()
+    return handler();
   }
-  return assertNever(value as never, `Unhandled case: ${String(value)}`)
+  return assertNever(value as never, `Unhandled case: ${String(value)}`);
 }

frontend/src/lib/types/index.ts

···
-export * from './result'
-export * from './branded'
-export * from './exhaustive'
-export * from './api'
-export * from './routes'
+export * from "./result.ts";
+export * from "./branded.ts";
+export * from "./exhaustive.ts";
+export * from "./api.ts";
+export * from "./routes.ts";

frontend/src/lib/types/result.ts

···
 export type Result<T, E = Error> =
   | { ok: true; value: T }
-  | { ok: false; error: E }
+  | { ok: false; error: E };
 
 export function ok<T>(value: T): Result<T, never> {
-  return { ok: true, value }
+  return { ok: true, value };
 }
 
 export function err<E>(error: E): Result<never, E> {
-  return { ok: false, error }
+  return { ok: false, error };
 }
 
-export function isOk<T, E>(result: Result<T, E>): result is { ok: true; value: T } {
-  return result.ok
+export function isOk<T, E>(
+  result: Result<T, E>,
+): result is { ok: true; value: T } {
+  return result.ok;
 }
 
-export function isErr<T, E>(result: Result<T, E>): result is { ok: false; error: E } {
-  return !result.ok
+export function isErr<T, E>(
+  result: Result<T, E>,
+): result is { ok: false; error: E } {
+  return !result.ok;
 }
 
-export function map<T, U, E>(result: Result<T, E>, fn: (t: T) => U): Result<U, E> {
-  return result.ok ? ok(fn(result.value)) : result
+export function map<T, U, E>(
+  result: Result<T, E>,
+  fn: (t: T) => U,
+): Result<U, E> {
+  return result.ok ? ok(fn(result.value)) : result;
 }
 
-export function mapErr<T, E, F>(result: Result<T, E>, fn: (e: E) => F): Result<T, F> {
-  return result.ok ? result : err(fn(result.error))
+export function mapErr<T, E, F>(
+  result: Result<T, E>,
+  fn: (e: E) => F,
+): Result<T, F> {
+  return result.ok ? result : err(fn(result.error));
 }
 
-export function flatMap<T, U, E>(result: Result<T, E>, fn: (t: T) => Result<U, E>): Result<U, E> {
-  return result.ok ? fn(result.value) : result
+export function flatMap<T, U, E>(
+  result: Result<T, E>,
+  fn: (t: T) => Result<U, E>,
+): Result<U, E> {
+  return result.ok ? fn(result.value) : result;
 }
 
 export function unwrap<T, E>(result: Result<T, E>): T {
-  if (result.ok) return result.value
-  throw result.error instanceof Error ? result.error : new Error(String(result.error))
+  if (result.ok) return result.value;
+  throw result.error instanceof Error
+    ? result.error
+    : new Error(String(result.error));
 }
 
 export function unwrapOr<T, E>(result: Result<T, E>, defaultValue: T): T {
-  return result.ok ? result.value : defaultValue
+  return result.ok ? result.value : defaultValue;
 }
 
 export function unwrapOrElse<T, E>(result: Result<T, E>, fn: (e: E) => T): T {
-  return result.ok ? result.value : fn(result.error)
+  return result.ok ? result.value : fn(result.error);
 }
 
 export function match<T, E, U>(
   result: Result<T, E>,
-  handlers: { ok: (t: T) => U; err: (e: E) => U }
+  handlers: { ok: (t: T) => U; err: (e: E) => U },
 ): U {
-  return result.ok ? handlers.ok(result.value) : handlers.err(result.error)
+  return result.ok ? handlers.ok(result.value) : handlers.err(result.error);
 }
 
-export async function tryAsync<T>(fn: () => Promise<T>): Promise<Result<T, Error>> {
+export async function tryAsync<T>(
+  fn: () => Promise<T>,
+): Promise<Result<T, Error>> {
   try {
-    return ok(await fn())
+    return ok(await fn());
   } catch (e) {
-    return err(e instanceof Error ? e : new Error(String(e)))
+    return err(e instanceof Error ? e : new Error(String(e)));
   }
 }
 
 export async function tryAsyncWith<T, E>(
   fn: () => Promise<T>,
-  mapError: (e: unknown) => E
+  mapError: (e: unknown) => E,
 ): Promise<Result<T, E>> {
   try {
-    return ok(await fn())
+    return ok(await fn());
   } catch (e) {
-    return err(mapError(e))
+    return err(mapError(e));
   }
 }
 
 export function fromNullable<T>(value: T | null | undefined): Result<T, null> {
-  return value != null ? ok(value) : err(null)
+  return value != null ? ok(value) : err(null);
 }
 
 export function toNullable<T, E>(result: Result<T, E>): T | null {
-  return result.ok ? result.value : null
+  return result.ok ? result.value : null;
 }
 
 export function collect<T, E>(results: Result<T, E>[]): Result<T[], E> {
-  const values: T[] = []
+  const values: T[] = [];
   for (const result of results) {
-    if (!result.ok) return result
-    values.push(result.value)
+    if (!result.ok) return result;
+    values.push(result.value);
   }
-  return ok(values)
+  return ok(values);
 }
 
 export async function collectAsync<T, E>(
-  results: Promise<Result<T, E>>[]
+  results: Promise<Result<T, E>>[],
 ): Promise<Result<T[], E>> {
-  const settled = await Promise.all(results)
-  return collect(settled)
+  const settled = await Promise.all(results);
+  return collect(settled);
 }

frontend/src/lib/types/routes.ts

···
 export const routes = {
-  login: '/login',
-  register: '/register',
-  registerPasskey: '/register-passkey',
-  dashboard: '/dashboard',
-  settings: '/settings',
-  security: '/security',
-  sessions: '/sessions',
-  appPasswords: '/app-passwords',
-  trustedDevices: '/trusted-devices',
-  inviteCodes: '/invite-codes',
-  comms: '/comms',
-  repo: '/repo',
-  controllers: '/controllers',
-  delegationAudit: '/delegation-audit',
-  actAs: '/act-as',
-  didDocument: '/did-document',
-  migrate: '/migrate',
-  admin: '/admin',
-  verify: '/verify',
-  resetPassword: '/reset-password',
-  recoverPasskey: '/recover-passkey',
-  requestPasskeyRecovery: '/request-passkey-recovery',
-  oauthLogin: '/oauth/login',
-  oauthConsent: '/oauth/consent',
-  oauthAccounts: '/oauth/accounts',
-  oauth2fa: '/oauth/2fa',
-  oauthTotp: '/oauth/totp',
-  oauthPasskey: '/oauth/passkey',
-  oauthDelegation: '/oauth/delegation',
-  oauthError: '/oauth/error',
-} as const
+  login: "/login",
+  register: "/register",
+  registerPasskey: "/register-passkey",
+  dashboard: "/dashboard",
+  settings: "/settings",
+  security: "/security",
+  sessions: "/sessions",
+  appPasswords: "/app-passwords",
+  trustedDevices: "/trusted-devices",
+  inviteCodes: "/invite-codes",
+  comms: "/comms",
+  repo: "/repo",
+  controllers: "/controllers",
+  delegationAudit: "/delegation-audit",
+  actAs: "/act-as",
+  didDocument: "/did-document",
+  migrate: "/migrate",
+  admin: "/admin",
+  verify: "/verify",
+  resetPassword: "/reset-password",
+  recoverPasskey: "/recover-passkey",
+  requestPasskeyRecovery: "/request-passkey-recovery",
+  oauthLogin: "/oauth/login",
+  oauthConsent: "/oauth/consent",
+  oauthAccounts: "/oauth/accounts",
+  oauth2fa: "/oauth/2fa",
+  oauthTotp: "/oauth/totp",
+  oauthPasskey: "/oauth/passkey",
+  oauthDelegation: "/oauth/delegation",
+  oauthError: "/oauth/error",
+} as const;
 
-export type Route = (typeof routes)[keyof typeof routes]
+export type Route = (typeof routes)[keyof typeof routes];
 
-export type RouteKey = keyof typeof routes
+export type RouteKey = keyof typeof routes;
 
 export function isValidRoute(path: string): path is Route {
-  return Object.values(routes).includes(path as Route)
+  return Object.values(routes).includes(path as Route);
 }
 
 export interface RouteParams {
-  [routes.verify]: { token?: string; email?: string }
-  [routes.resetPassword]: { token?: string }
-  [routes.recoverPasskey]: { token?: string; did?: string }
-  [routes.oauthLogin]: { request_uri?: string; error?: string }
-  [routes.oauthConsent]: { request_uri?: string; client_id?: string }
-  [routes.oauthAccounts]: { request_uri?: string }
-  [routes.oauth2fa]: { request_uri?: string; channel?: string }
-  [routes.oauthTotp]: { request_uri?: string }
-  [routes.oauthPasskey]: { request_uri?: string }
-  [routes.oauthDelegation]: { request_uri?: string; delegated_did?: string }
-  [routes.oauthError]: { error?: string; error_description?: string }
-  [routes.migrate]: { code?: string; state?: string }
+  [routes.verify]: { token?: string; email?: string };
+  [routes.resetPassword]: { token?: string };
+  [routes.recoverPasskey]: { token?: string; did?: string };
+  [routes.oauthLogin]: { request_uri?: string; error?: string };
+  [routes.oauthConsent]: { request_uri?: string; client_id?: string };
+  [routes.oauthAccounts]: { request_uri?: string };
+  [routes.oauth2fa]: { request_uri?: string; channel?: string };
+  [routes.oauthTotp]: { request_uri?: string };
+  [routes.oauthPasskey]: { request_uri?: string };
+  [routes.oauthDelegation]: { request_uri?: string; delegated_did?: string };
+  [routes.oauthError]: { error?: string; error_description?: string };
+  [routes.migrate]: { code?: string; state?: string };
 }
 
-export type RoutesWithParams = keyof RouteParams
+export type RoutesWithParams = keyof RouteParams;
 
 export function buildUrl<R extends Route>(
   route: R,
-  params?: R extends RoutesWithParams ? RouteParams[R] : never
+  params?: R extends RoutesWithParams ? RouteParams[R] : never,
 ): string {
-  if (!params) return route
-  const searchParams = new URLSearchParams()
+  if (!params) return route;
+  const searchParams = new URLSearchParams();
   for (const [key, value] of Object.entries(params)) {
     if (value != null) {
-      searchParams.set(key, String(value))
+      searchParams.set(key, String(value));
     }
   }
-  const queryString = searchParams.toString()
-  return queryString ? `${route}?${queryString}` : route
+  const queryString = searchParams.toString();
+  return queryString ? `${route}?${queryString}` : route;
 }
 
 export function parseRouteParams<R extends RoutesWithParams>(
-  route: R
+  _route: R,
 ): RouteParams[R] {
-  const params = new URLSearchParams(globalThis.location.search)
-  const result: Record<string, string> = {}
+  const params = new URLSearchParams(globalThis.location.search);
+  const result: Record<string, string> = {};
   for (const [key, value] of params.entries()) {
-    result[key] = value
+    result[key] = value;
   }
-  return result as RouteParams[R]
+  return result as RouteParams[R];
 }

frontend/src/lib/types/schemas.ts

···
-import { z } from 'zod'
-import type {
-  Did,
-  Handle,
-  AccessToken,
-  RefreshToken,
-  Cid,
-  Nsid,
-  AtUri,
-  Rkey,
-  ISODateString,
-  EmailAddress,
-  InviteCode,
-  PublicKeyMultibase,
-} from './branded'
+import { z } from "zod";
 import {
-  unsafeAsDid,
-  unsafeAsHandle,
   unsafeAsAccessToken,
-  unsafeAsRefreshToken,
-  unsafeAsCid,
-  unsafeAsNsid,
   unsafeAsAtUri,
-  unsafeAsRkey,
-  unsafeAsISODate,
+  unsafeAsCid,
+  unsafeAsDid,
   unsafeAsEmail,
+  unsafeAsHandle,
   unsafeAsInviteCode,
+  unsafeAsISODate,
+  unsafeAsNsid,
   unsafeAsPublicKeyMultibase,
-} from './branded'
+  unsafeAsRefreshToken,
+  unsafeAsRkey,
+} from "./branded.ts";
 
-const did = z.string().transform((s) => unsafeAsDid(s))
-const handle = z.string().transform((s) => unsafeAsHandle(s))
-const accessToken = z.string().transform((s) => unsafeAsAccessToken(s))
-const refreshToken = z.string().transform((s) => unsafeAsRefreshToken(s))
-const cid = z.string().transform((s) => unsafeAsCid(s))
-const nsid = z.string().transform((s) => unsafeAsNsid(s))
-const atUri = z.string().transform((s) => unsafeAsAtUri(s))
-const rkey = z.string().transform((s) => unsafeAsRkey(s))
-const isoDate = z.string().transform((s) => unsafeAsISODate(s))
-const email = z.string().transform((s) => unsafeAsEmail(s))
-const inviteCode = z.string().transform((s) => unsafeAsInviteCode(s))
-const publicKeyMultibase = z.string().transform((s) => unsafeAsPublicKeyMultibase(s))
+const did = z.string().transform((s) => unsafeAsDid(s));
+const handle = z.string().transform((s) => unsafeAsHandle(s));
+const accessToken = z.string().transform((s) => unsafeAsAccessToken(s));
+const refreshToken = z.string().transform((s) => unsafeAsRefreshToken(s));
+const cid = z.string().transform((s) => unsafeAsCid(s));
+const nsid = z.string().transform((s) => unsafeAsNsid(s));
+const atUri = z.string().transform((s) => unsafeAsAtUri(s));
+const _rkey = z.string().transform((s) => unsafeAsRkey(s));
+const isoDate = z.string().transform((s) => unsafeAsISODate(s));
+const email = z.string().transform((s) => unsafeAsEmail(s));
+const inviteCode = z.string().transform((s) => unsafeAsInviteCode(s));
+const publicKeyMultibase = z.string().transform((s) =>
+  unsafeAsPublicKeyMultibase(s)
+);
 
-export const verificationChannel = z.enum(['email', 'discord', 'telegram', 'signal'])
-export const didType = z.enum(['plc', 'web', 'web-external'])
-export const accountStatus = z.enum(['active', 'deactivated', 'migrated', 'suspended', 'deleted'])
-export const sessionType = z.enum(['oauth', 'legacy', 'app_password'])
-export const reauthMethod = z.enum(['password', 'totp', 'passkey'])
+export const verificationChannel = z.enum([
+  "email",
+  "discord",
+  "telegram",
+  "signal",
+]);
+export const didType = z.enum(["plc", "web", "web-external"]);
+export const accountStatus = z.enum([
+  "active",
+  "deactivated",
+  "migrated",
+  "suspended",
+  "deleted",
+]);
+export const sessionType = z.enum(["oauth", "legacy", "app_password"]);
+export const reauthMethod = z.enum(["password", "totp", "passkey"]);
 
 export const sessionSchema = z.object({
   did: did,
···
   migratedAt: isoDate.optional(),
   accessJwt: accessToken,
   refreshJwt: refreshToken,
-})
+});
 
 export const serverLinksSchema = z.object({
   privacyPolicy: z.string().optional(),
   termsOfService: z.string().optional(),
-})
+});
 
 export const serverDescriptionSchema = z.object({
   availableUserDomains: z.array(z.string()),
···
   version: z.string().optional(),
   availableCommsChannels: z.array(verificationChannel).optional(),
   selfHostedDidWebEnabled: z.boolean().optional(),
-})
+});
 
 export const appPasswordSchema = z.object({
   name: z.string(),
   createdAt: isoDate,
   scopes: z.string().optional(),
   createdByController: z.string().optional(),
-})
+});
 
 export const createdAppPasswordSchema = z.object({
   name: z.string(),
   password: z.string(),
   createdAt: isoDate,
   scopes: z.string().optional(),
-})
+});
 
 export const inviteCodeUseSchema = z.object({
   usedBy: did,
   usedByHandle: handle.optional(),
   usedAt: isoDate,
-})
+});
 
 export const inviteCodeInfoSchema = z.object({
   code: inviteCode,
···
   createdBy: did,
   createdAt: isoDate,
   uses: z.array(inviteCodeUseSchema),
-})
+});
 
 export const sessionInfoSchema = z.object({
   id: z.string(),
···
   createdAt: isoDate,
   expiresAt: isoDate,
   isCurrent: z.boolean(),
-})
+});
 
 export const listSessionsResponseSchema = z.object({
   sessions: z.array(sessionInfoSchema),
-})
+});
 
 export const totpStatusSchema = z.object({
   enabled: z.boolean(),
   hasBackupCodes: z.boolean(),
-})
+});
 
 export const totpSecretSchema = z.object({
   uri: z.string(),
   qrBase64: z.string(),
-})
+});
 
 export const enableTotpResponseSchema = z.object({
   success: z.boolean(),
   backupCodes: z.array(z.string()),
-})
+});
 
 export const passkeyInfoSchema = z.object({
   id: z.string(),
···
   friendlyName: z.string().nullable(),
   createdAt: isoDate,
   lastUsed: isoDate.nullable(),
-})
+});
 
 export const listPasskeysResponseSchema = z.object({
   passkeys: z.array(passkeyInfoSchema),
-})
+});
 
 export const trustedDeviceSchema = z.object({
   id: z.string(),
···
   trustedAt: isoDate.nullable(),
   trustedUntil: isoDate.nullable(),
   lastSeenAt: isoDate,
-})
+});
 
 export const listTrustedDevicesResponseSchema = z.object({
   devices: z.array(trustedDeviceSchema),
-})
+});
 
 export const reauthStatusSchema = z.object({
   requiresReauth: z.boolean(),
   lastReauthAt: isoDate.nullable(),
   availableMethods: z.array(reauthMethod),
-})
+});
 
 export const reauthResponseSchema = z.object({
   success: z.boolean(),
   reauthAt: isoDate,
-})
+});
 
 export const notificationPrefsSchema = z.object({
   preferredChannel: verificationChannel,
···
   telegramVerified: z.boolean(),
   signalNumber: z.string().nullable(),
   signalVerified: z.boolean(),
-})
+});
 
 export const verificationMethodSchema = z.object({
   id: z.string(),
   type: z.string(),
   controller: z.string(),
   publicKeyMultibase: publicKeyMultibase,
-})
+});
 
 export const serviceEndpointSchema = z.object({
   id: z.string(),
   type: z.string(),
   serviceEndpoint: z.string(),
-})
+});
 
 export const didDocumentSchema = z.object({
-  '@context': z.array(z.string()),
+  "@context": z.array(z.string()),
   id: did,
   alsoKnownAs: z.array(z.string()),
   verificationMethod: z.array(verificationMethodSchema),
   service: z.array(serviceEndpointSchema),
-})
+});
 
 export const repoDescriptionSchema = z.object({
   handle: handle,
···
   didDoc: didDocumentSchema,
   collections: z.array(nsid),
   handleIsCorrect: z.boolean(),
-})
+});
 
 export const recordInfoSchema = z.object({
   uri: atUri,
   cid: cid,
   value: z.unknown(),
-})
+});
 
 export const listRecordsResponseSchema = z.object({
   records: z.array(recordInfoSchema),
   cursor: z.string().optional(),
-})
+});
 
 export const recordResponseSchema = z.object({
   uri: atUri,
   cid: cid,
   value: z.unknown(),
-})
+});
 
 export const createRecordResponseSchema = z.object({
   uri: atUri,
   cid: cid,
-})
+});
 
 export const serverStatsSchema = z.object({
   userCount: z.number(),
   repoCount: z.number(),
   recordCount: z.number(),
   blobStorageBytes: z.number(),
-})
+});
 
 export const serverConfigSchema = z.object({
   serverName: z.string(),
···
   secondaryColor: z.string().nullable(),
   secondaryColorDark: z.string().nullable(),
   logoCid: cid.nullable(),
-})
+});
 
 export const passwordStatusSchema = z.object({
   hasPassword: z.boolean(),
-})
+});
 
 export const successResponseSchema = z.object({
   success: z.boolean(),
-})
+});
 
 export const legacyLoginPreferenceSchema = z.object({
   allowLegacyLogin: z.boolean(),
   hasMfa: z.boolean(),
-})
+});
 
 export const accountInfoSchema = z.object({
   did: did,
···
   emailConfirmedAt: isoDate.optional(),
   invitesDisabled: z.boolean().optional(),
   deactivatedAt: isoDate.optional(),
-})
+});
 
 export const searchAccountsResponseSchema = z.object({
   cursor: z.string().optional(),
   accounts: z.array(accountInfoSchema),
-})
+});
 
 export const backupInfoSchema = z.object({
   id: z.string(),
···
   blockCount: z.number(),
   sizeBytes: z.number(),
   createdAt: isoDate,
-})
+});
 
 export const listBackupsResponseSchema = z.object({
   backups: z.array(backupInfoSchema),
   backupEnabled: z.boolean(),
-})
+});
 
 export const createBackupResponseSchema = z.object({
   id: z.string(),
   repoRev: z.string(),
   sizeBytes: z.number(),
   blockCount: z.number(),
-})
+});
 
-export type ValidatedSession = z.infer<typeof sessionSchema>
-export type ValidatedServerDescription = z.infer<typeof serverDescriptionSchema>
-export type ValidatedAppPassword = z.infer<typeof appPasswordSchema>
-export type ValidatedCreatedAppPassword = z.infer<typeof createdAppPasswordSchema>
-export type ValidatedInviteCodeInfo = z.infer<typeof inviteCodeInfoSchema>
-export type ValidatedSessionInfo = z.infer<typeof sessionInfoSchema>
-export type ValidatedListSessionsResponse = z.infer<typeof listSessionsResponseSchema>
-export type ValidatedTotpStatus = z.infer<typeof totpStatusSchema>
-export type ValidatedTotpSecret = z.infer<typeof totpSecretSchema>
-export type ValidatedEnableTotpResponse = z.infer<typeof enableTotpResponseSchema>
-export type ValidatedPasskeyInfo = z.infer<typeof passkeyInfoSchema>
-export type ValidatedListPasskeysResponse = z.infer<typeof listPasskeysResponseSchema>
-export type ValidatedTrustedDevice = z.infer<typeof trustedDeviceSchema>
-export type ValidatedListTrustedDevicesResponse = z.infer<typeof listTrustedDevicesResponseSchema>
-export type ValidatedReauthStatus = z.infer<typeof reauthStatusSchema>
-export type ValidatedReauthResponse = z.infer<typeof reauthResponseSchema>
-export type ValidatedNotificationPrefs = z.infer<typeof notificationPrefsSchema>
-export type ValidatedDidDocument = z.infer<typeof didDocumentSchema>
-export type ValidatedRepoDescription = z.infer<typeof repoDescriptionSchema>
-export type ValidatedListRecordsResponse = z.infer<typeof listRecordsResponseSchema>
-export type ValidatedRecordResponse = z.infer<typeof recordResponseSchema>
-export type ValidatedCreateRecordResponse = z.infer<typeof createRecordResponseSchema>
-export type ValidatedServerStats = z.infer<typeof serverStatsSchema>
-export type ValidatedServerConfig = z.infer<typeof serverConfigSchema>
-export type ValidatedPasswordStatus = z.infer<typeof passwordStatusSchema>
-export type ValidatedSuccessResponse = z.infer<typeof successResponseSchema>
-export type ValidatedLegacyLoginPreference = z.infer<typeof legacyLoginPreferenceSchema>
-export type ValidatedAccountInfo = z.infer<typeof accountInfoSchema>
-export type ValidatedSearchAccountsResponse = z.infer<typeof searchAccountsResponseSchema>
-export type ValidatedBackupInfo = z.infer<typeof backupInfoSchema>
-export type ValidatedListBackupsResponse = z.infer<typeof listBackupsResponseSchema>
-export type ValidatedCreateBackupResponse = z.infer<typeof createBackupResponseSchema>
+export type ValidatedSession = z.infer<typeof sessionSchema>;
+export type ValidatedServerDescription = z.infer<
+  typeof serverDescriptionSchema
+>;
+export type ValidatedAppPassword = z.infer<typeof appPasswordSchema>;
+export type ValidatedCreatedAppPassword = z.infer<
+  typeof createdAppPasswordSchema
+>;
+export type ValidatedInviteCodeInfo = z.infer<typeof inviteCodeInfoSchema>;
+export type ValidatedSessionInfo = z.infer<typeof sessionInfoSchema>;
+export type ValidatedListSessionsResponse = z.infer<
+  typeof listSessionsResponseSchema
+>;
+export type ValidatedTotpStatus = z.infer<typeof totpStatusSchema>;
+export type ValidatedTotpSecret = z.infer<typeof totpSecretSchema>;
+export type ValidatedEnableTotpResponse = z.infer<
+  typeof enableTotpResponseSchema
+>;
+export type ValidatedPasskeyInfo = z.infer<typeof passkeyInfoSchema>;
+export type ValidatedListPasskeysResponse = z.infer<
+  typeof listPasskeysResponseSchema
+>;
+export type ValidatedTrustedDevice = z.infer<typeof trustedDeviceSchema>;
+export type ValidatedListTrustedDevicesResponse = z.infer<
+  typeof listTrustedDevicesResponseSchema
+>;
+export type ValidatedReauthStatus = z.infer<typeof reauthStatusSchema>;
+export type ValidatedReauthResponse = z.infer<typeof reauthResponseSchema>;
+export type ValidatedNotificationPrefs = z.infer<
+  typeof notificationPrefsSchema
+>;
+export type ValidatedDidDocument = z.infer<typeof didDocumentSchema>;
+export type ValidatedRepoDescription = z.infer<typeof repoDescriptionSchema>;
+export type ValidatedListRecordsResponse = z.infer<
+  typeof listRecordsResponseSchema
+>;
+export type ValidatedRecordResponse = z.infer<typeof recordResponseSchema>;
+export type ValidatedCreateRecordResponse = z.infer<
+  typeof createRecordResponseSchema
+>;
+export type ValidatedServerStats = z.infer<typeof serverStatsSchema>;
+export type ValidatedServerConfig = z.infer<typeof serverConfigSchema>;
+export type ValidatedPasswordStatus = z.infer<typeof passwordStatusSchema>;
+export type ValidatedSuccessResponse = z.infer<typeof successResponseSchema>;
+export type ValidatedLegacyLoginPreference = z.infer<
+  typeof legacyLoginPreferenceSchema
+>;
+export type ValidatedAccountInfo = z.infer<typeof accountInfoSchema>;
+export type ValidatedSearchAccountsResponse = z.infer<
+  typeof searchAccountsResponseSchema
+>;
+export type ValidatedBackupInfo = z.infer<typeof backupInfoSchema>;
+export type ValidatedListBackupsResponse = z.infer<
+  typeof listBackupsResponseSchema
+>;
+export type ValidatedCreateBackupResponse = z.infer<
+  typeof createBackupResponseSchema
+>;

frontend/src/lib/utils/array.ts

···
-import type { Option } from './option'
+import type { Option } from "./option.ts";
 
 export function first<T>(arr: readonly T[]): Option<T> {
-  return arr[0] ?? null
+  return arr[0] ?? null;
 }
 
 export function last<T>(arr: readonly T[]): Option<T> {
-  return arr[arr.length - 1] ?? null
+  return arr[arr.length - 1] ?? null;
 }
 
 export function at<T>(arr: readonly T[], index: number): Option<T> {
-  if (index < 0) index = arr.length + index
-  return arr[index] ?? null
+  if (index < 0) index = arr.length + index;
+  return arr[index] ?? null;
 }
 
-export function find<T>(arr: readonly T[], predicate: (t: T) => boolean): Option<T> {
-  return arr.find(predicate) ?? null
+export function find<T>(
+  arr: readonly T[],
+  predicate: (t: T) => boolean,
+): Option<T> {
+  return arr.find(predicate) ?? null;
 }
 
-export function findMap<T, U>(arr: readonly T[], fn: (t: T) => Option<U>): Option<U> {
+export function findMap<T, U>(
+  arr: readonly T[],
+  fn: (t: T) => Option<U>,
+): Option<U> {
   for (const item of arr) {
-    const result = fn(item)
-    if (result != null) return result
+    const result = fn(item);
+    if (result != null) return result;
   }
-  return null
+  return null;
 }
 
-export function findIndex<T>(arr: readonly T[], predicate: (t: T) => boolean): Option<number> {
-  const index = arr.findIndex(predicate)
-  return index >= 0 ? index : null
+export function findIndex<T>(
+  arr: readonly T[],
+  predicate: (t: T) => boolean,
+): Option<number> {
+  const index = arr.findIndex(predicate);
+  return index >= 0 ? index : null;
 }
 
 export function partition<T>(
   arr: readonly T[],
-  predicate: (t: T) => boolean
+  predicate: (t: T) => boolean,
 ): [T[], T[]] {
-  const pass: T[] = []
-  const fail: T[] = []
+  const pass: T[] = [];
+  const fail: T[] = [];
   for (const item of arr) {
     if (predicate(item)) {
-      pass.push(item)
+      pass.push(item);
     } else {
-      fail.push(item)
+      fail.push(item);
     }
   }
-  return [pass, fail]
+  return [pass, fail];
 }
 
 export function groupBy<T, K extends string | number>(
   arr: readonly T[],
-  keyFn: (t: T) => K
+  keyFn: (t: T) => K,
 ): Record<K, T[]> {
-  const result = {} as Record<K, T[]>
+  const result = {} as Record<K, T[]>;
   for (const item of arr) {
-    const key = keyFn(item)
+    const key = keyFn(item);
     if (!result[key]) {
-      result[key] = []
+      result[key] = [];
     }
-    result[key].push(item)
+    result[key].push(item);
   }
-  return result
+  return result;
 }
 
 export function unique<T>(arr: readonly T[]): T[] {
-  return [...new Set(arr)]
+  return [...new Set(arr)];
 }
 
 export function uniqueBy<T, K>(arr: readonly T[], keyFn: (t: T) => K): T[] {
-  const seen = new Set<K>()
-  const result: T[] = []
+  const seen = new Set<K>();
+  const result: T[] = [];
   for (const item of arr) {
-    const key = keyFn(item)
+    const key = keyFn(item);
     if (!seen.has(key)) {
-      seen.add(key)
-      result.push(item)
+      seen.add(key);
+      result.push(item);
     }
   }
-  return result
+  return result;
 }
 
-export function sortBy<T>(arr: readonly T[], keyFn: (t: T) => number | string): T[] {
+export function sortBy<T>(
+  arr: readonly T[],
+  keyFn: (t: T) => number | string,
+): T[] {
   return [...arr].sort((a, b) => {
-    const ka = keyFn(a)
-    const kb = keyFn(b)
-    if (ka < kb) return -1
-    if (ka > kb) return 1
-    return 0
-  })
+    const ka = keyFn(a);
+    const kb = keyFn(b);
+    if (ka < kb) return -1;
+    if (ka > kb) return 1;
+    return 0;
+  });
 }
 
-export function sortByDesc<T>(arr: readonly T[], keyFn: (t: T) => number | string): T[] {
+export function sortByDesc<T>(
+  arr: readonly T[],
+  keyFn: (t: T) => number | string,
+): T[] {
   return [...arr].sort((a, b) => {
-    const ka = keyFn(a)
-    const kb = keyFn(b)
-    if (ka > kb) return -1
-    if (ka < kb) return 1
-    return 0
-  })
+    const ka = keyFn(a);
+    const kb = keyFn(b);
+    if (ka > kb) return -1;
+    if (ka < kb) return 1;
+    return 0;
+  });
 }
 
 export function chunk<T>(arr: readonly T[], size: number): T[][] {
-  const result: T[][] = []
+  const result: T[][] = [];
   for (let i = 0; i < arr.length; i += size) {
-    result.push(arr.slice(i, i + size))
+    result.push(arr.slice(i, i + size));
   }
-  return result
+  return result;
 }
 
 export function zip<T, U>(a: readonly T[], b: readonly U[]): [T, U][] {
-  const length = Math.min(a.length, b.length)
-  const result: [T, U][] = []
+  const length = Math.min(a.length, b.length);
+  const result: [T, U][] = [];
   for (let i = 0; i < length; i++) {
-    result.push([a[i], b[i]])
+    result.push([a[i], b[i]]);
   }
-  return result
+  return result;
 }
 
 export function zipWith<T, U, R>(
   a: readonly T[],
   b: readonly U[],
-  fn: (t: T, u: U) => R
+  fn: (t: T, u: U) => R,
 ): R[] {
-  const length = Math.min(a.length, b.length)
-  const result: R[] = []
+  const length = Math.min(a.length, b.length);
+  const result: R[] = [];
   for (let i = 0; i < length; i++) {
-    result.push(fn(a[i], b[i]))
+    result.push(fn(a[i], b[i]));
   }
-  return result
+  return result;
 }
 
 export function intersperse<T>(arr: readonly T[], separator: T): T[] {
-  if (arr.length <= 1) return [...arr]
-  const result: T[] = [arr[0]]
+  if (arr.length <= 1) return [...arr];
+  const result: T[] = [arr[0]];
   for (let i = 1; i < arr.length; i++) {
-    result.push(separator, arr[i])
+    result.push(separator, arr[i]);
   }
-  return result
+  return result;
 }
 
 export function range(start: number, end: number): number[] {
-  const result: number[] = []
+  const result: number[] = [];
   for (let i = start; i < end; i++) {
-    result.push(i)
+    result.push(i);
   }
-  return result
+  return result;
 }
 
 export function isEmpty<T>(arr: readonly T[]): boolean {
-  return arr.length === 0
+  return arr.length === 0;
 }
 
 export function isNonEmpty<T>(arr: readonly T[]): arr is [T, ...T[]] {
-  return arr.length > 0
+  return arr.length > 0;
 }
 
 export function sum(arr: readonly number[]): number {
-  return arr.reduce((acc, n) => acc + n, 0)
+  return arr.reduce((acc, n) => acc + n, 0);
 }
 
 export function sumBy<T>(arr: readonly T[], fn: (t: T) => number): number {
-  return arr.reduce((acc, t) => acc + fn(t), 0)
+  return arr.reduce((acc, t) => acc + fn(t), 0);
 }
 
 export function maxBy<T>(arr: readonly T[], fn: (t: T) => number): Option<T> {
-  if (arr.length === 0) return null
-  let max = arr[0]
-  let maxValue = fn(max)
+  if (arr.length === 0) return null;
+  let max = arr[0];
+  let maxValue = fn(max);
   for (let i = 1; i < arr.length; i++) {
-    const value = fn(arr[i])
+    const value = fn(arr[i]);
     if (value > maxValue) {
-      max = arr[i]
-      maxValue = value
+      max = arr[i];
+      maxValue = value;
     }
   }
-  return max
+  return max;
 }
 
 export function minBy<T>(arr: readonly T[], fn: (t: T) => number): Option<T> {
-  if (arr.length === 0) return null
-  let min = arr[0]
-  let minValue = fn(min)
+  if (arr.length === 0) return null;
+  let min = arr[0];
+  let minValue = fn(min);
   for (let i = 1; i < arr.length; i++) {
-    const value = fn(arr[i])
+    const value = fn(arr[i]);
     if (value < minValue) {
-      min = arr[i]
-      minValue = value
+      min = arr[i];
+      minValue = value;
     }
   }
-  return min
+  return min;
 }

frontend/src/lib/utils/async.ts

···
-import { ok, err, type Result } from '../types/result'
+import { err, type Result } from "../types/result.ts";
 
 export function debounce<T extends (...args: Parameters<T>) => void>(
   fn: T,
-  ms: number
+  ms: number,
 ): T & { cancel: () => void } {
-  let timeoutId: ReturnType<typeof setTimeout> | null = null
+  let timeoutId: ReturnType<typeof setTimeout> | null = null;
 
   const debounced = ((...args: Parameters<T>) => {
-    if (timeoutId) clearTimeout(timeoutId)
+    if (timeoutId) clearTimeout(timeoutId);
     timeoutId = setTimeout(() => {
-      fn(...args)
-      timeoutId = null
-    }, ms)
-  }) as T & { cancel: () => void }
+      fn(...args);
+      timeoutId = null;
+    }, ms);
+  }) as T & { cancel: () => void };
 
   debounced.cancel = () => {
     if (timeoutId) {
-      clearTimeout(timeoutId)
-      timeoutId = null
+      clearTimeout(timeoutId);
+      timeoutId = null;
     }
-  }
+  };
 
-  return debounced
+  return debounced;
 }
 
 export function throttle<T extends (...args: Parameters<T>) => void>(
   fn: T,
-  ms: number
+  ms: number,
 ): T {
-  let lastCall = 0
-  let timeoutId: ReturnType<typeof setTimeout> | null = null
+  let lastCall = 0;
+  let timeoutId: ReturnType<typeof setTimeout> | null = null;
 
   return ((...args: Parameters<T>) => {
-    const now = Date.now()
-    const remaining = ms - (now - lastCall)
+    const now = Date.now();
+    const remaining = ms - (now - lastCall);
 
     if (remaining <= 0) {
       if (timeoutId) {
-        clearTimeout(timeoutId)
-        timeoutId = null
+        clearTimeout(timeoutId);
+        timeoutId = null;
       }
-      lastCall = now
-      fn(...args)
+      lastCall = now;
+      fn(...args);
     } else if (!timeoutId) {
       timeoutId = setTimeout(() => {
-        lastCall = Date.now()
-        timeoutId = null
-        fn(...args)
-      }, remaining)
+        lastCall = Date.now();
+        timeoutId = null;
+        fn(...args);
+      }, remaining);
     }
-  }) as T
+  }) as T;
 }
 
 export function sleep(ms: number): Promise<void> {
-  return new Promise((resolve) => setTimeout(resolve, ms))
+  return new Promise((resolve) => setTimeout(resolve, ms));
 }
 
 export async function retry<T>(
   fn: () => Promise<T>,
   options: {
-    attempts?: number
-    delay?: number
-    backoff?: number
-    shouldRetry?: (error: unknown, attempt: number) => boolean
-  } = {}
+    attempts?: number;
+    delay?: number;
+    backoff?: number;
+    shouldRetry?: (error: unknown, attempt: number) => boolean;
+  } = {},
 ): Promise<T> {
   const {
     attempts = 3,
     delay = 1000,
     backoff = 2,
     shouldRetry = () => true,
-  } = options
+  } = options;
 
-  let lastError: unknown
-  let currentDelay = delay
+  let lastError: unknown;
+  let currentDelay = delay;
 
   for (let attempt = 1; attempt <= attempts; attempt++) {
     try {
-      return await fn()
+      return await fn();
     } catch (error) {
-      lastError = error
+      lastError = error;
       if (attempt === attempts || !shouldRetry(error, attempt)) {
-        throw error
+        throw error;
       }
-      await sleep(currentDelay)
-      currentDelay *= backoff
+      await sleep(currentDelay);
+      currentDelay *= backoff;
     }
   }
 
-  throw lastError
+  throw lastError;
 }
 
 export async function retryResult<T, E>(
   fn: () => Promise<Result<T, E>>,
   options: {
-    attempts?: number
-    delay?: number
-    backoff?: number
-    shouldRetry?: (error: E, attempt: number) => boolean
-  } = {}
+    attempts?: number;
+    delay?: number;
+    backoff?: number;
+    shouldRetry?: (error: E, attempt: number) => boolean;
+  } = {},
 ): Promise<Result<T, E>> {
   const {
     attempts = 3,
     delay = 1000,
     backoff = 2,
     shouldRetry = () => true,
-  } = options
+  } = options;
 
-  let lastResult: Result<T, E> | null = null
-  let currentDelay = delay
+  let lastResult: Result<T, E> | null = null;
+  let currentDelay = delay;
 
   for (let attempt = 1; attempt <= attempts; attempt++) {
-    const result = await fn()
-    lastResult = result
+    const result = await fn();
+    lastResult = result;
 
     if (result.ok) {
-      return result
+      return result;
     }
 
     if (attempt === attempts || !shouldRetry(result.error, attempt)) {
-      return result
+      return result;
     }
 
-    await sleep(currentDelay)
-    currentDelay *= backoff
+    await sleep(currentDelay);
+    currentDelay *= backoff;
   }
 
-  return lastResult!
+  return lastResult!;
 }
 
 export function timeout<T>(promise: Promise<T>, ms: number): Promise<T> {
   return new Promise((resolve, reject) => {
     const timeoutId = setTimeout(() => {
-      reject(new Error(`Timeout after ${ms}ms`))
-    }, ms)
+      reject(new Error(`Timeout after ${ms}ms`));
+    }, ms);
 
     promise
       .then((value) => {
-        clearTimeout(timeoutId)
-        resolve(value)
+        clearTimeout(timeoutId);
+        resolve(value);
       })
       .catch((error) => {
-        clearTimeout(timeoutId)
-        reject(error)
-      })
-  })
+        clearTimeout(timeoutId);
+        reject(error);
+      });
+  });
 }
 
 export async function timeoutResult<T>(
   promise: Promise<Result<T, Error>>,
-  ms: number
+  ms: number,
 ): Promise<Result<T, Error>> {
   try {
-    return await timeout(promise, ms)
+    return await timeout(promise, ms);
   } catch (e) {
-    return err(e instanceof Error ? e : new Error(String(e)))
+    return err(e instanceof Error ? e : new Error(String(e)));
   }
 }
 
 export async function parallel<T>(
   tasks: (() => Promise<T>)[],
-  concurrency: number
+  concurrency: number,
 ): Promise<T[]> {
-  const results: T[] = []
-  const executing: Promise<void>[] = []
+  const results: T[] = [];
+  const executing: Promise<void>[] = [];
 
   for (const task of tasks) {
     const p = task().then((result) => {
-      results.push(result)
-    })
+      results.push(result);
+    });
 
-    executing.push(p)
+    executing.push(p);
 
     if (executing.length >= concurrency) {
-      await Promise.race(executing)
+      await Promise.race(executing);
       executing.splice(
         executing.findIndex((e) => e === p),
-        1
-      )
+        1,
+      );
     }
   }
 
-  await Promise.all(executing)
-  return results
+  await Promise.all(executing);
+  return results;
 }
 
 export async function mapParallel<T, U>(
   items: T[],
   fn: (item: T, index: number) => Promise<U>,
-  concurrency: number
+  concurrency: number,
 ): Promise<U[]> {
-  const results: U[] = new Array(items.length)
-  const executing: Promise<void>[] = []
+  const results: U[] = new Array(items.length);
+  const executing: Promise<void>[] = [];
 
   for (let i = 0; i < items.length; i++) {
-    const index = i
+    const index = i;
     const p = fn(items[index], index).then((result) => {
-      results[index] = result
-    })
+      results[index] = result;
+    });
 
-    executing.push(p)
+    executing.push(p);
 
     if (executing.length >= concurrency) {
-      await Promise.race(executing)
+      await Promise.race(executing);
       const doneIndex = executing.findIndex(
-        (e) =>
-          (e as Promise<void> & { _done?: boolean })._done !== false
-      )
+        (e) => (e as Promise<void> & { _done?: boolean })._done !== false,
+      );
       if (doneIndex >= 0) {
-        executing.splice(doneIndex, 1)
+        executing.splice(doneIndex, 1);
       }
     }
   }
 
-  await Promise.all(executing)
-  return results
+  await Promise.all(executing);
+  return results;
 }
 
 export function createAbortable<T>(
-  fn: (signal: AbortSignal) => Promise<T>
+  fn: (signal: AbortSignal) => Promise<T>,
 ): { promise: Promise<T>; abort: () => void } {
-  const controller = new AbortController()
+  const controller = new AbortController();
   return {
     promise: fn(controller.signal),
     abort: () => controller.abort(),
-  }
+  };
 }
 
 export interface Deferred<T> {
-  promise: Promise<T>
-  resolve: (value: T) => void
-  reject: (error: unknown) => void
+  promise: Promise<T>;
+  resolve: (value: T) => void;
+  reject: (error: unknown) => void;
 }
 
 export function deferred<T>(): Deferred<T> {
-  let resolve!: (value: T) => void
-  let reject!: (error: unknown) => void
+  let resolve!: (value: T) => void;
+  let reject!: (error: unknown) => void;
 
   const promise = new Promise<T>((res, rej) => {
-    resolve = res
-    reject = rej
-  })
+    resolve = res;
+    reject = rej;
+  });
 
-  return { promise, resolve, reject }
+  return { promise, resolve, reject };
 }

frontend/src/lib/utils/index.ts

···
-export * from './option'
-export * from './array'
-export * from './async'
+export * from "./option.ts";
+export {
+  at,
+  chunk,
+  find,
+  findIndex,
+  findMap,
+  first,
+  groupBy,
+  intersperse,
+  isEmpty,
+  isNonEmpty,
+  last,
+  maxBy,
+  minBy,
+  partition,
+  range,
+  sortBy,
+  sortByDesc,
+  sum,
+  sumBy,
+  unique,
+  uniqueBy,
+  zip as zipArrays,
+  zipWith as zipArraysWith,
+} from "./array.ts";
+export * from "./async.ts";

frontend/src/lib/utils/option.ts

···
-export type Option<T> = T | null | undefined
+export type Option<T> = T | null | undefined;
 
 export function isSome<T>(opt: Option<T>): opt is T {
-  return opt != null
+  return opt != null;
 }
 
 export function isNone<T>(opt: Option<T>): opt is null | undefined {
-  return opt == null
+  return opt == null;
 }
 
 export function map<T, U>(opt: Option<T>, fn: (t: T) => U): Option<U> {
-  return isSome(opt) ? fn(opt) : null
+  return isSome(opt) ? fn(opt) : null;
 }
 
-export function flatMap<T, U>(opt: Option<T>, fn: (t: T) => Option<U>): Option<U> {
-  return isSome(opt) ? fn(opt) : null
+export function flatMap<T, U>(
+  opt: Option<T>,
+  fn: (t: T) => Option<U>,
+): Option<U> {
+  return isSome(opt) ? fn(opt) : null;
 }
 
-export function filter<T>(opt: Option<T>, predicate: (t: T) => boolean): Option<T> {
-  return isSome(opt) && predicate(opt) ? opt : null
+export function filter<T>(
+  opt: Option<T>,
+  predicate: (t: T) => boolean,
+): Option<T> {
+  return isSome(opt) && predicate(opt) ? opt : null;
 }
 
 export function getOrElse<T>(opt: Option<T>, defaultValue: T): T {
-  return isSome(opt) ? opt : defaultValue
+  return isSome(opt) ? opt : defaultValue;
 }
 
 export function getOrElseLazy<T>(opt: Option<T>, fn: () => T): T {
-  return isSome(opt) ? opt : fn()
+  return isSome(opt) ? opt : fn();
 }
 
 export function getOrThrow<T>(opt: Option<T>, error?: string | Error): T {
-  if (isSome(opt)) return opt
-  if (error instanceof Error) throw error
-  throw new Error(error ?? 'Expected value but got null/undefined')
+  if (isSome(opt)) return opt;
+  if (error instanceof Error) throw error;
+  throw new Error(error ?? "Expected value but got null/undefined");
 }
 
 export function tap<T>(opt: Option<T>, fn: (t: T) => void): Option<T> {
-  if (isSome(opt)) fn(opt)
-  return opt
+  if (isSome(opt)) fn(opt);
+  return opt;
 }
 
 export function match<T, U>(
   opt: Option<T>,
-  handlers: { some: (t: T) => U; none: () => U }
+  handlers: { some: (t: T) => U; none: () => U },
 ): U {
-  return isSome(opt) ? handlers.some(opt) : handlers.none()
+  return isSome(opt) ? handlers.some(opt) : handlers.none();
 }
 
 export function toArray<T>(opt: Option<T>): T[] {
-  return isSome(opt) ? [opt] : []
+  return isSome(opt) ? [opt] : [];
 }
 
 export function fromArray<T>(arr: T[]): Option<T> {
-  return arr.length > 0 ? arr[0] : null
+  return arr.length > 0 ? arr[0] : null;
 }
 
 export function zip<T, U>(a: Option<T>, b: Option<U>): Option<[T, U]> {
-  return isSome(a) && isSome(b) ? [a, b] : null
+  return isSome(a) && isSome(b) ? [a, b] : null;
 }
 
 export function zipWith<T, U, R>(
   a: Option<T>,
   b: Option<U>,
-  fn: (t: T, u: U) => R
+  fn: (t: T, u: U) => R,
 ): Option<R> {
-  return isSome(a) && isSome(b) ? fn(a, b) : null
+  return isSome(a) && isSome(b) ? fn(a, b) : null;
 }
 
 export function or<T>(a: Option<T>, b: Option<T>): Option<T> {
-  return isSome(a) ? a : b
+  return isSome(a) ? a : b;
 }
 
 export function orLazy<T>(a: Option<T>, fn: () => Option<T>): Option<T> {
-  return isSome(a) ? a : fn()
+  return isSome(a) ? a : fn();
 }
 
 export function and<T, U>(a: Option<T>, b: Option<U>): Option<U> {
-  return isSome(a) ? b : null
+  return isSome(a) ? b : null;
 }

frontend/src/lib/validation.ts

···
-import { ok, err, type Result } from './types/result'
+import { err, ok, type Result } from "./types/result.ts";
 import {
+  type AtUri,
+  type Cid,
   type Did,
   type DidPlc,
   type DidWeb,
-  type Handle,
   type EmailAddress,
-  type AtUri,
-  type Cid,
-  type Nsid,
-  type ISODateString,
+  type Handle,
+  isAtUri,
+  isCid,
   isDid,
   isDidPlc,
   isDidWeb,
-  isHandle,
   isEmail,
-  isAtUri,
-  isCid,
+  isHandle,
+  isISODate,
   isNsid,
-  isISODate,
-} from './types/branded'
+  type ISODateString,
+  type Nsid,
+} from "./types/branded.ts";
 
 export class ValidationError extends Error {
   constructor(
     message: string,
     public readonly field?: string,
-    public readonly value?: unknown
+    public readonly value?: unknown,
   ) {
-    super(message)
-    this.name = 'ValidationError'
+    super(message);
+    this.name = "ValidationError";
   }
 }
 
 export function parseDid(s: string): Result<Did, ValidationError> {
   if (isDid(s)) {
-    return ok(s)
+    return ok(s);
   }
-  return err(new ValidationError(`Invalid DID: ${s}`, 'did', s))
+  return err(new ValidationError(`Invalid DID: ${s}`, "did", s));
 }
 
 export function parseDidPlc(s: string): Result<DidPlc, ValidationError> {
   if (isDidPlc(s)) {
-    return ok(s)
+    return ok(s);
   }
-  return err(new ValidationError(`Invalid DID:PLC: ${s}`, 'did', s))
+  return err(new ValidationError(`Invalid DID:PLC: ${s}`, "did", s));
 }
 
 export function parseDidWeb(s: string): Result<DidWeb, ValidationError> {
   if (isDidWeb(s)) {
-    return ok(s)
+    return ok(s);
   }
-  return err(new ValidationError(`Invalid DID:WEB: ${s}`, 'did', s))
+  return err(new ValidationError(`Invalid DID:WEB: ${s}`, "did", s));
 }
 
 export function parseHandle(s: string): Result<Handle, ValidationError> {
-  const trimmed = s.trim().toLowerCase()
+  const trimmed = s.trim().toLowerCase();
   if (isHandle(trimmed)) {
-    return ok(trimmed)
+    return ok(trimmed);
   }
-  return err(new ValidationError(`Invalid handle: ${s}`, 'handle', s))
+  return err(new ValidationError(`Invalid handle: ${s}`, "handle", s));
 }
 
 export function parseEmail(s: string): Result<EmailAddress, ValidationError> {
-  const trimmed = s.trim().toLowerCase()
+  const trimmed = s.trim().toLowerCase();
   if (isEmail(trimmed)) {
-    return ok(trimmed)
+    return ok(trimmed);
   }
-  return err(new ValidationError(`Invalid email: ${s}`, 'email', s))
+  return err(new ValidationError(`Invalid email: ${s}`, "email", s));
 }
 
 export function parseAtUri(s: string): Result<AtUri, ValidationError> {
   if (isAtUri(s)) {
-    return ok(s)
+    return ok(s);
   }
-  return err(new ValidationError(`Invalid AT-URI: ${s}`, 'uri', s))
+  return err(new ValidationError(`Invalid AT-URI: ${s}`, "uri", s));
 }
 
 export function parseCid(s: string): Result<Cid, ValidationError> {
   if (isCid(s)) {
-    return ok(s)
+    return ok(s);
   }
-  return err(new ValidationError(`Invalid CID: ${s}`, 'cid', s))
+  return err(new ValidationError(`Invalid CID: ${s}`, "cid", s));
 }
 
 export function parseNsid(s: string): Result<Nsid, ValidationError> {
   if (isNsid(s)) {
-    return ok(s)
+    return ok(s);
   }
-  return err(new ValidationError(`Invalid NSID: ${s}`, 'nsid', s))
+  return err(new ValidationError(`Invalid NSID: ${s}`, "nsid", s));
 }
 
-export function parseISODate(s: string): Result<ISODateString, ValidationError> {
+export function parseISODate(
+  s: string,
+): Result<ISODateString, ValidationError> {
   if (isISODate(s)) {
-    return ok(s)
+    return ok(s);
   }
-  return err(new ValidationError(`Invalid ISO date: ${s}`, 'date', s))
+  return err(new ValidationError(`Invalid ISO date: ${s}`, "date", s));
 }
 
 export interface PasswordValidationResult {
-  valid: boolean
-  errors: string[]
-  strength: 'weak' | 'fair' | 'good' | 'strong'
+  valid: boolean;
+  errors: string[];
+  strength: "weak" | "fair" | "good" | "strong";
 }
 
 export function validatePassword(password: string): PasswordValidationResult {
-  const errors: string[] = []
+  const errors: string[] = [];
 
   if (password.length < 8) {
-    errors.push('Password must be at least 8 characters')
+    errors.push("Password must be at least 8 characters");
   }
   if (password.length > 256) {
-    errors.push('Password must be at most 256 characters')
+    errors.push("Password must be at most 256 characters");
   }
   if (!/[a-z]/.test(password)) {
-    errors.push('Password must contain a lowercase letter')
+    errors.push("Password must contain a lowercase letter");
   }
   if (!/[A-Z]/.test(password)) {
-    errors.push('Password must contain an uppercase letter')
+    errors.push("Password must contain an uppercase letter");
   }
   if (!/\d/.test(password)) {
-    errors.push('Password must contain a number')
+    errors.push("Password must contain a number");
   }
 
-  let strength: PasswordValidationResult['strength'] = 'weak'
+  let strength: PasswordValidationResult["strength"] = "weak";
   if (errors.length === 0) {
-    const hasSpecial = /[!@#$%^&*()_+\-=\[\]{};':"\\|,.<>\/?]/.test(password)
-    const isLong = password.length >= 12
-    const isVeryLong = password.length >= 16
+    const hasSpecial = /[!@#$%^&*()_+\-=\[\]{};':"\\|,.<>\/?]/.test(password);
+    const isLong = password.length >= 12;
+    const isVeryLong = password.length >= 16;
 
     if (isVeryLong && hasSpecial) {
-      strength = 'strong'
+      strength = "strong";
     } else if (isLong || hasSpecial) {
-      strength = 'good'
+      strength = "good";
     } else {
-      strength = 'fair'
+      strength = "fair";
     }
   }
 
···
     valid: errors.length === 0,
     errors,
     strength,
-  }
+  };
 }
 
-export function validateHandle(handle: string): Result<Handle, ValidationError> {
-  const trimmed = handle.trim().toLowerCase()
+export function validateHandle(
+  handle: string,
+): Result<Handle, ValidationError> {
+  const trimmed = handle.trim().toLowerCase();
 
   if (trimmed.length < 3) {
-    return err(new ValidationError('Handle must be at least 3 characters', 'handle', handle))
+    return err(
+      new ValidationError(
+        "Handle must be at least 3 characters",
+        "handle",
+        handle,
+      ),
+    );
   }
 
   if (trimmed.length > 253) {
-    return err(new ValidationError('Handle must be at most 253 characters', 'handle', handle))
+    return err(
+      new ValidationError(
+        "Handle must be at most 253 characters",
+        "handle",
+        handle,
+      ),
+    );
   }
 
   if (!isHandle(trimmed)) {
-    return err(new ValidationError('Invalid handle format', 'handle', handle))
+    return err(new ValidationError("Invalid handle format", "handle", handle));
   }
 
-  return ok(trimmed)
+  return ok(trimmed);
 }
 
-export function validateInviteCode(code: string): Result<string, ValidationError> {
-  const trimmed = code.trim()
+export function validateInviteCode(
+  code: string,
+): Result<string, ValidationError> {
+  const trimmed = code.trim();
 
   if (trimmed.length === 0) {
-    return err(new ValidationError('Invite code is required', 'inviteCode', code))
+    return err(
+      new ValidationError("Invite code is required", "inviteCode", code),
+    );
   }
 
-  const pattern = /^[a-zA-Z0-9-]+$/
+  const pattern = /^[a-zA-Z0-9-]+$/;
   if (!pattern.test(trimmed)) {
-    return err(new ValidationError('Invalid invite code format', 'inviteCode', code))
+    return err(
+      new ValidationError("Invalid invite code format", "inviteCode", code),
+    );
   }
 
-  return ok(trimmed)
+  return ok(trimmed);
 }
 
-export function validateTotpCode(code: string): Result<string, ValidationError> {
-  const trimmed = code.trim().replace(/\s/g, '')
+export function validateTotpCode(
+  code: string,
+): Result<string, ValidationError> {
+  const trimmed = code.trim().replace(/\s/g, "");
 
   if (!/^\d{6}$/.test(trimmed)) {
-    return err(new ValidationError('TOTP code must be 6 digits', 'code', code))
+    return err(new ValidationError("TOTP code must be 6 digits", "code", code));
   }
 
-  return ok(trimmed)
+  return ok(trimmed);
 }
 
-export function validateBackupCode(code: string): Result<string, ValidationError> {
-  const trimmed = code.trim().replace(/\s/g, '').toLowerCase()
+export function validateBackupCode(
+  code: string,
+): Result<string, ValidationError> {
+  const trimmed = code.trim().replace(/\s/g, "").toLowerCase();
 
   if (!/^[a-z0-9]{8}$/.test(trimmed)) {
-    return err(new ValidationError('Invalid backup code format', 'code', code))
+    return err(new ValidationError("Invalid backup code format", "code", code));
   }
 
-  return ok(trimmed)
+  return ok(trimmed);
 }
 
 export interface FormValidation<T> {
-  validate: () => Result<T, ValidationError[]>
+  validate: () => Result<T, ValidationError[]>;
   field: <K extends keyof T>(
     key: K,
-    validator: (value: unknown) => Result<T[K], ValidationError>
-  ) => FormValidation<T>
+    validator: (value: unknown) => Result<T[K], ValidationError>,
+  ) => FormValidation<T>;
   optional: <K extends keyof T>(
     key: K,
-    validator: (value: unknown) => Result<T[K], ValidationError>
-  ) => FormValidation<T>
+    validator: (value: unknown) => Result<T[K], ValidationError>,
+  ) => FormValidation<T>;
 }
 
 export function createFormValidation<T extends Record<string, unknown>>(
-  data: Record<string, unknown>
+  data: Record<string, unknown>,
 ): FormValidation<T> {
   const validators: Array<{
-    key: string
-    validator: (value: unknown) => Result<unknown, ValidationError>
-    optional: boolean
-  }> = []
+    key: string;
+    validator: (value: unknown) => Result<unknown, ValidationError>;
+    optional: boolean;
+  }> = [];
 
   const builder: FormValidation<T> = {
     field: (key, validator) => {
-      validators.push({ key: key as string, validator, optional: false })
-      return builder
+      validators.push({ key: key as string, validator, optional: false });
+      return builder;
     },
     optional: (key, validator) => {
-      validators.push({ key: key as string, validator, optional: true })
-      return builder
+      validators.push({ key: key as string, validator, optional: true });
+      return builder;
     },
     validate: () => {
-      const errors: ValidationError[] = []
-      const result: Record<string, unknown> = {}
+      const errors: ValidationError[] = [];
+      const result: Record<string, unknown> = {};
 
       for (const { key, validator, optional } of validators) {
-        const value = data[key]
+        const value = data[key];
 
-        if (value == null || value === '') {
+        if (value == null || value === "") {
           if (!optional) {
-            errors.push(new ValidationError(`${key} is required`, key))
+            errors.push(new ValidationError(`${key} is required`, key));
           }
-          continue
+          continue;
         }
 
-        const validated = validator(value)
+        const validated = validator(value);
         if (validated.ok) {
-          result[key] = validated.value
+          result[key] = validated.value;
         } else {
-          errors.push(validated.error)
+          errors.push(validated.error);
         }
       }
 
       if (errors.length > 0) {
-        return err(errors)
+        return err(errors);
       }
 
-      return ok(result as T)
+      return ok(result as T);
     },
-  }
+  };
 
-  return builder
+  return builder;
 }

frontend/src/lib/webauthn.ts

···
 export interface PublicKeyCredentialDescriptorJSON {
-  type: 'public-key'
-  id: string
-  transports?: AuthenticatorTransport[]
+  type: "public-key";
+  id: string;
+  transports?: AuthenticatorTransport[];
 }
 
 export interface PublicKeyCredentialUserEntityJSON {
-  id: string
-  name: string
-  displayName: string
+  id: string;
+  name: string;
+  displayName: string;
 }
 
 export interface PublicKeyCredentialRpEntityJSON {
-  name: string
-  id?: string
+  name: string;
+  id?: string;
 }
 
 export interface PublicKeyCredentialParametersJSON {
-  type: 'public-key'
-  alg: number
+  type: "public-key";
+  alg: number;
 }
 
 export interface AuthenticatorSelectionCriteriaJSON {
-  authenticatorAttachment?: AuthenticatorAttachment
-  residentKey?: ResidentKeyRequirement
-  requireResidentKey?: boolean
-  userVerification?: UserVerificationRequirement
+  authenticatorAttachment?: AuthenticatorAttachment;
+  residentKey?: ResidentKeyRequirement;
+  requireResidentKey?: boolean;
+  userVerification?: UserVerificationRequirement;
 }
 
 export interface PublicKeyCredentialCreationOptionsJSON {
-  rp: PublicKeyCredentialRpEntityJSON
-  user: PublicKeyCredentialUserEntityJSON
-  challenge: string
-  pubKeyCredParams: PublicKeyCredentialParametersJSON[]
-  timeout?: number
-  excludeCredentials?: PublicKeyCredentialDescriptorJSON[]
-  authenticatorSelection?: AuthenticatorSelectionCriteriaJSON
-  attestation?: AttestationConveyancePreference
+  rp: PublicKeyCredentialRpEntityJSON;
+  user: PublicKeyCredentialUserEntityJSON;
+  challenge: string;
+  pubKeyCredParams: PublicKeyCredentialParametersJSON[];
+  timeout?: number;
+  excludeCredentials?: PublicKeyCredentialDescriptorJSON[];
+  authenticatorSelection?: AuthenticatorSelectionCriteriaJSON;
+  attestation?: AttestationConveyancePreference;
 }
 
 export interface PublicKeyCredentialRequestOptionsJSON {
-  challenge: string
-  timeout?: number
-  rpId?: string
-  allowCredentials?: PublicKeyCredentialDescriptorJSON[]
-  userVerification?: UserVerificationRequirement
+  challenge: string;
+  timeout?: number;
+  rpId?: string;
+  allowCredentials?: PublicKeyCredentialDescriptorJSON[];
+  userVerification?: UserVerificationRequirement;
 }
 
 export interface WebAuthnCreationOptionsResponse {
-  publicKey: PublicKeyCredentialCreationOptionsJSON
+  publicKey: PublicKeyCredentialCreationOptionsJSON;
 }
 
 export interface WebAuthnRequestOptionsResponse {
-  publicKey: PublicKeyCredentialRequestOptionsJSON
+  publicKey: PublicKeyCredentialRequestOptionsJSON;
 }
 
 export interface CredentialAssertionJSON {
-  id: string
-  type: string
-  rawId: string
+  id: string;
+  type: string;
+  rawId: string;
   response: {
-    clientDataJSON: string
-    authenticatorData: string
-    signature: string
-    userHandle: string | null
-  }
+    clientDataJSON: string;
+    authenticatorData: string;
+    signature: string;
+    userHandle: string | null;
+  };
 }
 
 export interface CredentialAttestationJSON {
-  id: string
-  type: string
-  rawId: string
+  id: string;
+  type: string;
+  rawId: string;
   response: {
-    clientDataJSON: string
-    attestationObject: string
-  }
+    clientDataJSON: string;
+    attestationObject: string;
+  };
 }
 
 export function base64UrlToArrayBuffer(base64url: string): ArrayBuffer {
-  const base64 = base64url.replace(/-/g, '+').replace(/_/g, '/')
-  const padded = base64 + '='.repeat((4 - (base64.length % 4)) % 4)
-  const binary = atob(padded)
-  return Uint8Array.from(binary, (char) => char.charCodeAt(0)).buffer
+  const base64 = base64url.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = base64 + "=".repeat((4 - (base64.length % 4)) % 4);
+  const binary = atob(padded);
+  return Uint8Array.from(binary, (char) => char.charCodeAt(0)).buffer;
 }
 
 export function arrayBufferToBase64Url(buffer: ArrayBuffer): string {
-  const bytes = new Uint8Array(buffer)
-  const binary = Array.from(bytes, (byte) => String.fromCharCode(byte)).join('')
-  return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '')
+  const bytes = new Uint8Array(buffer);
+  const binary = Array.from(bytes, (byte) => String.fromCharCode(byte)).join(
+    "",
+  );
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
 }
 
 export function prepareCreationOptions(
-  options: WebAuthnCreationOptionsResponse
+  options: WebAuthnCreationOptionsResponse,
 ): PublicKeyCredentialCreationOptions {
-  const pk = options.publicKey
+  const pk = options.publicKey;
   return {
     ...pk,
     challenge: base64UrlToArrayBuffer(pk.challenge),
···
       ...cred,
       id: base64UrlToArrayBuffer(cred.id),
     })),
-  }
+  };
 }
 
 export function prepareRequestOptions(
-  options: WebAuthnRequestOptionsResponse
+  options: WebAuthnRequestOptionsResponse,
 ): PublicKeyCredentialRequestOptions {
-  const pk = options.publicKey
+  const pk = options.publicKey;
   return {
     ...pk,
     challenge: base64UrlToArrayBuffer(pk.challenge),
···
       ...cred,
       id: base64UrlToArrayBuffer(cred.id),
     })),
-  }
+  };
 }
 
 export function serializeAttestationResponse(
-  credential: PublicKeyCredential
+  credential: PublicKeyCredential,
 ): CredentialAttestationJSON {
-  const response = credential.response as AuthenticatorAttestationResponse
+  const response = credential.response as AuthenticatorAttestationResponse;
   return {
     id: credential.id,
     type: credential.type,
···
       clientDataJSON: arrayBufferToBase64Url(response.clientDataJSON),
       attestationObject: arrayBufferToBase64Url(response.attestationObject),
     },
-  }
+  };
 }
 
 export function serializeAssertionResponse(
-  credential: PublicKeyCredential
+  credential: PublicKeyCredential,
 ): CredentialAssertionJSON {
-  const response = credential.response as AuthenticatorAssertionResponse
+  const response = credential.response as AuthenticatorAssertionResponse;
   return {
     id: credential.id,
     type: credential.type,
···
         ? arrayBufferToBase64Url(response.userHandle)
         : null,
     },
-  }
+  };
 }

frontend/src/routes/Admin.svelte

···
   import { api, ApiError } from '../lib/api'
   import { _ } from '../lib/i18n'
   import { formatDate, formatDateTime } from '../lib/date'
+  import { unsafeAsDid } from '../lib/types/branded'
   import type { Session } from '../lib/types/api'
   import { toast } from '../lib/toast.svelte'
 
···
     if (!session) return
     userDetailLoading = true
     try {
-      selectedUser = await api.getAccountInfo(session.accessJwt, did)
+      selectedUser = await api.getAccountInfo(session.accessJwt, unsafeAsDid(did))
     } catch (e) {
       toast.error(e instanceof ApiError ? e.message : $_('admin.failedToLoadUserDetails'))
     } finally {
···
     userActionLoading = true
     try {
       if (selectedUser.invitesDisabled) {
-        await api.enableAccountInvites(session.accessJwt, selectedUser.did)
+        await api.enableAccountInvites(session.accessJwt, unsafeAsDid(selectedUser.did))
         selectedUser = { ...selectedUser, invitesDisabled: false }
         toast.success($_('admin.invitesEnabled'))
       } else {
-        await api.disableAccountInvites(session.accessJwt, selectedUser.did)
+        await api.disableAccountInvites(session.accessJwt, unsafeAsDid(selectedUser.did))
         selectedUser = { ...selectedUser, invitesDisabled: true }
         toast.success($_('admin.invitesDisabled'))
       }
···
     if (!confirm($_('admin.deleteConfirm', { values: { handle: selectedUser.handle } }))) return
     userActionLoading = true
     try {
-      await api.adminDeleteAccount(session.accessJwt, selectedUser.did)
+      await api.adminDeleteAccount(session.accessJwt, unsafeAsDid(selectedUser.did))
       users = users.filter(u => u.did !== selectedUser!.did)
       selectedUser = null
       toast.success($_('admin.userDeleted'))
···
       </div>
     </div>
   {/if}
-{:else if auth.loading}
+{:else if authLoading}
   <div class="loading">{$_('admin.loading')}</div>
 {/if}
 <style>

frontend/src/routes/Dashboard.svelte

···
   $effect(() => {
     if (dropdownOpen) {
       document.addEventListener('click', closeDropdown)
-      return () => document.removeEventListener('click', closeDropdown)
+    }
+    return () => {
+      if (dropdownOpen) {
+        document.removeEventListener('click', closeDropdown)
+      }
     }
   })
 </script>

frontend/src/routes/Login.svelte

···
 
   type PageState =
     | { kind: 'login' }
-    | { kind: 'verification'; did: string }
+    | { kind: 'verification'; did: Did }
 
   let pageState = $state<PageState>({ kind: 'login' })
   let submitting = $state(false)

frontend/src/routes/RecoverPasskey.svelte

···
   import { navigate, routes } from '../lib/router.svelte'
   import { api, ApiError } from '../lib/api'
   import { _ } from '../lib/i18n'
+  import { unsafeAsDid } from '../lib/types/branded'
 
   let newPassword = $state('')
   let confirmPassword = $state('')
···
     error = null
 
     try {
-      await api.recoverPasskeyAccount(did, token, newPassword)
+      await api.recoverPasskeyAccount(unsafeAsDid(did), token, newPassword)
       success = true
     } catch (err) {
       if (err instanceof ApiError) {

frontend/src/routes/RegisterPasskey.svelte

···
   import {
     prepareCreationOptions,
     serializeAttestationResponse,
-    type WebAuthnCreationOptionsResponse,
+    type PublicKeyCredentialCreationOptionsJSON,
   } from '../lib/webauthn'
 
   let serverInfo = $state<{
···
         passkeyName || undefined
       )
 
-      const publicKeyOptions = prepareCreationOptions(options as WebAuthnCreationOptionsResponse)
+      const publicKeyOptions = prepareCreationOptions({ publicKey: options as unknown as PublicKeyCredentialCreationOptionsJSON })
       const credential = await navigator.credentials.create({
         publicKey: publicKeyOptions
       })

frontend/src/routes/RepoExplorer.svelte

···
   import { api, ApiError } from '../lib/api'
   import { _, locale } from '../lib/i18n'
   import type { Session } from '../lib/types/api'
+  import { unsafeAsNsid, unsafeAsRkey } from '../lib/types/branded'
 
   const auth = $derived(getAuthState())
 
···
     loading = true
     error = null
     try {
-      const result = await api.listRecords(session.accessJwt, session.did, collection, { limit: 50 })
+      const result = await api.listRecords(session.accessJwt, session.did, unsafeAsNsid(collection), { limit: 50 })
       records = result.records.map(r => ({
         ...r,
         rkey: r.uri.split('/').pop()!
···
     if (!session || !selectedCollection || !recordsCursor || loadingMore) return
     loadingMore = true
     try {
-      const result = await api.listRecords(session.accessJwt, session.did, selectedCollection, {
+      const result = await api.listRecords(session.accessJwt, session.did, unsafeAsNsid(selectedCollection), {
         limit: 50,
         cursor: recordsCursor
       })
···
       const result = await api.createRecord(
         session.accessJwt,
         session.did,
-        newCollection.trim(),
+        unsafeAsNsid(newCollection.trim()),
         record,
-        newRkey.trim() || undefined
+        newRkey.trim() ? unsafeAsRkey(newRkey.trim()) : undefined
       )
       success = $_('repoExplorer.recordCreated', { values: { uri: result.uri } })
       await loadCollections()
···
       await api.putRecord(
         session.accessJwt,
         session.did,
-        selectedCollection,
-        selectedRecord.rkey,
+        unsafeAsNsid(selectedCollection),
+        unsafeAsRkey(selectedRecord.rkey),
         record
       )
       success = $_('repoExplorer.recordUpdated')
       const updated = await api.getRecord(
         session.accessJwt,
         session.did,
-        selectedCollection,
-        selectedRecord.rkey
+        unsafeAsNsid(selectedCollection),
+        unsafeAsRkey(selectedRecord.rkey)
       )
       selectedRecord = { ...updated, rkey: selectedRecord.rkey }
       recordJson = JSON.stringify(updated.value, null, 2)
···
       await api.deleteRecord(
         session.accessJwt,
         session.did,
-        selectedCollection,
-        selectedRecord.rkey
+        unsafeAsNsid(selectedCollection),
+        unsafeAsRkey(selectedRecord.rkey)
       )
       success = $_('repoExplorer.recordDeleted')
       selectedRecord = null

frontend/src/routes/RequestPasskeyRecovery.svelte

···
   import { navigate, routes, getFullUrl } from '../lib/router.svelte'
   import { api, ApiError } from '../lib/api'
   import { _ } from '../lib/i18n'
+  import { unsafeAsEmail } from '../lib/types/branded'
 
   let identifier = $state('')
   let submitting = $state(false)
···
     error = null
 
     try {
-      await api.requestPasskeyRecovery(identifier)
+      await api.requestPasskeyRecovery(unsafeAsEmail(identifier))
       success = true
     } catch (err) {
       if (err instanceof ApiError) {

frontend/src/routes/ResetPassword.svelte

···
   import { getAuthState } from '../lib/auth.svelte'
   import { _ } from '../lib/i18n'
   import type { Session } from '../lib/types/api'
+  import { unsafeAsEmail } from '../lib/types/branded'
 
   const auth = $derived(getAuthState())
 
···
     error = null
     success = null
     try {
-      await api.requestPasswordReset(email)
+      await api.requestPasswordReset(unsafeAsEmail(email))
       tokenSent = true
       success = $_('resetPassword.codeSent')
     } catch (e) {

frontend/src/routes/Security.svelte

···
     addingPasskey = true
     try {
       const { options } = await api.startPasskeyRegistration(session.accessJwt, newPasskeyName || undefined)
-      const publicKeyOptions = prepareCreationOptions(options as WebAuthnCreationOptionsResponse)
+      const publicKeyOptions = prepareCreationOptions(options as unknown as WebAuthnCreationOptionsResponse)
       const credential = await navigator.credentials.create({
         publicKey: publicKeyOptions
       })

frontend/src/routes/Settings.svelte

···
   import { api, ApiError } from '../lib/api'
   import { locale, setLocale, getSupportedLocales, localeNames, _, type SupportedLocale } from '../lib/i18n'
   import { isOk } from '../lib/types/result'
+  import { unsafeAsHandle } from '../lib/types/branded'
   import type { Session } from '../lib/types/api'
   import { toast } from '../lib/toast.svelte'
 
···
       const fullHandle = showBYOHandle
         ? newHandle
         : `${newHandle}.${pdsHostname}`
-      await api.updateHandle(session.accessJwt, fullHandle)
+      await api.updateHandle(session.accessJwt, unsafeAsHandle(fullHandle))
       await refreshSession()
       toast.success($_('settings.messages.handleUpdated'))
       newHandle = ''

frontend/src/routes/Verify.svelte

···
   import { navigate, routes, getFullUrl } from '../lib/router.svelte'
   import { _ } from '../lib/i18n'
   import type { Session } from '../lib/types/api'
+  import { unsafeAsDid, unsafeAsEmail, type Did } from '../lib/types/branded'
 
   const STORAGE_KEY = 'tranquil_pds_pending_verification'
 
   interface PendingVerification {
-    did: string
+    did: Did
     handle: string
     channel: string
   }
···
       const stored = localStorage.getItem(STORAGE_KEY)
       if (stored) {
         try {
-          pendingVerification = JSON.parse(stored)
+          const parsed = JSON.parse(stored)
+          pendingVerification = {
+            did: unsafeAsDid(parsed.did),
+            handle: parsed.handle,
+            channel: parsed.channel,
+          }
         } catch {
           pendingVerification = null
         }
···
       const result = await api.verifyToken(
         verificationCode.trim(),
         identifier.trim(),
-        auth.session?.accessJwt
+        session?.accessJwt
       )
       success = true
       successPurpose = result.purpose
···
   async function handleEmailUpdate() {
     if (!verificationCode.trim() || !newEmail.trim()) return
 
-    if (!auth.session) {
+    if (!session) {
       error = $_('verify.emailUpdateRequiresAuth')
       return
     }
···
     error = null
 
     try {
-      await api.updateEmail(auth.session.accessJwt, newEmail.trim(), verificationCode.trim())
+      await api.updateEmail(session.accessJwt, newEmail.trim(), verificationCode.trim())
       success = true
       successPurpose = 'email-update'
       successChannel = 'email'
···
       error = null
 
       try {
-        await api.resendMigrationVerification(identifier.trim())
+        await api.resendMigrationVerification(unsafeAsEmail(identifier.trim()))
         resendMessage = $_('verify.codeResentDetail')
       } catch (e) {
         error = e instanceof Error ? e.message : 'Failed to resend verification'
···
     <h1>{$_('verify.emailUpdateTitle')}</h1>
     <p class="subtitle">{$_('verify.emailUpdateSubtitle')}</p>
 
-    {#if !auth.session}
+    {#if !session}
       <div class="message warning">{$_('verify.emailUpdateRequiresAuth')}</div>
       <div class="actions">
         <a href="/app/login" class="btn">{$_('verify.signIn')}</a>

frontend/src/tests/AppPasswords.test.ts

···
   setupAuthenticatedUser,
   setupFetchMock,
   setupUnauthenticatedUser,
-} from "./mocks";
+} from "./mocks.ts";
+import { unsafeAsISODateString } from "../lib/types/branded.ts";
 describe("AppPasswords", () => {
   beforeEach(() => {
     clearMocks();
···
     const testPasswords = [
       mockData.appPassword({
         name: "Graysky",
-        createdAt: "2024-01-15T10:00:00Z",
+        createdAt: unsafeAsISODateString("2024-01-15T10:00:00Z"),
       }),
       mockData.appPassword({
         name: "Skeets",
-        createdAt: "2024-02-20T15:30:00Z",
+        createdAt: unsafeAsISODateString("2024-02-20T15:30:00Z"),
       }),
     ];
     beforeEach(() => {

frontend/src/tests/Login.test.ts

···
   mockData,
   mockEndpoint,
   setupFetchMock,
-} from "./mocks";
-import { _testSetState, type SavedAccount } from "../lib/auth.svelte";
+} from "./mocks.ts";
+import { _testSetState, type SavedAccount } from "../lib/auth.svelte.ts";
+import {
+  unsafeAsAccessToken,
+  unsafeAsDid,
+  unsafeAsHandle,
+  unsafeAsRefreshToken,
+} from "../lib/types/branded.ts";
 
 describe("Login", () => {
   beforeEach(() => {
···
   describe("with saved accounts", () => {
     const savedAccounts: SavedAccount[] = [
       {
-        did: "did:web:test.tranquil.dev:u:alice",
-        handle: "alice.test.tranquil.dev",
-        accessJwt: "mock-jwt-alice",
-        refreshJwt: "mock-refresh-alice",
+        did: unsafeAsDid("did:web:test.tranquil.dev:u:alice"),
+        handle: unsafeAsHandle("alice.test.tranquil.dev"),
+        accessJwt: unsafeAsAccessToken("mock-jwt-alice"),
+        refreshJwt: unsafeAsRefreshToken("mock-refresh-alice"),
       },
       {
-        did: "did:web:test.tranquil.dev:u:bob",
-        handle: "bob.test.tranquil.dev",
-        accessJwt: "mock-jwt-bob",
-        refreshJwt: "mock-refresh-bob",
+        did: unsafeAsDid("did:web:test.tranquil.dev:u:bob"),
+        handle: unsafeAsHandle("bob.test.tranquil.dev"),
+        accessJwt: unsafeAsAccessToken("mock-jwt-bob"),
+        refreshJwt: unsafeAsRefreshToken("mock-refresh-bob"),
       },
     ];
 
···
       mockEndpoint(
         "com.atproto.server.getSession",
         () =>
-          jsonResponse(mockData.session({ handle: "alice.test.tranquil.dev" })),
+          jsonResponse(
+            mockData.session({
+              handle: unsafeAsHandle("alice.test.tranquil.dev"),
+            }),
+          ),
       );
     });
 

frontend/src/tests/migration/storage.test.ts

···
   setError,
   updateProgress,
   updateStep,
-} from "../../lib/migration/storage";
+} from "../../lib/migration/storage.ts";
 import type {
   InboundMigrationState,
-  OutboundMigrationState,
-} from "../../lib/migration/types";
+  MigrationState,
+} from "../../lib/migration/types.ts";
+
+interface OutboundMigrationState {
+  direction: "outbound";
+  step: string;
+  localDid: string;
+  localHandle: string;
+  targetPdsUrl: string;
+  targetPdsDid: string;
+  targetHandle: string;
+  targetEmail: string;
+  targetPassword: string;
+  inviteCode: string;
+  targetAccessToken: string | null;
+  targetRefreshToken: string | null;
+  serviceAuthToken: string | null;
+  plcToken: string;
+  progress: {
+    repoExported: boolean;
+    repoImported: boolean;
+    blobsTotal: number;
+    blobsMigrated: number;
+    blobsFailed: string[];
+    prefsMigrated: boolean;
+    plcSigned: boolean;
+    activated: boolean;
+    deactivated: boolean;
+    currentOperation: string;
+  };
+  error: string | null;
+  targetServerInfo: unknown;
+}
 
 const STORAGE_KEY = "tranquil_migration_state";
 const DPOP_KEY_STORAGE = "migration_dpop_key";
···
         step: "review",
       });
 
-      saveMigrationState(state);
+      saveMigrationState(state as unknown as MigrationState);
 
       const stored = JSON.parse(localStorage.getItem(STORAGE_KEY)!);
       expect(stored.version).toBe(1);

frontend/src/tests/mocks.ts

···
 import { vi } from "vitest";
-import type { AppPassword, InviteCode, Session } from "../lib/api";
-import { _testSetState } from "../lib/auth.svelte";
+import type { AppPassword, InviteCode, Session } from "../lib/api.ts";
+import { _testSetState } from "../lib/auth.svelte.ts";
+import {
+  unsafeAsAccessToken,
+  unsafeAsDid,
+  unsafeAsEmail,
+  unsafeAsHandle,
+  unsafeAsInviteCode,
+  unsafeAsISODateString,
+  unsafeAsRefreshToken,
+} from "../lib/types/branded.ts";
 
 const originalPushState = globalThis.history.pushState.bind(globalThis.history);
 const originalReplaceState = globalThis.history.replaceState.bind(
···
 }
 export const mockData = {
   session: (overrides?: Partial<Session>): Session => ({
-    did: "did:web:test.tranquil.dev:u:testuser",
-    handle: "testuser.test.tranquil.dev",
-    email: "[e-mail]",
+    did: unsafeAsDid("did:web:test.tranquil.dev:u:testuser"),
+    handle: unsafeAsHandle("testuser.test.tranquil.dev"),
+    email: unsafeAsEmail("[e-mail]"),
     emailConfirmed: true,
-    accessJwt: "mock-access-jwt-token",
-    refreshJwt: "mock-refresh-jwt-token",
+    accessJwt: unsafeAsAccessToken("mock-access-jwt-token"),
+    refreshJwt: unsafeAsRefreshToken("mock-refresh-jwt-token"),
     ...overrides,
   }),
   appPassword: (overrides?: Partial<AppPassword>): AppPassword => ({
     name: "Test App",
-    createdAt: new Date().toISOString(),
+    createdAt: unsafeAsISODateString(new Date().toISOString()),
     ...overrides,
   }),
   inviteCode: (overrides?: Partial<InviteCode>): InviteCode => ({
-    code: "test-invite-123",
+    code: unsafeAsInviteCode("test-invite-123"),
     available: 1,
     disabled: false,
-    forAccount: "did:web:test.tranquil.dev:u:testuser",
-    createdBy: "did:web:test.tranquil.dev:u:testuser",
-    createdAt: new Date().toISOString(),
+    forAccount: unsafeAsDid("did:web:test.tranquil.dev:u:testuser"),
+    createdBy: unsafeAsDid("did:web:test.tranquil.dev:u:testuser"),
+    createdAt: unsafeAsISODateString(new Date().toISOString()),
     uses: [],
     ...overrides,
   }),

frontend/src/tests/utils.ts

···
-import { render, type RenderResult } from "@testing-library/svelte";
+import { render } from "@testing-library/svelte";
 import { tick } from "svelte";
 import type { ComponentType } from "svelte";
 
-export async function renderAndWait<T extends ComponentType>(
-  component: T,
+export async function renderAndWait(
+  component: ComponentType,
   options?: Parameters<typeof render>[1],
-): Promise<RenderResult<T>> {
+) {
   const result = render(component, options);
   await tick();
   await new Promise((resolve) => setTimeout(resolve, 0));

frontend/tsconfig.json

···
+{
+  "compilerOptions": {
+    "target": "ESNext",
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "lib": ["ESNext", "DOM", "DOM.Iterable"],
+    "types": ["svelte", "vite/client"],
+    "strict": true,
+    "noImplicitAny": true,
+    "strictNullChecks": true,
+    "strictFunctionTypes": true,
+    "strictBindCallApply": true,
+    "strictPropertyInitialization": true,
+    "noImplicitThis": true,
+    "useUnknownInCatchVariables": true,
+    "alwaysStrict": true,
+    "noUnusedLocals": false,
+    "noUnusedParameters": false,
+    "noImplicitReturns": true,
+    "noFallthroughCasesInSwitch": true,
+    "noImplicitOverride": true,
+    "allowImportingTsExtensions": true,
+    "resolveJsonModule": true,
+    "isolatedModules": true,
+    "verbatimModuleSyntax": true,
+    "skipLibCheck": true,
+    "noEmit": true
+  },
+  "include": ["src/**/*"],
+  "exclude": ["node_modules", "dist"]
+}

justfile

···
     . ~/.deno/env && cd frontend && deno task dev
 frontend-build:
     . ~/.deno/env && cd frontend && deno task build
+frontend-check:
+    . ~/.deno/env && cd frontend && deno task check
 frontend-clean:
     rm -rf frontend/dist frontend/node_modules
 

src/api/actor/preferences.rs

···
     let prefs = match prefs_result {
         Ok(rows) => rows,
         Err(_) => {
-            return ApiError::InternalError(Some("Failed to fetch preferences".into())).into_response();
+            return ApiError::InternalError(Some("Failed to fetch preferences".into()))
+                .into_response();
         }
     };
     let mut personal_details_pref: Option<Value> = None;
···
     let mut tx = match state.db.begin().await {
         Ok(tx) => tx,
         Err(_) => {
-            return ApiError::InternalError(Some("Failed to start transaction".into())).into_response();
+            return ApiError::InternalError(Some("Failed to start transaction".into()))
+                .into_response();
         }
     };
     let delete_result = sqlx::query!(
···
         .await;
         if insert_result.is_err() {
             let _ = tx.rollback().await;
-            return ApiError::InternalError(Some("Failed to save preference".into())).into_response();
+            return ApiError::InternalError(Some("Failed to save preference".into()))
+                .into_response();
         }
     }
     if tx.commit().await.is_err() {
-        return ApiError::InternalError(Some("Failed to commit transaction".into())).into_response();
+        return ApiError::InternalError(Some("Failed to commit transaction".into()))
+            .into_response();
     }
     StatusCode::OK.into_response()
 }

src/api/admin/account/delete.rs

···
-use crate::api::error::ApiError;
 use crate::api::EmptyResponse;
+use crate::api::error::ApiError;
 use crate::auth::BearerAuthAdmin;
 use crate::state::AppState;
 use crate::types::Did;
···
         .await
     {
         error!("Failed to delete session tokens for {}: {:?}", did, e);
-        return ApiError::InternalError(Some("Failed to delete session tokens".into())).into_response();
+        return ApiError::InternalError(Some("Failed to delete session tokens".into()))
+            .into_response();
     }
     if let Err(e) = sqlx::query!("DELETE FROM used_refresh_tokens WHERE session_id IN (SELECT id FROM session_tokens WHERE did = $1)", did.as_str())
         .execute(&mut *tx)
···
             "Failed to delete app passwords for user {}: {:?}",
             user_id, e
         );
-        return ApiError::InternalError(Some("Failed to delete app passwords".into())).into_response();
+        return ApiError::InternalError(Some("Failed to delete app passwords".into()))
+            .into_response();
     }
     if let Err(e) = sqlx::query!(
         "DELETE FROM invite_code_uses WHERE used_by_user = $1",
···
         error!("Failed to commit account deletion transaction: {:?}", e);
         return ApiError::InternalError(Some("Failed to commit deletion".into())).into_response();
     }
-    if let Err(e) =
-        crate::api::repo::record::sequence_account_event(&state, did.as_str(), false, Some("deleted")).await
+    if let Err(e) = crate::api::repo::record::sequence_account_event(
+        &state,
+        did.as_str(),
+        false,
+        Some("deleted"),
+    )
+    .await
     {
         warn!(
             "Failed to sequence account deletion event for {}: {}",

src/api/admin/account/email.rs

···
     let result = crate::comms::enqueue_comms(&state.db, item).await;
     match result {
         Ok(_) => {
-            tracing::info!("Admin email queued for {} ({})", handle, input.recipient_did);
+            tracing::info!(
+                "Admin email queued for {} ({})",
+                handle,
+                input.recipient_did
+            );
             (StatusCode::OK, Json(SendEmailOutput { sent: true })).into_response()
         }
         Err(e) => {

src/api/admin/account/update.rs

···
-use crate::api::error::ApiError;
 use crate::api::EmptyResponse;
+use crate::api::error::ApiError;
 use crate::auth::BearerAuthAdmin;
 use crate::state::AppState;
 use crate::types::{Did, PlainPassword};
···
     if let Ok(Some(_)) = existing {
         return ApiError::HandleTaken.into_response();
     }
-    let result = sqlx::query!("UPDATE users SET handle = $1 WHERE did = $2", handle, did.as_str())
-        .execute(&state.db)
-        .await;
+    let result = sqlx::query!(
+        "UPDATE users SET handle = $1 WHERE did = $2",
+        handle,
+        did.as_str()
+    )
+    .execute(&state.db)
+    .await;
     match result {
         Ok(r) => {
             if r.rows_affected() == 0 {
···
                 let _ = state.cache.delete(&format!("handle:{}", old)).await;
             }
             let _ = state.cache.delete(&format!("handle:{}", handle)).await;
-            if let Err(e) =
-                crate::api::repo::record::sequence_identity_event(&state, did.as_str(), Some(&handle)).await
+            if let Err(e) = crate::api::repo::record::sequence_identity_event(
+                &state,
+                did.as_str(),
+                Some(&handle),
+            )
+            .await
             {
                 warn!(
                     "Failed to sequence identity event for admin handle update: {}",
                     e
                 );
             }
-            if let Err(e) = crate::api::identity::did::update_plc_handle(&state, did.as_str(), &handle).await
+            if let Err(e) =
+                crate::api::identity::did::update_plc_handle(&state, did.as_str(), &handle).await
             {
                 warn!("Failed to update PLC handle for admin handle update: {}", e);
             }

src/api/admin/status.rs

···
         let did = match &params.did {
             Some(d) => d,
             None => {
-                return ApiError::InvalidRequest(
-                    "Must provide a did to request blob state".into(),
-                )
-                .into_response();
+                return ApiError::InvalidRequest("Must provide a did to request blob state".into())
+                    .into_response();
             }
         };
         let blob = sqlx::query!(

src/api/age_assurance.rs

···
         }
     };
 
-    let row = match sqlx::query!("SELECT created_at FROM users WHERE did = $1", &auth_user.did)
-        .fetch_optional(&state.db)
-        .await
+    let row = match sqlx::query!(
+        "SELECT created_at FROM users WHERE did = $1",
+        &auth_user.did
+    )
+    .fetch_optional(&state.db)
+    .await
     {
         Ok(r) => {
             tracing::debug!(?r, "age assurance: query result");

src/api/backup.rs

···
         Ok(bytes) => bytes,
         Err(e) => {
             error!("Failed to fetch backup from storage: {:?}", e);
-            return ApiError::InternalError(Some("Failed to retrieve backup".into())).into_response();
+            return ApiError::InternalError(Some("Failed to retrieve backup".into()))
+                .into_response();
         }
     };
 
···
         Ok(bytes) => bytes,
         Err(e) => {
             error!("Failed to generate CAR: {:?}", e);
-            return ApiError::InternalError(Some("Failed to generate backup".into())).into_response();
+            return ApiError::InternalError(Some("Failed to generate backup".into()))
+                .into_response();
         }
     };
 
···
 
     info!(did = %auth.0.did, enabled = input.enabled, "Updated backup_enabled setting");
 
-    EnabledResponse::new(input.enabled).into_response()
+    EnabledResponse::response(input.enabled).into_response()
 }
 
 pub async fn export_blobs(State(state): State<AppState>, auth: BearerAuth) -> Response {
···
 
         if let Err(e) = zip.finish() {
             error!("Failed to finish zip: {:?}", e);
-            return ApiError::InternalError(Some("Failed to create zip file".into())).into_response();
+            return ApiError::InternalError(Some("Failed to create zip file".into()))
+                .into_response();
         }
     }
 

src/api/delegation.rs

···
         Ok(c) => c,
         Err(e) => {
             tracing::error!("Failed to list controllers: {:?}", e);
-            return ApiError::InternalError(Some("Failed to list controllers".into())).into_response();
+            return ApiError::InternalError(Some("Failed to list controllers".into()))
+                .into_response();
         }
     };
 
···
         Ok(false) => ApiError::DelegationNotFound.into_response(),
         Err(e) => {
             tracing::error!("Failed to update controller scopes: {:?}", e);
-            ApiError::InternalError(Some("Failed to update controller scopes".into())).into_response()
+            ApiError::InternalError(Some("Failed to update controller scopes".into()))
+                .into_response()
         }
     }
 }
···
             Ok(e) => e,
             Err(e) => {
                 tracing::error!("Failed to get audit log: {:?}", e);
-                return ApiError::InternalError(Some("Failed to get audit log".into())).into_response();
+                return ApiError::InternalError(Some("Failed to get audit log".into()))
+                    .into_response();
             }
         };
 
···
 
     info!(did = %did, handle = %handle, controller = %&auth.0.did, "Delegated account created");
 
-    Json(CreateDelegatedAccountResponse { did: did.into(), handle: handle.into() }).into_response()
+    Json(CreateDelegatedAccountResponse {
+        did: did.into(),
+        handle: handle.into(),
+    })
+    .into_response()
 }

src/api/error.rs

···
             Self::UpstreamFailure | Self::UpstreamUnavailable(_) | Self::UpstreamErrorMsg(_) => {
                 StatusCode::BAD_GATEWAY
             }
-            Self::ServiceUnavailable(_) | Self::BackupsDisabled => {
-                StatusCode::SERVICE_UNAVAILABLE
-            }
+            Self::ServiceUnavailable(_) | Self::BackupsDisabled => StatusCode::SERVICE_UNAVAILABLE,
             Self::UpstreamTimeout => StatusCode::GATEWAY_TIMEOUT,
             Self::UpstreamError { status, .. } => {
                 StatusCode::from_u16(*status).unwrap_or(StatusCode::BAD_GATEWAY)
···
             | Self::SubjectNotFound
             | Self::BlobNotFound(_)
             | Self::NotFoundMsg(_) => StatusCode::NOT_FOUND,
-            Self::RepoTakendown
-            | Self::RepoDeactivated
-            | Self::RepoNotFound(_) => StatusCode::BAD_REQUEST,
-            Self::InvalidSwap(_) | Self::TotpAlreadyEnabled => {
-                StatusCode::CONFLICT
+            Self::RepoTakendown | Self::RepoDeactivated | Self::RepoNotFound(_) => {
+                StatusCode::BAD_REQUEST
             }
+            Self::InvalidSwap(_) | Self::TotpAlreadyEnabled => StatusCode::CONFLICT,
             Self::InvalidRequest(_)
             | Self::InvalidHandle(_)
             | Self::HandleNotAvailable(_)
···
     }
 }
 
-
 impl From<sqlx::Error> for ApiError {
     fn from(e: sqlx::Error) -> Self {
         tracing::error!("Database error: {:?}", e);
···
             VerifyError::UnsupportedVersion => {
                 Self::InvalidRequest("This verification code version is not supported".to_string())
             }
-            VerifyError::Expired => {
-                Self::InvalidRequest("The verification code has expired. Please request a new one.".to_string())
-            }
+            VerifyError::Expired => Self::InvalidRequest(
+                "The verification code has expired. Please request a new one.".to_string(),
+            ),
             VerifyError::InvalidSignature => {
                 Self::InvalidRequest("The verification code is invalid".to_string())
             }
···
             PlcError::NotFound => Self::NotFoundMsg("DID not found in PLC directory".into()),
             PlcError::Tombstoned => Self::InvalidRequest("DID is tombstoned".into()),
             PlcError::Timeout => Self::UpstreamTimeout,
-            PlcError::CircuitBreakerOpen => {
-                Self::ServiceUnavailable(Some("PLC directory service temporarily unavailable".into()))
-            }
+            PlcError::CircuitBreakerOpen => Self::ServiceUnavailable(Some(
+                "PLC directory service temporarily unavailable".into(),
+            )),
             PlcError::Http(err) => {
                 tracing::error!("PLC HTTP error: {:?}", err);
                 Self::UpstreamErrorMsg("Failed to communicate with PLC directory".into())

src/api/identity/account.rs

···
     http::{HeaderMap, StatusCode},
     response::{IntoResponse, Response},
 };
-use serde_json::json;
 use bcrypt::{DEFAULT_COST, hash};
 use jacquard::types::{integer::LimitedU32, string::Tid};
 use jacquard_repo::{mst::Mst, storage::BlockStore};
 use k256::{SecretKey, ecdsa::SigningKey};
 use rand::rngs::OsRng;
 use serde::{Deserialize, Serialize};
+use serde_json::json;
 use std::sync::Arc;
 use tracing::{debug, error, info, warn};
 
···
         .await
     {
         warn!(ip = %client_ip, "Account creation rate limit exceeded");
-        return ApiError::RateLimitExceeded(Some("Too many account creation attempts. Please try again later.".into(),))
+        return ApiError::RateLimitExceeded(Some(
+            "Too many account creation attempts. Please try again later.".into(),
+        ))
         .into_response();
     }
 

src/api/identity/did.rs

···
     }
     let cache_key = format!("handle:{}", handle);
     if let Some(did) = state.cache.get(&cache_key).await {
-        return DidResponse::new(did).into_response();
+        return DidResponse::response(did).into_response();
     }
     let user = sqlx::query!("SELECT did FROM users WHERE handle = $1", handle)
         .fetch_optional(&state.db)
···
                 .cache
                 .set(&cache_key, &row.did, std::time::Duration::from_secs(300))
                 .await;
-            DidResponse::new(row.did).into_response()
+            DidResponse::response(row.did).into_response()
         }
         Ok(None) => match crate::handle::resolve_handle(handle).await {
             Ok(did) => {
···
                     .cache
                     .set(&cache_key, &did, std::time::Duration::from_secs(300))
                     .await;
-                DidResponse::new(did).into_response()
+                DidResponse::response(did).into_response()
             }
             Err(_) => ApiError::HandleNotFound.into_response(),
         },
···
         .check_rate_limit(crate::state::RateLimitKind::HandleUpdate, &did)
         .await
     {
-        return ApiError::RateLimitExceeded(Some("Too many handle updates. Try again later.".into(),))
+        return ApiError::RateLimitExceeded(Some(
+            "Too many handle updates. Try again later.".into(),
+        ))
         .into_response();
     }
     if !state
···
                 .into_response();
         }
         if segment.starts_with('-') || segment.ends_with('-') {
-            return ApiError::InvalidHandle(Some("Handle segment cannot start or end with hyphen".into(),))
-        .into_response();
+            return ApiError::InvalidHandle(Some(
+                "Handle segment cannot start or end with hyphen".into(),
+            ))
+            .into_response();
         }
     }
     if crate::moderation::has_explicit_slur(&new_handle) {
···
             return EmptyResponse::ok().into_response();
         }
         if short_part.contains('.') {
-            return ApiError::InvalidHandle(Some("Nested subdomains are not allowed. Use a simple handle without dots.".into(),))
-        .into_response();
+            return ApiError::InvalidHandle(Some(
+                "Nested subdomains are not allowed. Use a simple handle without dots.".into(),
+            ))
+            .into_response();
         }
         if short_part.len() < 3 {
             return ApiError::InvalidHandle(Some("Handle too short".into())).into_response();
···
                 return ApiError::HandleNotAvailable(None).into_response();
             }
             Err(crate::handle::HandleResolutionError::DidMismatch { expected, actual }) => {
-                return ApiError::HandleNotAvailable(Some(
-                    format!("Handle points to different DID. Expected {}, got {}", expected, actual),
-                ))
+                return ApiError::HandleNotAvailable(Some(format!(
+                    "Handle points to different DID. Expected {}, got {}",
+                    expected, actual
+                )))
                 .into_response();
             }
             Err(e) => {

src/api/identity/plc/sign.rs

···
     {
         Ok(Some(row)) => row,
         _ => {
-            return ApiError::InternalError(Some("User signing key not found".into())).into_response();
+            return ApiError::InternalError(Some("User signing key not found".into()))
+                .into_response();
         }
     };
     let key_bytes = match crate::config::decrypt_key(&key_row.key_bytes, key_row.encryption_version)

src/api/identity/plc/submit.rs

···
     {
         Ok(Some(row)) => row,
         _ => {
-            return ApiError::InternalError(Some("User signing key not found".into())).into_response();
+            return ApiError::InternalError(Some("User signing key not found".into()))
+                .into_response();
         }
     };
     let key_bytes = match crate::config::decrypt_key(&key_row.key_bytes, key_row.encryption_version)

src/api/mod.rs

···
 pub mod verification;
 
 pub use error::ApiError;
+pub use proxy_client::{AtUriParts, proxy_client, validate_at_uri, validate_did, validate_limit};
 pub use responses::{
     DidResponse, EmptyResponse, EnabledResponse, HasPasswordResponse, OptionsResponse,
     StatusResponse, SuccessResponse, TokenRequiredResponse, VerifiedResponse,
 };
-pub use proxy_client::{AtUriParts, proxy_client, validate_at_uri, validate_did, validate_limit};

src/api/moderation/mod.rs

···
                 }
                 Err(e) => {
                     error!(error = ?e, "DB error fetching user key for report");
-                    return ApiError::AuthenticationFailed(Some("Failed to get signing key".into()))
-                        .into_response();
+                    return ApiError::AuthenticationFailed(Some(
+                        "Failed to get signing key".into(),
+                    ))
+                    .into_response();
                 }
             }
         }

src/api/notification_prefs.rs

···
             return ApiError::AuthenticationFailed(None).into_response();
         }
     };
-    let row =
-        match sqlx::query(
-            r#"
+    let row = match sqlx::query(
+        r#"
         SELECT
             email,
             preferred_comms_channel::text as channel,
···
         FROM users
         WHERE did = $1
         "#,
-        )
-        .bind(&user.did)
-        .fetch_one(&state.db)
-        .await
-        {
-            Ok(r) => r,
-            Err(e) => {
-                return ApiError::InternalError(Some(format!("Database error: {}", e))).into_response()
-            }
-        };
+    )
+    .bind(&user.did)
+    .fetch_one(&state.db)
+    .await
+    {
+        Ok(r) => r,
+        Err(e) => {
+            return ApiError::InternalError(Some(format!("Database error: {}", e))).into_response();
+        }
+    };
     let email: String = row.get("email");
     let channel: String = row.get("channel");
     let discord_id: Option<String> = row.get("discord_id");
···
         {
             Ok(id) => id,
             Err(e) => {
-                return ApiError::InternalError(Some(format!("Database error: {}", e))).into_response()
+                return ApiError::InternalError(Some(format!("Database error: {}", e)))
+                    .into_response();
             }
         };
 
-    let rows =
-        match sqlx::query!(
-            r#"
+    let rows = match sqlx::query!(
+        r#"
         SELECT
             created_at,
             channel as "channel: String",
···
         ORDER BY created_at DESC
         LIMIT 50
         "#,
-            user_id
-        )
-        .fetch_all(&state.db)
-        .await
-        {
-            Ok(r) => r,
-            Err(e) => {
-                return ApiError::InternalError(Some(format!("Database error: {}", e))).into_response()
-            }
-        };
+        user_id
+    )
+    .fetch_all(&state.db)
+    .await
+    {
+        Ok(r) => r,
+        Err(e) => {
+            return ApiError::InternalError(Some(format!("Database error: {}", e))).into_response();
+        }
+    };
 
     let sensitive_types = [
         "email_verification",
···
         }
     };
 
-    let user_row =
-        match sqlx::query!(
-            "SELECT id, handle, email FROM users WHERE did = $1",
-            &user.did
-        )
-        .fetch_one(&state.db)
-        .await
-        {
-            Ok(row) => row,
-            Err(e) => {
-                return ApiError::InternalError(Some(format!("Database error: {}", e))).into_response()
-            }
-        };
+    let user_row = match sqlx::query!(
+        "SELECT id, handle, email FROM users WHERE did = $1",
+        &user.did
+    )
+    .fetch_one(&state.db)
+    .await
+    {
+        Ok(row) => row,
+        Err(e) => {
+            return ApiError::InternalError(Some(format!("Database error: {}", e))).into_response();
+        }
+    };
 
     let user_id = user_row.id;
     let handle = user_row.handle;

src/api/proxy.rs

···
 ) -> Response {
     // This layer is nested under /xrpc in an axum router so the extracted uri will look like /<method> and thus we can just strip the /
     let method = uri.path().trim_start_matches("/");
-    if is_protected_method(&method) {
+    if is_protected_method(method) {
         warn!(method = %method, "Attempted to proxy protected method");
         return ApiError::InvalidRequest(format!("Cannot proxy protected method: {}", method))
             .into_response();
···
                     auth_user.is_oauth,
                     auth_user.scope.as_deref(),
                     &resolved.did,
-                    &method,
+                    method,
                 ) {
                     return e;
                 }
···
                     match crate::auth::create_service_token(
                         &auth_user.did,
                         &resolved.did,
-                        &method,
+                        method,
                         &key_bytes,
                     ) {
                         Ok(new_token) => {

src/api/repo/blob.rs

···
             );
         }
         detected
+    } else if client_hint == "*/*" || client_hint.is_empty() {
+        warn!(
+            "Could not detect MIME type and client sent invalid hint: '{}'",
+            client_hint
+        );
+        "application/octet-stream".to_string()
     } else {
-        if client_hint == "*/*" || client_hint.is_empty() {
-            warn!("Could not detect MIME type and client sent invalid hint: '{}'", client_hint);
-            "application/octet-stream".to_string()
-        } else {
-            client_hint.to_string()
-        }
+        client_hint.to_string()
     }
 }
 

src/api/repo/import.rs

···
+use crate::api::EmptyResponse;
 use crate::api::error::ApiError;
 use crate::api::repo::record::create_signed_commit;
-use crate::api::EmptyResponse;
 use crate::state::AppState;
 use crate::sync::import::{ImportError, apply_import, parse_car};
 use crate::sync::verify::CarVerifier;
···
             ApiError::InvalidRequest(format!("Referenced block not found in CAR: {}", cid))
                 .into_response()
         }
-        Err(ImportError::ConcurrentModification) => ApiError::InvalidSwap(Some("Repository is being modified by another operation, please retry".into(),))
+        Err(ImportError::ConcurrentModification) => ApiError::InvalidSwap(Some(
+            "Repository is being modified by another operation, please retry".into(),
+        ))
         .into_response(),
         Err(ImportError::VerificationFailed(ve)) => {
             ApiError::InvalidRequest(format!("CAR verification failed: {}", ve)).into_response()
         }
-        Err(ImportError::DidMismatch { car_did, auth_did }) => {
-            ApiError::InvalidRequest(format!(
-                "CAR is for {} but authenticated as {}",
-                car_did, auth_did
-            ))
-            .into_response()
-        }
+        Err(ImportError::DidMismatch { car_did, auth_did }) => ApiError::InvalidRequest(format!(
+            "CAR is for {} but authenticated as {}",
+            car_did, auth_did
+        ))
+        .into_response(),
         Err(e) => {
             error!("Import error: {:?}", e);
             ApiError::InternalError(None).into_response()

src/api/repo/record/batch.rs

···
         }
     }
 
-    let user_id: uuid::Uuid = match sqlx::query_scalar!("SELECT id FROM users WHERE did = $1", did.as_str())
-        .fetch_optional(&state.db)
-        .await
-    {
-        Ok(Some(id)) => id,
-        _ => return ApiError::InternalError(Some("User not found".into())).into_response(),
-    };
+    let user_id: uuid::Uuid =
+        match sqlx::query_scalar!("SELECT id FROM users WHERE did = $1", did.as_str())
+            .fetch_optional(&state.db)
+            .await
+        {
+            Ok(Some(id)) => id,
+            _ => return ApiError::InternalError(Some("User not found".into())).into_response(),
+        };
     let root_cid_str: String = match sqlx::query_scalar!(
         "SELECT repo_root_cid FROM repos WHERE user_id = $1",
         user_id
···
     let current_root_cid = match Cid::from_str(&root_cid_str) {
         Ok(c) => c,
         Err(_) => {
-            return ApiError::InternalError(Some("Invalid repo root CID".into())).into_response()
+            return ApiError::InternalError(Some("Invalid repo root CID".into())).into_response();
         }
     };
     if let Some(swap_commit) = &input.swap_commit
···
                     Ok(c) => c,
                     Err(_) => {
                         return ApiError::InternalError(Some("Failed to store record".into()))
-                            .into_response()
+                            .into_response();
                     }
                 };
                 let key = format!("{}/{}", collection, rkey);
···
                     Ok(m) => m,
                     Err(_) => {
                         return ApiError::InternalError(Some("Failed to add to MST".into()))
-                            .into_response()
+                            .into_response();
                     }
                 };
                 let uri = AtUri::from_parts(&did, collection, &rkey);
···
                     Ok(c) => c,
                     Err(_) => {
                         return ApiError::InternalError(Some("Failed to store record".into()))
-                            .into_response()
+                            .into_response();
                     }
                 };
                 let key = format!("{}/{}", collection, rkey);
···
                     Ok(m) => m,
                     Err(_) => {
                         return ApiError::InternalError(Some("Failed to update MST".into()))
-                            .into_response()
+                            .into_response();
                     }
                 };
                 let uri = AtUri::from_parts(&did, collection, rkey);
···
                     Ok(m) => m,
                     Err(_) => {
                         return ApiError::InternalError(Some("Failed to delete from MST".into()))
-                            .into_response()
+                            .into_response();
                     }
                 };
                 results.push(WriteResult::DeleteResult {});
···
     }
     let new_mst_root = match mst.persist().await {
         Ok(c) => c,
-        Err(_) => return ApiError::InternalError(Some("Failed to persist MST".into())).into_response(),
+        Err(_) => {
+            return ApiError::InternalError(Some("Failed to persist MST".into())).into_response();
+        }
     };
     let mut relevant_blocks = std::collections::BTreeMap::new();
     for key in &modified_keys {
···
         Ok(res) => res,
         Err(e) => {
             error!("Commit failed: {}", e);
-            return ApiError::InternalError(Some("Failed to commit changes".into())).into_response();
+            return ApiError::InternalError(Some("Failed to commit changes".into()))
+                .into_response();
         }
     };
 

src/api/repo/record/delete.rs

···
         let expected_cid = Cid::from_str(swap_record_str).ok();
         let actual_cid = mst.get(&key).await.ok().flatten();
         if expected_cid != actual_cid {
-            return ApiError::InvalidSwap(Some("Record has been modified or does not exist".into()))
-                .into_response();
+            return ApiError::InvalidSwap(Some(
+                "Record has been modified or does not exist".into(),
+            ))
+            .into_response();
         }
     }
     let prev_record_cid = mst.get(&key).await.ok().flatten();

src/api/repo/record/write.rs

···
         ApiError::InternalError(None).into_response()
     })?
     .ok_or_else(|| ApiError::InternalError(Some("Repo root not found".into())).into_response())?;
-    let current_root_cid = Cid::from_str(&root_cid_str)
-        .map_err(|_| ApiError::InternalError(Some("Invalid repo root CID".into())).into_response())?;
+    let current_root_cid = Cid::from_str(&root_cid_str).map_err(|_| {
+        ApiError::InternalError(Some("Invalid repo root CID".into())).into_response()
+    })?;
     Ok(RepoWriteAuth {
         did: auth_user.did.clone(),
         user_id,
···
     let record_cid = match tracking_store.put(&record_bytes).await {
         Ok(c) => c,
         _ => {
-            return ApiError::InternalError(Some("Failed to save record block".into())).into_response()
+            return ApiError::InternalError(Some("Failed to save record block".into()))
+                .into_response();
         }
     };
     let key = format!("{}/{}", input.collection, rkey);
···
         let expected_cid = Cid::from_str(swap_record_str).ok();
         let actual_cid = mst.get(&key).await.ok().flatten();
         if expected_cid != actual_cid {
-            return ApiError::InvalidSwap(Some("Record has been modified or does not exist".into()))
-                .into_response();
+            return ApiError::InvalidSwap(Some(
+                "Record has been modified or does not exist".into(),
+            ))
+            .into_response();
         }
     }
     let existing_cid = mst.get(&key).await.ok().flatten();
···
     let record_cid = match tracking_store.put(&record_bytes).await {
         Ok(c) => c,
         _ => {
-            return ApiError::InternalError(Some("Failed to save record block".into())).into_response()
+            return ApiError::InternalError(Some("Failed to save record block".into()))
+                .into_response();
         }
     };
     if existing_cid == Some(record_cid) {
···
         match mst.update(&key, record_cid).await {
             Ok(m) => m,
             Err(_) => {
-                return ApiError::InternalError(Some("Failed to update MST".into())).into_response()
+                return ApiError::InternalError(Some("Failed to update MST".into()))
+                    .into_response();
             }
         }
     } else {
         match mst.add(&key, record_cid).await {
             Ok(m) => m,
             Err(_) => {
-                return ApiError::InternalError(Some("Failed to add to MST".into())).into_response()
+                return ApiError::InternalError(Some("Failed to add to MST".into()))
+                    .into_response();
             }
         }
     };
     let new_mst_root = match new_mst.persist().await {
         Ok(c) => c,
         Err(_) => {
-            return ApiError::InternalError(Some("Failed to persist MST".into())).into_response()
+            return ApiError::InternalError(Some("Failed to persist MST".into())).into_response();
         }
     };
     let op = if existing_cid.is_some() {

src/api/responses.rs

···
 }
 
 impl DidResponse {
-    pub fn new(did: impl Into<Did>) -> impl IntoResponse {
+    pub fn response(did: impl Into<Did>) -> impl IntoResponse {
         Json(Self { did: did.into() })
     }
 }
···
 }
 
 impl TokenRequiredResponse {
-    pub fn new(required: bool) -> impl IntoResponse {
-        Json(Self { token_required: required })
+    pub fn response(required: bool) -> impl IntoResponse {
+        Json(Self {
+            token_required: required,
+        })
     }
 }
 
···
 }
 
 impl HasPasswordResponse {
-    pub fn new(has_password: bool) -> impl IntoResponse {
+    pub fn response(has_password: bool) -> impl IntoResponse {
         Json(Self { has_password })
     }
 }
···
 }
 
 impl VerifiedResponse {
-    pub fn new(verified: bool) -> impl IntoResponse {
+    pub fn response(verified: bool) -> impl IntoResponse {
         Json(Self { verified })
     }
 }
···
 }
 
 impl EnabledResponse {
-    pub fn new(enabled: bool) -> impl IntoResponse {
+    pub fn response(enabled: bool) -> impl IntoResponse {
         Json(Self { enabled })
     }
 }
···
 }
 
 impl StatusResponse {
-    pub fn new(status: impl Into<String>) -> impl IntoResponse {
-        Json(Self { status: status.into() })
+    pub fn response(status: impl Into<String>) -> impl IntoResponse {
+        Json(Self {
+            status: status.into(),
+        })
     }
 }
 
···
 }
 
 impl DidDocumentResponse {
-    pub fn new(did_document: serde_json::Value) -> impl IntoResponse {
+    pub fn response(did_document: serde_json::Value) -> impl IntoResponse {
         Json(Self { did_document })
     }
 }

src/api/server/account_status.rs

···
-use crate::api::error::ApiError;
 use crate::api::EmptyResponse;
+use crate::api::error::ApiError;
 use crate::cache::Cache;
 use crate::plc::PlcClient;
 use crate::state::AppState;
···
             return ApiError::InternalError(None).into_response();
         }
     };
-    let user_status = sqlx::query!("SELECT deactivated_at FROM users WHERE did = $1", did.as_str())
-        .fetch_optional(&state.db)
-        .await;
+    let user_status = sqlx::query!(
+        "SELECT deactivated_at FROM users WHERE did = $1",
+        did.as_str()
+    )
+    .fetch_optional(&state.db)
+    .await;
     let deactivated_at = match user_status {
         Ok(Some(row)) => row.deactivated_at,
         _ => None,
···
     );
     let did_validation_start = std::time::Instant::now();
     if let Err(e) =
-        assert_valid_did_document_for_service(&state.db, state.cache.clone(), did.as_str(), true).await
+        assert_valid_did_document_for_service(&state.db, state.cache.clone(), did.as_str(), true)
+            .await
     {
         info!(
             "[MIGRATION] activateAccount: DID document validation FAILED for {} (took {:?})",
···
         "[MIGRATION] activateAccount: Activating account did={} handle={:?}",
         did, handle
     );
-    let result = sqlx::query!("UPDATE users SET deactivated_at = NULL WHERE did = $1", did.as_str())
-        .execute(&state.db)
-        .await;
+    let result = sqlx::query!(
+        "UPDATE users SET deactivated_at = NULL WHERE did = $1",
+        did.as_str()
+    )
+    .execute(&state.db)
+    .await;
     match result {
         Ok(_) => {
             info!(
···
                 did
             );
             if let Err(e) =
-                crate::api::repo::record::sequence_account_event(&state, did.as_str(), true, None).await
+                crate::api::repo::record::sequence_account_event(&state, did.as_str(), true, None)
+                    .await
             {
                 warn!(
                     "[MIGRATION] activateAccount: Failed to sequence account activation event: {}",
···
                 "[MIGRATION] activateAccount: Sequencing identity event for did={} handle={:?}",
                 did, handle
             );
-            if let Err(e) =
-                crate::api::repo::record::sequence_identity_event(&state, did.as_str(), handle.as_deref())
-                    .await
+            if let Err(e) = crate::api::repo::record::sequence_identity_event(
+                &state,
+                did.as_str(),
+                handle.as_deref(),
+            )
+            .await
             {
                 warn!(
                     "[MIGRATION] activateAccount: Failed to sequence identity event for activation: {}",
···
     let did = validated.did.clone();
 
     if !crate::api::server::reauth::check_legacy_session_mfa(&state.db, did.as_str()).await {
-        return crate::api::server::reauth::legacy_mfa_required_response(&state.db, did.as_str()).await;
+        return crate::api::server::reauth::legacy_mfa_required_response(&state.db, did.as_str())
+            .await;
     }
 
     let user_id = match sqlx::query_scalar!("SELECT id FROM users WHERE did = $1", did.as_str())

src/api/server/app_password.rs

···
-use crate::api::error::ApiError;
 use crate::api::EmptyResponse;
+use crate::api::error::ApiError;
 use crate::auth::BearerAuth;
 use crate::delegation::{self, DelegationActionType};
 use crate::state::{AppState, RateLimitKind};

src/api/server/email.rs

···
     }
 
     info!("Email update requested for user {}", user.id);
-    TokenRequiredResponse::new(token_required).into_response()
+    TokenRequiredResponse::response(token_required).into_response()
 }
 
 #[derive(Deserialize)]
···
     .await;
 
     match user {
-        Ok(Some(row)) => VerifiedResponse::new(row.email_verified).into_response(),
+        Ok(Some(row)) => VerifiedResponse::response(row.email_verified).into_response(),
         Ok(None) => ApiError::AccountNotFound.into_response(),
         Err(e) => {
             error!("DB error checking email verified: {:?}", e);

src/api/server/invite.rs

···
         return ApiError::InvalidRequest("useCount must be at least 1".into()).into_response();
     }
 
-    let for_account = input.for_account.unwrap_or_else(|| auth_user.did.to_string());
+    let for_account = input
+        .for_account
+        .unwrap_or_else(|| auth_user.did.to_string());
     let code = gen_invite_code();
 
     match sqlx::query!(

src/api/server/passkey_account.rs

···
         .await
     {
         warn!(ip = %client_ip, "Account creation rate limit exceeded");
-        return ApiError::RateLimitExceeded(Some("Too many account creation attempts. Please try again later.".into(),))
+        return ApiError::RateLimitExceeded(Some(
+            "Too many account creation attempts. Please try again later.".into(),
+        ))
         .into_response();
     }
 
···
                     Ok(r) => r,
                     Err(e) => {
                         error!("Error creating PLC genesis operation: {:?}", e);
-                        return ApiError::InternalError(Some("Failed to create PLC operation".into()))
-                            .into_response();
+                        return ApiError::InternalError(Some(
+                            "Failed to create PLC operation".into(),
+                        ))
+                        .into_response();
                     }
                 };
 
···
         }
     };
 
-    let reg_state = match crate::auth::webauthn::load_registration_state(&state.db, &input.did)
-        .await
-    {
-        Ok(Some(s)) => s,
-        Ok(None) => {
-            return ApiError::NoChallengeInProgress.into_response();
-        }
-        Err(e) => {
-            error!("Error loading registration state: {:?}", e);
-            return ApiError::InternalError(None).into_response();
-        }
-    };
+    let reg_state =
+        match crate::auth::webauthn::load_registration_state(&state.db, &input.did).await {
+            Ok(Some(s)) => s,
+            Ok(None) => {
+                return ApiError::NoChallengeInProgress.into_response();
+            }
+            Err(e) => {
+                error!("Error loading registration state: {:?}", e);
+                return ApiError::InternalError(None).into_response();
+            }
+        };
 
     let credential: webauthn_rs::prelude::RegisterPublicKeyCredential =
         match serde_json::from_value(input.passkey_credential) {

src/api/server/password.rs

···
     .await;
 
     match user {
-        Ok(Some(row)) => HasPasswordResponse::new(row.has_password.unwrap_or(false)).into_response(),
+        Ok(Some(row)) => {
+            HasPasswordResponse::response(row.has_password.unwrap_or(false)).into_response()
+        }
         Ok(None) => ApiError::AccountNotFound.into_response(),
         Err(e) => {
             error!("DB error: {:?}", e);

src/api/server/reauth.rs

···
     auth: BearerAuth,
     Json(input): Json<PasswordReauthInput>,
 ) -> Response {
-    let user = sqlx::query!("SELECT password_hash FROM users WHERE did = $1", &*&auth.0.did)
-        .fetch_optional(&state.db)
-        .await;
+    let user = sqlx::query!(
+        "SELECT password_hash FROM users WHERE did = $1",
+        &*&auth.0.did
+    )
+    .fetch_optional(&state.db)
+    .await;
 
     let password_hash = match user {
         Ok(Some(row)) => row.password_hash,
···
         .await
     {
         warn!(did = %&auth.0.did, "TOTP verification rate limit exceeded");
-        return ApiError::RateLimitExceeded(Some("Too many verification attempts. Please try again in a few minutes.".into(),))
+        return ApiError::RateLimitExceeded(Some(
+            "Too many verification attempts. Please try again in a few minutes.".into(),
+        ))
         .into_response();
     }
 

src/api/server/service_auth.rs

···
-use crate::types::Did;
 use crate::AccountStatus;
 use crate::api::error::ApiError;
 use crate::state::AppState;
+use crate::types::Did;
 use axum::{
     Json,
     extract::{Query, State},
···
                 }
                 Err(e) => {
                     error!(error = ?e, "DB error fetching user key");
-                    return ApiError::AuthenticationFailed(Some("Failed to get signing key".into()))
-                        .into_response();
+                    return ApiError::AuthenticationFailed(Some(
+                        "Failed to get signing key".into(),
+                    ))
+                    .into_response();
                 }
             }
         }

src/api/server/session.rs

···
             }
         };
     if crate::auth::verify_refresh_token(&refresh_token, &key_bytes).is_err() {
-        return ApiError::AuthenticationFailed(Some("Invalid refresh token".into())).into_response();
+        return ApiError::AuthenticationFailed(Some("Invalid refresh token".into()))
+            .into_response();
     }
     let new_access_meta = match crate::auth::create_access_token_with_delegation(
         &session_row.did,
···
             let pds_hostname =
                 std::env::var("PDS_HOSTNAME").unwrap_or_else(|_| "localhost".to_string());
             let handle = full_handle(&u.handle, &pds_hostname);
-            let account_state = AccountState::from_db_fields(
-                u.deactivated_at,
-                u.takedown_ref.clone(),
-                None,
-                None,
-            );
+            let account_state =
+                AccountState::from_db_fields(u.deactivated_at, u.takedown_ref.clone(), None, None);
             let mut response = json!({
                 "accessJwt": new_access_meta.token,
                 "refreshJwt": new_refresh_meta.token,

src/api/server/totp.rs

···
 }
 
 pub async fn create_totp_secret(State(state): State<AppState>, auth: BearerAuth) -> Response {
-    let existing = sqlx::query_scalar!("SELECT verified FROM user_totp WHERE did = $1", &*&auth.0.did)
-        .fetch_optional(&state.db)
-        .await;
+    let existing = sqlx::query_scalar!(
+        "SELECT verified FROM user_totp WHERE did = $1",
+        &*&auth.0.did
+    )
+    .fetch_optional(&state.db)
+    .await;
 
     if let Ok(Some(true)) = existing {
         return ApiError::TotpAlreadyEnabled.into_response();
···
         Ok(qr) => qr,
         Err(e) => {
             error!("Failed to generate QR code: {:?}", e);
-            return ApiError::InternalError(Some("Failed to generate QR code".into())).into_response();
+            return ApiError::InternalError(Some("Failed to generate QR code".into()))
+                .into_response();
         }
     };
 
···
         return ApiError::RateLimitExceeded(None).into_response();
     }
 
-    let user = sqlx::query!("SELECT password_hash FROM users WHERE did = $1", &*&auth.0.did)
-        .fetch_optional(&state.db)
-        .await;
+    let user = sqlx::query!(
+        "SELECT password_hash FROM users WHERE did = $1",
+        &*&auth.0.did
+    )
+    .fetch_optional(&state.db)
+    .await;
 
     let password_hash = match user {
         Ok(Some(row)) => row.password_hash,
···
 }
 
 pub async fn get_totp_status(State(state): State<AppState>, auth: BearerAuth) -> Response {
-    let totp_row = sqlx::query!("SELECT verified FROM user_totp WHERE did = $1", &*&auth.0.did)
-        .fetch_optional(&state.db)
-        .await;
+    let totp_row = sqlx::query!(
+        "SELECT verified FROM user_totp WHERE did = $1",
+        &*&auth.0.did
+    )
+    .fetch_optional(&state.db)
+    .await;
 
     let enabled = match totp_row {
         Ok(Some(row)) => row.verified,
···
         return ApiError::RateLimitExceeded(None).into_response();
     }
 
-    let user = sqlx::query!("SELECT password_hash FROM users WHERE did = $1", &*&auth.0.did)
-        .fetch_optional(&state.db)
-        .await;
+    let user = sqlx::query!(
+        "SELECT password_hash FROM users WHERE did = $1",
+        &*&auth.0.did
+    )
+    .fetch_optional(&state.db)
+    .await;
 
     let password_hash = match user {
         Ok(Some(row)) => row.password_hash,

src/api/server/trusted_devices.rs

···
-use crate::api::error::ApiError;
 use crate::api::SuccessResponse;
+use crate::api::error::ApiError;
 use axum::{
     Json,
     extract::State,
···
             let devices = rows
                 .into_iter()
                 .map(|row| {
-                    let trust_state = DeviceTrustState::from_timestamps(row.trusted_at, row.trusted_until);
+                    let trust_state =
+                        DeviceTrustState::from_timestamps(row.trusted_at, row.trusted_until);
                     TrustedDevice {
                         id: row.id,
                         user_agent: row.user_agent,
···
 }
 
 pub async fn is_device_trusted(db: &PgPool, device_id: &str, did: &str) -> bool {
-    get_device_trust_state(db, device_id, did).await.is_trusted()
+    get_device_trust_state(db, device_id, did)
+        .await
+        .is_trusted()
 }
 
 pub async fn trust_device(db: &PgPool, device_id: &str) -> Result<(), sqlx::Error> {

src/api/server/verify_email.rs

···
 
     Ok(Json(VerifyMigrationEmailOutput {
         success: result.success,
-        did: result.did.clone().into(),
+        did: result.did.clone(),
     }))
 }
 

src/api/validation.rs

···
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         match self {
             Self::Empty => write!(f, "Email cannot be empty"),
-            Self::TooLong => write!(f, "Email exceeds maximum length of {} characters", MAX_EMAIL_LENGTH),
+            Self::TooLong => write!(
+                f,
+                "Email exceeds maximum length of {} characters",
+                MAX_EMAIL_LENGTH
+            ),
             Self::MissingAtSign => write!(f, "Email must contain @"),
             Self::EmptyLocalPart => write!(f, "Email local part cannot be empty"),
             Self::LocalPartTooLong => write!(f, "Email local part exceeds maximum length"),
···
     }
 
     pub fn local_part(&self) -> &str {
-        self.0.rsplitn(2, '@').nth(1).unwrap_or("")
+        self.0
+            .rsplit_once('@')
+            .map(|(local, _)| local)
+            .unwrap_or("")
     }
 
     pub fn domain(&self) -> &str {
-        self.0.rsplitn(2, '@').next().unwrap_or("")
+        self.0
+            .rsplit_once('@')
+            .map(|(_, domain)| domain)
+            .unwrap_or("")
     }
 }
 

src/auth/extractor.rs

···
                 Err(_) => Err(AuthError::AuthenticationFailed),
             }
         } else {
-            match validate_bearer_token_cached(&state.db, state.cache.as_ref(), &extracted.token).await {
+            match validate_bearer_token_cached(&state.db, state.cache.as_ref(), &extracted.token)
+                .await
+            {
                 Ok(user) => Ok(BearerAuth(user)),
                 Err(TokenValidationError::AccountDeactivated) => Err(AuthError::AccountDeactivated),
                 Err(TokenValidationError::AccountTakedown) => Err(AuthError::AccountTakedown),
···
                 Err(_) => return Err(AuthError::AuthenticationFailed),
             }
         } else {
-            match validate_bearer_token_cached(&state.db, state.cache.as_ref(), &extracted.token).await {
+            match validate_bearer_token_cached(&state.db, state.cache.as_ref(), &extracted.token)
+                .await
+            {
                 Ok(user) => user,
                 Err(TokenValidationError::AccountDeactivated) => {
                     return Err(AuthError::AccountDeactivated);

src/auth/mod.rs

···
 use std::fmt;
 use std::time::Duration;
 
-use crate::types::Did;
 use crate::AccountStatus;
 use crate::cache::Cache;
 use crate::oauth::scopes::ScopePermissions;
+use crate::types::Did;
 
 pub mod extractor;
 pub mod scope_check;
···
                             .act
                             .as_ref()
                             .map(|a| Did::new_unchecked(a.sub.clone()));
-                        let status = AccountStatus::from_db_fields(
-                            takedown_ref.as_deref(),
-                            deactivated_at,
-                        );
+                        let status =
+                            AccountStatus::from_db_fields(takedown_ref.as_deref(), deactivated_at);
                         return Ok(AuthenticatedUser {
                             did: Did::new_unchecked(did.clone()),
                             key_bytes: Some(decrypted_key),

src/lib.rs

···
 pub mod validation;
 
 use api::proxy::XrpcProxyLayer;
-pub use sync::util::AccountStatus;
-pub use types::{AccountState, AtIdentifier, AtUri, Did, Handle, Nsid, Rkey};
 use axum::{
     Json, Router,
     extract::DefaultBodyLimit,
···
 use http::StatusCode;
 use serde_json::json;
 use state::AppState;
+pub use sync::util::AccountStatus;
 use tower::ServiceBuilder;
 use tower_http::cors::{Any, CorsLayer};
 use tower_http::services::{ServeDir, ServeFile};
+pub use types::{AccountState, AtIdentifier, AtUri, Did, Handle, Nsid, Rkey};
 
 pub fn app(state: AppState) -> Router {
     let xrpc_router = Router::new()

src/oauth/db/request.rs

···
-use super::super::{AuthFlowState, AuthorizationRequestParameters, ClientAuth, OAuthError, RequestData};
+use super::super::{
+    AuthFlowState, AuthorizationRequestParameters, ClientAuth, OAuthError, RequestData,
+};
 use super::helpers::{from_json, to_json};
 use sqlx::PgPool;
 

src/oauth/db/token.rs

···
 use sqlx::PgPool;
 
 pub enum RefreshTokenLookup {
-    Valid { db_id: i32, token_data: TokenData },
-    InGracePeriod { db_id: i32, token_data: TokenData, rotated_at: DateTime<Utc> },
-    Used { original_token_id: i32 },
-    Expired { db_id: i32 },
+    Valid {
+        db_id: i32,
+        token_data: TokenData,
+    },
+    InGracePeriod {
+        db_id: i32,
+        token_data: TokenData,
+        rotated_at: DateTime<Utc>,
+    },
+    Used {
+        original_token_id: i32,
+    },
+    Expired {
+        db_id: i32,
+    },
     NotFound,
 }
 
···
         match self {
             RefreshTokenLookup::Valid { .. } => RefreshTokenState::Valid,
             RefreshTokenLookup::InGracePeriod { rotated_at, .. } => {
-                RefreshTokenState::InGracePeriod { rotated_at: *rotated_at }
+                RefreshTokenState::InGracePeriod {
+                    rotated_at: *rotated_at,
+                }
             }
             RefreshTokenLookup::Used { .. } => RefreshTokenState::Used { at: Utc::now() },
             RefreshTokenLookup::Expired { .. } => RefreshTokenState::Expired,
···
     refresh_token: &str,
 ) -> Result<RefreshTokenLookup, OAuthError> {
     if let Some(token_id) = check_refresh_token_used(pool, refresh_token).await? {
-        if let Some((db_id, token_data)) = get_token_by_previous_refresh_token(pool, refresh_token).await? {
+        if let Some((db_id, token_data)) =
+            get_token_by_previous_refresh_token(pool, refresh_token).await?
+        {
             let rotated_at = token_data.updated_at;
-            return Ok(RefreshTokenLookup::InGracePeriod { db_id, token_data, rotated_at });
+            return Ok(RefreshTokenLookup::InGracePeriod {
+                db_id,
+                token_data,
+                rotated_at,
+            });
         }
-        return Ok(RefreshTokenLookup::Used { original_token_id: token_id });
+        return Ok(RefreshTokenLookup::Used {
+            original_token_id: token_id,
+        });
     }
 
     match get_token_by_refresh_token(pool, refresh_token).await? {

src/oauth/endpoints/token/grants.rs

···
     dpop_proof: Option<String>,
 ) -> Result<(HeaderMap, Json<TokenResponse>), OAuthError> {
     let (code, code_verifier, redirect_uri) = match request.grant {
-        TokenGrant::AuthorizationCode { code, code_verifier, redirect_uri } => {
-            (code, code_verifier, redirect_uri)
+        TokenGrant::AuthorizationCode {
+            code,
+            code_verifier,
+            redirect_uri,
+        } => (code, code_verifier, redirect_uri),
+        _ => {
+            return Err(OAuthError::InvalidRequest(
+                "Expected authorization_code grant".to_string(),
+            ));
         }
-        _ => return Err(OAuthError::InvalidRequest("Expected authorization_code grant".to_string())),
     };
     let auth_request = db::consume_authorization_request_by_code(&state.db, &code)
         .await?
···
     let did = flow_state.did().unwrap().to_string();
     let client_metadata_cache = ClientMetadataCache::new(3600);
     let client_metadata = client_metadata_cache.get(&auth_request.client_id).await?;
-    let client_auth = if let (Some(assertion), Some(assertion_type)) =
-        (&request.client_auth.client_assertion, &request.client_auth.client_assertion_type)
-    {
+    let client_auth = if let (Some(assertion), Some(assertion_type)) = (
+        &request.client_auth.client_assertion,
+        &request.client_auth.client_assertion_type,
+    ) {
         if assertion_type != "urn:ietf:params:oauth:client-assertion-type:jwt-bearer" {
             return Err(OAuthError::InvalidClient(
                 "Unsupported client_assertion_type".to_string(),
···
 ) -> Result<(HeaderMap, Json<TokenResponse>), OAuthError> {
     let refresh_token_str = match request.grant {
         TokenGrant::RefreshToken { refresh_token } => refresh_token,
-        _ => return Err(OAuthError::InvalidRequest("Expected refresh_token grant".to_string())),
+        _ => {
+            return Err(OAuthError::InvalidRequest(
+                "Expected refresh_token grant".to_string(),
+            ));
+        }
     };
     let token_prefix = &refresh_token_str[..std::cmp::min(16, refresh_token_str.len())];
     tracing::info!(
···
 
     let (db_id, token_data) = match lookup {
         RefreshTokenLookup::Valid { db_id, token_data } => (db_id, token_data),
-        RefreshTokenLookup::InGracePeriod { db_id: _, token_data, rotated_at } => {
+        RefreshTokenLookup::InGracePeriod {
+            db_id: _,
+            token_data,
+            rotated_at,
+        } => {
             tracing::info!(
                 refresh_token_prefix = %token_prefix,
                 rotated_at = %rotated_at,
···
         }
         RefreshTokenLookup::NotFound => {
             tracing::warn!(refresh_token_prefix = %token_prefix, "Refresh token not found");
-            return Err(OAuthError::InvalidGrant("Invalid refresh token".to_string()));
+            return Err(OAuthError::InvalidGrant(
+                "Invalid refresh token".to_string(),
+            ));
         }
     };
     let dpop_jkt = if let Some(proof) = &dpop_proof {

src/oauth/endpoints/token/mod.rs

···
 pub use introspect::{
     IntrospectRequest, IntrospectResponse, RevokeRequest, introspect_token, revoke_token,
 };
-pub use types::{ClientAuthParams, GrantType, TokenGrant, TokenRequest, TokenResponse, ValidatedTokenRequest};
+pub use types::{
+    ClientAuthParams, GrantType, TokenGrant, TokenRequest, TokenResponse, ValidatedTokenRequest,
+};
 
 fn extract_client_ip(headers: &HeaderMap) -> String {
     if let Some(forwarded) = headers.get("x-forwarded-for")

src/oauth/endpoints/token/types.rs

···
         let grant = match self.grant_type {
             GrantType::AuthorizationCode => {
                 let code = self.code.ok_or_else(|| {
-                    OAuthError::InvalidRequest("code is required for authorization_code grant".to_string())
+                    OAuthError::InvalidRequest(
+                        "code is required for authorization_code grant".to_string(),
+                    )
                 })?;
                 let code_verifier = self.code_verifier.ok_or_else(|| {
-                    OAuthError::InvalidRequest("code_verifier is required for authorization_code grant".to_string())
+                    OAuthError::InvalidRequest(
+                        "code_verifier is required for authorization_code grant".to_string(),
+                    )
                 })?;
                 TokenGrant::AuthorizationCode {
                     code,
···
             }
             GrantType::RefreshToken => {
                 let refresh_token = self.refresh_token.ok_or_else(|| {
-                    OAuthError::InvalidRequest("refresh_token is required for refresh_token grant".to_string())
+                    OAuthError::InvalidRequest(
+                        "refresh_token is required for refresh_token grant".to_string(),
+                    )
                 })?;
                 TokenGrant::RefreshToken { refresh_token }
             }

src/oauth/scopes/parser.rs

···
         .split('&')
         .filter_map(|part| part.split_once('='))
         .fold(HashMap::new(), |mut acc, (key, value)| {
-            acc.entry(key.to_string()).or_default().push(value.to_string());
+            acc.entry(key.to_string())
+                .or_default()
+                .push(value.to_string());
             acc
         })
 }

src/oauth/types.rs

···
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub enum AuthFlowState {
     Pending,
-    Authenticated { did: String, device_id: Option<String> },
-    Authorized { did: String, device_id: Option<String>, code: String },
+    Authenticated {
+        did: String,
+        device_id: Option<String>,
+    },
+    Authorized {
+        did: String,
+        device_id: Option<String>,
+        code: String,
+    },
     Expired,
 }
 
···
             AuthFlowState::Pending => write!(f, "pending"),
             AuthFlowState::Authenticated { did, .. } => write!(f, "authenticated ({})", did),
             AuthFlowState::Authorized { did, code, .. } => {
-                write!(f, "authorized ({}, code={}...)", did, &code[..8.min(code.len())])
+                write!(
+                    f,
+                    "authorized ({}, code={}...)",
+                    did,
+                    &code[..8.min(code.len())]
+                )
             }
             AuthFlowState::Expired => write!(f, "expired"),
         }
···
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub enum RefreshTokenState {
     Valid,
-    Used { at: chrono::DateTime<chrono::Utc> },
-    InGracePeriod { rotated_at: chrono::DateTime<chrono::Utc> },
+    Used {
+        at: chrono::DateTime<chrono::Utc>,
+    },
+    InGracePeriod {
+        rotated_at: chrono::DateTime<chrono::Utc>,
+    },
     Expired,
     Revoked,
 }

src/oauth/verify.rs

···
 
 async fn try_legacy_auth(pool: &PgPool, token: &str) -> Result<LegacyAuthResult, ()> {
     match crate::auth::validate_bearer_token(pool, token).await {
-        Ok(user) if !user.is_oauth => Ok(LegacyAuthResult { did: user.did.to_string() }),
+        Ok(user) if !user.is_oauth => Ok(LegacyAuthResult {
+            did: user.did.to_string(),
+        }),
         _ => Err(()),
     }
 }

src/sync/commit.rs

···
         Ok(Some(a)) => a,
         Ok(None) => {
             return ApiError::RepoNotFound(Some(format!("Could not find repo for DID: {}", did)))
-                .into_response()
+                .into_response();
         }
         Err(e) => {
             error!("DB error in get_repo_status: {:?}", e);

src/sync/deprecated.rs

···
     };
     match account.repo_root_cid {
         Some(root) => (StatusCode::OK, Json(GetHeadOutput { root })).into_response(),
-        None => {
-            ApiError::RepoNotFound(Some(format!("Could not find root for DID: {}", did)))
-                .into_response()
-        }
+        None => ApiError::RepoNotFound(Some(format!("Could not find root for DID: {}", did)))
+            .into_response(),
     }
 }
 

src/sync/frame.rs

···
 }
 
 impl CommitFrameBuilder {
+    #[allow(clippy::too_many_arguments)]
     pub fn new(
         seq: i64,
         did: String,
···
     ) -> Result<Self, CommitFrameError> {
         let commit_cid = Cid::from_str(commit_cid_str)
             .map_err(|_| CommitFrameError::InvalidCommitCid(commit_cid_str.to_string()))?;
-        let prev_cid = prev_cid_str
-            .map(|s| Cid::from_str(s))
-            .transpose()
-            .map_err(|_| CommitFrameError::InvalidCommitCid(prev_cid_str.unwrap_or("").to_string()))?;
+        let prev_cid = prev_cid_str.map(Cid::from_str).transpose().map_err(|_| {
+            CommitFrameError::InvalidCommitCid(prev_cid_str.unwrap_or("").to_string())
+        })?;
         let blob_cids: Vec<Cid> = blob_strs
             .iter()
             .filter_map(|s| Cid::from_str(s).ok())

src/sync/repo.rs

···
     {
         Ok(cids) => cids,
         Err(invalid) => {
-            return ApiError::InvalidRequest(format!("Invalid CID: {}", invalid)).into_response()
+            return ApiError::InvalidRequest(format!("Invalid CID: {}", invalid)).into_response();
         }
     };
 
···
     let missing_cids: Vec<String> = blocks
         .iter()
         .zip(&cids)
-        .filter_map(|(block_opt, cid)| block_opt.is_none().then(|| cid.to_string()))
+        .filter(|(block_opt, _)| block_opt.is_none())
+        .map(|(_, cid)| cid.to_string())
         .collect();
     if !missing_cids.is_empty() {
         return ApiError::InvalidRequest(format!(

src/sync/util.rs

···
         matches!(self, Self::Active)
     }
 
-    pub fn from_db_fields(takedown_ref: Option<&str>, deactivated_at: Option<chrono::DateTime<chrono::Utc>>) -> Self {
+    pub fn from_db_fields(
+        takedown_ref: Option<&str>,
+        deactivated_at: Option<chrono::DateTime<chrono::Utc>>,
+    ) -> Self {
         if takedown_ref.is_some() {
             Self::Takendown
         } else if deactivated_at.is_some() {

src/types.rs

···
     }
 
     pub fn now() -> Self {
-        Self(chrono::Utc::now().format("%Y-%m-%dT%H:%M:%S%.3fZ").to_string())
+        Self(
+            chrono::Utc::now()
+                .format("%Y-%m-%dT%H:%M:%S%.3fZ")
+                .to_string(),
+        )
     }
 
     pub fn as_str(&self) -> &str {
···
     }
 
     pub fn can_access_repo(&self) -> bool {
-        matches!(self, AccountState::Active | AccountState::Deactivated { .. })
+        matches!(
+            self,
+            AccountState::Active | AccountState::Deactivated { .. }
+        )
     }
 
     pub fn status_string(&self) -> &'static str {
···
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub enum TokenSource {
     Session,
-    OAuth { client_id: Option<String> },
-    ServiceAuth { lxm: Option<String>, aud: Option<String> },
+    OAuth {
+        client_id: Option<String>,
+    },
+    ServiceAuth {
+        lxm: Option<String>,
+        aud: Option<String>,
+    },
 }
 
 impl TokenSource {
···
 
     #[test]
     fn test_cidlink_validation() {
-        assert!(CidLink::new("bafyreib74ckyq525l3y6an5txykwwtb3dgex6ofzakml53di77oxwr5pfe").is_ok());
+        assert!(
+            CidLink::new("bafyreib74ckyq525l3y6an5txykwwtb3dgex6ofzakml53di77oxwr5pfe").is_ok()
+        );
         assert!(CidLink::new("not-a-cid").is_err());
     }
 

tests/import_verification.rs

···
     assert_eq!(import_res.status(), StatusCode::FORBIDDEN);
     let body: serde_json::Value = import_res.json().await.unwrap();
     assert!(
-        body["error"] == "InvalidRepo" || body["error"] == "InvalidRequest" || body["error"] == "DidMismatch",
+        body["error"] == "InvalidRepo"
+            || body["error"] == "InvalidRequest"
+            || body["error"] == "DidMismatch",
         "Expected InvalidRepo, DidMismatch, or InvalidRequest error, got: {:?}",
         body
     );