More functional and typesafe frontend

frontend/deno.lock

···
     "npm:@atcute/crypto@^2.3.0": "2.3.0",
     "npm:@atcute/did-plc@~0.3.1": "0.3.1",
     "npm:@atcute/multibase@^1.1.6": "1.1.6",
-    "npm:@noble/secp256k1@^2.1.0": "2.3.0",
-    "npm:@sveltejs/vite-plugin-svelte@5": "5.1.1_svelte@5.45.10__acorn@8.15.0_vite@6.4.1__picomatch@4.0.3",
-    "npm:@testing-library/jest-dom@^6.6.3": "6.9.1",
-    "npm:@testing-library/svelte@^5.2.6": "5.2.9_svelte@5.45.10__acorn@8.15.0_vite@6.4.1__picomatch@4.0.3_vitest@2.1.9__jsdom@25.0.1__vite@5.4.21_jsdom@25.0.1",
-    "npm:@testing-library/user-event@^14.5.2": "14.6.1_@testing-library+dom@10.4.1",
+    "npm:@noble/secp256k1@3": "3.0.0",
+    "npm:@sveltejs/vite-plugin-svelte@^6.2.1": "6.2.1_svelte@5.46.1__acorn@8.15.0_vite@7.3.0__picomatch@4.0.3",
+    "npm:@testing-library/jest-dom@^6.9.1": "6.9.1",
+    "npm:@testing-library/svelte@^5.3.1": "5.3.1_svelte@5.46.1__acorn@8.15.0_vite@7.3.0__picomatch@4.0.3_vitest@4.0.16__jsdom@25.0.1__vite@7.3.0___picomatch@4.0.3_jsdom@25.0.1",
+    "npm:@testing-library/user-event@^14.6.1": "14.6.1_@testing-library+dom@10.4.1",
     "npm:jsdom@^25.0.1": "25.0.1",
-    "npm:multiformats@^13.3.1": "13.4.2",
-    "npm:svelte-check@*": "4.3.5_svelte@5.45.10__acorn@8.15.0_typescript@5.9.3",
-    "npm:svelte-i18n@^4.0.1": "4.0.1_svelte@5.45.10__acorn@8.15.0",
-    "npm:svelte@5": "5.45.10_acorn@8.15.0",
-    "npm:vite@*": "6.4.1_picomatch@4.0.3",
-    "npm:vite@6": "6.4.1_picomatch@4.0.3",
-    "npm:vitest@*": "2.1.9_jsdom@25.0.1_vite@5.4.21",
-    "npm:vitest@^2.1.8": "2.1.9_jsdom@25.0.1_vite@5.4.21"
+    "npm:multiformats@^13.4.2": "13.4.2",
+    "npm:svelte-i18n@^4.0.1": "4.0.1_svelte@5.46.1__acorn@8.15.0",
+    "npm:svelte@^5.46.1": "5.46.1_acorn@8.15.0",
+    "npm:vite@*": "7.3.0_picomatch@4.0.3",
+    "npm:vite@^7.3.0": "7.3.0_picomatch@4.0.3",
+    "npm:vitest@*": "4.0.16_jsdom@25.0.1_vite@7.3.0__picomatch@4.0.3",
+    "npm:vitest@^4.0.16": "4.0.16_jsdom@25.0.1_vite@7.3.0__picomatch@4.0.3",
+    "npm:zod@^4.3.5": "4.3.5"
   },
   "npm": {
     "@adobe/css-tools@4.4.4": {
···
       "dependencies": [
         "@atcute/multibase",
         "@atcute/uint8array",
-        "@noble/secp256k1@3.0.0"
+        "@noble/secp256k1"
       ]
     },
     "@atcute/did-plc@0.3.1": {
···
     "@atcute/uint8array@1.0.6": {
       "integrity": "sha512-ucfRBQc7BFT8n9eCyGOzDHEMKF/nZwhS2pPao4Xtab1ML3HdFYcX2DM1tadCzas85QTGxHe5urnUAAcNKGRi9A=="
     },
-    "@atcute/util-fetch@1.0.4": {
-      "integrity": "sha512-sIU9Qk0dE8PLEXSfhy+gIJV+HpiiknMytCI2SqLlqd0vgZUtEKI/EQfP+23LHWvP+CLCzVDOa6cpH045OlmNBg==",
+    "@atcute/util-fetch@1.0.5": {
+      "integrity": "sha512-qjHj01BGxjSjIFdPiAjSARnodJIIyKxnCMMEcXMESo9TAyND6XZQqrie5fia+LlYWVXdpsTds8uFQwc9jdKTig==",
       "dependencies": [
         "@badrap/valita"
       ]
···
       "os": ["aix"],
       "cpu": ["ppc64"]
     },
-    "@esbuild/aix-ppc64@0.21.5": {
-      "integrity": "sha512-1SDgH6ZSPTlggy1yI6+Dbkiz8xzpHJEVAlF/AM1tHPLsf5STom9rwtjE4hKAF20FfXXNTFqEYXyJNWh1GiZedQ==",
-      "os": ["aix"],
-      "cpu": ["ppc64"]
-    },
-    "@esbuild/aix-ppc64@0.25.12": {
-      "integrity": "sha512-Hhmwd6CInZ3dwpuGTF8fJG6yoWmsToE+vYgD4nytZVxcu1ulHpUQRAB1UJ8+N1Am3Mz4+xOByoQoSZf4D+CpkA==",
+    "@esbuild/aix-ppc64@0.27.2": {
+      "integrity": "sha512-GZMB+a0mOMZs4MpDbj8RJp4cw+w1WV5NYD6xzgvzUJ5Ek2jerwfO2eADyI6ExDSUED+1X8aMbegahsJi+8mgpw==",
       "os": ["aix"],
       "cpu": ["ppc64"]
     },
···
       "os": ["android"],
       "cpu": ["arm64"]
     },
-    "@esbuild/android-arm64@0.21.5": {
-      "integrity": "sha512-c0uX9VAUBQ7dTDCjq+wdyGLowMdtR/GoC2U5IYk/7D1H1JYC0qseD7+11iMP2mRLN9RcCMRcjC4YMclCzGwS/A==",
-      "os": ["android"],
-      "cpu": ["arm64"]
-    },
-    "@esbuild/android-arm64@0.25.12": {
-      "integrity": "sha512-6AAmLG7zwD1Z159jCKPvAxZd4y/VTO0VkprYy+3N2FtJ8+BQWFXU+OxARIwA46c5tdD9SsKGZ/1ocqBS/gAKHg==",
+    "@esbuild/android-arm64@0.27.2": {
+      "integrity": "sha512-pvz8ZZ7ot/RBphf8fv60ljmaoydPU12VuXHImtAs0XhLLw+EXBi2BLe3OYSBslR4rryHvweW5gmkKFwTiFy6KA==",
       "os": ["android"],
       "cpu": ["arm64"]
     },
···
       "os": ["android"],
       "cpu": ["arm"]
     },
-    "@esbuild/android-arm@0.21.5": {
-      "integrity": "sha512-vCPvzSjpPHEi1siZdlvAlsPxXl7WbOVUBBAowWug4rJHb68Ox8KualB+1ocNvT5fjv6wpkX6o/iEpbDrf68zcg==",
-      "os": ["android"],
-      "cpu": ["arm"]
-    },
-    "@esbuild/android-arm@0.25.12": {
-      "integrity": "sha512-VJ+sKvNA/GE7Ccacc9Cha7bpS8nyzVv0jdVgwNDaR4gDMC/2TTRc33Ip8qrNYUcpkOHUT5OZ0bUcNNVZQ9RLlg==",
+    "@esbuild/android-arm@0.27.2": {
+      "integrity": "sha512-DVNI8jlPa7Ujbr1yjU2PfUSRtAUZPG9I1RwW4F4xFB1Imiu2on0ADiI/c3td+KmDtVKNbi+nffGDQMfcIMkwIA==",
       "os": ["android"],
       "cpu": ["arm"]
     },
···
       "os": ["android"],
       "cpu": ["x64"]
     },
-    "@esbuild/android-x64@0.21.5": {
-      "integrity": "sha512-D7aPRUUNHRBwHxzxRvp856rjUHRFW1SdQATKXH2hqA0kAZb1hKmi02OpYRacl0TxIGz/ZmXWlbZgjwWYaCakTA==",
-      "os": ["android"],
-      "cpu": ["x64"]
-    },
-    "@esbuild/android-x64@0.25.12": {
-      "integrity": "sha512-5jbb+2hhDHx5phYR2By8GTWEzn6I9UqR11Kwf22iKbNpYrsmRB18aX/9ivc5cabcUiAT/wM+YIZ6SG9QO6a8kg==",
+    "@esbuild/android-x64@0.27.2": {
+      "integrity": "sha512-z8Ank4Byh4TJJOh4wpz8g2vDy75zFL0TlZlkUkEwYXuPSgX8yzep596n6mT7905kA9uHZsf/o2OJZubl2l3M7A==",
       "os": ["android"],
       "cpu": ["x64"]
     },
···
       "os": ["darwin"],
       "cpu": ["arm64"]
     },
-    "@esbuild/darwin-arm64@0.21.5": {
-      "integrity": "sha512-DwqXqZyuk5AiWWf3UfLiRDJ5EDd49zg6O9wclZ7kUMv2WRFr4HKjXp/5t8JZ11QbQfUS6/cRCKGwYhtNAY88kQ==",
-      "os": ["darwin"],
-      "cpu": ["arm64"]
-    },
-    "@esbuild/darwin-arm64@0.25.12": {
-      "integrity": "sha512-N3zl+lxHCifgIlcMUP5016ESkeQjLj/959RxxNYIthIg+CQHInujFuXeWbWMgnTo4cp5XVHqFPmpyu9J65C1Yg==",
+    "@esbuild/darwin-arm64@0.27.2": {
+      "integrity": "sha512-davCD2Zc80nzDVRwXTcQP/28fiJbcOwvdolL0sOiOsbwBa72kegmVU0Wrh1MYrbuCL98Omp5dVhQFWRKR2ZAlg==",
       "os": ["darwin"],
       "cpu": ["arm64"]
     },
···
       "os": ["darwin"],
       "cpu": ["x64"]
     },
-    "@esbuild/darwin-x64@0.21.5": {
-      "integrity": "sha512-se/JjF8NlmKVG4kNIuyWMV/22ZaerB+qaSi5MdrXtd6R08kvs2qCN4C09miupktDitvh8jRFflwGFBQcxZRjbw==",
-      "os": ["darwin"],
-      "cpu": ["x64"]
-    },
-    "@esbuild/darwin-x64@0.25.12": {
-      "integrity": "sha512-HQ9ka4Kx21qHXwtlTUVbKJOAnmG1ipXhdWTmNXiPzPfWKpXqASVcWdnf2bnL73wgjNrFXAa3yYvBSd9pzfEIpA==",
+    "@esbuild/darwin-x64@0.27.2": {
+      "integrity": "sha512-ZxtijOmlQCBWGwbVmwOF/UCzuGIbUkqB1faQRf5akQmxRJ1ujusWsb3CVfk/9iZKr2L5SMU5wPBi1UWbvL+VQA==",
       "os": ["darwin"],
       "cpu": ["x64"]
     },
···
       "os": ["freebsd"],
       "cpu": ["arm64"]
     },
-    "@esbuild/freebsd-arm64@0.21.5": {
-      "integrity": "sha512-5JcRxxRDUJLX8JXp/wcBCy3pENnCgBR9bN6JsY4OmhfUtIHe3ZW0mawA7+RDAcMLrMIZaf03NlQiX9DGyB8h4g==",
-      "os": ["freebsd"],
-      "cpu": ["arm64"]
-    },
-    "@esbuild/freebsd-arm64@0.25.12": {
-      "integrity": "sha512-gA0Bx759+7Jve03K1S0vkOu5Lg/85dou3EseOGUes8flVOGxbhDDh/iZaoek11Y8mtyKPGF3vP8XhnkDEAmzeg==",
+    "@esbuild/freebsd-arm64@0.27.2": {
+      "integrity": "sha512-lS/9CN+rgqQ9czogxlMcBMGd+l8Q3Nj1MFQwBZJyoEKI50XGxwuzznYdwcav6lpOGv5BqaZXqvBSiB/kJ5op+g==",
       "os": ["freebsd"],
       "cpu": ["arm64"]
     },
···
       "os": ["freebsd"],
       "cpu": ["x64"]
     },
-    "@esbuild/freebsd-x64@0.21.5": {
-      "integrity": "sha512-J95kNBj1zkbMXtHVH29bBriQygMXqoVQOQYA+ISs0/2l3T9/kj42ow2mpqerRBxDJnmkUDCaQT/dfNXWX/ZZCQ==",
-      "os": ["freebsd"],
-      "cpu": ["x64"]
-    },
-    "@esbuild/freebsd-x64@0.25.12": {
-      "integrity": "sha512-TGbO26Yw2xsHzxtbVFGEXBFH0FRAP7gtcPE7P5yP7wGy7cXK2oO7RyOhL5NLiqTlBh47XhmIUXuGciXEqYFfBQ==",
+    "@esbuild/freebsd-x64@0.27.2": {
+      "integrity": "sha512-tAfqtNYb4YgPnJlEFu4c212HYjQWSO/w/h/lQaBK7RbwGIkBOuNKQI9tqWzx7Wtp7bTPaGC6MJvWI608P3wXYA==",
       "os": ["freebsd"],
       "cpu": ["x64"]
     },
···
       "os": ["linux"],
       "cpu": ["arm64"]
     },
-    "@esbuild/linux-arm64@0.21.5": {
-      "integrity": "sha512-ibKvmyYzKsBeX8d8I7MH/TMfWDXBF3db4qM6sy+7re0YXya+K1cem3on9XgdT2EQGMu4hQyZhan7TeQ8XkGp4Q==",
-      "os": ["linux"],
-      "cpu": ["arm64"]
-    },
-    "@esbuild/linux-arm64@0.25.12": {
-      "integrity": "sha512-8bwX7a8FghIgrupcxb4aUmYDLp8pX06rGh5HqDT7bB+8Rdells6mHvrFHHW2JAOPZUbnjUpKTLg6ECyzvas2AQ==",
+    "@esbuild/linux-arm64@0.27.2": {
+      "integrity": "sha512-hYxN8pr66NsCCiRFkHUAsxylNOcAQaxSSkHMMjcpx0si13t1LHFphxJZUiGwojB1a/Hd5OiPIqDdXONia6bhTw==",
       "os": ["linux"],
       "cpu": ["arm64"]
     },
···
       "os": ["linux"],
       "cpu": ["arm"]
     },
-    "@esbuild/linux-arm@0.21.5": {
-      "integrity": "sha512-bPb5AHZtbeNGjCKVZ9UGqGwo8EUu4cLq68E95A53KlxAPRmUyYv2D6F0uUI65XisGOL1hBP5mTronbgo+0bFcA==",
-      "os": ["linux"],
-      "cpu": ["arm"]
-    },
-    "@esbuild/linux-arm@0.25.12": {
-      "integrity": "sha512-lPDGyC1JPDou8kGcywY0YILzWlhhnRjdof3UlcoqYmS9El818LLfJJc3PXXgZHrHCAKs/Z2SeZtDJr5MrkxtOw==",
+    "@esbuild/linux-arm@0.27.2": {
+      "integrity": "sha512-vWfq4GaIMP9AIe4yj1ZUW18RDhx6EPQKjwe7n8BbIecFtCQG4CfHGaHuh7fdfq+y3LIA2vGS/o9ZBGVxIDi9hw==",
       "os": ["linux"],
       "cpu": ["arm"]
     },
···
       "os": ["linux"],
       "cpu": ["ia32"]
     },
-    "@esbuild/linux-ia32@0.21.5": {
-      "integrity": "sha512-YvjXDqLRqPDl2dvRODYmmhz4rPeVKYvppfGYKSNGdyZkA01046pLWyRKKI3ax8fbJoK5QbxblURkwK/MWY18Tg==",
-      "os": ["linux"],
-      "cpu": ["ia32"]
-    },
-    "@esbuild/linux-ia32@0.25.12": {
-      "integrity": "sha512-0y9KrdVnbMM2/vG8KfU0byhUN+EFCny9+8g202gYqSSVMonbsCfLjUO+rCci7pM0WBEtz+oK/PIwHkzxkyharA==",
+    "@esbuild/linux-ia32@0.27.2": {
+      "integrity": "sha512-MJt5BRRSScPDwG2hLelYhAAKh9imjHK5+NE/tvnRLbIqUWa+0E9N4WNMjmp/kXXPHZGqPLxggwVhz7QP8CTR8w==",
       "os": ["linux"],
       "cpu": ["ia32"]
     },
···
       "os": ["linux"],
       "cpu": ["loong64"]
     },
-    "@esbuild/linux-loong64@0.21.5": {
-      "integrity": "sha512-uHf1BmMG8qEvzdrzAqg2SIG/02+4/DHB6a9Kbya0XDvwDEKCoC8ZRWI5JJvNdUjtciBGFQ5PuBlpEOXQj+JQSg==",
-      "os": ["linux"],
-      "cpu": ["loong64"]
-    },
-    "@esbuild/linux-loong64@0.25.12": {
-      "integrity": "sha512-h///Lr5a9rib/v1GGqXVGzjL4TMvVTv+s1DPoxQdz7l/AYv6LDSxdIwzxkrPW438oUXiDtwM10o9PmwS/6Z0Ng==",
+    "@esbuild/linux-loong64@0.27.2": {
+      "integrity": "sha512-lugyF1atnAT463aO6KPshVCJK5NgRnU4yb3FUumyVz+cGvZbontBgzeGFO1nF+dPueHD367a2ZXe1NtUkAjOtg==",
       "os": ["linux"],
       "cpu": ["loong64"]
     },
···
       "os": ["linux"],
       "cpu": ["mips64el"]
     },
-    "@esbuild/linux-mips64el@0.21.5": {
-      "integrity": "sha512-IajOmO+KJK23bj52dFSNCMsz1QP1DqM6cwLUv3W1QwyxkyIWecfafnI555fvSGqEKwjMXVLokcV5ygHW5b3Jbg==",
-      "os": ["linux"],
-      "cpu": ["mips64el"]
-    },
-    "@esbuild/linux-mips64el@0.25.12": {
-      "integrity": "sha512-iyRrM1Pzy9GFMDLsXn1iHUm18nhKnNMWscjmp4+hpafcZjrr2WbT//d20xaGljXDBYHqRcl8HnxbX6uaA/eGVw==",
+    "@esbuild/linux-mips64el@0.27.2": {
+      "integrity": "sha512-nlP2I6ArEBewvJ2gjrrkESEZkB5mIoaTswuqNFRv/WYd+ATtUpe9Y09RnJvgvdag7he0OWgEZWhviS1OTOKixw==",
       "os": ["linux"],
       "cpu": ["mips64el"]
     },
···
       "os": ["linux"],
       "cpu": ["ppc64"]
     },
-    "@esbuild/linux-ppc64@0.21.5": {
-      "integrity": "sha512-1hHV/Z4OEfMwpLO8rp7CvlhBDnjsC3CttJXIhBi+5Aj5r+MBvy4egg7wCbe//hSsT+RvDAG7s81tAvpL2XAE4w==",
-      "os": ["linux"],
-      "cpu": ["ppc64"]
-    },
-    "@esbuild/linux-ppc64@0.25.12": {
-      "integrity": "sha512-9meM/lRXxMi5PSUqEXRCtVjEZBGwB7P/D4yT8UG/mwIdze2aV4Vo6U5gD3+RsoHXKkHCfSxZKzmDssVlRj1QQA==",
+    "@esbuild/linux-ppc64@0.27.2": {
+      "integrity": "sha512-C92gnpey7tUQONqg1n6dKVbx3vphKtTHJaNG2Ok9lGwbZil6DrfyecMsp9CrmXGQJmZ7iiVXvvZH6Ml5hL6XdQ==",
       "os": ["linux"],
       "cpu": ["ppc64"]
     },
···
       "os": ["linux"],
       "cpu": ["riscv64"]
     },
-    "@esbuild/linux-riscv64@0.21.5": {
-      "integrity": "sha512-2HdXDMd9GMgTGrPWnJzP2ALSokE/0O5HhTUvWIbD3YdjME8JwvSCnNGBnTThKGEB91OZhzrJ4qIIxk/SBmyDDA==",
-      "os": ["linux"],
-      "cpu": ["riscv64"]
-    },
-    "@esbuild/linux-riscv64@0.25.12": {
-      "integrity": "sha512-Zr7KR4hgKUpWAwb1f3o5ygT04MzqVrGEGXGLnj15YQDJErYu/BGg+wmFlIDOdJp0PmB0lLvxFIOXZgFRrdjR0w==",
+    "@esbuild/linux-riscv64@0.27.2": {
+      "integrity": "sha512-B5BOmojNtUyN8AXlK0QJyvjEZkWwy/FKvakkTDCziX95AowLZKR6aCDhG7LeF7uMCXEJqwa8Bejz5LTPYm8AvA==",
       "os": ["linux"],
       "cpu": ["riscv64"]
     },
···
       "os": ["linux"],
       "cpu": ["s390x"]
     },
-    "@esbuild/linux-s390x@0.21.5": {
-      "integrity": "sha512-zus5sxzqBJD3eXxwvjN1yQkRepANgxE9lgOW2qLnmr8ikMTphkjgXu1HR01K4FJg8h1kEEDAqDcZQtbrRnB41A==",
-      "os": ["linux"],
-      "cpu": ["s390x"]
-    },
-    "@esbuild/linux-s390x@0.25.12": {
-      "integrity": "sha512-MsKncOcgTNvdtiISc/jZs/Zf8d0cl/t3gYWX8J9ubBnVOwlk65UIEEvgBORTiljloIWnBzLs4qhzPkJcitIzIg==",
+    "@esbuild/linux-s390x@0.27.2": {
+      "integrity": "sha512-p4bm9+wsPwup5Z8f4EpfN63qNagQ47Ua2znaqGH6bqLlmJ4bx97Y9JdqxgGZ6Y8xVTixUnEkoKSHcpRlDnNr5w==",
       "os": ["linux"],
       "cpu": ["s390x"]
     },
···
       "os": ["linux"],
       "cpu": ["x64"]
     },
-    "@esbuild/linux-x64@0.21.5": {
-      "integrity": "sha512-1rYdTpyv03iycF1+BhzrzQJCdOuAOtaqHTWJZCWvijKD2N5Xu0TtVC8/+1faWqcP9iBCWOmjmhoH94dH82BxPQ==",
-      "os": ["linux"],
-      "cpu": ["x64"]
-    },
-    "@esbuild/linux-x64@0.25.12": {
-      "integrity": "sha512-uqZMTLr/zR/ed4jIGnwSLkaHmPjOjJvnm6TVVitAa08SLS9Z0VM8wIRx7gWbJB5/J54YuIMInDquWyYvQLZkgw==",
+    "@esbuild/linux-x64@0.27.2": {
+      "integrity": "sha512-uwp2Tip5aPmH+NRUwTcfLb+W32WXjpFejTIOWZFw/v7/KnpCDKG66u4DLcurQpiYTiYwQ9B7KOeMJvLCu/OvbA==",
       "os": ["linux"],
       "cpu": ["x64"]
     },
-    "@esbuild/netbsd-arm64@0.25.12": {
-      "integrity": "sha512-xXwcTq4GhRM7J9A8Gv5boanHhRa/Q9KLVmcyXHCTaM4wKfIpWkdXiMog/KsnxzJ0A1+nD+zoecuzqPmCRyBGjg==",
+    "@esbuild/netbsd-arm64@0.27.2": {
+      "integrity": "sha512-Kj6DiBlwXrPsCRDeRvGAUb/LNrBASrfqAIok+xB0LxK8CHqxZ037viF13ugfsIpePH93mX7xfJp97cyDuTZ3cw==",
       "os": ["netbsd"],
       "cpu": ["arm64"]
     },
···
       "os": ["netbsd"],
       "cpu": ["x64"]
     },
-    "@esbuild/netbsd-x64@0.21.5": {
-      "integrity": "sha512-Woi2MXzXjMULccIwMnLciyZH4nCIMpWQAs049KEeMvOcNADVxo0UBIQPfSmxB3CWKedngg7sWZdLvLczpe0tLg==",
+    "@esbuild/netbsd-x64@0.27.2": {
+      "integrity": "sha512-HwGDZ0VLVBY3Y+Nw0JexZy9o/nUAWq9MlV7cahpaXKW6TOzfVno3y3/M8Ga8u8Yr7GldLOov27xiCnqRZf0tCA==",
       "os": ["netbsd"],
       "cpu": ["x64"]
     },
-    "@esbuild/netbsd-x64@0.25.12": {
-      "integrity": "sha512-Ld5pTlzPy3YwGec4OuHh1aCVCRvOXdH8DgRjfDy/oumVovmuSzWfnSJg+VtakB9Cm0gxNO9BzWkj6mtO1FMXkQ==",
-      "os": ["netbsd"],
-      "cpu": ["x64"]
-    },
-    "@esbuild/openbsd-arm64@0.25.12": {
-      "integrity": "sha512-fF96T6KsBo/pkQI950FARU9apGNTSlZGsv1jZBAlcLL1MLjLNIWPBkj5NlSz8aAzYKg+eNqknrUJ24QBybeR5A==",
+    "@esbuild/openbsd-arm64@0.27.2": {
+      "integrity": "sha512-DNIHH2BPQ5551A7oSHD0CKbwIA/Ox7+78/AWkbS5QoRzaqlev2uFayfSxq68EkonB+IKjiuxBFoV8ESJy8bOHA==",
       "os": ["openbsd"],
       "cpu": ["arm64"]
     },
···
       "os": ["openbsd"],
       "cpu": ["x64"]
     },
-    "@esbuild/openbsd-x64@0.21.5": {
-      "integrity": "sha512-HLNNw99xsvx12lFBUwoT8EVCsSvRNDVxNpjZ7bPn947b8gJPzeHWyNVhFsaerc0n3TsbOINvRP2byTZ5LKezow==",
+    "@esbuild/openbsd-x64@0.27.2": {
+      "integrity": "sha512-/it7w9Nb7+0KFIzjalNJVR5bOzA9Vay+yIPLVHfIQYG/j+j9VTH84aNB8ExGKPU4AzfaEvN9/V4HV+F+vo8OEg==",
       "os": ["openbsd"],
       "cpu": ["x64"]
     },
-    "@esbuild/openbsd-x64@0.25.12": {
-      "integrity": "sha512-MZyXUkZHjQxUvzK7rN8DJ3SRmrVrke8ZyRusHlP+kuwqTcfWLyqMOE3sScPPyeIXN/mDJIfGXvcMqCgYKekoQw==",
-      "os": ["openbsd"],
-      "cpu": ["x64"]
-    },
-    "@esbuild/openharmony-arm64@0.25.12": {
-      "integrity": "sha512-rm0YWsqUSRrjncSXGA7Zv78Nbnw4XL6/dzr20cyrQf7ZmRcsovpcRBdhD43Nuk3y7XIoW2OxMVvwuRvk9XdASg==",
+    "@esbuild/openharmony-arm64@0.27.2": {
+      "integrity": "sha512-LRBbCmiU51IXfeXk59csuX/aSaToeG7w48nMwA6049Y4J4+VbWALAuXcs+qcD04rHDuSCSRKdmY63sruDS5qag==",
       "os": ["openharmony"],
       "cpu": ["arm64"]
     },
···
       "os": ["sunos"],
       "cpu": ["x64"]
     },
-    "@esbuild/sunos-x64@0.21.5": {
-      "integrity": "sha512-6+gjmFpfy0BHU5Tpptkuh8+uw3mnrvgs+dSPQXQOv3ekbordwnzTVEb4qnIvQcYXq6gzkyTnoZ9dZG+D4garKg==",
-      "os": ["sunos"],
-      "cpu": ["x64"]
-    },
-    "@esbuild/sunos-x64@0.25.12": {
-      "integrity": "sha512-3wGSCDyuTHQUzt0nV7bocDy72r2lI33QL3gkDNGkod22EsYl04sMf0qLb8luNKTOmgF/eDEDP5BFNwoBKH441w==",
+    "@esbuild/sunos-x64@0.27.2": {
+      "integrity": "sha512-kMtx1yqJHTmqaqHPAzKCAkDaKsffmXkPHThSfRwZGyuqyIeBvf08KSsYXl+abf5HDAPMJIPnbBfXvP2ZC2TfHg==",
       "os": ["sunos"],
       "cpu": ["x64"]
     },
···
       "os": ["win32"],
       "cpu": ["arm64"]
     },
-    "@esbuild/win32-arm64@0.21.5": {
-      "integrity": "sha512-Z0gOTd75VvXqyq7nsl93zwahcTROgqvuAcYDUr+vOv8uHhNSKROyU961kgtCD1e95IqPKSQKH7tBTslnS3tA8A==",
-      "os": ["win32"],
-      "cpu": ["arm64"]
-    },
-    "@esbuild/win32-arm64@0.25.12": {
-      "integrity": "sha512-rMmLrur64A7+DKlnSuwqUdRKyd3UE7oPJZmnljqEptesKM8wx9J8gx5u0+9Pq0fQQW8vqeKebwNXdfOyP+8Bsg==",
+    "@esbuild/win32-arm64@0.27.2": {
+      "integrity": "sha512-Yaf78O/B3Kkh+nKABUF++bvJv5Ijoy9AN1ww904rOXZFLWVc5OLOfL56W+C8F9xn5JQZa3UX6m+IktJnIb1Jjg==",
       "os": ["win32"],
       "cpu": ["arm64"]
     },
···
       "os": ["win32"],
       "cpu": ["ia32"]
     },
-    "@esbuild/win32-ia32@0.21.5": {
-      "integrity": "sha512-SWXFF1CL2RVNMaVs+BBClwtfZSvDgtL//G/smwAc5oVK/UPu2Gu9tIaRgFmYFFKrmg3SyAjSrElf0TiJ1v8fYA==",
-      "os": ["win32"],
-      "cpu": ["ia32"]
-    },
-    "@esbuild/win32-ia32@0.25.12": {
-      "integrity": "sha512-HkqnmmBoCbCwxUKKNPBixiWDGCpQGVsrQfJoVGYLPT41XWF8lHuE5N6WhVia2n4o5QK5M4tYr21827fNhi4byQ==",
+    "@esbuild/win32-ia32@0.27.2": {
+      "integrity": "sha512-Iuws0kxo4yusk7sw70Xa2E2imZU5HoixzxfGCdxwBdhiDgt9vX9VUCBhqcwY7/uh//78A1hMkkROMJq9l27oLQ==",
       "os": ["win32"],
       "cpu": ["ia32"]
     },
···
       "os": ["win32"],
       "cpu": ["x64"]
     },
-    "@esbuild/win32-x64@0.21.5": {
-      "integrity": "sha512-tQd/1efJuzPC6rCFwEvLtci/xNFcTZknmXs98FYDfGE4wP9ClFV98nyKrzJKVPMhdDnjzLhdUyMX4PsQAPjwIw==",
-      "os": ["win32"],
-      "cpu": ["x64"]
-    },
-    "@esbuild/win32-x64@0.25.12": {
-      "integrity": "sha512-alJC0uCZpTFrSL0CCDjcgleBXPnCrEAhTBILpeAp7M/OFgoqtAetfBzX0xM00MUsVVPpVjlPuMbREqnZCXaTnA==",
+    "@esbuild/win32-x64@0.27.2": {
+      "integrity": "sha512-sRdU18mcKf7F+YgheI/zGf5alZatMUTKj/jNS6l744f9u3WFu4v7twcUI9vu4mknF4Y9aDlblIie0IM+5xxaqQ==",
       "os": ["win32"],
       "cpu": ["x64"]
     },
···
         "@jridgewell/sourcemap-codec"
       ]
     },
-    "@noble/secp256k1@2.3.0": {
-      "integrity": "sha512-0TQed2gcBbIrh7Ccyw+y/uZQvbJwm7Ao4scBUxqpBCcsOlZG0O4KGfjtNAy/li4W8n1xt3dxrwJ0beZ2h2G6Kw=="
-    },
     "@noble/secp256k1@3.0.0": {
       "integrity": "sha512-NJBaR352KyIvj3t6sgT/+7xrNyF9Xk9QlLSIqUGVUYlsnDTAUqY8LOmwpcgEx4AMJXRITQ5XEVHD+mMaPfr3mg=="
     },
-    "@rollup/rollup-android-arm-eabi@4.53.3": {
-      "integrity": "sha512-mRSi+4cBjrRLoaal2PnqH82Wqyb+d3HsPUN/W+WslCXsZsyHa9ZeQQX/pQsZaVIWDkPcpV6jJ+3KLbTbgnwv8w==",
+    "@rollup/rollup-android-arm-eabi@4.54.0": {
+      "integrity": "sha512-OywsdRHrFvCdvsewAInDKCNyR3laPA2mc9bRYJ6LBp5IyvF3fvXbbNR0bSzHlZVFtn6E0xw2oZlyjg4rKCVcng==",
       "os": ["android"],
       "cpu": ["arm"]
     },
-    "@rollup/rollup-android-arm64@4.53.3": {
-      "integrity": "sha512-CbDGaMpdE9sh7sCmTrTUyllhrg65t6SwhjlMJsLr+J8YjFuPmCEjbBSx4Z/e4SmDyH3aB5hGaJUP2ltV/vcs4w==",
+    "@rollup/rollup-android-arm64@4.54.0": {
+      "integrity": "sha512-Skx39Uv+u7H224Af+bDgNinitlmHyQX1K/atIA32JP3JQw6hVODX5tkbi2zof/E69M1qH2UoN3Xdxgs90mmNYw==",
       "os": ["android"],
       "cpu": ["arm64"]
     },
-    "@rollup/rollup-darwin-arm64@4.53.3": {
-      "integrity": "sha512-Nr7SlQeqIBpOV6BHHGZgYBuSdanCXuw09hon14MGOLGmXAFYjx1wNvquVPmpZnl0tLjg25dEdr4IQ6GgyToCUA==",
+    "@rollup/rollup-darwin-arm64@4.54.0": {
+      "integrity": "sha512-k43D4qta/+6Fq+nCDhhv9yP2HdeKeP56QrUUTW7E6PhZP1US6NDqpJj4MY0jBHlJivVJD5P8NxrjuobZBJTCRw==",
       "os": ["darwin"],
       "cpu": ["arm64"]
     },
-    "@rollup/rollup-darwin-x64@4.53.3": {
-      "integrity": "sha512-DZ8N4CSNfl965CmPktJ8oBnfYr3F8dTTNBQkRlffnUarJ2ohudQD17sZBa097J8xhQ26AwhHJ5mvUyQW8ddTsQ==",
+    "@rollup/rollup-darwin-x64@4.54.0": {
+      "integrity": "sha512-cOo7biqwkpawslEfox5Vs8/qj83M/aZCSSNIWpVzfU2CYHa2G3P1UN5WF01RdTHSgCkri7XOlTdtk17BezlV3A==",
       "os": ["darwin"],
       "cpu": ["x64"]
     },
-    "@rollup/rollup-freebsd-arm64@4.53.3": {
-      "integrity": "sha512-yMTrCrK92aGyi7GuDNtGn2sNW+Gdb4vErx4t3Gv/Tr+1zRb8ax4z8GWVRfr3Jw8zJWvpGHNpss3vVlbF58DZ4w==",
+    "@rollup/rollup-freebsd-arm64@4.54.0": {
+      "integrity": "sha512-miSvuFkmvFbgJ1BevMa4CPCFt5MPGw094knM64W9I0giUIMMmRYcGW/JWZDriaw/k1kOBtsWh1z6nIFV1vPNtA==",
       "os": ["freebsd"],
       "cpu": ["arm64"]
     },
-    "@rollup/rollup-freebsd-x64@4.53.3": {
-      "integrity": "sha512-lMfF8X7QhdQzseM6XaX0vbno2m3hlyZFhwcndRMw8fbAGUGL3WFMBdK0hbUBIUYcEcMhVLr1SIamDeuLBnXS+Q==",
+    "@rollup/rollup-freebsd-x64@4.54.0": {
+      "integrity": "sha512-KGXIs55+b/ZfZsq9aR026tmr/+7tq6VG6MsnrvF4H8VhwflTIuYh+LFUlIsRdQSgrgmtM3fVATzEAj4hBQlaqQ==",
       "os": ["freebsd"],
       "cpu": ["x64"]
     },
-    "@rollup/rollup-linux-arm-gnueabihf@4.53.3": {
-      "integrity": "sha512-k9oD15soC/Ln6d2Wv/JOFPzZXIAIFLp6B+i14KhxAfnq76ajt0EhYc5YPeX6W1xJkAdItcVT+JhKl1QZh44/qw==",
+    "@rollup/rollup-linux-arm-gnueabihf@4.54.0": {
+      "integrity": "sha512-EHMUcDwhtdRGlXZsGSIuXSYwD5kOT9NVnx9sqzYiwAc91wfYOE1g1djOEDseZJKKqtHAHGwnGPQu3kytmfaXLQ==",
       "os": ["linux"],
       "cpu": ["arm"]
     },
-    "@rollup/rollup-linux-arm-musleabihf@4.53.3": {
-      "integrity": "sha512-vTNlKq+N6CK/8UktsrFuc+/7NlEYVxgaEgRXVUVK258Z5ymho29skzW1sutgYjqNnquGwVUObAaxae8rZ6YMhg==",
+    "@rollup/rollup-linux-arm-musleabihf@4.54.0": {
+      "integrity": "sha512-+pBrqEjaakN2ySv5RVrj/qLytYhPKEUwk+e3SFU5jTLHIcAtqh2rLrd/OkbNuHJpsBgxsD8ccJt5ga/SeG0JmA==",
       "os": ["linux"],
       "cpu": ["arm"]
     },
-    "@rollup/rollup-linux-arm64-gnu@4.53.3": {
-      "integrity": "sha512-RGrFLWgMhSxRs/EWJMIFM1O5Mzuz3Xy3/mnxJp/5cVhZ2XoCAxJnmNsEyeMJtpK+wu0FJFWz+QF4mjCA7AUQ3w==",
+    "@rollup/rollup-linux-arm64-gnu@4.54.0": {
+      "integrity": "sha512-NSqc7rE9wuUaRBsBp5ckQ5CVz5aIRKCwsoa6WMF7G01sX3/qHUw/z4pv+D+ahL1EIKy6Enpcnz1RY8pf7bjwng==",
       "os": ["linux"],
       "cpu": ["arm64"]
     },
-    "@rollup/rollup-linux-arm64-musl@4.53.3": {
-      "integrity": "sha512-kASyvfBEWYPEwe0Qv4nfu6pNkITLTb32p4yTgzFCocHnJLAHs+9LjUu9ONIhvfT/5lv4YS5muBHyuV84epBo/A==",
+    "@rollup/rollup-linux-arm64-musl@4.54.0": {
+      "integrity": "sha512-gr5vDbg3Bakga5kbdpqx81m2n9IX8M6gIMlQQIXiLTNeQW6CucvuInJ91EuCJ/JYvc+rcLLsDFcfAD1K7fMofg==",
       "os": ["linux"],
       "cpu": ["arm64"]
     },
-    "@rollup/rollup-linux-loong64-gnu@4.53.3": {
-      "integrity": "sha512-JiuKcp2teLJwQ7vkJ95EwESWkNRFJD7TQgYmCnrPtlu50b4XvT5MOmurWNrCj3IFdyjBQ5p9vnrX4JM6I8OE7g==",
+    "@rollup/rollup-linux-loong64-gnu@4.54.0": {
+      "integrity": "sha512-gsrtB1NA3ZYj2vq0Rzkylo9ylCtW/PhpLEivlgWe0bpgtX5+9j9EZa0wtZiCjgu6zmSeZWyI/e2YRX1URozpIw==",
       "os": ["linux"],
       "cpu": ["loong64"]
     },
-    "@rollup/rollup-linux-ppc64-gnu@4.53.3": {
-      "integrity": "sha512-EoGSa8nd6d3T7zLuqdojxC20oBfNT8nexBbB/rkxgKj5T5vhpAQKKnD+h3UkoMuTyXkP5jTjK/ccNRmQrPNDuw==",
+    "@rollup/rollup-linux-ppc64-gnu@4.54.0": {
+      "integrity": "sha512-y3qNOfTBStmFNq+t4s7Tmc9hW2ENtPg8FeUD/VShI7rKxNW7O4fFeaYbMsd3tpFlIg1Q8IapFgy7Q9i2BqeBvA==",
       "os": ["linux"],
       "cpu": ["ppc64"]
     },
-    "@rollup/rollup-linux-riscv64-gnu@4.53.3": {
-      "integrity": "sha512-4s+Wped2IHXHPnAEbIB0YWBv7SDohqxobiiPA1FIWZpX+w9o2i4LezzH/NkFUl8LRci/8udci6cLq+jJQlh+0g==",
+    "@rollup/rollup-linux-riscv64-gnu@4.54.0": {
+      "integrity": "sha512-89sepv7h2lIVPsFma8iwmccN7Yjjtgz0Rj/Ou6fEqg3HDhpCa+Et+YSufy27i6b0Wav69Qv4WBNl3Rs6pwhebQ==",
       "os": ["linux"],
       "cpu": ["riscv64"]
     },
-    "@rollup/rollup-linux-riscv64-musl@4.53.3": {
-      "integrity": "sha512-68k2g7+0vs2u9CxDt5ktXTngsxOQkSEV/xBbwlqYcUrAVh6P9EgMZvFsnHy4SEiUl46Xf0IObWVbMvPrr2gw8A==",
+    "@rollup/rollup-linux-riscv64-musl@4.54.0": {
+      "integrity": "sha512-ZcU77ieh0M2Q8Ur7D5X7KvK+UxbXeDHwiOt/CPSBTI1fBmeDMivW0dPkdqkT4rOgDjrDDBUed9x4EgraIKoR2A==",
       "os": ["linux"],
       "cpu": ["riscv64"]
     },
-    "@rollup/rollup-linux-s390x-gnu@4.53.3": {
-      "integrity": "sha512-VYsFMpULAz87ZW6BVYw3I6sWesGpsP9OPcyKe8ofdg9LHxSbRMd7zrVrr5xi/3kMZtpWL/wC+UIJWJYVX5uTKg==",
+    "@rollup/rollup-linux-s390x-gnu@4.54.0": {
+      "integrity": "sha512-2AdWy5RdDF5+4YfG/YesGDDtbyJlC9LHmL6rZw6FurBJ5n4vFGupsOBGfwMRjBYH7qRQowT8D/U4LoSvVwOhSQ==",
       "os": ["linux"],
       "cpu": ["s390x"]
     },
-    "@rollup/rollup-linux-x64-gnu@4.53.3": {
-      "integrity": "sha512-3EhFi1FU6YL8HTUJZ51imGJWEX//ajQPfqWLI3BQq4TlvHy4X0MOr5q3D2Zof/ka0d5FNdPwZXm3Yyib/UEd+w==",
+    "@rollup/rollup-linux-x64-gnu@4.54.0": {
+      "integrity": "sha512-WGt5J8Ij/rvyqpFexxk3ffKqqbLf9AqrTBbWDk7ApGUzaIs6V+s2s84kAxklFwmMF/vBNGrVdYgbblCOFFezMQ==",
       "os": ["linux"],
       "cpu": ["x64"]
     },
-    "@rollup/rollup-linux-x64-musl@4.53.3": {
-      "integrity": "sha512-eoROhjcc6HbZCJr+tvVT8X4fW3/5g/WkGvvmwz/88sDtSJzO7r/blvoBDgISDiCjDRZmHpwud7h+6Q9JxFwq1Q==",
+    "@rollup/rollup-linux-x64-musl@4.54.0": {
+      "integrity": "sha512-JzQmb38ATzHjxlPHuTH6tE7ojnMKM2kYNzt44LO/jJi8BpceEC8QuXYA908n8r3CNuG/B3BV8VR3Hi1rYtmPiw==",
       "os": ["linux"],
       "cpu": ["x64"]
     },
-    "@rollup/rollup-openharmony-arm64@4.53.3": {
-      "integrity": "sha512-OueLAWgrNSPGAdUdIjSWXw+u/02BRTcnfw9PN41D2vq/JSEPnJnVuBgw18VkN8wcd4fjUs+jFHVM4t9+kBSNLw==",
+    "@rollup/rollup-openharmony-arm64@4.54.0": {
+      "integrity": "sha512-huT3fd0iC7jigGh7n3q/+lfPcXxBi+om/Rs3yiFxjvSxbSB6aohDFXbWvlspaqjeOh+hx7DDHS+5Es5qRkWkZg==",
       "os": ["openharmony"],
       "cpu": ["arm64"]
     },
-    "@rollup/rollup-win32-arm64-msvc@4.53.3": {
-      "integrity": "sha512-GOFuKpsxR/whszbF/bzydebLiXIHSgsEUp6M0JI8dWvi+fFa1TD6YQa4aSZHtpmh2/uAlj/Dy+nmby3TJ3pkTw==",
+    "@rollup/rollup-win32-arm64-msvc@4.54.0": {
+      "integrity": "sha512-c2V0W1bsKIKfbLMBu/WGBz6Yci8nJ/ZJdheE0EwB73N3MvHYKiKGs3mVilX4Gs70eGeDaMqEob25Tw2Gb9Nqyw==",
       "os": ["win32"],
       "cpu": ["arm64"]
     },
-    "@rollup/rollup-win32-ia32-msvc@4.53.3": {
-      "integrity": "sha512-iah+THLcBJdpfZ1TstDFbKNznlzoxa8fmnFYK4V67HvmuNYkVdAywJSoteUszvBQ9/HqN2+9AZghbajMsFT+oA==",
+    "@rollup/rollup-win32-ia32-msvc@4.54.0": {
+      "integrity": "sha512-woEHgqQqDCkAzrDhvDipnSirm5vxUXtSKDYTVpZG3nUdW/VVB5VdCYA2iReSj/u3yCZzXID4kuKG7OynPnB3WQ==",
       "os": ["win32"],
       "cpu": ["ia32"]
     },
-    "@rollup/rollup-win32-x64-gnu@4.53.3": {
-      "integrity": "sha512-J9QDiOIZlZLdcot5NXEepDkstocktoVjkaKUtqzgzpt2yWjGlbYiKyp05rWwk4nypbYUNoFAztEgixoLaSETkg==",
+    "@rollup/rollup-win32-x64-gnu@4.54.0": {
+      "integrity": "sha512-dzAc53LOuFvHwbCEOS0rPbXp6SIhAf2txMP5p6mGyOXXw5mWY8NGGbPMPrs4P1WItkfApDathBj/NzMLUZ9rtQ==",
       "os": ["win32"],
       "cpu": ["x64"]
     },
-    "@rollup/rollup-win32-x64-msvc@4.53.3": {
-      "integrity": "sha512-UhTd8u31dXadv0MopwGgNOBpUVROFKWVQgAg5N1ESyCz8AuBcMqm4AuTjrwgQKGDfoFuz02EuMRHQIw/frmYKQ==",
+    "@rollup/rollup-win32-x64-msvc@4.54.0": {
+      "integrity": "sha512-hYT5d3YNdSh3mbCU1gwQyPgQd3T2ne0A3KG8KSBdav5TiBg6eInVmV+TeR5uHufiIgSFg0XsOWGW5/RhNcSvPg==",
       "os": ["win32"],
       "cpu": ["x64"]
     },
···
         "acorn"
       ]
     },
-    "@sveltejs/vite-plugin-svelte-inspector@4.0.1_@sveltejs+vite-plugin-svelte@5.1.1__svelte@5.45.10___acorn@8.15.0__vite@6.4.1___picomatch@4.0.3_svelte@5.45.10__acorn@8.15.0_vite@6.4.1__picomatch@4.0.3": {
-      "integrity": "sha512-J/Nmb2Q2y7mck2hyCX4ckVHcR5tu2J+MtBEQqpDrrgELZ2uvraQcK/ioCV61AqkdXFgriksOKIceDcQmqnGhVw==",
+    "@sveltejs/vite-plugin-svelte-inspector@5.0.1_@sveltejs+vite-plugin-svelte@6.2.1__svelte@5.46.1___acorn@8.15.0__vite@7.3.0___picomatch@4.0.3_svelte@5.46.1__acorn@8.15.0_vite@7.3.0__picomatch@4.0.3": {
+      "integrity": "sha512-ubWshlMk4bc8mkwWbg6vNvCeT7lGQojE3ijDh3QTR6Zr/R+GXxsGbyH4PExEPpiFmqPhYiVSVmHBjUcVc1JIrA==",
       "dependencies": [
         "@sveltejs/vite-plugin-svelte",
         "debug",
         "svelte",
-        "vite@6.4.1_picomatch@4.0.3"
+        "vite"
       ]
     },
-    "@sveltejs/vite-plugin-svelte@5.1.1_svelte@5.45.10__acorn@8.15.0_vite@6.4.1__picomatch@4.0.3": {
-      "integrity": "sha512-Y1Cs7hhTc+a5E9Va/xwKlAJoariQyHY+5zBgCZg4PFWNYQ1nMN9sjK1zhw1gK69DuqVP++sht/1GZg1aRwmAXQ==",
+    "@sveltejs/vite-plugin-svelte@6.2.1_svelte@5.46.1__acorn@8.15.0_vite@7.3.0__picomatch@4.0.3": {
+      "integrity": "sha512-YZs/OSKOQAQCnJvM/P+F1URotNnYNeU3P2s4oIpzm1uFaqUEqRxUB0g5ejMjEb5Gjb9/PiBI5Ktrq4rUUF8UVQ==",
       "dependencies": [
         "@sveltejs/vite-plugin-svelte-inspector",
         "debug",
         "deepmerge",
-        "kleur",
         "magic-string",
         "svelte",
-        "vite@6.4.1_picomatch@4.0.3",
+        "vite",
         "vitefu"
       ]
     },
···
         "redent"
       ]
     },
-    "@testing-library/svelte@5.2.9_svelte@5.45.10__acorn@8.15.0_vite@6.4.1__picomatch@4.0.3_vitest@2.1.9__jsdom@25.0.1__vite@5.4.21_jsdom@25.0.1": {
-      "integrity": "sha512-p0Lg/vL1iEsEasXKSipvW9nBCtItQGhYvxL8OZ4w7/IDdC+LGoSJw4mMS5bndVFON/gWryitEhMr29AlO4FvBg==",
+    "@testing-library/svelte-core@1.0.0_svelte@5.46.1__acorn@8.15.0": {
+      "integrity": "sha512-VkUePoLV6oOYwSUvX6ShA8KLnJqZiYMIbP2JW2t0GLWLkJxKGvuH5qrrZBV/X7cXFnLGuFQEC7RheYiZOW68KQ==",
+      "dependencies": [
+        "svelte"
+      ]
+    },
+    "@testing-library/svelte@5.3.1_svelte@5.46.1__acorn@8.15.0_vite@7.3.0__picomatch@4.0.3_vitest@4.0.16__jsdom@25.0.1__vite@7.3.0___picomatch@4.0.3_jsdom@25.0.1": {
+      "integrity": "sha512-8Ez7ZOqW5geRf9PF5rkuopODe5RGy3I9XR+kc7zHh26gBiktLaxTfKmhlGaSHYUOTQE7wFsLMN9xCJVCszw47w==",
       "dependencies": [
         "@testing-library/dom",
+        "@testing-library/svelte-core",
         "svelte",
-        "vite@6.4.1_picomatch@4.0.3",
+        "vite",
         "vitest"
       ],
       "optionalPeers": [
-        "vite@6.4.1_picomatch@4.0.3",
+        "vite",
         "vitest"
       ]
     },
···
     "@types/aria-query@5.0.4": {
       "integrity": "sha512-rfT93uj5s0PRL7EzccGMs3brplhcrghnDoV26NqKhCAS1hVo+WdNsPvE/yb6ilfr5hi2MEk6d5EWJTKdxg8jVw=="
     },
+    "@types/chai@5.2.3": {
+      "integrity": "sha512-Mw558oeA9fFbv65/y4mHtXDs9bPnFMZAL/jxdPFUpOHHIXX91mcgEHbS5Lahr+pwZFR8A7GQleRWeI6cGFC2UA==",
+      "dependencies": [
+        "@types/deep-eql",
+        "assertion-error"
+      ]
+    },
+    "@types/deep-eql@4.0.2": {
+      "integrity": "sha512-c9h9dVVMigMPc4bwTvC5dxqtqJZwQPePsWjPlpSOnojbor6pGqdk541lfA7AqFQr5pB1BRdq0juY9db81BwyFw=="
+    },
     "@types/estree@1.0.8": {
       "integrity": "sha512-dWHzHa2WqEXI/O1E9OjrocMTKJl2mSrEolh1Iomrv6U+JuNwaHXsXx9bLu5gG7BUWFIN0skIQJQ/L1rIex4X6w=="
     },
-    "@vitest/expect@2.1.9": {
-      "integrity": "sha512-UJCIkTBenHeKT1TTlKMJWy1laZewsRIzYighyYiJKZreqtdxSos/S1t+ktRMQWu2CKqaarrkeszJx1cgC5tGZw==",
+    "@vitest/expect@4.0.16": {
+      "integrity": "sha512-eshqULT2It7McaJkQGLkPjPjNph+uevROGuIMJdG3V+0BSR2w9u6J9Lwu+E8cK5TETlfou8GRijhafIMhXsimA==",
       "dependencies": [
+        "@standard-schema/spec",
+        "@types/chai",
         "@vitest/spy",
         "@vitest/utils",
         "chai",
         "tinyrainbow"
       ]
     },
-    "@vitest/mocker@2.1.9_vite@5.4.21": {
-      "integrity": "sha512-tVL6uJgoUdi6icpxmdrn5YNo3g3Dxv+IHJBr0GXHaEdTcw3F+cPKnsXFhli6nO+f/6SDKPHEK1UN+k+TQv0Ehg==",
+    "@vitest/mocker@4.0.16_vite@7.3.0__picomatch@4.0.3": {
+      "integrity": "sha512-yb6k4AZxJTB+q9ycAvsoxGn+j/po0UaPgajllBgt1PzoMAAmJGYFdDk0uCcRcxb3BrME34I6u8gHZTQlkqSZpg==",
       "dependencies": [
         "@vitest/spy",
         "estree-walker@3.0.3",
         "magic-string",
-        "vite@5.4.21"
+        "vite"
       ],
       "optionalPeers": [
-        "vite@5.4.21"
+        "vite"
       ]
     },
-    "@vitest/pretty-format@2.1.9": {
-      "integrity": "sha512-KhRIdGV2U9HOUzxfiHmY8IFHTdqtOhIzCpd8WRdJiE7D/HUcZVD0EgQCVjm+Q9gkUXWgBvMmTtZgIG48wq7sOQ==",
+    "@vitest/pretty-format@4.0.16": {
+      "integrity": "sha512-eNCYNsSty9xJKi/UdVD8Ou16alu7AYiS2fCPRs0b1OdhJiV89buAXQLpTbe+X8V9L6qrs9CqyvU7OaAopJYPsA==",
       "dependencies": [
         "tinyrainbow"
       ]
     },
-    "@vitest/runner@2.1.9": {
-      "integrity": "sha512-ZXSSqTFIrzduD63btIfEyOmNcBmQvgOVsPNPe0jYtESiXkhd8u2erDLnMxmGrDCwHCCHE7hxwRDCT3pt0esT4g==",
+    "@vitest/runner@4.0.16": {
+      "integrity": "sha512-VWEDm5Wv9xEo80ctjORcTQRJ539EGPB3Pb9ApvVRAY1U/WkHXmmYISqU5E79uCwcW7xYUV38gwZD+RV755fu3Q==",
       "dependencies": [
         "@vitest/utils",
         "pathe"
       ]
     },
-    "@vitest/snapshot@2.1.9": {
-      "integrity": "sha512-oBO82rEjsxLNJincVhLhaxxZdEtV0EFHMK5Kmx5sJ6H9L183dHECjiefOAdnqpIgT5eZwT04PoggUnW88vOBNQ==",
+    "@vitest/snapshot@4.0.16": {
+      "integrity": "sha512-sf6NcrYhYBsSYefxnry+DR8n3UV4xWZwWxYbCJUt2YdvtqzSPR7VfGrY0zsv090DAbjFZsi7ZaMi1KnSRyK1XA==",
       "dependencies": [
         "@vitest/pretty-format",
         "magic-string",
         "pathe"
       ]
     },
-    "@vitest/spy@2.1.9": {
-      "integrity": "sha512-E1B35FwzXXTs9FHNK6bDszs7mtydNi5MIfUWpceJ8Xbfb1gBMscAnwLbEu+B44ed6W3XjL9/ehLPHR1fkf1KLQ==",
-      "dependencies": [
-        "tinyspy"
-      ]
+    "@vitest/spy@4.0.16": {
+      "integrity": "sha512-4jIOWjKP0ZUaEmJm00E0cOBLU+5WE0BpeNr3XN6TEF05ltro6NJqHWxXD0kA8/Zc8Nh23AT8WQxwNG+WeROupw=="
     },
-    "@vitest/utils@2.1.9": {
-      "integrity": "sha512-v0psaMSkNJ3A2NMrUEHFRzJtDPFn+/VWZ5WxImB21T9fjucJRmS7xCS3ppEnARb9y11OAzaD+P2Ps+b+BGX5iQ==",
+    "@vitest/utils@4.0.16": {
+      "integrity": "sha512-h8z9yYhV3e1LEfaQ3zdypIrnAg/9hguReGZoS7Gl0aBG5xgA410zBqECqmaF/+RkTggRsfnzc1XaAHA6bmUufA==",
       "dependencies": [
         "@vitest/pretty-format",
-        "loupe",
         "tinyrainbow"
       ]
     },
···
     "axobject-query@4.1.0": {
       "integrity": "sha512-qIj0G9wZbMGNLjLmg1PT6v2mE9AH2zlnADJD/2tC6E00hgmhUOfEB6greHPAfLRSufHqROIUTkw6E+M3lH0PTQ=="
     },
-    "cac@6.7.14": {
-      "integrity": "sha512-b6Ilus+c3RrdDk+JhLKUAQfzzgLEPy6wcXqS7f/xe1EETvsDP6GORG7SFuOs6cID5YkqchW/LXZbX5bc8j7ZcQ=="
-    },
     "call-bind-apply-helpers@1.0.2": {
       "integrity": "sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==",
       "dependencies": [
···
         "function-bind"
       ]
     },
-    "chai@5.3.3": {
-      "integrity": "sha512-4zNhdJD/iOjSH0A05ea+Ke6MU5mmpQcbQsSOkgdaUMJ9zTlDTD/GYlwohmIE2u0gaxHYiVHEn1Fw9mZ/ktJWgw==",
-      "dependencies": [
-        "assertion-error",
-        "check-error",
-        "deep-eql",
-        "loupe",
-        "pathval"
-      ]
-    },
-    "check-error@2.1.1": {
-      "integrity": "sha512-OAlb+T7V4Op9OwdkjmguYRqncdlx5JiofwOAUkmTF+jNdHwzTaTs4sRAGpzLF3oOz5xAyDGrPgeIDFQmDOTiJw=="
-    },
-    "chokidar@4.0.3": {
-      "integrity": "sha512-Qgzu8kfBvo+cA4962jnP1KkS6Dop5NS6g7R5LFYJr4b8Ub94PPQXUksCw9PvXoeXPRRddRNC5C1JQUR2SMGtnA==",
-      "dependencies": [
-        "readdirp"
-      ]
+    "chai@6.2.2": {
+      "integrity": "sha512-NUPRluOfOiTKBKvWPtSD4PhFvWCqOi0BGStNWs57X9js7XGTprSmFoz5F0tWhR4WPjNeR9jXqdC7/UpSJTnlRg=="
     },
     "cli-color@2.0.4": {
       "integrity": "sha512-zlnpg0jNcibNrO7GG9IeHH7maWFeCz+Ja1wx/7tZNU5ASSSSZ+/qZciM0/LHCYxSdqv5h2sdbQ/PXYdOuetXvA==",
···
     },
     "decimal.js@10.6.0": {
       "integrity": "sha512-YpgQiITW3JXGntzdUmyUR1V812Hn8T1YVXhCu+wO3OpS4eU9l4YdD3qjyiKdV6mvV29zapkMeD390UVEf2lkUg=="
-    },
-    "deep-eql@5.0.2": {
-      "integrity": "sha512-h5k/5U50IJJFpzfL6nO9jaaumfjO/f2NjK/oYB2Djzm4p9L+3T9qWpZqZ2hAbLPuuYq9wrU08WQyBTL5GbPk5Q=="
     },
     "deepmerge@4.3.1": {
       "integrity": "sha512-3sUqbMEc77XqpdNO7FRyRog+eW3ph+GYCbj+rK+uYyRMuwsVy0rMiVtPn+QJlKFvWP/1PYpapqYn0Me2knFn+A=="
···
       "scripts": true,
       "bin": true
     },
-    "esbuild@0.21.5": {
-      "integrity": "sha512-mg3OPMV4hXywwpoDxu3Qda5xCKQi+vCTZq8S9J/EpkhB2HzKXq4SNFZE3+NK93JYxc8VMSep+lOUSC/RVKaBqw==",
+    "esbuild@0.27.2": {
+      "integrity": "sha512-HyNQImnsOC7X9PMNaCIeAm4ISCQXs5a5YasTXVliKv4uuBo1dKrG0A+uQS8M5eXjVMnLg3WgXaKvprHlFJQffw==",
       "optionalDependencies": [
-        "@esbuild/aix-ppc64@0.21.5",
-        "@esbuild/android-arm@0.21.5",
-        "@esbuild/android-arm64@0.21.5",
-        "@esbuild/android-x64@0.21.5",
-        "@esbuild/darwin-arm64@0.21.5",
-        "@esbuild/darwin-x64@0.21.5",
-        "@esbuild/freebsd-arm64@0.21.5",
-        "@esbuild/freebsd-x64@0.21.5",
-        "@esbuild/linux-arm@0.21.5",
-        "@esbuild/linux-arm64@0.21.5",
-        "@esbuild/linux-ia32@0.21.5",
-        "@esbuild/linux-loong64@0.21.5",
-        "@esbuild/linux-mips64el@0.21.5",
-        "@esbuild/linux-ppc64@0.21.5",
-        "@esbuild/linux-riscv64@0.21.5",
-        "@esbuild/linux-s390x@0.21.5",
-        "@esbuild/linux-x64@0.21.5",
-        "@esbuild/netbsd-x64@0.21.5",
-        "@esbuild/openbsd-x64@0.21.5",
-        "@esbuild/sunos-x64@0.21.5",
-        "@esbuild/win32-arm64@0.21.5",
-        "@esbuild/win32-ia32@0.21.5",
-        "@esbuild/win32-x64@0.21.5"
-      ],
-      "scripts": true,
-      "bin": true
-    },
-    "esbuild@0.25.12": {
-      "integrity": "sha512-bbPBYYrtZbkt6Os6FiTLCTFxvq4tt3JKall1vRwshA3fdVztsLAatFaZobhkBC8/BrPetoa0oksYoKXoG4ryJg==",
-      "optionalDependencies": [
-        "@esbuild/aix-ppc64@0.25.12",
-        "@esbuild/android-arm@0.25.12",
-        "@esbuild/android-arm64@0.25.12",
-        "@esbuild/android-x64@0.25.12",
-        "@esbuild/darwin-arm64@0.25.12",
-        "@esbuild/darwin-x64@0.25.12",
-        "@esbuild/freebsd-arm64@0.25.12",
-        "@esbuild/freebsd-x64@0.25.12",
-        "@esbuild/linux-arm@0.25.12",
-        "@esbuild/linux-arm64@0.25.12",
-        "@esbuild/linux-ia32@0.25.12",
-        "@esbuild/linux-loong64@0.25.12",
-        "@esbuild/linux-mips64el@0.25.12",
-        "@esbuild/linux-ppc64@0.25.12",
-        "@esbuild/linux-riscv64@0.25.12",
-        "@esbuild/linux-s390x@0.25.12",
-        "@esbuild/linux-x64@0.25.12",
+        "@esbuild/aix-ppc64@0.27.2",
+        "@esbuild/android-arm@0.27.2",
+        "@esbuild/android-arm64@0.27.2",
+        "@esbuild/android-x64@0.27.2",
+        "@esbuild/darwin-arm64@0.27.2",
+        "@esbuild/darwin-x64@0.27.2",
+        "@esbuild/freebsd-arm64@0.27.2",
+        "@esbuild/freebsd-x64@0.27.2",
+        "@esbuild/linux-arm@0.27.2",
+        "@esbuild/linux-arm64@0.27.2",
+        "@esbuild/linux-ia32@0.27.2",
+        "@esbuild/linux-loong64@0.27.2",
+        "@esbuild/linux-mips64el@0.27.2",
+        "@esbuild/linux-ppc64@0.27.2",
+        "@esbuild/linux-riscv64@0.27.2",
+        "@esbuild/linux-s390x@0.27.2",
+        "@esbuild/linux-x64@0.27.2",
         "@esbuild/netbsd-arm64",
-        "@esbuild/netbsd-x64@0.25.12",
+        "@esbuild/netbsd-x64@0.27.2",
         "@esbuild/openbsd-arm64",
-        "@esbuild/openbsd-x64@0.25.12",
+        "@esbuild/openbsd-x64@0.27.2",
         "@esbuild/openharmony-arm64",
-        "@esbuild/sunos-x64@0.25.12",
-        "@esbuild/win32-arm64@0.25.12",
-        "@esbuild/win32-ia32@0.25.12",
-        "@esbuild/win32-x64@0.25.12"
+        "@esbuild/sunos-x64@0.27.2",
+        "@esbuild/win32-arm64@0.27.2",
+        "@esbuild/win32-ia32@0.27.2",
+        "@esbuild/win32-x64@0.27.2"
       ],
       "scripts": true,
       "bin": true
···
         "xml-name-validator"
       ]
     },
-    "kleur@4.1.5": {
-      "integrity": "sha512-o+NO+8WrRiQEE4/7nwRJhN1HWpVmJm511pBHUxPLtp0BUISzlBplORYSmTclCnJvQq2tKu/sgl3xVpkc7ZWuQQ=="
-    },
     "locate-character@3.0.0": {
       "integrity": "sha512-SW13ws7BjaeJ6p7Q6CO2nchbYEc3X3J6WrmTTDto7yMPqVSZTUyY5Tjbid+Ab8gLnATtygYtiDIJGQRRn2ZOiA=="
-    },
-    "loupe@3.2.1": {
-      "integrity": "sha512-CdzqowRJCeLU72bHvWqwRBBlLcMEtIvGrlvef74kMnV2AolS9Y8xUv1I0U/MNAWMhBlKIoyuEgoJ0t/bbwHbLQ=="
     },
     "lru-cache@10.4.3": {
       "integrity": "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ=="
···
     "nwsapi@2.2.23": {
       "integrity": "sha512-7wfH4sLbt4M0gCDzGE6vzQBo0bfTKjU7Sfpqy/7gs1qBfYz2vEJH6vXcBKpO3+6Yu1telwd0t9HpyOoLEQQbIQ=="
     },
+    "obug@2.1.1": {
+      "integrity": "sha512-uTqF9MuPraAQ+IsnPf366RG4cP9RtUi7MLO1N3KEc+wb0a6yKpeL0lmk2IB1jY5KHPAlTc6T/JRdC/YqxHNwkQ=="
+    },
     "parse5@7.3.0": {
       "integrity": "sha512-IInvU7fabl34qmi9gY8XOVxhYyMyuH2xUNpb2q8/Y+7552KlejkRvqvD19nMoUW/uQGGbqNpA6Tufu5FL5BZgw==",
       "dependencies": [
         "entities"
       ]
     },
-    "pathe@1.1.2": {
-      "integrity": "sha512-whLdWMYL2TwI08hn8/ZqAbrVemu0LNaNNJZX73O6qaIdCTfXutsLhMkjdENX0qhsQ9uIimo4/aQOmXkoon2nDQ=="
-    },
-    "pathval@2.0.1": {
-      "integrity": "sha512-//nshmD55c46FuFw26xV/xFAaB5HF9Xdap7HJBBnrKdAd6/GxDBaNA1870O79+9ueg61cZLSVc+OaFlfmObYVQ=="
+    "pathe@2.0.3": {
+      "integrity": "sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w=="
     },
     "picocolors@1.1.1": {
       "integrity": "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA=="
···
     "react-is@17.0.2": {
       "integrity": "sha512-w2GsyukL62IJnlaff/nRegPQR94C/XXamvMWmSHRJ4y7Ts/4ocGRmTHvOs8PSE6pB3dWOrD/nueuU5sduBsQ4w=="
     },
-    "readdirp@4.1.2": {
-      "integrity": "sha512-GDhwkLfywWL2s6vEjyhri+eXmfH6j1L7JE27WhqLeYzoh/A3DBaYGEj2H/HFZCn/kMfim73FXxEJTw06WtxQwg=="
-    },
     "redent@3.0.0": {
       "integrity": "sha512-6tDA8g98We0zd0GvVeMT9arEOnTw9qM03L9cJXaCjrip1OO764RDBLBfrB4cwzNGDj5OA5ioymC9GkizgWJDUg==",
       "dependencies": [
···
         "strip-indent"
       ]
     },
-    "rollup@4.53.3": {
-      "integrity": "sha512-w8GmOxZfBmKknvdXU1sdM9NHcoQejwF/4mNgj2JuEEdRaHwwF12K7e9eXn1nLZ07ad+du76mkVsyeb2rKGllsA==",
+    "rollup@4.54.0": {
+      "integrity": "sha512-3nk8Y3a9Ea8szgKhinMlGMhGMw89mqule3KWczxhIzqudyHdCIOHw8WJlj/r329fACjKLEh13ZSk7oE22kyeIw==",
       "dependencies": [
         "@types/estree"
       ],
···
         "min-indent"
       ]
     },
-    "svelte-check@4.3.5_svelte@5.45.10__acorn@8.15.0_typescript@5.9.3": {
-      "integrity": "sha512-e4VWZETyXaKGhpkxOXP+B/d0Fp/zKViZoJmneZWe/05Y2aqSKj3YN2nLfYPJBQ87WEiY4BQCQ9hWGu9mPT1a1Q==",
-      "dependencies": [
-        "@jridgewell/trace-mapping",
-        "chokidar",
-        "fdir",
-        "picocolors",
-        "sade",
-        "svelte",
-        "typescript"
-      ],
-      "bin": true
-    },
-    "svelte-i18n@4.0.1_svelte@5.45.10__acorn@8.15.0": {
+    "svelte-i18n@4.0.1_svelte@5.46.1__acorn@8.15.0": {
       "integrity": "sha512-jaykGlGT5PUaaq04JWbJREvivlCnALtT+m87Kbm0fxyYHynkQaxQMnIKHLm2WeIuBRoljzwgyvz0Z6/CMwfdmQ==",
       "dependencies": [
         "cli-color",
···
       ],
       "bin": true
     },
-    "svelte@5.45.10_acorn@8.15.0": {
-      "integrity": "sha512-GiWXq6akkEN3zVDMQ1BVlRolmks5JkEdzD/67mvXOz6drRfuddT5JwsGZjMGSnsTRv/PjAXX8fqBcOr2g2qc/Q==",
+    "svelte@5.46.1_acorn@8.15.0": {
+      "integrity": "sha512-ynjfCHD3nP2el70kN5Pmg37sSi0EjOm9FgHYQdC4giWG/hzO3AatzXXJJgP305uIhGQxSufJLuYWtkY8uK/8RA==",
       "dependencies": [
         "@jridgewell/remapping",
         "@jridgewell/sourcemap-codec",
···
     "tinybench@2.9.0": {
       "integrity": "sha512-0+DUvqWMValLmha6lr4kD8iAMK1HzV0/aKnCtWb9v9641TnP/MFb7Pc2bxoxQjTXAErryXVgUOfv2YqNllqGeg=="
     },
-    "tinyexec@0.3.2": {
-      "integrity": "sha512-KQQR9yN7R5+OSwaK0XQoj22pwHoTlgYqmUscPYoknOoWCWfj/5/ABTMRi69FrKU5ffPVh5QcFikpWJI/P1ocHA=="
+    "tinyexec@1.0.2": {
+      "integrity": "sha512-W/KYk+NFhkmsYpuHq5JykngiOCnxeVL8v8dFnqxSD8qEEdRfXk1SDM6JzNqcERbcGYj9tMrDQBYV9cjgnunFIg=="
     },
     "tinyglobby@0.2.15_picomatch@4.0.3": {
       "integrity": "sha512-j2Zq4NyQYG5XMST4cbs02Ak8iJUdxRM0XI5QyxXuZOzKOINmWurp3smXu3y5wDcJrptwpSjgXHzIQxR0omXljQ==",
···
         "picomatch"
       ]
     },
-    "tinypool@1.1.1": {
-      "integrity": "sha512-Zba82s87IFq9A9XmjiX5uZA/ARWDrB03OHlq+Vw1fSdt0I+4/Kutwy8BP4Y/y/aORMo61FQ0vIb5j44vSo5Pkg=="
-    },
-    "tinyrainbow@1.2.0": {
-      "integrity": "sha512-weEDEq7Z5eTHPDh4xjX789+fHfF+P8boiFB+0vbWzpbnbsEr/GRaohi/uMKxg8RZMXnl1ItAi/IUHWMsjDV7kQ=="
-    },
-    "tinyspy@3.0.2": {
-      "integrity": "sha512-n1cw8k1k0x4pgA2+9XrOkFydTerNcJ1zWCO5Nn9scWHTD+5tp8dghT2x1uduQePZTZgd3Tupf+x9BxJjeJi77Q=="
+    "tinyrainbow@3.0.3": {
+      "integrity": "sha512-PSkbLUoxOFRzJYjjxHJt9xro7D+iilgMX/C9lawzVuYiIdcihh9DXmVibBe8lmcFrRi/VzlPjBxbN7rH24q8/Q=="
     },
     "tldts-core@6.1.86": {
       "integrity": "sha512-Je6p7pkk+KMzMv2XXKmAE3McmolOQFdxkKw0R8EYNr7sELW46JqnNeTX8ybPiQgvg1ymCoF8LXs5fzFaZvJPTA=="
···
     "type@2.7.3": {
       "integrity": "sha512-8j+1QmAbPvLZow5Qpi6NCaN8FB60p/6x8/vfNqOk/hC+HuvFZhL4+WfekuhQLiqFZXOgQdrs3B+XxEmCc6b3FQ=="
     },
-    "typescript@5.9.3": {
-      "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
-      "bin": true
+    "unicode-segmenter@0.14.5": {
+      "integrity": "sha512-jHGmj2LUuqDcX3hqY12Ql+uhUTn8huuxNZGq7GvtF6bSybzH3aFgedYu/KTzQStEgt1Ra2F3HxadNXsNjb3m3g=="
     },
-    "unicode-segmenter@0.14.4": {
-      "integrity": "sha512-pR5VCiCrLrKOL6FRW61jnk9+wyMtKKowq+jyFY9oc6uHbWKhDL4yVRiI4YZPksGMK72Pahh8m0cn/0JvbDDyJg=="
-    },
-    "vite-node@2.1.9": {
-      "integrity": "sha512-AM9aQ/IPrW/6ENLQg3AGY4K1N2TGZdR5e4gu/MmmR2xR3Ll1+dib+nook92g4TV3PXVyeyxdWwtaCAiUL0hMxA==",
+    "vite@7.3.0_picomatch@4.0.3": {
+      "integrity": "sha512-dZwN5L1VlUBewiP6H9s2+B3e3Jg96D0vzN+Ry73sOefebhYr9f94wwkMNN/9ouoU8pV1BqA1d1zGk8928cx0rg==",
       "dependencies": [
-        "cac",
-        "debug",
-        "es-module-lexer",
-        "pathe",
-        "vite@5.4.21"
-      ],
-      "bin": true
-    },
-    "vite@5.4.21": {
-      "integrity": "sha512-o5a9xKjbtuhY6Bi5S3+HvbRERmouabWbyUcpXXUA1u+GNUKoROi9byOJ8M0nHbHYHkYICiMlqxkg1KkYmm25Sw==",
-      "dependencies": [
-        "esbuild@0.21.5",
-        "postcss",
-        "rollup"
-      ],
-      "optionalDependencies": [
-        "fsevents"
-      ],
-      "bin": true
-    },
-    "vite@6.4.1_picomatch@4.0.3": {
-      "integrity": "sha512-+Oxm7q9hDoLMyJOYfUYBuHQo+dkAloi33apOPP56pzj+vsdJDzr+j1NISE5pyaAuKL4A3UD34qd0lx5+kfKp2g==",
-      "dependencies": [
-        "esbuild@0.25.12",
+        "esbuild@0.27.2",
         "fdir",
         "picomatch",
         "postcss",
···
       ],
       "bin": true
     },
-    "vitefu@1.1.1_vite@6.4.1__picomatch@4.0.3": {
+    "vitefu@1.1.1_vite@7.3.0__picomatch@4.0.3": {
       "integrity": "sha512-B/Fegf3i8zh0yFbpzZ21amWzHmuNlLlmJT6n7bu5e+pCHUKQIfXSYokrqOBGEMMe9UG2sostKQF9mml/vYaWJQ==",
       "dependencies": [
-        "vite@6.4.1_picomatch@4.0.3"
+        "vite"
       ],
       "optionalPeers": [
-        "vite@6.4.1_picomatch@4.0.3"
+        "vite"
       ]
     },
-    "vitest@2.1.9_jsdom@25.0.1_vite@5.4.21": {
-      "integrity": "sha512-MSmPM9REYqDGBI8439mA4mWhV5sKmDlBKWIYbA3lRb2PTHACE0mgKwA8yQ2xq9vxDTuk4iPrECBAEW2aoFXY0Q==",
+    "vitest@4.0.16_jsdom@25.0.1_vite@7.3.0__picomatch@4.0.3": {
+      "integrity": "sha512-E4t7DJ9pESL6E3I8nFjPa4xGUd3PmiWDLsDztS2qXSJWfHtbQnwAWylaBvSNY48I3vr8PTqIZlyK8TE3V3CA4Q==",
       "dependencies": [
         "@vitest/expect",
         "@vitest/mocker",
···
         "@vitest/snapshot",
         "@vitest/spy",
         "@vitest/utils",
-        "chai",
-        "debug",
+        "es-module-lexer",
         "expect-type",
         "jsdom",
         "magic-string",
+        "obug",
         "pathe",
+        "picomatch",
         "std-env",
         "tinybench",
         "tinyexec",
-        "tinypool",
+        "tinyglobby",
         "tinyrainbow",
-        "vite@5.4.21",
-        "vite-node",
+        "vite",
         "why-is-node-running"
       ],
       "optionalPeers": [
···
       "integrity": "sha512-6qN4hJdMwfYBtE3YBTTHhoeuUrDBPZmbQaxWAqSALV/MeEnR5z1xd8UKud2RAkFoPkmB+hli1TZSnyi84xz1vQ==",
       "dependencies": [
         "iconv-lite"
-      ]
+      ],
+      "deprecated": true
     },
     "whatwg-mimetype@4.0.0": {
       "integrity": "sha512-QaKxh0eNIi2mE9p2vEdzfagOKHCcj1pJ56EEHGQOVxp8r9/iszLUUV7v89x9O1p/T+NlTM5W7jW6+cz4Fq1YVg=="
···
     },
     "zimmerframe@1.1.4": {
       "integrity": "sha512-B58NGBEoc8Y9MWWCQGl/gq9xBCe4IiKM0a2x7GZdQKOW5Exr8S1W24J6OgM1njK8xCRGvAJIL/MxXHf6SkmQKQ=="
+    },
+    "zod@4.3.5": {
+      "integrity": "sha512-k7Nwx6vuWx1IJ9Bjuf4Zt1PEllcwe7cls3VNzm4CQ1/hgtFUK2bRNG3rvnpPUhFjmqJKAKtjV576KnUkHocg/g=="
     }
   },
   "workspace": {
···
         "npm:@atcute/crypto@^2.3.0",
         "npm:@atcute/did-plc@~0.3.1",
         "npm:@atcute/multibase@^1.1.6",
-        "npm:@noble/secp256k1@^2.1.0",
-        "npm:@sveltejs/vite-plugin-svelte@5",
-        "npm:@testing-library/jest-dom@^6.6.3",
-        "npm:@testing-library/svelte@^5.2.6",
-        "npm:@testing-library/user-event@^14.5.2",
+        "npm:@noble/secp256k1@3",
+        "npm:@sveltejs/vite-plugin-svelte@^6.2.1",
+        "npm:@testing-library/jest-dom@^6.9.1",
+        "npm:@testing-library/svelte@^5.3.1",
+        "npm:@testing-library/user-event@^14.6.1",
         "npm:jsdom@^25.0.1",
-        "npm:multiformats@^13.3.1",
+        "npm:multiformats@^13.4.2",
         "npm:svelte-i18n@^4.0.1",
-        "npm:svelte@5",
-        "npm:vite@6",
-        "npm:vitest@^2.1.8"
+        "npm:svelte@^5.46.1",
+        "npm:vite@^7.3.0",
+        "npm:vitest@^4.0.16",
+        "npm:zod@^4.3.5"
       ]
     }
   }

frontend/package.json

···
     "@atcute/crypto": "^2.3.0",
     "@atcute/did-plc": "^0.3.1",
     "@atcute/multibase": "^1.1.6",
-    "@noble/secp256k1": "^2.1.0",
-    "multiformats": "^13.3.1",
-    "svelte-i18n": "^4.0.1"
+    "@noble/secp256k1": "^3.0.0",
+    "multiformats": "^13.4.2",
+    "svelte-i18n": "^4.0.1",
+    "zod": "^4.3.5"
   },
   "devDependencies": {
-    "@sveltejs/vite-plugin-svelte": "^5.0.0",
-    "@testing-library/jest-dom": "^6.6.3",
-    "@testing-library/svelte": "^5.2.6",
-    "@testing-library/user-event": "^14.5.2",
+    "@sveltejs/vite-plugin-svelte": "^6.2.1",
+    "@testing-library/jest-dom": "^6.9.1",
+    "@testing-library/svelte": "^5.3.1",
+    "@testing-library/user-event": "^14.6.1",
     "jsdom": "^25.0.1",
-    "svelte": "^5.0.0",
-    "vite": "^6.0.0",
-    "vitest": "^2.1.8"
+    "svelte": "^5.46.1",
+    "vite": "^7.3.0",
+    "vitest": "^4.0.16"
   }
 }

frontend/src/App.svelte

···
   import { initServerConfig } from './lib/serverConfig.svelte'
   import { initI18n } from './lib/i18n'
   import { isLoading as i18nLoading } from 'svelte-i18n'
+  import Toast from './components/Toast.svelte'
   import Login from './routes/Login.svelte'
   import Register from './routes/Register.svelte'
   import RegisterPasskey from './routes/RegisterPasskey.svelte'
···
   import DidDocumentEditor from './routes/DidDocumentEditor.svelte'
   initI18n()
 
-  const auth = getAuthState()
+  const auth = $derived(getAuthState())
 
   let oauthCallbackPending = $state(hasOAuthCallback())
 
···
   })
 
   $effect(() => {
-    if (auth.loading) return
+    if (auth.kind === 'loading') return
     const path = getCurrentPath()
     if (path === '/') {
-      if (auth.session) {
+      if (auth.kind === 'authenticated') {
         navigate('/dashboard', true)
       } else {
         navigate('/login', true)
···
 </script>
 
 <main>
-  {#if auth.loading || $i18nLoading || oauthCallbackPending}
-    <div class="loading">
-      <p>Loading...</p>
-    </div>
+  {#if auth.kind === 'loading' || $i18nLoading || oauthCallbackPending}
+    <div class="loading"></div>
   {:else}
     <CurrentComponent />
   {/if}
 </main>
+<Toast />
 
 <style>
   main {
···
   }
 
   .loading {
-    display: flex;
-    align-items: center;
-    justify-content: center;
     min-height: 100vh;
-    color: var(--text-secondary);
   }
 </style>

frontend/src/components/ReauthModal.svelte

···
   import { getAuthState, getValidToken } from '../lib/auth.svelte'
   import { api, ApiError } from '../lib/api'
   import { _ } from '../lib/i18n'
+  import type { Session } from '../lib/types/api'
+  import {
+    prepareRequestOptions,
+    serializeAssertionResponse,
+    type WebAuthnRequestOptionsResponse,
+  } from '../lib/webauthn'
 
   interface Props {
     show: boolean
···
 
   let { show = $bindable(), availableMethods = ['password'], onSuccess, onCancel }: Props = $props()
 
-  const auth = getAuthState()
+  const auth = $derived(getAuthState())
+
+  function getSession(): Session | null {
+    return auth.kind === 'authenticated' ? auth.session : null
+  }
+
+  const session = $derived(getSession())
   let activeMethod = $state<'password' | 'totp' | 'passkey'>('password')
   let password = $state('')
   let totpCode = $state('')
···
     }
   })
 
-  function arrayBufferToBase64Url(buffer: ArrayBuffer): string {
-    const bytes = new Uint8Array(buffer)
-    let binary = ''
-    for (let i = 0; i < bytes.byteLength; i++) {
-      binary += String.fromCharCode(bytes[i])
-    }
-    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '')
-  }
-
-  function base64UrlToArrayBuffer(base64url: string): ArrayBuffer {
-    const base64 = base64url.replace(/-/g, '+').replace(/_/g, '/')
-    const padded = base64 + '='.repeat((4 - base64.length % 4) % 4)
-    const binary = atob(padded)
-    const bytes = new Uint8Array(binary.length)
-    for (let i = 0; i < binary.length; i++) {
-      bytes[i] = binary.charCodeAt(i)
-    }
-    return bytes.buffer
-  }
-
-  function prepareAuthOptions(options: any): PublicKeyCredentialRequestOptions {
-    return {
-      ...options.publicKey,
-      challenge: base64UrlToArrayBuffer(options.publicKey.challenge),
-      allowCredentials: options.publicKey.allowCredentials?.map((cred: any) => ({
-        ...cred,
-        id: base64UrlToArrayBuffer(cred.id)
-      })) || []
-    }
-  }
-
   async function handlePasswordSubmit(e: Event) {
     e.preventDefault()
-    if (!auth.session || !password) return
+    if (!session || !password) return
     loading = true
     error = ''
     try {
···
 
   async function handleTotpSubmit(e: Event) {
     e.preventDefault()
-    if (!auth.session || !totpCode) return
+    if (!session || !totpCode) return
     loading = true
     error = ''
     try {
···
   }
 
   async function handlePasskeyAuth() {
-    if (!auth.session) return
+    if (!session) return
     if (!window.PublicKeyCredential) {
       error = 'Passkeys are not supported in this browser'
       return
···
         return
       }
       const { options } = await api.reauthPasskeyStart(token)
-      const publicKeyOptions = prepareAuthOptions(options)
+      const publicKeyOptions = prepareRequestOptions(options as WebAuthnRequestOptionsResponse)
       const credential = await navigator.credentials.get({
         publicKey: publicKeyOptions
       })
···
         error = 'Passkey authentication was cancelled'
         return
       }
-      const pkCredential = credential as PublicKeyCredential
-      const response = pkCredential.response as AuthenticatorAssertionResponse
-      const credentialResponse = {
-        id: pkCredential.id,
-        type: pkCredential.type,
-        rawId: arrayBufferToBase64Url(pkCredential.rawId),
-        response: {
-          clientDataJSON: arrayBufferToBase64Url(response.clientDataJSON),
-          authenticatorData: arrayBufferToBase64Url(response.authenticatorData),
-          signature: arrayBufferToBase64Url(response.signature),
-          userHandle: response.userHandle ? arrayBufferToBase64Url(response.userHandle) : null,
-        },
-      }
+      const credentialResponse = serializeAssertionResponse(credential as PublicKeyCredential)
       await api.reauthPasskeyFinish(token, credentialResponse)
       show = false
       onSuccess()

frontend/src/components/Skeleton.svelte

···
+<script lang="ts">
+  type Variant = 'line' | 'circle' | 'card'
+  type Size = 'tiny' | 'short' | 'medium' | 'full'
+
+  interface Props {
+    variant?: Variant
+    size?: Size
+    lines?: number
+    class?: string
+  }
+
+  let { variant = 'line', size = 'full', lines = 1, class: className = '' }: Props = $props()
+</script>
+
+{#if variant === 'card'}
+  <div class="skeleton-card {className}">
+    <div class="skeleton-header">
+      <div class="skeleton-line short"></div>
+      <div class="skeleton-line tiny"></div>
+    </div>
+    {#each Array(lines) as _}
+      <div class="skeleton-line"></div>
+    {/each}
+    <div class="skeleton-line medium"></div>
+  </div>
+{:else if variant === 'circle'}
+  <div class="skeleton-circle {className}"></div>
+{:else}
+  {#each Array(lines) as _, i}
+    <div class="skeleton-line {size} {className}" class:last={i === lines - 1}></div>
+  {/each}
+{/if}
+
+<style>
+  .skeleton-card {
+    background: var(--bg-card);
+    border: 1px solid var(--border-color);
+    border-radius: var(--radius-md);
+    padding: var(--space-3);
+  }
+
+  .skeleton-header {
+    display: flex;
+    gap: var(--space-2);
+    margin-bottom: var(--space-2);
+  }
+
+  .skeleton-line {
+    height: 14px;
+    background: var(--bg-tertiary);
+    border-radius: var(--radius-sm);
+    animation: skeleton-pulse 1.5s ease-in-out infinite;
+    margin-bottom: var(--space-1);
+  }
+
+  .skeleton-line.last {
+    margin-bottom: 0;
+  }
+
+  .skeleton-line.tiny { width: 50px; }
+  .skeleton-line.short { width: 80px; }
+  .skeleton-line.medium { width: 60%; }
+  .skeleton-line.full { width: 100%; }
+
+  .skeleton-circle {
+    width: 40px;
+    height: 40px;
+    border-radius: 50%;
+    background: var(--bg-tertiary);
+    animation: skeleton-pulse 1.5s ease-in-out infinite;
+  }
+
+  @keyframes skeleton-pulse {
+    0%, 100% { opacity: 1; }
+    50% { opacity: 0.4; }
+  }
+</style>

frontend/src/components/Toast.svelte

···
+<script lang="ts">
+  import { getToasts, dismissToast, type Toast } from '../lib/toast.svelte'
+
+  const toasts = $derived(getToasts())
+
+  function handleDismiss(id: number) {
+    dismissToast(id)
+  }
+
+  function getIcon(type: Toast['type']): string {
+    switch (type) {
+      case 'success':
+        return '✓'
+      case 'error':
+        return '!'
+      case 'warning':
+        return '⚠'
+      case 'info':
+        return 'i'
+    }
+  }
+</script>
+
+{#if toasts.length > 0}
+  <div class="toast-container" role="region" aria-label="Notifications">
+    {#each toasts as toast (toast.id)}
+      <div
+        class="toast toast-{toast.type}"
+        class:dismissing={toast.dismissing}
+        role="alert"
+        aria-live="polite"
+      >
+        <span class="toast-icon">{getIcon(toast.type)}</span>
+        <span class="toast-message">{toast.message}</span>
+        <button
+          type="button"
+          class="toast-dismiss"
+          onclick={() => handleDismiss(toast.id)}
+          aria-label="Dismiss notification"
+        >
+          x
+        </button>
+      </div>
+    {/each}
+  </div>
+{/if}
+
+<style>
+  .toast-container {
+    position: fixed;
+    top: var(--space-6);
+    right: var(--space-6);
+    z-index: 9999;
+    display: flex;
+    flex-direction: column;
+    gap: var(--space-3);
+    max-width: min(400px, calc(100vw - var(--space-12)));
+    pointer-events: none;
+  }
+
+  .toast {
+    display: flex;
+    align-items: flex-start;
+    gap: var(--space-3);
+    padding: var(--space-4);
+    border-radius: var(--radius-lg);
+    box-shadow: var(--shadow-lg);
+    pointer-events: auto;
+    animation: toast-in 0.1s ease-out;
+  }
+
+  .toast.dismissing {
+    animation: toast-out 0.15s ease-in forwards;
+  }
+
+  @keyframes toast-in {
+    from {
+      opacity: 0;
+      transform: scale(0.95);
+    }
+    to {
+      opacity: 1;
+      transform: scale(1);
+    }
+  }
+
+  @keyframes toast-out {
+    from {
+      opacity: 1;
+      transform: scale(1);
+    }
+    to {
+      opacity: 0;
+      transform: scale(0.95);
+    }
+  }
+
+  .toast-success {
+    background: var(--success-bg);
+    border: 1px solid var(--success-border);
+    color: var(--success-text);
+  }
+
+  .toast-error {
+    background: var(--error-bg);
+    border: 1px solid var(--error-border);
+    color: var(--error-text);
+  }
+
+  .toast-warning {
+    background: var(--warning-bg);
+    border: 1px solid var(--warning-border);
+    color: var(--warning-text);
+  }
+
+  .toast-info {
+    background: var(--accent-muted);
+    border: 1px solid var(--accent);
+    color: var(--text-primary);
+  }
+
+  .toast-icon {
+    flex-shrink: 0;
+    width: 20px;
+    height: 20px;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    border-radius: 50%;
+    font-size: var(--text-xs);
+    font-weight: var(--font-bold);
+  }
+
+  .toast-success .toast-icon {
+    background: var(--success-text);
+    color: var(--success-bg);
+  }
+
+  .toast-error .toast-icon {
+    background: var(--error-text);
+    color: var(--error-bg);
+  }
+
+  .toast-warning .toast-icon {
+    background: var(--warning-text);
+    color: var(--warning-bg);
+  }
+
+  .toast-info .toast-icon {
+    background: var(--accent);
+    color: var(--bg-card);
+  }
+
+  .toast-message {
+    flex: 1;
+    font-size: var(--text-sm);
+    line-height: 1.4;
+  }
+
+  .toast-dismiss {
+    flex-shrink: 0;
+    width: 20px;
+    height: 20px;
+    padding: 0;
+    border: none;
+    background: transparent;
+    cursor: pointer;
+    opacity: 0.6;
+    font-size: var(--text-sm);
+    line-height: 1;
+    color: inherit;
+    border-radius: var(--radius-sm);
+  }
+
+  .toast-dismiss:hover {
+    opacity: 1;
+    background: rgba(0, 0, 0, 0.1);
+  }
+
+  @media (max-width: 480px) {
+    .toast-container {
+      top: var(--space-4);
+      right: var(--space-4);
+      left: var(--space-4);
+      max-width: none;
+    }
+  }
+</style>

frontend/src/lib/api-validated.ts

···
+import { z } from 'zod'
+import { ok, err, type Result } from './types/result'
+import { ApiError } from './api'
+import type { AccessToken, RefreshToken, Did, Handle, Nsid, Rkey } from './types/branded'
+import {
+  sessionSchema,
+  serverDescriptionSchema,
+  appPasswordSchema,
+  createdAppPasswordSchema,
+  listSessionsResponseSchema,
+  totpStatusSchema,
+  totpSecretSchema,
+  enableTotpResponseSchema,
+  listPasskeysResponseSchema,
+  listTrustedDevicesResponseSchema,
+  reauthStatusSchema,
+  notificationPrefsSchema,
+  didDocumentSchema,
+  repoDescriptionSchema,
+  listRecordsResponseSchema,
+  recordResponseSchema,
+  createRecordResponseSchema,
+  serverStatsSchema,
+  serverConfigSchema,
+  passwordStatusSchema,
+  successResponseSchema,
+  legacyLoginPreferenceSchema,
+  accountInfoSchema,
+  searchAccountsResponseSchema,
+  listBackupsResponseSchema,
+  createBackupResponseSchema,
+  type ValidatedSession,
+  type ValidatedServerDescription,
+  type ValidatedListSessionsResponse,
+  type ValidatedTotpStatus,
+  type ValidatedTotpSecret,
+  type ValidatedEnableTotpResponse,
+  type ValidatedListPasskeysResponse,
+  type ValidatedListTrustedDevicesResponse,
+  type ValidatedReauthStatus,
+  type ValidatedNotificationPrefs,
+  type ValidatedDidDocument,
+  type ValidatedRepoDescription,
+  type ValidatedListRecordsResponse,
+  type ValidatedRecordResponse,
+  type ValidatedCreateRecordResponse,
+  type ValidatedServerStats,
+  type ValidatedServerConfig,
+  type ValidatedPasswordStatus,
+  type ValidatedSuccessResponse,
+  type ValidatedLegacyLoginPreference,
+  type ValidatedAccountInfo,
+  type ValidatedSearchAccountsResponse,
+  type ValidatedListBackupsResponse,
+  type ValidatedCreateBackupResponse,
+  type ValidatedCreatedAppPassword,
+  type ValidatedAppPassword,
+} from './types/schemas'
+
+const API_BASE = '/xrpc'
+
+interface XrpcOptions {
+  method?: 'GET' | 'POST'
+  params?: Record<string, string>
+  body?: unknown
+  token?: string
+}
+
+class ValidationError extends Error {
+  constructor(
+    public issues: z.ZodIssue[],
+    message: string = 'API response validation failed'
+  ) {
+    super(message)
+    this.name = 'ValidationError'
+  }
+}
+
+async function xrpcValidated<T>(
+  method: string,
+  schema: z.ZodType<T>,
+  options?: XrpcOptions
+): Promise<Result<T, ApiError | ValidationError>> {
+  const { method: httpMethod = 'GET', params, body, token } = options ?? {}
+  let url = `${API_BASE}/${method}`
+  if (params) {
+    const searchParams = new URLSearchParams(params)
+    url += `?${searchParams}`
+  }
+  const headers: Record<string, string> = {}
+  if (token) {
+    headers['Authorization'] = `Bearer ${token}`
+  }
+  if (body) {
+    headers['Content-Type'] = 'application/json'
+  }
+
+  try {
+    const res = await fetch(url, {
+      method: httpMethod,
+      headers,
+      body: body ? JSON.stringify(body) : undefined,
+    })
+
+    if (!res.ok) {
+      const errData = await res.json().catch(() => ({
+        error: 'Unknown',
+        message: res.statusText,
+      }))
+      return err(new ApiError(res.status, errData.error, errData.message))
+    }
+
+    const data = await res.json()
+    const parsed = schema.safeParse(data)
+
+    if (!parsed.success) {
+      return err(new ValidationError(parsed.error.issues))
+    }
+
+    return ok(parsed.data)
+  } catch (e) {
+    if (e instanceof ApiError || e instanceof ValidationError) {
+      return err(e)
+    }
+    return err(new ApiError(0, 'Unknown', e instanceof Error ? e.message : String(e)))
+  }
+}
+
+export const validatedApi = {
+  getSession(token: AccessToken): Promise<Result<ValidatedSession, ApiError | ValidationError>> {
+    return xrpcValidated('com.atproto.server.getSession', sessionSchema, { token })
+  },
+
+  refreshSession(refreshJwt: RefreshToken): Promise<Result<ValidatedSession, ApiError | ValidationError>> {
+    return xrpcValidated('com.atproto.server.refreshSession', sessionSchema, {
+      method: 'POST',
+      token: refreshJwt,
+    })
+  },
+
+  createSession(
+    identifier: string,
+    password: string
+  ): Promise<Result<ValidatedSession, ApiError | ValidationError>> {
+    return xrpcValidated('com.atproto.server.createSession', sessionSchema, {
+      method: 'POST',
+      body: { identifier, password },
+    })
+  },
+
+  describeServer(): Promise<Result<ValidatedServerDescription, ApiError | ValidationError>> {
+    return xrpcValidated('com.atproto.server.describeServer', serverDescriptionSchema)
+  },
+
+  listAppPasswords(
+    token: AccessToken
+  ): Promise<Result<{ passwords: ValidatedAppPassword[] }, ApiError | ValidationError>> {
+    return xrpcValidated(
+      'com.atproto.server.listAppPasswords',
+      z.object({ passwords: z.array(appPasswordSchema) }),
+      { token }
+    )
+  },
+
+  createAppPassword(
+    token: AccessToken,
+    name: string,
+    scopes?: string
+  ): Promise<Result<ValidatedCreatedAppPassword, ApiError | ValidationError>> {
+    return xrpcValidated('com.atproto.server.createAppPassword', createdAppPasswordSchema, {
+      method: 'POST',
+      token,
+      body: { name, scopes },
+    })
+  },
+
+  listSessions(token: AccessToken): Promise<Result<ValidatedListSessionsResponse, ApiError | ValidationError>> {
+    return xrpcValidated('_account.listSessions', listSessionsResponseSchema, { token })
+  },
+
+  getTotpStatus(token: AccessToken): Promise<Result<ValidatedTotpStatus, ApiError | ValidationError>> {
+    return xrpcValidated('com.atproto.server.getTotpStatus', totpStatusSchema, { token })
+  },
+
+  createTotpSecret(token: AccessToken): Promise<Result<ValidatedTotpSecret, ApiError | ValidationError>> {
+    return xrpcValidated('com.atproto.server.createTotpSecret', totpSecretSchema, {
+      method: 'POST',
+      token,
+    })
+  },
+
+  enableTotp(
+    token: AccessToken,
+    code: string
+  ): Promise<Result<ValidatedEnableTotpResponse, ApiError | ValidationError>> {
+    return xrpcValidated('com.atproto.server.enableTotp', enableTotpResponseSchema, {
+      method: 'POST',
+      token,
+      body: { code },
+    })
+  },
+
+  listPasskeys(token: AccessToken): Promise<Result<ValidatedListPasskeysResponse, ApiError | ValidationError>> {
+    return xrpcValidated('com.atproto.server.listPasskeys', listPasskeysResponseSchema, { token })
+  },
+
+  listTrustedDevices(
+    token: AccessToken
+  ): Promise<Result<ValidatedListTrustedDevicesResponse, ApiError | ValidationError>> {
+    return xrpcValidated('_account.listTrustedDevices', listTrustedDevicesResponseSchema, { token })
+  },
+
+  getReauthStatus(token: AccessToken): Promise<Result<ValidatedReauthStatus, ApiError | ValidationError>> {
+    return xrpcValidated('_account.getReauthStatus', reauthStatusSchema, { token })
+  },
+
+  getNotificationPrefs(
+    token: AccessToken
+  ): Promise<Result<ValidatedNotificationPrefs, ApiError | ValidationError>> {
+    return xrpcValidated('_account.getNotificationPrefs', notificationPrefsSchema, { token })
+  },
+
+  getDidDocument(token: AccessToken): Promise<Result<ValidatedDidDocument, ApiError | ValidationError>> {
+    return xrpcValidated('_account.getDidDocument', didDocumentSchema, { token })
+  },
+
+  describeRepo(
+    token: AccessToken,
+    repo: Did
+  ): Promise<Result<ValidatedRepoDescription, ApiError | ValidationError>> {
+    return xrpcValidated('com.atproto.repo.describeRepo', repoDescriptionSchema, {
+      token,
+      params: { repo },
+    })
+  },
+
+  listRecords(
+    token: AccessToken,
+    repo: Did,
+    collection: Nsid,
+    options?: { limit?: number; cursor?: string; reverse?: boolean }
+  ): Promise<Result<ValidatedListRecordsResponse, ApiError | ValidationError>> {
+    const params: Record<string, string> = { repo, collection }
+    if (options?.limit) params.limit = String(options.limit)
+    if (options?.cursor) params.cursor = options.cursor
+    if (options?.reverse) params.reverse = 'true'
+    return xrpcValidated('com.atproto.repo.listRecords', listRecordsResponseSchema, {
+      token,
+      params,
+    })
+  },
+
+  getRecord(
+    token: AccessToken,
+    repo: Did,
+    collection: Nsid,
+    rkey: Rkey
+  ): Promise<Result<ValidatedRecordResponse, ApiError | ValidationError>> {
+    return xrpcValidated('com.atproto.repo.getRecord', recordResponseSchema, {
+      token,
+      params: { repo, collection, rkey },
+    })
+  },
+
+  createRecord(
+    token: AccessToken,
+    repo: Did,
+    collection: Nsid,
+    record: unknown,
+    rkey?: Rkey
+  ): Promise<Result<ValidatedCreateRecordResponse, ApiError | ValidationError>> {
+    return xrpcValidated('com.atproto.repo.createRecord', createRecordResponseSchema, {
+      method: 'POST',
+      token,
+      body: { repo, collection, record, rkey },
+    })
+  },
+
+  getServerStats(token: AccessToken): Promise<Result<ValidatedServerStats, ApiError | ValidationError>> {
+    return xrpcValidated('_admin.getServerStats', serverStatsSchema, { token })
+  },
+
+  getServerConfig(): Promise<Result<ValidatedServerConfig, ApiError | ValidationError>> {
+    return xrpcValidated('_server.getConfig', serverConfigSchema)
+  },
+
+  getPasswordStatus(token: AccessToken): Promise<Result<ValidatedPasswordStatus, ApiError | ValidationError>> {
+    return xrpcValidated('_account.getPasswordStatus', passwordStatusSchema, { token })
+  },
+
+  changePassword(
+    token: AccessToken,
+    currentPassword: string,
+    newPassword: string
+  ): Promise<Result<ValidatedSuccessResponse, ApiError | ValidationError>> {
+    return xrpcValidated('_account.changePassword', successResponseSchema, {
+      method: 'POST',
+      token,
+      body: { currentPassword, newPassword },
+    })
+  },
+
+  getLegacyLoginPreference(
+    token: AccessToken
+  ): Promise<Result<ValidatedLegacyLoginPreference, ApiError | ValidationError>> {
+    return xrpcValidated('_account.getLegacyLoginPreference', legacyLoginPreferenceSchema, { token })
+  },
+
+  getAccountInfo(
+    token: AccessToken,
+    did: Did
+  ): Promise<Result<ValidatedAccountInfo, ApiError | ValidationError>> {
+    return xrpcValidated('com.atproto.admin.getAccountInfo', accountInfoSchema, {
+      token,
+      params: { did },
+    })
+  },
+
+  searchAccounts(
+    token: AccessToken,
+    options?: { handle?: string; cursor?: string; limit?: number }
+  ): Promise<Result<ValidatedSearchAccountsResponse, ApiError | ValidationError>> {
+    const params: Record<string, string> = {}
+    if (options?.handle) params.handle = options.handle
+    if (options?.cursor) params.cursor = options.cursor
+    if (options?.limit) params.limit = String(options.limit)
+    return xrpcValidated('com.atproto.admin.searchAccounts', searchAccountsResponseSchema, {
+      token,
+      params,
+    })
+  },
+
+  listBackups(token: AccessToken): Promise<Result<ValidatedListBackupsResponse, ApiError | ValidationError>> {
+    return xrpcValidated('_backup.listBackups', listBackupsResponseSchema, { token })
+  },
+
+  createBackup(token: AccessToken): Promise<Result<ValidatedCreateBackupResponse, ApiError | ValidationError>> {
+    return xrpcValidated('_backup.createBackup', createBackupResponseSchema, {
+      method: 'POST',
+      token,
+    })
+  },
+}
+
+export { ValidationError }

frontend/src/lib/api.ts

···
-const API_BASE = "/xrpc";
+import { ok, err, type Result } from './types/result'
+import type {
+  Did,
+  Handle,
+  AccessToken,
+  RefreshToken,
+  Cid,
+  Rkey,
+  AtUri,
+  Nsid,
+  ISODateString,
+  EmailAddress,
+  InviteCode as InviteCodeBrand,
+} from './types/branded'
+import {
+  unsafeAsDid,
+  unsafeAsHandle,
+  unsafeAsAccessToken,
+  unsafeAsRefreshToken,
+  unsafeAsCid,
+  unsafeAsISODate,
+  unsafeAsEmail,
+  unsafeAsInviteCode,
+} from './types/branded'
+import type {
+  Session,
+  DidDocument,
+  AppPassword,
+  CreatedAppPassword,
+  InviteCodeInfo,
+  ServerDescription,
+  NotificationPrefs,
+  NotificationHistoryResponse,
+  ServerStats,
+  ServerConfig,
+  UploadBlobResponse,
+  ListSessionsResponse,
+  SearchAccountsResponse,
+  GetInviteCodesResponse,
+  AccountInfo,
+  RepoDescription,
+  ListRecordsResponse,
+  RecordResponse,
+  CreateRecordResponse,
+  TotpStatus,
+  TotpSecret,
+  EnableTotpResponse,
+  RegenerateBackupCodesResponse,
+  ListPasskeysResponse,
+  StartPasskeyRegistrationResponse,
+  FinishPasskeyRegistrationResponse,
+  ListTrustedDevicesResponse,
+  ReauthStatus,
+  ReauthResponse,
+  ReauthPasskeyStartResponse,
+  ReserveSigningKeyResponse,
+  RecommendedDidCredentials,
+  PasskeyAccountCreateResponse,
+  CompletePasskeySetupResponse,
+  VerifyTokenResponse,
+  ListBackupsResponse,
+  CreateBackupResponse,
+  SetBackupEnabledResponse,
+  EmailUpdateResponse,
+  LegacyLoginPreference,
+  UpdateLegacyLoginResponse,
+  UpdateLocaleResponse,
+  PasswordStatus,
+  SuccessResponse,
+  CheckEmailVerifiedResponse,
+  VerifyMigrationEmailResponse,
+  ResendMigrationVerificationResponse,
+  ListReposResponse,
+  VerificationChannel,
+  DidType,
+  ApiErrorCode,
+  VerificationMethod as VerificationMethodType,
+  CreateAccountParams,
+  CreateAccountResult,
+  ConfirmSignupResult,
+} from './types/api'
+
+const API_BASE = '/xrpc'
 
 export class ApiError extends Error {
-  public did?: string;
-  public reauthMethods?: string[];
+  public did?: Did
+  public reauthMethods?: string[]
   constructor(
     public status: number,
-    public error: string,
+    public error: ApiErrorCode,
     message: string,
     did?: string,
     reauthMethods?: string[],
   ) {
-    super(message);
-    this.name = "ApiError";
-    this.did = did;
-    this.reauthMethods = reauthMethods;
+    super(message)
+    this.name = 'ApiError'
+    this.did = did ? unsafeAsDid(did) : undefined
+    this.reauthMethods = reauthMethods
   }
 }
 
-let tokenRefreshCallback: (() => Promise<string | null>) | null = null;
+let tokenRefreshCallback: (() => Promise<string | null>) | null = null
 
 export function setTokenRefreshCallback(
   callback: () => Promise<string | null>,
 ) {
-  tokenRefreshCallback = callback;
+  tokenRefreshCallback = callback
 }
 
-async function xrpc<T>(method: string, options?: {
-  method?: "GET" | "POST";
-  params?: Record<string, string>;
-  body?: unknown;
-  token?: string;
-  skipRetry?: boolean;
-}): Promise<T> {
-  const { method: httpMethod = "GET", params, body, token, skipRetry } =
-    options ?? {};
-  let url = `${API_BASE}/${method}`;
+interface XrpcOptions {
+  method?: 'GET' | 'POST'
+  params?: Record<string, string>
+  body?: unknown
+  token?: string
+  skipRetry?: boolean
+}
+
+async function xrpc<T>(method: string, options?: XrpcOptions): Promise<T> {
+  const { method: httpMethod = 'GET', params, body, token, skipRetry } =
+    options ?? {}
+  let url = `${API_BASE}/${method}`
   if (params) {
-    const searchParams = new URLSearchParams(params);
-    url += `?${searchParams}`;
+    const searchParams = new URLSearchParams(params)
+    url += `?${searchParams}`
   }
-  const headers: Record<string, string> = {};
+  const headers: Record<string, string> = {}
   if (token) {
-    headers["Authorization"] = `Bearer ${token}`;
+    headers['Authorization'] = `Bearer ${token}`
   }
   if (body) {
-    headers["Content-Type"] = "application/json";
+    headers['Content-Type'] = 'application/json'
   }
   const res = await fetch(url, {
     method: httpMethod,
     headers,
     body: body ? JSON.stringify(body) : undefined,
-  });
+  })
   if (!res.ok) {
-    const err = await res.json().catch(() => ({
-      error: "Unknown",
+    const errData = await res.json().catch(() => ({
+      error: 'Unknown',
       message: res.statusText,
-    }));
+    }))
     if (
       res.status === 401 &&
-      (err.error === "AuthenticationFailed" || err.error === "ExpiredToken") &&
+      (errData.error === 'AuthenticationFailed' || errData.error === 'ExpiredToken') &&
       token && tokenRefreshCallback && !skipRetry
     ) {
-      const newToken = await tokenRefreshCallback();
+      const newToken = await tokenRefreshCallback()
       if (newToken && newToken !== token) {
-        return xrpc(method, { ...options, token: newToken, skipRetry: true });
+        return xrpc(method, { ...options, token: newToken, skipRetry: true })
       }
     }
     throw new ApiError(
       res.status,
-      err.error,
-      err.message,
-      err.did,
-      err.reauthMethods,
-    );
+      errData.error as ApiErrorCode,
+      errData.message,
+      errData.did,
+      errData.reauthMethods,
+    )
   }
-  return res.json();
+  return res.json()
 }
 
-export interface Session {
-  did: string;
-  handle: string;
-  email?: string;
-  emailConfirmed?: boolean;
-  preferredChannel?: string;
-  preferredChannelVerified?: boolean;
-  isAdmin?: boolean;
-  active?: boolean;
-  status?: "active" | "deactivated" | "migrated";
-  migratedToPds?: string;
-  migratedAt?: string;
-  accessJwt: string;
-  refreshJwt: string;
+async function xrpcResult<T>(
+  method: string,
+  options?: XrpcOptions
+): Promise<Result<T, ApiError>> {
+  try {
+    const value = await xrpc<T>(method, options)
+    return ok(value)
+  } catch (e) {
+    if (e instanceof ApiError) {
+      return err(e)
+    }
+    return err(new ApiError(0, 'Unknown', e instanceof Error ? e.message : String(e)))
+  }
 }
 
 export interface VerificationMethod {
-  id: string;
-  type: string;
-  publicKeyMultibase: string;
+  id: string
+  type: string
+  publicKeyMultibase: string
 }
 
-export interface DidDocument {
-  "@context": string[];
-  id: string;
-  alsoKnownAs: string[];
-  verificationMethod: Array<{
-    id: string;
-    type: string;
-    controller: string;
-    publicKeyMultibase: string;
-  }>;
-  service: Array<{
-    id: string;
-    type: string;
-    serviceEndpoint: string;
-  }>;
-}
+export type { Session, DidDocument, AppPassword, InviteCodeInfo as InviteCode }
+export type { VerificationChannel, DidType, CreateAccountParams, CreateAccountResult, ConfirmSignupResult }
 
-export interface AppPassword {
-  name: string;
-  createdAt: string;
-  scopes?: string;
-  createdByController?: string;
-}
-
-export interface InviteCode {
-  code: string;
-  available: number;
-  disabled: boolean;
-  forAccount: string;
-  createdBy: string;
-  createdAt: string;
-  uses: { usedBy: string; usedByHandle?: string; usedAt: string }[];
-}
-
-export type VerificationChannel = "email" | "discord" | "telegram" | "signal";
-
-export type DidType = "plc" | "web" | "web-external";
-
-export interface CreateAccountParams {
-  handle: string;
-  email: string;
-  password: string;
-  inviteCode?: string;
-  didType?: DidType;
-  did?: string;
-  signingKey?: string;
-  verificationChannel?: VerificationChannel;
-  discordId?: string;
-  telegramUsername?: string;
-  signalNumber?: string;
-}
-
-export interface CreateAccountResult {
-  handle: string;
-  did: string;
-  verificationRequired: boolean;
-  verificationChannel: string;
-}
-
-export interface ConfirmSignupResult {
-  accessJwt: string;
-  refreshJwt: string;
-  handle: string;
-  did: string;
-  email?: string;
-  emailConfirmed?: boolean;
-  preferredChannel?: string;
-  preferredChannelVerified?: boolean;
+function castSession(raw: unknown): Session {
+  const s = raw as Record<string, unknown>
+  return {
+    did: unsafeAsDid(s.did as string),
+    handle: unsafeAsHandle(s.handle as string),
+    email: s.email ? unsafeAsEmail(s.email as string) : undefined,
+    emailConfirmed: s.emailConfirmed as boolean | undefined,
+    preferredChannel: s.preferredChannel as VerificationChannel | undefined,
+    preferredChannelVerified: s.preferredChannelVerified as boolean | undefined,
+    isAdmin: s.isAdmin as boolean | undefined,
+    active: s.active as boolean | undefined,
+    status: s.status as Session['status'],
+    migratedToPds: s.migratedToPds as string | undefined,
+    migratedAt: s.migratedAt ? unsafeAsISODate(s.migratedAt as string) : undefined,
+    accessJwt: unsafeAsAccessToken(s.accessJwt as string),
+    refreshJwt: unsafeAsRefreshToken(s.refreshJwt as string),
+  }
 }
 
 export const api = {
···
     params: CreateAccountParams,
     byodToken?: string,
   ): Promise<CreateAccountResult> {
-    const url = `${API_BASE}/com.atproto.server.createAccount`;
+    const url = `${API_BASE}/com.atproto.server.createAccount`
     const headers: Record<string, string> = {
-      "Content-Type": "application/json",
-    };
+      'Content-Type': 'application/json',
+    }
     if (byodToken) {
-      headers["Authorization"] = `Bearer ${byodToken}`;
+      headers['Authorization'] = `Bearer ${byodToken}`
     }
     const response = await fetch(url, {
-      method: "POST",
+      method: 'POST',
       headers,
       body: JSON.stringify({
         handle: params.handle,
···
         telegramUsername: params.telegramUsername,
         signalNumber: params.signalNumber,
       }),
-    });
-    const data = await response.json();
+    })
+    const data = await response.json()
     if (!response.ok) {
-      throw new ApiError(response.status, data.error, data.message);
+      throw new ApiError(response.status, data.error, data.message)
     }
-    return data;
+    return data
   },
 
   async createAccountWithServiceAuth(
     serviceAuthToken: string,
     params: {
-      did: string;
-      handle: string;
-      email: string;
-      password: string;
-      inviteCode?: string;
+      did: Did
+      handle: Handle
+      email: EmailAddress
+      password: string
+      inviteCode?: string
     },
   ): Promise<Session> {
-    const url = `${API_BASE}/com.atproto.server.createAccount`;
+    const url = `${API_BASE}/com.atproto.server.createAccount`
     const response = await fetch(url, {
-      method: "POST",
+      method: 'POST',
       headers: {
-        "Content-Type": "application/json",
-        "Authorization": `Bearer ${serviceAuthToken}`,
+        'Content-Type': 'application/json',
+        'Authorization': `Bearer ${serviceAuthToken}`,
       },
       body: JSON.stringify({
         did: params.did,
···
         password: params.password,
         inviteCode: params.inviteCode,
       }),
-    });
-    const data = await response.json();
+    })
+    const data = await response.json()
     if (!response.ok) {
-      throw new ApiError(response.status, data.error, data.message);
+      throw new ApiError(response.status, data.error, data.message)
     }
-    return data;
+    return castSession(data)
   },
 
   confirmSignup(
-    did: string,
+    did: Did,
     verificationCode: string,
   ): Promise<ConfirmSignupResult> {
-    return xrpc("com.atproto.server.confirmSignup", {
-      method: "POST",
+    return xrpc('com.atproto.server.confirmSignup', {
+      method: 'POST',
       body: { did, verificationCode },
-    });
+    })
   },
 
-  resendVerification(did: string): Promise<{ success: boolean }> {
-    return xrpc("com.atproto.server.resendVerification", {
-      method: "POST",
+  resendVerification(did: Did): Promise<{ success: boolean }> {
+    return xrpc('com.atproto.server.resendVerification', {
+      method: 'POST',
       body: { did },
-    });
+    })
   },
 
-  createSession(identifier: string, password: string): Promise<Session> {
-    return xrpc("com.atproto.server.createSession", {
-      method: "POST",
+  async createSession(identifier: string, password: string): Promise<Session> {
+    const raw = await xrpc<unknown>('com.atproto.server.createSession', {
+      method: 'POST',
       body: { identifier, password },
-    });
+    })
+    return castSession(raw)
   },
 
   checkEmailVerified(identifier: string): Promise<{ verified: boolean }> {
-    return xrpc("_checkEmailVerified", {
-      method: "POST",
+    return xrpc('_checkEmailVerified', {
+      method: 'POST',
       body: { identifier },
-    });
+    })
   },
 
-  getSession(token: string): Promise<Session> {
-    return xrpc("com.atproto.server.getSession", { token });
+  async getSession(token: AccessToken): Promise<Session> {
+    const raw = await xrpc<unknown>('com.atproto.server.getSession', { token })
+    return castSession(raw)
   },
 
-  refreshSession(refreshJwt: string): Promise<Session> {
-    return xrpc("com.atproto.server.refreshSession", {
-      method: "POST",
+  async refreshSession(refreshJwt: RefreshToken): Promise<Session> {
+    const raw = await xrpc<unknown>('com.atproto.server.refreshSession', {
+      method: 'POST',
       token: refreshJwt,
-    });
+    })
+    return castSession(raw)
   },
 
-  async deleteSession(token: string): Promise<void> {
-    await xrpc("com.atproto.server.deleteSession", {
-      method: "POST",
+  async deleteSession(token: AccessToken): Promise<void> {
+    await xrpc('com.atproto.server.deleteSession', {
+      method: 'POST',
       token,
-    });
+    })
   },
 
-  listAppPasswords(token: string): Promise<{ passwords: AppPassword[] }> {
-    return xrpc("com.atproto.server.listAppPasswords", { token });
+  listAppPasswords(token: AccessToken): Promise<{ passwords: AppPassword[] }> {
+    return xrpc('com.atproto.server.listAppPasswords', { token })
   },
 
   createAppPassword(
-    token: string,
+    token: AccessToken,
     name: string,
     scopes?: string,
-  ): Promise<
-    { name: string; password: string; createdAt: string; scopes?: string }
-  > {
-    return xrpc("com.atproto.server.createAppPassword", {
-      method: "POST",
+  ): Promise<CreatedAppPassword> {
+    return xrpc('com.atproto.server.createAppPassword', {
+      method: 'POST',
       token,
       body: { name, scopes },
-    });
+    })
   },
 
-  async revokeAppPassword(token: string, name: string): Promise<void> {
-    await xrpc("com.atproto.server.revokeAppPassword", {
-      method: "POST",
+  async revokeAppPassword(token: AccessToken, name: string): Promise<void> {
+    await xrpc('com.atproto.server.revokeAppPassword', {
+      method: 'POST',
       token,
       body: { name },
-    });
+    })
   },
 
-  getAccountInviteCodes(token: string): Promise<{ codes: InviteCode[] }> {
-    return xrpc("com.atproto.server.getAccountInviteCodes", { token });
+  getAccountInviteCodes(token: AccessToken): Promise<{ codes: InviteCodeInfo[] }> {
+    return xrpc('com.atproto.server.getAccountInviteCodes', { token })
   },
 
   createInviteCode(
-    token: string,
+    token: AccessToken,
     useCount: number = 1,
   ): Promise<{ code: string }> {
-    return xrpc("com.atproto.server.createInviteCode", {
-      method: "POST",
+    return xrpc('com.atproto.server.createInviteCode', {
+      method: 'POST',
       token,
       body: { useCount },
-    });
+    })
   },
 
-  async requestPasswordReset(email: string): Promise<void> {
-    await xrpc("com.atproto.server.requestPasswordReset", {
-      method: "POST",
+  async requestPasswordReset(email: EmailAddress): Promise<void> {
+    await xrpc('com.atproto.server.requestPasswordReset', {
+      method: 'POST',
       body: { email },
-    });
+    })
   },
 
   async resetPassword(token: string, password: string): Promise<void> {
-    await xrpc("com.atproto.server.resetPassword", {
-      method: "POST",
+    await xrpc('com.atproto.server.resetPassword', {
+      method: 'POST',
       body: { token, password },
-    });
+    })
   },
 
-  requestEmailUpdate(
-    token: string,
-  ): Promise<{ tokenRequired: boolean }> {
-    return xrpc("com.atproto.server.requestEmailUpdate", {
-      method: "POST",
+  requestEmailUpdate(token: AccessToken): Promise<EmailUpdateResponse> {
+    return xrpc('com.atproto.server.requestEmailUpdate', {
+      method: 'POST',
       token,
-    });
+    })
   },
 
   async updateEmail(
-    token: string,
+    token: AccessToken,
     email: string,
     emailToken?: string,
   ): Promise<void> {
-    await xrpc("com.atproto.server.updateEmail", {
-      method: "POST",
+    await xrpc('com.atproto.server.updateEmail', {
+      method: 'POST',
       token,
       body: { email, token: emailToken },
-    });
+    })
   },
 
-  async updateHandle(token: string, handle: string): Promise<void> {
-    await xrpc("com.atproto.identity.updateHandle", {
-      method: "POST",
+  async updateHandle(token: AccessToken, handle: Handle): Promise<void> {
+    await xrpc('com.atproto.identity.updateHandle', {
+      method: 'POST',
       token,
       body: { handle },
-    });
+    })
   },
 
-  async requestAccountDelete(token: string): Promise<void> {
-    await xrpc("com.atproto.server.requestAccountDelete", {
-      method: "POST",
+  async requestAccountDelete(token: AccessToken): Promise<void> {
+    await xrpc('com.atproto.server.requestAccountDelete', {
+      method: 'POST',
       token,
-    });
+    })
   },
 
   async deleteAccount(
-    did: string,
+    did: Did,
     password: string,
     deleteToken: string,
   ): Promise<void> {
-    await xrpc("com.atproto.server.deleteAccount", {
-      method: "POST",
+    await xrpc('com.atproto.server.deleteAccount', {
+      method: 'POST',
       body: { did, password, token: deleteToken },
-    });
+    })
   },
 
-  describeServer(): Promise<{
-    availableUserDomains: string[];
-    inviteCodeRequired: boolean;
-    links?: { privacyPolicy?: string; termsOfService?: string };
-    version?: string;
-    availableCommsChannels?: string[];
-    selfHostedDidWebEnabled?: boolean;
-  }> {
-    return xrpc("com.atproto.server.describeServer");
+  describeServer(): Promise<ServerDescription> {
+    return xrpc('com.atproto.server.describeServer')
   },
 
-  listRepos(limit?: number): Promise<{
-    repos: Array<{ did: string; head: string; rev: string }>;
-    cursor?: string;
-  }> {
-    const params: Record<string, string> = {};
-    if (limit) params.limit = String(limit);
-    return xrpc("com.atproto.sync.listRepos", { params });
+  listRepos(limit?: number): Promise<ListReposResponse> {
+    const params: Record<string, string> = {}
+    if (limit) params.limit = String(limit)
+    return xrpc('com.atproto.sync.listRepos', { params })
   },
 
-  getNotificationPrefs(token: string): Promise<{
-    preferredChannel: string;
-    email: string;
-    discordId: string | null;
-    discordVerified: boolean;
-    telegramUsername: string | null;
-    telegramVerified: boolean;
-    signalNumber: string | null;
-    signalVerified: boolean;
-  }> {
-    return xrpc("_account.getNotificationPrefs", { token });
+  getNotificationPrefs(token: AccessToken): Promise<NotificationPrefs> {
+    return xrpc('_account.getNotificationPrefs', { token })
   },
 
-  updateNotificationPrefs(token: string, prefs: {
-    preferredChannel?: string;
-    discordId?: string;
-    telegramUsername?: string;
-    signalNumber?: string;
-  }): Promise<{ success: boolean }> {
-    return xrpc("_account.updateNotificationPrefs", {
-      method: "POST",
+  updateNotificationPrefs(token: AccessToken, prefs: {
+    preferredChannel?: string
+    discordId?: string
+    telegramUsername?: string
+    signalNumber?: string
+  }): Promise<SuccessResponse> {
+    return xrpc('_account.updateNotificationPrefs', {
+      method: 'POST',
       token,
       body: prefs,
-    });
+    })
   },
 
   confirmChannelVerification(
-    token: string,
+    token: AccessToken,
     channel: string,
     identifier: string,
     code: string,
-  ): Promise<{ success: boolean }> {
-    return xrpc("_account.confirmChannelVerification", {
-      method: "POST",
+  ): Promise<SuccessResponse> {
+    return xrpc('_account.confirmChannelVerification', {
+      method: 'POST',
       token,
       body: { channel, identifier, code },
-    });
+    })
   },
 
-  getNotificationHistory(token: string): Promise<{
-    notifications: Array<{
-      createdAt: string;
-      channel: string;
-      notificationType: string;
-      status: string;
-      subject: string | null;
-      body: string;
-    }>;
-  }> {
-    return xrpc("_account.getNotificationHistory", { token });
+  getNotificationHistory(token: AccessToken): Promise<NotificationHistoryResponse> {
+    return xrpc('_account.getNotificationHistory', { token })
   },
 
-  getServerStats(token: string): Promise<{
-    userCount: number;
-    repoCount: number;
-    recordCount: number;
-    blobStorageBytes: number;
-  }> {
-    return xrpc("_admin.getServerStats", { token });
+  getServerStats(token: AccessToken): Promise<ServerStats> {
+    return xrpc('_admin.getServerStats', { token })
   },
 
-  getServerConfig(): Promise<{
-    serverName: string;
-    primaryColor: string | null;
-    primaryColorDark: string | null;
-    secondaryColor: string | null;
-    secondaryColorDark: string | null;
-    logoCid: string | null;
-  }> {
-    return xrpc("_server.getConfig");
+  getServerConfig(): Promise<ServerConfig> {
+    return xrpc('_server.getConfig')
   },
 
   updateServerConfig(
-    token: string,
+    token: AccessToken,
     config: {
-      serverName?: string;
-      primaryColor?: string;
-      primaryColorDark?: string;
-      secondaryColor?: string;
-      secondaryColorDark?: string;
-      logoCid?: string;
+      serverName?: string
+      primaryColor?: string
+      primaryColorDark?: string
+      secondaryColor?: string
+      secondaryColorDark?: string
+      logoCid?: string
     },
-  ): Promise<{ success: boolean }> {
-    return xrpc("_admin.updateServerConfig", {
-      method: "POST",
+  ): Promise<SuccessResponse> {
+    return xrpc('_admin.updateServerConfig', {
+      method: 'POST',
       token,
       body: config,
-    });
+    })
   },
 
-  async uploadBlob(
-    token: string,
-    file: File,
-  ): Promise<
-    {
-      blob: {
-        $type: string;
-        ref: { $link: string };
-        mimeType: string;
-        size: number;
-      };
-    }
-  > {
-    const res = await fetch("/xrpc/com.atproto.repo.uploadBlob", {
-      method: "POST",
+  async uploadBlob(token: AccessToken, file: File): Promise<UploadBlobResponse> {
+    const res = await fetch('/xrpc/com.atproto.repo.uploadBlob', {
+      method: 'POST',
       headers: {
-        "Authorization": `Bearer ${token}`,
-        "Content-Type": file.type,
+        'Authorization': `Bearer ${token}`,
+        'Content-Type': file.type,
       },
       body: file,
-    });
+    })
     if (!res.ok) {
-      const err = await res.json().catch(() => ({
-        error: "Unknown",
+      const errData = await res.json().catch(() => ({
+        error: 'Unknown',
         message: res.statusText,
-      }));
-      throw new ApiError(res.status, err.error, err.message);
+      }))
+      throw new ApiError(res.status, errData.error, errData.message)
     }
-    return res.json();
+    return res.json()
   },
 
   async changePassword(
-    token: string,
+    token: AccessToken,
     currentPassword: string,
     newPassword: string,
   ): Promise<void> {
-    await xrpc("_account.changePassword", {
-      method: "POST",
+    await xrpc('_account.changePassword', {
+      method: 'POST',
       token,
       body: { currentPassword, newPassword },
-    });
+    })
   },
 
-  removePassword(token: string): Promise<{ success: boolean }> {
-    return xrpc("_account.removePassword", {
-      method: "POST",
+  removePassword(token: AccessToken): Promise<SuccessResponse> {
+    return xrpc('_account.removePassword', {
+      method: 'POST',
       token,
-    });
+    })
   },
 
-  getPasswordStatus(token: string): Promise<{ hasPassword: boolean }> {
-    return xrpc("_account.getPasswordStatus", { token });
+  getPasswordStatus(token: AccessToken): Promise<PasswordStatus> {
+    return xrpc('_account.getPasswordStatus', { token })
   },
 
-  getLegacyLoginPreference(
-    token: string,
-  ): Promise<{ allowLegacyLogin: boolean; hasMfa: boolean }> {
-    return xrpc("_account.getLegacyLoginPreference", { token });
+  getLegacyLoginPreference(token: AccessToken): Promise<LegacyLoginPreference> {
+    return xrpc('_account.getLegacyLoginPreference', { token })
   },
 
   updateLegacyLoginPreference(
-    token: string,
+    token: AccessToken,
     allowLegacyLogin: boolean,
-  ): Promise<{ allowLegacyLogin: boolean }> {
-    return xrpc("_account.updateLegacyLoginPreference", {
-      method: "POST",
+  ): Promise<UpdateLegacyLoginResponse> {
+    return xrpc('_account.updateLegacyLoginPreference', {
+      method: 'POST',
       token,
       body: { allowLegacyLogin },
-    });
+    })
   },
 
-  updateLocale(
-    token: string,
-    preferredLocale: string,
-  ): Promise<{ preferredLocale: string }> {
-    return xrpc("_account.updateLocale", {
-      method: "POST",
+  updateLocale(token: AccessToken, preferredLocale: string): Promise<UpdateLocaleResponse> {
+    return xrpc('_account.updateLocale', {
+      method: 'POST',
       token,
       body: { preferredLocale },
-    });
+    })
   },
 
-  listSessions(token: string): Promise<{
-    sessions: Array<{
-      id: string;
-      sessionType: string;
-      clientName: string | null;
-      createdAt: string;
-      expiresAt: string;
-      isCurrent: boolean;
-    }>;
-  }> {
-    return xrpc("_account.listSessions", { token });
+  listSessions(token: AccessToken): Promise<ListSessionsResponse> {
+    return xrpc('_account.listSessions', { token })
   },
 
-  async revokeSession(token: string, sessionId: string): Promise<void> {
-    await xrpc("_account.revokeSession", {
-      method: "POST",
+  async revokeSession(token: AccessToken, sessionId: string): Promise<void> {
+    await xrpc('_account.revokeSession', {
+      method: 'POST',
       token,
       body: { sessionId },
-    });
+    })
   },
 
-  revokeAllSessions(token: string): Promise<{ revokedCount: number }> {
-    return xrpc("_account.revokeAllSessions", {
-      method: "POST",
+  revokeAllSessions(token: AccessToken): Promise<{ revokedCount: number }> {
+    return xrpc('_account.revokeAllSessions', {
+      method: 'POST',
       token,
-    });
+    })
   },
 
-  searchAccounts(token: string, options?: {
-    handle?: string;
-    cursor?: string;
-    limit?: number;
-  }): Promise<{
-    cursor?: string;
-    accounts: Array<{
-      did: string;
-      handle: string;
-      email?: string;
-      indexedAt: string;
-      emailConfirmedAt?: string;
-      deactivatedAt?: string;
-    }>;
-  }> {
-    const params: Record<string, string> = {};
-    if (options?.handle) params.handle = options.handle;
-    if (options?.cursor) params.cursor = options.cursor;
-    if (options?.limit) params.limit = String(options.limit);
-    return xrpc("com.atproto.admin.searchAccounts", { token, params });
+  searchAccounts(token: AccessToken, options?: {
+    handle?: string
+    cursor?: string
+    limit?: number
+  }): Promise<SearchAccountsResponse> {
+    const params: Record<string, string> = {}
+    if (options?.handle) params.handle = options.handle
+    if (options?.cursor) params.cursor = options.cursor
+    if (options?.limit) params.limit = String(options.limit)
+    return xrpc('com.atproto.admin.searchAccounts', { token, params })
   },
 
-  getInviteCodes(token: string, options?: {
-    sort?: "recent" | "usage";
-    cursor?: string;
-    limit?: number;
-  }): Promise<{
-    cursor?: string;
-    codes: Array<{
-      code: string;
-      available: number;
-      disabled: boolean;
-      forAccount: string;
-      createdBy: string;
-      createdAt: string;
-      uses: Array<{ usedBy: string; usedAt: string }>;
-    }>;
-  }> {
-    const params: Record<string, string> = {};
-    if (options?.sort) params.sort = options.sort;
-    if (options?.cursor) params.cursor = options.cursor;
-    if (options?.limit) params.limit = String(options.limit);
-    return xrpc("com.atproto.admin.getInviteCodes", { token, params });
+  getInviteCodes(token: AccessToken, options?: {
+    sort?: 'recent' | 'usage'
+    cursor?: string
+    limit?: number
+  }): Promise<GetInviteCodesResponse> {
+    const params: Record<string, string> = {}
+    if (options?.sort) params.sort = options.sort
+    if (options?.cursor) params.cursor = options.cursor
+    if (options?.limit) params.limit = String(options.limit)
+    return xrpc('com.atproto.admin.getInviteCodes', { token, params })
   },
 
   async disableInviteCodes(
-    token: string,
+    token: AccessToken,
     codes?: string[],
     accounts?: string[],
   ): Promise<void> {
-    await xrpc("com.atproto.admin.disableInviteCodes", {
-      method: "POST",
+    await xrpc('com.atproto.admin.disableInviteCodes', {
+      method: 'POST',
       token,
       body: { codes, accounts },
-    });
+    })
   },
 
-  getAccountInfo(token: string, did: string): Promise<{
-    did: string;
-    handle: string;
-    email?: string;
-    indexedAt: string;
-    emailConfirmedAt?: string;
-    invitesDisabled?: boolean;
-    deactivatedAt?: string;
-  }> {
-    return xrpc("com.atproto.admin.getAccountInfo", { token, params: { did } });
+  getAccountInfo(token: AccessToken, did: Did): Promise<AccountInfo> {
+    return xrpc('com.atproto.admin.getAccountInfo', { token, params: { did } })
   },
 
-  async disableAccountInvites(token: string, account: string): Promise<void> {
-    await xrpc("com.atproto.admin.disableAccountInvites", {
-      method: "POST",
+  async disableAccountInvites(token: AccessToken, account: Did): Promise<void> {
+    await xrpc('com.atproto.admin.disableAccountInvites', {
+      method: 'POST',
       token,
       body: { account },
-    });
+    })
   },
 
-  async enableAccountInvites(token: string, account: string): Promise<void> {
-    await xrpc("com.atproto.admin.enableAccountInvites", {
-      method: "POST",
+  async enableAccountInvites(token: AccessToken, account: Did): Promise<void> {
+    await xrpc('com.atproto.admin.enableAccountInvites', {
+      method: 'POST',
       token,
       body: { account },
-    });
+    })
   },
 
-  async adminDeleteAccount(token: string, did: string): Promise<void> {
-    await xrpc("com.atproto.admin.deleteAccount", {
-      method: "POST",
+  async adminDeleteAccount(token: AccessToken, did: Did): Promise<void> {
+    await xrpc('com.atproto.admin.deleteAccount', {
+      method: 'POST',
       token,
       body: { did },
-    });
+    })
   },
 
-  describeRepo(token: string, repo: string): Promise<{
-    handle: string;
-    did: string;
-    didDoc: unknown;
-    collections: string[];
-    handleIsCorrect: boolean;
-  }> {
-    return xrpc("com.atproto.repo.describeRepo", {
+  describeRepo(token: AccessToken, repo: Did): Promise<RepoDescription> {
+    return xrpc('com.atproto.repo.describeRepo', {
       token,
       params: { repo },
-    });
+    })
   },
 
-  listRecords(token: string, repo: string, collection: string, options?: {
-    limit?: number;
-    cursor?: string;
-    reverse?: boolean;
-  }): Promise<{
-    records: Array<{ uri: string; cid: string; value: unknown }>;
-    cursor?: string;
-  }> {
-    const params: Record<string, string> = { repo, collection };
-    if (options?.limit) params.limit = String(options.limit);
-    if (options?.cursor) params.cursor = options.cursor;
-    if (options?.reverse) params.reverse = "true";
-    return xrpc("com.atproto.repo.listRecords", { token, params });
+  listRecords(token: AccessToken, repo: Did, collection: Nsid, options?: {
+    limit?: number
+    cursor?: string
+    reverse?: boolean
+  }): Promise<ListRecordsResponse> {
+    const params: Record<string, string> = { repo, collection }
+    if (options?.limit) params.limit = String(options.limit)
+    if (options?.cursor) params.cursor = options.cursor
+    if (options?.reverse) params.reverse = 'true'
+    return xrpc('com.atproto.repo.listRecords', { token, params })
   },
 
   getRecord(
-    token: string,
-    repo: string,
-    collection: string,
-    rkey: string,
-  ): Promise<{
-    uri: string;
-    cid: string;
-    value: unknown;
-  }> {
-    return xrpc("com.atproto.repo.getRecord", {
+    token: AccessToken,
+    repo: Did,
+    collection: Nsid,
+    rkey: Rkey,
+  ): Promise<RecordResponse> {
+    return xrpc('com.atproto.repo.getRecord', {
       token,
       params: { repo, collection, rkey },
-    });
+    })
   },
 
   createRecord(
-    token: string,
-    repo: string,
-    collection: string,
+    token: AccessToken,
+    repo: Did,
+    collection: Nsid,
     record: unknown,
-    rkey?: string,
-  ): Promise<{
-    uri: string;
-    cid: string;
-  }> {
-    return xrpc("com.atproto.repo.createRecord", {
-      method: "POST",
+    rkey?: Rkey,
+  ): Promise<CreateRecordResponse> {
+    return xrpc('com.atproto.repo.createRecord', {
+      method: 'POST',
       token,
       body: { repo, collection, record, rkey },
-    });
+    })
   },
 
   putRecord(
-    token: string,
-    repo: string,
-    collection: string,
-    rkey: string,
+    token: AccessToken,
+    repo: Did,
+    collection: Nsid,
+    rkey: Rkey,
     record: unknown,
-  ): Promise<{
-    uri: string;
-    cid: string;
-  }> {
-    return xrpc("com.atproto.repo.putRecord", {
-      method: "POST",
+  ): Promise<CreateRecordResponse> {
+    return xrpc('com.atproto.repo.putRecord', {
+      method: 'POST',
       token,
       body: { repo, collection, rkey, record },
-    });
+    })
   },
 
   async deleteRecord(
-    token: string,
-    repo: string,
-    collection: string,
-    rkey: string,
+    token: AccessToken,
+    repo: Did,
+    collection: Nsid,
+    rkey: Rkey,
   ): Promise<void> {
-    await xrpc("com.atproto.repo.deleteRecord", {
-      method: "POST",
+    await xrpc('com.atproto.repo.deleteRecord', {
+      method: 'POST',
       token,
       body: { repo, collection, rkey },
-    });
+    })
   },
 
-  getTotpStatus(
-    token: string,
-  ): Promise<{ enabled: boolean; hasBackupCodes: boolean }> {
-    return xrpc("com.atproto.server.getTotpStatus", { token });
+  getTotpStatus(token: AccessToken): Promise<TotpStatus> {
+    return xrpc('com.atproto.server.getTotpStatus', { token })
   },
 
-  createTotpSecret(
-    token: string,
-  ): Promise<{ uri: string; qrBase64: string }> {
-    return xrpc("com.atproto.server.createTotpSecret", {
-      method: "POST",
+  createTotpSecret(token: AccessToken): Promise<TotpSecret> {
+    return xrpc('com.atproto.server.createTotpSecret', {
+      method: 'POST',
       token,
-    });
+    })
   },
 
-  enableTotp(
-    token: string,
-    code: string,
-  ): Promise<{ success: boolean; backupCodes: string[] }> {
-    return xrpc("com.atproto.server.enableTotp", {
-      method: "POST",
+  enableTotp(token: AccessToken, code: string): Promise<EnableTotpResponse> {
+    return xrpc('com.atproto.server.enableTotp', {
+      method: 'POST',
       token,
       body: { code },
-    });
+    })
   },
 
   disableTotp(
-    token: string,
+    token: AccessToken,
     password: string,
     code: string,
-  ): Promise<{ success: boolean }> {
-    return xrpc("com.atproto.server.disableTotp", {
-      method: "POST",
+  ): Promise<SuccessResponse> {
+    return xrpc('com.atproto.server.disableTotp', {
+      method: 'POST',
       token,
       body: { password, code },
-    });
+    })
   },
 
   regenerateBackupCodes(
-    token: string,
+    token: AccessToken,
     password: string,
     code: string,
-  ): Promise<{ backupCodes: string[] }> {
-    return xrpc("com.atproto.server.regenerateBackupCodes", {
-      method: "POST",
+  ): Promise<RegenerateBackupCodesResponse> {
+    return xrpc('com.atproto.server.regenerateBackupCodes', {
+      method: 'POST',
       token,
       body: { password, code },
-    });
+    })
   },
 
   startPasskeyRegistration(
-    token: string,
+    token: AccessToken,
     friendlyName?: string,
-  ): Promise<{ options: unknown }> {
-    return xrpc("com.atproto.server.startPasskeyRegistration", {
-      method: "POST",
+  ): Promise<StartPasskeyRegistrationResponse> {
+    return xrpc('com.atproto.server.startPasskeyRegistration', {
+      method: 'POST',
       token,
       body: { friendlyName },
-    });
+    })
   },
 
   finishPasskeyRegistration(
-    token: string,
+    token: AccessToken,
     credential: unknown,
     friendlyName?: string,
-  ): Promise<{ id: string; credentialId: string }> {
-    return xrpc("com.atproto.server.finishPasskeyRegistration", {
-      method: "POST",
+  ): Promise<FinishPasskeyRegistrationResponse> {
+    return xrpc('com.atproto.server.finishPasskeyRegistration', {
+      method: 'POST',
       token,
       body: { credential, friendlyName },
-    });
+    })
   },
 
-  listPasskeys(token: string): Promise<{
-    passkeys: Array<{
-      id: string;
-      credentialId: string;
-      friendlyName: string | null;
-      createdAt: string;
-      lastUsed: string | null;
-    }>;
-  }> {
-    return xrpc("com.atproto.server.listPasskeys", { token });
+  listPasskeys(token: AccessToken): Promise<ListPasskeysResponse> {
+    return xrpc('com.atproto.server.listPasskeys', { token })
   },
 
-  async deletePasskey(token: string, id: string): Promise<void> {
-    await xrpc("com.atproto.server.deletePasskey", {
-      method: "POST",
+  async deletePasskey(token: AccessToken, id: string): Promise<void> {
+    await xrpc('com.atproto.server.deletePasskey', {
+      method: 'POST',
       token,
       body: { id },
-    });
+    })
   },
 
   async updatePasskey(
-    token: string,
+    token: AccessToken,
     id: string,
     friendlyName: string,
   ): Promise<void> {
-    await xrpc("com.atproto.server.updatePasskey", {
-      method: "POST",
+    await xrpc('com.atproto.server.updatePasskey', {
+      method: 'POST',
       token,
       body: { id, friendlyName },
-    });
+    })
   },
 
-  listTrustedDevices(token: string): Promise<{
-    devices: Array<{
-      id: string;
-      userAgent: string | null;
-      friendlyName: string | null;
-      trustedAt: string | null;
-      trustedUntil: string | null;
-      lastSeenAt: string;
-    }>;
-  }> {
-    return xrpc("_account.listTrustedDevices", { token });
+  listTrustedDevices(token: AccessToken): Promise<ListTrustedDevicesResponse> {
+    return xrpc('_account.listTrustedDevices', { token })
   },
 
-  revokeTrustedDevice(
-    token: string,
-    deviceId: string,
-  ): Promise<{ success: boolean }> {
-    return xrpc("_account.revokeTrustedDevice", {
-      method: "POST",
+  revokeTrustedDevice(token: AccessToken, deviceId: string): Promise<SuccessResponse> {
+    return xrpc('_account.revokeTrustedDevice', {
+      method: 'POST',
       token,
       body: { deviceId },
-    });
+    })
   },
 
   updateTrustedDevice(
-    token: string,
+    token: AccessToken,
     deviceId: string,
     friendlyName: string,
-  ): Promise<{ success: boolean }> {
-    return xrpc("_account.updateTrustedDevice", {
-      method: "POST",
+  ): Promise<SuccessResponse> {
+    return xrpc('_account.updateTrustedDevice', {
+      method: 'POST',
       token,
       body: { deviceId, friendlyName },
-    });
+    })
   },
 
-  getReauthStatus(token: string): Promise<{
-    requiresReauth: boolean;
-    lastReauthAt: string | null;
-    availableMethods: string[];
-  }> {
-    return xrpc("_account.getReauthStatus", { token });
+  getReauthStatus(token: AccessToken): Promise<ReauthStatus> {
+    return xrpc('_account.getReauthStatus', { token })
   },
 
-  reauthPassword(
-    token: string,
-    password: string,
-  ): Promise<{ success: boolean; reauthAt: string }> {
-    return xrpc("_account.reauthPassword", {
-      method: "POST",
+  reauthPassword(token: AccessToken, password: string): Promise<ReauthResponse> {
+    return xrpc('_account.reauthPassword', {
+      method: 'POST',
       token,
       body: { password },
-    });
+    })
   },
 
-  reauthTotp(
-    token: string,
-    code: string,
-  ): Promise<{ success: boolean; reauthAt: string }> {
-    return xrpc("_account.reauthTotp", {
-      method: "POST",
+  reauthTotp(token: AccessToken, code: string): Promise<ReauthResponse> {
+    return xrpc('_account.reauthTotp', {
+      method: 'POST',
       token,
       body: { code },
-    });
+    })
   },
 
-  reauthPasskeyStart(token: string): Promise<{ options: unknown }> {
-    return xrpc("_account.reauthPasskeyStart", {
-      method: "POST",
+  reauthPasskeyStart(token: AccessToken): Promise<ReauthPasskeyStartResponse> {
+    return xrpc('_account.reauthPasskeyStart', {
+      method: 'POST',
       token,
-    });
+    })
   },
 
-  reauthPasskeyFinish(
-    token: string,
-    credential: unknown,
-  ): Promise<{ success: boolean; reauthAt: string }> {
-    return xrpc("_account.reauthPasskeyFinish", {
-      method: "POST",
+  reauthPasskeyFinish(token: AccessToken, credential: unknown): Promise<ReauthResponse> {
+    return xrpc('_account.reauthPasskeyFinish', {
+      method: 'POST',
       token,
       body: { credential },
-    });
+    })
   },
 
-  reserveSigningKey(did?: string): Promise<{ signingKey: string }> {
-    return xrpc("com.atproto.server.reserveSigningKey", {
-      method: "POST",
+  reserveSigningKey(did?: Did): Promise<ReserveSigningKeyResponse> {
+    return xrpc('com.atproto.server.reserveSigningKey', {
+      method: 'POST',
       body: { did },
-    });
+    })
   },
 
-  getRecommendedDidCredentials(token: string): Promise<{
-    rotationKeys?: string[];
-    alsoKnownAs?: string[];
-    verificationMethods?: { atproto?: string };
-    services?: { atproto_pds?: { type: string; endpoint: string } };
-  }> {
-    return xrpc("com.atproto.identity.getRecommendedDidCredentials", { token });
+  getRecommendedDidCredentials(token: AccessToken): Promise<RecommendedDidCredentials> {
+    return xrpc('com.atproto.identity.getRecommendedDidCredentials', { token })
   },
 
-  async activateAccount(token: string): Promise<void> {
-    await xrpc("com.atproto.server.activateAccount", {
-      method: "POST",
+  async activateAccount(token: AccessToken): Promise<void> {
+    await xrpc('com.atproto.server.activateAccount', {
+      method: 'POST',
       token,
-    });
+    })
   },
 
   async createPasskeyAccount(params: {
-    handle: string;
-    email?: string;
-    inviteCode?: string;
-    didType?: DidType;
-    did?: string;
-    signingKey?: string;
-    verificationChannel?: VerificationChannel;
-    discordId?: string;
-    telegramUsername?: string;
-    signalNumber?: string;
-  }, byodToken?: string): Promise<{
-    did: string;
-    handle: string;
-    setupToken: string;
-    setupExpiresAt: string;
-  }> {
-    const url = `${API_BASE}/_account.createPasskeyAccount`;
+    handle: Handle
+    email?: EmailAddress
+    inviteCode?: string
+    didType?: DidType
+    did?: Did
+    signingKey?: string
+    verificationChannel?: VerificationChannel
+    discordId?: string
+    telegramUsername?: string
+    signalNumber?: string
+  }, byodToken?: string): Promise<PasskeyAccountCreateResponse> {
+    const url = `${API_BASE}/_account.createPasskeyAccount`
     const headers: Record<string, string> = {
-      "Content-Type": "application/json",
-    };
+      'Content-Type': 'application/json',
+    }
     if (byodToken) {
-      headers["Authorization"] = `Bearer ${byodToken}`;
+      headers['Authorization'] = `Bearer ${byodToken}`
     }
     const res = await fetch(url, {
-      method: "POST",
+      method: 'POST',
       headers,
       body: JSON.stringify(params),
-    });
+    })
     if (!res.ok) {
-      const err = await res.json().catch(() => ({
-        error: "Unknown",
+      const errData = await res.json().catch(() => ({
+        error: 'Unknown',
         message: res.statusText,
-      }));
-      throw new ApiError(res.status, err.error, err.message);
+      }))
+      throw new ApiError(res.status, errData.error, errData.message)
     }
-    return res.json();
+    return res.json()
   },
 
   startPasskeyRegistrationForSetup(
-    did: string,
+    did: Did,
     setupToken: string,
     friendlyName?: string,
-  ): Promise<{ options: unknown }> {
-    return xrpc("_account.startPasskeyRegistrationForSetup", {
-      method: "POST",
+  ): Promise<StartPasskeyRegistrationResponse> {
+    return xrpc('_account.startPasskeyRegistrationForSetup', {
+      method: 'POST',
       body: { did, setupToken, friendlyName },
-    });
+    })
   },
 
   completePasskeySetup(
-    did: string,
+    did: Did,
     setupToken: string,
     passkeyCredential: unknown,
     passkeyFriendlyName?: string,
-  ): Promise<{
-    did: string;
-    handle: string;
-    appPassword: string;
-    appPasswordName: string;
-  }> {
-    return xrpc("_account.completePasskeySetup", {
-      method: "POST",
+  ): Promise<CompletePasskeySetupResponse> {
+    return xrpc('_account.completePasskeySetup', {
+      method: 'POST',
       body: { did, setupToken, passkeyCredential, passkeyFriendlyName },
-    });
+    })
   },
 
-  requestPasskeyRecovery(email: string): Promise<{ success: boolean }> {
-    return xrpc("_account.requestPasskeyRecovery", {
-      method: "POST",
+  requestPasskeyRecovery(email: EmailAddress): Promise<SuccessResponse> {
+    return xrpc('_account.requestPasskeyRecovery', {
+      method: 'POST',
       body: { email },
-    });
+    })
   },
 
   recoverPasskeyAccount(
-    did: string,
+    did: Did,
     recoveryToken: string,
     newPassword: string,
-  ): Promise<{ success: boolean }> {
-    return xrpc("_account.recoverPasskeyAccount", {
-      method: "POST",
+  ): Promise<SuccessResponse> {
+    return xrpc('_account.recoverPasskeyAccount', {
+      method: 'POST',
       body: { did, recoveryToken, newPassword },
-    });
+    })
   },
 
-  verifyMigrationEmail(
-    token: string,
-    email: string,
-  ): Promise<{ success: boolean; did: string }> {
-    return xrpc("com.atproto.server.verifyMigrationEmail", {
-      method: "POST",
+  verifyMigrationEmail(token: string, email: EmailAddress): Promise<VerifyMigrationEmailResponse> {
+    return xrpc('com.atproto.server.verifyMigrationEmail', {
+      method: 'POST',
       body: { token, email },
-    });
+    })
   },
 
-  resendMigrationVerification(email: string): Promise<{ sent: boolean }> {
-    return xrpc("com.atproto.server.resendMigrationVerification", {
-      method: "POST",
+  resendMigrationVerification(email: EmailAddress): Promise<ResendMigrationVerificationResponse> {
+    return xrpc('com.atproto.server.resendMigrationVerification', {
+      method: 'POST',
       body: { email },
-    });
+    })
   },
 
   verifyToken(
     token: string,
     identifier: string,
-    accessToken?: string,
-  ): Promise<{
-    success: boolean;
-    did: string;
-    purpose: string;
-    channel: string;
-  }> {
-    return xrpc("_account.verifyToken", {
-      method: "POST",
+    accessToken?: AccessToken,
+  ): Promise<VerifyTokenResponse> {
+    return xrpc('_account.verifyToken', {
+      method: 'POST',
       body: { token, identifier },
       token: accessToken,
-    });
+    })
   },
 
-  getDidDocument(token: string): Promise<DidDocument> {
-    return xrpc("_account.getDidDocument", { token });
+  getDidDocument(token: AccessToken): Promise<DidDocument> {
+    return xrpc('_account.getDidDocument', { token })
   },
 
   updateDidDocument(
-    token: string,
+    token: AccessToken,
     params: {
-      verificationMethods?: VerificationMethod[];
-      alsoKnownAs?: string[];
-      serviceEndpoint?: string;
+      verificationMethods?: VerificationMethod[]
+      alsoKnownAs?: string[]
+      serviceEndpoint?: string
     },
-  ): Promise<{ success: boolean }> {
-    return xrpc("_account.updateDidDocument", {
-      method: "POST",
+  ): Promise<SuccessResponse> {
+    return xrpc('_account.updateDidDocument', {
+      method: 'POST',
       token,
       body: params,
-    });
+    })
   },
 
-  async deactivateAccount(
-    token: string,
-    deleteAfter?: string,
-  ): Promise<void> {
-    await xrpc("com.atproto.server.deactivateAccount", {
-      method: "POST",
+  async deactivateAccount(token: AccessToken, deleteAfter?: string): Promise<void> {
+    await xrpc('com.atproto.server.deactivateAccount', {
+      method: 'POST',
       token,
       body: { deleteAfter },
-    });
+    })
   },
 
-  async getRepo(token: string, did: string): Promise<ArrayBuffer> {
-    const url = `${API_BASE}/com.atproto.sync.getRepo?did=${
-      encodeURIComponent(did)
-    }`;
+  async getRepo(token: AccessToken, did: Did): Promise<ArrayBuffer> {
+    const url = `${API_BASE}/com.atproto.sync.getRepo?did=${encodeURIComponent(did)}`
     const res = await fetch(url, {
       headers: { Authorization: `Bearer ${token}` },
-    });
+    })
     if (!res.ok) {
-      const err = await res.json().catch(() => ({
-        error: "Unknown",
+      const errData = await res.json().catch(() => ({
+        error: 'Unknown',
         message: res.statusText,
-      }));
-      throw new ApiError(res.status, err.error, err.message);
+      }))
+      throw new ApiError(res.status, errData.error, errData.message)
     }
-    return res.arrayBuffer();
+    return res.arrayBuffer()
   },
 
-  listBackups(token: string): Promise<{
-    backups: Array<{
-      id: string;
-      repoRev: string;
-      repoRootCid: string;
-      blockCount: number;
-      sizeBytes: number;
-      createdAt: string;
-    }>;
-    backupEnabled: boolean;
-  }> {
-    return xrpc("_backup.listBackups", { token });
+  listBackups(token: AccessToken): Promise<ListBackupsResponse> {
+    return xrpc('_backup.listBackups', { token })
   },
 
-  async getBackup(token: string, id: string): Promise<Blob> {
-    const url = `${API_BASE}/_backup.getBackup?id=${encodeURIComponent(id)}`;
+  async getBackup(token: AccessToken, id: string): Promise<Blob> {
+    const url = `${API_BASE}/_backup.getBackup?id=${encodeURIComponent(id)}`
     const res = await fetch(url, {
       headers: { Authorization: `Bearer ${token}` },
-    });
+    })
     if (!res.ok) {
-      const err = await res.json().catch(() => ({
-        error: "Unknown",
+      const errData = await res.json().catch(() => ({
+        error: 'Unknown',
         message: res.statusText,
-      }));
-      throw new ApiError(res.status, err.error, err.message);
+      }))
+      throw new ApiError(res.status, errData.error, errData.message)
     }
-    return res.blob();
+    return res.blob()
   },
 
-  createBackup(token: string): Promise<{
-    id: string;
-    repoRev: string;
-    sizeBytes: number;
-    blockCount: number;
-  }> {
-    return xrpc("_backup.createBackup", {
-      method: "POST",
+  createBackup(token: AccessToken): Promise<CreateBackupResponse> {
+    return xrpc('_backup.createBackup', {
+      method: 'POST',
       token,
-    });
+    })
   },
 
-  async deleteBackup(token: string, id: string): Promise<void> {
-    await xrpc("_backup.deleteBackup", {
-      method: "POST",
+  async deleteBackup(token: AccessToken, id: string): Promise<void> {
+    await xrpc('_backup.deleteBackup', {
+      method: 'POST',
       token,
       params: { id },
-    });
+    })
   },
 
-  setBackupEnabled(
-    token: string,
-    enabled: boolean,
-  ): Promise<{ enabled: boolean }> {
-    return xrpc("_backup.setEnabled", {
-      method: "POST",
+  setBackupEnabled(token: AccessToken, enabled: boolean): Promise<SetBackupEnabledResponse> {
+    return xrpc('_backup.setEnabled', {
+      method: 'POST',
       token,
       body: { enabled },
-    });
+    })
   },
 
-  async importRepo(token: string, car: Uint8Array): Promise<void> {
-    const url = `${API_BASE}/com.atproto.repo.importRepo`;
+  async importRepo(token: AccessToken, car: Uint8Array): Promise<void> {
+    const url = `${API_BASE}/com.atproto.repo.importRepo`
     const res = await fetch(url, {
-      method: "POST",
+      method: 'POST',
       headers: {
         Authorization: `Bearer ${token}`,
-        "Content-Type": "application/vnd.ipld.car",
+        'Content-Type': 'application/vnd.ipld.car',
       },
       body: car,
-    });
+    })
     if (!res.ok) {
-      const err = await res.json().catch(() => ({
-        error: "Unknown",
+      const errData = await res.json().catch(() => ({
+        error: 'Unknown',
         message: res.statusText,
-      }));
-      throw new ApiError(res.status, err.error, err.message);
+      }))
+      throw new ApiError(res.status, errData.error, errData.message)
+    }
+  },
+}
+
+export const typedApi = {
+  createSession(
+    identifier: string,
+    password: string
+  ): Promise<Result<Session, ApiError>> {
+    return xrpcResult<Session>('com.atproto.server.createSession', {
+      method: 'POST',
+      body: { identifier, password },
+    }).then(r => r.ok ? ok(castSession(r.value)) : r)
+  },
+
+  getSession(token: AccessToken): Promise<Result<Session, ApiError>> {
+    return xrpcResult<Session>('com.atproto.server.getSession', { token })
+      .then(r => r.ok ? ok(castSession(r.value)) : r)
+  },
+
+  refreshSession(refreshJwt: RefreshToken): Promise<Result<Session, ApiError>> {
+    return xrpcResult<Session>('com.atproto.server.refreshSession', {
+      method: 'POST',
+      token: refreshJwt,
+    }).then(r => r.ok ? ok(castSession(r.value)) : r)
+  },
+
+  describeServer(): Promise<Result<ServerDescription, ApiError>> {
+    return xrpcResult('com.atproto.server.describeServer')
+  },
+
+  listAppPasswords(token: AccessToken): Promise<Result<{ passwords: AppPassword[] }, ApiError>> {
+    return xrpcResult('com.atproto.server.listAppPasswords', { token })
+  },
+
+  createAppPassword(
+    token: AccessToken,
+    name: string,
+    scopes?: string
+  ): Promise<Result<CreatedAppPassword, ApiError>> {
+    return xrpcResult('com.atproto.server.createAppPassword', {
+      method: 'POST',
+      token,
+      body: { name, scopes },
+    })
+  },
+
+  revokeAppPassword(token: AccessToken, name: string): Promise<Result<void, ApiError>> {
+    return xrpcResult<void>('com.atproto.server.revokeAppPassword', {
+      method: 'POST',
+      token,
+      body: { name },
+    })
+  },
+
+  listSessions(token: AccessToken): Promise<Result<ListSessionsResponse, ApiError>> {
+    return xrpcResult('_account.listSessions', { token })
+  },
+
+  revokeSession(token: AccessToken, sessionId: string): Promise<Result<void, ApiError>> {
+    return xrpcResult<void>('_account.revokeSession', {
+      method: 'POST',
+      token,
+      body: { sessionId },
+    })
+  },
+
+  getTotpStatus(token: AccessToken): Promise<Result<TotpStatus, ApiError>> {
+    return xrpcResult('com.atproto.server.getTotpStatus', { token })
+  },
+
+  createTotpSecret(token: AccessToken): Promise<Result<TotpSecret, ApiError>> {
+    return xrpcResult('com.atproto.server.createTotpSecret', {
+      method: 'POST',
+      token,
+    })
+  },
+
+  enableTotp(token: AccessToken, code: string): Promise<Result<EnableTotpResponse, ApiError>> {
+    return xrpcResult('com.atproto.server.enableTotp', {
+      method: 'POST',
+      token,
+      body: { code },
+    })
+  },
+
+  disableTotp(
+    token: AccessToken,
+    password: string,
+    code: string
+  ): Promise<Result<SuccessResponse, ApiError>> {
+    return xrpcResult('com.atproto.server.disableTotp', {
+      method: 'POST',
+      token,
+      body: { password, code },
+    })
+  },
+
+  listPasskeys(token: AccessToken): Promise<Result<ListPasskeysResponse, ApiError>> {
+    return xrpcResult('com.atproto.server.listPasskeys', { token })
+  },
+
+  deletePasskey(token: AccessToken, id: string): Promise<Result<void, ApiError>> {
+    return xrpcResult<void>('com.atproto.server.deletePasskey', {
+      method: 'POST',
+      token,
+      body: { id },
+    })
+  },
+
+  listTrustedDevices(token: AccessToken): Promise<Result<ListTrustedDevicesResponse, ApiError>> {
+    return xrpcResult('_account.listTrustedDevices', { token })
+  },
+
+  getReauthStatus(token: AccessToken): Promise<Result<ReauthStatus, ApiError>> {
+    return xrpcResult('_account.getReauthStatus', { token })
+  },
+
+  getNotificationPrefs(token: AccessToken): Promise<Result<NotificationPrefs, ApiError>> {
+    return xrpcResult('_account.getNotificationPrefs', { token })
+  },
+
+  updateHandle(token: AccessToken, handle: Handle): Promise<Result<void, ApiError>> {
+    return xrpcResult<void>('com.atproto.identity.updateHandle', {
+      method: 'POST',
+      token,
+      body: { handle },
+    })
+  },
+
+  describeRepo(token: AccessToken, repo: Did): Promise<Result<RepoDescription, ApiError>> {
+    return xrpcResult('com.atproto.repo.describeRepo', {
+      token,
+      params: { repo },
+    })
+  },
+
+  listRecords(
+    token: AccessToken,
+    repo: Did,
+    collection: Nsid,
+    options?: { limit?: number; cursor?: string; reverse?: boolean }
+  ): Promise<Result<ListRecordsResponse, ApiError>> {
+    const params: Record<string, string> = { repo, collection }
+    if (options?.limit) params.limit = String(options.limit)
+    if (options?.cursor) params.cursor = options.cursor
+    if (options?.reverse) params.reverse = 'true'
+    return xrpcResult('com.atproto.repo.listRecords', { token, params })
+  },
+
+  getRecord(
+    token: AccessToken,
+    repo: Did,
+    collection: Nsid,
+    rkey: Rkey
+  ): Promise<Result<RecordResponse, ApiError>> {
+    return xrpcResult('com.atproto.repo.getRecord', {
+      token,
+      params: { repo, collection, rkey },
+    })
+  },
+
+  deleteRecord(
+    token: AccessToken,
+    repo: Did,
+    collection: Nsid,
+    rkey: Rkey
+  ): Promise<Result<void, ApiError>> {
+    return xrpcResult<void>('com.atproto.repo.deleteRecord', {
+      method: 'POST',
+      token,
+      body: { repo, collection, rkey },
+    })
+  },
+
+  searchAccounts(
+    token: AccessToken,
+    options?: { handle?: string; cursor?: string; limit?: number }
+  ): Promise<Result<SearchAccountsResponse, ApiError>> {
+    const params: Record<string, string> = {}
+    if (options?.handle) params.handle = options.handle
+    if (options?.cursor) params.cursor = options.cursor
+    if (options?.limit) params.limit = String(options.limit)
+    return xrpcResult('com.atproto.admin.searchAccounts', { token, params })
+  },
+
+  getAccountInfo(token: AccessToken, did: Did): Promise<Result<AccountInfo, ApiError>> {
+    return xrpcResult('com.atproto.admin.getAccountInfo', { token, params: { did } })
+  },
+
+  getServerStats(token: AccessToken): Promise<Result<ServerStats, ApiError>> {
+    return xrpcResult('_admin.getServerStats', { token })
+  },
+
+  listBackups(token: AccessToken): Promise<Result<ListBackupsResponse, ApiError>> {
+    return xrpcResult('_backup.listBackups', { token })
+  },
+
+  createBackup(token: AccessToken): Promise<Result<CreateBackupResponse, ApiError>> {
+    return xrpcResult('_backup.createBackup', {
+      method: 'POST',
+      token,
+    })
+  },
+
+  getDidDocument(token: AccessToken): Promise<Result<DidDocument, ApiError>> {
+    return xrpcResult('_account.getDidDocument', { token })
+  },
+
+  deleteSession(token: AccessToken): Promise<Result<void, ApiError>> {
+    return xrpcResult<void>('com.atproto.server.deleteSession', {
+      method: 'POST',
+      token,
+    })
+  },
+
+  revokeAllSessions(token: AccessToken): Promise<Result<{ revokedCount: number }, ApiError>> {
+    return xrpcResult('_account.revokeAllSessions', {
+      method: 'POST',
+      token,
+    })
+  },
+
+  getAccountInviteCodes(token: AccessToken): Promise<Result<{ codes: InviteCodeInfo[] }, ApiError>> {
+    return xrpcResult('com.atproto.server.getAccountInviteCodes', { token })
+  },
+
+  createInviteCode(token: AccessToken, useCount: number = 1): Promise<Result<{ code: string }, ApiError>> {
+    return xrpcResult('com.atproto.server.createInviteCode', {
+      method: 'POST',
+      token,
+      body: { useCount },
+    })
+  },
+
+  changePassword(
+    token: AccessToken,
+    currentPassword: string,
+    newPassword: string
+  ): Promise<Result<void, ApiError>> {
+    return xrpcResult<void>('_account.changePassword', {
+      method: 'POST',
+      token,
+      body: { currentPassword, newPassword },
+    })
+  },
+
+  getPasswordStatus(token: AccessToken): Promise<Result<PasswordStatus, ApiError>> {
+    return xrpcResult('_account.getPasswordStatus', { token })
+  },
+
+  getServerConfig(): Promise<Result<ServerConfig, ApiError>> {
+    return xrpcResult('_server.getConfig')
+  },
+
+  getLegacyLoginPreference(token: AccessToken): Promise<Result<LegacyLoginPreference, ApiError>> {
+    return xrpcResult('_account.getLegacyLoginPreference', { token })
+  },
+
+  updateLegacyLoginPreference(
+    token: AccessToken,
+    allowLegacyLogin: boolean
+  ): Promise<Result<UpdateLegacyLoginResponse, ApiError>> {
+    return xrpcResult('_account.updateLegacyLoginPreference', {
+      method: 'POST',
+      token,
+      body: { allowLegacyLogin },
+    })
+  },
+
+  getNotificationHistory(token: AccessToken): Promise<Result<NotificationHistoryResponse, ApiError>> {
+    return xrpcResult('_account.getNotificationHistory', { token })
+  },
+
+  updateNotificationPrefs(
+    token: AccessToken,
+    prefs: {
+      preferredChannel?: string
+      discordId?: string
+      telegramUsername?: string
+      signalNumber?: string
     }
+  ): Promise<Result<SuccessResponse, ApiError>> {
+    return xrpcResult('_account.updateNotificationPrefs', {
+      method: 'POST',
+      token,
+      body: prefs,
+    })
   },
-};
+
+  revokeTrustedDevice(token: AccessToken, deviceId: string): Promise<Result<SuccessResponse, ApiError>> {
+    return xrpcResult('_account.revokeTrustedDevice', {
+      method: 'POST',
+      token,
+      body: { deviceId },
+    })
+  },
+
+  updateTrustedDevice(
+    token: AccessToken,
+    deviceId: string,
+    friendlyName: string
+  ): Promise<Result<SuccessResponse, ApiError>> {
+    return xrpcResult('_account.updateTrustedDevice', {
+      method: 'POST',
+      token,
+      body: { deviceId, friendlyName },
+    })
+  },
+
+  reauthPassword(token: AccessToken, password: string): Promise<Result<ReauthResponse, ApiError>> {
+    return xrpcResult('_account.reauthPassword', {
+      method: 'POST',
+      token,
+      body: { password },
+    })
+  },
+
+  reauthTotp(token: AccessToken, code: string): Promise<Result<ReauthResponse, ApiError>> {
+    return xrpcResult('_account.reauthTotp', {
+      method: 'POST',
+      token,
+      body: { code },
+    })
+  },
+
+  reauthPasskeyStart(token: AccessToken): Promise<Result<ReauthPasskeyStartResponse, ApiError>> {
+    return xrpcResult('_account.reauthPasskeyStart', {
+      method: 'POST',
+      token,
+    })
+  },
+
+  reauthPasskeyFinish(token: AccessToken, credential: unknown): Promise<Result<ReauthResponse, ApiError>> {
+    return xrpcResult('_account.reauthPasskeyFinish', {
+      method: 'POST',
+      token,
+      body: { credential },
+    })
+  },
+
+  confirmSignup(did: Did, verificationCode: string): Promise<Result<ConfirmSignupResult, ApiError>> {
+    return xrpcResult('com.atproto.server.confirmSignup', {
+      method: 'POST',
+      body: { did, verificationCode },
+    })
+  },
+
+  resendVerification(did: Did): Promise<Result<{ success: boolean }, ApiError>> {
+    return xrpcResult('com.atproto.server.resendVerification', {
+      method: 'POST',
+      body: { did },
+    })
+  },
+
+  requestEmailUpdate(token: AccessToken): Promise<Result<EmailUpdateResponse, ApiError>> {
+    return xrpcResult('com.atproto.server.requestEmailUpdate', {
+      method: 'POST',
+      token,
+    })
+  },
+
+  updateEmail(token: AccessToken, email: string, emailToken?: string): Promise<Result<void, ApiError>> {
+    return xrpcResult<void>('com.atproto.server.updateEmail', {
+      method: 'POST',
+      token,
+      body: { email, token: emailToken },
+    })
+  },
+
+  requestAccountDelete(token: AccessToken): Promise<Result<void, ApiError>> {
+    return xrpcResult<void>('com.atproto.server.requestAccountDelete', {
+      method: 'POST',
+      token,
+    })
+  },
+
+  deleteAccount(did: Did, password: string, deleteToken: string): Promise<Result<void, ApiError>> {
+    return xrpcResult<void>('com.atproto.server.deleteAccount', {
+      method: 'POST',
+      body: { did, password, token: deleteToken },
+    })
+  },
+
+  updateDidDocument(
+    token: AccessToken,
+    params: {
+      verificationMethods?: VerificationMethod[]
+      alsoKnownAs?: string[]
+      serviceEndpoint?: string
+    }
+  ): Promise<Result<SuccessResponse, ApiError>> {
+    return xrpcResult('_account.updateDidDocument', {
+      method: 'POST',
+      token,
+      body: params,
+    })
+  },
+
+  deactivateAccount(token: AccessToken, deleteAfter?: string): Promise<Result<void, ApiError>> {
+    return xrpcResult<void>('com.atproto.server.deactivateAccount', {
+      method: 'POST',
+      token,
+      body: { deleteAfter },
+    })
+  },
+
+  activateAccount(token: AccessToken): Promise<Result<void, ApiError>> {
+    return xrpcResult<void>('com.atproto.server.activateAccount', {
+      method: 'POST',
+      token,
+    })
+  },
+
+  setBackupEnabled(token: AccessToken, enabled: boolean): Promise<Result<SetBackupEnabledResponse, ApiError>> {
+    return xrpcResult('_backup.setEnabled', {
+      method: 'POST',
+      token,
+      body: { enabled },
+    })
+  },
+
+  deleteBackup(token: AccessToken, id: string): Promise<Result<void, ApiError>> {
+    return xrpcResult<void>('_backup.deleteBackup', {
+      method: 'POST',
+      token,
+      params: { id },
+    })
+  },
+
+  createRecord(
+    token: AccessToken,
+    repo: Did,
+    collection: Nsid,
+    record: unknown,
+    rkey?: Rkey
+  ): Promise<Result<CreateRecordResponse, ApiError>> {
+    return xrpcResult('com.atproto.repo.createRecord', {
+      method: 'POST',
+      token,
+      body: { repo, collection, record, rkey },
+    })
+  },
+
+  putRecord(
+    token: AccessToken,
+    repo: Did,
+    collection: Nsid,
+    rkey: Rkey,
+    record: unknown
+  ): Promise<Result<CreateRecordResponse, ApiError>> {
+    return xrpcResult('com.atproto.repo.putRecord', {
+      method: 'POST',
+      token,
+      body: { repo, collection, rkey, record },
+    })
+  },
+
+  getInviteCodes(
+    token: AccessToken,
+    options?: { sort?: 'recent' | 'usage'; cursor?: string; limit?: number }
+  ): Promise<Result<GetInviteCodesResponse, ApiError>> {
+    const params: Record<string, string> = {}
+    if (options?.sort) params.sort = options.sort
+    if (options?.cursor) params.cursor = options.cursor
+    if (options?.limit) params.limit = String(options.limit)
+    return xrpcResult('com.atproto.admin.getInviteCodes', { token, params })
+  },
+
+  disableAccountInvites(token: AccessToken, account: Did): Promise<Result<void, ApiError>> {
+    return xrpcResult<void>('com.atproto.admin.disableAccountInvites', {
+      method: 'POST',
+      token,
+      body: { account },
+    })
+  },
+
+  enableAccountInvites(token: AccessToken, account: Did): Promise<Result<void, ApiError>> {
+    return xrpcResult<void>('com.atproto.admin.enableAccountInvites', {
+      method: 'POST',
+      token,
+      body: { account },
+    })
+  },
+
+  adminDeleteAccount(token: AccessToken, did: Did): Promise<Result<void, ApiError>> {
+    return xrpcResult<void>('com.atproto.admin.deleteAccount', {
+      method: 'POST',
+      token,
+      body: { did },
+    })
+  },
+
+  startPasskeyRegistration(
+    token: AccessToken,
+    friendlyName?: string
+  ): Promise<Result<StartPasskeyRegistrationResponse, ApiError>> {
+    return xrpcResult('com.atproto.server.startPasskeyRegistration', {
+      method: 'POST',
+      token,
+      body: { friendlyName },
+    })
+  },
+
+  finishPasskeyRegistration(
+    token: AccessToken,
+    credential: unknown,
+    friendlyName?: string
+  ): Promise<Result<FinishPasskeyRegistrationResponse, ApiError>> {
+    return xrpcResult('com.atproto.server.finishPasskeyRegistration', {
+      method: 'POST',
+      token,
+      body: { credential, friendlyName },
+    })
+  },
+
+  updatePasskey(
+    token: AccessToken,
+    id: string,
+    friendlyName: string
+  ): Promise<Result<void, ApiError>> {
+    return xrpcResult<void>('com.atproto.server.updatePasskey', {
+      method: 'POST',
+      token,
+      body: { id, friendlyName },
+    })
+  },
+
+  regenerateBackupCodes(
+    token: AccessToken,
+    password: string,
+    code: string
+  ): Promise<Result<RegenerateBackupCodesResponse, ApiError>> {
+    return xrpcResult('com.atproto.server.regenerateBackupCodes', {
+      method: 'POST',
+      token,
+      body: { password, code },
+    })
+  },
+
+  updateLocale(token: AccessToken, preferredLocale: string): Promise<Result<UpdateLocaleResponse, ApiError>> {
+    return xrpcResult('_account.updateLocale', {
+      method: 'POST',
+      token,
+      body: { preferredLocale },
+    })
+  },
+
+  confirmChannelVerification(
+    token: AccessToken,
+    channel: string,
+    identifier: string,
+    code: string
+  ): Promise<Result<SuccessResponse, ApiError>> {
+    return xrpcResult('_account.confirmChannelVerification', {
+      method: 'POST',
+      token,
+      body: { channel, identifier, code },
+    })
+  },
+
+  removePassword(token: AccessToken): Promise<Result<SuccessResponse, ApiError>> {
+    return xrpcResult('_account.removePassword', {
+      method: 'POST',
+      token,
+    })
+  },
+}

frontend/src/lib/auth.svelte.ts

···
 import {
   api,
   ApiError,
+  typedApi,
   type CreateAccountParams,
   type CreateAccountResult,
-  type Session,
-  setTokenRefreshCallback,
 } from "./api";
+import type { Session } from "./types/api";
+import {
+  type Did,
+  type Handle,
+  type AccessToken,
+  type RefreshToken,
+  unsafeAsDid,
+  unsafeAsHandle,
+  unsafeAsAccessToken,
+  unsafeAsRefreshToken,
+} from "./types/branded";
+import { type Result, ok, err, isOk, isErr, map } from "./types/result";
+import { assertNever } from "./types/exhaustive";
 import {
   checkForOAuthCallback,
   clearOAuthCallbackParams,
···
 } from "./oauth";
 import { setLocale, type SupportedLocale } from "./i18n";
 
-function applyLocaleFromSession(
-  sessionInfo: { preferredLocale?: string | null },
-) {
-  if (sessionInfo.preferredLocale) {
-    setLocale(sessionInfo.preferredLocale as SupportedLocale);
+const STORAGE_KEY = "tranquil_pds_session";
+const ACCOUNTS_KEY = "tranquil_pds_accounts";
+
+export interface SavedAccount {
+  readonly did: Did;
+  readonly handle: Handle;
+  readonly accessJwt: AccessToken;
+  readonly refreshJwt: RefreshToken;
+}
+
+export type AuthError =
+  | { readonly type: "network"; readonly message: string }
+  | { readonly type: "unauthorized"; readonly message: string }
+  | { readonly type: "validation"; readonly message: string }
+  | { readonly type: "oauth"; readonly message: string }
+  | { readonly type: "unknown"; readonly message: string };
+
+function toAuthError(e: unknown): AuthError {
+  if (e instanceof ApiError) {
+    if (e.status === 401) {
+      return { type: "unauthorized", message: e.message };
+    }
+    return { type: "validation", message: e.message };
   }
+  if (e instanceof Error) {
+    if (e.message.includes("network") || e.message.includes("fetch")) {
+      return { type: "network", message: e.message };
+    }
+    return { type: "unknown", message: e.message };
+  }
+  return { type: "unknown", message: "An unknown error occurred" };
 }
 
-const STORAGE_KEY = "tranquil_pds_session";
-const ACCOUNTS_KEY = "tranquil_pds_accounts";
+type AuthStateKind = "unauthenticated" | "loading" | "authenticated" | "error";
+
+export type AuthState =
+  | {
+      readonly kind: "unauthenticated";
+      readonly savedAccounts: readonly SavedAccount[];
+    }
+  | {
+      readonly kind: "loading";
+      readonly savedAccounts: readonly SavedAccount[];
+      readonly previousSession: Session | null;
+    }
+  | {
+      readonly kind: "authenticated";
+      readonly session: Session;
+      readonly savedAccounts: readonly SavedAccount[];
+    }
+  | {
+      readonly kind: "error";
+      readonly error: AuthError;
+      readonly savedAccounts: readonly SavedAccount[];
+    };
+
+function createUnauthenticated(
+  savedAccounts: readonly SavedAccount[],
+): AuthState {
+  return { kind: "unauthenticated", savedAccounts };
+}
+
+function createLoading(
+  savedAccounts: readonly SavedAccount[],
+  previousSession: Session | null = null,
+): AuthState {
+  return { kind: "loading", savedAccounts, previousSession };
+}
 
-export interface SavedAccount {
-  did: string;
-  handle: string;
-  accessJwt: string;
-  refreshJwt: string;
+function createAuthenticated(
+  session: Session,
+  savedAccounts: readonly SavedAccount[],
+): AuthState {
+  return { kind: "authenticated", session, savedAccounts };
 }
 
-interface AuthState {
-  session: Session | null;
-  loading: boolean;
-  error: string | null;
-  savedAccounts: SavedAccount[];
+function createError(
+  error: AuthError,
+  savedAccounts: readonly SavedAccount[],
+): AuthState {
+  return { kind: "error", error, savedAccounts };
 }
 
-const state = $state<AuthState>({
-  session: null,
-  loading: true,
-  error: null,
-  savedAccounts: [],
+const state = $state<{ current: AuthState }>({
+  current: createLoading([]),
 });
 
-function saveSession(session: Session | null) {
-  if (session) {
-    localStorage.setItem(STORAGE_KEY, JSON.stringify(session));
-  } else {
-    localStorage.removeItem(STORAGE_KEY);
+function applyLocaleFromSession(sessionInfo: {
+  preferredLocale?: string | null;
+}): void {
+  if (sessionInfo.preferredLocale) {
+    setLocale(sessionInfo.preferredLocale as SupportedLocale);
   }
 }
 
-function loadSession(): Session | null {
-  const stored = localStorage.getItem(STORAGE_KEY);
-  if (stored) {
-    try {
-      return JSON.parse(stored);
-    } catch {
-      return null;
+function sessionToSavedAccount(session: Session): SavedAccount {
+  return {
+    did: unsafeAsDid(session.did),
+    handle: unsafeAsHandle(session.handle),
+    accessJwt: unsafeAsAccessToken(session.accessJwt),
+    refreshJwt: unsafeAsRefreshToken(session.refreshJwt),
+  };
+}
+
+interface StoredSession {
+  readonly did: string;
+  readonly handle: string;
+  readonly accessJwt: string;
+  readonly refreshJwt: string;
+  readonly email?: string;
+  readonly emailConfirmed?: boolean;
+  readonly preferredChannel?: string;
+  readonly preferredChannelVerified?: boolean;
+  readonly preferredLocale?: string | null;
+}
+
+function parseStoredSession(json: string): Result<StoredSession, Error> {
+  try {
+    const parsed = JSON.parse(json);
+    if (
+      typeof parsed === "object" &&
+      parsed !== null &&
+      typeof parsed.did === "string" &&
+      typeof parsed.handle === "string" &&
+      typeof parsed.accessJwt === "string" &&
+      typeof parsed.refreshJwt === "string"
+    ) {
+      return ok(parsed as StoredSession);
     }
+    return err(new Error("Invalid session format"));
+  } catch (e) {
+    return err(e instanceof Error ? e : new Error("Failed to parse session"));
   }
-  return null;
 }
 
-function loadSavedAccounts(): SavedAccount[] {
-  const stored = localStorage.getItem(ACCOUNTS_KEY);
-  if (stored) {
-    try {
-      return JSON.parse(stored);
-    } catch {
-      return [];
+function parseStoredAccounts(json: string): Result<SavedAccount[], Error> {
+  try {
+    const parsed = JSON.parse(json);
+    if (!Array.isArray(parsed)) {
+      return err(new Error("Invalid accounts format"));
     }
+    const accounts: SavedAccount[] = parsed
+      .filter(
+        (a): a is { did: string; handle: string; accessJwt: string; refreshJwt: string } =>
+          typeof a === "object" &&
+          a !== null &&
+          typeof a.did === "string" &&
+          typeof a.handle === "string" &&
+          typeof a.accessJwt === "string" &&
+          typeof a.refreshJwt === "string",
+      )
+      .map((a) => ({
+        did: unsafeAsDid(a.did),
+        handle: unsafeAsHandle(a.handle),
+        accessJwt: unsafeAsAccessToken(a.accessJwt),
+        refreshJwt: unsafeAsRefreshToken(a.refreshJwt),
+      }));
+    return ok(accounts);
+  } catch (e) {
+    return err(e instanceof Error ? e : new Error("Failed to parse accounts"));
   }
-  return [];
 }
 
-function saveSavedAccounts(accounts: SavedAccount[]) {
-  localStorage.setItem(ACCOUNTS_KEY, JSON.stringify(accounts));
+function loadSessionFromStorage(): StoredSession | null {
+  const stored = localStorage.getItem(STORAGE_KEY);
+  if (!stored) return null;
+  const result = parseStoredSession(stored);
+  return isOk(result) ? result.value : null;
+}
+
+function loadSavedAccountsFromStorage(): readonly SavedAccount[] {
+  const stored = localStorage.getItem(ACCOUNTS_KEY);
+  if (!stored) return [];
+  const result = parseStoredAccounts(stored);
+  return isOk(result) ? result.value : [];
 }
 
-function addOrUpdateSavedAccount(session: Session) {
-  const accounts = loadSavedAccounts();
-  const existing = accounts.findIndex((a) => a.did === session.did);
-  const savedAccount: SavedAccount = {
-    did: session.did,
-    handle: session.handle,
-    accessJwt: session.accessJwt,
-    refreshJwt: session.refreshJwt,
-  };
-  if (existing >= 0) {
-    accounts[existing] = savedAccount;
+function persistSession(session: Session | null): void {
+  if (session) {
+    localStorage.setItem(STORAGE_KEY, JSON.stringify(session));
   } else {
-    accounts.push(savedAccount);
+    localStorage.removeItem(STORAGE_KEY);
   }
-  saveSavedAccounts(accounts);
-  state.savedAccounts = accounts;
+}
+
+function persistSavedAccounts(accounts: readonly SavedAccount[]): void {
+  localStorage.setItem(ACCOUNTS_KEY, JSON.stringify(accounts));
+}
+
+function updateSavedAccounts(
+  accounts: readonly SavedAccount[],
+  session: Session,
+): readonly SavedAccount[] {
+  const newAccount = sessionToSavedAccount(session);
+  const filtered = accounts.filter((a) => a.did !== newAccount.did);
+  return [...filtered, newAccount];
+}
+
+function removeSavedAccountByDid(
+  accounts: readonly SavedAccount[],
+  did: Did,
+): readonly SavedAccount[] {
+  return accounts.filter((a) => a.did !== did);
+}
+
+function findSavedAccount(
+  accounts: readonly SavedAccount[],
+  did: Did,
+): SavedAccount | undefined {
+  return accounts.find((a) => a.did === did);
+}
+
+function getSavedAccounts(): readonly SavedAccount[] {
+  return state.current.savedAccounts;
+}
+
+function setState(newState: AuthState): void {
+  state.current = newState;
 }
 
-function removeSavedAccount(did: string) {
-  const accounts = loadSavedAccounts().filter((a) => a.did !== did);
-  saveSavedAccounts(accounts);
-  state.savedAccounts = accounts;
+function setAuthenticated(session: Session): void {
+  const accounts = updateSavedAccounts(getSavedAccounts(), session);
+  persistSession(session);
+  persistSavedAccounts(accounts);
+  setState(createAuthenticated(session, accounts));
+}
+
+function setUnauthenticated(): void {
+  persistSession(null);
+  setState(createUnauthenticated(getSavedAccounts()));
+}
+
+function setError(error: AuthError): void {
+  setState(createError(error, getSavedAccounts()));
+}
+
+function setLoading(previousSession: Session | null = null): void {
+  setState(createLoading(getSavedAccounts(), previousSession));
 }
 
 async function tryRefreshToken(): Promise<string | null> {
-  if (!state.session) return null;
+  if (state.current.kind !== "authenticated") return null;
+  const currentSession = state.current.session;
   try {
-    const tokens = await refreshOAuthToken(state.session.refreshJwt);
+    const tokens = await refreshOAuthToken(currentSession.refreshJwt);
     const sessionInfo = await api.getSession(tokens.access_token);
     const session: Session = {
       ...sessionInfo,
       accessJwt: tokens.access_token,
-      refreshJwt: tokens.refresh_token || state.session.refreshJwt,
+      refreshJwt: tokens.refresh_token || currentSession.refreshJwt,
     };
-    state.session = session;
-    saveSession(session);
-    addOrUpdateSavedAccount(session);
+    setAuthenticated(session);
     return session.accessJwt;
   } catch {
     return null;
   }
 }
 
+import { setTokenRefreshCallback } from "./api";
+
 export async function initAuth(): Promise<{ oauthLoginCompleted: boolean }> {
   setTokenRefreshCallback(tryRefreshToken);
-  state.loading = true;
-  state.error = null;
-  state.savedAccounts = loadSavedAccounts();
+  const savedAccounts = loadSavedAccountsFromStorage();
+  setState(createLoading(savedAccounts));
 
   const oauthCallback = checkForOAuthCallback();
   if (oauthCallback) {
···
         accessJwt: tokens.access_token,
         refreshJwt: tokens.refresh_token || "",
       };
-      state.session = session;
-      saveSession(session);
-      addOrUpdateSavedAccount(session);
+      setAuthenticated(session);
       applyLocaleFromSession(sessionInfo);
-      state.loading = false;
       return { oauthLoginCompleted: true };
     } catch (e) {
-      state.error = e instanceof Error ? e.message : "OAuth login failed";
-      state.loading = false;
+      setError({ type: "oauth", message: e instanceof Error ? e.message : "OAuth login failed" });
       return { oauthLoginCompleted: false };
     }
   }
 
-  const stored = loadSession();
+  const stored = loadSessionFromStorage();
   if (stored) {
     try {
       const sessionInfo = await api.getSession(stored.accessJwt);
-      state.session = {
+      const session: Session = {
         ...sessionInfo,
         accessJwt: stored.accessJwt,
         refreshJwt: stored.refreshJwt,
       };
-      addOrUpdateSavedAccount(state.session);
+      setAuthenticated(session);
       applyLocaleFromSession(sessionInfo);
     } catch (e) {
       if (e instanceof ApiError && e.status === 401) {
···
             accessJwt: tokens.access_token,
             refreshJwt: tokens.refresh_token || stored.refreshJwt,
           };
-          state.session = session;
-          saveSession(session);
-          addOrUpdateSavedAccount(session);
+          setAuthenticated(session);
           applyLocaleFromSession(sessionInfo);
         } catch (refreshError) {
           console.error("Token refresh failed during init:", refreshError);
-          saveSession(null);
-          state.session = null;
+          setUnauthenticated();
         }
       } else {
         console.error("Non-401 error during getSession:", e);
-        saveSession(null);
-        state.session = null;
+        setUnauthenticated();
       }
     }
+  } else {
+    setState(createUnauthenticated(savedAccounts));
   }
-  state.loading = false;
+
   return { oauthLoginCompleted: false };
 }
 
 export async function login(
   identifier: string,
   password: string,
-): Promise<void> {
-  state.loading = true;
-  state.error = null;
-  try {
-    const session = await api.createSession(identifier, password);
-    state.session = session;
-    saveSession(session);
-    addOrUpdateSavedAccount(session);
-  } catch (e) {
-    if (e instanceof ApiError) {
-      state.error = e.message;
-    } else {
-      state.error = "Login failed";
-    }
-    throw e;
-  } finally {
-    state.loading = false;
+): Promise<Result<Session, AuthError>> {
+  const currentState = state.current;
+  const previousSession =
+    currentState.kind === "authenticated" ? currentState.session : null;
+  setLoading(previousSession);
+
+  const result = await typedApi.createSession(identifier, password);
+  if (isErr(result)) {
+    const error = toAuthError(result.error);
+    setError(error);
+    return err(error);
   }
+
+  setAuthenticated(result.value);
+  return ok(result.value);
 }
 
-export async function loginWithOAuth(): Promise<void> {
-  state.loading = true;
-  state.error = null;
+export async function loginWithOAuth(): Promise<Result<void, AuthError>> {
+  setLoading();
   try {
     await startOAuthLogin();
+    return ok(undefined);
   } catch (e) {
-    state.loading = false;
-    state.error = e instanceof Error
-      ? e.message
-      : "Failed to start OAuth login";
-    throw e;
+    const error = toAuthError(e);
+    setError(error);
+    return err(error);
   }
 }
 
 export async function register(
   params: CreateAccountParams,
-): Promise<CreateAccountResult> {
+): Promise<Result<CreateAccountResult, AuthError>> {
   try {
     const result = await api.createAccount(params);
-    return result;
+    return ok(result);
   } catch (e) {
-    if (e instanceof ApiError) {
-      state.error = e.message;
-    } else {
-      state.error = "Registration failed";
-    }
-    throw e;
+    return err(toAuthError(e));
   }
 }
 
 export async function confirmSignup(
   did: string,
   verificationCode: string,
-): Promise<void> {
-  state.loading = true;
-  state.error = null;
+): Promise<Result<Session, AuthError>> {
+  setLoading();
   try {
     const result = await api.confirmSignup(did, verificationCode);
     const session: Session = {
···
       preferredChannel: result.preferredChannel,
       preferredChannelVerified: result.preferredChannelVerified,
     };
-    state.session = session;
-    saveSession(session);
-    addOrUpdateSavedAccount(session);
+    setAuthenticated(session);
+    return ok(session);
   } catch (e) {
-    if (e instanceof ApiError) {
-      state.error = e.message;
-    } else {
-      state.error = "Verification failed";
-    }
-    throw e;
-  } finally {
-    state.loading = false;
+    const error = toAuthError(e);
+    setError(error);
+    return err(error);
   }
 }
 
-export async function resendVerification(did: string): Promise<void> {
+export async function resendVerification(
+  did: string,
+): Promise<Result<void, AuthError>> {
   try {
     await api.resendVerification(did);
+    return ok(undefined);
   } catch (e) {
-    if (e instanceof ApiError) {
-      throw e;
-    }
-    throw new Error("Failed to resend verification code");
+    return err(toAuthError(e));
   }
 }
 
-export function setSession(
-  session: {
-    did: string;
-    handle: string;
-    accessJwt: string;
-    refreshJwt: string;
-  },
-): void {
+export function setSession(session: {
+  did: string;
+  handle: string;
+  accessJwt: string;
+  refreshJwt: string;
+}): void {
   const newSession: Session = {
     did: session.did,
     handle: session.handle,
     accessJwt: session.accessJwt,
     refreshJwt: session.refreshJwt,
   };
-  state.session = newSession;
-  saveSession(newSession);
-  addOrUpdateSavedAccount(newSession);
+  setAuthenticated(newSession);
 }
 
-export async function logout(): Promise<void> {
-  if (state.session) {
-    const did = state.session.did;
-    const refreshToken = state.session.refreshJwt;
+export async function logout(): Promise<Result<void, AuthError>> {
+  if (state.current.kind === "authenticated") {
+    const { session } = state.current;
+    const did = unsafeAsDid(session.did);
     try {
       await fetch("/oauth/revoke", {
         method: "POST",
         headers: { "Content-Type": "application/x-www-form-urlencoded" },
-        body: new URLSearchParams({ token: refreshToken }),
+        body: new URLSearchParams({ token: session.refreshJwt }),
       });
     } catch {
-      // Ignore errors on logout
+      // Ignore revocation errors
     }
-    removeSavedAccount(did);
+    const accounts = removeSavedAccountByDid(getSavedAccounts(), did);
+    persistSavedAccounts(accounts);
+    persistSession(null);
+    setState(createUnauthenticated(accounts));
+  } else {
+    setUnauthenticated();
   }
-  state.session = null;
-  saveSession(null);
+  return ok(undefined);
 }
 
-export async function switchAccount(did: string): Promise<void> {
-  const account = state.savedAccounts.find((a) => a.did === did);
+export async function switchAccount(
+  did: Did,
+): Promise<Result<Session, AuthError>> {
+  const account = findSavedAccount(getSavedAccounts(), did);
   if (!account) {
-    throw new Error("Account not found");
+    return err({ type: "validation", message: "Account not found" });
   }
-  state.loading = true;
-  state.error = null;
+
+  setLoading();
+
   try {
-    const session = await api.getSession(account.accessJwt);
-    state.session = {
-      ...session,
-      accessJwt: account.accessJwt,
-      refreshJwt: account.refreshJwt,
+    const sessionInfo = await api.getSession(account.accessJwt as string);
+    const session: Session = {
+      ...sessionInfo,
+      accessJwt: account.accessJwt as string,
+      refreshJwt: account.refreshJwt as string,
     };
-    saveSession(state.session);
-    addOrUpdateSavedAccount(state.session);
+    setAuthenticated(session);
+    return ok(session);
   } catch (e) {
     if (e instanceof ApiError && e.status === 401) {
       try {
-        const tokens = await refreshOAuthToken(account.refreshJwt);
+        const tokens = await refreshOAuthToken(account.refreshJwt as string);
         const sessionInfo = await api.getSession(tokens.access_token);
         const session: Session = {
           ...sessionInfo,
           accessJwt: tokens.access_token,
-          refreshJwt: tokens.refresh_token || account.refreshJwt,
+          refreshJwt: tokens.refresh_token || (account.refreshJwt as string),
         };
-        state.session = session;
-        saveSession(session);
-        addOrUpdateSavedAccount(session);
+        setAuthenticated(session);
+        return ok(session);
       } catch {
-        removeSavedAccount(did);
-        state.error = "Session expired. Please log in again.";
-        throw new Error("Session expired");
+        const accounts = removeSavedAccountByDid(getSavedAccounts(), did);
+        persistSavedAccounts(accounts);
+        const error: AuthError = {
+          type: "unauthorized",
+          message: "Session expired. Please log in again.",
+        };
+        setState(createError(error, accounts));
+        return err(error);
       }
-    } else {
-      state.error = "Failed to switch account";
-      throw e;
     }
-  } finally {
-    state.loading = false;
+    const error = toAuthError(e);
+    setError(error);
+    return err(error);
   }
 }
 
-export function forgetAccount(did: string): void {
-  removeSavedAccount(did);
+export function forgetAccount(did: Did): void {
+  const accounts = removeSavedAccountByDid(getSavedAccounts(), did);
+  persistSavedAccounts(accounts);
+  setState({
+    ...state.current,
+    savedAccounts: accounts,
+  } as AuthState);
 }
 
-export function getAuthState() {
-  return state;
+export function getAuthState(): AuthState {
+  return state.current;
 }
 
-export async function refreshSession(): Promise<void> {
-  if (!state.session) return;
+export async function refreshSession(): Promise<Result<Session, AuthError>> {
+  if (state.current.kind !== "authenticated") {
+    return err({ type: "unauthorized", message: "Not authenticated" });
+  }
+  const currentSession = state.current.session;
   try {
-    const sessionInfo = await api.getSession(state.session.accessJwt);
-    state.session = {
+    const sessionInfo = await api.getSession(currentSession.accessJwt);
+    const session: Session = {
       ...sessionInfo,
-      accessJwt: state.session.accessJwt,
-      refreshJwt: state.session.refreshJwt,
+      accessJwt: currentSession.accessJwt,
+      refreshJwt: currentSession.refreshJwt,
     };
-    saveSession(state.session);
-    addOrUpdateSavedAccount(state.session);
+    setAuthenticated(session);
+    return ok(session);
   } catch (e) {
     console.error("Failed to refresh session:", e);
+    return err(toAuthError(e));
   }
 }
 
-export function getToken(): string | null {
-  return state.session?.accessJwt ?? null;
+export function getToken(): AccessToken | null {
+  if (state.current.kind === "authenticated") {
+    return unsafeAsAccessToken(state.current.session.accessJwt);
+  }
+  return null;
 }
 
-export async function getValidToken(): Promise<string | null> {
-  if (!state.session) return null;
+export async function getValidToken(): Promise<AccessToken | null> {
+  if (state.current.kind !== "authenticated") return null;
+  const currentSession = state.current.session;
   try {
-    await api.getSession(state.session.accessJwt);
-    return state.session.accessJwt;
+    await api.getSession(currentSession.accessJwt);
+    return unsafeAsAccessToken(currentSession.accessJwt);
   } catch (e) {
     if (e instanceof ApiError && e.status === 401) {
       try {
-        const tokens = await refreshOAuthToken(state.session.refreshJwt);
+        const tokens = await refreshOAuthToken(currentSession.refreshJwt);
         const sessionInfo = await api.getSession(tokens.access_token);
         const session: Session = {
           ...sessionInfo,
           accessJwt: tokens.access_token,
-          refreshJwt: tokens.refresh_token || state.session.refreshJwt,
+          refreshJwt: tokens.refresh_token || currentSession.refreshJwt,
         };
-        state.session = session;
-        saveSession(session);
-        addOrUpdateSavedAccount(session);
-        return session.accessJwt;
+        setAuthenticated(session);
+        return unsafeAsAccessToken(session.accessJwt);
       } catch {
         return null;
       }
···
 }
 
 export function isAuthenticated(): boolean {
-  return state.session !== null;
+  return state.current.kind === "authenticated";
+}
+
+export function isLoading(): boolean {
+  return state.current.kind === "loading";
+}
+
+export function getError(): AuthError | null {
+  return state.current.kind === "error" ? state.current.error : null;
+}
+
+export function getSession(): Session | null {
+  return state.current.kind === "authenticated" ? state.current.session : null;
+}
+
+export function matchAuthState<T>(handlers: {
+  unauthenticated: (accounts: readonly SavedAccount[]) => T;
+  loading: (accounts: readonly SavedAccount[], previousSession: Session | null) => T;
+  authenticated: (session: Session, accounts: readonly SavedAccount[]) => T;
+  error: (error: AuthError, accounts: readonly SavedAccount[]) => T;
+}): T {
+  const current = state.current;
+  switch (current.kind) {
+    case "unauthenticated":
+      return handlers.unauthenticated(current.savedAccounts);
+    case "loading":
+      return handlers.loading(current.savedAccounts, current.previousSession);
+    case "authenticated":
+      return handlers.authenticated(current.session, current.savedAccounts);
+    case "error":
+      return handlers.error(current.error, current.savedAccounts);
+    default:
+      return assertNever(current);
+  }
 }
 
-export function _testSetState(
-  newState: {
-    session: Session | null;
-    loading: boolean;
-    error: string | null;
-    savedAccounts?: SavedAccount[];
-  },
-) {
-  state.session = newState.session;
-  state.loading = newState.loading;
-  state.error = newState.error;
-  state.savedAccounts = newState.savedAccounts ?? [];
+export function _testSetState(newState: {
+  session: Session | null;
+  loading: boolean;
+  error: string | null;
+  savedAccounts?: SavedAccount[];
+}): void {
+  const accounts = newState.savedAccounts ?? [];
+  if (newState.loading) {
+    setState(createLoading(accounts, newState.session));
+  } else if (newState.error) {
+    setState(createError({ type: "unknown", message: newState.error }, accounts));
+  } else if (newState.session) {
+    setState(createAuthenticated(newState.session, accounts));
+  } else {
+    setState(createUnauthenticated(accounts));
+  }
 }
 
-export function _testResetState() {
-  state.session = null;
-  state.loading = true;
-  state.error = null;
-  state.savedAccounts = [];
+export function _testResetState(): void {
+  setState(createLoading([]));
 }
 
-export function _testReset() {
+export function _testReset(): void {
   _testResetState();
   localStorage.removeItem(STORAGE_KEY);
   localStorage.removeItem(ACCOUNTS_KEY);
 }
+
+export { type Session };

frontend/src/lib/crypto.ts

···
   const bytes = typeof data === "string"
     ? new TextEncoder().encode(data)
     : data;
-  let binary = "";
-  for (let i = 0; i < bytes.length; i++) {
-    binary += String.fromCharCode(bytes[i]);
-  }
+  const binary = Array.from(bytes, (byte) => String.fromCharCode(byte)).join('')
   return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
 }
 

frontend/src/lib/migration/atproto-client.ts

···
 
 export function base64UrlEncode(buffer: Uint8Array | ArrayBuffer): string {
   const bytes = buffer instanceof ArrayBuffer ? new Uint8Array(buffer) : buffer;
-  let binary = "";
-  for (let i = 0; i < bytes.length; i++) {
-    binary += String.fromCharCode(bytes[i]);
-  }
+  const binary = Array.from(bytes, (byte) => String.fromCharCode(byte)).join('')
   return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(
     /=+$/,
     "",
···
   const base64 = base64url.replace(/-/g, "+").replace(/_/g, "/");
   const padded = base64 + "=".repeat((4 - (base64.length % 4)) % 4);
   const binary = atob(padded);
-  const bytes = new Uint8Array(binary.length);
-  for (let i = 0; i < binary.length; i++) {
-    bytes[i] = binary.charCodeAt(i);
-  }
-  return bytes;
+  return Uint8Array.from(binary, (char) => char.charCodeAt(0));
 }
 
 export function prepareWebAuthnCreationOptions(
···
       );
       if (dnsRes.ok) {
         const dnsData = await dnsRes.json();
-        const txtRecords = dnsData.Answer ?? [];
-        for (const record of txtRecords) {
-          const txt = record.data?.replace(/"/g, "") ?? "";
-          if (txt.startsWith("did=")) {
-            did = txt.slice(4);
-            break;
-          }
+        const txtRecords: Array<{ data?: string }> = dnsData.Answer ?? [];
+        const didRecord = txtRecords
+          .map((record) => record.data?.replace(/"/g, "") ?? "")
+          .find((txt) => txt.startsWith("did="));
+        if (didRecord) {
+          did = didRecord.slice(4);
         }
       }
 

frontend/src/lib/migration/blob-migration.ts

···
       "blobs, cursor:",
       nextCursor,
     );
-    for (const blob of blobs) {
-      missingBlobs.push(blob.cid);
-    }
+    missingBlobs.push(...blobs.map((blob) => blob.cid));
     cursor = nextCursor;
   } while (cursor);
 

frontend/src/lib/oauth.ts

···
 
 function base64UrlEncode(buffer: ArrayBuffer): string {
   const bytes = new Uint8Array(buffer);
-  let binary = "";
-  for (const byte of bytes) {
-    binary += String.fromCharCode(byte);
-  }
+  const binary = Array.from(bytes, (byte) => String.fromCharCode(byte)).join('')
   return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(
     /=+$/,
     "",

frontend/src/lib/registration/VerificationStep.svelte

···
 <script lang="ts">
   import { api, ApiError } from '../api'
+  import { resendVerification } from '../auth.svelte'
   import type { RegistrationFlow } from './flow.svelte'
 
   interface Props {
···
     flow.clearError()
 
     try {
-      const { resendVerification } = await import('../auth.svelte')
       await resendVerification(flow.account.did)
       resendMessage = 'Verification code resent!'
     } catch (err) {

frontend/src/lib/registration/flow.svelte.ts

···
 import { api, ApiError } from "../api";
+import { setSession } from "../auth.svelte";
 import {
   createServiceJwt,
   generateDidDocument,
···
 
   async function finalizeSession() {
     if (!state.session || !state.account) return;
-    const { setSession } = await import("../auth.svelte");
     setSession({
       did: state.account.did,
       handle: state.account.handle,

frontend/src/lib/router.svelte.ts

···
+import {
+  routes,
+  type Route,
+  type RouteParams,
+  type RoutesWithParams,
+  buildUrl,
+  parseRouteParams,
+  isValidRoute,
+} from "./types/routes";
+
 const APP_BASE = "/app";
 
-function getAppPath(): string {
+type Brand<T, B extends string> = T & { readonly __brand: B };
+type AppPath = Brand<string, "AppPath">;
+
+function asAppPath(path: string): AppPath {
+  const normalized = path.startsWith("/") ? path : "/" + path;
+  return normalized as AppPath;
+}
+
+function getAppPath(): AppPath {
   const pathname = globalThis.location.pathname;
   if (pathname.startsWith(APP_BASE)) {
     const path = pathname.slice(APP_BASE.length) || "/";
-    return path.startsWith("/") ? path : "/" + path;
+    return asAppPath(path);
   }
-  return "/";
+  return asAppPath("/");
 }
 
-let currentPath = $state(getAppPath());
+function getSearchParams(): URLSearchParams {
+  return new URLSearchParams(globalThis.location.search);
+}
+
+interface RouterState {
+  readonly path: AppPath;
+  readonly searchParams: URLSearchParams;
+}
 
-globalThis.addEventListener("popstate", () => {
-  currentPath = getAppPath();
+const state = $state<{ current: RouterState }>({
+  current: {
+    path: getAppPath(),
+    searchParams: getSearchParams(),
+  },
 });
 
-export function navigate(path: string, replace = false) {
-  const fullPath = APP_BASE + (path.startsWith("/") ? path : "/" + path);
+function updateState(): void {
+  state.current = {
+    path: getAppPath(),
+    searchParams: getSearchParams(),
+  };
+}
+
+globalThis.addEventListener("popstate", updateState);
+
+export function navigate<R extends Route>(
+  route: R,
+  options?: {
+    params?: R extends RoutesWithParams ? RouteParams[R] : never;
+    replace?: boolean;
+  },
+): void {
+  const url = options?.params ? buildUrl(route, options.params) : route;
+  const fullPath = APP_BASE + (url.startsWith("/") ? url : "/" + url);
+
+  if (options?.replace) {
+    globalThis.history.replaceState(null, "", fullPath);
+  } else {
+    globalThis.history.pushState(null, "", fullPath);
+  }
+
+  updateState();
+}
+
+export function navigateTo(path: string, replace = false): void {
+  const normalizedPath = path.startsWith("/") ? path : "/" + path;
+  const fullPath = APP_BASE + normalizedPath;
+
   if (replace) {
     globalThis.history.replaceState(null, "", fullPath);
   } else {
     globalThis.history.pushState(null, "", fullPath);
   }
-  currentPath = path.startsWith("/") ? path : "/" + path;
+
+  updateState();
 }
 
-export function getCurrentPath() {
-  return currentPath;
+export function getCurrentPath(): AppPath {
+  return state.current.path;
+}
+
+export function getCurrentSearchParams(): URLSearchParams {
+  return state.current.searchParams;
+}
+
+export function getSearchParam(key: string): string | null {
+  return state.current.searchParams.get(key);
 }
 
 export function getFullUrl(path: string): string {
   return APP_BASE + (path.startsWith("/") ? path : "/" + path);
 }
+
+export function matchRoute(path: AppPath): Route | null {
+  const pathWithoutQuery = path.split("?")[0];
+  if (isValidRoute(pathWithoutQuery)) {
+    return pathWithoutQuery;
+  }
+  return null;
+}
+
+export function isCurrentRoute(route: Route): boolean {
+  const pathWithoutQuery = state.current.path.split("?")[0];
+  return pathWithoutQuery === route;
+}
+
+export function getRouteParams<R extends RoutesWithParams>(
+  _route: R,
+): RouteParams[R] {
+  return parseRouteParams(_route);
+}
+
+export type RouteMatch =
+  | { readonly matched: true; readonly route: Route; readonly params: URLSearchParams }
+  | { readonly matched: false };
+
+export function match(): RouteMatch {
+  const route = matchRoute(state.current.path);
+  if (route) {
+    return {
+      matched: true,
+      route,
+      params: state.current.searchParams,
+    };
+  }
+  return { matched: false };
+}
+
+export { routes, type Route, type RouteParams, type RoutesWithParams };

frontend/src/lib/toast.svelte.ts

···
+export type ToastType = 'success' | 'error' | 'warning' | 'info'
+
+export interface Toast {
+  id: number
+  type: ToastType
+  message: string
+  duration: number
+  dismissing?: boolean
+}
+
+let nextId = 0
+let toasts = $state<Toast[]>([])
+
+export function getToasts(): readonly Toast[] {
+  return toasts
+}
+
+export function showToast(
+  type: ToastType,
+  message: string,
+  duration = 5000
+): number {
+  const id = nextId++
+  toasts = [...toasts, { id, type, message, duration }]
+
+  if (duration > 0) {
+    setTimeout(() => {
+      dismissToast(id)
+    }, duration)
+  }
+
+  return id
+}
+
+export function dismissToast(id: number): void {
+  const toast = toasts.find(t => t.id === id)
+  if (!toast || toast.dismissing) return
+
+  toasts = toasts.map(t => t.id === id ? { ...t, dismissing: true } : t)
+
+  setTimeout(() => {
+    toasts = toasts.filter(t => t.id !== id)
+  }, 150)
+}
+
+export function clearAllToasts(): void {
+  toasts = []
+}
+
+export function success(message: string, duration?: number): number {
+  return showToast('success', message, duration)
+}
+
+export function error(message: string, duration?: number): number {
+  return showToast('error', message, duration)
+}
+
+export function warning(message: string, duration?: number): number {
+  return showToast('warning', message, duration)
+}
+
+export function info(message: string, duration?: number): number {
+  return showToast('info', message, duration)
+}
+
+export const toast = {
+  show: showToast,
+  success,
+  error,
+  warning,
+  info,
+  dismiss: dismissToast,
+  clear: clearAllToasts,
+}

frontend/src/lib/types/api.ts

···
+import type {
+  Did,
+  Handle,
+  AccessToken,
+  RefreshToken,
+  Cid,
+  Rkey,
+  AtUri,
+  Nsid,
+  ISODateString,
+  EmailAddress,
+  InviteCode as InviteCodeBrand,
+  PublicKeyMultibase,
+} from './branded'
+
+export type ApiErrorCode =
+  | 'InvalidRequest'
+  | 'AuthenticationRequired'
+  | 'ExpiredToken'
+  | 'InvalidToken'
+  | 'AccountNotFound'
+  | 'HandleNotAvailable'
+  | 'InvalidHandle'
+  | 'InvalidPassword'
+  | 'RateLimitExceeded'
+  | 'InternalServerError'
+  | 'AccountTakedown'
+  | 'AccountDeactivated'
+  | 'AccountNotVerified'
+  | 'RepoNotFound'
+  | 'RecordNotFound'
+  | 'BlobNotFound'
+  | 'InvalidInviteCode'
+  | 'DuplicateCreate'
+  | 'Unknown'
+
+export type AccountStatus = 'active' | 'deactivated' | 'migrated' | 'suspended' | 'deleted'
+
+export type SessionType = 'oauth' | 'legacy' | 'app_password'
+
+export type VerificationChannel = 'email' | 'discord' | 'telegram' | 'signal'
+
+export type DidType = 'plc' | 'web' | 'web-external'
+
+export type ReauthMethod = 'password' | 'totp' | 'passkey'
+
+export interface Session {
+  did: Did
+  handle: Handle
+  email?: EmailAddress
+  emailConfirmed?: boolean
+  preferredChannel?: VerificationChannel
+  preferredChannelVerified?: boolean
+  isAdmin?: boolean
+  active?: boolean
+  status?: AccountStatus
+  migratedToPds?: string
+  migratedAt?: ISODateString
+  accessJwt: AccessToken
+  refreshJwt: RefreshToken
+}
+
+export interface VerificationMethod {
+  id: string
+  type: string
+  controller: string
+  publicKeyMultibase: PublicKeyMultibase
+}
+
+export interface ServiceEndpoint {
+  id: string
+  type: string
+  serviceEndpoint: string
+}
+
+export interface DidDocument {
+  '@context': string[]
+  id: Did
+  alsoKnownAs: string[]
+  verificationMethod: VerificationMethod[]
+  service: ServiceEndpoint[]
+}
+
+export interface AppPassword {
+  name: string
+  createdAt: ISODateString
+  scopes?: string
+  createdByController?: string
+}
+
+export interface CreatedAppPassword {
+  name: string
+  password: string
+  createdAt: ISODateString
+  scopes?: string
+}
+
+export interface InviteCodeUse {
+  usedBy: Did
+  usedByHandle?: Handle
+  usedAt: ISODateString
+}
+
+export interface InviteCodeInfo {
+  code: InviteCodeBrand
+  available: number
+  disabled: boolean
+  forAccount: Did
+  createdBy: Did
+  createdAt: ISODateString
+  uses: InviteCodeUse[]
+}
+
+export interface CreateAccountParams {
+  handle: string
+  email: string
+  password: string
+  inviteCode?: string
+  didType?: DidType
+  did?: string
+  signingKey?: string
+  verificationChannel?: VerificationChannel
+  discordId?: string
+  telegramUsername?: string
+  signalNumber?: string
+}
+
+export interface CreateAccountResult {
+  handle: Handle
+  did: Did
+  verificationRequired: boolean
+  verificationChannel: VerificationChannel
+}
+
+export interface ConfirmSignupResult {
+  accessJwt: AccessToken
+  refreshJwt: RefreshToken
+  handle: Handle
+  did: Did
+  email?: EmailAddress
+  emailConfirmed?: boolean
+  preferredChannel?: VerificationChannel
+  preferredChannelVerified?: boolean
+}
+
+export interface ListAppPasswordsResponse {
+  passwords: AppPassword[]
+}
+
+export interface AccountInviteCodesResponse {
+  codes: InviteCodeInfo[]
+}
+
+export interface CreateInviteCodeResponse {
+  code: InviteCodeBrand
+}
+
+export interface ServerLinks {
+  privacyPolicy?: string
+  termsOfService?: string
+}
+
+export interface ServerDescription {
+  availableUserDomains: string[]
+  inviteCodeRequired: boolean
+  links?: ServerLinks
+  version?: string
+  availableCommsChannels?: VerificationChannel[]
+  selfHostedDidWebEnabled?: boolean
+}
+
+export interface RepoInfo {
+  did: Did
+  head: Cid
+  rev: string
+}
+
+export interface ListReposResponse {
+  repos: RepoInfo[]
+  cursor?: string
+}
+
+export interface NotificationPrefs {
+  preferredChannel: VerificationChannel
+  email: EmailAddress
+  discordId: string | null
+  discordVerified: boolean
+  telegramUsername: string | null
+  telegramVerified: boolean
+  signalNumber: string | null
+  signalVerified: boolean
+}
+
+export interface NotificationHistoryItem {
+  createdAt: ISODateString
+  channel: VerificationChannel
+  notificationType: string
+  status: string
+  subject: string | null
+  body: string
+}
+
+export interface NotificationHistoryResponse {
+  notifications: NotificationHistoryItem[]
+}
+
+export interface ServerStats {
+  userCount: number
+  repoCount: number
+  recordCount: number
+  blobStorageBytes: number
+}
+
+export interface ServerConfig {
+  serverName: string
+  primaryColor: string | null
+  primaryColorDark: string | null
+  secondaryColor: string | null
+  secondaryColorDark: string | null
+  logoCid: Cid | null
+}
+
+export interface BlobRef {
+  $type: 'blob'
+  ref: { $link: Cid }
+  mimeType: string
+  size: number
+}
+
+export interface UploadBlobResponse {
+  blob: BlobRef
+}
+
+export interface SessionInfo {
+  id: string
+  sessionType: SessionType
+  clientName: string | null
+  createdAt: ISODateString
+  expiresAt: ISODateString
+  isCurrent: boolean
+}
+
+export interface ListSessionsResponse {
+  sessions: SessionInfo[]
+}
+
+export interface RevokeAllSessionsResponse {
+  revokedCount: number
+}
+
+export interface AccountSearchResult {
+  did: Did
+  handle: Handle
+  email?: EmailAddress
+  indexedAt: ISODateString
+  emailConfirmedAt?: ISODateString
+  deactivatedAt?: ISODateString
+}
+
+export interface SearchAccountsResponse {
+  cursor?: string
+  accounts: AccountSearchResult[]
+}
+
+export interface AdminInviteCodeUse {
+  usedBy: Did
+  usedAt: ISODateString
+}
+
+export interface AdminInviteCode {
+  code: InviteCodeBrand
+  available: number
+  disabled: boolean
+  forAccount: Did
+  createdBy: Did
+  createdAt: ISODateString
+  uses: AdminInviteCodeUse[]
+}
+
+export interface GetInviteCodesResponse {
+  cursor?: string
+  codes: AdminInviteCode[]
+}
+
+export interface AccountInfo {
+  did: Did
+  handle: Handle
+  email?: EmailAddress
+  indexedAt: ISODateString
+  emailConfirmedAt?: ISODateString
+  invitesDisabled?: boolean
+  deactivatedAt?: ISODateString
+}
+
+export interface RepoDescription {
+  handle: Handle
+  did: Did
+  didDoc: DidDocument
+  collections: Nsid[]
+  handleIsCorrect: boolean
+}
+
+export interface RecordInfo {
+  uri: AtUri
+  cid: Cid
+  value: unknown
+}
+
+export interface ListRecordsResponse {
+  records: RecordInfo[]
+  cursor?: string
+}
+
+export interface RecordResponse {
+  uri: AtUri
+  cid: Cid
+  value: unknown
+}
+
+export interface CreateRecordResponse {
+  uri: AtUri
+  cid: Cid
+}
+
+export interface TotpStatus {
+  enabled: boolean
+  hasBackupCodes: boolean
+}
+
+export interface TotpSecret {
+  uri: string
+  qrBase64: string
+}
+
+export interface EnableTotpResponse {
+  success: boolean
+  backupCodes: string[]
+}
+
+export interface RegenerateBackupCodesResponse {
+  backupCodes: string[]
+}
+
+export interface PasskeyInfo {
+  id: string
+  credentialId: string
+  friendlyName: string | null
+  createdAt: ISODateString
+  lastUsed: ISODateString | null
+}
+
+export interface ListPasskeysResponse {
+  passkeys: PasskeyInfo[]
+}
+
+export interface StartPasskeyRegistrationResponse {
+  options: PublicKeyCredentialCreationOptions
+}
+
+export interface FinishPasskeyRegistrationResponse {
+  id: string
+  credentialId: string
+}
+
+export interface TrustedDevice {
+  id: string
+  userAgent: string | null
+  friendlyName: string | null
+  trustedAt: ISODateString | null
+  trustedUntil: ISODateString | null
+  lastSeenAt: ISODateString
+}
+
+export interface ListTrustedDevicesResponse {
+  devices: TrustedDevice[]
+}
+
+export interface ReauthStatus {
+  requiresReauth: boolean
+  lastReauthAt: ISODateString | null
+  availableMethods: ReauthMethod[]
+}
+
+export interface ReauthResponse {
+  success: boolean
+  reauthAt: ISODateString
+}
+
+export interface ReauthPasskeyStartResponse {
+  options: PublicKeyCredentialRequestOptions
+}
+
+export interface ReserveSigningKeyResponse {
+  signingKey: PublicKeyMultibase
+}
+
+export interface RecommendedDidCredentials {
+  rotationKeys?: PublicKeyMultibase[]
+  alsoKnownAs?: string[]
+  verificationMethods?: { atproto?: PublicKeyMultibase }
+  services?: { atproto_pds?: { type: string; endpoint: string } }
+}
+
+export interface PasskeyAccountCreateResponse {
+  did: Did
+  handle: Handle
+  setupToken: string
+  setupExpiresAt: ISODateString
+}
+
+export interface CompletePasskeySetupResponse {
+  did: Did
+  handle: Handle
+  appPassword: string
+  appPasswordName: string
+}
+
+export interface VerifyTokenResponse {
+  success: boolean
+  did: Did
+  purpose: string
+  channel: VerificationChannel
+}
+
+export interface BackupInfo {
+  id: string
+  repoRev: string
+  repoRootCid: Cid
+  blockCount: number
+  sizeBytes: number
+  createdAt: ISODateString
+}
+
+export interface ListBackupsResponse {
+  backups: BackupInfo[]
+  backupEnabled: boolean
+}
+
+export interface CreateBackupResponse {
+  id: string
+  repoRev: string
+  sizeBytes: number
+  blockCount: number
+}
+
+export interface SetBackupEnabledResponse {
+  enabled: boolean
+}
+
+export interface EmailUpdateResponse {
+  tokenRequired: boolean
+}
+
+export interface LegacyLoginPreference {
+  allowLegacyLogin: boolean
+  hasMfa: boolean
+}
+
+export interface UpdateLegacyLoginResponse {
+  allowLegacyLogin: boolean
+}
+
+export interface UpdateLocaleResponse {
+  preferredLocale: string
+}
+
+export interface PasswordStatus {
+  hasPassword: boolean
+}
+
+export interface SuccessResponse {
+  success: boolean
+}
+
+export interface CheckEmailVerifiedResponse {
+  verified: boolean
+}
+
+export interface VerifyMigrationEmailResponse {
+  success: boolean
+  did: Did
+}
+
+export interface ResendMigrationVerificationResponse {
+  sent: boolean
+}

frontend/src/lib/types/branded.ts

···
+declare const __brand: unique symbol
+
+type Brand<T, B extends string> = T & { readonly [__brand]: B }
+
+export type Did = Brand<string, 'Did'>
+export type DidPlc = Brand<Did, 'DidPlc'>
+export type DidWeb = Brand<Did, 'DidWeb'>
+
+export type Handle = Brand<string, 'Handle'>
+export type AccessToken = Brand<string, 'AccessToken'>
+export type RefreshToken = Brand<string, 'RefreshToken'>
+export type ServiceToken = Brand<string, 'ServiceToken'>
+export type SetupToken = Brand<string, 'SetupToken'>
+
+export type Cid = Brand<string, 'Cid'>
+export type Rkey = Brand<string, 'Rkey'>
+export type AtUri = Brand<string, 'AtUri'>
+export type Nsid = Brand<string, 'Nsid'>
+
+export type ISODateString = Brand<string, 'ISODateString'>
+export type EmailAddress = Brand<string, 'EmailAddress'>
+export type InviteCode = Brand<string, 'InviteCode'>
+
+export type PublicKeyMultibase = Brand<string, 'PublicKeyMultibase'>
+export type DidKeyString = Brand<string, 'DidKeyString'>
+
+const DID_PLC_REGEX = /^did:plc:[a-z2-7]{24}$/
+const DID_WEB_REGEX = /^did:web:.+$/
+const HANDLE_REGEX = /^([a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?$/
+const AT_URI_REGEX = /^at:\/\/[^/]+\/[^/]+\/[^/]+$/
+const CID_REGEX = /^[a-z2-7]{59}$|^baf[a-z2-7]+$/
+const NSID_REGEX = /^[a-z]([a-z0-9-]*[a-z0-9])?(\.[a-z]([a-z0-9-]*[a-z0-9])?)+$/
+const EMAIL_REGEX = /^[^\s@]+@[^\s@]+\.[^\s@]+$/
+const ISO_DATE_REGEX = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?(Z|[+-]\d{2}:\d{2})$/
+
+export function isDid(s: string): s is Did {
+  return s.startsWith('did:plc:') || s.startsWith('did:web:')
+}
+
+export function isDidPlc(s: string): s is DidPlc {
+  return DID_PLC_REGEX.test(s)
+}
+
+export function isDidWeb(s: string): s is DidWeb {
+  return DID_WEB_REGEX.test(s)
+}
+
+export function isHandle(s: string): s is Handle {
+  return HANDLE_REGEX.test(s) && s.length <= 253
+}
+
+export function isAtUri(s: string): s is AtUri {
+  return AT_URI_REGEX.test(s)
+}
+
+export function isCid(s: string): s is Cid {
+  return CID_REGEX.test(s)
+}
+
+export function isNsid(s: string): s is Nsid {
+  return NSID_REGEX.test(s)
+}
+
+export function isEmail(s: string): s is EmailAddress {
+  return EMAIL_REGEX.test(s)
+}
+
+export function isISODate(s: string): s is ISODateString {
+  return ISO_DATE_REGEX.test(s)
+}
+
+export function asDid(s: string): Did {
+  if (!isDid(s)) throw new TypeError(`Invalid DID: ${s}`)
+  return s
+}
+
+export function asDidPlc(s: string): DidPlc {
+  if (!isDidPlc(s)) throw new TypeError(`Invalid DID:PLC: ${s}`)
+  return s as DidPlc
+}
+
+export function asDidWeb(s: string): DidWeb {
+  if (!isDidWeb(s)) throw new TypeError(`Invalid DID:WEB: ${s}`)
+  return s as DidWeb
+}
+
+export function asHandle(s: string): Handle {
+  if (!isHandle(s)) throw new TypeError(`Invalid handle: ${s}`)
+  return s
+}
+
+export function asAtUri(s: string): AtUri {
+  if (!isAtUri(s)) throw new TypeError(`Invalid AT-URI: ${s}`)
+  return s
+}
+
+export function asCid(s: string): Cid {
+  if (!isCid(s)) throw new TypeError(`Invalid CID: ${s}`)
+  return s
+}
+
+export function asNsid(s: string): Nsid {
+  if (!isNsid(s)) throw new TypeError(`Invalid NSID: ${s}`)
+  return s
+}
+
+export function asEmail(s: string): EmailAddress {
+  if (!isEmail(s)) throw new TypeError(`Invalid email: ${s}`)
+  return s
+}
+
+export function asISODate(s: string): ISODateString {
+  if (!isISODate(s)) throw new TypeError(`Invalid ISO date: ${s}`)
+  return s
+}
+
+export function unsafeAsDid(s: string): Did {
+  return s as Did
+}
+
+export function unsafeAsHandle(s: string): Handle {
+  return s as Handle
+}
+
+export function unsafeAsAccessToken(s: string): AccessToken {
+  return s as AccessToken
+}
+
+export function unsafeAsRefreshToken(s: string): RefreshToken {
+  return s as RefreshToken
+}
+
+export function unsafeAsServiceToken(s: string): ServiceToken {
+  return s as ServiceToken
+}
+
+export function unsafeAsSetupToken(s: string): SetupToken {
+  return s as SetupToken
+}
+
+export function unsafeAsCid(s: string): Cid {
+  return s as Cid
+}
+
+export function unsafeAsRkey(s: string): Rkey {
+  return s as Rkey
+}
+
+export function unsafeAsAtUri(s: string): AtUri {
+  return s as AtUri
+}
+
+export function unsafeAsNsid(s: string): Nsid {
+  return s as Nsid
+}
+
+export function unsafeAsISODate(s: string): ISODateString {
+  return s as ISODateString
+}
+
+export function unsafeAsEmail(s: string): EmailAddress {
+  return s as EmailAddress
+}
+
+export function unsafeAsInviteCode(s: string): InviteCode {
+  return s as InviteCode
+}
+
+export function unsafeAsPublicKeyMultibase(s: string): PublicKeyMultibase {
+  return s as PublicKeyMultibase
+}
+
+export function unsafeAsDidKey(s: string): DidKeyString {
+  return s as DidKeyString
+}
+
+export function parseAtUri(uri: AtUri): { repo: Did; collection: Nsid; rkey: Rkey } {
+  const parts = uri.replace('at://', '').split('/')
+  return {
+    repo: unsafeAsDid(parts[0]),
+    collection: unsafeAsNsid(parts[1]),
+    rkey: unsafeAsRkey(parts[2]),
+  }
+}
+
+export function makeAtUri(repo: Did, collection: Nsid, rkey: Rkey): AtUri {
+  return `at://${repo}/${collection}/${rkey}` as AtUri
+}

frontend/src/lib/types/exhaustive.ts

···
+export function assertNever(x: never, message?: string): never {
+  throw new Error(message ?? `Unexpected value: ${JSON.stringify(x)}`)
+}
+
+export function exhaustive<T extends string | number | symbol>(
+  value: T,
+  handlers: Record<T, () => void>
+): void {
+  const handler = handlers[value]
+  if (handler) {
+    handler()
+  } else {
+    assertNever(value as never, `Unhandled case: ${String(value)}`)
+  }
+}
+
+export function exhaustiveMap<T extends string | number | symbol, R>(
+  value: T,
+  handlers: Record<T, () => R>
+): R {
+  const handler = handlers[value]
+  if (handler) {
+    return handler()
+  }
+  return assertNever(value as never, `Unhandled case: ${String(value)}`)
+}
+
+export async function exhaustiveAsync<T extends string | number | symbol>(
+  value: T,
+  handlers: Record<T, () => Promise<void>>
+): Promise<void> {
+  const handler = handlers[value]
+  if (handler) {
+    await handler()
+  } else {
+    assertNever(value as never, `Unhandled case: ${String(value)}`)
+  }
+}
+
+export async function exhaustiveMapAsync<T extends string | number | symbol, R>(
+  value: T,
+  handlers: Record<T, () => Promise<R>>
+): Promise<R> {
+  const handler = handlers[value]
+  if (handler) {
+    return handler()
+  }
+  return assertNever(value as never, `Unhandled case: ${String(value)}`)
+}

frontend/src/lib/types/index.ts

···
+export * from './result'
+export * from './branded'
+export * from './exhaustive'
+export * from './api'
+export * from './routes'

frontend/src/lib/types/result.ts

···
+export type Result<T, E = Error> =
+  | { ok: true; value: T }
+  | { ok: false; error: E }
+
+export function ok<T>(value: T): Result<T, never> {
+  return { ok: true, value }
+}
+
+export function err<E>(error: E): Result<never, E> {
+  return { ok: false, error }
+}
+
+export function isOk<T, E>(result: Result<T, E>): result is { ok: true; value: T } {
+  return result.ok
+}
+
+export function isErr<T, E>(result: Result<T, E>): result is { ok: false; error: E } {
+  return !result.ok
+}
+
+export function map<T, U, E>(result: Result<T, E>, fn: (t: T) => U): Result<U, E> {
+  return result.ok ? ok(fn(result.value)) : result
+}
+
+export function mapErr<T, E, F>(result: Result<T, E>, fn: (e: E) => F): Result<T, F> {
+  return result.ok ? result : err(fn(result.error))
+}
+
+export function flatMap<T, U, E>(result: Result<T, E>, fn: (t: T) => Result<U, E>): Result<U, E> {
+  return result.ok ? fn(result.value) : result
+}
+
+export function unwrap<T, E>(result: Result<T, E>): T {
+  if (result.ok) return result.value
+  throw result.error instanceof Error ? result.error : new Error(String(result.error))
+}
+
+export function unwrapOr<T, E>(result: Result<T, E>, defaultValue: T): T {
+  return result.ok ? result.value : defaultValue
+}
+
+export function unwrapOrElse<T, E>(result: Result<T, E>, fn: (e: E) => T): T {
+  return result.ok ? result.value : fn(result.error)
+}
+
+export function match<T, E, U>(
+  result: Result<T, E>,
+  handlers: { ok: (t: T) => U; err: (e: E) => U }
+): U {
+  return result.ok ? handlers.ok(result.value) : handlers.err(result.error)
+}
+
+export async function tryAsync<T>(fn: () => Promise<T>): Promise<Result<T, Error>> {
+  try {
+    return ok(await fn())
+  } catch (e) {
+    return err(e instanceof Error ? e : new Error(String(e)))
+  }
+}
+
+export async function tryAsyncWith<T, E>(
+  fn: () => Promise<T>,
+  mapError: (e: unknown) => E
+): Promise<Result<T, E>> {
+  try {
+    return ok(await fn())
+  } catch (e) {
+    return err(mapError(e))
+  }
+}
+
+export function fromNullable<T>(value: T | null | undefined): Result<T, null> {
+  return value != null ? ok(value) : err(null)
+}
+
+export function toNullable<T, E>(result: Result<T, E>): T | null {
+  return result.ok ? result.value : null
+}
+
+export function collect<T, E>(results: Result<T, E>[]): Result<T[], E> {
+  const values: T[] = []
+  for (const result of results) {
+    if (!result.ok) return result
+    values.push(result.value)
+  }
+  return ok(values)
+}
+
+export async function collectAsync<T, E>(
+  results: Promise<Result<T, E>>[]
+): Promise<Result<T[], E>> {
+  const settled = await Promise.all(results)
+  return collect(settled)
+}

frontend/src/lib/types/routes.ts

···
+export const routes = {
+  login: '/login',
+  register: '/register',
+  registerPasskey: '/register-passkey',
+  dashboard: '/dashboard',
+  settings: '/settings',
+  security: '/security',
+  sessions: '/sessions',
+  appPasswords: '/app-passwords',
+  trustedDevices: '/trusted-devices',
+  inviteCodes: '/invite-codes',
+  comms: '/comms',
+  repo: '/repo',
+  controllers: '/controllers',
+  delegationAudit: '/delegation-audit',
+  actAs: '/act-as',
+  didDocument: '/did-document',
+  migrate: '/migrate',
+  admin: '/admin',
+  verify: '/verify',
+  resetPassword: '/reset-password',
+  recoverPasskey: '/recover-passkey',
+  requestPasskeyRecovery: '/request-passkey-recovery',
+  oauthLogin: '/oauth/login',
+  oauthConsent: '/oauth/consent',
+  oauthAccounts: '/oauth/accounts',
+  oauth2fa: '/oauth/2fa',
+  oauthTotp: '/oauth/totp',
+  oauthPasskey: '/oauth/passkey',
+  oauthDelegation: '/oauth/delegation',
+  oauthError: '/oauth/error',
+} as const
+
+export type Route = (typeof routes)[keyof typeof routes]
+
+export type RouteKey = keyof typeof routes
+
+export function isValidRoute(path: string): path is Route {
+  return Object.values(routes).includes(path as Route)
+}
+
+export interface RouteParams {
+  [routes.verify]: { token?: string; email?: string }
+  [routes.resetPassword]: { token?: string }
+  [routes.recoverPasskey]: { token?: string; did?: string }
+  [routes.oauthLogin]: { request_uri?: string; error?: string }
+  [routes.oauthConsent]: { request_uri?: string; client_id?: string }
+  [routes.oauthAccounts]: { request_uri?: string }
+  [routes.oauth2fa]: { request_uri?: string; channel?: string }
+  [routes.oauthTotp]: { request_uri?: string }
+  [routes.oauthPasskey]: { request_uri?: string }
+  [routes.oauthDelegation]: { request_uri?: string; delegated_did?: string }
+  [routes.oauthError]: { error?: string; error_description?: string }
+  [routes.migrate]: { code?: string; state?: string }
+}
+
+export type RoutesWithParams = keyof RouteParams
+
+export function buildUrl<R extends Route>(
+  route: R,
+  params?: R extends RoutesWithParams ? RouteParams[R] : never
+): string {
+  if (!params) return route
+  const searchParams = new URLSearchParams()
+  for (const [key, value] of Object.entries(params)) {
+    if (value != null) {
+      searchParams.set(key, String(value))
+    }
+  }
+  const queryString = searchParams.toString()
+  return queryString ? `${route}?${queryString}` : route
+}
+
+export function parseRouteParams<R extends RoutesWithParams>(
+  route: R
+): RouteParams[R] {
+  const params = new URLSearchParams(globalThis.location.search)
+  const result: Record<string, string> = {}
+  for (const [key, value] of params.entries()) {
+    result[key] = value
+  }
+  return result as RouteParams[R]
+}

frontend/src/lib/types/schemas.ts

···
+import { z } from 'zod'
+import type {
+  Did,
+  Handle,
+  AccessToken,
+  RefreshToken,
+  Cid,
+  Nsid,
+  AtUri,
+  Rkey,
+  ISODateString,
+  EmailAddress,
+  InviteCode,
+  PublicKeyMultibase,
+} from './branded'
+import {
+  unsafeAsDid,
+  unsafeAsHandle,
+  unsafeAsAccessToken,
+  unsafeAsRefreshToken,
+  unsafeAsCid,
+  unsafeAsNsid,
+  unsafeAsAtUri,
+  unsafeAsRkey,
+  unsafeAsISODate,
+  unsafeAsEmail,
+  unsafeAsInviteCode,
+  unsafeAsPublicKeyMultibase,
+} from './branded'
+
+const did = z.string().transform((s) => unsafeAsDid(s))
+const handle = z.string().transform((s) => unsafeAsHandle(s))
+const accessToken = z.string().transform((s) => unsafeAsAccessToken(s))
+const refreshToken = z.string().transform((s) => unsafeAsRefreshToken(s))
+const cid = z.string().transform((s) => unsafeAsCid(s))
+const nsid = z.string().transform((s) => unsafeAsNsid(s))
+const atUri = z.string().transform((s) => unsafeAsAtUri(s))
+const rkey = z.string().transform((s) => unsafeAsRkey(s))
+const isoDate = z.string().transform((s) => unsafeAsISODate(s))
+const email = z.string().transform((s) => unsafeAsEmail(s))
+const inviteCode = z.string().transform((s) => unsafeAsInviteCode(s))
+const publicKeyMultibase = z.string().transform((s) => unsafeAsPublicKeyMultibase(s))
+
+export const verificationChannel = z.enum(['email', 'discord', 'telegram', 'signal'])
+export const didType = z.enum(['plc', 'web', 'web-external'])
+export const accountStatus = z.enum(['active', 'deactivated', 'migrated', 'suspended', 'deleted'])
+export const sessionType = z.enum(['oauth', 'legacy', 'app_password'])
+export const reauthMethod = z.enum(['password', 'totp', 'passkey'])
+
+export const sessionSchema = z.object({
+  did: did,
+  handle: handle,
+  email: email.optional(),
+  emailConfirmed: z.boolean().optional(),
+  preferredChannel: verificationChannel.optional(),
+  preferredChannelVerified: z.boolean().optional(),
+  isAdmin: z.boolean().optional(),
+  active: z.boolean().optional(),
+  status: accountStatus.optional(),
+  migratedToPds: z.string().optional(),
+  migratedAt: isoDate.optional(),
+  accessJwt: accessToken,
+  refreshJwt: refreshToken,
+})
+
+export const serverLinksSchema = z.object({
+  privacyPolicy: z.string().optional(),
+  termsOfService: z.string().optional(),
+})
+
+export const serverDescriptionSchema = z.object({
+  availableUserDomains: z.array(z.string()),
+  inviteCodeRequired: z.boolean(),
+  links: serverLinksSchema.optional(),
+  version: z.string().optional(),
+  availableCommsChannels: z.array(verificationChannel).optional(),
+  selfHostedDidWebEnabled: z.boolean().optional(),
+})
+
+export const appPasswordSchema = z.object({
+  name: z.string(),
+  createdAt: isoDate,
+  scopes: z.string().optional(),
+  createdByController: z.string().optional(),
+})
+
+export const createdAppPasswordSchema = z.object({
+  name: z.string(),
+  password: z.string(),
+  createdAt: isoDate,
+  scopes: z.string().optional(),
+})
+
+export const inviteCodeUseSchema = z.object({
+  usedBy: did,
+  usedByHandle: handle.optional(),
+  usedAt: isoDate,
+})
+
+export const inviteCodeInfoSchema = z.object({
+  code: inviteCode,
+  available: z.number(),
+  disabled: z.boolean(),
+  forAccount: did,
+  createdBy: did,
+  createdAt: isoDate,
+  uses: z.array(inviteCodeUseSchema),
+})
+
+export const sessionInfoSchema = z.object({
+  id: z.string(),
+  sessionType: sessionType,
+  clientName: z.string().nullable(),
+  createdAt: isoDate,
+  expiresAt: isoDate,
+  isCurrent: z.boolean(),
+})
+
+export const listSessionsResponseSchema = z.object({
+  sessions: z.array(sessionInfoSchema),
+})
+
+export const totpStatusSchema = z.object({
+  enabled: z.boolean(),
+  hasBackupCodes: z.boolean(),
+})
+
+export const totpSecretSchema = z.object({
+  uri: z.string(),
+  qrBase64: z.string(),
+})
+
+export const enableTotpResponseSchema = z.object({
+  success: z.boolean(),
+  backupCodes: z.array(z.string()),
+})
+
+export const passkeyInfoSchema = z.object({
+  id: z.string(),
+  credentialId: z.string(),
+  friendlyName: z.string().nullable(),
+  createdAt: isoDate,
+  lastUsed: isoDate.nullable(),
+})
+
+export const listPasskeysResponseSchema = z.object({
+  passkeys: z.array(passkeyInfoSchema),
+})
+
+export const trustedDeviceSchema = z.object({
+  id: z.string(),
+  userAgent: z.string().nullable(),
+  friendlyName: z.string().nullable(),
+  trustedAt: isoDate.nullable(),
+  trustedUntil: isoDate.nullable(),
+  lastSeenAt: isoDate,
+})
+
+export const listTrustedDevicesResponseSchema = z.object({
+  devices: z.array(trustedDeviceSchema),
+})
+
+export const reauthStatusSchema = z.object({
+  requiresReauth: z.boolean(),
+  lastReauthAt: isoDate.nullable(),
+  availableMethods: z.array(reauthMethod),
+})
+
+export const reauthResponseSchema = z.object({
+  success: z.boolean(),
+  reauthAt: isoDate,
+})
+
+export const notificationPrefsSchema = z.object({
+  preferredChannel: verificationChannel,
+  email: email,
+  discordId: z.string().nullable(),
+  discordVerified: z.boolean(),
+  telegramUsername: z.string().nullable(),
+  telegramVerified: z.boolean(),
+  signalNumber: z.string().nullable(),
+  signalVerified: z.boolean(),
+})
+
+export const verificationMethodSchema = z.object({
+  id: z.string(),
+  type: z.string(),
+  controller: z.string(),
+  publicKeyMultibase: publicKeyMultibase,
+})
+
+export const serviceEndpointSchema = z.object({
+  id: z.string(),
+  type: z.string(),
+  serviceEndpoint: z.string(),
+})
+
+export const didDocumentSchema = z.object({
+  '@context': z.array(z.string()),
+  id: did,
+  alsoKnownAs: z.array(z.string()),
+  verificationMethod: z.array(verificationMethodSchema),
+  service: z.array(serviceEndpointSchema),
+})
+
+export const repoDescriptionSchema = z.object({
+  handle: handle,
+  did: did,
+  didDoc: didDocumentSchema,
+  collections: z.array(nsid),
+  handleIsCorrect: z.boolean(),
+})
+
+export const recordInfoSchema = z.object({
+  uri: atUri,
+  cid: cid,
+  value: z.unknown(),
+})
+
+export const listRecordsResponseSchema = z.object({
+  records: z.array(recordInfoSchema),
+  cursor: z.string().optional(),
+})
+
+export const recordResponseSchema = z.object({
+  uri: atUri,
+  cid: cid,
+  value: z.unknown(),
+})
+
+export const createRecordResponseSchema = z.object({
+  uri: atUri,
+  cid: cid,
+})
+
+export const serverStatsSchema = z.object({
+  userCount: z.number(),
+  repoCount: z.number(),
+  recordCount: z.number(),
+  blobStorageBytes: z.number(),
+})
+
+export const serverConfigSchema = z.object({
+  serverName: z.string(),
+  primaryColor: z.string().nullable(),
+  primaryColorDark: z.string().nullable(),
+  secondaryColor: z.string().nullable(),
+  secondaryColorDark: z.string().nullable(),
+  logoCid: cid.nullable(),
+})
+
+export const passwordStatusSchema = z.object({
+  hasPassword: z.boolean(),
+})
+
+export const successResponseSchema = z.object({
+  success: z.boolean(),
+})
+
+export const legacyLoginPreferenceSchema = z.object({
+  allowLegacyLogin: z.boolean(),
+  hasMfa: z.boolean(),
+})
+
+export const accountInfoSchema = z.object({
+  did: did,
+  handle: handle,
+  email: email.optional(),
+  indexedAt: isoDate,
+  emailConfirmedAt: isoDate.optional(),
+  invitesDisabled: z.boolean().optional(),
+  deactivatedAt: isoDate.optional(),
+})
+
+export const searchAccountsResponseSchema = z.object({
+  cursor: z.string().optional(),
+  accounts: z.array(accountInfoSchema),
+})
+
+export const backupInfoSchema = z.object({
+  id: z.string(),
+  repoRev: z.string(),
+  repoRootCid: cid,
+  blockCount: z.number(),
+  sizeBytes: z.number(),
+  createdAt: isoDate,
+})
+
+export const listBackupsResponseSchema = z.object({
+  backups: z.array(backupInfoSchema),
+  backupEnabled: z.boolean(),
+})
+
+export const createBackupResponseSchema = z.object({
+  id: z.string(),
+  repoRev: z.string(),
+  sizeBytes: z.number(),
+  blockCount: z.number(),
+})
+
+export type ValidatedSession = z.infer<typeof sessionSchema>
+export type ValidatedServerDescription = z.infer<typeof serverDescriptionSchema>
+export type ValidatedAppPassword = z.infer<typeof appPasswordSchema>
+export type ValidatedCreatedAppPassword = z.infer<typeof createdAppPasswordSchema>
+export type ValidatedInviteCodeInfo = z.infer<typeof inviteCodeInfoSchema>
+export type ValidatedSessionInfo = z.infer<typeof sessionInfoSchema>
+export type ValidatedListSessionsResponse = z.infer<typeof listSessionsResponseSchema>
+export type ValidatedTotpStatus = z.infer<typeof totpStatusSchema>
+export type ValidatedTotpSecret = z.infer<typeof totpSecretSchema>
+export type ValidatedEnableTotpResponse = z.infer<typeof enableTotpResponseSchema>
+export type ValidatedPasskeyInfo = z.infer<typeof passkeyInfoSchema>
+export type ValidatedListPasskeysResponse = z.infer<typeof listPasskeysResponseSchema>
+export type ValidatedTrustedDevice = z.infer<typeof trustedDeviceSchema>
+export type ValidatedListTrustedDevicesResponse = z.infer<typeof listTrustedDevicesResponseSchema>
+export type ValidatedReauthStatus = z.infer<typeof reauthStatusSchema>
+export type ValidatedReauthResponse = z.infer<typeof reauthResponseSchema>
+export type ValidatedNotificationPrefs = z.infer<typeof notificationPrefsSchema>
+export type ValidatedDidDocument = z.infer<typeof didDocumentSchema>
+export type ValidatedRepoDescription = z.infer<typeof repoDescriptionSchema>
+export type ValidatedListRecordsResponse = z.infer<typeof listRecordsResponseSchema>
+export type ValidatedRecordResponse = z.infer<typeof recordResponseSchema>
+export type ValidatedCreateRecordResponse = z.infer<typeof createRecordResponseSchema>
+export type ValidatedServerStats = z.infer<typeof serverStatsSchema>
+export type ValidatedServerConfig = z.infer<typeof serverConfigSchema>
+export type ValidatedPasswordStatus = z.infer<typeof passwordStatusSchema>
+export type ValidatedSuccessResponse = z.infer<typeof successResponseSchema>
+export type ValidatedLegacyLoginPreference = z.infer<typeof legacyLoginPreferenceSchema>
+export type ValidatedAccountInfo = z.infer<typeof accountInfoSchema>
+export type ValidatedSearchAccountsResponse = z.infer<typeof searchAccountsResponseSchema>
+export type ValidatedBackupInfo = z.infer<typeof backupInfoSchema>
+export type ValidatedListBackupsResponse = z.infer<typeof listBackupsResponseSchema>
+export type ValidatedCreateBackupResponse = z.infer<typeof createBackupResponseSchema>

frontend/src/lib/utils/array.ts

···
+import type { Option } from './option'
+
+export function first<T>(arr: readonly T[]): Option<T> {
+  return arr[0] ?? null
+}
+
+export function last<T>(arr: readonly T[]): Option<T> {
+  return arr[arr.length - 1] ?? null
+}
+
+export function at<T>(arr: readonly T[], index: number): Option<T> {
+  if (index < 0) index = arr.length + index
+  return arr[index] ?? null
+}
+
+export function find<T>(arr: readonly T[], predicate: (t: T) => boolean): Option<T> {
+  return arr.find(predicate) ?? null
+}
+
+export function findMap<T, U>(arr: readonly T[], fn: (t: T) => Option<U>): Option<U> {
+  for (const item of arr) {
+    const result = fn(item)
+    if (result != null) return result
+  }
+  return null
+}
+
+export function findIndex<T>(arr: readonly T[], predicate: (t: T) => boolean): Option<number> {
+  const index = arr.findIndex(predicate)
+  return index >= 0 ? index : null
+}
+
+export function partition<T>(
+  arr: readonly T[],
+  predicate: (t: T) => boolean
+): [T[], T[]] {
+  const pass: T[] = []
+  const fail: T[] = []
+  for (const item of arr) {
+    if (predicate(item)) {
+      pass.push(item)
+    } else {
+      fail.push(item)
+    }
+  }
+  return [pass, fail]
+}
+
+export function groupBy<T, K extends string | number>(
+  arr: readonly T[],
+  keyFn: (t: T) => K
+): Record<K, T[]> {
+  const result = {} as Record<K, T[]>
+  for (const item of arr) {
+    const key = keyFn(item)
+    if (!result[key]) {
+      result[key] = []
+    }
+    result[key].push(item)
+  }
+  return result
+}
+
+export function unique<T>(arr: readonly T[]): T[] {
+  return [...new Set(arr)]
+}
+
+export function uniqueBy<T, K>(arr: readonly T[], keyFn: (t: T) => K): T[] {
+  const seen = new Set<K>()
+  const result: T[] = []
+  for (const item of arr) {
+    const key = keyFn(item)
+    if (!seen.has(key)) {
+      seen.add(key)
+      result.push(item)
+    }
+  }
+  return result
+}
+
+export function sortBy<T>(arr: readonly T[], keyFn: (t: T) => number | string): T[] {
+  return [...arr].sort((a, b) => {
+    const ka = keyFn(a)
+    const kb = keyFn(b)
+    if (ka < kb) return -1
+    if (ka > kb) return 1
+    return 0
+  })
+}
+
+export function sortByDesc<T>(arr: readonly T[], keyFn: (t: T) => number | string): T[] {
+  return [...arr].sort((a, b) => {
+    const ka = keyFn(a)
+    const kb = keyFn(b)
+    if (ka > kb) return -1
+    if (ka < kb) return 1
+    return 0
+  })
+}
+
+export function chunk<T>(arr: readonly T[], size: number): T[][] {
+  const result: T[][] = []
+  for (let i = 0; i < arr.length; i += size) {
+    result.push(arr.slice(i, i + size))
+  }
+  return result
+}
+
+export function zip<T, U>(a: readonly T[], b: readonly U[]): [T, U][] {
+  const length = Math.min(a.length, b.length)
+  const result: [T, U][] = []
+  for (let i = 0; i < length; i++) {
+    result.push([a[i], b[i]])
+  }
+  return result
+}
+
+export function zipWith<T, U, R>(
+  a: readonly T[],
+  b: readonly U[],
+  fn: (t: T, u: U) => R
+): R[] {
+  const length = Math.min(a.length, b.length)
+  const result: R[] = []
+  for (let i = 0; i < length; i++) {
+    result.push(fn(a[i], b[i]))
+  }
+  return result
+}
+
+export function intersperse<T>(arr: readonly T[], separator: T): T[] {
+  if (arr.length <= 1) return [...arr]
+  const result: T[] = [arr[0]]
+  for (let i = 1; i < arr.length; i++) {
+    result.push(separator, arr[i])
+  }
+  return result
+}
+
+export function range(start: number, end: number): number[] {
+  const result: number[] = []
+  for (let i = start; i < end; i++) {
+    result.push(i)
+  }
+  return result
+}
+
+export function isEmpty<T>(arr: readonly T[]): boolean {
+  return arr.length === 0
+}
+
+export function isNonEmpty<T>(arr: readonly T[]): arr is [T, ...T[]] {
+  return arr.length > 0
+}
+
+export function sum(arr: readonly number[]): number {
+  return arr.reduce((acc, n) => acc + n, 0)
+}
+
+export function sumBy<T>(arr: readonly T[], fn: (t: T) => number): number {
+  return arr.reduce((acc, t) => acc + fn(t), 0)
+}
+
+export function maxBy<T>(arr: readonly T[], fn: (t: T) => number): Option<T> {
+  if (arr.length === 0) return null
+  let max = arr[0]
+  let maxValue = fn(max)
+  for (let i = 1; i < arr.length; i++) {
+    const value = fn(arr[i])
+    if (value > maxValue) {
+      max = arr[i]
+      maxValue = value
+    }
+  }
+  return max
+}
+
+export function minBy<T>(arr: readonly T[], fn: (t: T) => number): Option<T> {
+  if (arr.length === 0) return null
+  let min = arr[0]
+  let minValue = fn(min)
+  for (let i = 1; i < arr.length; i++) {
+    const value = fn(arr[i])
+    if (value < minValue) {
+      min = arr[i]
+      minValue = value
+    }
+  }
+  return min
+}

frontend/src/lib/utils/async.ts

···
+import { ok, err, type Result } from '../types/result'
+
+export function debounce<T extends (...args: Parameters<T>) => void>(
+  fn: T,
+  ms: number
+): T & { cancel: () => void } {
+  let timeoutId: ReturnType<typeof setTimeout> | null = null
+
+  const debounced = ((...args: Parameters<T>) => {
+    if (timeoutId) clearTimeout(timeoutId)
+    timeoutId = setTimeout(() => {
+      fn(...args)
+      timeoutId = null
+    }, ms)
+  }) as T & { cancel: () => void }
+
+  debounced.cancel = () => {
+    if (timeoutId) {
+      clearTimeout(timeoutId)
+      timeoutId = null
+    }
+  }
+
+  return debounced
+}
+
+export function throttle<T extends (...args: Parameters<T>) => void>(
+  fn: T,
+  ms: number
+): T {
+  let lastCall = 0
+  let timeoutId: ReturnType<typeof setTimeout> | null = null
+
+  return ((...args: Parameters<T>) => {
+    const now = Date.now()
+    const remaining = ms - (now - lastCall)
+
+    if (remaining <= 0) {
+      if (timeoutId) {
+        clearTimeout(timeoutId)
+        timeoutId = null
+      }
+      lastCall = now
+      fn(...args)
+    } else if (!timeoutId) {
+      timeoutId = setTimeout(() => {
+        lastCall = Date.now()
+        timeoutId = null
+        fn(...args)
+      }, remaining)
+    }
+  }) as T
+}
+
+export function sleep(ms: number): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, ms))
+}
+
+export async function retry<T>(
+  fn: () => Promise<T>,
+  options: {
+    attempts?: number
+    delay?: number
+    backoff?: number
+    shouldRetry?: (error: unknown, attempt: number) => boolean
+  } = {}
+): Promise<T> {
+  const {
+    attempts = 3,
+    delay = 1000,
+    backoff = 2,
+    shouldRetry = () => true,
+  } = options
+
+  let lastError: unknown
+  let currentDelay = delay
+
+  for (let attempt = 1; attempt <= attempts; attempt++) {
+    try {
+      return await fn()
+    } catch (error) {
+      lastError = error
+      if (attempt === attempts || !shouldRetry(error, attempt)) {
+        throw error
+      }
+      await sleep(currentDelay)
+      currentDelay *= backoff
+    }
+  }
+
+  throw lastError
+}
+
+export async function retryResult<T, E>(
+  fn: () => Promise<Result<T, E>>,
+  options: {
+    attempts?: number
+    delay?: number
+    backoff?: number
+    shouldRetry?: (error: E, attempt: number) => boolean
+  } = {}
+): Promise<Result<T, E>> {
+  const {
+    attempts = 3,
+    delay = 1000,
+    backoff = 2,
+    shouldRetry = () => true,
+  } = options
+
+  let lastResult: Result<T, E> | null = null
+  let currentDelay = delay
+
+  for (let attempt = 1; attempt <= attempts; attempt++) {
+    const result = await fn()
+    lastResult = result
+
+    if (result.ok) {
+      return result
+    }
+
+    if (attempt === attempts || !shouldRetry(result.error, attempt)) {
+      return result
+    }
+
+    await sleep(currentDelay)
+    currentDelay *= backoff
+  }
+
+  return lastResult!
+}
+
+export function timeout<T>(promise: Promise<T>, ms: number): Promise<T> {
+  return new Promise((resolve, reject) => {
+    const timeoutId = setTimeout(() => {
+      reject(new Error(`Timeout after ${ms}ms`))
+    }, ms)
+
+    promise
+      .then((value) => {
+        clearTimeout(timeoutId)
+        resolve(value)
+      })
+      .catch((error) => {
+        clearTimeout(timeoutId)
+        reject(error)
+      })
+  })
+}
+
+export async function timeoutResult<T>(
+  promise: Promise<Result<T, Error>>,
+  ms: number
+): Promise<Result<T, Error>> {
+  try {
+    return await timeout(promise, ms)
+  } catch (e) {
+    return err(e instanceof Error ? e : new Error(String(e)))
+  }
+}
+
+export async function parallel<T>(
+  tasks: (() => Promise<T>)[],
+  concurrency: number
+): Promise<T[]> {
+  const results: T[] = []
+  const executing: Promise<void>[] = []
+
+  for (const task of tasks) {
+    const p = task().then((result) => {
+      results.push(result)
+    })
+
+    executing.push(p)
+
+    if (executing.length >= concurrency) {
+      await Promise.race(executing)
+      executing.splice(
+        executing.findIndex((e) => e === p),
+        1
+      )
+    }
+  }
+
+  await Promise.all(executing)
+  return results
+}
+
+export async function mapParallel<T, U>(
+  items: T[],
+  fn: (item: T, index: number) => Promise<U>,
+  concurrency: number
+): Promise<U[]> {
+  const results: U[] = new Array(items.length)
+  const executing: Promise<void>[] = []
+
+  for (let i = 0; i < items.length; i++) {
+    const index = i
+    const p = fn(items[index], index).then((result) => {
+      results[index] = result
+    })
+
+    executing.push(p)
+
+    if (executing.length >= concurrency) {
+      await Promise.race(executing)
+      const doneIndex = executing.findIndex(
+        (e) =>
+          (e as Promise<void> & { _done?: boolean })._done !== false
+      )
+      if (doneIndex >= 0) {
+        executing.splice(doneIndex, 1)
+      }
+    }
+  }
+
+  await Promise.all(executing)
+  return results
+}
+
+export function createAbortable<T>(
+  fn: (signal: AbortSignal) => Promise<T>
+): { promise: Promise<T>; abort: () => void } {
+  const controller = new AbortController()
+  return {
+    promise: fn(controller.signal),
+    abort: () => controller.abort(),
+  }
+}
+
+export interface Deferred<T> {
+  promise: Promise<T>
+  resolve: (value: T) => void
+  reject: (error: unknown) => void
+}
+
+export function deferred<T>(): Deferred<T> {
+  let resolve!: (value: T) => void
+  let reject!: (error: unknown) => void
+
+  const promise = new Promise<T>((res, rej) => {
+    resolve = res
+    reject = rej
+  })
+
+  return { promise, resolve, reject }
+}

frontend/src/lib/utils/index.ts

···
+export * from './option'
+export * from './array'
+export * from './async'

frontend/src/lib/utils/option.ts

···
+export type Option<T> = T | null | undefined
+
+export function isSome<T>(opt: Option<T>): opt is T {
+  return opt != null
+}
+
+export function isNone<T>(opt: Option<T>): opt is null | undefined {
+  return opt == null
+}
+
+export function map<T, U>(opt: Option<T>, fn: (t: T) => U): Option<U> {
+  return isSome(opt) ? fn(opt) : null
+}
+
+export function flatMap<T, U>(opt: Option<T>, fn: (t: T) => Option<U>): Option<U> {
+  return isSome(opt) ? fn(opt) : null
+}
+
+export function filter<T>(opt: Option<T>, predicate: (t: T) => boolean): Option<T> {
+  return isSome(opt) && predicate(opt) ? opt : null
+}
+
+export function getOrElse<T>(opt: Option<T>, defaultValue: T): T {
+  return isSome(opt) ? opt : defaultValue
+}
+
+export function getOrElseLazy<T>(opt: Option<T>, fn: () => T): T {
+  return isSome(opt) ? opt : fn()
+}
+
+export function getOrThrow<T>(opt: Option<T>, error?: string | Error): T {
+  if (isSome(opt)) return opt
+  if (error instanceof Error) throw error
+  throw new Error(error ?? 'Expected value but got null/undefined')
+}
+
+export function tap<T>(opt: Option<T>, fn: (t: T) => void): Option<T> {
+  if (isSome(opt)) fn(opt)
+  return opt
+}
+
+export function match<T, U>(
+  opt: Option<T>,
+  handlers: { some: (t: T) => U; none: () => U }
+): U {
+  return isSome(opt) ? handlers.some(opt) : handlers.none()
+}
+
+export function toArray<T>(opt: Option<T>): T[] {
+  return isSome(opt) ? [opt] : []
+}
+
+export function fromArray<T>(arr: T[]): Option<T> {
+  return arr.length > 0 ? arr[0] : null
+}
+
+export function zip<T, U>(a: Option<T>, b: Option<U>): Option<[T, U]> {
+  return isSome(a) && isSome(b) ? [a, b] : null
+}
+
+export function zipWith<T, U, R>(
+  a: Option<T>,
+  b: Option<U>,
+  fn: (t: T, u: U) => R
+): Option<R> {
+  return isSome(a) && isSome(b) ? fn(a, b) : null
+}
+
+export function or<T>(a: Option<T>, b: Option<T>): Option<T> {
+  return isSome(a) ? a : b
+}
+
+export function orLazy<T>(a: Option<T>, fn: () => Option<T>): Option<T> {
+  return isSome(a) ? a : fn()
+}
+
+export function and<T, U>(a: Option<T>, b: Option<U>): Option<U> {
+  return isSome(a) ? b : null
+}

frontend/src/lib/validation.ts

···
+import { ok, err, type Result } from './types/result'
+import {
+  type Did,
+  type DidPlc,
+  type DidWeb,
+  type Handle,
+  type EmailAddress,
+  type AtUri,
+  type Cid,
+  type Nsid,
+  type ISODateString,
+  isDid,
+  isDidPlc,
+  isDidWeb,
+  isHandle,
+  isEmail,
+  isAtUri,
+  isCid,
+  isNsid,
+  isISODate,
+} from './types/branded'
+
+export class ValidationError extends Error {
+  constructor(
+    message: string,
+    public readonly field?: string,
+    public readonly value?: unknown
+  ) {
+    super(message)
+    this.name = 'ValidationError'
+  }
+}
+
+export function parseDid(s: string): Result<Did, ValidationError> {
+  if (isDid(s)) {
+    return ok(s)
+  }
+  return err(new ValidationError(`Invalid DID: ${s}`, 'did', s))
+}
+
+export function parseDidPlc(s: string): Result<DidPlc, ValidationError> {
+  if (isDidPlc(s)) {
+    return ok(s)
+  }
+  return err(new ValidationError(`Invalid DID:PLC: ${s}`, 'did', s))
+}
+
+export function parseDidWeb(s: string): Result<DidWeb, ValidationError> {
+  if (isDidWeb(s)) {
+    return ok(s)
+  }
+  return err(new ValidationError(`Invalid DID:WEB: ${s}`, 'did', s))
+}
+
+export function parseHandle(s: string): Result<Handle, ValidationError> {
+  const trimmed = s.trim().toLowerCase()
+  if (isHandle(trimmed)) {
+    return ok(trimmed)
+  }
+  return err(new ValidationError(`Invalid handle: ${s}`, 'handle', s))
+}
+
+export function parseEmail(s: string): Result<EmailAddress, ValidationError> {
+  const trimmed = s.trim().toLowerCase()
+  if (isEmail(trimmed)) {
+    return ok(trimmed)
+  }
+  return err(new ValidationError(`Invalid email: ${s}`, 'email', s))
+}
+
+export function parseAtUri(s: string): Result<AtUri, ValidationError> {
+  if (isAtUri(s)) {
+    return ok(s)
+  }
+  return err(new ValidationError(`Invalid AT-URI: ${s}`, 'uri', s))
+}
+
+export function parseCid(s: string): Result<Cid, ValidationError> {
+  if (isCid(s)) {
+    return ok(s)
+  }
+  return err(new ValidationError(`Invalid CID: ${s}`, 'cid', s))
+}
+
+export function parseNsid(s: string): Result<Nsid, ValidationError> {
+  if (isNsid(s)) {
+    return ok(s)
+  }
+  return err(new ValidationError(`Invalid NSID: ${s}`, 'nsid', s))
+}
+
+export function parseISODate(s: string): Result<ISODateString, ValidationError> {
+  if (isISODate(s)) {
+    return ok(s)
+  }
+  return err(new ValidationError(`Invalid ISO date: ${s}`, 'date', s))
+}
+
+export interface PasswordValidationResult {
+  valid: boolean
+  errors: string[]
+  strength: 'weak' | 'fair' | 'good' | 'strong'
+}
+
+export function validatePassword(password: string): PasswordValidationResult {
+  const errors: string[] = []
+
+  if (password.length < 8) {
+    errors.push('Password must be at least 8 characters')
+  }
+  if (password.length > 256) {
+    errors.push('Password must be at most 256 characters')
+  }
+  if (!/[a-z]/.test(password)) {
+    errors.push('Password must contain a lowercase letter')
+  }
+  if (!/[A-Z]/.test(password)) {
+    errors.push('Password must contain an uppercase letter')
+  }
+  if (!/\d/.test(password)) {
+    errors.push('Password must contain a number')
+  }
+
+  let strength: PasswordValidationResult['strength'] = 'weak'
+  if (errors.length === 0) {
+    const hasSpecial = /[!@#$%^&*()_+\-=\[\]{};':"\\|,.<>\/?]/.test(password)
+    const isLong = password.length >= 12
+    const isVeryLong = password.length >= 16
+
+    if (isVeryLong && hasSpecial) {
+      strength = 'strong'
+    } else if (isLong || hasSpecial) {
+      strength = 'good'
+    } else {
+      strength = 'fair'
+    }
+  }
+
+  return {
+    valid: errors.length === 0,
+    errors,
+    strength,
+  }
+}
+
+export function validateHandle(handle: string): Result<Handle, ValidationError> {
+  const trimmed = handle.trim().toLowerCase()
+
+  if (trimmed.length < 3) {
+    return err(new ValidationError('Handle must be at least 3 characters', 'handle', handle))
+  }
+
+  if (trimmed.length > 253) {
+    return err(new ValidationError('Handle must be at most 253 characters', 'handle', handle))
+  }
+
+  if (!isHandle(trimmed)) {
+    return err(new ValidationError('Invalid handle format', 'handle', handle))
+  }
+
+  return ok(trimmed)
+}
+
+export function validateInviteCode(code: string): Result<string, ValidationError> {
+  const trimmed = code.trim()
+
+  if (trimmed.length === 0) {
+    return err(new ValidationError('Invite code is required', 'inviteCode', code))
+  }
+
+  const pattern = /^[a-zA-Z0-9-]+$/
+  if (!pattern.test(trimmed)) {
+    return err(new ValidationError('Invalid invite code format', 'inviteCode', code))
+  }
+
+  return ok(trimmed)
+}
+
+export function validateTotpCode(code: string): Result<string, ValidationError> {
+  const trimmed = code.trim().replace(/\s/g, '')
+
+  if (!/^\d{6}$/.test(trimmed)) {
+    return err(new ValidationError('TOTP code must be 6 digits', 'code', code))
+  }
+
+  return ok(trimmed)
+}
+
+export function validateBackupCode(code: string): Result<string, ValidationError> {
+  const trimmed = code.trim().replace(/\s/g, '').toLowerCase()
+
+  if (!/^[a-z0-9]{8}$/.test(trimmed)) {
+    return err(new ValidationError('Invalid backup code format', 'code', code))
+  }
+
+  return ok(trimmed)
+}
+
+export interface FormValidation<T> {
+  validate: () => Result<T, ValidationError[]>
+  field: <K extends keyof T>(
+    key: K,
+    validator: (value: unknown) => Result<T[K], ValidationError>
+  ) => FormValidation<T>
+  optional: <K extends keyof T>(
+    key: K,
+    validator: (value: unknown) => Result<T[K], ValidationError>
+  ) => FormValidation<T>
+}
+
+export function createFormValidation<T extends Record<string, unknown>>(
+  data: Record<string, unknown>
+): FormValidation<T> {
+  const validators: Array<{
+    key: string
+    validator: (value: unknown) => Result<unknown, ValidationError>
+    optional: boolean
+  }> = []
+
+  const builder: FormValidation<T> = {
+    field: (key, validator) => {
+      validators.push({ key: key as string, validator, optional: false })
+      return builder
+    },
+    optional: (key, validator) => {
+      validators.push({ key: key as string, validator, optional: true })
+      return builder
+    },
+    validate: () => {
+      const errors: ValidationError[] = []
+      const result: Record<string, unknown> = {}
+
+      for (const { key, validator, optional } of validators) {
+        const value = data[key]
+
+        if (value == null || value === '') {
+          if (!optional) {
+            errors.push(new ValidationError(`${key} is required`, key))
+          }
+          continue
+        }
+
+        const validated = validator(value)
+        if (validated.ok) {
+          result[key] = validated.value
+        } else {
+          errors.push(validated.error)
+        }
+      }
+
+      if (errors.length > 0) {
+        return err(errors)
+      }
+
+      return ok(result as T)
+    },
+  }
+
+  return builder
+}

frontend/src/lib/webauthn.ts

···
+export interface PublicKeyCredentialDescriptorJSON {
+  type: 'public-key'
+  id: string
+  transports?: AuthenticatorTransport[]
+}
+
+export interface PublicKeyCredentialUserEntityJSON {
+  id: string
+  name: string
+  displayName: string
+}
+
+export interface PublicKeyCredentialRpEntityJSON {
+  name: string
+  id?: string
+}
+
+export interface PublicKeyCredentialParametersJSON {
+  type: 'public-key'
+  alg: number
+}
+
+export interface AuthenticatorSelectionCriteriaJSON {
+  authenticatorAttachment?: AuthenticatorAttachment
+  residentKey?: ResidentKeyRequirement
+  requireResidentKey?: boolean
+  userVerification?: UserVerificationRequirement
+}
+
+export interface PublicKeyCredentialCreationOptionsJSON {
+  rp: PublicKeyCredentialRpEntityJSON
+  user: PublicKeyCredentialUserEntityJSON
+  challenge: string
+  pubKeyCredParams: PublicKeyCredentialParametersJSON[]
+  timeout?: number
+  excludeCredentials?: PublicKeyCredentialDescriptorJSON[]
+  authenticatorSelection?: AuthenticatorSelectionCriteriaJSON
+  attestation?: AttestationConveyancePreference
+}
+
+export interface PublicKeyCredentialRequestOptionsJSON {
+  challenge: string
+  timeout?: number
+  rpId?: string
+  allowCredentials?: PublicKeyCredentialDescriptorJSON[]
+  userVerification?: UserVerificationRequirement
+}
+
+export interface WebAuthnCreationOptionsResponse {
+  publicKey: PublicKeyCredentialCreationOptionsJSON
+}
+
+export interface WebAuthnRequestOptionsResponse {
+  publicKey: PublicKeyCredentialRequestOptionsJSON
+}
+
+export interface CredentialAssertionJSON {
+  id: string
+  type: string
+  rawId: string
+  response: {
+    clientDataJSON: string
+    authenticatorData: string
+    signature: string
+    userHandle: string | null
+  }
+}
+
+export interface CredentialAttestationJSON {
+  id: string
+  type: string
+  rawId: string
+  response: {
+    clientDataJSON: string
+    attestationObject: string
+  }
+}
+
+export function base64UrlToArrayBuffer(base64url: string): ArrayBuffer {
+  const base64 = base64url.replace(/-/g, '+').replace(/_/g, '/')
+  const padded = base64 + '='.repeat((4 - (base64.length % 4)) % 4)
+  const binary = atob(padded)
+  return Uint8Array.from(binary, (char) => char.charCodeAt(0)).buffer
+}
+
+export function arrayBufferToBase64Url(buffer: ArrayBuffer): string {
+  const bytes = new Uint8Array(buffer)
+  const binary = Array.from(bytes, (byte) => String.fromCharCode(byte)).join('')
+  return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '')
+}
+
+export function prepareCreationOptions(
+  options: WebAuthnCreationOptionsResponse
+): PublicKeyCredentialCreationOptions {
+  const pk = options.publicKey
+  return {
+    ...pk,
+    challenge: base64UrlToArrayBuffer(pk.challenge),
+    user: {
+      ...pk.user,
+      id: base64UrlToArrayBuffer(pk.user.id),
+    },
+    excludeCredentials: (pk.excludeCredentials ?? []).map((cred) => ({
+      ...cred,
+      id: base64UrlToArrayBuffer(cred.id),
+    })),
+  }
+}
+
+export function prepareRequestOptions(
+  options: WebAuthnRequestOptionsResponse
+): PublicKeyCredentialRequestOptions {
+  const pk = options.publicKey
+  return {
+    ...pk,
+    challenge: base64UrlToArrayBuffer(pk.challenge),
+    allowCredentials: (pk.allowCredentials ?? []).map((cred) => ({
+      ...cred,
+      id: base64UrlToArrayBuffer(cred.id),
+    })),
+  }
+}
+
+export function serializeAttestationResponse(
+  credential: PublicKeyCredential
+): CredentialAttestationJSON {
+  const response = credential.response as AuthenticatorAttestationResponse
+  return {
+    id: credential.id,
+    type: credential.type,
+    rawId: arrayBufferToBase64Url(credential.rawId),
+    response: {
+      clientDataJSON: arrayBufferToBase64Url(response.clientDataJSON),
+      attestationObject: arrayBufferToBase64Url(response.attestationObject),
+    },
+  }
+}
+
+export function serializeAssertionResponse(
+  credential: PublicKeyCredential
+): CredentialAssertionJSON {
+  const response = credential.response as AuthenticatorAssertionResponse
+  return {
+    id: credential.id,
+    type: credential.type,
+    rawId: arrayBufferToBase64Url(credential.rawId),
+    response: {
+      clientDataJSON: arrayBufferToBase64Url(response.clientDataJSON),
+      authenticatorData: arrayBufferToBase64Url(response.authenticatorData),
+      signature: arrayBufferToBase64Url(response.signature),
+      userHandle: response.userHandle
+        ? arrayBufferToBase64Url(response.userHandle)
+        : null,
+    },
+  }
+}

frontend/src/routes/ActAs.svelte

···
 <script lang="ts">
   import { getAuthState, logout } from '../lib/auth.svelte'
-  import { navigate } from '../lib/router.svelte'
+  import { navigate, routes, getFullUrl } from '../lib/router.svelte'
   import { generateCodeVerifier, generateCodeChallenge, saveOAuthState, generateState } from '../lib/oauth'
   import { _ } from '../lib/i18n'
+  import type { Session } from '../lib/types/api'
 
-  const auth = getAuthState()
+  const auth = $derived(getAuthState())
+
+  function getSession(): Session | null {
+    return auth.kind === 'authenticated' ? auth.session : null
+  }
+
+  function isLoading(): boolean {
+    return auth.kind === 'loading'
+  }
+
+  const session = $derived(getSession())
+  const authLoading = $derived(isLoading())
   let error = $state<string | null>(null)
   let loading = $state(true)
   let actAsInProgress = $state(false)
···
   }
 
   $effect(() => {
-    if (!auth.loading && !auth.session && !actAsInProgress) {
-      navigate('/login')
+    if (!authLoading && !session && !actAsInProgress) {
+      navigate(routes.login)
     }
   })
 
   $effect(() => {
-    if (auth.session && !actAsInProgress) {
+    if (session && !actAsInProgress) {
       actAsInProgress = true
       initiateActAs()
     }
···
       const response = await fetch(
         `/xrpc/_delegation.listControlledAccounts`,
         {
-          headers: { 'Authorization': `Bearer ${auth.session!.accessJwt}` }
+          headers: { 'Authorization': `Bearer ${session!.accessJwt}` }
         }
       )
 

frontend/src/routes/Admin.svelte

···
 <script lang="ts">
   import { getAuthState } from '../lib/auth.svelte'
   import { setServerName as setGlobalServerName, setColors as setGlobalColors, setHasLogo as setGlobalHasLogo } from '../lib/serverConfig.svelte'
-  import { navigate } from '../lib/router.svelte'
+  import { navigate, routes, getFullUrl } from '../lib/router.svelte'
   import { api, ApiError } from '../lib/api'
   import { _ } from '../lib/i18n'
   import { formatDate, formatDateTime } from '../lib/date'
-  const auth = getAuthState()
+  import type { Session } from '../lib/types/api'
+  import { toast } from '../lib/toast.svelte'
+
+  const auth = $derived(getAuthState())
+
+  function getSession(): Session | null {
+    return auth.kind === 'authenticated' ? auth.session : null
+  }
+
+  function isLoading(): boolean {
+    return auth.kind === 'loading'
+  }
+
+  const session = $derived(getSession())
+  const authLoading = $derived(isLoading())
   const DEFAULT_COLORS = {
     primaryLight: '#1A1D1D',
     primaryDark: '#E6E8E8',
···
     secondaryDark: '#E6E8E8',
   }
   let loading = $state(true)
-  let error = $state<string | null>(null)
   let stats = $state<{
     userCount: number
     repoCount: number
···
     blobStorageBytes: number
   } | null>(null)
   let usersLoading = $state(false)
-  let usersError = $state<string | null>(null)
   let users = $state<Array<{
     did: string
     handle: string
···
   let handleSearchQuery = $state('')
   let showUsers = $state(false)
   let invitesLoading = $state(false)
-  let invitesError = $state<string | null>(null)
   let invites = $state<Array<{
     code: string
     available: number
···
   let logoFile = $state<File | null>(null)
   let logoPreview = $state<string | null>(null)
   let serverConfigLoading = $state(false)
-  let serverConfigError = $state<string | null>(null)
-  let serverConfigSuccess = $state(false)
   $effect(() => {
-    if (!auth.loading && !auth.session) {
-      navigate('/login')
-    } else if (!auth.loading && auth.session && !auth.session.isAdmin) {
-      navigate('/dashboard')
+    if (!authLoading && !session) {
+      navigate(routes.login)
+    } else if (!authLoading && session && !session.isAdmin) {
+      navigate(routes.dashboard)
     }
   })
   $effect(() => {
-    if (auth.session?.isAdmin) {
+    if (session?.isAdmin) {
       loadStats()
       loadServerConfig()
     }
···
         logoPreview = '/logo'
       }
     } catch (e) {
-      serverConfigError = e instanceof ApiError ? e.message : 'Failed to load server config'
+      toast.error(e instanceof ApiError ? e.message : $_('admin.failedToLoadConfig'))
     }
   }
   async function saveServerConfig(e: Event) {
     e.preventDefault()
-    if (!auth.session) return
+    if (!session) return
     serverConfigLoading = true
-    serverConfigError = null
-    serverConfigSuccess = false
     try {
       let newLogoCid = logoCid
       if (logoFile) {
-        const result = await api.uploadBlob(auth.session.accessJwt, logoFile)
+        const result = await api.uploadBlob(session.accessJwt, logoFile)
         newLogoCid = result.blob.ref.$link
       }
-      await api.updateServerConfig(auth.session.accessJwt, {
+      await api.updateServerConfig(session.accessJwt, {
         serverName: serverNameInput,
         primaryColor: primaryColorInput,
         primaryColorDark: primaryColorDarkInput,
···
         secondaryColorDark: secondaryColorDarkInput || null,
       })
       setGlobalHasLogo(!!newLogoCid)
-      serverConfigSuccess = true
-      setTimeout(() => { serverConfigSuccess = false }, 3000)
+      toast.success($_('admin.configSaved'))
     } catch (e) {
-      serverConfigError = e instanceof ApiError ? e.message : 'Failed to save server config'
+      toast.error(e instanceof ApiError ? e.message : $_('admin.failedToSaveConfig'))
     } finally {
       serverConfigLoading = false
     }
···
       logoChanged
   }
   async function loadStats() {
-    if (!auth.session) return
+    if (!session) return
     loading = true
-    error = null
     try {
-      stats = await api.getServerStats(auth.session.accessJwt)
+      stats = await api.getServerStats(session.accessJwt)
     } catch (e) {
-      error = e instanceof ApiError ? e.message : 'Failed to load server stats'
+      toast.error(e instanceof ApiError ? e.message : $_('admin.failedToLoadStats'))
     } finally {
       loading = false
     }
   }
   async function loadUsers(reset = false) {
-    if (!auth.session) return
+    if (!session) return
     usersLoading = true
-    usersError = null
     if (reset) {
       users = []
       usersCursor = undefined
     }
     try {
-      const result = await api.searchAccounts(auth.session.accessJwt, {
+      const result = await api.searchAccounts(session.accessJwt, {
         handle: handleSearchQuery || undefined,
         cursor: reset ? undefined : usersCursor,
         limit: 25,
···
       usersCursor = result.cursor
       showUsers = true
     } catch (e) {
-      usersError = e instanceof ApiError ? e.message : 'Failed to load users'
+      toast.error(e instanceof ApiError ? e.message : $_('admin.failedToLoadUsers'))
     } finally {
       usersLoading = false
     }
···
     loadUsers(true)
   }
   async function loadInvites(reset = false) {
-    if (!auth.session) return
+    if (!session) return
     invitesLoading = true
-    invitesError = null
     if (reset) {
       invites = []
       invitesCursor = undefined
     }
     try {
-      const result = await api.getInviteCodes(auth.session.accessJwt, {
+      const result = await api.getInviteCodes(session.accessJwt, {
         cursor: reset ? undefined : invitesCursor,
         limit: 25,
       })
···
       invitesCursor = result.cursor
       showInvites = true
     } catch (e) {
-      invitesError = e instanceof ApiError ? e.message : 'Failed to load invites'
+      toast.error(e instanceof ApiError ? e.message : $_('admin.failedToLoadInvites'))
     } finally {
       invitesLoading = false
     }
   }
   async function disableInvite(code: string) {
-    if (!auth.session) return
+    if (!session) return
     if (!confirm($_('admin.disableInviteConfirm', { values: { code } }))) return
     try {
-      await api.disableInviteCodes(auth.session.accessJwt, [code])
+      await api.disableInviteCodes(session.accessJwt, [code])
       invites = invites.map(inv => inv.code === code ? { ...inv, disabled: true } : inv)
+      toast.success($_('admin.inviteDisabled'))
     } catch (e) {
-      invitesError = e instanceof ApiError ? e.message : 'Failed to disable invite'
+      toast.error(e instanceof ApiError ? e.message : $_('admin.failedToDisableInvite'))
     }
   }
   async function selectUser(did: string) {
-    if (!auth.session) return
+    if (!session) return
     userDetailLoading = true
     try {
-      selectedUser = await api.getAccountInfo(auth.session.accessJwt, did)
+      selectedUser = await api.getAccountInfo(session.accessJwt, did)
     } catch (e) {
-      usersError = e instanceof ApiError ? e.message : 'Failed to load user details'
+      toast.error(e instanceof ApiError ? e.message : $_('admin.failedToLoadUserDetails'))
     } finally {
       userDetailLoading = false
     }
···
     selectedUser = null
   }
   async function toggleUserInvites() {
-    if (!auth.session || !selectedUser) return
+    if (!session || !selectedUser) return
     userActionLoading = true
     try {
       if (selectedUser.invitesDisabled) {
-        await api.enableAccountInvites(auth.session.accessJwt, selectedUser.did)
+        await api.enableAccountInvites(session.accessJwt, selectedUser.did)
         selectedUser = { ...selectedUser, invitesDisabled: false }
+        toast.success($_('admin.invitesEnabled'))
       } else {
-        await api.disableAccountInvites(auth.session.accessJwt, selectedUser.did)
+        await api.disableAccountInvites(session.accessJwt, selectedUser.did)
         selectedUser = { ...selectedUser, invitesDisabled: true }
+        toast.success($_('admin.invitesDisabled'))
       }
     } catch (e) {
-      usersError = e instanceof ApiError ? e.message : 'Failed to update user'
+      toast.error(e instanceof ApiError ? e.message : $_('admin.failedToUpdateUser'))
     } finally {
       userActionLoading = false
     }
   }
   async function deleteUser() {
-    if (!auth.session || !selectedUser) return
+    if (!session || !selectedUser) return
     if (!confirm($_('admin.deleteConfirm', { values: { handle: selectedUser.handle } }))) return
     userActionLoading = true
     try {
-      await api.adminDeleteAccount(auth.session.accessJwt, selectedUser.did)
+      await api.adminDeleteAccount(session.accessJwt, selectedUser.did)
       users = users.filter(u => u.did !== selectedUser!.did)
       selectedUser = null
+      toast.success($_('admin.userDeleted'))
     } catch (e) {
-      usersError = e instanceof ApiError ? e.message : 'Failed to delete user'
+      toast.error(e instanceof ApiError ? e.message : $_('admin.failedToDeleteUser'))
     } finally {
       userActionLoading = false
     }
···
     return num.toLocaleString()
   }
 </script>
-{#if auth.session?.isAdmin}
+{#if session?.isAdmin}
   <div class="page">
     <header>
       <a href="/app/dashboard" class="back">{$_('common.backToDashboard')}</a>
···
     {#if loading}
       <p class="loading">{$_('admin.loading')}</p>
     {:else}
-      {#if error}
-        <div class="message error">{error}</div>
-      {/if}
       <section>
         <h2>{$_('admin.serverConfig')}</h2>
         <form class="config-form" onsubmit={saveServerConfig}>
···
             </div>
           </div>
 
-          {#if serverConfigError}
-            <div class="message error">{serverConfigError}</div>
-          {/if}
-          {#if serverConfigSuccess}
-            <div class="message success">{$_('admin.configSaved')}</div>
-          {/if}
           <button type="submit" disabled={serverConfigLoading || !hasConfigChanges()}>
             {serverConfigLoading ? $_('common.saving') : $_('admin.saveConfig')}
           </button>
···
             {usersLoading ? $_('admin.loading') : $_('admin.searchUsers')}
           </button>
         </form>
-        {#if usersError}
-          <div class="message error">{usersError}</div>
-        {/if}
         {#if showUsers}
           <div class="user-list">
             {#if users.length === 0}
···
             {invitesLoading ? $_('admin.loading') : showInvites ? $_('admin.refresh') : $_('admin.loadInviteCodes')}
           </button>
         </div>
-        {#if invitesError}
-          <div class="message error">{invitesError}</div>
-        {/if}
         {#if showInvites}
           <div class="invite-list">
             {#if invites.length === 0}

frontend/src/routes/AppPasswords.svelte

···
 <script lang="ts">
   import { getAuthState } from '../lib/auth.svelte'
-  import { navigate } from '../lib/router.svelte'
+  import { navigate, routes, getFullUrl } from '../lib/router.svelte'
   import { api, type AppPassword, ApiError } from '../lib/api'
   import { _ } from '../lib/i18n'
   import { formatDate } from '../lib/date'
-  const auth = getAuthState()
+  import type { Session } from '../lib/types/api'
+  import { toast } from '../lib/toast.svelte'
+
+  const auth = $derived(getAuthState())
+
+  function getSession(): Session | null {
+    return auth.kind === 'authenticated' ? auth.session : null
+  }
+
+  function isLoading(): boolean {
+    return auth.kind === 'loading'
+  }
+
+  const session = $derived(getSession())
+  const authLoading = $derived(isLoading())
   let passwords = $state<AppPassword[]>([])
   let loading = $state(true)
-  let error = $state<string | null>(null)
   let newPasswordName = $state('')
   let selectedScope = $state<string | null>(null)
   let creating = $state(false)
···
     return $_('appPasswords.scopeCustom')
   }
   $effect(() => {
-    if (!auth.loading && !auth.session) {
-      navigate('/login')
+    if (!authLoading && !session) {
+      navigate(routes.login)
     }
   })
   $effect(() => {
-    if (auth.session) {
+    if (session) {
       loadPasswords()
     }
   })
   async function loadPasswords() {
-    if (!auth.session) return
+    if (!session) return
     loading = true
-    error = null
     try {
-      const result = await api.listAppPasswords(auth.session.accessJwt)
+      const result = await api.listAppPasswords(session.accessJwt)
       passwords = result.passwords
     } catch (e) {
-      error = e instanceof ApiError ? e.message : 'Failed to load app passwords'
+      toast.error(e instanceof ApiError ? e.message : $_('appPasswords.failedToLoad'))
     } finally {
       loading = false
     }
   }
   async function handleCreate(e: Event) {
     e.preventDefault()
-    if (!auth.session || !newPasswordName.trim()) return
+    if (!session || !newPasswordName.trim()) return
     creating = true
-    error = null
     try {
       const scopeValue = selectedScope === null ? undefined : selectedScope
-      const result = await api.createAppPassword(auth.session.accessJwt, newPasswordName.trim(), scopeValue ?? undefined)
+      const result = await api.createAppPassword(session.accessJwt, newPasswordName.trim(), scopeValue ?? undefined)
       createdPassword = { name: result.name, password: result.password }
       newPasswordName = ''
       selectedScope = null
       await loadPasswords()
     } catch (e) {
-      error = e instanceof ApiError ? e.message : 'Failed to create app password'
+      toast.error(e instanceof ApiError ? e.message : $_('appPasswords.failedToCreate'))
     } finally {
       creating = false
     }
   }
   async function handleRevoke(name: string) {
-    if (!auth.session) return
+    if (!session) return
     if (!confirm($_('appPasswords.revokeConfirm', { values: { name } }))) {
       return
     }
     revoking = name
-    error = null
     try {
-      await api.revokeAppPassword(auth.session.accessJwt, name)
+      await api.revokeAppPassword(session.accessJwt, name)
       await loadPasswords()
+      toast.success($_('appPasswords.passwordRevoked'))
     } catch (e) {
-      error = e instanceof ApiError ? e.message : 'Failed to revoke app password'
+      toast.error(e instanceof ApiError ? e.message : $_('appPasswords.failedToRevoke'))
     } finally {
       revoking = null
     }
···
 </script>
 <div class="page">
   <header>
-    <a href="/app/dashboard" class="back">{$_('common.backToDashboard')}</a>
+    <a href={getFullUrl(routes.dashboard)} class="back">{$_('common.backToDashboard')}</a>
     <h1>{$_('appPasswords.title')}</h1>
   </header>
   <p class="description">
     {$_('appPasswords.description')}
   </p>
-  {#if error}
-    <div class="error">{error}</div>
-  {/if}
   {#if createdPassword}
     <div class="created-password">
       <div class="warning-box">
···
   <section class="list-section">
     <h2>{$_('appPasswords.yourPasswords')}</h2>
     {#if loading}
-      <p class="empty">{$_('common.loading')}</p>
+      <ul class="password-list">
+        {#each Array(2) as _}
+          <li class="skeleton-item"></li>
+        {/each}
+      </ul>
     {:else if passwords.length === 0}
       <p class="empty">{$_('appPasswords.noPasswords')}</p>
     {:else}
···
     color: var(--text-secondary);
     text-align: center;
     padding: var(--space-7);
+  }
+
+  .skeleton-item {
+    height: 60px;
+    background: var(--bg-tertiary);
+    animation: skeleton-pulse 1.5s ease-in-out infinite;
+  }
+
+  @keyframes skeleton-pulse {
+    0%, 100% { opacity: 1; }
+    50% { opacity: 0.5; }
   }
 </style>

frontend/src/routes/Comms.svelte

···
 <script lang="ts">
   import { getAuthState, refreshSession } from '../lib/auth.svelte'
-  import { navigate } from '../lib/router.svelte'
+  import { navigate, routes, getFullUrl } from '../lib/router.svelte'
   import { api, ApiError } from '../lib/api'
   import { _ } from '../lib/i18n'
   import { formatDateTime } from '../lib/date'
-  const auth = getAuthState()
+  import type { Session } from '../lib/types/api'
+  import { toast } from '../lib/toast.svelte'
+
+  const auth = $derived(getAuthState())
+
+  function getSession(): Session | null {
+    return auth.kind === 'authenticated' ? auth.session : null
+  }
+
+  function isLoading(): boolean {
+    return auth.kind === 'loading'
+  }
+
+  const session = $derived(getSession())
+  const authLoading = $derived(isLoading())
   let loading = $state(true)
   let saving = $state(false)
-  let error = $state<string | null>(null)
-  let success = $state<string | null>(null)
   let preferredChannel = $state('email')
   let availableCommsChannels = $state<string[]>(['email'])
   let email = $state('')
···
   let signalVerified = $state(false)
   let verifyingChannel = $state<string | null>(null)
   let verificationCode = $state('')
-  let verificationError = $state<string | null>(null)
-  let verificationSuccess = $state<string | null>(null)
   let historyLoading = $state(true)
-  let historyError = $state<string | null>(null)
   let messages = $state<Array<{
     createdAt: string
     channel: string
···
     body: string
   }>>([])
   $effect(() => {
-    if (!auth.loading && !auth.session) {
-      navigate('/login')
+    if (!authLoading && !session) {
+      navigate(routes.login)
     }
   })
   $effect(() => {
-    if (auth.session) {
+    if (session) {
       loadPrefs()
       loadHistory()
     }
   })
   async function loadPrefs() {
-    if (!auth.session) return
+    if (!session) return
     loading = true
-    error = null
     try {
       const [prefs, serverInfo] = await Promise.all([
-        api.getNotificationPrefs(auth.session.accessJwt),
+        api.getNotificationPrefs(session.accessJwt),
         api.describeServer()
       ])
       preferredChannel = prefs.preferredChannel
···
       signalVerified = prefs.signalVerified
       availableCommsChannels = serverInfo.availableCommsChannels ?? ['email']
     } catch (e) {
-      error = e instanceof ApiError ? e.message : 'Failed to load notification preferences'
+      toast.error(e instanceof ApiError ? e.message : $_('comms.failedToLoad'))
     } finally {
       loading = false
     }
   }
   async function handleSave(e: Event) {
     e.preventDefault()
-    if (!auth.session) return
+    if (!session) return
     saving = true
-    error = null
-    success = null
     try {
-      await api.updateNotificationPrefs(auth.session.accessJwt, {
+      await api.updateNotificationPrefs(session.accessJwt, {
         preferredChannel,
         discordId: discordId || undefined,
         telegramUsername: telegramUsername || undefined,
         signalNumber: signalNumber || undefined,
       })
       await refreshSession()
-      success = $_('comms.preferencesSaved')
+      toast.success($_('comms.preferencesSaved'))
       await loadPrefs()
     } catch (e) {
-      error = e instanceof ApiError ? e.message : 'Failed to save preferences'
+      toast.error(e instanceof ApiError ? e.message : $_('comms.failedToSave'))
     } finally {
       saving = false
     }
   }
   async function handleVerify(channel: string) {
-    if (!auth.session || !verificationCode) return
-    verificationError = null
-    verificationSuccess = null
+    if (!session || !verificationCode) return
 
     let identifier = ''
     switch (channel) {
···
     if (!identifier) return
 
     try {
-      await api.confirmChannelVerification(auth.session.accessJwt, channel, identifier, verificationCode)
+      await api.confirmChannelVerification(session.accessJwt, channel, identifier, verificationCode)
       await refreshSession()
-      verificationSuccess = $_('comms.verifiedSuccess', { values: { channel } })
+      toast.success($_('comms.verifiedSuccess', { values: { channel } }))
       verificationCode = ''
       verifyingChannel = null
       await loadPrefs()
     } catch (e) {
-      verificationError = e instanceof ApiError ? e.message : 'Failed to verify channel'
+      toast.error(e instanceof ApiError ? e.message : $_('comms.failedToVerify'))
     }
   }
   async function loadHistory() {
-    if (!auth.session) return
+    if (!session) return
     historyLoading = true
-    historyError = null
     try {
-      const result = await api.getNotificationHistory(auth.session.accessJwt)
+      const result = await api.getNotificationHistory(session.accessJwt)
       messages = result.notifications
     } catch (e) {
-      historyError = e instanceof ApiError ? e.message : 'Failed to load notification history'
+      toast.error(e instanceof ApiError ? e.message : $_('comms.failedToLoadHistory'))
     } finally {
       historyLoading = false
     }
···
 </script>
 <div class="page">
   <header>
-    <a href="/app/dashboard" class="back">{$_('common.backToDashboard')}</a>
+    <a href={getFullUrl(routes.dashboard)} class="back">{$_('common.backToDashboard')}</a>
     <h1>{$_('comms.title')}</h1>
     <p class="description">{$_('comms.description')}</p>
   </header>
 
   {#if loading}
-    <p class="loading">{$_('common.loading')}</p>
+    <div class="skeleton-sections">
+      <div class="skeleton-section"></div>
+      <div class="skeleton-section"></div>
+    </div>
   {:else}
-    {#if error}
-      <div class="message error">{error}</div>
-    {/if}
-    {#if success}
-      <div class="message success">{success}</div>
-    {/if}
-
     <div class="split-layout">
       <div class="main-column">
         <form onsubmit={handleSave}>
···
               </div>
             </div>
 
-            {#if verificationError}
-              <div class="message error" style="margin-top: 1rem">{verificationError}</div>
-            {/if}
-            {#if verificationSuccess}
-              <div class="message success" style="margin-top: 1rem">{verificationSuccess}</div>
-            {/if}
           </section>
 
           <div class="actions">
···
                 </div>
               {/each}
             </div>
-          {:else if historyError}
-            <div class="message error">{historyError}</div>
           {:else if messages.length === 0}
             <p class="no-messages">{$_('comms.noMessages')}</p>
           {:else}
···
     font-size: var(--text-xs);
     color: var(--text-muted);
     margin-top: var(--space-2);
+  }
+
+  .skeleton-sections {
+    display: flex;
+    flex-direction: column;
+    gap: var(--space-6);
+  }
+
+  .skeleton-section {
+    height: 180px;
+    background: var(--bg-secondary);
+    border-radius: var(--radius-xl);
+    animation: skeleton-pulse 1.5s ease-in-out infinite;
+  }
+
+  @keyframes skeleton-pulse {
+    0%, 100% { opacity: 1; }
+    50% { opacity: 0.5; }
   }
 </style>

frontend/src/routes/Controllers.svelte

···
 <script lang="ts">
   import { getAuthState } from '../lib/auth.svelte'
-  import { navigate } from '../lib/router.svelte'
+  import { navigate, routes, getFullUrl } from '../lib/router.svelte'
   import { _ } from '../lib/i18n'
   import { formatDateTime } from '../lib/date'
+  import type { Session } from '../lib/types/api'
+  import { toast } from '../lib/toast.svelte'
 
   interface Controller {
     did: string
···
     scopes: string
   }
 
-  const auth = getAuthState()
+  const auth = $derived(getAuthState())
+
+  function getSession(): Session | null {
+    return auth.kind === 'authenticated' ? auth.session : null
+  }
+
+  function isLoading(): boolean {
+    return auth.kind === 'loading'
+  }
+
+  const session = $derived(getSession())
+  const authLoading = $derived(isLoading())
+
   let loading = $state(true)
-  let error = $state<string | null>(null)
-  let success = $state<string | null>(null)
   let controllers = $state<Controller[]>([])
   let controlledAccounts = $state<ControlledAccount[]>([])
   let scopePresets = $state<ScopePreset[]>([])
···
   let creatingDelegated = $state(false)
 
   $effect(() => {
-    if (!auth.loading && !auth.session) {
-      navigate('/login')
+    if (!authLoading && !session) {
+      navigate(routes.login)
     }
   })
 
   $effect(() => {
-    if (auth.session) {
+    if (session) {
       loadData()
     }
   })
 
   async function loadData() {
     loading = true
-    error = null
     try {
       await Promise.all([loadControllers(), loadControlledAccounts(), loadScopePresets()])
     } finally {
···
   }
 
   async function loadControllers() {
-    if (!auth.session) return
+    if (!session) return
     try {
       const response = await fetch('/xrpc/_delegation.listControllers', {
-        headers: { 'Authorization': `Bearer ${auth.session.accessJwt}` }
+        headers: { 'Authorization': `Bearer ${session.accessJwt}` }
       })
       if (response.ok) {
         const data = await response.json()
···
   }
 
   async function loadControlledAccounts() {
-    if (!auth.session) return
+    if (!session) return
     try {
       const response = await fetch('/xrpc/_delegation.listControlledAccounts', {
-        headers: { 'Authorization': `Bearer ${auth.session.accessJwt}` }
+        headers: { 'Authorization': `Bearer ${session.accessJwt}` }
       })
       if (response.ok) {
         const data = await response.json()
···
   }
 
   async function addController() {
-    if (!auth.session || !addControllerDid.trim()) return
+    if (!session || !addControllerDid.trim()) return
     addingController = true
-    error = null
-    success = null
 
     try {
       const response = await fetch('/xrpc/_delegation.addController', {
         method: 'POST',
         headers: {
-          'Authorization': `Bearer ${auth.session.accessJwt}`,
+          'Authorization': `Bearer ${session.accessJwt}`,
           'Content-Type': 'application/json'
         },
         body: JSON.stringify({
···
 
       if (!response.ok) {
         const data = await response.json()
-        error = data.message || data.error || $_('delegation.failedToAddController')
+        toast.error(data.message || data.error || $_('delegation.failedToAddController'))
         return
       }
 
-      success = $_('delegation.controllerAdded')
+      toast.success($_('delegation.controllerAdded'))
       addControllerDid = ''
       addControllerScopes = 'atproto'
       showAddController = false
       await loadControllers()
     } catch (e) {
-      error = $_('delegation.failedToAddController')
+      toast.error($_('delegation.failedToAddController'))
     } finally {
       addingController = false
     }
   }
 
   async function removeController(controllerDid: string) {
-    if (!auth.session) return
+    if (!session) return
     if (!confirm($_('delegation.removeConfirm'))) return
 
-    error = null
-    success = null
-
     try {
       const response = await fetch('/xrpc/_delegation.removeController', {
         method: 'POST',
         headers: {
-          'Authorization': `Bearer ${auth.session.accessJwt}`,
+          'Authorization': `Bearer ${session.accessJwt}`,
           'Content-Type': 'application/json'
         },
         body: JSON.stringify({ controller_did: controllerDid })
···
 
       if (!response.ok) {
         const data = await response.json()
-        error = data.message || data.error || $_('delegation.failedToRemoveController')
+        toast.error(data.message || data.error || $_('delegation.failedToRemoveController'))
         return
       }
 
-      success = $_('delegation.controllerRemoved')
+      toast.success($_('delegation.controllerRemoved'))
       await loadControllers()
     } catch (e) {
-      error = $_('delegation.failedToRemoveController')
+      toast.error($_('delegation.failedToRemoveController'))
     }
   }
 
   async function createDelegatedAccount() {
-    if (!auth.session || !newDelegatedHandle.trim()) return
+    if (!session || !newDelegatedHandle.trim()) return
     creatingDelegated = true
-    error = null
-    success = null
 
     try {
       const response = await fetch('/xrpc/_delegation.createDelegatedAccount', {
         method: 'POST',
         headers: {
-          'Authorization': `Bearer ${auth.session.accessJwt}`,
+          'Authorization': `Bearer ${session.accessJwt}`,
           'Content-Type': 'application/json'
         },
         body: JSON.stringify({
···
 
       if (!response.ok) {
         const data = await response.json()
-        error = data.message || data.error || $_('delegation.failedToCreateAccount')
+        toast.error(data.message || data.error || $_('delegation.failedToCreateAccount'))
         return
       }
 
       const data = await response.json()
-      success = $_('delegation.accountCreated', { values: { handle: data.handle } })
+      toast.success($_('delegation.accountCreated', { values: { handle: data.handle } }))
       newDelegatedHandle = ''
       newDelegatedEmail = ''
       newDelegatedScopes = 'atproto'
       showCreateDelegated = false
       await loadControlledAccounts()
     } catch (e) {
-      error = $_('delegation.failedToCreateAccount')
+      toast.error($_('delegation.failedToCreateAccount'))
     } finally {
       creatingDelegated = false
     }
···
   </header>
 
   {#if loading}
-    <p class="loading">{$_('delegation.loading')}</p>
+    <div class="skeleton-list">
+      {#each Array(2) as _}
+        <div class="skeleton-card"></div>
+      {/each}
+    </div>
   {:else}
-    {#if error}
-      <div class="message error">{error}</div>
-    {/if}
-
-    {#if success}
-      <div class="message success">{success}</div>
-    {/if}
-
     <section class="section">
       <div class="section-header">
         <h2>{$_('delegation.controllers')}</h2>
···
   .form-actions button {
     padding: var(--space-2) var(--space-4);
     font-size: var(--text-sm);
+  }
+
+  .skeleton-list {
+    display: flex;
+    flex-direction: column;
+    gap: var(--space-4);
+  }
+
+  .skeleton-card {
+    height: 120px;
+    background: var(--bg-secondary);
+    border: 1px solid var(--border-color);
+    border-radius: var(--radius-xl);
+    animation: skeleton-pulse 1.5s ease-in-out infinite;
+  }
+
+  @keyframes skeleton-pulse {
+    0%, 100% { opacity: 1; }
+    50% { opacity: 0.5; }
   }
 </style>

frontend/src/routes/Dashboard.svelte

···
 <script lang="ts">
-  import { getAuthState, logout, switchAccount } from '../lib/auth.svelte'
-  import { navigate } from '../lib/router.svelte'
+  import {
+    getAuthState,
+    logout,
+    switchAccount,
+    type SavedAccount,
+  } from '../lib/auth.svelte'
+  import { navigate, routes, getFullUrl } from '../lib/router.svelte'
   import { _ } from '../lib/i18n'
   import { api } from '../lib/api'
+  import { isOk } from '../lib/types/result'
+  import { unsafeAsDid, type Did } from '../lib/types/branded'
+  import type { Session } from '../lib/types/api'
   import { onMount } from 'svelte'
 
-  const auth = getAuthState()
+  const auth = $derived(getAuthState())
   let dropdownOpen = $state(false)
   let switching = $state(false)
   let inviteCodesEnabled = $state(false)
 
-  const isDidWeb = $derived(auth.session?.did?.startsWith('did:web:') ?? false)
+  function getSession(): Session | null {
+    return auth.kind === 'authenticated' ? auth.session : null
+  }
+
+  function getSavedAccounts(): readonly SavedAccount[] {
+    return auth.savedAccounts
+  }
+
+  function isLoading(): boolean {
+    return auth.kind === 'loading'
+  }
+
+  const session = $derived(getSession())
+  const savedAccounts = $derived(getSavedAccounts())
+  const loading = $derived(isLoading())
+  const isDidWeb = $derived(session?.did?.startsWith('did:web:') ?? false)
+  const otherAccounts = $derived(savedAccounts.filter(a => a.did !== session?.did))
 
   onMount(async () => {
     try {
···
   })
 
   $effect(() => {
-    if (!auth.loading && !auth.session) {
-      navigate('/login')
+    if (!loading && !session) {
+      navigate(routes.login)
     }
   })
 
   async function handleLogout() {
     await logout()
-    navigate('/login')
+    navigate(routes.login)
   }
 
-  async function handleSwitchAccount(did: string) {
+  async function handleSwitchAccount(did: Did) {
     switching = true
     dropdownOpen = false
-    try {
-      await switchAccount(did)
-    } catch {
-      navigate('/login')
-    } finally {
-      switching = false
+    const result = await switchAccount(did)
+    if (!isOk(result)) {
+      navigate(routes.login)
     }
+    switching = false
   }
 
   function toggleDropdown() {
···
       return () => document.removeEventListener('click', closeDropdown)
     }
   })
-
-  let otherAccounts = $derived(
-    auth.savedAccounts.filter(a => a.did !== auth.session?.did)
-  )
 </script>
 
-{#if auth.session}
+{#if session}
   <div class="dashboard">
     <header>
       <h1>{$_('dashboard.title')}</h1>
       <div class="account-dropdown">
         <button class="account-trigger" onclick={toggleDropdown} disabled={switching}>
-          <span class="account-handle">@{auth.session.handle}</span>
+          <span class="account-handle">@{session.handle}</span>
           <span class="dropdown-arrow">{dropdownOpen ? '▲' : '▼'}</span>
         </button>
         {#if dropdownOpen}
···
               </div>
               <div class="dropdown-divider"></div>
             {/if}
-            <button type="button" class="dropdown-item" onclick={() => { dropdownOpen = false; navigate('/login') }}>
+            <button type="button" class="dropdown-item" onclick={() => { dropdownOpen = false; navigate(routes.login) }}>
               {$_('dashboard.addAnotherAccount')}
             </button>
             <div class="dropdown-divider"></div>
             <button type="button" class="dropdown-item logout-item" onclick={handleLogout}>
-              {$_('dashboard.signOut', { values: { handle: auth.session.handle } })}
+              {$_('dashboard.signOut', { values: { handle: session.handle } })}
             </button>
           </div>
         {/if}
       </div>
     </header>
 
-    {#if auth.session.status === 'migrated'}
+    {#if session.status === 'migrated'}
       <div class="migrated-banner">
         <strong>{$_('dashboard.migratedTitle')}</strong>
-        <p>{$_('dashboard.migratedMessage', { values: { pds: auth.session.migratedToPds || 'another PDS' } })}</p>
+        <p>{$_('dashboard.migratedMessage', { values: { pds: session.migratedToPds || 'another PDS' } })}</p>
       </div>
-    {:else if auth.session.status === 'deactivated' || auth.session.active === false}
+    {:else if session.status === 'deactivated' || session.active === false}
       <div class="deactivated-banner">
         <strong>{$_('dashboard.deactivatedTitle')}</strong>
         <p>{$_('dashboard.deactivatedMessage')}</p>
···
       <dl>
         <dt>{$_('dashboard.handle')}</dt>
         <dd>
-          @{auth.session.handle}
-          {#if auth.session.isAdmin}
+          @{session.handle}
+          {#if session.isAdmin}
             <span class="badge admin">{$_('dashboard.admin')}</span>
           {/if}
-          {#if auth.session.status === 'migrated'}
+          {#if session.status === 'migrated'}
             <span class="badge migrated">{$_('dashboard.migrated')}</span>
-          {:else if auth.session.status === 'deactivated' || auth.session.active === false}
+          {:else if session.status === 'deactivated' || session.active === false}
             <span class="badge deactivated">{$_('dashboard.deactivated')}</span>
           {/if}
         </dd>
         <dt>{$_('dashboard.did')}</dt>
-        <dd class="mono">{auth.session.did}</dd>
-        {#if auth.session.preferredChannel}
+        <dd class="mono">{session.did}</dd>
+        {#if session.preferredChannel}
           <dt>{$_('dashboard.primaryContact')}</dt>
           <dd>
-            {#if auth.session.preferredChannel === 'email'}
-              {auth.session.email || $_('register.email')}
-            {:else if auth.session.preferredChannel === 'discord'}
+            {#if session.preferredChannel === 'email'}
+              {session.email || $_('register.email')}
+            {:else if session.preferredChannel === 'discord'}
               {$_('register.discord')}
-            {:else if auth.session.preferredChannel === 'telegram'}
+            {:else if session.preferredChannel === 'telegram'}
               {$_('register.telegram')}
-            {:else if auth.session.preferredChannel === 'signal'}
+            {:else if session.preferredChannel === 'signal'}
               {$_('register.signal')}
             {:else}
-              {auth.session.preferredChannel}
+              {session.preferredChannel}
             {/if}
-            {#if auth.session.preferredChannelVerified}
+            {#if session.preferredChannelVerified}
               <span class="badge success">{$_('dashboard.verified')}</span>
             {:else}
               <span class="badge warning">{$_('dashboard.unverified')}</span>
             {/if}
           </dd>
-        {:else if auth.session.email}
+        {:else if session.email}
           <dt>{$_('register.email')}</dt>
           <dd>
-            {auth.session.email}
-            {#if auth.session.emailConfirmed}
+            {session.email}
+            {#if session.emailConfirmed}
               <span class="badge success">{$_('dashboard.verified')}</span>
             {:else}
               <span class="badge warning">{$_('dashboard.unverified')}</span>
···
     </section>
 
     <nav class="nav-grid">
-      {#if auth.session.status === 'migrated'}
-        <a href="/app/did-document" class="nav-card migrated-card">
+      {#if session.status === 'migrated'}
+        <a href={getFullUrl(routes.didDocument)} class="nav-card migrated-card">
           <h3>{$_('dashboard.navDidDocument')}</h3>
           <p>{$_('dashboard.navDidDocumentDesc')}</p>
         </a>
-        <a href="/app/sessions" class="nav-card">
+        <a href={getFullUrl(routes.sessions)} class="nav-card">
           <h3>{$_('dashboard.navSessions')}</h3>
           <p>{$_('dashboard.navSessionsDesc')}</p>
         </a>
-        <a href="/app/security" class="nav-card">
+        <a href={getFullUrl(routes.security)} class="nav-card">
           <h3>{$_('dashboard.navSecurity')}</h3>
           <p>{$_('dashboard.navSecurityDesc')}</p>
         </a>
-        <a href="/app/settings" class="nav-card">
+        <a href={getFullUrl(routes.settings)} class="nav-card">
           <h3>{$_('dashboard.navSettings')}</h3>
           <p>{$_('dashboard.navSettingsDesc')}</p>
         </a>
-        <a href="/app/migrate" class="nav-card">
+        <a href={getFullUrl(routes.migrate)} class="nav-card">
           <h3>{$_('dashboard.navMigrateAgain')}</h3>
           <p>{$_('dashboard.navMigrateAgainDesc')}</p>
         </a>
       {:else}
-        <a href="/app/app-passwords" class="nav-card">
+        <a href={getFullUrl(routes.appPasswords)} class="nav-card">
           <h3>{$_('dashboard.navAppPasswords')}</h3>
           <p>{$_('dashboard.navAppPasswordsDesc')}</p>
         </a>
-        <a href="/app/sessions" class="nav-card">
+        <a href={getFullUrl(routes.sessions)} class="nav-card">
           <h3>{$_('dashboard.navSessions')}</h3>
           <p>{$_('dashboard.navSessionsDesc')}</p>
         </a>
-        {#if inviteCodesEnabled && auth.session.isAdmin}
-          <a href="/app/invite-codes" class="nav-card">
+        {#if inviteCodesEnabled && session.isAdmin}
+          <a href={getFullUrl(routes.inviteCodes)} class="nav-card">
             <h3>{$_('dashboard.navInviteCodes')}</h3>
             <p>{$_('dashboard.navInviteCodesDesc')}</p>
           </a>
         {/if}
-        <a href="/app/settings" class="nav-card">
+        <a href={getFullUrl(routes.settings)} class="nav-card">
           <h3>{$_('dashboard.navSettings')}</h3>
           <p>{$_('dashboard.navSettingsDesc')}</p>
         </a>
-        <a href="/app/security" class="nav-card">
+        <a href={getFullUrl(routes.security)} class="nav-card">
           <h3>{$_('dashboard.navSecurity')}</h3>
           <p>{$_('dashboard.navSecurityDesc')}</p>
         </a>
-        <a href="/app/comms" class="nav-card">
+        <a href={getFullUrl(routes.comms)} class="nav-card">
           <h3>{$_('dashboard.navComms')}</h3>
           <p>{$_('dashboard.navCommsDesc')}</p>
         </a>
-        <a href="/app/repo" class="nav-card">
+        <a href={getFullUrl(routes.repo)} class="nav-card">
           <h3>{$_('dashboard.navRepo')}</h3>
           <p>{$_('dashboard.navRepoDesc')}</p>
         </a>
-        <a href="/app/controllers" class="nav-card">
+        <a href={getFullUrl(routes.controllers)} class="nav-card">
           <h3>{$_('dashboard.navDelegation')}</h3>
           <p>{$_('dashboard.navDelegationDesc')}</p>
         </a>
         {#if isDidWeb}
-          <a href="/app/did-document" class="nav-card did-web-card">
+          <a href={getFullUrl(routes.didDocument)} class="nav-card did-web-card">
             <h3>{$_('dashboard.navDidDocument')}</h3>
             <p>{$_('dashboard.navDidDocumentDescActive')}</p>
           </a>
         {/if}
-        <a href="/app/migrate" class="nav-card">
+        <a href={getFullUrl(routes.migrate)} class="nav-card">
           <h3>{$_('migration.navTitle')}</h3>
           <p>{$_('migration.navDesc')}</p>
         </a>
-        {#if auth.session.isAdmin}
-          <a href="/app/admin" class="nav-card admin-card">
+        {#if session.isAdmin}
+          <a href={getFullUrl(routes.admin)} class="nav-card admin-card">
             <h3>{$_('dashboard.navAdmin')}</h3>
             <p>{$_('dashboard.navAdminDesc')}</p>
           </a>
···
       {/if}
     </nav>
   </div>
-{:else if auth.loading}
-  <div class="loading">{$_('common.loading')}</div>
+{:else if loading}
+  <div class="dashboard">
+    <div class="skeleton-section"></div>
+    <nav class="nav-grid">
+      {#each Array(6) as _}
+        <div class="skeleton-card"></div>
+      {/each}
+    </nav>
+  </div>
 {/if}
 
 <style>
···
     box-shadow: 0 2px 12px var(--accent-muted);
   }
 
-  .loading {
-    text-align: center;
-    padding: var(--space-9);
-    color: var(--text-secondary);
+  .skeleton-section {
+    height: 140px;
+    background: var(--bg-secondary);
+    border-radius: var(--radius-xl);
+    margin-bottom: var(--space-7);
+    animation: skeleton-pulse 1.5s ease-in-out infinite;
+  }
+
+  .skeleton-card {
+    height: 100px;
+    background: var(--bg-tertiary);
+    border: 1px solid var(--border-color);
+    border-radius: var(--radius-xl);
+    animation: skeleton-pulse 1.5s ease-in-out infinite;
+  }
+
+  @keyframes skeleton-pulse {
+    0%, 100% { opacity: 1; }
+    50% { opacity: 0.5; }
   }
 
   .deactivated-banner {

frontend/src/routes/DelegationAudit.svelte

···
 <script lang="ts">
   import { getAuthState } from '../lib/auth.svelte'
-  import { navigate } from '../lib/router.svelte'
+  import { navigate, routes, getFullUrl } from '../lib/router.svelte'
   import { _ } from '../lib/i18n'
   import { formatDateTime } from '../lib/date'
+  import type { Session } from '../lib/types/api'
+  import { toast } from '../lib/toast.svelte'
 
   interface AuditEntry {
     id: string
···
     createdAt: string
   }
 
-  const auth = getAuthState()
+  const auth = $derived(getAuthState())
+
+  function getSession(): Session | null {
+    return auth.kind === 'authenticated' ? auth.session : null
+  }
+
+  function isLoading(): boolean {
+    return auth.kind === 'loading'
+  }
+
+  const session = $derived(getSession())
+  const authLoading = $derived(isLoading())
+
   let loading = $state(true)
-  let error = $state<string | null>(null)
   let entries = $state<AuditEntry[]>([])
   let total = $state(0)
   let offset = $state(0)
   const limit = 20
 
   $effect(() => {
-    if (!auth.loading && !auth.session) {
-      navigate('/login')
+    if (!authLoading && !session) {
+      navigate(routes.login)
     }
   })
 
   $effect(() => {
-    if (auth.session) {
+    if (session) {
       loadAuditLog()
     }
   })
 
   async function loadAuditLog() {
-    if (!auth.session) return
+    if (!session) return
     loading = true
-    error = null
 
     try {
       const response = await fetch(
         `/xrpc/_delegation.getAuditLog?limit=${limit}&offset=${offset}`,
         {
-          headers: { 'Authorization': `Bearer ${auth.session.accessJwt}` }
+          headers: { 'Authorization': `Bearer ${session.accessJwt}` }
         }
       )
 
       if (!response.ok) {
         const data = await response.json()
-        error = data.message || data.error || $_('delegation.failedToLoadAuditLog')
+        toast.error(data.message || data.error || $_('delegation.failedToLoadAuditLog'))
         return
       }
 
···
       entries = data.entries || []
       total = data.total || 0
     } catch (e) {
-      error = $_('delegation.failedToLoadAuditLog')
+      toast.error($_('delegation.failedToLoadAuditLog'))
     } finally {
       loading = false
     }
···
 
   function formatActionDetails(details: Record<string, unknown> | null): string {
     if (!details) return ''
-    const parts: string[] = []
-    for (const [key, value] of Object.entries(details)) {
-      const formattedKey = key.replace(/_/g, ' ')
-      parts.push(`${formattedKey}: ${JSON.stringify(value)}`)
-    }
-    return parts.join(', ')
+    return Object.entries(details)
+      .map(([key, value]) => `${key.replace(/_/g, ' ')}: ${JSON.stringify(value)}`)
+      .join(', ')
   }
 
   function truncateDid(did: string): string {
···
   </header>
 
   {#if loading}
-    <p class="loading">{$_('delegation.loading')}</p>
+    <div class="skeleton-list">
+      {#each Array(3) as _}
+        <div class="skeleton-entry"></div>
+      {/each}
+    </div>
   {:else}
-    {#if error}
-      <div class="message error">{error}</div>
-    {/if}
-
     {#if entries.length === 0}
       <p class="empty">{$_('delegation.noActivity')}</p>
     {:else}
···
   .actions-bar button {
     padding: var(--space-2) var(--space-4);
     font-size: var(--text-sm);
+  }
+
+  .skeleton-list {
+    display: flex;
+    flex-direction: column;
+    gap: var(--space-3);
+  }
+
+  .skeleton-entry {
+    height: 100px;
+    background: var(--bg-secondary);
+    border: 1px solid var(--border-color);
+    border-radius: var(--radius-lg);
+    animation: skeleton-pulse 1.5s ease-in-out infinite;
+  }
+
+  @keyframes skeleton-pulse {
+    0%, 100% { opacity: 1; }
+    50% { opacity: 0.5; }
   }
 </style>

frontend/src/routes/DidDocumentEditor.svelte

···
 <script lang="ts">
   import { onMount } from 'svelte'
   import { getAuthState } from '../lib/auth.svelte'
-  import { navigate } from '../lib/router.svelte'
+  import { navigate, routes, getFullUrl } from '../lib/router.svelte'
   import { api, ApiError, type VerificationMethod, type DidDocument } from '../lib/api'
   import { _ } from '../lib/i18n'
+  import type { Session } from '../lib/types/api'
+  import { toast } from '../lib/toast.svelte'
 
-  const auth = getAuthState()
+  const auth = $derived(getAuthState())
+
+  function getSession(): Session | null {
+    return auth.kind === 'authenticated' ? auth.session : null
+  }
+
+  function isLoading(): boolean {
+    return auth.kind === 'loading'
+  }
+
+  const session = $derived(getSession())
+  const authLoading = $derived(isLoading())
 
   let loading = $state(true)
   let saving = $state(false)
-  let message = $state<{ type: 'success' | 'error'; text: string } | null>(null)
   let didDocument = $state<DidDocument | null>(null)
   let verificationMethods = $state<VerificationMethod[]>([])
   let alsoKnownAs = $state<string[]>([])
···
   let newHandle = $state('')
 
   $effect(() => {
-    if (!auth.loading && !auth.session) {
-      navigate('/login')
+    if (!authLoading && !session) {
+      navigate(routes.login)
     }
   })
 
   onMount(async () => {
-    if (!auth.session) return
+    if (!session) return
     try {
-      didDocument = await api.getDidDocument(auth.session.accessJwt)
+      didDocument = await api.getDidDocument(session.accessJwt)
       verificationMethods = didDocument.verificationMethod.map(vm => ({
         id: vm.id.replace(didDocument!.id, ''),
         type: vm.type,
···
       const pdsService = didDocument.service.find(s => s.id === '#atproto_pds')
       serviceEndpoint = pdsService?.serviceEndpoint || ''
     } catch (e) {
-      showMessage('error', e instanceof ApiError ? e.message : $_('didEditor.loadFailed'))
+      toast.error(e instanceof ApiError ? e.message : $_('didEditor.loadFailed'))
     } finally {
       loading = false
     }
   })
 
-  function showMessage(type: 'success' | 'error', text: string) {
-    message = { type, text }
-    setTimeout(() => {
-      if (message?.text === text) message = null
-    }, 5000)
-  }
-
   function addVerificationMethod() {
     if (!newKeyId || !newKeyPublic) return
     if (!newKeyPublic.startsWith('z')) {
-      showMessage('error', $_('didEditor.invalidMultibase'))
+      toast.error($_('didEditor.invalidMultibase'))
       return
     }
     verificationMethods = [...verificationMethods, {
···
   function addHandle() {
     if (!newHandle) return
     if (!newHandle.startsWith('at://')) {
-      showMessage('error', $_('didEditor.invalidHandle'))
+      toast.error($_('didEditor.invalidHandle'))
       return
     }
     alsoKnownAs = [...alsoKnownAs, newHandle]
···
   }
 
   async function handleSave() {
-    if (!auth.session) return
+    if (!session) return
     saving = true
-    message = null
     try {
-      await api.updateDidDocument(auth.session.accessJwt, {
+      await api.updateDidDocument(session.accessJwt, {
         verificationMethods: verificationMethods.length > 0 ? verificationMethods : undefined,
         alsoKnownAs: alsoKnownAs.length > 0 ? alsoKnownAs : undefined,
         serviceEndpoint: serviceEndpoint || undefined
       })
-      showMessage('success', $_('didEditor.success'))
-      didDocument = await api.getDidDocument(auth.session.accessJwt)
+      toast.success($_('didEditor.success'))
+      didDocument = await api.getDidDocument(session.accessJwt)
     } catch (e) {
-      showMessage('error', e instanceof ApiError ? e.message : $_('didEditor.saveFailed'))
+      toast.error(e instanceof ApiError ? e.message : $_('didEditor.saveFailed'))
     } finally {
       saving = false
     }
···
     <h1>{$_('didEditor.title')}</h1>
   </header>
 
-  {#if message}
-    <div class="message {message.type}">{message.text}</div>
-  {/if}
-
   {#if loading}
-    <div class="loading">{$_('common.loading')}</div>
+    <div class="skeleton-sections">
+      <div class="skeleton-section small"></div>
+      <div class="skeleton-section large"></div>
+      <div class="skeleton-section"></div>
+      <div class="skeleton-section"></div>
+    </div>
   {:else}
     <div class="help-section">
       <h3>{$_('didEditor.helpTitle')}</h3>
···
     .add-btn {
       width: 100%;
     }
+  }
+
+  .skeleton-sections {
+    display: flex;
+    flex-direction: column;
+    gap: var(--space-6);
+  }
+
+  .skeleton-section {
+    height: 180px;
+    background: var(--bg-secondary);
+    border-radius: var(--radius-xl);
+    animation: skeleton-pulse 1.5s ease-in-out infinite;
+  }
+
+  .skeleton-section.small {
+    height: 80px;
+  }
+
+  .skeleton-section.large {
+    height: 250px;
+  }
+
+  @keyframes skeleton-pulse {
+    0%, 100% { opacity: 1; }
+    50% { opacity: 0.5; }
   }
 </style>

frontend/src/routes/InviteCodes.svelte

···
 <script lang="ts">
   import { getAuthState } from '../lib/auth.svelte'
-  import { navigate } from '../lib/router.svelte'
+  import { navigate, routes, getFullUrl } from '../lib/router.svelte'
   import { api, type InviteCode, ApiError } from '../lib/api'
   import { _ } from '../lib/i18n'
   import { formatDate } from '../lib/date'
   import { onMount } from 'svelte'
+  import type { Session } from '../lib/types/api'
+  import { toast } from '../lib/toast.svelte'
 
-  const auth = getAuthState()
+  const auth = $derived(getAuthState())
+
+  function getSession(): Session | null {
+    return auth.kind === 'authenticated' ? auth.session : null
+  }
+
+  function isLoading(): boolean {
+    return auth.kind === 'loading'
+  }
+
+  const session = $derived(getSession())
+  const authLoading = $derived(isLoading())
   let codes = $state<InviteCode[]>([])
   let loading = $state(true)
-  let error = $state<string | null>(null)
   let creating = $state(false)
   let createdCode = $state<string | null>(null)
   let createdCodeCopied = $state(false)
···
       const serverInfo = await api.describeServer()
       inviteCodesEnabled = serverInfo.inviteCodeRequired
       if (!serverInfo.inviteCodeRequired) {
-        navigate('/dashboard')
+        navigate(routes.dashboard)
       }
     } catch {
-      navigate('/dashboard')
+      navigate(routes.dashboard)
     }
   })
 
   $effect(() => {
-    if (!auth.loading && !auth.session) {
-      navigate('/login')
+    if (!authLoading && !session) {
+      navigate(routes.login)
     }
   })
   $effect(() => {
-    if (auth.session && inviteCodesEnabled) {
+    if (session && inviteCodesEnabled) {
       loadCodes()
     }
   })
   async function loadCodes() {
-    if (!auth.session) return
+    if (!session) return
     loading = true
-    error = null
     try {
-      const result = await api.getAccountInviteCodes(auth.session.accessJwt)
+      const result = await api.getAccountInviteCodes(session.accessJwt)
       codes = result.codes
     } catch (e) {
-      error = e instanceof ApiError ? e.message : 'Failed to load invite codes'
+      toast.error(e instanceof ApiError ? e.message : $_('inviteCodes.failedToLoad'))
     } finally {
       loading = false
     }
   }
   async function handleCreate() {
-    if (!auth.session) return
+    if (!session) return
     creating = true
-    error = null
     try {
-      const result = await api.createInviteCode(auth.session.accessJwt, 1)
+      const result = await api.createInviteCode(session.accessJwt, 1)
       createdCode = result.code
       await loadCodes()
     } catch (e) {
-      error = e instanceof ApiError ? e.message : 'Failed to create invite code'
+      toast.error(e instanceof ApiError ? e.message : $_('inviteCodes.failedToCreate'))
     } finally {
       creating = false
     }
···
 </script>
 <div class="page">
   <header>
-    <a href="/app/dashboard" class="back">{$_('common.backToDashboard')}</a>
+    <a href={getFullUrl(routes.dashboard)} class="back">{$_('common.backToDashboard')}</a>
     <h1>{$_('inviteCodes.title')}</h1>
   </header>
   <p class="description">
     {$_('inviteCodes.description')}
   </p>
-  {#if error}
-    <div class="error">{error}</div>
-  {/if}
   {#if createdCode}
     <div class="created-code">
       <h3>{$_('inviteCodes.created')}</h3>
···
       <button onclick={dismissCreated}>{$_('common.done')}</button>
     </div>
   {/if}
-  {#if auth.session?.isAdmin}
+  {#if session?.isAdmin}
     <section class="create-section">
       <button onclick={handleCreate} disabled={creating}>
         {creating ? $_('common.creating') : $_('inviteCodes.createNew')}
···
   <section class="list-section">
     <h2>{$_('inviteCodes.yourCodes')}</h2>
     {#if loading}
-      <p class="empty">{$_('common.loading')}</p>
+      <ul class="code-list">
+        {#each Array(2) as _}
+          <li class="skeleton-item"></li>
+        {/each}
+      </ul>
     {:else if codes.length === 0}
       <p class="empty">{$_('inviteCodes.noCodes')}</p>
     {:else}
···
     color: var(--text-secondary);
     text-align: center;
     padding: var(--space-7);
+  }
+
+  .skeleton-item {
+    height: 50px;
+    background: var(--bg-tertiary);
+    animation: skeleton-pulse 1.5s ease-in-out infinite;
+  }
+
+  @keyframes skeleton-pulse {
+    0%, 100% { opacity: 1; }
+    50% { opacity: 0.5; }
   }
 </style>

frontend/src/routes/Login.svelte

···
 <script lang="ts">
-  import { loginWithOAuth, confirmSignup, resendVerification, getAuthState, switchAccount, forgetAccount } from '../lib/auth.svelte'
-  import { navigate } from '../lib/router.svelte'
+  import {
+    loginWithOAuth,
+    confirmSignup,
+    resendVerification,
+    getAuthState,
+    switchAccount,
+    forgetAccount,
+    matchAuthState,
+    type SavedAccount,
+    type AuthError,
+  } from '../lib/auth.svelte'
+  import { navigate, routes } from '../lib/router.svelte'
   import { _ } from '../lib/i18n'
+  import { isOk, isErr } from '../lib/types/result'
+  import { unsafeAsDid, type Did } from '../lib/types/branded'
 
+  type PageState =
+    | { kind: 'login' }
+    | { kind: 'verification'; did: string }
+
+  let pageState = $state<PageState>({ kind: 'login' })
   let submitting = $state(false)
-  let pendingVerification = $state<{ did: string } | null>(null)
   let verificationCode = $state('')
   let resendingCode = $state(false)
   let resendMessage = $state<string | null>(null)
   let autoRedirectAttempted = $state(false)
-  const auth = getAuthState()
+
+  const auth = $derived(getAuthState())
+
+  function getSavedAccounts(): readonly SavedAccount[] {
+    return auth.savedAccounts
+  }
+
+  function getErrorMessage(): string | null {
+    if (auth.kind === 'error') {
+      return auth.error.message
+    }
+    return null
+  }
+
+  function isLoading(): boolean {
+    return auth.kind === 'loading'
+  }
 
   $effect(() => {
-    if (!auth.loading && !auth.error && auth.savedAccounts.length === 0 && !pendingVerification && !autoRedirectAttempted) {
+    const accounts = getSavedAccounts()
+    const loading = isLoading()
+    const hasError = auth.kind === 'error'
+
+    if (!loading && !hasError && accounts.length === 0 && pageState.kind === 'login' && !autoRedirectAttempted) {
       autoRedirectAttempted = true
       loginWithOAuth()
     }
   })
 
-  async function handleSwitchAccount(did: string) {
+  async function handleSwitchAccount(did: Did) {
     submitting = true
-    try {
-      await switchAccount(did)
-      navigate('/dashboard')
-    } catch {
+    const result = await switchAccount(did)
+    if (isOk(result)) {
+      navigate(routes.dashboard)
+    } else {
       submitting = false
     }
   }
 
-  function handleForgetAccount(did: string, e: Event) {
+  function handleForgetAccount(did: Did, e: Event) {
     e.stopPropagation()
     forgetAccount(did)
   }
 
   async function handleOAuthLogin() {
     submitting = true
-    try {
-      await loginWithOAuth()
-    } catch {
+    const result = await loginWithOAuth()
+    if (isErr(result)) {
       submitting = false
     }
   }
 
   async function handleVerification(e: Event) {
     e.preventDefault()
-    if (!pendingVerification || !verificationCode.trim()) return
+    if (pageState.kind !== 'verification' || !verificationCode.trim()) return
+
     submitting = true
-    try {
-      await confirmSignup(pendingVerification.did, verificationCode.trim())
-      navigate('/dashboard')
-    } catch {
+    const result = await confirmSignup(pageState.did, verificationCode.trim())
+    if (isOk(result)) {
+      navigate(routes.dashboard)
+    } else {
       submitting = false
     }
   }
 
   async function handleResendCode() {
-    if (!pendingVerification || resendingCode) return
+    if (pageState.kind !== 'verification' || resendingCode) return
+
     resendingCode = true
     resendMessage = null
-    try {
-      await resendVerification(pendingVerification.did)
+    const result = await resendVerification(pageState.did)
+    if (isOk(result)) {
       resendMessage = $_('verification.resent')
-    } catch {
-      resendMessage = null
-    } finally {
-      resendingCode = false
     }
+    resendingCode = false
   }
 
   function backToLogin() {
-    pendingVerification = null
+    pageState = { kind: 'login' }
     verificationCode = ''
     resendMessage = null
   }
+
+  const errorMessage = $derived(getErrorMessage())
+  const savedAccounts = $derived(getSavedAccounts())
+  const loading = $derived(isLoading())
 </script>
 
 <div class="login-page">
-  {#if auth.error}
-    <div class="message error">{auth.error}</div>
+  {#if errorMessage}
+    <div class="message error">{errorMessage}</div>
   {/if}
 
-  {#if pendingVerification}
+  {#if pageState.kind === 'verification'}
     <header class="page-header">
       <h1>{$_('verification.title')}</h1>
       <p class="subtitle">{$_('verification.subtitle')}</p>
···
   {:else}
     <header class="page-header">
       <h1>{$_('login.title')}</h1>
-      <p class="subtitle">{auth.savedAccounts.length > 0 ? $_('login.chooseAccount') : $_('login.subtitle')}</p>
+      <p class="subtitle">{savedAccounts.length > 0 ? $_('login.chooseAccount') : $_('login.subtitle')}</p>
     </header>
 
     <div class="split-layout sidebar-right">
       <div class="main-section">
-        {#if auth.savedAccounts.length > 0}
+        {#if savedAccounts.length > 0}
           <div class="saved-accounts">
-            {#each auth.savedAccounts as account}
+            {#each savedAccounts as account}
               <div
                 class="account-item"
                 class:disabled={submitting}
···
           <p class="or-divider">{$_('login.signInToAnother')}</p>
         {/if}
 
-        <button type="button" class="oauth-btn" onclick={handleOAuthLogin} disabled={submitting || auth.loading}>
+        <button type="button" class="oauth-btn" onclick={handleOAuthLogin} disabled={submitting || loading}>
           {submitting ? $_('login.redirecting') : $_('login.button')}
         </button>
 
···
       </div>
 
       <aside class="info-panel">
-        {#if auth.savedAccounts.length > 0}
+        {#if savedAccounts.length > 0}
           <h3>{$_('login.infoSavedAccountsTitle')}</h3>
           <p>{$_('login.infoSavedAccountsDesc')}</p>
 

frontend/src/routes/Migration.svelte

···
 <script lang="ts">
   import { setSession } from '../lib/auth.svelte'
-  import { navigate } from '../lib/router.svelte'
+  import { navigate, routes } from '../lib/router.svelte'
   import { _ } from '../lib/i18n'
   import {
     createInboundMigrationFlow,
···
         refreshJwt: '',
       })
     }
-    navigate('/dashboard')
+    navigate(routes.dashboard)
   }
 
   function handleOfflineComplete() {
···
         refreshJwt: '',
       })
     }
-    navigate('/dashboard')
+    navigate(routes.dashboard)
   }
 </script>
 

frontend/src/routes/OAuth2FA.svelte

···
 <script lang="ts">
-  import { navigate } from '../lib/router.svelte'
+  import { navigate, routes } from '../lib/router.svelte'
   import { _ } from '../lib/i18n'
 
   let code = $state('')
···
   function handleCancel() {
     const requestUri = getRequestUri()
     if (requestUri) {
-      navigate(`/oauth/login?request_uri=${encodeURIComponent(requestUri)}`)
+      navigate(routes.oauthLogin, { params: { request_uri: requestUri } })
     } else {
       window.history.back()
     }

frontend/src/routes/OAuthAccounts.svelte

···
 <script lang="ts">
-  import { navigate } from '../lib/router.svelte'
+  import { navigate, routes } from '../lib/router.svelte'
   import { _ } from '../lib/i18n'
 
   interface AccountInfo {
···
       }
 
       if (data.needs_totp) {
-        navigate(`/oauth/totp?request_uri=${encodeURIComponent(requestUri)}`)
+        navigate(routes.oauthTotp, { params: { request_uri: requestUri } })
         return
       }
 
       if (data.needs_2fa) {
-        navigate(`/oauth/2fa?request_uri=${encodeURIComponent(requestUri)}&channel=${encodeURIComponent(data.channel || '')}`)
+        navigate(routes.oauth2fa, { params: { request_uri: requestUri, channel: data.channel || '' } })
         return
       }
 
···
   function handleDifferentAccount() {
     const requestUri = getRequestUri()
     if (requestUri) {
-      navigate(`/oauth/login?request_uri=${encodeURIComponent(requestUri)}`)
+      navigate(routes.oauthLogin, { params: { request_uri: requestUri } })
     } else {
-      navigate('/oauth/login')
+      navigate(routes.oauthLogin)
     }
   }
 
···
 
 <div class="oauth-accounts-container">
   {#if loading}
-    <div class="loading">
-      <p>{$_('common.loading')}</p>
-    </div>
+    <div class="loading"></div>
   {:else if error}
     <div class="error-container">
       <h1>Error</h1>

frontend/src/routes/OAuthConsent.svelte

···
 <script lang="ts">
-  import { navigate } from '../lib/router.svelte'
+  import { navigate, routes, getFullUrl } from '../lib/router.svelte'
   import { _ } from '../lib/i18n'
 
   interface ScopeInfo {
···
       const data: ConsentData = await response.json()
       consentData = data
 
-      for (const scope of data.scopes) {
-        if (scope.required) {
-          scopeSelections[scope.scope] = true
-        } else if (scope.granted !== null) {
-          scopeSelections[scope.scope] = scope.granted
-        } else {
-          scopeSelections[scope.scope] = true
-        }
-      }
+      scopeSelections = Object.fromEntries(
+        data.scopes.map((scope) => [
+          scope.scope,
+          scope.required ? true : scope.granted ?? true,
+        ])
+      )
 
       if (!data.show_consent) {
         await submitConsent()
···
   }
 
   function groupScopesByCategory(scopes: ScopeInfo[]): Record<string, ScopeInfo[]> {
-    const groups: Record<string, ScopeInfo[]> = {}
-    for (const scope of scopes) {
-      if (!groups[scope.category]) {
-        groups[scope.category] = []
-      }
-      groups[scope.category].push(scope)
-    }
-    return groups
+    return scopes.reduce(
+      (groups, scope) => ({
+        ...groups,
+        [scope.category]: [...(groups[scope.category] ?? []), scope],
+      }),
+      {} as Record<string, ScopeInfo[]>
+    )
   }
 
   $effect(() => {
···
 
 <div class="consent-container">
   {#if loading}
-    <div class="loading">
-      <p>{$_('common.loading')}</p>
-    </div>
+    <div class="loading"></div>
   {:else if error}
     <div class="error-container">
       <h1>{$_('oauth.error.title')}</h1>
       <div class="error">{error}</div>
-      <button type="button" onclick={() => navigate('/login')}>
+      <button type="button" onclick={() => navigate(routes.login)}>
         {$_('common.backToLogin')}
       </button>
     </div>

frontend/src/routes/OAuthDelegation.svelte

···
 <script lang="ts">
-  import { navigate } from '../lib/router.svelte'
+  import { navigate, routes } from '../lib/router.svelte'
   import { _ } from '../lib/i18n'
+  import {
+    prepareRequestOptions,
+    serializeAssertionResponse,
+    type WebAuthnRequestOptionsResponse,
+  } from '../lib/webauthn'
 
   let delegatedDid = $state<string | null>(null)
   let delegatedHandle = $state<string | null>(null)
···
     }
   }
 
-  function arrayBufferToBase64Url(buffer: ArrayBuffer): string {
-    const bytes = new Uint8Array(buffer)
-    let binary = ''
-    for (let i = 0; i < bytes.byteLength; i++) {
-      binary += String.fromCharCode(bytes[i])
-    }
-    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '')
-  }
-
-  function base64UrlToArrayBuffer(base64url: string): ArrayBuffer {
-    const base64 = base64url.replace(/-/g, '+').replace(/_/g, '/')
-    const padded = base64 + '='.repeat((4 - base64.length % 4) % 4)
-    const binary = atob(padded)
-    const bytes = new Uint8Array(binary.length)
-    for (let i = 0; i < binary.length; i++) {
-      bytes[i] = binary.charCodeAt(i)
-    }
-    return bytes.buffer
-  }
-
-  function prepareCredentialRequestOptions(options: any): PublicKeyCredentialRequestOptions {
-    return {
-      ...options,
-      challenge: base64UrlToArrayBuffer(options.challenge),
-      allowCredentials: options.allowCredentials?.map((cred: any) => ({
-        ...cred,
-        id: base64UrlToArrayBuffer(cred.id)
-      })) || []
-    }
-  }
-
   async function handlePasskeyLogin() {
     const requestUri = getRequestUri()
     if (!requestUri || !controllerDid || !delegatedDid) {
···
       }
 
       const { options } = await startResponse.json()
+      const publicKeyOptions = prepareRequestOptions(options as WebAuthnRequestOptionsResponse)
 
       const credential = await navigator.credentials.get({
-        publicKey: prepareCredentialRequestOptions(options.publicKey)
+        publicKey: publicKeyOptions
       }) as PublicKeyCredential | null
 
       if (!credential) {
···
         return
       }
 
-      const assertionResponse = credential.response as AuthenticatorAssertionResponse
-      const credentialData = {
-        id: credential.id,
-        type: credential.type,
-        rawId: arrayBufferToBase64Url(credential.rawId),
-        response: {
-          clientDataJSON: arrayBufferToBase64Url(assertionResponse.clientDataJSON),
-          authenticatorData: arrayBufferToBase64Url(assertionResponse.authenticatorData),
-          signature: arrayBufferToBase64Url(assertionResponse.signature),
-          userHandle: assertionResponse.userHandle ? arrayBufferToBase64Url(assertionResponse.userHandle) : null
-        }
-      }
+      const credentialData = serializeAssertionResponse(credential)
 
       const finishResponse = await fetch('/oauth/passkey/finish', {
         method: 'POST',
···
       }
 
       if (data.needs_totp) {
-        navigate(`/oauth/totp?request_uri=${encodeURIComponent(requestUri)}`)
+        navigate(routes.oauthTotp, { params: { request_uri: requestUri } })
         return
       }
 
       if (data.needs_2fa) {
-        navigate(`/oauth/2fa?request_uri=${encodeURIComponent(requestUri)}&channel=${encodeURIComponent(data.channel || '')}`)
+        navigate(routes.oauth2fa, { params: { request_uri: requestUri, channel: data.channel || '' } })
         return
       }
 
···
       }
 
       if (data.needs_totp) {
-        navigate(`/oauth/totp?request_uri=${encodeURIComponent(requestUri)}`)
+        navigate(routes.oauthTotp, { params: { request_uri: requestUri } })
         return
       }
 
       if (data.needs_2fa) {
-        navigate(`/oauth/2fa?request_uri=${encodeURIComponent(requestUri)}&channel=${encodeURIComponent(data.channel || '')}`)
+        navigate(routes.oauth2fa, { params: { request_uri: requestUri, channel: data.channel || '' } })
         return
       }
 

frontend/src/routes/OAuthLogin.svelte

···
 <script lang="ts">
-  import { navigate } from '../lib/router.svelte'
+  import { navigate, routes, getFullUrl } from '../lib/router.svelte'
   import { _ } from '../lib/i18n'
+  import {
+    prepareRequestOptions,
+    serializeAssertionResponse,
+    type WebAuthnRequestOptionsResponse,
+  } from '../lib/webauthn'
 
   let username = $state('')
   let password = $state('')
···
         if (!hasPassword && !hasPasskeys && isDelegated && data.did) {
           const requestUri = getRequestUri()
           if (requestUri) {
-            navigate(`/oauth/delegation?request_uri=${encodeURIComponent(requestUri)}&delegated_did=${encodeURIComponent(data.did)}`)
+            navigate(routes.oauthDelegation, { params: { request_uri: requestUri, delegated_did: data.did } })
             return
           }
         }
···
       }
 
       const { options } = await startResponse.json()
+      const publicKeyOptions = prepareRequestOptions(options as WebAuthnRequestOptionsResponse)
 
       const credential = await navigator.credentials.get({
-        publicKey: prepareCredentialRequestOptions(options.publicKey)
+        publicKey: publicKeyOptions
       }) as PublicKeyCredential | null
 
       if (!credential) {
···
         return
       }
 
-      const assertionResponse = credential.response as AuthenticatorAssertionResponse
-      const credentialData = {
-        id: credential.id,
-        type: credential.type,
-        rawId: arrayBufferToBase64Url(credential.rawId),
-        response: {
-          clientDataJSON: arrayBufferToBase64Url(assertionResponse.clientDataJSON),
-          authenticatorData: arrayBufferToBase64Url(assertionResponse.authenticatorData),
-          signature: arrayBufferToBase64Url(assertionResponse.signature),
-          userHandle: assertionResponse.userHandle ? arrayBufferToBase64Url(assertionResponse.userHandle) : null
-        }
-      }
+      const credentialData = serializeAssertionResponse(credential)
 
       const finishResponse = await fetch('/oauth/passkey/finish', {
         method: 'POST',
···
       }
 
       if (data.needs_totp) {
-        navigate(`/oauth/totp?request_uri=${encodeURIComponent(requestUri)}`)
+        navigate(routes.oauthTotp, { params: { request_uri: requestUri } })
         return
       }
 
       if (data.needs_2fa) {
-        navigate(`/oauth/2fa?request_uri=${encodeURIComponent(requestUri)}&channel=${encodeURIComponent(data.channel || '')}`)
+        navigate(routes.oauth2fa, { params: { request_uri: requestUri, channel: data.channel || '' } })
         return
       }
 
···
     }
   }
 
-  function arrayBufferToBase64Url(buffer: ArrayBuffer): string {
-    const bytes = new Uint8Array(buffer)
-    let binary = ''
-    for (let i = 0; i < bytes.byteLength; i++) {
-      binary += String.fromCharCode(bytes[i])
-    }
-    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '')
-  }
-
-  function base64UrlToArrayBuffer(base64url: string): ArrayBuffer {
-    const base64 = base64url.replace(/-/g, '+').replace(/_/g, '/')
-    const padded = base64 + '='.repeat((4 - base64.length % 4) % 4)
-    const binary = atob(padded)
-    const bytes = new Uint8Array(binary.length)
-    for (let i = 0; i < binary.length; i++) {
-      bytes[i] = binary.charCodeAt(i)
-    }
-    return bytes.buffer
-  }
-
-  function prepareCredentialRequestOptions(options: any): PublicKeyCredentialRequestOptions {
-    return {
-      ...options,
-      challenge: base64UrlToArrayBuffer(options.challenge),
-      allowCredentials: options.allowCredentials?.map((cred: any) => ({
-        ...cred,
-        id: base64UrlToArrayBuffer(cred.id)
-      })) || []
-    }
-  }
-
   async function handleSubmit(e: Event) {
     e.preventDefault()
     const requestUri = getRequestUri()
···
       }
 
       if (data.needs_totp) {
-        navigate(`/oauth/totp?request_uri=${encodeURIComponent(requestUri)}`)
+        navigate(routes.oauthTotp, { params: { request_uri: requestUri } })
         return
       }
 
       if (data.needs_2fa) {
-        navigate(`/oauth/2fa?request_uri=${encodeURIComponent(requestUri)}&channel=${encodeURIComponent(data.channel || '')}`)
+        navigate(routes.oauth2fa, { params: { request_uri: requestUri, channel: data.channel || '' } })
         return
       }
 
···
   </form>
 
   <p class="help-links">
-    <a href="/app/reset-password">{$_('login.forgotPassword')}</a> &middot; <a href="/app/request-passkey-recovery">{$_('login.lostPasskey')}</a>
+    <a href={getFullUrl(routes.resetPassword)}>{$_('login.forgotPassword')}</a> &middot; <a href={getFullUrl(routes.requestPasskeyRecovery)}>{$_('login.lostPasskey')}</a>
   </p>
 </div>
 

frontend/src/routes/OAuthPasskey.svelte

···
 <script lang="ts">
-  import { navigate } from '../lib/router.svelte'
+  import { navigate, routes } from '../lib/router.svelte'
   import { _ } from '../lib/i18n'
+  import {
+    prepareRequestOptions,
+    serializeAssertionResponse,
+    type WebAuthnRequestOptionsResponse,
+  } from '../lib/webauthn'
 
   let loading = $state(false)
   let error = $state<string | null>(null)
···
 
   const t = $_
 
-  function arrayBufferToBase64Url(buffer: ArrayBuffer): string {
-    const bytes = new Uint8Array(buffer)
-    let binary = ''
-    for (let i = 0; i < bytes.byteLength; i++) {
-      binary += String.fromCharCode(bytes[i])
-    }
-    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '')
-  }
-
-  function base64UrlToArrayBuffer(base64url: string): ArrayBuffer {
-    const base64 = base64url.replace(/-/g, '+').replace(/_/g, '/')
-    const padded = base64 + '='.repeat((4 - base64.length % 4) % 4)
-    const binary = atob(padded)
-    const bytes = new Uint8Array(binary.length)
-    for (let i = 0; i < binary.length; i++) {
-      bytes[i] = binary.charCodeAt(i)
-    }
-    return bytes.buffer
-  }
-
-  function prepareAuthOptions(options: any): PublicKeyCredentialRequestOptions {
-    return {
-      ...options.publicKey,
-      challenge: base64UrlToArrayBuffer(options.publicKey.challenge),
-      allowCredentials: options.publicKey.allowCredentials?.map((cred: any) => ({
-        ...cred,
-        id: base64UrlToArrayBuffer(cred.id)
-      })) || []
-    }
-  }
-
   async function startPasskeyAuth() {
     const requestUri = getRequestUri()
     if (!requestUri) {
···
       }
 
       const { options } = await startResponse.json()
-      const publicKeyOptions = prepareAuthOptions(options)
+      const publicKeyOptions = prepareRequestOptions(options as WebAuthnRequestOptionsResponse)
 
       const credential = await navigator.credentials.get({
         publicKey: publicKeyOptions
···
         return
       }
 
-      const pkCredential = credential as PublicKeyCredential
-      const response = pkCredential.response as AuthenticatorAssertionResponse
-      const credentialResponse = {
-        id: pkCredential.id,
-        type: pkCredential.type,
-        rawId: arrayBufferToBase64Url(pkCredential.rawId),
-        response: {
-          clientDataJSON: arrayBufferToBase64Url(response.clientDataJSON),
-          authenticatorData: arrayBufferToBase64Url(response.authenticatorData),
-          signature: arrayBufferToBase64Url(response.signature),
-          userHandle: response.userHandle ? arrayBufferToBase64Url(response.userHandle) : null,
-        },
-      }
+      const credentialResponse = serializeAssertionResponse(credential as PublicKeyCredential)
 
       const finishResponse = await fetch('/oauth/authorize/passkey', {
         method: 'POST',
···
   function handleCancel() {
     const requestUri = getRequestUri()
     if (requestUri) {
-      navigate(`/oauth/login?request_uri=${encodeURIComponent(requestUri)}`)
+      navigate(routes.oauthLogin, { params: { request_uri: requestUri } })
     } else {
       window.history.back()
     }

frontend/src/routes/OAuthTotp.svelte

···
 <script lang="ts">
-  import { navigate } from '../lib/router.svelte'
+  import { navigate, routes } from '../lib/router.svelte'
   import { _ } from '../lib/i18n'
 
   let code = $state('')
···
   function handleCancel() {
     const requestUri = getRequestUri()
     if (requestUri) {
-      navigate(`/oauth/login?request_uri=${encodeURIComponent(requestUri)}`)
+      navigate(routes.oauthLogin, { params: { request_uri: requestUri } })
     } else {
       window.history.back()
     }

frontend/src/routes/RecoverPasskey.svelte

···
 <script lang="ts">
-  import { navigate } from '../lib/router.svelte'
+  import { navigate, routes } from '../lib/router.svelte'
   import { api, ApiError } from '../lib/api'
   import { _ } from '../lib/i18n'
 
···
   }
 
   function goToLogin() {
-    navigate('/login')
+    navigate(routes.login)
   }
 
   function requestNewLink() {
-    navigate('/login')
+    navigate(routes.login)
   }
 </script>
 

frontend/src/routes/Register.svelte

···
 <script lang="ts">
-  import { navigate } from '../lib/router.svelte'
+  import { navigate, routes, getFullUrl } from '../lib/router.svelte'
   import { api, ApiError } from '../lib/api'
   import { _ } from '../lib/i18n'
   import {
···
 
   $effect(() => {
     if (flow?.state.step === 'redirect-to-dashboard') {
-      navigate('/dashboard')
+      navigate(routes.dashboard)
     }
   })
 
···
     if (flow) {
       await flow.finalizeSession()
     }
-    navigate('/dashboard')
+    navigate(routes.dashboard)
   }
 
   function isChannelAvailable(ch: string): boolean {
···
   {/if}
 
   {#if loadingServerInfo || !flow}
-    <p class="loading">{$_('common.loading')}</p>
-
+    <div class="loading"></div>
   {:else if flow.state.step === 'info'}
     <div class="migrate-callout">
       <div class="migrate-icon">↗</div>
       <div class="migrate-content">
         <strong>{$_('register.migrateTitle')}</strong>
         <p>{$_('register.migrateDescription')}</p>
-        <a href="/app/migrate" class="migrate-link">
+        <a href={getFullUrl(routes.migrate)} class="migrate-link">
           {$_('register.migrateLink')} →
         </a>
       </div>
···
 
         <div class="form-links">
           <p class="link-text">
-            {$_('register.alreadyHaveAccount')} <a href="/app/login">{$_('register.signIn')}</a>
+            {$_('register.alreadyHaveAccount')} <a href={getFullUrl(routes.login)}>{$_('register.signIn')}</a>
           </p>
           <p class="link-text">
-            {$_('register.wantPasswordless')} <a href="/app/register-passkey">{$_('register.createPasskeyAccount')}</a>
+            {$_('register.wantPasswordless')} <a href={getFullUrl(routes.registerPasskey)}>{$_('register.createPasskeyAccount')}</a>
           </p>
         </div>
       </div>

frontend/src/routes/RegisterPasskey.svelte

···
     DidDocStep,
     AppPasswordStep,
   } from '../lib/registration'
+  import {
+    prepareCreationOptions,
+    serializeAttestationResponse,
+    type WebAuthnCreationOptionsResponse,
+  } from '../lib/webauthn'
 
   let serverInfo = $state<{
     availableUserDomains: string[]
···
     return null
   }
 
-  function arrayBufferToBase64Url(buffer: ArrayBuffer): string {
-    const bytes = new Uint8Array(buffer)
-    let binary = ''
-    for (let i = 0; i < bytes.byteLength; i++) {
-      binary += String.fromCharCode(bytes[i])
-    }
-    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '')
-  }
-
-  function base64UrlToArrayBuffer(base64url: string): ArrayBuffer {
-    const base64 = base64url.replace(/-/g, '+').replace(/_/g, '/')
-    const padded = base64 + '='.repeat((4 - base64.length % 4) % 4)
-    const binary = atob(padded)
-    const bytes = new Uint8Array(binary.length)
-    for (let i = 0; i < binary.length; i++) {
-      bytes[i] = binary.charCodeAt(i)
-    }
-    return bytes.buffer
-  }
-
-  function preparePublicKeyOptions(options: any): PublicKeyCredentialCreationOptions {
-    return {
-      ...options.publicKey,
-      challenge: base64UrlToArrayBuffer(options.publicKey.challenge),
-      user: {
-        ...options.publicKey.user,
-        id: base64UrlToArrayBuffer(options.publicKey.user.id)
-      },
-      excludeCredentials: options.publicKey.excludeCredentials?.map((cred: any) => ({
-        ...cred,
-        id: base64UrlToArrayBuffer(cred.id)
-      })) || []
-    }
-  }
-
   async function handleInfoSubmit(e: Event) {
     e.preventDefault()
     if (!flow) return
···
         passkeyName || undefined
       )
 
-      const publicKeyOptions = preparePublicKeyOptions(options)
+      const publicKeyOptions = prepareCreationOptions(options as WebAuthnCreationOptionsResponse)
       const credential = await navigator.credentials.create({
         publicKey: publicKeyOptions
       })
···
         return
       }
 
-      const pkCredential = credential as PublicKeyCredential
-      const response = pkCredential.response as AuthenticatorAttestationResponse
-      const credentialResponse = {
-        id: pkCredential.id,
-        type: pkCredential.type,
-        rawId: arrayBufferToBase64Url(pkCredential.rawId),
-        response: {
-          clientDataJSON: arrayBufferToBase64Url(response.clientDataJSON),
-          attestationObject: arrayBufferToBase64Url(response.attestationObject),
-        },
-      }
+      const credentialResponse = serializeAttestationResponse(credential as PublicKeyCredential)
 
       const result = await api.completePasskeySetup(
         flow.account.did,

frontend/src/routes/RepoExplorer.svelte

···
 <script lang="ts">
   import { getAuthState } from '../lib/auth.svelte'
-  import { navigate } from '../lib/router.svelte'
+  import { navigate, routes, getFullUrl } from '../lib/router.svelte'
   import { api, ApiError } from '../lib/api'
   import { _, locale } from '../lib/i18n'
-  const auth = getAuthState()
+  import type { Session } from '../lib/types/api'
+
+  const auth = $derived(getAuthState())
+
+  function getSession(): Session | null {
+    return auth.kind === 'authenticated' ? auth.session : null
+  }
+
+  function isLoading(): boolean {
+    return auth.kind === 'loading'
+  }
+
+  const session = $derived(getSession())
+  const authLoading = $derived(isLoading())
   type View = 'collections' | 'records' | 'record' | 'create'
   let view = $state<View>('collections')
   let collections = $state<string[]>([])
···
   let saving = $state(false)
   let filter = $state('')
   $effect(() => {
-    if (!auth.loading && !auth.session) {
-      navigate('/login')
+    if (!authLoading && !session) {
+      navigate(routes.login)
     }
   })
   $effect(() => {
-    if (auth.session) {
+    if (session) {
       loadCollections()
     }
   })
   async function loadCollections() {
-    if (!auth.session) return
+    if (!session) return
     loading = true
     error = null
     try {
-      const result = await api.describeRepo(auth.session.accessJwt, auth.session.did)
+      const result = await api.describeRepo(session.accessJwt, session.did)
       collections = result.collections.sort()
     } catch (e) {
       setError(e)
···
     }
   }
   async function selectCollection(collection: string) {
-    if (!auth.session) return
+    if (!session) return
     selectedCollection = collection
     records = []
     recordsCursor = undefined
···
     loading = true
     error = null
     try {
-      const result = await api.listRecords(auth.session.accessJwt, auth.session.did, collection, { limit: 50 })
+      const result = await api.listRecords(session.accessJwt, session.did, collection, { limit: 50 })
       records = result.records.map(r => ({
         ...r,
         rkey: r.uri.split('/').pop()!
···
     }
   }
   async function loadMoreRecords() {
-    if (!auth.session || !selectedCollection || !recordsCursor || loadingMore) return
+    if (!session || !selectedCollection || !recordsCursor || loadingMore) return
     loadingMore = true
     try {
-      const result = await api.listRecords(auth.session.accessJwt, auth.session.did, selectedCollection, {
+      const result = await api.listRecords(session.accessJwt, session.did, selectedCollection, {
         limit: 50,
         cursor: recordsCursor
       })
···
   }
   async function handleCreate(e: Event) {
     e.preventDefault()
-    if (!auth.session) return
+    if (!session) return
     const record = validateJson()
     if (!record) return
     if (!newCollection.trim()) {
···
     error = null
     try {
       const result = await api.createRecord(
-        auth.session.accessJwt,
-        auth.session.did,
+        session.accessJwt,
+        session.did,
         newCollection.trim(),
         record,
         newRkey.trim() || undefined
···
   }
   async function handleUpdate(e: Event) {
     e.preventDefault()
-    if (!auth.session || !selectedRecord || !selectedCollection) return
+    if (!session || !selectedRecord || !selectedCollection) return
     const record = validateJson()
     if (!record) return
     saving = true
     error = null
     try {
       await api.putRecord(
-        auth.session.accessJwt,
-        auth.session.did,
+        session.accessJwt,
+        session.did,
         selectedCollection,
         selectedRecord.rkey,
         record
       )
       success = $_('repoExplorer.recordUpdated')
       const updated = await api.getRecord(
-        auth.session.accessJwt,
-        auth.session.did,
+        session.accessJwt,
+        session.did,
         selectedCollection,
         selectedRecord.rkey
       )
···
     }
   }
   async function handleDelete() {
-    if (!auth.session || !selectedRecord || !selectedCollection) return
+    if (!session || !selectedRecord || !selectedCollection) return
     if (!confirm($_('repoExplorer.deleteConfirm', { values: { rkey: selectedRecord.rkey } }))) return
     saving = true
     error = null
     try {
       await api.deleteRecord(
-        auth.session.accessJwt,
-        auth.session.did,
+        session.accessJwt,
+        session.did,
         selectedCollection,
         selectedRecord.rkey
       )
···
       : records
   )
   function groupCollectionsByAuthority(cols: string[]): Map<string, string[]> {
-    const groups = new Map<string, string[]>()
-    for (const col of cols) {
+    return cols.reduce((groups, col) => {
       const parts = col.split('.')
       const authority = parts.slice(0, -1).join('.')
       const name = parts[parts.length - 1]
-      if (!groups.has(authority)) {
-        groups.set(authority, [])
-      }
-      groups.get(authority)!.push(name)
-    }
-    return groups
+      return groups.set(authority, [...(groups.get(authority) ?? []), name])
+    }, new Map<string, string[]>())
   }
   let groupedCollections = $derived(groupCollectionsByAuthority(filteredCollections))
 </script>
···
         {$_('repoExplorer.createRecord')}
       {/if}
     </h1>
-    {#if auth.session}
-      <p class="did">{auth.session.did}</p>
+    {#if session}
+      <p class="did">{session.did}</p>
     {/if}
   </header>
   {#if error}
···
     <div class="message success">{success}</div>
   {/if}
   {#if loading}
-    <p class="loading-text">{$_('common.loading')}</p>
+    <div class="skeleton-list">
+      {#each Array(4) as _}
+        <div class="skeleton-row"></div>
+      {/each}
+    </div>
   {:else if view === 'collections'}
     <div class="toolbar">
       <input
···
   .page ::-moz-selection {
     background: var(--accent);
     color: var(--text-inverse);
+  }
+
+  .skeleton-list {
+    display: flex;
+    flex-direction: column;
+    gap: var(--space-2);
+  }
+
+  .skeleton-row {
+    height: 44px;
+    background: var(--bg-secondary);
+    border-radius: var(--radius-md);
+    animation: skeleton-pulse 1.5s ease-in-out infinite;
+  }
+
+  @keyframes skeleton-pulse {
+    0%, 100% { opacity: 1; }
+    50% { opacity: 0.5; }
   }
 </style>

frontend/src/routes/RequestPasskeyRecovery.svelte

···
 <script lang="ts">
-  import { navigate } from '../lib/router.svelte'
+  import { navigate, routes, getFullUrl } from '../lib/router.svelte'
   import { api, ApiError } from '../lib/api'
   import { _ } from '../lib/i18n'
 
···
       <h1>{$_('requestPasskeyRecovery.successTitle')}</h1>
       <p class="subtitle">{$_('requestPasskeyRecovery.successMessage')}</p>
       <p class="info-text">{$_('requestPasskeyRecovery.successInfo')}</p>
-      <button onclick={() => navigate('/login')}>{$_('common.backToLogin')}</button>
+      <button onclick={() => navigate(routes.login)}>{$_('common.backToLogin')}</button>
     </div>
   {:else}
     <h1>{$_('requestPasskeyRecovery.title')}</h1>
···
   {/if}
 
   <p class="link-text">
-    <a href="/app/login">{$_('common.backToLogin')}</a>
+    <a href={getFullUrl(routes.login)}>{$_('common.backToLogin')}</a>
   </p>
 </div>
 

frontend/src/routes/ResetPassword.svelte

···
 <script lang="ts">
-  import { navigate } from '../lib/router.svelte'
+  import { navigate, routes, getFullUrl } from '../lib/router.svelte'
   import { api, ApiError } from '../lib/api'
   import { getAuthState } from '../lib/auth.svelte'
   import { _ } from '../lib/i18n'
+  import type { Session } from '../lib/types/api'
 
-  const auth = getAuthState()
+  const auth = $derived(getAuthState())
+
+  function getSession(): Session | null {
+    return auth.kind === 'authenticated' ? auth.session : null
+  }
+
+  const session = $derived(getSession())
 
   let email = $state('')
   let token = $state('')
···
   let tokenSent = $state(false)
 
   $effect(() => {
-    if (auth.session) {
-      navigate('/dashboard')
+    if (session) {
+      navigate(routes.dashboard)
     }
   })
 
···
     try {
       await api.resetPassword(token, newPassword)
       success = $_('resetPassword.success')
-      setTimeout(() => navigate('/login'), 2000)
+      setTimeout(() => navigate(routes.login), 2000)
     } catch (e) {
       error = e instanceof ApiError ? e.message : 'Failed to reset password'
     } finally {

frontend/src/routes/Security.svelte

···
 <script lang="ts">
   import { getAuthState, getValidToken } from '../lib/auth.svelte'
-  import { navigate } from '../lib/router.svelte'
+  import { navigate, routes, getFullUrl } from '../lib/router.svelte'
   import { api, ApiError } from '../lib/api'
   import ReauthModal from '../components/ReauthModal.svelte'
   import { _ } from '../lib/i18n'
   import { formatDate as formatDateUtil } from '../lib/date'
+  import type { Session } from '../lib/types/api'
+  import {
+    prepareCreationOptions,
+    serializeAttestationResponse,
+    type WebAuthnCreationOptionsResponse,
+  } from '../lib/webauthn'
+  import { toast } from '../lib/toast.svelte'
 
-  const auth = getAuthState()
-  let message = $state<{ type: 'success' | 'error'; text: string } | null>(null)
+  const auth = $derived(getAuthState())
+
+  function getSession(): Session | null {
+    return auth.kind === 'authenticated' ? auth.session : null
+  }
+
+  function isLoading(): boolean {
+    return auth.kind === 'loading'
+  }
+
+  const session = $derived(getSession())
+  const authLoading = $derived(isLoading())
+
   let loading = $state(true)
   let totpEnabled = $state(false)
   let hasBackupCodes = $state(false)
···
   let pendingAction = $state<(() => Promise<void>) | null>(null)
 
   $effect(() => {
-    if (!auth.loading && !auth.session) {
-      navigate('/login')
+    if (!authLoading && !session) {
+      navigate(routes.login)
     }
   })
 
   $effect(() => {
-    if (auth.session) {
+    if (session) {
       loadTotpStatus()
       loadPasskeys()
       loadPasswordStatus()
···
   })
 
   async function loadPasswordStatus() {
-    if (!auth.session) return
+    if (!session) return
     passwordLoading = true
     try {
-      const status = await api.getPasswordStatus(auth.session.accessJwt)
+      const status = await api.getPasswordStatus(session.accessJwt)
       hasPassword = status.hasPassword
     } catch {
       hasPassword = true
···
   }
 
   async function loadLegacyLoginPreference() {
-    if (!auth.session) return
+    if (!session) return
     legacyLoginLoading = true
     try {
-      const pref = await api.getLegacyLoginPreference(auth.session.accessJwt)
+      const pref = await api.getLegacyLoginPreference(session.accessJwt)
       allowLegacyLogin = pref.allowLegacyLogin
       hasMfa = pref.hasMfa
     } catch {
···
   }
 
   async function handleToggleLegacyLogin() {
-    if (!auth.session) return
+    if (!session) return
     legacyLoginUpdating = true
     try {
-      const result = await api.updateLegacyLoginPreference(auth.session.accessJwt, !allowLegacyLogin)
+      const result = await api.updateLegacyLoginPreference(session.accessJwt, !allowLegacyLogin)
       allowLegacyLogin = result.allowLegacyLogin
-      showMessage('success', allowLegacyLogin
+      toast.success(allowLegacyLogin
         ? $_('security.legacyLoginEnabled')
         : $_('security.legacyLoginDisabled'))
     } catch (e) {
···
           pendingAction = handleToggleLegacyLogin
           showReauthModal = true
         } else {
-          showMessage('error', e.message)
+          toast.error(e.message)
         }
       } else {
-        showMessage('error', $_('security.failedToUpdatePreference'))
+        toast.error($_('security.failedToUpdatePreference'))
       }
     } finally {
       legacyLoginUpdating = false
···
   }
 
   async function handleRemovePassword() {
-    if (!auth.session) return
+    if (!session) return
     removePasswordLoading = true
     try {
       const token = await getValidToken()
       if (!token) {
-        showMessage('error', $_('security.sessionExpired'))
+        toast.error($_('security.sessionExpired'))
         return
       }
       await api.removePassword(token)
       hasPassword = false
       showRemovePasswordForm = false
-      showMessage('success', $_('security.passwordRemoved'))
+      toast.success($_('security.passwordRemoved'))
     } catch (e) {
       if (e instanceof ApiError) {
         if (e.error === 'ReauthRequired') {
···
           pendingAction = handleRemovePassword
           showReauthModal = true
         } else {
-          showMessage('error', e.message)
+          toast.error(e.message)
         }
       } else {
-        showMessage('error', $_('security.failedToRemovePassword'))
+        toast.error($_('security.failedToRemovePassword'))
       }
     } finally {
       removePasswordLoading = false
···
   }
 
   async function loadTotpStatus() {
-    if (!auth.session) return
+    if (!session) return
     loading = true
     try {
-      const status = await api.getTotpStatus(auth.session.accessJwt)
+      const status = await api.getTotpStatus(session.accessJwt)
       totpEnabled = status.enabled
       hasBackupCodes = status.hasBackupCodes
     } catch {
-      showMessage('error', $_('security.failedToLoadTotpStatus'))
+      toast.error($_('security.failedToLoadTotpStatus'))
     } finally {
       loading = false
     }
   }
 
-  function showMessage(type: 'success' | 'error', text: string) {
-    message = { type, text }
-    setTimeout(() => {
-      if (message?.text === text) message = null
-    }, 5000)
-  }
-
   async function handleStartSetup() {
-    if (!auth.session) return
+    if (!session) return
     verifyLoading = true
     try {
-      const result = await api.createTotpSecret(auth.session.accessJwt)
+      const result = await api.createTotpSecret(session.accessJwt)
       qrBase64 = result.qrBase64
       totpUri = result.uri
       setupStep = 'qr'
     } catch (e) {
-      showMessage('error', e instanceof ApiError ? e.message : 'Failed to generate TOTP secret')
+      toast.error(e instanceof ApiError ? e.message : 'Failed to generate TOTP secret')
     } finally {
       verifyLoading = false
     }
···
 
   async function handleVerifySetup(e: Event) {
     e.preventDefault()
-    if (!auth.session || !verifyCode) return
+    if (!session || !verifyCode) return
     verifyLoading = true
     try {
-      const result = await api.enableTotp(auth.session.accessJwt, verifyCode)
+      const result = await api.enableTotp(session.accessJwt, verifyCode)
       backupCodes = result.backupCodes
       setupStep = 'backup'
       totpEnabled = true
       hasBackupCodes = true
       verifyCodeRaw = ''
     } catch (e) {
-      showMessage('error', e instanceof ApiError ? e.message : 'Invalid code. Please try again.')
+      toast.error(e instanceof ApiError ? e.message : 'Invalid code. Please try again.')
     } finally {
       verifyLoading = false
     }
···
     backupCodes = []
     qrBase64 = ''
     totpUri = ''
-    showMessage('success', $_('security.totpEnabledSuccess'))
+    toast.success($_('security.totpEnabledSuccess'))
   }
 
   async function handleDisable(e: Event) {
     e.preventDefault()
-    if (!auth.session || !disablePassword || !disableCode) return
+    if (!session || !disablePassword || !disableCode) return
     disableLoading = true
     try {
-      await api.disableTotp(auth.session.accessJwt, disablePassword, disableCode)
+      await api.disableTotp(session.accessJwt, disablePassword, disableCode)
       totpEnabled = false
       hasBackupCodes = false
       showDisableForm = false
       disablePassword = ''
       disableCode = ''
-      showMessage('success', $_('security.totpDisabledSuccess'))
+      toast.success($_('security.totpDisabledSuccess'))
     } catch (e) {
-      showMessage('error', e instanceof ApiError ? e.message : 'Failed to disable TOTP')
+      toast.error(e instanceof ApiError ? e.message : 'Failed to disable TOTP')
     } finally {
       disableLoading = false
     }
···
 
   async function handleRegenerate(e: Event) {
     e.preventDefault()
-    if (!auth.session || !regenPassword || !regenCode) return
+    if (!session || !regenPassword || !regenCode) return
     regenLoading = true
     try {
-      const result = await api.regenerateBackupCodes(auth.session.accessJwt, regenPassword, regenCode)
+      const result = await api.regenerateBackupCodes(session.accessJwt, regenPassword, regenCode)
       backupCodes = result.backupCodes
       setupStep = 'backup'
       showRegenForm = false
       regenPassword = ''
       regenCode = ''
     } catch (e) {
-      showMessage('error', e instanceof ApiError ? e.message : 'Failed to regenerate backup codes')
+      toast.error(e instanceof ApiError ? e.message : 'Failed to regenerate backup codes')
     } finally {
       regenLoading = false
     }
···
   function copyBackupCodes() {
     const text = backupCodes.join('\n')
     navigator.clipboard.writeText(text)
-    showMessage('success', $_('security.backupCodesCopied'))
+    toast.success($_('security.backupCodesCopied'))
   }
 
   async function loadPasskeys() {
-    if (!auth.session) return
+    if (!session) return
     passkeysLoading = true
     try {
-      const result = await api.listPasskeys(auth.session.accessJwt)
+      const result = await api.listPasskeys(session.accessJwt)
       passkeys = result.passkeys
     } catch {
-      showMessage('error', $_('security.failedToLoadPasskeys'))
+      toast.error($_('security.failedToLoadPasskeys'))
     } finally {
       passkeysLoading = false
     }
   }
 
   async function handleAddPasskey() {
-    if (!auth.session) return
+    if (!session) return
     if (!window.PublicKeyCredential) {
-      showMessage('error', $_('security.passkeysNotSupported'))
+      toast.error($_('security.passkeysNotSupported'))
       return
     }
     addingPasskey = true
     try {
-      const { options } = await api.startPasskeyRegistration(auth.session.accessJwt, newPasskeyName || undefined)
-      const publicKeyOptions = preparePublicKeyOptions(options)
+      const { options } = await api.startPasskeyRegistration(session.accessJwt, newPasskeyName || undefined)
+      const publicKeyOptions = prepareCreationOptions(options as WebAuthnCreationOptionsResponse)
       const credential = await navigator.credentials.create({
         publicKey: publicKeyOptions
       })
       if (!credential) {
-        showMessage('error', $_('security.passkeyCreationCancelled'))
+        toast.error($_('security.passkeyCreationCancelled'))
         return
       }
-      const credentialResponse = {
-        id: credential.id,
-        type: credential.type,
-        rawId: arrayBufferToBase64Url((credential as PublicKeyCredential).rawId),
-        response: {
-          clientDataJSON: arrayBufferToBase64Url((credential as PublicKeyCredential).response.clientDataJSON),
-          attestationObject: arrayBufferToBase64Url(((credential as PublicKeyCredential).response as AuthenticatorAttestationResponse).attestationObject),
-        },
-      }
-      await api.finishPasskeyRegistration(auth.session.accessJwt, credentialResponse, newPasskeyName || undefined)
+      const credentialResponse = serializeAttestationResponse(credential as PublicKeyCredential)
+      await api.finishPasskeyRegistration(session.accessJwt, credentialResponse, newPasskeyName || undefined)
       await loadPasskeys()
       newPasskeyName = ''
-      showMessage('success', $_('security.passkeyAddedSuccess'))
+      toast.success($_('security.passkeyAddedSuccess'))
     } catch (e) {
       if (e instanceof DOMException && e.name === 'NotAllowedError') {
-        showMessage('error', $_('security.passkeyCreationCancelled'))
+        toast.error($_('security.passkeyCreationCancelled'))
       } else {
-        showMessage('error', e instanceof ApiError ? e.message : 'Failed to add passkey')
+        toast.error(e instanceof ApiError ? e.message : 'Failed to add passkey')
       }
     } finally {
       addingPasskey = false
···
   }
 
   async function handleDeletePasskey(id: string) {
-    if (!auth.session) return
+    if (!session) return
     const passkey = passkeys.find(p => p.id === id)
     const name = passkey?.friendlyName || 'this passkey'
     if (!confirm($_('security.deletePasskeyConfirm', { values: { name } }))) return
     try {
-      await api.deletePasskey(auth.session.accessJwt, id)
+      await api.deletePasskey(session.accessJwt, id)
       await loadPasskeys()
-      showMessage('success', $_('security.passkeyDeleted'))
+      toast.success($_('security.passkeyDeleted'))
     } catch (e) {
-      showMessage('error', e instanceof ApiError ? e.message : 'Failed to delete passkey')
+      toast.error(e instanceof ApiError ? e.message : 'Failed to delete passkey')
     }
   }
 
   async function handleSavePasskeyName() {
-    if (!auth.session || !editingPasskeyId || !editPasskeyName.trim()) return
+    if (!session || !editingPasskeyId || !editPasskeyName.trim()) return
     try {
-      await api.updatePasskey(auth.session.accessJwt, editingPasskeyId, editPasskeyName.trim())
+      await api.updatePasskey(session.accessJwt, editingPasskeyId, editPasskeyName.trim())
       await loadPasskeys()
       editingPasskeyId = null
       editPasskeyName = ''
-      showMessage('success', $_('security.passkeyRenamed'))
+      toast.success($_('security.passkeyRenamed'))
     } catch (e) {
-      showMessage('error', e instanceof ApiError ? e.message : 'Failed to rename passkey')
+      toast.error(e instanceof ApiError ? e.message : 'Failed to rename passkey')
     }
   }
 
···
     editPasskeyName = ''
   }
 
-  function arrayBufferToBase64Url(buffer: ArrayBuffer): string {
-    const bytes = new Uint8Array(buffer)
-    let binary = ''
-    for (let i = 0; i < bytes.byteLength; i++) {
-      binary += String.fromCharCode(bytes[i])
-    }
-    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '')
-  }
-
-  function base64UrlToArrayBuffer(base64url: string): ArrayBuffer {
-    const base64 = base64url.replace(/-/g, '+').replace(/_/g, '/')
-    const padded = base64 + '='.repeat((4 - base64.length % 4) % 4)
-    const binary = atob(padded)
-    const bytes = new Uint8Array(binary.length)
-    for (let i = 0; i < binary.length; i++) {
-      bytes[i] = binary.charCodeAt(i)
-    }
-    return bytes.buffer
-  }
-
-  function preparePublicKeyOptions(options: any): PublicKeyCredentialCreationOptions {
-    return {
-      ...options.publicKey,
-      challenge: base64UrlToArrayBuffer(options.publicKey.challenge),
-      user: {
-        ...options.publicKey.user,
-        id: base64UrlToArrayBuffer(options.publicKey.user.id)
-      },
-      excludeCredentials: options.publicKey.excludeCredentials?.map((cred: any) => ({
-        ...cred,
-        id: base64UrlToArrayBuffer(cred.id)
-      })) || []
-    }
-  }
-
   function formatDate(dateStr: string): string {
     return formatDateUtil(dateStr)
   }
···
 
 <div class="page">
   <header>
-    <a href="/app/dashboard" class="back">{$_('common.backToDashboard')}</a>
+    <a href={getFullUrl(routes.dashboard)} class="back">{$_('common.backToDashboard')}</a>
     <h1>{$_('security.title')}</h1>
   </header>
 
-  {#if message}
-    <div class="message {message.type}">{message.text}</div>
-  {/if}
-
   {#if loading}
-    <div class="loading">{$_('common.loading')}</div>
+    <div class="skeleton-grid">
+      {#each Array(4) as _}
+        <div class="skeleton-section"></div>
+      {/each}
+    </div>
   {:else}
     <div class="sections-grid">
     <section>
···
         {$_('security.passkeysDescription')}
       </p>
 
-      {#if passkeysLoading}
-        <div class="loading">{$_('security.loadingPasskeys')}</div>
-      {:else}
+      {#if !passkeysLoading}
         {#if passkeys.length > 0}
           <div class="passkey-list">
             {#each passkeys as passkey}
···
         {$_('security.passwordDescription')}
       </p>
 
-      {#if passwordLoading}
-        <div class="loading">{$_('common.loading')}</div>
-      {:else if hasPassword}
+      {#if !passwordLoading && hasPassword}
         <div class="status enabled">
           <span>{$_('security.passwordStatus')}</span>
         </div>
···
       <p class="description">
         {$_('security.trustedDevicesDescription')}
       </p>
-      <a href="/app/trusted-devices" class="section-link">
+      <a href={getFullUrl(routes.trustedDevices)} class="section-link">
         {$_('security.manageTrustedDevices')} &rarr;
       </a>
     </section>
···
           {$_('security.legacyLoginDescription')}
         </p>
 
-        {#if legacyLoginLoading}
-          <div class="loading">{$_('common.loading')}</div>
-        {:else}
+        {#if !legacyLoginLoading}
           <div class="toggle-row">
             <div class="toggle-info">
               <span class="toggle-label">{$_('security.legacyLogin')}</span>
···
               <strong>{$_('security.legacyLoginWarning')}</strong>
               <p>{$_('security.totpPasswordWarning')}</p>
               <ol>
-                <li><strong>{$_('security.totpPasswordOption1Label')}</strong> {$_('security.totpPasswordOption1Text')} <a href="/app/settings">{$_('security.totpPasswordOption1Link')}</a> {$_('security.totpPasswordOption1Suffix')}</li>
-                <li><strong>{$_('security.totpPasswordOption2Label')}</strong> {$_('security.totpPasswordOption2Text')} <a href="/app/settings">{$_('security.totpPasswordOption2Link')}</a> {$_('security.totpPasswordOption2Suffix')}</li>
+                <li><strong>{$_('security.totpPasswordOption1Label')}</strong> {$_('security.totpPasswordOption1Text')} <a href={getFullUrl(routes.settings)}>{$_('security.totpPasswordOption1Link')}</a> {$_('security.totpPasswordOption1Suffix')}</li>
+                <li><strong>{$_('security.totpPasswordOption2Label')}</strong> {$_('security.totpPasswordOption2Text')} <a href={getFullUrl(routes.settings)}>{$_('security.totpPasswordOption2Link')}</a> {$_('security.totpPasswordOption2Suffix')}</li>
               </ol>
             </div>
           {/if}
···
 
   .warning-box a {
     color: var(--accent);
+  }
+
+  .skeleton-grid {
+    display: grid;
+    grid-template-columns: repeat(2, 1fr);
+    gap: var(--space-6);
+  }
+
+  .skeleton-section {
+    height: 200px;
+    background: var(--bg-secondary);
+    border-radius: var(--radius-xl);
+    animation: skeleton-pulse 1.5s ease-in-out infinite;
+  }
+
+  @keyframes skeleton-pulse {
+    0%, 100% { opacity: 1; }
+    50% { opacity: 0.5; }
+  }
+
+  @media (max-width: 900px) {
+    .skeleton-grid {
+      grid-template-columns: 1fr;
+    }
   }
 </style>

frontend/src/routes/Sessions.svelte

···
 <script lang="ts">
   import { getAuthState } from '../lib/auth.svelte'
-  import { navigate } from '../lib/router.svelte'
+  import { navigate, routes, getFullUrl } from '../lib/router.svelte'
   import { api, ApiError } from '../lib/api'
   import { _ } from '../lib/i18n'
   import { formatDateTime } from '../lib/date'
-  const auth = getAuthState()
+  import type { Session } from '../lib/types/api'
+  import { toast } from '../lib/toast.svelte'
+
+  const auth = $derived(getAuthState())
+
+  function getSession(): Session | null {
+    return auth.kind === 'authenticated' ? auth.session : null
+  }
+
+  function isLoading(): boolean {
+    return auth.kind === 'loading'
+  }
+
+  const session = $derived(getSession())
+  const authLoading = $derived(isLoading())
   let loading = $state(true)
-  let error = $state<string | null>(null)
   let sessions = $state<Array<{
     id: string
     sessionType: string
···
     isCurrent: boolean
   }>>([])
   $effect(() => {
-    if (!auth.loading && !auth.session) {
-      navigate('/login')
+    if (!authLoading && !session) {
+      navigate(routes.login)
     }
   })
   $effect(() => {
-    if (auth.session) {
+    if (session) {
       loadSessions()
     }
   })
   async function loadSessions() {
-    if (!auth.session) return
+    if (!session) return
     loading = true
-    error = null
     try {
-      const result = await api.listSessions(auth.session.accessJwt)
+      const result = await api.listSessions(session.accessJwt)
       sessions = result.sessions
     } catch (e) {
-      error = e instanceof ApiError ? e.message : $_('sessions.failedToLoad')
+      toast.error(e instanceof ApiError ? e.message : $_('sessions.failedToLoad'))
     } finally {
       loading = false
     }
   }
   async function revokeSession(sessionId: string, isCurrent: boolean) {
-    if (!auth.session) return
+    if (!session) return
     const msg = isCurrent
       ? $_('sessions.revokeCurrentConfirm')
       : $_('sessions.revokeConfirm')
     if (!confirm(msg)) return
     try {
-      await api.revokeSession(auth.session.accessJwt, sessionId)
+      await api.revokeSession(session.accessJwt, sessionId)
       if (isCurrent) {
-        navigate('/login')
+        navigate(routes.login)
       } else {
         sessions = sessions.filter(s => s.id !== sessionId)
+        toast.success($_('sessions.sessionRevoked'))
       }
     } catch (e) {
-      error = e instanceof ApiError ? e.message : $_('sessions.failedToRevoke')
+      toast.error(e instanceof ApiError ? e.message : $_('sessions.failedToRevoke'))
     }
   }
   async function revokeAllSessions() {
-    if (!auth.session) return
+    if (!session) return
     const otherSessions = sessions.filter(s => !s.isCurrent)
     if (otherSessions.length === 0) {
-      error = $_('sessions.noOtherSessions')
+      toast.warning($_('sessions.noOtherSessions'))
       return
     }
     if (!confirm($_('sessions.revokeAllConfirm', { values: { count: otherSessions.length } }))) return
     try {
-      await api.revokeAllSessions(auth.session.accessJwt)
+      await api.revokeAllSessions(session.accessJwt)
       sessions = sessions.filter(s => s.isCurrent)
+      toast.success($_('sessions.allSessionsRevoked'))
     } catch (e) {
-      error = e instanceof ApiError ? e.message : $_('sessions.failedToRevokeAll')
+      toast.error(e instanceof ApiError ? e.message : $_('sessions.failedToRevokeAll'))
     }
   }
   function formatDate(dateStr: string): string {
···
 </script>
 <div class="page">
   <header>
-    <a href="/app/dashboard" class="back">{$_('common.backToDashboard')}</a>
+    <a href={getFullUrl(routes.dashboard)} class="back">{$_('common.backToDashboard')}</a>
     <h1>{$_('sessions.title')}</h1>
   </header>
   {#if loading}
-    <p class="loading">{$_('sessions.loadingSessions')}</p>
+    <div class="sessions-list">
+      {#each Array(3) as _}
+        <div class="skeleton-card"></div>
+      {/each}
+    </div>
   {:else}
-    {#if error}
-      <div class="message error">{error}</div>
-    {/if}
     {#if sessions.length === 0}
       <p class="empty">{$_('sessions.noSessions')}</p>
     {:else}
···
     margin: var(--space-2) 0 0 0;
   }
 
-  .loading,
   .empty {
     text-align: center;
     color: var(--text-secondary);
     padding: var(--space-7);
+  }
+
+  .skeleton-card {
+    height: 80px;
+    background: var(--bg-secondary);
+    border: 1px solid var(--border-color);
+    border-radius: var(--radius-xl);
+    animation: skeleton-pulse 1.5s ease-in-out infinite;
+  }
+
+  @keyframes skeleton-pulse {
+    0%, 100% { opacity: 1; }
+    50% { opacity: 0.5; }
   }
 
   .sessions-list {

frontend/src/routes/Settings.svelte

···
 <script lang="ts">
   import { onMount } from 'svelte'
   import { getAuthState, logout, refreshSession } from '../lib/auth.svelte'
-  import { navigate } from '../lib/router.svelte'
+  import { navigate, routes, getFullUrl } from '../lib/router.svelte'
   import { api, ApiError } from '../lib/api'
   import { locale, setLocale, getSupportedLocales, localeNames, _, type SupportedLocale } from '../lib/i18n'
-  const auth = getAuthState()
+  import { isOk } from '../lib/types/result'
+  import type { Session } from '../lib/types/api'
+  import { toast } from '../lib/toast.svelte'
+
+  const auth = $derived(getAuthState())
   const supportedLocales = getSupportedLocales()
   let pdsHostname = $state<string | null>(null)
 
+  function getSession(): Session | null {
+    return auth.kind === 'authenticated' ? auth.session : null
+  }
+
+  function isLoading(): boolean {
+    return auth.kind === 'loading'
+  }
+
+  const session = $derived(getSession())
+  const loading = $derived(isLoading())
+
   onMount(() => {
     api.describeServer().then(info => {
       if (info.availableUserDomains?.length) {
···
       }
     }).catch(() => {})
   })
+
   let localeLoading = $state(false)
   async function handleLocaleChange(newLocale: SupportedLocale) {
-    if (!auth.session) return
+    if (!session) return
     setLocale(newLocale)
     localeLoading = true
     try {
-      await api.updateLocale(auth.session.accessJwt, newLocale)
+      await api.updateLocale(session.accessJwt, newLocale)
     } catch (e) {
       console.error('Failed to save locale preference:', e)
     } finally {
       localeLoading = false
     }
   }
-  let message = $state<{ type: 'success' | 'error'; text: string } | null>(null)
+
   let emailLoading = $state(false)
   let newEmail = $state('')
   let emailToken = $state('')
···
   let newPassword = $state('')
   let confirmNewPassword = $state('')
   let showBYOHandle = $state(false)
+
   $effect(() => {
-    if (!auth.loading && !auth.session) {
-      navigate('/login')
+    if (!loading && !session) {
+      navigate(routes.login)
     }
   })
-  function showMessage(type: 'success' | 'error', text: string) {
-    message = { type, text }
-    setTimeout(() => {
-      if (message?.text === text) message = null
-    }, 5000)
-  }
+
   async function handleRequestEmailUpdate() {
-    if (!auth.session) return
+    if (!session) return
     emailLoading = true
-    message = null
     try {
-      const result = await api.requestEmailUpdate(auth.session.accessJwt)
+      const result = await api.requestEmailUpdate(session.accessJwt)
       emailTokenRequired = result.tokenRequired
       if (emailTokenRequired) {
-        showMessage('success', $_('settings.messages.emailCodeSentToCurrent'))
+        toast.success($_('settings.messages.emailCodeSentToCurrent'))
       } else {
         emailTokenRequired = true
       }
     } catch (e) {
-      showMessage('error', e instanceof ApiError ? e.message : $_('settings.messages.emailUpdateFailed'))
+      toast.error(e instanceof ApiError ? e.message : $_('settings.messages.emailUpdateFailed'))
     } finally {
       emailLoading = false
     }
   }
+
   async function handleConfirmEmailUpdate(e: Event) {
     e.preventDefault()
-    if (!auth.session || !newEmail || !emailToken) return
+    if (!session || !newEmail || !emailToken) return
     emailLoading = true
-    message = null
     try {
-      await api.updateEmail(auth.session.accessJwt, newEmail, emailToken)
+      await api.updateEmail(session.accessJwt, newEmail, emailToken)
       await refreshSession()
-      showMessage('success', $_('settings.messages.emailUpdated'))
+      toast.success($_('settings.messages.emailUpdated'))
       newEmail = ''
       emailToken = ''
       emailTokenRequired = false
     } catch (e) {
-      showMessage('error', e instanceof ApiError ? e.message : $_('settings.messages.emailUpdateFailed'))
+      toast.error(e instanceof ApiError ? e.message : $_('settings.messages.emailUpdateFailed'))
     } finally {
       emailLoading = false
     }
   }
+
   async function handleUpdateHandle(e: Event) {
     e.preventDefault()
-    if (!auth.session || !newHandle) return
+    if (!session || !newHandle) return
     handleLoading = true
-    message = null
     try {
       const fullHandle = showBYOHandle
         ? newHandle
         : `${newHandle}.${pdsHostname}`
-      await api.updateHandle(auth.session.accessJwt, fullHandle)
+      await api.updateHandle(session.accessJwt, fullHandle)
       await refreshSession()
-      showMessage('success', $_('settings.messages.handleUpdated'))
+      toast.success($_('settings.messages.handleUpdated'))
       newHandle = ''
     } catch (e) {
-      showMessage('error', e instanceof ApiError ? e.message : $_('settings.messages.handleUpdateFailed'))
+      toast.error(e instanceof ApiError ? e.message : $_('settings.messages.handleUpdateFailed'))
     } finally {
       handleLoading = false
     }
   }
+
   async function handleRequestDelete() {
-    if (!auth.session) return
+    if (!session) return
     deleteLoading = true
-    message = null
     try {
-      await api.requestAccountDelete(auth.session.accessJwt)
+      await api.requestAccountDelete(session.accessJwt)
       deleteTokenSent = true
-      showMessage('success', $_('settings.messages.deletionConfirmationSent'))
+      toast.success($_('settings.messages.deletionConfirmationSent'))
     } catch (e) {
-      showMessage('error', e instanceof ApiError ? e.message : $_('settings.messages.deletionRequestFailed'))
+      toast.error(e instanceof ApiError ? e.message : $_('settings.messages.deletionRequestFailed'))
     } finally {
       deleteLoading = false
     }
   }
+
   async function handleConfirmDelete(e: Event) {
     e.preventDefault()
-    if (!auth.session || !deletePassword || !deleteToken) return
+    if (!session || !deletePassword || !deleteToken) return
     if (!confirm($_('settings.messages.deleteConfirmation'))) {
       return
     }
     deleteLoading = true
-    message = null
     try {
-      await api.deleteAccount(auth.session.did, deletePassword, deleteToken)
+      await api.deleteAccount(session.did, deletePassword, deleteToken)
       await logout()
-      navigate('/login')
+      navigate(routes.login)
     } catch (e) {
-      showMessage('error', e instanceof ApiError ? e.message : $_('settings.messages.deletionFailed'))
+      toast.error(e instanceof ApiError ? e.message : $_('settings.messages.deletionFailed'))
     } finally {
       deleteLoading = false
     }
   }
+
   async function handleExportRepo() {
-    if (!auth.session) return
+    if (!session) return
     exportLoading = true
-    message = null
     try {
-      const response = await fetch(`/xrpc/com.atproto.sync.getRepo?did=${encodeURIComponent(auth.session.did)}`, {
+      const response = await fetch(`/xrpc/com.atproto.sync.getRepo?did=${encodeURIComponent(session.did)}`, {
         headers: {
-          'Authorization': `Bearer ${auth.session.accessJwt}`
+          'Authorization': `Bearer ${session.accessJwt}`
         }
       })
       if (!response.ok) {
···
       const url = URL.createObjectURL(blob)
       const a = document.createElement('a')
       a.href = url
-      a.download = `${auth.session.handle}-repo.car`
+      a.download = `${session.handle}-repo.car`
       document.body.appendChild(a)
       a.click()
       document.body.removeChild(a)
       URL.revokeObjectURL(url)
-      showMessage('success', $_('settings.messages.repoExported'))
+      toast.success($_('settings.messages.repoExported'))
     } catch (e) {
-      showMessage('error', e instanceof Error ? e.message : $_('settings.messages.exportFailed'))
+      toast.error(e instanceof Error ? e.message : $_('settings.messages.exportFailed'))
     } finally {
       exportLoading = false
     }
   }
+
   async function handleExportBlobs() {
-    if (!auth.session) return
+    if (!session) return
     exportBlobsLoading = true
-    message = null
     try {
       const response = await fetch('/xrpc/_backup.exportBlobs', {
         headers: {
-          'Authorization': `Bearer ${auth.session.accessJwt}`
+          'Authorization': `Bearer ${session.accessJwt}`
         }
       })
       if (!response.ok) {
···
       }
       const blob = await response.blob()
       if (blob.size === 0) {
-        showMessage('success', $_('settings.messages.noBlobsToExport'))
+        toast.success($_('settings.messages.noBlobsToExport'))
         return
       }
       const url = URL.createObjectURL(blob)
       const a = document.createElement('a')
       a.href = url
-      a.download = `${auth.session.handle}-blobs.zip`
+      a.download = `${session.handle}-blobs.zip`
       document.body.appendChild(a)
       a.click()
       document.body.removeChild(a)
       URL.revokeObjectURL(url)
-      showMessage('success', $_('settings.messages.blobsExported'))
+      toast.success($_('settings.messages.blobsExported'))
     } catch (e) {
-      showMessage('error', e instanceof Error ? e.message : $_('settings.messages.exportFailed'))
+      toast.error(e instanceof Error ? e.message : $_('settings.messages.exportFailed'))
     } finally {
       exportBlobsLoading = false
     }
···
   let restoreLoading = $state(false)
 
   async function loadBackups() {
-    if (!auth.session) return
+    if (!session) return
     backupsLoading = true
     try {
-      const result = await api.listBackups(auth.session.accessJwt)
+      const result = await api.listBackups(session.accessJwt)
       backups = result.backups
       backupEnabled = result.backupEnabled
     } catch (e) {
···
   })
 
   async function handleToggleBackup() {
-    if (!auth.session) return
+    if (!session) return
     const newEnabled = !backupEnabled
     backupsLoading = true
     try {
-      await api.setBackupEnabled(auth.session.accessJwt, newEnabled)
+      await api.setBackupEnabled(session.accessJwt, newEnabled)
       backupEnabled = newEnabled
-      showMessage('success', newEnabled ? $_('settings.backups.enabled') : $_('settings.backups.disabled'))
+      toast.success(newEnabled ? $_('settings.backups.enabled') : $_('settings.backups.disabled'))
     } catch (e) {
-      showMessage('error', e instanceof ApiError ? e.message : $_('settings.backups.toggleFailed'))
+      toast.error(e instanceof ApiError ? e.message : $_('settings.backups.toggleFailed'))
     } finally {
       backupsLoading = false
     }
   }
 
   async function handleCreateBackup() {
-    if (!auth.session) return
+    if (!session) return
     createBackupLoading = true
-    message = null
     try {
-      await api.createBackup(auth.session.accessJwt)
+      await api.createBackup(session.accessJwt)
       await loadBackups()
-      showMessage('success', $_('settings.backups.created'))
+      toast.success($_('settings.backups.created'))
     } catch (e) {
-      showMessage('error', e instanceof ApiError ? e.message : $_('settings.backups.createFailed'))
+      toast.error(e instanceof ApiError ? e.message : $_('settings.backups.createFailed'))
     } finally {
       createBackupLoading = false
     }
   }
 
   async function handleDownloadBackup(id: string, rev: string) {
-    if (!auth.session) return
+    if (!session) return
     try {
-      const blob = await api.getBackup(auth.session.accessJwt, id)
+      const blob = await api.getBackup(session.accessJwt, id)
       const url = URL.createObjectURL(blob)
       const a = document.createElement('a')
       a.href = url
-      a.download = `${auth.session.handle}-${rev}.car`
+      a.download = `${session.handle}-${rev}.car`
       document.body.appendChild(a)
       a.click()
       document.body.removeChild(a)
       URL.revokeObjectURL(url)
     } catch (e) {
-      showMessage('error', e instanceof ApiError ? e.message : $_('settings.backups.downloadFailed'))
+      toast.error(e instanceof ApiError ? e.message : $_('settings.backups.downloadFailed'))
     }
   }
 
   async function handleDeleteBackup(id: string) {
-    if (!auth.session) return
+    if (!session) return
     try {
-      await api.deleteBackup(auth.session.accessJwt, id)
+      await api.deleteBackup(session.accessJwt, id)
       await loadBackups()
-      showMessage('success', $_('settings.backups.deleted'))
+      toast.success($_('settings.backups.deleted'))
     } catch (e) {
-      showMessage('error', e instanceof ApiError ? e.message : $_('settings.backups.deleteFailed'))
+      toast.error(e instanceof ApiError ? e.message : $_('settings.backups.deleteFailed'))
     }
   }
 
···
   }
 
   async function handleRestore() {
-    if (!auth.session || !restoreFile) return
+    if (!session || !restoreFile) return
     restoreLoading = true
-    message = null
     try {
       const buffer = await restoreFile.arrayBuffer()
       const car = new Uint8Array(buffer)
-      await api.importRepo(auth.session.accessJwt, car)
-      showMessage('success', $_('settings.backups.restored'))
+      await api.importRepo(session.accessJwt, car)
+      toast.success($_('settings.backups.restored'))
       restoreFile = null
     } catch (e) {
-      showMessage('error', e instanceof ApiError ? e.message : $_('settings.backups.restoreFailed'))
+      toast.error(e instanceof ApiError ? e.message : $_('settings.backups.restoreFailed'))
     } finally {
       restoreLoading = false
     }
···
 
   async function handleChangePassword(e: Event) {
     e.preventDefault()
-    if (!auth.session || !currentPassword || !newPassword || !confirmNewPassword) return
+    if (!session || !currentPassword || !newPassword || !confirmNewPassword) return
     if (newPassword !== confirmNewPassword) {
-      showMessage('error', $_('settings.messages.passwordsDoNotMatch'))
+      toast.error($_('settings.messages.passwordsDoNotMatch'))
       return
     }
     if (newPassword.length < 8) {
-      showMessage('error', $_('settings.messages.passwordTooShort'))
+      toast.error($_('settings.messages.passwordTooShort'))
       return
     }
     passwordLoading = true
-    message = null
     try {
-      await api.changePassword(auth.session.accessJwt, currentPassword, newPassword)
-      showMessage('success', $_('settings.messages.passwordChanged'))
+      await api.changePassword(session.accessJwt, currentPassword, newPassword)
+      toast.success($_('settings.messages.passwordChanged'))
       currentPassword = ''
       newPassword = ''
       confirmNewPassword = ''
     } catch (e) {
-      showMessage('error', e instanceof ApiError ? e.message : $_('settings.messages.passwordChangeFailed'))
+      toast.error(e instanceof ApiError ? e.message : $_('settings.messages.passwordChangeFailed'))
     } finally {
       passwordLoading = false
     }
···
 </script>
 <div class="page">
   <header>
-    <a href="/app/dashboard" class="back">{$_('common.backToDashboard')}</a>
+    <a href={getFullUrl(routes.dashboard)} class="back">{$_('common.backToDashboard')}</a>
     <h1>{$_('settings.title')}</h1>
   </header>
-  {#if message}
-    <div class="message {message.type}">{message.text}</div>
-  {/if}
   <div class="sections-grid">
   <section>
     <h2>{$_('settings.language')}</h2>
···
   </section>
   <section>
     <h2>{$_('settings.changeEmail')}</h2>
-    {#if auth.session?.email}
-      <p class="current">{$_('settings.currentEmail', { values: { email: auth.session.email } })}</p>
+    {#if session?.email}
+      <p class="current">{$_('settings.currentEmail', { values: { email: session.email } })}</p>
     {/if}
     {#if emailTokenRequired}
       <form onsubmit={handleConfirmEmailUpdate}>
···
   </section>
   <section>
     <h2>{$_('settings.changeHandle')}</h2>
-    {#if auth.session}
-      <p class="current">{$_('settings.currentHandle', { values: { handle: auth.session.handle } })}</p>
+    {#if session}
+      <p class="current">{$_('settings.currentHandle', { values: { handle: session.handle } })}</p>
     {/if}
     <div class="tabs">
       <button
···
     {#if showBYOHandle}
       <div class="byo-handle">
         <p class="description">{$_('settings.customDomainDescription')}</p>
-        {#if auth.session}
+        {#if session}
           <div class="verification-info">
             <h3>{$_('settings.setupInstructions')}</h3>
             <p>{$_('settings.setupMethodsIntro')}</p>
             <div class="method">
               <h4>{$_('settings.dnsMethod')}</h4>
               <p>{$_('settings.dnsMethodDesc')}</p>
-              <code class="record">_atproto.{newHandle || 'yourdomain.com'} TXT "did={auth.session.did}"</code>
+              <code class="record">_atproto.{newHandle || 'yourdomain.com'} TXT "did={session.did}"</code>
             </div>
             <div class="method">
               <h4>{$_('settings.httpMethod')}</h4>
               <p>{$_('settings.httpMethodDesc')}</p>
               <code class="record">https://{newHandle || 'yourdomain.com'}/.well-known/atproto-did</code>
               <p>{$_('settings.httpMethodContent')}</p>
-              <code class="record">{auth.session.did}</code>
+              <code class="record">{session.did}</code>
             </div>
           </div>
         {/if}
···
       <span>{$_('settings.backups.enableAutomatic')}</span>
     </label>
 
-    {#if backupsLoading}
-      <p class="loading">{$_('common.loading')}</p>
-    {:else if backups.length > 0}
+    {#if !backupsLoading && backups.length > 0}
       <ul class="backup-list">
         {#each backups as backup}
           <li class="backup-item">

frontend/src/routes/TrustedDevices.svelte

···
 <script lang="ts">
   import { getAuthState } from '../lib/auth.svelte'
-  import { navigate } from '../lib/router.svelte'
+  import { navigate, routes, getFullUrl } from '../lib/router.svelte'
   import { api, ApiError } from '../lib/api'
   import { _ } from '../lib/i18n'
   import { formatDateTime } from '../lib/date'
+  import type { Session } from '../lib/types/api'
+  import { toast } from '../lib/toast.svelte'
 
   interface TrustedDevice {
     id: string
···
     lastSeenAt: string
   }
 
-  const auth = getAuthState()
+  const auth = $derived(getAuthState())
+
+  function getSession(): Session | null {
+    return auth.kind === 'authenticated' ? auth.session : null
+  }
+
+  function isLoading(): boolean {
+    return auth.kind === 'loading'
+  }
+
+  const session = $derived(getSession())
+  const authLoading = $derived(isLoading())
   let devices = $state<TrustedDevice[]>([])
   let loading = $state(true)
-  let message = $state<{ type: 'success' | 'error'; text: string } | null>(null)
   let editingDeviceId = $state<string | null>(null)
   let editDeviceName = $state('')
 
   $effect(() => {
-    if (!auth.loading && !auth.session) {
-      navigate('/login')
+    if (!authLoading && !session) {
+      navigate(routes.login)
     }
   })
 
   $effect(() => {
-    if (auth.session) {
+    if (session) {
       loadDevices()
     }
   })
 
   async function loadDevices() {
-    if (!auth.session) return
+    if (!session) return
     loading = true
     try {
-      const result = await api.listTrustedDevices(auth.session.accessJwt)
+      const result = await api.listTrustedDevices(session.accessJwt)
       devices = result.devices
     } catch {
-      showMessage('error', $_('trustedDevices.failedToLoad'))
+      toast.error($_('trustedDevices.failedToLoad'))
     } finally {
       loading = false
     }
   }
 
-  function showMessage(type: 'success' | 'error', text: string) {
-    message = { type, text }
-    setTimeout(() => {
-      if (message?.text === text) message = null
-    }, 5000)
-  }
-
   async function handleRevoke(deviceId: string) {
-    if (!auth.session) return
+    if (!session) return
     if (!confirm($_('trustedDevices.revokeConfirm'))) return
     try {
-      await api.revokeTrustedDevice(auth.session.accessJwt, deviceId)
+      await api.revokeTrustedDevice(session.accessJwt, deviceId)
       await loadDevices()
-      showMessage('success', $_('trustedDevices.deviceRevoked'))
+      toast.success($_('trustedDevices.deviceRevoked'))
     } catch (e) {
-      showMessage('error', e instanceof ApiError ? e.message : $_('common.error'))
+      toast.error(e instanceof ApiError ? e.message : $_('common.error'))
     }
   }
 
···
   }
 
   async function handleSaveDeviceName() {
-    if (!auth.session || !editingDeviceId || !editDeviceName.trim()) return
+    if (!session || !editingDeviceId || !editDeviceName.trim()) return
     try {
-      await api.updateTrustedDevice(auth.session.accessJwt, editingDeviceId, editDeviceName.trim())
+      await api.updateTrustedDevice(session.accessJwt, editingDeviceId, editDeviceName.trim())
       await loadDevices()
       editingDeviceId = null
       editDeviceName = ''
-      showMessage('success', $_('trustedDevices.deviceRenamed'))
+      toast.success($_('trustedDevices.deviceRenamed'))
     } catch (e) {
-      showMessage('error', e instanceof ApiError ? e.message : $_('common.error'))
+      toast.error(e instanceof ApiError ? e.message : $_('common.error'))
     }
   }
 
···
 
 <div class="page">
   <header>
-    <a href="/app/security" class="back">{$_('trustedDevices.backToSecurity')}</a>
+    <a href={getFullUrl(routes.security)} class="back">{$_('trustedDevices.backToSecurity')}</a>
     <h1>{$_('trustedDevices.title')}</h1>
   </header>
-
-  {#if message}
-    <div class="message {message.type}">{message.text}</div>
-  {/if}
 
   <div class="description">
     <p>
···
   </div>
 
   {#if loading}
-    <div class="loading">{$_('common.loading')}</div>
+    <div class="skeleton-list">
+      {#each Array(2) as _}
+        <div class="skeleton-card"></div>
+      {/each}
+    </div>
   {:else if devices.length === 0}
     <div class="empty-state">
       <p>{$_('trustedDevices.noDevices')}</p>
···
 
   .btn-danger:hover {
     background: var(--error-bg);
+  }
+
+  .skeleton-list {
+    display: flex;
+    flex-direction: column;
+    gap: var(--space-4);
+  }
+
+  .skeleton-card {
+    height: 100px;
+    background: var(--bg-secondary);
+    border: 1px solid var(--border-color);
+    border-radius: var(--radius-xl);
+    animation: skeleton-pulse 1.5s ease-in-out infinite;
+  }
+
+  @keyframes skeleton-pulse {
+    0%, 100% { opacity: 1; }
+    50% { opacity: 0.5; }
   }
 </style>

frontend/src/routes/Verify.svelte

···
   import { onMount } from 'svelte'
   import { confirmSignup, resendVerification, getAuthState } from '../lib/auth.svelte'
   import { api, ApiError } from '../lib/api'
-  import { navigate } from '../lib/router.svelte'
+  import { navigate, routes, getFullUrl } from '../lib/router.svelte'
   import { _ } from '../lib/i18n'
+  import type { Session } from '../lib/types/api'
 
   const STORAGE_KEY = 'tranquil_pds_pending_verification'
 
···
   let successPurpose = $state<string | null>(null)
   let successChannel = $state<string | null>(null)
 
-  const auth = getAuthState()
+  const auth = $derived(getAuthState())
 
+  function getSession(): Session | null {
+    return auth.kind === 'authenticated' ? auth.session : null
+  }
 
-  function parseQueryParams() {
-    const params: Record<string, string> = {}
-    const searchParams = new URLSearchParams(window.location.search)
-    for (const [key, value] of searchParams.entries()) {
-      params[key] = value
-    }
-    return params
+  const session = $derived(getSession())
+
+  function parseQueryParams(): Record<string, string> {
+    return Object.fromEntries(new URLSearchParams(window.location.search))
   }
 
   onMount(async () => {
···
   })
 
   $effect(() => {
-    if (mode === 'signup' && auth.session) {
+    if (mode === 'signup' && session) {
       clearPendingVerification()
-      navigate('/dashboard')
+      navigate(routes.dashboard)
     }
   })
 
···
       await confirmSignup(pendingVerification.did, verificationCode.trim())
       clearPendingVerification()
       navigate('/dashboard')
-    } catch (e: any) {
-      error = e.message || 'Verification failed'
+    } catch (e) {
+      error = e instanceof Error ? e.message : 'Verification failed'
     } finally {
       submitting = false
     }
···
       success = true
       successPurpose = result.purpose
       successChannel = result.channel
-    } catch (e: any) {
+    } catch (e) {
       if (e instanceof ApiError) {
         if (e.error === 'AuthenticationRequired') {
           error = 'You must be signed in to complete this verification. Please sign in and try again.'
···
       success = true
       successPurpose = 'email-update'
       successChannel = 'email'
-    } catch (e: any) {
+    } catch (e) {
       if (e instanceof ApiError) {
         error = e.message
       } else {
···
       try {
         await resendVerification(pendingVerification.did)
         resendMessage = $_('verify.codeResent')
-      } catch (e: any) {
-        error = e.message || 'Failed to resend code'
+      } catch (e) {
+        error = e instanceof Error ? e.message : 'Failed to resend code'
       } finally {
         resendingCode = false
       }
···
       try {
         await api.resendMigrationVerification(identifier.trim())
         resendMessage = $_('verify.codeResentDetail')
-      } catch (e: any) {
-        error = e.message || 'Failed to resend verification'
+      } catch (e) {
+        error = e instanceof Error ? e.message : 'Failed to resend verification'
       } finally {
         resendingCode = false
       }

src/api/error.rs

···
             | Self::AccountTakedown
             | Self::InvalidCode(_)
             | Self::InvalidPassword(_)
+            | Self::InvalidToken(_)
+            | Self::ExpiredToken(_)
             | Self::PasskeyCounterAnomaly => StatusCode::UNAUTHORIZED,
             Self::Forbidden
             | Self::AdminRequired
···
             | Self::InvalidVerificationChannel
             | Self::SelfHostedDidWebDisabled
             | Self::AccountAlreadyExists
-            | Self::InvalidToken(_)
-            | Self::ExpiredToken(_)
             | Self::TokenRequired => StatusCode::BAD_REQUEST,
             Self::PasskeyNotFound => StatusCode::NOT_FOUND,
         }