OAuth inbound migration

frontend/deno.json

···
     "test:ui": "deno run -A npm:vitest --ui",
     "test:coverage": "deno run -A npm:vitest run --coverage"
   },
-  "nodeModulesDir": "auto"
+  "nodeModulesDir": "auto",
+  "lint": {
+    "rules": {
+      "exclude": [
+        "require-await",
+        "prefer-const"
+      ]
+    }
+  }
 }

frontend/src/App.svelte

···
   import DidDocumentEditor from './routes/DidDocumentEditor.svelte'
   import Home from './routes/Home.svelte'
 
+  if (window.location.pathname === '/migrate') {
+    const newUrl = `${window.location.origin}/${window.location.search}#/migrate`
+    window.location.replace(newUrl)
+  }
+
   initI18n()
 
   const auth = getAuthState()
···
   let oauthCallbackPending = $state(hasOAuthCallback())
 
   function hasOAuthCallback(): boolean {
+    if (window.location.hash === '#/migrate') {
+      return false
+    }
     const params = new URLSearchParams(window.location.search)
     return !!(params.get('code') && params.get('state'))
   }

frontend/src/components/ReauthModal.svelte

···
   <div class="modal-backdrop" onclick={handleClose} onkeydown={(e) => e.key === 'Escape' && handleClose()} role="presentation">
     <div class="modal" onclick={(e) => e.stopPropagation()} onkeydown={(e) => e.stopPropagation()} role="dialog" aria-modal="true" tabindex="-1">
       <div class="modal-header">
-        <h2>Re-authentication Required</h2>
+        <h2>{$_('reauth.title')}</h2>
         <button class="close-btn" onclick={handleClose} aria-label="Close">&times;</button>
       </div>
 
       <p class="modal-description">
-        This action requires you to verify your identity.
+        {$_('reauth.subtitle')}
       </p>
 
       {#if error}
···
               class:active={activeMethod === 'password'}
               onclick={() => activeMethod = 'password'}
             >
-              Password
+              {$_('reauth.password')}
             </button>
           {/if}
           {#if availableMethods.includes('totp')}
···
               class:active={activeMethod === 'totp'}
               onclick={() => activeMethod = 'totp'}
             >
-              TOTP
+              {$_('reauth.totp')}
             </button>
           {/if}
           {#if availableMethods.includes('passkey')}
···
               class:active={activeMethod === 'passkey'}
               onclick={() => activeMethod = 'passkey'}
             >
-              Passkey
+              {$_('reauth.passkey')}
             </button>
           {/if}
         </div>
···
         {#if activeMethod === 'password'}
           <form onsubmit={handlePasswordSubmit}>
             <div class="form-group">
-              <label for="reauth-password">Password</label>
+              <label for="reauth-password">{$_('reauth.password')}</label>
               <input
                 id="reauth-password"
                 type="password"
···
               />
             </div>
             <button type="submit" class="btn-primary" disabled={loading || !password}>
-              {loading ? 'Verifying...' : 'Verify'}
+              {loading ? $_('reauth.verifying') : $_('reauth.verify')}
             </button>
           </form>
         {:else if activeMethod === 'totp'}
           <form onsubmit={handleTotpSubmit}>
             <div class="form-group">
-              <label for="reauth-totp">Authenticator Code</label>
+              <label for="reauth-totp">{$_('reauth.authenticatorCode')}</label>
               <input
                 id="reauth-totp"
                 type="text"
···
               />
             </div>
             <button type="submit" class="btn-primary" disabled={loading || !totpCode}>
-              {loading ? 'Verifying...' : 'Verify'}
+              {loading ? $_('reauth.verifying') : $_('reauth.verify')}
             </button>
           </form>
         {:else if activeMethod === 'passkey'}
           <div class="passkey-auth">
-            <p>Click the button below to authenticate with your passkey.</p>
+            <p>{$_('reauth.passkeyPrompt')}</p>
             <button
               class="btn-primary"
               onclick={handlePasskeyAuth}
               disabled={loading}
             >
-              {loading ? 'Authenticating...' : 'Use Passkey'}
+              {loading ? $_('reauth.authenticating') : $_('reauth.usePasskey')}
             </button>
           </div>
         {/if}
···
 
       <div class="modal-footer">
         <button class="btn-secondary" onclick={handleClose} disabled={loading}>
-          Cancel
+          {$_('reauth.cancel')}
         </button>
       </div>
     </div>

frontend/src/components/migration/InboundWizard.svelte

···
 <script lang="ts">
   import type { InboundMigrationFlow } from '../../lib/migration'
-  import type { ServerDescription } from '../../lib/migration/types'
+  import type { AuthMethod, ServerDescription } from '../../lib/migration/types'
+  import { getErrorMessage } from '../../lib/migration/types'
+  import { base64UrlEncode, prepareWebAuthnCreationOptions } from '../../lib/migration/atproto-client'
   import { _ } from '../../lib/i18n'
+  import '../../styles/migration.css'
+
+  interface ResumeInfo {
+    direction: 'inbound' | 'outbound'
+    sourceHandle: string
+    targetHandle: string
+    sourcePdsUrl: string
+    targetPdsUrl: string
+    targetEmail: string
+    authMethod?: AuthMethod
+    progressSummary: string
+    step: string
+  }
 
   interface Props {
     flow: InboundMigrationFlow
+    resumeInfo?: ResumeInfo | null
     onBack: () => void
     onComplete: () => void
   }
 
-  let { flow, onBack, onComplete }: Props = $props()
+  let { flow, resumeInfo = null, onBack, onComplete }: Props = $props()
 
   let serverInfo = $state<ServerDescription | null>(null)
   let loading = $state(false)
   let handleInput = $state('')
-  let passwordInput = $state('')
   let localPasswordInput = $state('')
   let understood = $state(false)
   let selectedDomain = $state('')
   let handleAvailable = $state<boolean | null>(null)
   let checkingHandle = $state(false)
+  let selectedAuthMethod = $state<AuthMethod>('password')
+  let passkeyName = $state('')
+  let appPasswordCopied = $state(false)
+  let appPasswordAcknowledged = $state(false)
 
-  const isResumedMigration = $derived(flow.state.progress.repoImported)
+  const isResuming = $derived(flow.state.needsReauth === true)
   const isDidWeb = $derived(flow.state.sourceDid.startsWith("did:web:"))
 
   $effect(() => {
     if (flow.state.step === 'welcome' || flow.state.step === 'choose-handle') {
       loadServerInfo()
     }
+    if (flow.state.step === 'choose-handle') {
+      handleInput = ''
+      handleAvailable = null
+    }
+    if (flow.state.step === 'source-handle' && resumeInfo) {
+      handleInput = resumeInfo.sourceHandle
+      selectedAuthMethod = resumeInfo.authMethod ?? 'password'
+    }
   })
 
 
···
     }
   }
 
-  async function handleLogin(e: Event) {
-    e.preventDefault()
-    loading = true
-    flow.updateField('error', null)
-
-    try {
-      await flow.loginToSource(handleInput, passwordInput, flow.state.twoFactorCode || undefined)
-      const username = flow.state.sourceHandle.split('.')[0]
-      handleInput = username
-      flow.updateField('targetPassword', passwordInput)
-
-      if (flow.state.progress.repoImported) {
-        if (!localPasswordInput) {
-          flow.setError('Please enter your password for your new account on this PDS')
-          return
-        }
-        await flow.loadLocalServerInfo()
-
-        try {
-          await flow.authenticateToLocal(flow.state.targetEmail, localPasswordInput)
-          await flow.requestPlcToken()
-          flow.setStep('plc-token')
-        } catch (err) {
-          const error = err as Error & { error?: string }
-          if (error.error === 'AccountNotVerified') {
-            flow.setStep('email-verify')
-          } else {
-            throw err
-          }
-        }
-      } else {
-        flow.setStep('choose-handle')
-      }
-    } catch (err) {
-      flow.setError((err as Error).message)
-    } finally {
-      loading = false
-    }
-  }
-
   async function checkHandle() {
     if (!handleInput.trim()) return
 
···
     try {
       await flow.startMigration()
     } catch (err) {
-      flow.setError((err as Error).message)
+      flow.setError(getErrorMessage(err))
     } finally {
       loading = false
     }
···
     try {
       await flow.submitEmailVerifyToken(flow.state.emailVerifyToken, localPasswordInput || undefined)
     } catch (err) {
-      flow.setError((err as Error).message)
+      flow.setError(getErrorMessage(err))
     } finally {
       loading = false
     }
···
       await flow.resendEmailVerification()
       flow.setError(null)
     } catch (err) {
-      flow.setError((err as Error).message)
+      flow.setError(getErrorMessage(err))
     } finally {
       loading = false
     }
···
     try {
       await flow.submitPlcToken(flow.state.plcToken)
     } catch (err) {
-      flow.setError((err as Error).message)
+      flow.setError(getErrorMessage(err))
     } finally {
       loading = false
     }
···
       await flow.resendPlcToken()
       flow.setError(null)
     } catch (err) {
-      flow.setError((err as Error).message)
+      flow.setError(getErrorMessage(err))
     } finally {
       loading = false
     }
···
     try {
       await flow.completeDidWebMigration()
     } catch (err) {
-      flow.setError((err as Error).message)
+      flow.setError(getErrorMessage(err))
+    } finally {
+      loading = false
+    }
+  }
+
+  async function registerPasskey() {
+    loading = true
+    flow.setError(null)
+
+    try {
+      if (!window.PublicKeyCredential) {
+        throw new Error('Passkeys are not supported in this browser. Please use a modern browser with WebAuthn support.')
+      }
+
+      const { options } = await flow.startPasskeyRegistration()
+
+      const publicKeyOptions = prepareWebAuthnCreationOptions(
+        options as { publicKey: Record<string, unknown> }
+      )
+      const credential = await navigator.credentials.create({
+        publicKey: publicKeyOptions,
+      })
+
+      if (!credential) {
+        throw new Error('Passkey creation was cancelled')
+      }
+
+      const publicKeyCredential = credential as PublicKeyCredential
+      const response = publicKeyCredential.response as AuthenticatorAttestationResponse
+
+      const credentialData = {
+        id: publicKeyCredential.id,
+        rawId: base64UrlEncode(publicKeyCredential.rawId),
+        type: publicKeyCredential.type,
+        response: {
+          clientDataJSON: base64UrlEncode(response.clientDataJSON),
+          attestationObject: base64UrlEncode(response.attestationObject),
+        },
+      }
+
+      await flow.completePasskeyRegistration(credentialData, passkeyName || undefined)
+    } catch (err) {
+      const message = getErrorMessage(err)
+      if (message.includes('cancelled') || message.includes('AbortError')) {
+        flow.setError('Passkey registration was cancelled. Please try again.')
+      } else {
+        flow.setError(message)
+      }
     } finally {
       loading = false
     }
   }
 
+  function copyAppPassword() {
+    if (flow.state.generatedAppPassword) {
+      navigator.clipboard.writeText(flow.state.generatedAppPassword)
+      appPasswordCopied = true
+    }
+  }
+
+  async function handleProceedFromAppPassword() {
+    loading = true
+    try {
+      await flow.proceedFromAppPassword()
+    } catch (err) {
+      flow.setError(getErrorMessage(err))
+    } finally {
+      loading = false
+    }
+  }
+
+  async function handleSourceHandleSubmit(e: Event) {
+    e.preventDefault()
+    loading = true
+    flow.updateField('error', null)
+
+    try {
+      await flow.initiateOAuthLogin(handleInput)
+    } catch (err) {
+      flow.setError(getErrorMessage(err))
+    } finally {
+      loading = false
+    }
+  }
+
+  function proceedToReviewWithAuth() {
+    const fullHandle = handleInput.includes('.')
+      ? handleInput
+      : `${handleInput}.${selectedDomain}`
+
+    flow.updateField('targetHandle', fullHandle)
+    flow.updateField('authMethod', selectedAuthMethod)
+    flow.setStep('review')
+  }
+
   const steps = $derived(isDidWeb
-    ? ['Login', 'Handle', 'Review', 'Transfer', 'Verify Email', 'Update DID', 'Complete']
-    : ['Login', 'Handle', 'Review', 'Transfer', 'Verify Email', 'Verify PLC', 'Complete'])
+    ? ['Authenticate', 'Handle', 'Review', 'Transfer', 'Verify Email', 'Update DID', 'Complete']
+    : flow.state.authMethod === 'passkey'
+      ? ['Authenticate', 'Handle', 'Review', 'Transfer', 'Verify Email', 'Passkey', 'App Password', 'Verify PLC', 'Complete']
+      : ['Authenticate', 'Handle', 'Review', 'Transfer', 'Verify Email', 'Verify PLC', 'Complete'])
+
   function getCurrentStepIndex(): number {
+    const isPasskey = flow.state.authMethod === 'passkey'
     switch (flow.state.step) {
       case 'welcome':
-      case 'source-login': return 0
+      case 'source-handle': return 0
       case 'choose-handle': return 1
       case 'review': return 2
       case 'migrating': return 3
       case 'email-verify': return 4
+      case 'passkey-setup': return isPasskey ? 5 : 4
+      case 'app-password': return 6
       case 'plc-token':
       case 'did-web-update':
-      case 'finalizing': return 5
-      case 'success': return 6
+      case 'finalizing': return isPasskey ? 7 : 5
+      case 'success': return isPasskey ? 8 : 6
       default: return 0
     }
   }
 </script>
 
-<div class="inbound-wizard">
+<div class="migration-wizard">
   <div class="step-indicator">
-    {#each steps as stepName, i}
+    {#each steps as _, i}
       <div class="step" class:active={i === getCurrentStepIndex()} class:completed={i < getCurrentStepIndex()}>
         <div class="step-dot">{i < getCurrentStepIndex() ? '✓' : i + 1}</div>
-        <span class="step-label">{stepName}</span>
       </div>
       {#if i < steps.length - 1}
         <div class="step-line" class:completed={i < getCurrentStepIndex()}></div>
       {/if}
     {/each}
   </div>
+  <div class="current-step-label">
+    <strong>{steps[getCurrentStepIndex()]}</strong> · Step {getCurrentStepIndex() + 1} of {steps.length}
+  </div>
 
   {#if flow.state.error}
     <div class="message error">{flow.state.error}</div>
···
 
   {#if flow.state.step === 'welcome'}
     <div class="step-content">
-      <h2>Migrate Your Account Here</h2>
-      <p>This wizard will help you move your AT Protocol account from another PDS to this one.</p>
+      <h2>{$_('migration.inbound.welcome.title')}</h2>
+      <p>{$_('migration.inbound.welcome.desc')}</p>
 
       <div class="info-box">
-        <h3>What will happen:</h3>
+        <h3>{$_('migration.inbound.common.whatWillHappen')}</h3>
         <ol>
-          <li>Log in to your current PDS</li>
-          <li>Choose your new handle on this server</li>
-          <li>Your repository and blobs will be transferred</li>
-          <li>Verify the migration via email</li>
-          <li>Your identity will be updated to point here</li>
+          <li>{$_('migration.inbound.common.step1')}</li>
+          <li>{$_('migration.inbound.common.step2')}</li>
+          <li>{$_('migration.inbound.common.step3')}</li>
+          <li>{$_('migration.inbound.common.step4')}</li>
+          <li>{$_('migration.inbound.common.step5')}</li>
         </ol>
       </div>
 
       <div class="warning-box">
-        <strong>Before you proceed:</strong>
+        <strong>{$_('migration.inbound.common.beforeProceed')}</strong>
         <ul>
-          <li>You need access to the email registered with your current account</li>
-          <li>Large accounts may take several minutes to transfer</li>
-          <li>Your old account will be deactivated after migration</li>
+          <li>{$_('migration.inbound.common.warning1')}</li>
+          <li>{$_('migration.inbound.common.warning2')}</li>
+          <li>{$_('migration.inbound.common.warning3')}</li>
         </ul>
       </div>
 
       <label class="checkbox-label">
         <input type="checkbox" bind:checked={understood} />
-        <span>I understand the risks and want to proceed with migration</span>
+        <span>{$_('migration.inbound.welcome.understand')}</span>
       </label>
 
       <div class="button-row">
-        <button class="ghost" onclick={onBack}>Cancel</button>
-        <button disabled={!understood} onclick={() => flow.setStep('source-login')}>
-          Continue
+        <button class="ghost" onclick={onBack}>{$_('migration.inbound.common.cancel')}</button>
+        <button disabled={!understood} onclick={() => flow.setStep('source-handle')}>
+          {$_('migration.inbound.common.continue')}
         </button>
       </div>
     </div>
 
-  {:else if flow.state.step === 'source-login'}
+  {:else if flow.state.step === 'source-handle'}
     <div class="step-content">
-      <h2>{isResumedMigration ? 'Resume Migration' : 'Log In to Your Current PDS'}</h2>
-      <p>{isResumedMigration ? 'Enter your credentials to continue the migration.' : 'Enter your credentials for the account you want to migrate.'}</p>
+      <h2>{isResuming ? $_('migration.inbound.sourceAuth.titleResume') : $_('migration.inbound.sourceAuth.title')}</h2>
+      <p>{isResuming ? $_('migration.inbound.sourceAuth.descResume') : $_('migration.inbound.sourceAuth.desc')}</p>
 
-      {#if isResumedMigration}
-        <div class="info-box">
-          <p>Your migration was interrupted. Log in to both accounts to resume.</p>
-          <p class="hint" style="margin-top: 8px;">Migrating: <strong>{flow.state.sourceHandle}</strong> → <strong>{flow.state.targetHandle}</strong></p>
+      {#if isResuming && resumeInfo}
+        <div class="info-box resume-info">
+          <h3>{$_('migration.inbound.sourceAuth.resumeTitle')}</h3>
+          <div class="resume-details">
+            <div class="resume-row">
+              <span class="label">{$_('migration.inbound.sourceAuth.resumeFrom')}:</span>
+              <span class="value">@{resumeInfo.sourceHandle}</span>
+            </div>
+            <div class="resume-row">
+              <span class="label">{$_('migration.inbound.sourceAuth.resumeTo')}:</span>
+              <span class="value">@{resumeInfo.targetHandle}</span>
+            </div>
+            <div class="resume-row">
+              <span class="label">{$_('migration.inbound.sourceAuth.resumeProgress')}:</span>
+              <span class="value">{resumeInfo.progressSummary}</span>
+            </div>
+          </div>
+          <p class="resume-note">{$_('migration.inbound.sourceAuth.resumeOAuthNote')}</p>
         </div>
       {/if}
 
-      <form onsubmit={handleLogin}>
+      <form onsubmit={handleSourceHandleSubmit}>
         <div class="field">
-          <label for="handle">{isResumedMigration ? 'Old Account Handle' : 'Handle'}</label>
+          <label for="source-handle">{$_('migration.inbound.sourceAuth.handle')}</label>
           <input
-            id="handle"
+            id="source-handle"
             type="text"
-            placeholder="alice.bsky.social"
+            placeholder={$_('migration.inbound.sourceAuth.handlePlaceholder')}
             bind:value={handleInput}
-            disabled={loading}
+            disabled={loading || isResuming}
             required
           />
-          <p class="hint">Your current handle on your existing PDS</p>
+          <p class="hint">{$_('migration.inbound.sourceAuth.handleHint')}</p>
         </div>
 
-        <div class="field">
-          <label for="password">{isResumedMigration ? 'Old Account Password' : 'Password'}</label>
-          <input
-            id="password"
-            type="password"
-            bind:value={passwordInput}
-            disabled={loading}
-            required
-          />
-          <p class="hint">Your account password (not an app password)</p>
-        </div>
-
-        {#if flow.state.requires2FA}
-          <div class="field">
-            <label for="2fa">Two-Factor Code</label>
-            <input
-              id="2fa"
-              type="text"
-              placeholder="Enter code from email"
-              bind:value={flow.state.twoFactorCode}
-              disabled={loading}
-              required
-            />
-            <p class="hint">Check your email for the verification code</p>
-          </div>
-        {/if}
-
-        {#if isResumedMigration}
-          <hr style="margin: 24px 0; border: none; border-top: 1px solid var(--border);" />
-
-          <div class="field">
-            <label for="local-password">New Account Password</label>
-            <input
-              id="local-password"
-              type="password"
-              placeholder="Password for your new account"
-              bind:value={localPasswordInput}
-              disabled={loading}
-              required
-            />
-            <p class="hint">The password you set for your account on this PDS</p>
-          </div>
-        {/if}
-
         <div class="button-row">
-          <button type="button" class="ghost" onclick={onBack} disabled={loading}>Back</button>
-          <button type="submit" disabled={loading}>
-            {loading ? 'Logging in...' : (isResumedMigration ? 'Continue Migration' : 'Log In')}
+          <button type="button" class="ghost" onclick={() => flow.setStep('welcome')} disabled={loading}>{$_('migration.inbound.common.back')}</button>
+          <button type="submit" disabled={loading || !handleInput.trim()}>
+            {loading ? $_('migration.inbound.sourceAuth.connecting') : (isResuming ? $_('migration.inbound.sourceAuth.reauthenticate') : $_('migration.inbound.sourceAuth.continue'))}
           </button>
         </div>
       </form>
···
 
   {:else if flow.state.step === 'choose-handle'}
     <div class="step-content">
-      <h2>Choose Your New Handle</h2>
-      <p>Select a handle for your account on this PDS.</p>
+      <h2>{$_('migration.inbound.chooseHandle.title')}</h2>
+      <p>{$_('migration.inbound.chooseHandle.desc')}</p>
 
       <div class="current-info">
-        <span class="label">Migrating from:</span>
+        <span class="label">{$_('migration.inbound.chooseHandle.migratingFrom')}:</span>
         <span class="value">{flow.state.sourceHandle}</span>
       </div>
 
       <div class="field">
-        <label for="new-handle">New Handle</label>
+        <label for="new-handle">{$_('migration.inbound.chooseHandle.newHandle')}</label>
         <div class="handle-input-group">
           <input
             id="new-handle"
···
         </div>
 
         {#if checkingHandle}
-          <p class="hint">Checking availability...</p>
+          <p class="hint">{$_('migration.inbound.chooseHandle.checkingAvailability')}</p>
         {:else if handleAvailable === true}
-          <p class="hint success">Handle is available!</p>
+          <p class="hint" style="color: var(--success-text)">{$_('migration.inbound.chooseHandle.handleAvailable')}</p>
         {:else if handleAvailable === false}
-          <p class="hint error">Handle is already taken</p>
+          <p class="hint error">{$_('migration.inbound.chooseHandle.handleTaken')}</p>
         {:else}
-          <p class="hint">You can also use your own domain by entering the full handle (e.g., alice.mydomain.com)</p>
+          <p class="hint">{$_('migration.inbound.chooseHandle.handleHint')}</p>
         {/if}
       </div>
 
       <div class="field">
-        <label for="email">Email Address</label>
+        <label for="email">{$_('migration.inbound.chooseHandle.email')}</label>
         <input
           id="email"
           type="email"
···
       </div>
 
       <div class="field">
-        <label for="new-password">Password</label>
-        <input
-          id="new-password"
-          type="password"
-          placeholder="Password for your new account"
-          bind:value={flow.state.targetPassword}
-          oninput={(e) => flow.updateField('targetPassword', (e.target as HTMLInputElement).value)}
-          required
-          minlength="8"
-        />
-        <p class="hint">At least 8 characters</p>
+        <label>{$_('migration.inbound.chooseHandle.authMethod')}</label>
+        <div class="auth-method-options">
+          <label class="auth-option" class:selected={selectedAuthMethod === 'password'}>
+            <input
+              type="radio"
+              name="auth-method"
+              value="password"
+              bind:group={selectedAuthMethod}
+            />
+            <div class="auth-option-content">
+              <strong>{$_('migration.inbound.chooseHandle.authPassword')}</strong>
+              <span>{$_('migration.inbound.chooseHandle.authPasswordDesc')}</span>
+            </div>
+          </label>
+          <label class="auth-option" class:selected={selectedAuthMethod === 'passkey'}>
+            <input
+              type="radio"
+              name="auth-method"
+              value="passkey"
+              bind:group={selectedAuthMethod}
+            />
+            <div class="auth-option-content">
+              <strong>{$_('migration.inbound.chooseHandle.authPasskey')}</strong>
+              <span>{$_('migration.inbound.chooseHandle.authPasskeyDesc')}</span>
+            </div>
+          </label>
+        </div>
       </div>
 
+      {#if selectedAuthMethod === 'password'}
+        <div class="field">
+          <label for="new-password">{$_('migration.inbound.chooseHandle.password')}</label>
+          <input
+            id="new-password"
+            type="password"
+            placeholder="Password for your new account"
+            bind:value={flow.state.targetPassword}
+            oninput={(e) => flow.updateField('targetPassword', (e.target as HTMLInputElement).value)}
+            required
+            minlength="8"
+          />
+          <p class="hint">{$_('migration.inbound.chooseHandle.passwordHint')}</p>
+        </div>
+      {:else}
+        <div class="info-box">
+          <p>{$_('migration.inbound.chooseHandle.passkeyInfo')}</p>
+        </div>
+      {/if}
+
       {#if serverInfo?.inviteCodeRequired}
         <div class="field">
-          <label for="invite">Invite Code</label>
+          <label for="invite">{$_('migration.inbound.chooseHandle.inviteCode')}</label>
           <input
             id="invite"
             type="text"
···
       {/if}
 
       <div class="button-row">
-        <button class="ghost" onclick={() => flow.setStep('source-login')}>Back</button>
+        <button class="ghost" onclick={() => flow.setStep('source-handle')}>{$_('migration.inbound.common.back')}</button>
         <button
-                   disabled={!handleInput.trim() || !flow.state.targetEmail || !flow.state.targetPassword || handleAvailable === false}
-          onclick={proceedToReview}
+          disabled={!handleInput.trim() || !flow.state.targetEmail || (selectedAuthMethod === 'password' && !flow.state.targetPassword) || handleAvailable === false}
+          onclick={proceedToReviewWithAuth}
         >
-          Continue
+          {$_('migration.inbound.common.continue')}
         </button>
       </div>
     </div>
 
   {:else if flow.state.step === 'review'}
     <div class="step-content">
-      <h2>Review Migration</h2>
-      <p>Please confirm the details of your migration.</p>
+      <h2>{$_('migration.inbound.review.title')}</h2>
+      <p>{$_('migration.inbound.review.desc')}</p>
 
       <div class="review-card">
         <div class="review-row">
-          <span class="label">Current Handle:</span>
+          <span class="label">{$_('migration.inbound.review.currentHandle')}:</span>
           <span class="value">{flow.state.sourceHandle}</span>
         </div>
         <div class="review-row">
-          <span class="label">New Handle:</span>
+          <span class="label">{$_('migration.inbound.review.newHandle')}:</span>
           <span class="value">{flow.state.targetHandle}</span>
         </div>
         <div class="review-row">
-          <span class="label">DID:</span>
+          <span class="label">{$_('migration.inbound.review.did')}:</span>
           <span class="value mono">{flow.state.sourceDid}</span>
         </div>
         <div class="review-row">
-          <span class="label">From PDS:</span>
+          <span class="label">{$_('migration.inbound.review.sourcePds')}:</span>
           <span class="value">{flow.state.sourcePdsUrl}</span>
         </div>
         <div class="review-row">
-          <span class="label">To PDS:</span>
+          <span class="label">{$_('migration.inbound.review.targetPds')}:</span>
           <span class="value">{window.location.origin}</span>
         </div>
         <div class="review-row">
-          <span class="label">Email:</span>
+          <span class="label">{$_('migration.inbound.review.email')}:</span>
           <span class="value">{flow.state.targetEmail}</span>
         </div>
+        <div class="review-row">
+          <span class="label">{$_('migration.inbound.review.authentication')}:</span>
+          <span class="value">{flow.state.authMethod === 'passkey' ? $_('migration.inbound.review.authPasskey') : $_('migration.inbound.review.authPassword')}</span>
+        </div>
       </div>
 
       <div class="warning-box">
-        <strong>Final confirmation:</strong> After you click "Start Migration", your repository and data will begin
-        transferring. This process cannot be easily undone.
+        {$_('migration.inbound.review.warning')}
       </div>
 
       <div class="button-row">
-        <button class="ghost" onclick={() => flow.setStep('choose-handle')} disabled={loading}>Back</button>
+        <button class="ghost" onclick={() => flow.setStep('choose-handle')} disabled={loading}>{$_('migration.inbound.common.back')}</button>
         <button onclick={startMigration} disabled={loading}>
-          {loading ? 'Starting...' : 'Start Migration'}
+          {loading ? $_('migration.inbound.review.starting') : $_('migration.inbound.review.startMigration')}
         </button>
       </div>
     </div>
 
   {:else if flow.state.step === 'migrating'}
     <div class="step-content">
-      <h2>Migration in Progress</h2>
-      <p>Please wait while your account is being transferred...</p>
+      <h2>{$_('migration.inbound.migrating.title')}</h2>
+      <p>{$_('migration.inbound.migrating.desc')}</p>
 
       <div class="progress-section">
         <div class="progress-item" class:completed={flow.state.progress.repoExported}>
           <span class="icon">{flow.state.progress.repoExported ? '✓' : '○'}</span>
-          <span>Export repository</span>
+          <span>{$_('migration.inbound.migrating.exportRepo')}</span>
         </div>
         <div class="progress-item" class:completed={flow.state.progress.repoImported}>
           <span class="icon">{flow.state.progress.repoImported ? '✓' : '○'}</span>
-          <span>Import repository</span>
+          <span>{$_('migration.inbound.migrating.importRepo')}</span>
         </div>
         <div class="progress-item" class:active={flow.state.progress.repoImported && !flow.state.progress.prefsMigrated}>
           <span class="icon">{flow.state.progress.blobsMigrated === flow.state.progress.blobsTotal && flow.state.progress.blobsTotal > 0 ? '✓' : '○'}</span>
-          <span>Migrate blobs ({flow.state.progress.blobsMigrated}/{flow.state.progress.blobsTotal})</span>
+          <span>{$_('migration.inbound.migrating.migrateBlobs')} ({flow.state.progress.blobsMigrated}/{flow.state.progress.blobsTotal})</span>
         </div>
         <div class="progress-item" class:completed={flow.state.progress.prefsMigrated}>
           <span class="icon">{flow.state.progress.prefsMigrated ? '✓' : '○'}</span>
-          <span>Migrate preferences</span>
+          <span>{$_('migration.inbound.migrating.migratePrefs')}</span>
         </div>
       </div>
 
···
       <p class="status-text">{flow.state.progress.currentOperation}</p>
     </div>
 
+  {:else if flow.state.step === 'passkey-setup'}
+    <div class="step-content">
+      <h2>{$_('migration.inbound.passkeySetup.title')}</h2>
+      <p>{$_('migration.inbound.passkeySetup.desc')}</p>
+
+      {#if flow.state.error}
+        <div class="message error">
+          {flow.state.error}
+        </div>
+      {/if}
+
+      <div class="field">
+        <label for="passkey-name">{$_('migration.inbound.passkeySetup.nameLabel')}</label>
+        <input
+          id="passkey-name"
+          type="text"
+          placeholder={$_('migration.inbound.passkeySetup.namePlaceholder')}
+          bind:value={passkeyName}
+          disabled={loading}
+        />
+        <p class="hint">{$_('migration.inbound.passkeySetup.nameHint')}</p>
+      </div>
+
+      <div class="passkey-section">
+        <p>{$_('migration.inbound.passkeySetup.instructions')}</p>
+        <button class="primary" onclick={registerPasskey} disabled={loading}>
+          {loading ? $_('migration.inbound.passkeySetup.registering') : $_('migration.inbound.passkeySetup.register')}
+        </button>
+      </div>
+    </div>
+
+  {:else if flow.state.step === 'app-password'}
+    <div class="step-content">
+      <h2>{$_('migration.inbound.appPassword.title')}</h2>
+      <p>{$_('migration.inbound.appPassword.desc')}</p>
+
+      <div class="warning-box">
+        <strong>{$_('migration.inbound.appPassword.warning')}</strong>
+      </div>
+
+      <div class="app-password-display">
+        <div class="app-password-label">
+          {$_('migration.inbound.appPassword.label')}: <strong>{flow.state.generatedAppPasswordName}</strong>
+        </div>
+        <code class="app-password-code">{flow.state.generatedAppPassword}</code>
+        <button type="button" class="copy-btn" onclick={copyAppPassword}>
+          {appPasswordCopied ? $_('common.copied') : $_('common.copyToClipboard')}
+        </button>
+      </div>
+
+      <label class="checkbox-label">
+        <input type="checkbox" bind:checked={appPasswordAcknowledged} />
+        <span>{$_('migration.inbound.appPassword.saved')}</span>
+      </label>
+
+      <div class="button-row">
+        <button onclick={handleProceedFromAppPassword} disabled={!appPasswordAcknowledged || loading}>
+          {loading ? $_('migration.inbound.common.continue') : $_('migration.inbound.appPassword.continue')}
+        </button>
+      </div>
+    </div>
+
   {:else if flow.state.step === 'email-verify'}
     <div class="step-content">
       <h2>{$_('migration.inbound.emailVerify.title')}</h2>
···
       </div>
 
       {#if flow.state.error}
-        <div class="error-box">
+        <div class="message error">
           {flow.state.error}
         </div>
       {/if}
···
 
   {:else if flow.state.step === 'plc-token'}
     <div class="step-content">
-      <h2>Verify Migration</h2>
-      <p>A verification code has been sent to the email registered with your old account.</p>
+      <h2>{$_('migration.inbound.plcToken.title')}</h2>
+      <p>{$_('migration.inbound.plcToken.desc')}</p>
 
       <div class="info-box">
-        <p>
-          This code confirms you have access to the account and authorizes updating your identity
-          to point to this PDS.
-        </p>
+        <p>{$_('migration.inbound.plcToken.info')}</p>
       </div>
 
       <form onsubmit={submitPlcToken}>
         <div class="field">
-          <label for="plc-token">Verification Code</label>
+          <label for="plc-token">{$_('migration.inbound.plcToken.tokenLabel')}</label>
           <input
             id="plc-token"
             type="text"
-            placeholder="Enter code from email"
+            placeholder={$_('migration.inbound.plcToken.tokenPlaceholder')}
             bind:value={flow.state.plcToken}
             oninput={(e) => flow.updateField('plcToken', (e.target as HTMLInputElement).value)}
             disabled={loading}
···
 
         <div class="button-row">
           <button type="button" class="ghost" onclick={resendToken} disabled={loading}>
-            Resend Code
+            {$_('migration.inbound.plcToken.resend')}
           </button>
           <button type="submit" disabled={loading || !flow.state.plcToken}>
-            {loading ? 'Verifying...' : 'Complete Migration'}
+            {loading ? $_('migration.inbound.plcToken.completing') : $_('migration.inbound.plcToken.complete')}
           </button>
         </div>
       </form>
···
       </div>
 
       <div class="button-row">
-        <button class="ghost" onclick={() => flow.setStep('email-verify')} disabled={loading}>Back</button>
+        <button class="ghost" onclick={() => flow.setStep('email-verify')} disabled={loading}>{$_('migration.inbound.common.back')}</button>
         <button onclick={completeDidWeb} disabled={loading}>
           {loading ? $_('migration.inbound.didWebUpdate.completing') : $_('migration.inbound.didWebUpdate.complete')}
         </button>
···
 
   {:else if flow.state.step === 'finalizing'}
     <div class="step-content">
-      <h2>Finalizing Migration</h2>
-      <p>Please wait while we complete the migration...</p>
+      <h2>{$_('migration.inbound.finalizing.title')}</h2>
+      <p>{$_('migration.inbound.finalizing.desc')}</p>
 
       <div class="progress-section">
         <div class="progress-item" class:completed={flow.state.progress.plcSigned}>
           <span class="icon">{flow.state.progress.plcSigned ? '✓' : '○'}</span>
-          <span>Sign identity update</span>
+          <span>{$_('migration.inbound.finalizing.signingPlc')}</span>
         </div>
         <div class="progress-item" class:completed={flow.state.progress.activated}>
           <span class="icon">{flow.state.progress.activated ? '✓' : '○'}</span>
-          <span>Activate new account</span>
+          <span>{$_('migration.inbound.finalizing.activating')}</span>
         </div>
         <div class="progress-item" class:completed={flow.state.progress.deactivated}>
           <span class="icon">{flow.state.progress.deactivated ? '✓' : '○'}</span>
-          <span>Deactivate old account</span>
+          <span>{$_('migration.inbound.finalizing.deactivating')}</span>
         </div>
       </div>
 
···
   {:else if flow.state.step === 'success'}
     <div class="step-content success-content">
       <div class="success-icon">✓</div>
-      <h2>Migration Complete!</h2>
-      <p>Your account has been successfully migrated to this PDS.</p>
+      <h2>{$_('migration.inbound.success.title')}</h2>
+      <p>{$_('migration.inbound.success.desc')}</p>
 
       <div class="success-details">
         <div class="detail-row">
-          <span class="label">Your new handle:</span>
+          <span class="label">{$_('migration.inbound.success.yourNewHandle')}:</span>
           <span class="value">{flow.state.targetHandle}</span>
         </div>
         <div class="detail-row">
-          <span class="label">DID:</span>
+          <span class="label">{$_('migration.inbound.success.did')}:</span>
           <span class="value mono">{flow.state.sourceDid}</span>
         </div>
       </div>
 
       {#if flow.state.progress.blobsFailed.length > 0}
-        <div class="warning-box">
-          <strong>Note:</strong> {flow.state.progress.blobsFailed.length} blobs could not be migrated.
-          These may be images or other media that are no longer available.
+        <div class="message warning">
+          {$_('migration.inbound.success.blobsWarning', { values: { count: flow.state.progress.blobsFailed.length } })}
         </div>
       {/if}
 
-      <p class="redirect-text">Redirecting to dashboard...</p>
+      <p class="redirect-text">{$_('migration.inbound.success.redirecting')}</p>
     </div>
 
   {:else if flow.state.step === 'error'}
     <div class="step-content">
-      <h2>Migration Error</h2>
-      <p>An error occurred during migration.</p>
+      <h2>{$_('migration.inbound.error.title')}</h2>
+      <p>{$_('migration.inbound.error.desc')}</p>
 
-      <div class="error-box">
-        {flow.state.error}
+      <div class="message error">
+        {flow.state.error || 'An unknown error occurred. Please check the browser console for details.'}
       </div>
 
       <div class="button-row">
-        <button class="ghost" onclick={onBack}>Start Over</button>
+        <button class="ghost" onclick={onBack}>{$_('migration.inbound.error.startOver')}</button>
       </div>
     </div>
   {/if}
 </div>
 
 <style>
-  .inbound-wizard {
-    max-width: 600px;
-    margin: 0 auto;
-  }
-
-  .step-indicator {
-    display: flex;
-    align-items: center;
-    justify-content: center;
-    margin-bottom: var(--space-8);
-    padding: 0 var(--space-4);
+  .passkey-section {
+    margin-top: 16px;
   }
-
-  .step {
-    display: flex;
-    flex-direction: column;
-    align-items: center;
-    gap: var(--space-2);
+  .passkey-section button {
+    width: 100%;
+    margin-top: 12px;
   }
-
-  .step-dot {
-    width: 32px;
-    height: 32px;
-    border-radius: 50%;
-    background: var(--bg-secondary);
-    border: 2px solid var(--border);
-    display: flex;
-    align-items: center;
-    justify-content: center;
-    font-size: var(--text-sm);
-    font-weight: var(--font-medium);
-    color: var(--text-secondary);
-  }
-
-  .step.active .step-dot {
-    background: var(--accent);
-    border-color: var(--accent);
-    color: var(--text-inverse);
-  }
-
-  .step.completed .step-dot {
-    background: var(--success-bg);
-    border-color: var(--success-text);
-    color: var(--success-text);
-  }
-
-  .step-label {
-    font-size: var(--text-xs);
-    color: var(--text-secondary);
-  }
-
-  .step.active .step-label {
-    color: var(--accent);
-    font-weight: var(--font-medium);
-  }
-
-  .step-line {
-    flex: 1;
-    height: 2px;
-    background: var(--border);
-    margin: 0 var(--space-2);
-    margin-bottom: var(--space-6);
-    min-width: 20px;
-  }
-
-  .step-line.completed {
-    background: var(--success-text);
-  }
-
-  .step-content {
-    background: var(--bg-secondary);
+  .app-password-display {
+    background: var(--bg-card);
+    border: 2px solid var(--accent);
     border-radius: var(--radius-xl);
     padding: var(--space-6);
-  }
-
-  .step-content h2 {
-    margin: 0 0 var(--space-3) 0;
+    text-align: center;
+    margin: var(--space-4) 0;
   }
-
-  .step-content > p {
+  .app-password-label {
+    font-size: var(--text-sm);
     color: var(--text-secondary);
-    margin: 0 0 var(--space-5) 0;
+    margin-bottom: var(--space-4);
   }
-
-  .info-box {
-    background: var(--accent-muted);
-    border: 1px solid var(--accent);
-    border-radius: var(--radius-lg);
+  .app-password-code {
+    display: block;
+    font-size: var(--text-xl);
+    font-family: ui-monospace, monospace;
+    letter-spacing: 0.1em;
     padding: var(--space-5);
-    margin-bottom: var(--space-5);
-  }
-
-  .info-box h3 {
-    margin: 0 0 var(--space-3) 0;
-    font-size: var(--text-base);
-  }
-
-  .info-box ol, .info-box ul {
-    margin: 0;
-    padding-left: var(--space-5);
-  }
-
-  .info-box li {
-    margin-bottom: var(--space-2);
-    color: var(--text-secondary);
+    background: var(--bg-input);
+    border-radius: var(--radius-md);
+    margin-bottom: var(--space-4);
+    user-select: all;
   }
-
-  .info-box p {
-    margin: 0;
-    color: var(--text-secondary);
-  }
-
-  .warning-box {
-    background: var(--warning-bg);
-    border: 1px solid var(--warning-border);
-    border-radius: var(--radius-lg);
-    padding: var(--space-5);
-    margin-bottom: var(--space-5);
+  .copy-btn {
+    padding: var(--space-3) var(--space-5);
     font-size: var(--text-sm);
   }
-
-  .warning-box strong {
-    color: var(--warning-text);
-  }
-
-  .warning-box ul {
-    margin: var(--space-3) 0 0 0;
-    padding-left: var(--space-5);
-  }
-
-  .error-box {
-    background: var(--error-bg);
-    border: 1px solid var(--error-border);
-    border-radius: var(--radius-lg);
-    padding: var(--space-5);
+  .resume-info {
     margin-bottom: var(--space-5);
-    color: var(--error-text);
   }
-
-  .checkbox-label {
-    display: inline-flex;
-    align-items: flex-start;
-    gap: var(--space-3);
-    cursor: pointer;
-    margin-bottom: var(--space-5);
-    text-align: left;
+  .resume-info h3 {
+    margin: 0 0 var(--space-3) 0;
+    font-size: var(--text-base);
   }
-
-  .checkbox-label input[type="checkbox"] {
-    width: 18px;
-    height: 18px;
-    margin: 0;
-    flex-shrink: 0;
-  }
-
-  .button-row {
-    display: flex;
-    gap: var(--space-3);
-    justify-content: flex-end;
-    margin-top: var(--space-5);
-  }
-
-  .field {
-    margin-bottom: var(--space-5);
-  }
-
-  .field label {
-    display: block;
-    margin-bottom: var(--space-2);
-    font-weight: var(--font-medium);
-  }
-
-  .field input, .field select {
-    width: 100%;
-    padding: var(--space-3);
-    border: 1px solid var(--border);
-    border-radius: var(--radius-md);
-    background: var(--bg-primary);
-    color: var(--text-primary);
-  }
-
-  .field input:focus, .field select:focus {
-    outline: none;
-    border-color: var(--accent);
-  }
-
-  .hint {
-    font-size: var(--text-sm);
-    color: var(--text-secondary);
-    margin: var(--space-2) 0 0 0;
-  }
-
-  .hint.success {
-    color: var(--success-text);
-  }
-
-  .hint.error {
-    color: var(--error-text);
-  }
-
-  .handle-input-group {
+  .resume-details {
     display: flex;
+    flex-direction: column;
     gap: var(--space-2);
   }
-
-  .handle-input-group input {
-    flex: 1;
-  }
-
-  .handle-input-group select {
-    width: auto;
-  }
-
-  .current-info {
-    background: var(--bg-primary);
-    border-radius: var(--radius-lg);
-    padding: var(--space-4);
-    margin-bottom: var(--space-5);
-    display: flex;
-    justify-content: space-between;
-  }
-
-  .current-info .label {
-    color: var(--text-secondary);
-  }
-
-  .current-info .value {
-    font-weight: var(--font-medium);
-  }
-
-  .review-card {
-    background: var(--bg-primary);
-    border-radius: var(--radius-lg);
-    padding: var(--space-4);
-    margin-bottom: var(--space-5);
-  }
-
-  .review-row {
+  .resume-row {
     display: flex;
     justify-content: space-between;
-    padding: var(--space-3) 0;
-    border-bottom: 1px solid var(--border);
-  }
-
-  .review-row:last-child {
-    border-bottom: none;
-  }
-
-  .review-row .label {
-    color: var(--text-secondary);
-  }
-
-  .review-row .value {
-    font-weight: var(--font-medium);
-    text-align: right;
-    word-break: break-all;
-  }
-
-  .review-row .value.mono {
-    font-family: var(--font-mono);
     font-size: var(--text-sm);
   }
-
-  .progress-section {
-    margin-bottom: var(--space-5);
-  }
-
-  .progress-item {
-    display: flex;
-    align-items: center;
-    gap: var(--space-3);
-    padding: var(--space-3) 0;
-    color: var(--text-secondary);
-  }
-
-  .progress-item.completed {
-    color: var(--success-text);
-  }
-
-  .progress-item.active {
-    color: var(--accent);
-  }
-
-  .progress-item .icon {
-    width: 24px;
-    text-align: center;
-  }
-
-  .progress-bar {
-    height: 8px;
-    background: var(--bg-primary);
-    border-radius: 4px;
-    overflow: hidden;
-    margin-bottom: var(--space-4);
-  }
-
-  .progress-fill {
-    height: 100%;
-    background: var(--accent);
-    transition: width 0.3s ease;
-  }
-
-  .status-text {
-    text-align: center;
-    color: var(--text-secondary);
-    font-size: var(--text-sm);
-  }
-
-  .success-content {
-    text-align: center;
-  }
-
-  .success-icon {
-    width: 64px;
-    height: 64px;
-    background: var(--success-bg);
-    color: var(--success-text);
-    border-radius: 50%;
-    display: flex;
-    align-items: center;
-    justify-content: center;
-    font-size: var(--text-2xl);
-    margin: 0 auto var(--space-5) auto;
-  }
-
-  .success-details {
-    background: var(--bg-primary);
-    border-radius: var(--radius-lg);
-    padding: var(--space-4);
-    margin: var(--space-5) 0;
-    text-align: left;
-  }
-
-  .success-details .detail-row {
-    display: flex;
-    justify-content: space-between;
-    padding: var(--space-2) 0;
-  }
-
-  .success-details .label {
+  .resume-row .label {
     color: var(--text-secondary);
   }
-
-  .success-details .value {
+  .resume-row .value {
     font-weight: var(--font-medium);
   }
-
-  .success-details .value.mono {
-    font-family: var(--font-mono);
+  .resume-note {
+    margin-top: var(--space-3);
     font-size: var(--text-sm);
-  }
-
-  .redirect-text {
-    color: var(--text-secondary);
     font-style: italic;
-  }
-
-  .message.error {
-    background: var(--error-bg);
-    border: 1px solid var(--error-border);
-    color: var(--error-text);
-    padding: var(--space-4);
-    border-radius: var(--radius-lg);
-    margin-bottom: var(--space-5);
-  }
-
-  .code-block {
-    background: var(--bg-primary);
-    border: 1px solid var(--border);
-    border-radius: var(--radius-lg);
-    padding: var(--space-4);
-    margin-bottom: var(--space-5);
-    overflow-x: auto;
-  }
-
-  .code-block pre {
-    margin: 0;
-    font-family: var(--font-mono);
-    font-size: var(--text-sm);
-    white-space: pre-wrap;
-    word-break: break-all;
-  }
-
-  code {
-    font-family: var(--font-mono);
-    background: var(--bg-primary);
-    padding: 2px 6px;
-    border-radius: var(--radius-sm);
-    font-size: 0.9em;
   }
 </style>

frontend/src/components/migration/OutboundWizard.svelte

···
   import type { OutboundMigrationFlow } from '../../lib/migration'
   import type { ServerDescription } from '../../lib/migration/types'
   import { getAuthState, logout } from '../../lib/auth.svelte'
+  import '../../styles/migration.css'
 
   interface Props {
     flow: OutboundMigrationFlow
···
   }
 </script>
 
-<div class="outbound-wizard">
+<div class="migration-wizard">
   {#if flow.state.step !== 'welcome'}
     <div class="step-indicator">
       {#each steps as stepName, i}
···
   {/if}
 
   {#if flow.state.error}
-    <div class="message error">{flow.state.error}</div>
+    <div class="migration-message error">{flow.state.error}</div>
   {/if}
 
   {#if flow.state.step === 'welcome'}
···
       </div>
 
       {#if isDidWeb()}
-        <div class="warning-box">
+        <div class="migration-warning-box">
           <strong>did:web Migration Notice</strong>
           <p>
             Your account uses a did:web identifier ({auth.session?.did}). After migrating, this PDS will
···
         </div>
       {/if}
 
-      <div class="info-box">
+      <div class="migration-info-box">
         <h3>What will happen:</h3>
         <ol>
           <li>Choose your new PDS</li>
···
         </ol>
       </div>
 
-      <div class="warning-box">
+      <div class="migration-warning-box">
         <strong>Before you proceed:</strong>
         <ul>
           <li>You need access to the email registered with this account</li>
···
       <p>Enter the URL of the PDS you want to migrate to.</p>
 
       <form onsubmit={validatePds}>
-        <div class="field">
+        <div class="migration-field">
           <label for="pds-url">PDS URL</label>
           <input
             id="pds-url"
···
             disabled={loading}
             required
           />
-          <p class="hint">The server address of your new PDS (e.g., bsky.social, pds.example.com)</p>
+          <p class="migration-hint">The server address of your new PDS (e.g., bsky.social, pds.example.com)</p>
         </div>
 
         <div class="button-row">
···
         <span class="value">{flow.state.targetPdsUrl}</span>
       </div>
 
-      <div class="field">
+      <div class="migration-field">
         <label for="new-handle">New Handle</label>
         <div class="handle-input-group">
           <input
···
             </select>
           {/if}
         </div>
-        <p class="hint">You can also use your own domain by entering the full handle (e.g., alice.mydomain.com)</p>
+        <p class="migration-hint">You can also use your own domain by entering the full handle (e.g., alice.mydomain.com)</p>
       </div>
 
-      <div class="field">
+      <div class="migration-field">
         <label for="email">Email Address</label>
         <input
           id="email"
···
         />
       </div>
 
-      <div class="field">
+      <div class="migration-field">
         <label for="new-password">Password</label>
         <input
           id="new-password"
···
           required
           minlength="8"
         />
-        <p class="hint">At least 8 characters. This will be your password on the new PDS.</p>
+        <p class="migration-hint">At least 8 characters. This will be your password on the new PDS.</p>
       </div>
 
       {#if flow.state.targetServerInfo?.inviteCodeRequired}
-        <div class="field">
+        <div class="migration-field">
           <label for="invite">Invite Code</label>
           <input
             id="invite"
···
             oninput={(e) => flow.updateField('inviteCode', (e.target as HTMLInputElement).value)}
             required
           />
-          <p class="hint">Required by this PDS to create an account</p>
+          <p class="migration-hint">Required by this PDS to create an account</p>
         </div>
       {/if}
 
···
         </div>
       </div>
 
-      <div class="warning-box final-warning">
+      <div class="migration-warning-box final-warning">
         <strong>This action cannot be easily undone!</strong>
         <p>
           After migration completes, your account on this PDS will be deactivated.
···
       <h2>Verify Migration</h2>
       <p>A verification code has been sent to your email ({auth.session?.email}).</p>
 
-      <div class="info-box">
+      <div class="migration-info-box">
         <p>
           This code confirms you have access to the account and authorizes updating your identity
           to point to the new PDS.
···
       </div>
 
       <form onsubmit={submitPlcToken}>
-        <div class="field">
+        <div class="migration-field">
           <label for="plc-token">Verification Code</label>
           <input
             id="plc-token"
···
       </div>
 
       {#if flow.state.progress.blobsFailed.length > 0}
-        <div class="warning-box">
+        <div class="migration-warning-box">
           <strong>Note:</strong> {flow.state.progress.blobsFailed.length} blobs could not be migrated.
           These may be images or other media that are no longer available.
         </div>
···
       <h2>Migration Error</h2>
       <p>An error occurred during migration.</p>
 
-      <div class="error-box">
+      <div class="migration-error-box">
         {flow.state.error}
       </div>
 
···
 </div>
 
 <style>
-  .outbound-wizard {
-    max-width: 600px;
-    margin: 0 auto;
-  }
-
-  .step-indicator {
-    display: flex;
-    align-items: center;
-    justify-content: center;
-    margin-bottom: var(--space-8);
-    padding: 0 var(--space-4);
-  }
-
-  .step {
-    display: flex;
-    flex-direction: column;
-    align-items: center;
-    gap: var(--space-2);
-  }
-
-  .step-dot {
-    width: 32px;
-    height: 32px;
-    border-radius: 50%;
-    background: var(--bg-secondary);
-    border: 2px solid var(--border);
-    display: flex;
-    align-items: center;
-    justify-content: center;
-    font-size: var(--text-sm);
-    font-weight: var(--font-medium);
-    color: var(--text-secondary);
-  }
-
-  .step.active .step-dot {
-    background: var(--accent);
-    border-color: var(--accent);
-    color: var(--text-inverse);
-  }
-
-  .step.completed .step-dot {
-    background: var(--success-bg);
-    border-color: var(--success-text);
-    color: var(--success-text);
-  }
-
-  .step-label {
-    font-size: var(--text-xs);
-    color: var(--text-secondary);
-  }
-
-  .step.active .step-label {
-    color: var(--accent);
-    font-weight: var(--font-medium);
-  }
-
-  .step-line {
-    flex: 1;
-    height: 2px;
-    background: var(--border);
-    margin: 0 var(--space-2);
-    margin-bottom: var(--space-6);
-    min-width: 20px;
-  }
-
-  .step-line.completed {
-    background: var(--success-text);
-  }
-
-  .step-content {
-    background: var(--bg-secondary);
-    border-radius: var(--radius-xl);
-    padding: var(--space-6);
-  }
-
-  .step-content h2 {
-    margin: 0 0 var(--space-3) 0;
-  }
-
-  .step-content > p {
-    color: var(--text-secondary);
-    margin: 0 0 var(--space-5) 0;
-  }
-
-  .current-account {
-    background: var(--bg-primary);
-    border-radius: var(--radius-lg);
-    padding: var(--space-4);
-    margin-bottom: var(--space-5);
-    display: flex;
-    justify-content: space-between;
-    align-items: center;
-  }
-
-  .current-account .label {
-    color: var(--text-secondary);
-  }
-
-  .current-account .value {
-    font-weight: var(--font-medium);
-    font-size: var(--text-lg);
-  }
-
-  .info-box {
-    background: var(--accent-muted);
-    border: 1px solid var(--accent);
-    border-radius: var(--radius-lg);
-    padding: var(--space-5);
-    margin-bottom: var(--space-5);
-  }
-
-  .info-box h3 {
-    margin: 0 0 var(--space-3) 0;
-    font-size: var(--text-base);
-  }
-
-  .info-box ol, .info-box ul {
-    margin: 0;
-    padding-left: var(--space-5);
-  }
-
-  .info-box li {
-    margin-bottom: var(--space-2);
-    color: var(--text-secondary);
-  }
-
-  .info-box p {
-    margin: 0;
-    color: var(--text-secondary);
-  }
-
-  .warning-box {
-    background: var(--warning-bg);
-    border: 1px solid var(--warning-border);
-    border-radius: var(--radius-lg);
-    padding: var(--space-5);
-    margin-bottom: var(--space-5);
-    font-size: var(--text-sm);
-  }
-
-  .warning-box strong {
-    color: var(--warning-text);
-  }
-
-  .warning-box p {
-    margin: var(--space-3) 0 0 0;
-    color: var(--text-secondary);
-  }
-
-  .warning-box ul {
-    margin: var(--space-3) 0 0 0;
-    padding-left: var(--space-5);
-  }
-
-  .final-warning {
-    background: var(--error-bg);
-    border-color: var(--error-border);
-  }
-
-  .final-warning strong {
-    color: var(--error-text);
-  }
-
-  .error-box {
-    background: var(--error-bg);
-    border: 1px solid var(--error-border);
-    border-radius: var(--radius-lg);
-    padding: var(--space-5);
-    margin-bottom: var(--space-5);
-    color: var(--error-text);
-  }
-
-  .checkbox-label {
-    display: inline-flex;
-    align-items: flex-start;
-    gap: var(--space-3);
-    cursor: pointer;
-    margin-bottom: var(--space-5);
-    text-align: left;
-  }
-
-  .checkbox-label input[type="checkbox"] {
-    width: 18px;
-    height: 18px;
-    margin: 0;
-    flex-shrink: 0;
-  }
-
-  .button-row {
-    display: flex;
-    gap: var(--space-3);
-    justify-content: flex-end;
-    margin-top: var(--space-5);
-  }
-
-  .field {
-    margin-bottom: var(--space-5);
-  }
-
-  .field label {
-    display: block;
-    margin-bottom: var(--space-2);
-    font-weight: var(--font-medium);
-  }
-
-  .field input, .field select {
-    width: 100%;
-    padding: var(--space-3);
-    border: 1px solid var(--border);
-    border-radius: var(--radius-md);
-    background: var(--bg-primary);
-    color: var(--text-primary);
-  }
-
-  .field input:focus, .field select:focus {
-    outline: none;
-    border-color: var(--accent);
-  }
-
-  .hint {
-    font-size: var(--text-sm);
-    color: var(--text-secondary);
-    margin: var(--space-2) 0 0 0;
-  }
-
-  .handle-input-group {
-    display: flex;
-    gap: var(--space-2);
-  }
-
-  .handle-input-group input {
-    flex: 1;
-  }
-
-  .handle-input-group select {
-    width: auto;
-  }
-
-  .current-info {
-    background: var(--bg-primary);
-    border-radius: var(--radius-lg);
-    padding: var(--space-4);
-    margin-bottom: var(--space-5);
-    display: flex;
-    justify-content: space-between;
-  }
-
-  .current-info .label {
-    color: var(--text-secondary);
-  }
-
-  .current-info .value {
-    font-weight: var(--font-medium);
-  }
-
-  .server-info {
-    background: var(--bg-primary);
-    border-radius: var(--radius-lg);
-    padding: var(--space-4);
-    margin-top: var(--space-5);
-  }
-
-  .server-info h3 {
-    margin: 0 0 var(--space-3) 0;
-    font-size: var(--text-base);
-    color: var(--success-text);
-  }
-
-  .server-info .info-row {
-    display: flex;
-    justify-content: space-between;
-    padding: var(--space-2) 0;
-    font-size: var(--text-sm);
-  }
-
-  .server-info .label {
-    color: var(--text-secondary);
-  }
-
-  .server-info a {
-    display: inline-block;
-    margin-top: var(--space-2);
-    margin-right: var(--space-3);
-    color: var(--accent);
-    font-size: var(--text-sm);
-  }
-
-  .review-card {
-    background: var(--bg-primary);
-    border-radius: var(--radius-lg);
-    padding: var(--space-4);
-    margin-bottom: var(--space-5);
-  }
-
-  .review-row {
-    display: flex;
-    justify-content: space-between;
-    padding: var(--space-3) 0;
-    border-bottom: 1px solid var(--border);
-  }
-
-  .review-row:last-child {
-    border-bottom: none;
-  }
-
-  .review-row .label {
-    color: var(--text-secondary);
-  }
-
-  .review-row .value {
-    font-weight: var(--font-medium);
-    text-align: right;
-    word-break: break-all;
-  }
-
-  .review-row .value.mono {
-    font-family: var(--font-mono);
-    font-size: var(--text-sm);
-  }
-
-  .progress-section {
-    margin-bottom: var(--space-5);
-  }
-
-  .progress-item {
-    display: flex;
-    align-items: center;
-    gap: var(--space-3);
-    padding: var(--space-3) 0;
-    color: var(--text-secondary);
-  }
-
-  .progress-item.completed {
-    color: var(--success-text);
-  }
-
-  .progress-item.active {
-    color: var(--accent);
-  }
-
-  .progress-item .icon {
-    width: 24px;
-    text-align: center;
-  }
-
-  .progress-bar {
-    height: 8px;
-    background: var(--bg-primary);
-    border-radius: 4px;
-    overflow: hidden;
-    margin-bottom: var(--space-4);
-  }
-
-  .progress-fill {
-    height: 100%;
-    background: var(--accent);
-    transition: width 0.3s ease;
-  }
-
-  .status-text {
-    text-align: center;
-    color: var(--text-secondary);
-    font-size: var(--text-sm);
-  }
-
-  .success-content {
-    text-align: center;
-  }
-
-  .success-icon {
-    width: 64px;
-    height: 64px;
-    background: var(--success-bg);
-    color: var(--success-text);
-    border-radius: 50%;
-    display: flex;
-    align-items: center;
-    justify-content: center;
-    font-size: var(--text-2xl);
-    margin: 0 auto var(--space-5) auto;
-  }
-
-  .success-details {
-    background: var(--bg-primary);
-    border-radius: var(--radius-lg);
-    padding: var(--space-4);
-    margin: var(--space-5) 0;
-    text-align: left;
-  }
-
-  .success-details .detail-row {
-    display: flex;
-    justify-content: space-between;
-    padding: var(--space-2) 0;
-  }
-
-  .success-details .label {
-    color: var(--text-secondary);
-  }
-
-  .success-details .value {
-    font-weight: var(--font-medium);
-  }
-
-  .success-details .value.mono {
-    font-family: var(--font-mono);
-    font-size: var(--text-sm);
-  }
-
-  .next-steps {
-    background: var(--accent-muted);
-    border-radius: var(--radius-lg);
-    padding: var(--space-5);
-    margin: var(--space-5) 0;
-    text-align: left;
-  }
-
-  .next-steps h3 {
-    margin: 0 0 var(--space-3) 0;
-  }
-
-  .next-steps ol {
-    margin: 0;
-    padding-left: var(--space-5);
-  }
-
-  .next-steps li {
-    margin-bottom: var(--space-2);
-  }
-
-  .next-steps a {
-    color: var(--accent);
-  }
-
-  .redirect-text {
-    color: var(--text-secondary);
-    font-style: italic;
-  }
-
-  .message.error {
-    background: var(--error-bg);
-    border: 1px solid var(--error-border);
-    color: var(--error-text);
-    padding: var(--space-4);
-    border-radius: var(--radius-lg);
-    margin-bottom: var(--space-5);
-  }
 </style>

frontend/src/lib/auth.svelte.ts

···
   state.savedAccounts = newState.savedAccounts ?? [];
 }
 
-export function _testReset() {
+export function _testResetState() {
   state.session = null;
   state.loading = true;
   state.error = null;
   state.savedAccounts = [];
+}
+
+export function _testReset() {
+  _testResetState();
   localStorage.removeItem(STORAGE_KEY);
   localStorage.removeItem(ACCOUNTS_KEY);
 }

frontend/src/lib/crypto.ts

···
   publicKeyDidKey: string;
 }
 
-export async function generateKeypair(): Promise<Keypair> {
+export function generateKeypair(): Keypair {
   const privateKey = secp.utils.randomPrivateKey();
   const publicKey = secp.getPublicKey(privateKey, true);
 

frontend/src/lib/migration/atproto-client.ts

···
 import type {
   AccountStatus,
   BlobRef,
+  CompletePasskeySetupResponse,
   CreateAccountParams,
+  CreatePasskeyAccountParams,
   DidCredentials,
   DidDocument,
-  MigrationError,
+  OAuthServerMetadata,
+  OAuthTokenResponse,
+  PasskeyAccountSetup,
   PlcOperation,
   Preferences,
   ServerDescription,
   Session,
+  StartPasskeyRegistrationResponse,
 } from "./types";
 
 function apiLog(
···
 export class AtprotoClient {
   private baseUrl: string;
   private accessToken: string | null = null;
+  private dpopKeyPair: DPoPKeyPair | null = null;
+  private dpopNonce: string | null = null;
 
   constructor(pdsUrl: string) {
     this.baseUrl = pdsUrl.replace(/\/$/, "");
···
     return this.accessToken;
   }
 
+  setDPoPKeyPair(keyPair: DPoPKeyPair | null) {
+    this.dpopKeyPair = keyPair;
+  }
+
   private async xrpc<T>(
     method: string,
     options?: {
···
       url += `?${searchParams}`;
     }
 
-    const headers: Record<string, string> = {};
-    const token = authToken ?? this.accessToken;
-    if (token) {
-      headers["Authorization"] = `Bearer ${token}`;
-    }
+    const makeRequest = async (nonce?: string): Promise<Response> => {
+      const headers: Record<string, string> = {};
+      const token = authToken ?? this.accessToken;
+      if (token) {
+        if (this.dpopKeyPair) {
+          headers["Authorization"] = `DPoP ${token}`;
+          const tokenHash = await computeAccessTokenHash(token);
+          const dpopProof = await createDPoPProof(
+            this.dpopKeyPair,
+            httpMethod,
+            url.split("?")[0],
+            nonce,
+            tokenHash,
+          );
+          headers["DPoP"] = dpopProof;
+        } else {
+          headers["Authorization"] = `Bearer ${token}`;
+        }
+      }
+
+      let requestBody: BodyInit | undefined;
+      if (rawBody) {
+        headers["Content-Type"] = contentType ?? "application/octet-stream";
+        requestBody = rawBody;
+      } else if (body) {
+        headers["Content-Type"] = "application/json";
+        requestBody = JSON.stringify(body);
+      } else if (httpMethod === "POST") {
+        headers["Content-Type"] = "application/json";
+      }
 
-    let requestBody: BodyInit | undefined;
-    if (rawBody) {
-      headers["Content-Type"] = contentType ?? "application/octet-stream";
-      requestBody = rawBody;
-    } else if (body) {
-      headers["Content-Type"] = "application/json";
-      requestBody = JSON.stringify(body);
-    } else if (httpMethod === "POST") {
-      headers["Content-Type"] = "application/json";
+      return fetch(url, {
+        method: httpMethod,
+        headers,
+        body: requestBody,
+      });
+    };
+
+    let res = await makeRequest(this.dpopNonce ?? undefined);
+
+    if (!res.ok && this.dpopKeyPair) {
+      const dpopNonce = res.headers.get("DPoP-Nonce");
+      if (dpopNonce && dpopNonce !== this.dpopNonce) {
+        this.dpopNonce = dpopNonce;
+        res = await makeRequest(dpopNonce);
+      }
     }
 
-    const res = await fetch(url, {
-      method: httpMethod,
-      headers,
-      body: requestBody,
-    });
-
     if (!res.ok) {
       const err = await res.json().catch(() => ({
         error: "Unknown",
         message: res.statusText,
       }));
-      const error = new Error(err.message) as Error & {
+      const error = new Error(err.message || err.error || res.statusText) as Error & {
         status: number;
         error: string;
       };
       error.status = res.status;
       error.error = err.error;
       throw error;
+    }
+
+    const newNonce = res.headers.get("DPoP-Nonce");
+    if (newNonce) {
+      this.dpopNonce = newNonce;
     }
 
     const responseContentType = res.headers.get("content-type") ?? "";
···
         error: "Unknown",
         message: res.statusText,
       }));
-      const error = new Error(err.message) as Error & {
+      const error = new Error(err.message || err.error || res.statusText) as Error & {
         status: number;
         error: string;
       };
···
       httpMethod: "POST",
     });
   }
+
+  async createPasskeyAccount(
+    params: CreatePasskeyAccountParams,
+    serviceToken?: string,
+  ): Promise<PasskeyAccountSetup> {
+    const headers: Record<string, string> = {
+      "Content-Type": "application/json",
+    };
+    if (serviceToken) {
+      headers["Authorization"] = `Bearer ${serviceToken}`;
+    }
+
+    const res = await fetch(
+      `${this.baseUrl}/xrpc/com.tranquil.account.createPasskeyAccount`,
+      {
+        method: "POST",
+        headers,
+        body: JSON.stringify(params),
+      },
+    );
+
+    if (!res.ok) {
+      const err = await res.json().catch(() => ({
+        error: "Unknown",
+        message: res.statusText,
+      }));
+      const error = new Error(err.message || err.error || res.statusText) as Error & {
+        status: number;
+        error: string;
+      };
+      error.status = res.status;
+      error.error = err.error;
+      throw error;
+    }
+
+    return res.json();
+  }
+
+  async startPasskeyRegistrationForSetup(
+    did: string,
+    setupToken: string,
+    friendlyName?: string,
+  ): Promise<StartPasskeyRegistrationResponse> {
+    return this.xrpc("com.tranquil.account.startPasskeyRegistrationForSetup", {
+      httpMethod: "POST",
+      body: { did, setupToken, friendlyName },
+    });
+  }
+
+  async completePasskeySetup(
+    did: string,
+    setupToken: string,
+    passkeyCredential: unknown,
+    passkeyFriendlyName?: string,
+  ): Promise<CompletePasskeySetupResponse> {
+    return this.xrpc("com.tranquil.account.completePasskeySetup", {
+      httpMethod: "POST",
+      body: { did, setupToken, passkeyCredential, passkeyFriendlyName },
+    });
+  }
+}
+
+export async function getOAuthServerMetadata(
+  pdsUrl: string,
+): Promise<OAuthServerMetadata | null> {
+  try {
+    const directUrl = `${pdsUrl}/.well-known/oauth-authorization-server`;
+    const directRes = await fetch(directUrl);
+    if (directRes.ok) {
+      return directRes.json();
+    }
+
+    const protectedResourceUrl = `${pdsUrl}/.well-known/oauth-protected-resource`;
+    const protectedRes = await fetch(protectedResourceUrl);
+    if (!protectedRes.ok) {
+      return null;
+    }
+
+    const protectedMetadata = await protectedRes.json();
+    const authServers = protectedMetadata.authorization_servers;
+    if (!authServers || authServers.length === 0) {
+      return null;
+    }
+
+    const authServerUrl = `${authServers[0]}/.well-known/oauth-authorization-server`;
+    const authServerRes = await fetch(authServerUrl);
+    if (!authServerRes.ok) {
+      return null;
+    }
+
+    return authServerRes.json();
+  } catch {
+    return null;
+  }
+}
+
+export async function generatePKCE(): Promise<{
+  codeVerifier: string;
+  codeChallenge: string;
+}> {
+  const array = new Uint8Array(32);
+  crypto.getRandomValues(array);
+  const codeVerifier = base64UrlEncode(array);
+
+  const encoder = new TextEncoder();
+  const data = encoder.encode(codeVerifier);
+  const digest = await crypto.subtle.digest("SHA-256", data);
+  const codeChallenge = base64UrlEncode(new Uint8Array(digest));
+
+  return { codeVerifier, codeChallenge };
+}
+
+export function base64UrlEncode(buffer: Uint8Array | ArrayBuffer): string {
+  const bytes = buffer instanceof ArrayBuffer ? new Uint8Array(buffer) : buffer;
+  let binary = "";
+  for (let i = 0; i < bytes.length; i++) {
+    binary += String.fromCharCode(bytes[i]);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+
+export function base64UrlDecode(base64url: string): Uint8Array {
+  const base64 = base64url.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = base64 + "=".repeat((4 - (base64.length % 4)) % 4);
+  const binary = atob(padded);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) {
+    bytes[i] = binary.charCodeAt(i);
+  }
+  return bytes;
+}
+
+export function prepareWebAuthnCreationOptions(
+  options: { publicKey: Record<string, unknown> },
+): PublicKeyCredentialCreationOptions {
+  const pk = options.publicKey;
+  return {
+    ...pk,
+    challenge: base64UrlDecode(pk.challenge as string),
+    user: {
+      ...(pk.user as Record<string, unknown>),
+      id: base64UrlDecode((pk.user as Record<string, unknown>).id as string),
+    },
+    excludeCredentials:
+      ((pk.excludeCredentials as Array<Record<string, unknown>>) ?? []).map(
+        (cred) => ({
+          ...cred,
+          id: base64UrlDecode(cred.id as string),
+        }),
+      ),
+  } as PublicKeyCredentialCreationOptions;
+}
+
+async function computeAccessTokenHash(accessToken: string): Promise<string> {
+  const encoder = new TextEncoder();
+  const data = encoder.encode(accessToken);
+  const hash = await crypto.subtle.digest("SHA-256", data);
+  return base64UrlEncode(new Uint8Array(hash));
+}
+
+export function generateOAuthState(): string {
+  const array = new Uint8Array(16);
+  crypto.getRandomValues(array);
+  return base64UrlEncode(array);
+}
+
+export function buildOAuthAuthorizationUrl(
+  metadata: OAuthServerMetadata,
+  params: {
+    clientId: string;
+    redirectUri: string;
+    codeChallenge: string;
+    state: string;
+    scope?: string;
+    dpopJkt?: string;
+    loginHint?: string;
+  },
+): string {
+  const url = new URL(metadata.authorization_endpoint);
+  url.searchParams.set("response_type", "code");
+  url.searchParams.set("client_id", params.clientId);
+  url.searchParams.set("redirect_uri", params.redirectUri);
+  url.searchParams.set("code_challenge", params.codeChallenge);
+  url.searchParams.set("code_challenge_method", "S256");
+  url.searchParams.set("state", params.state);
+  url.searchParams.set("scope", params.scope ?? "atproto");
+  if (params.dpopJkt) {
+    url.searchParams.set("dpop_jkt", params.dpopJkt);
+  }
+  if (params.loginHint) {
+    url.searchParams.set("login_hint", params.loginHint);
+  }
+  return url.toString();
+}
+
+export async function exchangeOAuthCode(
+  metadata: OAuthServerMetadata,
+  params: {
+    code: string;
+    codeVerifier: string;
+    clientId: string;
+    redirectUri: string;
+    dpopKeyPair?: DPoPKeyPair;
+  },
+): Promise<OAuthTokenResponse> {
+  const body = new URLSearchParams({
+    grant_type: "authorization_code",
+    code: params.code,
+    code_verifier: params.codeVerifier,
+    client_id: params.clientId,
+    redirect_uri: params.redirectUri,
+  });
+
+  const makeRequest = async (nonce?: string): Promise<Response> => {
+    const headers: Record<string, string> = {
+      "Content-Type": "application/x-www-form-urlencoded",
+    };
+
+    if (params.dpopKeyPair) {
+      const dpopProof = await createDPoPProof(
+        params.dpopKeyPair,
+        "POST",
+        metadata.token_endpoint,
+        nonce,
+      );
+      headers["DPoP"] = dpopProof;
+    }
+
+    return fetch(metadata.token_endpoint, {
+      method: "POST",
+      headers,
+      body: body.toString(),
+    });
+  };
+
+  let res = await makeRequest();
+
+  if (!res.ok) {
+    const err = await res.json().catch(() => ({
+      error: "token_error",
+      error_description: res.statusText,
+    }));
+
+    if (err.error === "use_dpop_nonce" && params.dpopKeyPair) {
+      const dpopNonce = res.headers.get("DPoP-Nonce");
+      if (dpopNonce) {
+        res = await makeRequest(dpopNonce);
+        if (!res.ok) {
+          const retryErr = await res.json().catch(() => ({
+            error: "token_error",
+            error_description: res.statusText,
+          }));
+          throw new Error(
+            retryErr.error_description || retryErr.error || "Token exchange failed",
+          );
+        }
+        return res.json();
+      }
+    }
+
+    throw new Error(err.error_description || err.error || "Token exchange failed");
+  }
+
+  return res.json();
 }
 
 export async function resolveDidDocument(did: string): Promise<DidDocument> {
···
 export async function resolvePdsUrl(
   handleOrDid: string,
 ): Promise<{ did: string; pdsUrl: string }> {
-  let did: string;
+  let did: string | undefined;
 
   if (handleOrDid.startsWith("did:")) {
     did = handleOrDid;
···
     }
   }
 
+  if (!did) {
+    throw new Error("Could not resolve DID");
+  }
+
   const didDoc = await resolveDidDocument(did);
 
   const pdsService = didDoc.service?.find(
···
 }
 
 export function createLocalClient(): AtprotoClient {
-  return new AtprotoClient(window.location.origin);
+  return new AtprotoClient(globalThis.location.origin);
+}
+
+export function getMigrationOAuthClientId(): string {
+  return `${globalThis.location.origin}/oauth/client-metadata.json`;
+}
+
+export function getMigrationOAuthRedirectUri(): string {
+  return `${globalThis.location.origin}/migrate`;
+}
+
+export interface DPoPKeyPair {
+  privateKey: CryptoKey;
+  publicKey: CryptoKey;
+  jwk: JsonWebKey;
+  thumbprint: string;
+}
+
+const DPOP_KEY_STORAGE = "migration_dpop_key";
+const DPOP_KEY_MAX_AGE_MS = 24 * 60 * 60 * 1000;
+
+export async function generateDPoPKeyPair(): Promise<DPoPKeyPair> {
+  const keyPair = await crypto.subtle.generateKey(
+    {
+      name: "ECDSA",
+      namedCurve: "P-256",
+    },
+    true,
+    ["sign", "verify"],
+  );
+
+  const publicJwk = await crypto.subtle.exportKey("jwk", keyPair.publicKey);
+  const thumbprint = await computeJwkThumbprint(publicJwk);
+
+  return {
+    privateKey: keyPair.privateKey,
+    publicKey: keyPair.publicKey,
+    jwk: publicJwk,
+    thumbprint,
+  };
+}
+
+async function computeJwkThumbprint(jwk: JsonWebKey): Promise<string> {
+  const thumbprintInput = JSON.stringify({
+    crv: jwk.crv,
+    kty: jwk.kty,
+    x: jwk.x,
+    y: jwk.y,
+  });
+
+  const encoder = new TextEncoder();
+  const data = encoder.encode(thumbprintInput);
+  const hash = await crypto.subtle.digest("SHA-256", data);
+  return base64UrlEncode(new Uint8Array(hash));
+}
+
+export async function saveDPoPKey(keyPair: DPoPKeyPair): Promise<void> {
+  const privateJwk = await crypto.subtle.exportKey("jwk", keyPair.privateKey);
+  const stored = {
+    privateJwk,
+    publicJwk: keyPair.jwk,
+    thumbprint: keyPair.thumbprint,
+    createdAt: Date.now(),
+  };
+  localStorage.setItem(DPOP_KEY_STORAGE, JSON.stringify(stored));
+}
+
+export async function loadDPoPKey(): Promise<DPoPKeyPair | null> {
+  const stored = localStorage.getItem(DPOP_KEY_STORAGE);
+  if (!stored) return null;
+
+  try {
+    const { privateJwk, publicJwk, thumbprint, createdAt } = JSON.parse(stored);
+
+    if (createdAt && Date.now() - createdAt > DPOP_KEY_MAX_AGE_MS) {
+      localStorage.removeItem(DPOP_KEY_STORAGE);
+      return null;
+    }
+
+    const privateKey = await crypto.subtle.importKey(
+      "jwk",
+      privateJwk,
+      { name: "ECDSA", namedCurve: "P-256" },
+      true,
+      ["sign"],
+    );
+
+    const publicKey = await crypto.subtle.importKey(
+      "jwk",
+      publicJwk,
+      { name: "ECDSA", namedCurve: "P-256" },
+      true,
+      ["verify"],
+    );
+
+    return { privateKey, publicKey, jwk: publicJwk, thumbprint };
+  } catch {
+    localStorage.removeItem(DPOP_KEY_STORAGE);
+    return null;
+  }
+}
+
+export function clearDPoPKey(): void {
+  localStorage.removeItem(DPOP_KEY_STORAGE);
+}
+
+export async function createDPoPProof(
+  keyPair: DPoPKeyPair,
+  httpMethod: string,
+  httpUri: string,
+  nonce?: string,
+  accessTokenHash?: string,
+): Promise<string> {
+  const header = {
+    typ: "dpop+jwt",
+    alg: "ES256",
+    jwk: {
+      kty: keyPair.jwk.kty,
+      crv: keyPair.jwk.crv,
+      x: keyPair.jwk.x,
+      y: keyPair.jwk.y,
+    },
+  };
+
+  const payload: Record<string, unknown> = {
+    jti: crypto.randomUUID(),
+    htm: httpMethod,
+    htu: httpUri,
+    iat: Math.floor(Date.now() / 1000),
+  };
+
+  if (nonce) {
+    payload.nonce = nonce;
+  }
+
+  if (accessTokenHash) {
+    payload.ath = accessTokenHash;
+  }
+
+  const headerB64 = base64UrlEncode(
+    new TextEncoder().encode(JSON.stringify(header)),
+  );
+  const payloadB64 = base64UrlEncode(
+    new TextEncoder().encode(JSON.stringify(payload)),
+  );
+
+  const signingInput = `${headerB64}.${payloadB64}`;
+  const signature = await crypto.subtle.sign(
+    { name: "ECDSA", hash: "SHA-256" },
+    keyPair.privateKey,
+    new TextEncoder().encode(signingInput),
+  );
+
+  const signatureB64 = base64UrlEncode(new Uint8Array(signature));
+  return `${headerB64}.${payloadB64}.${signatureB64}`;
 }

frontend/src/lib/migration/flow.svelte.ts

···
   InboundMigrationState,
   InboundStep,
   MigrationProgress,
+  OAuthServerMetadata,
   OutboundMigrationState,
   OutboundStep,
+  PasskeyAccountSetup,
   ServerDescription,
   StoredMigrationState,
 } from "./types";
 import {
   AtprotoClient,
+  buildOAuthAuthorizationUrl,
+  clearDPoPKey,
   createLocalClient,
+  exchangeOAuthCode,
+  generateDPoPKeyPair,
+  generateOAuthState,
+  generatePKCE,
+  getMigrationOAuthClientId,
+  getMigrationOAuthRedirectUri,
+  getOAuthServerMetadata,
+  loadDPoPKey,
   resolvePdsUrl,
+  saveDPoPKey,
 } from "./atproto-client";
 import {
   clearMigrationState,
-  loadMigrationState,
   saveMigrationState,
   updateProgress,
   updateStep,
···
     plcToken: "",
     progress: createInitialProgress(),
     error: null,
-    requires2FA: false,
-    twoFactorCode: "",
     targetVerificationMethod: null,
+    authMethod: "password",
+    passkeySetupToken: null,
+    oauthCodeVerifier: null,
+    generatedAppPassword: null,
+    generatedAppPasswordName: null,
   });
 
   let sourceClient: AtprotoClient | null = null;
   let localClient: AtprotoClient | null = null;
   let localServerInfo: ServerDescription | null = null;
+  let sourceOAuthMetadata: OAuthServerMetadata | null = null;
 
   function setStep(step: InboundStep) {
     state.step = step;
···
     }
   }
 
-  async function loginToSource(
-    handle: string,
-    password: string,
-    twoFactorCode?: string,
-  ): Promise<void> {
-    migrationLog("loginToSource START", { handle, has2FA: !!twoFactorCode });
+  async function initiateOAuthLogin(handle: string): Promise<void> {
+    migrationLog("initiateOAuthLogin START", { handle });
 
     if (!state.sourcePdsUrl) {
       await resolveSourcePds(handle);
     }
 
-    if (!sourceClient) {
-      sourceClient = new AtprotoClient(state.sourcePdsUrl);
+    const metadata = await getOAuthServerMetadata(state.sourcePdsUrl);
+    if (!metadata) {
+      throw new Error(
+        "Source PDS does not support OAuth. This PDS only supports OAuth-based migrations.",
+      );
+    }
+    sourceOAuthMetadata = metadata;
+
+    const { codeVerifier, codeChallenge } = await generatePKCE();
+    const oauthState = generateOAuthState();
+
+    const dpopKeyPair = await generateDPoPKeyPair();
+    await saveDPoPKey(dpopKeyPair);
+
+    localStorage.setItem("migration_oauth_state", oauthState);
+    localStorage.setItem("migration_oauth_code_verifier", codeVerifier);
+    localStorage.setItem("migration_source_pds_url", state.sourcePdsUrl);
+    localStorage.setItem("migration_source_did", state.sourceDid);
+    localStorage.setItem("migration_source_handle", state.sourceHandle);
+    localStorage.setItem("migration_oauth_issuer", metadata.issuer);
+
+    const authUrl = buildOAuthAuthorizationUrl(metadata, {
+      clientId: getMigrationOAuthClientId(),
+      redirectUri: getMigrationOAuthRedirectUri(),
+      codeChallenge,
+      state: oauthState,
+      scope: "atproto identity:* rpc:com.atproto.server.createAccount?aud=*",
+      dpopJkt: dpopKeyPair.thumbprint,
+      loginHint: state.sourceHandle,
+    });
+
+    migrationLog("initiateOAuthLogin: Redirecting to authorization", {
+      sourcePdsUrl: state.sourcePdsUrl,
+      authEndpoint: metadata.authorization_endpoint,
+      dpopJkt: dpopKeyPair.thumbprint,
+    });
+
+    state.oauthCodeVerifier = codeVerifier;
+    saveMigrationState(state);
+
+    globalThis.location.href = authUrl;
+  }
+
+  function cleanupOAuthSessionData(): void {
+    localStorage.removeItem("migration_oauth_state");
+    localStorage.removeItem("migration_oauth_code_verifier");
+    localStorage.removeItem("migration_source_pds_url");
+    localStorage.removeItem("migration_source_did");
+    localStorage.removeItem("migration_source_handle");
+    localStorage.removeItem("migration_oauth_issuer");
+  }
+
+  async function handleOAuthCallback(
+    code: string,
+    returnedState: string,
+  ): Promise<void> {
+    migrationLog("handleOAuthCallback START");
+
+    const savedState = localStorage.getItem("migration_oauth_state");
+    const codeVerifier = localStorage.getItem("migration_oauth_code_verifier");
+    const sourcePdsUrl = localStorage.getItem("migration_source_pds_url");
+    const sourceDid = localStorage.getItem("migration_source_did");
+    const sourceHandle = localStorage.getItem("migration_source_handle");
+    const oauthIssuer = localStorage.getItem("migration_oauth_issuer");
+
+    if (returnedState !== savedState) {
+      cleanupOAuthSessionData();
+      throw new Error("OAuth state mismatch - possible CSRF attack");
     }
 
+    if (!codeVerifier || !sourcePdsUrl || !sourceDid || !sourceHandle) {
+      cleanupOAuthSessionData();
+      throw new Error("Missing OAuth session data");
+    }
+
+    const dpopKeyPair = await loadDPoPKey();
+    if (!dpopKeyPair) {
+      cleanupOAuthSessionData();
+      throw new Error("Missing DPoP key - please restart the migration");
+    }
+
+    state.sourcePdsUrl = sourcePdsUrl;
+    state.sourceDid = sourceDid;
+    state.sourceHandle = sourceHandle;
+    sourceClient = new AtprotoClient(sourcePdsUrl);
+
+    let metadata = await getOAuthServerMetadata(sourcePdsUrl);
+    if (!metadata && oauthIssuer) {
+      metadata = await getOAuthServerMetadata(oauthIssuer);
+    }
+    if (!metadata) {
+      cleanupOAuthSessionData();
+      throw new Error("Could not fetch OAuth server metadata");
+    }
+    sourceOAuthMetadata = metadata;
+
+    migrationLog("handleOAuthCallback: Exchanging code for tokens");
+
+    let tokenResponse;
     try {
-      migrationLog("loginToSource: Calling createSession on OLD PDS", {
-        pdsUrl: state.sourcePdsUrl,
+      tokenResponse = await exchangeOAuthCode(metadata, {
+        code,
+        codeVerifier,
+        clientId: getMigrationOAuthClientId(),
+        redirectUri: getMigrationOAuthRedirectUri(),
+        dpopKeyPair,
       });
-      const session = await sourceClient.login(handle, password, twoFactorCode);
-      migrationLog("loginToSource SUCCESS", {
-        did: session.did,
-        handle: session.handle,
-        pdsUrl: state.sourcePdsUrl,
-      });
-      state.sourceAccessToken = session.accessJwt;
-      state.sourceRefreshToken = session.refreshJwt;
-      state.sourceDid = session.did;
-      state.sourceHandle = session.handle;
-      state.requires2FA = false;
-      saveMigrationState(state);
-    } catch (e) {
-      const err = e as Error & { error?: string };
-      migrationLog("loginToSource FAILED", {
-        error: err.message,
-        errorCode: err.error,
-      });
-      if (err.error === "AuthFactorTokenRequired") {
-        state.requires2FA = true;
-        throw new Error(
-          "Two-factor authentication required. Please enter the code sent to your email.",
-        );
+    } catch (err) {
+      cleanupOAuthSessionData();
+      throw err;
+    }
+
+    migrationLog("handleOAuthCallback: Got access token");
+
+    state.sourceAccessToken = tokenResponse.access_token;
+    state.sourceRefreshToken = tokenResponse.refresh_token ?? null;
+    sourceClient.setAccessToken(tokenResponse.access_token);
+    sourceClient.setDPoPKeyPair(dpopKeyPair);
+
+    cleanupOAuthSessionData();
+
+    if (state.needsReauth && state.resumeToStep) {
+      const targetStep = state.resumeToStep;
+      state.needsReauth = false;
+      state.resumeToStep = undefined;
+
+      const postEmailSteps = [
+        "plc-token",
+        "did-web-update",
+        "finalizing",
+        "app-password",
+      ];
+
+      if (postEmailSteps.includes(targetStep)) {
+        if (state.authMethod === "passkey" && state.passkeySetupToken) {
+          localClient = createLocalClient();
+          setStep("passkey-setup");
+          migrationLog("handleOAuthCallback: Resuming passkey flow at passkey-setup");
+        } else {
+          setStep("email-verify");
+          migrationLog("handleOAuthCallback: Resuming at email-verify for re-auth");
+        }
+      } else {
+        setStep(targetStep);
       }
-      throw e;
+    } else {
+      setStep("choose-handle");
     }
+    saveMigrationState(state);
   }
 
   async function checkHandleAvailability(handle: string): Promise<boolean> {
···
     await localClient.loginDeactivated(email, password);
   }
 
+  let passkeySetup: PasskeyAccountSetup | null = null;
+
   async function startMigration(): Promise<void> {
     migrationLog("startMigration START", {
       sourceDid: state.sourceDid,
       sourceHandle: state.sourceHandle,
       targetHandle: state.targetHandle,
       sourcePdsUrl: state.sourcePdsUrl,
+      authMethod: state.authMethod,
     });
 
     if (!sourceClient || !state.sourceAccessToken) {
-      migrationLog("startMigration ERROR: Not logged in to source PDS");
-      throw new Error("Not logged in to source PDS");
+      migrationLog("startMigration ERROR: Not authenticated to source PDS");
+      throw new Error("Not authenticated to source PDS");
     }
 
     if (!localClient) {
···
     }
 
     setStep("migrating");
-    setProgress({ currentOperation: "Getting service auth token..." });
 
     try {
+      setProgress({ currentOperation: "Getting service auth token..." });
       migrationLog("startMigration: Loading local server info");
       const serverInfo = await loadLocalServerInfo();
       migrationLog("startMigration: Got server info", {
         serverDid: serverInfo.did,
       });
 
-      migrationLog("startMigration: Getting service auth token from OLD PDS");
+      migrationLog("startMigration: Getting service auth token from source PDS");
       const { token } = await sourceClient.getServiceAuth(
         serverInfo.did,
         "com.atproto.server.createAccount",
···
 
       setProgress({ currentOperation: "Creating account on new PDS..." });
 
-      const accountParams = {
-        did: state.sourceDid,
-        handle: state.targetHandle,
-        email: state.targetEmail,
-        password: state.targetPassword,
-        inviteCode: state.inviteCode || undefined,
-      };
+      if (state.authMethod === "passkey") {
+        const passkeyParams = {
+          did: state.sourceDid,
+          handle: state.targetHandle,
+          email: state.targetEmail,
+          inviteCode: state.inviteCode || undefined,
+        };
 
-      migrationLog("startMigration: Creating account on NEW PDS", {
-        did: accountParams.did,
-        handle: accountParams.handle,
-      });
-      const session = await localClient.createAccount(accountParams, token);
-      migrationLog("startMigration: Account created on NEW PDS", {
-        did: session.did,
-      });
-      localClient.setAccessToken(session.accessJwt);
+        migrationLog("startMigration: Creating passkey account on NEW PDS", {
+          did: passkeyParams.did,
+          handle: passkeyParams.handle,
+          inviteCode: passkeyParams.inviteCode,
+          stateInviteCode: state.inviteCode,
+        });
+        passkeySetup = await localClient.createPasskeyAccount(passkeyParams, token);
+        migrationLog("startMigration: Passkey account created on NEW PDS", {
+          did: passkeySetup.did,
+          hasAccessJwt: !!passkeySetup.accessJwt,
+        });
+        state.passkeySetupToken = passkeySetup.setupToken;
+        if (passkeySetup.accessJwt) {
+          localClient.setAccessToken(passkeySetup.accessJwt);
+        }
+      } else {
+        const accountParams = {
+          did: state.sourceDid,
+          handle: state.targetHandle,
+          email: state.targetEmail,
+          password: state.targetPassword,
+          inviteCode: state.inviteCode || undefined,
+        };
+
+        migrationLog("startMigration: Creating account on NEW PDS", {
+          did: accountParams.did,
+          handle: accountParams.handle,
+        });
+        const session = await localClient.createAccount(accountParams, token);
+        migrationLog("startMigration: Account created on NEW PDS", {
+          did: session.did,
+        });
+        localClient.setAccessToken(session.accessJwt);
+      }
 
       setProgress({ currentOperation: "Exporting repository..." });
-      migrationLog("startMigration: Exporting repo from OLD PDS");
+      migrationLog("startMigration: Exporting repo from source PDS");
       const exportStart = Date.now();
       const car = await sourceClient.getRepo(state.sourceDid);
       migrationLog("startMigration: Repo exported", {
···
           await localClient.uploadBlob(blobData, "application/octet-stream");
           migrated++;
           setProgress({ blobsMigrated: migrated });
-        } catch (e) {
+        } catch {
           state.progress.blobsFailed.push(blob.cid);
         }
       }
···
       const prefs = await sourceClient.getPreferences();
       await localClient.putPreferences(prefs);
       setProgress({ prefsMigrated: true });
-    } catch {
-    }
+    } catch { /* optional, best-effort */ }
   }
 
   async function submitEmailVerifyToken(
···
       await localClient.verifyToken(token, state.targetEmail);
 
       if (!sourceClient) {
-        setStep("source-login");
+        setStep("source-handle");
         setError(
           "Email verified! Please log in to your old account again to complete the migration.",
         );
         return;
       }
 
+      if (state.authMethod === "passkey") {
+        migrationLog(
+          "submitEmailVerifyToken: Email verified, proceeding to passkey setup",
+        );
+        setStep("passkey-setup");
+        return;
+      }
+
       if (localPassword) {
         setProgress({ currentOperation: "Authenticating to new PDS..." });
         await localClient.loginDeactivated(state.targetEmail, localPassword);
···
     if (checkingEmailVerification) return false;
     if (!sourceClient || !localClient) return false;
 
+    if (state.authMethod === "passkey") {
+      return false;
+    }
+
     checkingEmailVerification = true;
     try {
       await localClient.loginDeactivated(
···
         services: credentials.services,
       });
 
-      migrationLog("Step 2: Signing PLC operation on OLD PDS", {
+      migrationLog("Step 2: Signing PLC operation on source PDS", {
         sourcePdsUrl: state.sourcePdsUrl,
       });
       const signStart = Date.now();
···
       setProgress({ activated: true });
 
       setProgress({ currentOperation: "Deactivating old account..." });
-      migrationLog("Step 5: Deactivating account on OLD PDS", {
+      migrationLog("Step 5: Deactivating account on source PDS", {
         sourcePdsUrl: state.sourcePdsUrl,
       });
       const deactivateStart = Date.now();
       try {
         await sourceClient.deactivateAccount();
-        migrationLog("Step 5 COMPLETE: Account deactivated on OLD PDS", {
+        migrationLog("Step 5 COMPLETE: Account deactivated on source PDS", {
           durationMs: Date.now() - deactivateStart,
           success: true,
         });
···
           error?: string;
           status?: number;
         };
-        migrationLog("Step 5 FAILED: Could not deactivate on OLD PDS", {
+        migrationLog("Step 5 FAILED: Could not deactivate on source PDS", {
           durationMs: Date.now() - deactivateStart,
           error: err.message,
           errorCode: err.error,
···
       setProgress({ activated: true });
 
       setProgress({ currentOperation: "Deactivating old account..." });
-      migrationLog("Deactivating account on OLD PDS");
+      migrationLog("Deactivating account on source PDS");
       const deactivateStart = Date.now();
       try {
         await sourceClient.deactivateAccount();
-        migrationLog("Account deactivated on OLD PDS", {
+        migrationLog("Account deactivated on source PDS", {
           durationMs: Date.now() - deactivateStart,
         });
         setProgress({ deactivated: true });
       } catch (deactivateErr) {
         const err = deactivateErr as Error & { error?: string };
-        migrationLog("Could not deactivate on OLD PDS", { error: err.message });
+        migrationLog("Could not deactivate on source PDS", { error: err.message });
       }
 
       migrationLog("completeDidWebMigration SUCCESS");
···
     }
   }
 
+  async function startPasskeyRegistration(): Promise<{ options: unknown }> {
+    if (!localClient || !state.passkeySetupToken) {
+      throw new Error("Not ready for passkey registration");
+    }
+
+    migrationLog("startPasskeyRegistration START", { did: state.sourceDid });
+    const result = await localClient.startPasskeyRegistrationForSetup(
+      state.sourceDid,
+      state.passkeySetupToken,
+    );
+    migrationLog("startPasskeyRegistration: Got WebAuthn options");
+    return result;
+  }
+
+  async function completePasskeyRegistration(
+    credential: unknown,
+    friendlyName?: string,
+  ): Promise<void> {
+    if (!localClient || !state.passkeySetupToken || !sourceClient) {
+      throw new Error("Not ready for passkey registration");
+    }
+
+    migrationLog("completePasskeyRegistration START", { did: state.sourceDid });
+
+    const result = await localClient.completePasskeySetup(
+      state.sourceDid,
+      state.passkeySetupToken,
+      credential,
+      friendlyName,
+    );
+    migrationLog("completePasskeyRegistration: Passkey registered", {
+      appPassword: "***",
+    });
+
+    setProgress({ currentOperation: "Authenticating with app password..." });
+    await localClient.loginDeactivated(state.targetEmail, result.appPassword);
+    migrationLog("completePasskeyRegistration: Authenticated to new PDS");
+
+    state.generatedAppPassword = result.appPassword;
+    state.generatedAppPasswordName = result.appPasswordName;
+    setStep("app-password");
+  }
+
+  async function proceedFromAppPassword(): Promise<void> {
+    if (!sourceClient || !localClient) {
+      throw new Error("Clients not initialized");
+    }
+
+    migrationLog("proceedFromAppPassword: Starting");
+
+    if (state.sourceDid.startsWith("did:web:")) {
+      const credentials = await localClient.getRecommendedDidCredentials();
+      state.targetVerificationMethod =
+        credentials.verificationMethods?.atproto || null;
+      setStep("did-web-update");
+    } else {
+      setProgress({ currentOperation: "Requesting PLC operation token..." });
+      await sourceClient.requestPlcOperationSignature();
+      setStep("plc-token");
+    }
+  }
+
   function reset(): void {
     state = {
       direction: "inbound",
···
       plcToken: "",
       progress: createInitialProgress(),
       error: null,
-      requires2FA: false,
-      twoFactorCode: "",
       targetVerificationMethod: null,
+      authMethod: "password",
+      passkeySetupToken: null,
+      oauthCodeVerifier: null,
+      generatedAppPassword: null,
+      generatedAppPasswordName: null,
     };
     sourceClient = null;
+    passkeySetup = null;
+    sourceOAuthMetadata = null;
     clearMigrationState();
+    clearDPoPKey();
   }
 
   async function resumeFromState(stored: StoredMigrationState): Promise<void> {
···
     state.sourceHandle = stored.sourceHandle;
     state.targetHandle = stored.targetHandle;
     state.targetEmail = stored.targetEmail;
+    state.authMethod = stored.authMethod ?? "password";
     state.progress = {
       ...createInitialProgress(),
       ...stored.progress,
     };
 
-    state.step = "source-login";
+    const stepsRequiringSourceAuth = [
+      "choose-handle",
+      "review",
+      "migrating",
+      "email-verify",
+      "plc-token",
+      "did-web-update",
+      "finalizing",
+      "app-password",
+    ];
+
+    if (stepsRequiringSourceAuth.includes(stored.step)) {
+      state.step = "source-handle";
+      state.needsReauth = true;
+      state.resumeToStep = stored.step as InboundMigrationState["step"];
+      migrationLog("resumeFromState: Requiring re-auth for step", {
+        originalStep: stored.step,
+      });
+    } else if (stored.step === "passkey-setup" && stored.passkeySetupToken) {
+      state.passkeySetupToken = stored.passkeySetupToken;
+      localClient = createLocalClient();
+      state.step = "passkey-setup";
+      migrationLog("resumeFromState: Restored passkey-setup with token");
+    } else if (stored.step === "success") {
+      state.step = "success";
+    } else if (stored.step === "error") {
+      state.step = "source-handle";
+      state.needsReauth = true;
+      migrationLog("resumeFromState: Error state, requiring re-auth");
+    } else {
+      state.step = stored.step as InboundMigrationState["step"];
+    }
   }
 
   function getLocalSession():
···
     get state() {
       return state;
     },
+    get passkeySetup() {
+      return passkeySetup;
+    },
     setStep,
     setError,
     loadLocalServerInfo,
-    loginToSource,
+    resolveSourcePds,
+    initiateOAuthLogin,
+    handleOAuthCallback,
     authenticateToLocal,
     checkHandleAvailability,
     startMigration,
···
     submitPlcToken,
     resendPlcToken,
     completeDidWebMigration,
+    startPasskeyRegistration,
+    completePasskeyRegistration,
+    proceedFromAppPassword,
     reset,
     resumeFromState,
     getLocalSession,
···
           await targetClient.uploadBlob(blobData, "application/octet-stream");
           migrated++;
           setProgress({ blobsMigrated: migrated });
-        } catch (e) {
+        } catch {
           state.progress.blobsFailed.push(blob.cid);
         }
       }
···
       const prefs = await localClient.getPreferences();
       await targetClient.putPreferences(prefs);
       setProgress({ prefsMigrated: true });
-    } catch {
-    }
+    } catch { /* optional, best-effort */ }
   }
 
   async function submitPlcToken(token: string): Promise<void> {
···
       try {
         await localClient.deactivateAccount(state.targetPdsUrl);
         setProgress({ deactivated: true });
-      } catch {
-      }
+      } catch { /* optional, best-effort */ }
 
       setStep("success");
       clearMigrationState();

frontend/src/lib/migration/storage.ts

···
   MigrationState,
   StoredMigrationState,
 } from "./types";
+import { clearDPoPKey } from "./atproto-client";
 
 const STORAGE_KEY = "tranquil_migration_state";
 const MAX_AGE_MS = 24 * 60 * 60 * 1000;
···
     startedAt: new Date().toISOString(),
     sourcePdsUrl: state.direction === "inbound"
       ? state.sourcePdsUrl
-      : window.location.origin,
+      : globalThis.location.origin,
     targetPdsUrl: state.direction === "inbound"
-      ? window.location.origin
+      ? globalThis.location.origin
       : state.targetPdsUrl,
     sourceDid: state.direction === "inbound" ? state.sourceDid : "",
     sourceHandle: state.direction === "inbound" ? state.sourceHandle : "",
     targetHandle: state.targetHandle,
     targetEmail: state.targetEmail,
+    authMethod: state.direction === "inbound" ? state.authMethod : undefined,
+    passkeySetupToken: state.direction === "inbound"
+      ? state.passkeySetupToken ?? undefined
+      : undefined,
     progress: {
       repoExported: state.progress.repoExported,
       repoImported: state.progress.repoImported,
···
   };
 
   try {
-    sessionStorage.setItem(STORAGE_KEY, JSON.stringify(storedState));
-  } catch {
-  }
+    localStorage.setItem(STORAGE_KEY, JSON.stringify(storedState));
+  } catch { /* localStorage unavailable */ }
 }
 
 export function loadMigrationState(): StoredMigrationState | null {
   try {
-    const stored = sessionStorage.getItem(STORAGE_KEY);
+    const stored = localStorage.getItem(STORAGE_KEY);
     if (!stored) return null;
 
     const state = JSON.parse(stored) as StoredMigrationState;
 
-    if (state.version !== 1) return null;
+    if (state.version !== 1) {
+      clearMigrationState();
+      return null;
+    }
 
     const startedAt = new Date(state.startedAt).getTime();
     if (Date.now() - startedAt > MAX_AGE_MS) {
···
 
     return state;
   } catch {
+    clearMigrationState();
     return null;
   }
 }
 
 export function clearMigrationState(): void {
   try {
-    sessionStorage.removeItem(STORAGE_KEY);
-  } catch {
-  }
+    localStorage.removeItem(STORAGE_KEY);
+    clearDPoPKey();
+  } catch { /* localStorage unavailable */ }
 }
 
 export function hasPendingMigration(): boolean {
···
   targetHandle: string;
   sourcePdsUrl: string;
   targetPdsUrl: string;
+  targetEmail: string;
+  authMethod?: "password" | "passkey";
   progressSummary: string;
   step: string;
 } | null {
···
     targetHandle: state.targetHandle,
     sourcePdsUrl: state.sourcePdsUrl,
     targetPdsUrl: state.targetPdsUrl,
+    targetEmail: state.targetEmail,
+    authMethod: state.authMethod,
     progressSummary: progressParts.length > 0
       ? progressParts.join(", ")
       : "just started",
···
 
   state.progress = { ...state.progress, ...updates };
   try {
-    sessionStorage.setItem(STORAGE_KEY, JSON.stringify(state));
-  } catch {
-  }
+    localStorage.setItem(STORAGE_KEY, JSON.stringify(state));
+  } catch { /* localStorage unavailable */ }
 }
 
 export function updateStep(step: string): void {
···
 
   state.step = step;
   try {
-    sessionStorage.setItem(STORAGE_KEY, JSON.stringify(state));
-  } catch {
-  }
+    localStorage.setItem(STORAGE_KEY, JSON.stringify(state));
+  } catch { /* localStorage unavailable */ }
 }
 
 export function setError(error: string, step: string): void {
···
   state.lastError = error;
   state.lastErrorStep = step;
   try {
-    sessionStorage.setItem(STORAGE_KEY, JSON.stringify(state));
-  } catch {
-  }
+    localStorage.setItem(STORAGE_KEY, JSON.stringify(state));
+  } catch { /* localStorage unavailable */ }
 }

frontend/src/lib/migration/types.ts

···
 export type InboundStep =
   | "welcome"
-  | "source-login"
+  | "source-handle"
   | "choose-handle"
   | "review"
   | "migrating"
+  | "passkey-setup"
+  | "app-password"
   | "email-verify"
   | "plc-token"
   | "did-web-update"
   | "finalizing"
   | "success"
   | "error";
+
+export type AuthMethod = "password" | "passkey";
 
 export type OutboundStep =
   | "welcome"
···
   plcToken: string;
   progress: MigrationProgress;
   error: string | null;
-  requires2FA: boolean;
-  twoFactorCode: string;
   targetVerificationMethod: string | null;
+  authMethod: AuthMethod;
+  passkeySetupToken: string | null;
+  oauthCodeVerifier: string | null;
+  generatedAppPassword: string | null;
+  generatedAppPasswordName: string | null;
+  needsReauth?: boolean;
+  resumeToStep?: InboundStep;
 }
 
 export interface OutboundMigrationState {
···
   sourceHandle: string;
   targetHandle: string;
   targetEmail: string;
+  authMethod?: AuthMethod;
+  passkeySetupToken?: string;
   progress: {
     repoExported: boolean;
     repoImported: boolean;
···
   recoveryKey?: string;
 }
 
+export interface CreatePasskeyAccountParams {
+  did?: string;
+  handle: string;
+  email: string;
+  inviteCode?: string;
+}
+
+export interface PasskeyAccountSetup {
+  setupToken: string;
+  did: string;
+  handle: string;
+  setupExpiresAt: string;
+  accessJwt?: string;
+}
+
+export interface CompletePasskeySetupResponse {
+  did: string;
+  handle: string;
+  appPassword: string;
+  appPasswordName: string;
+}
+
+export interface StartPasskeyRegistrationResponse {
+  options: unknown;
+}
+
+export interface OAuthServerMetadata {
+  issuer: string;
+  authorization_endpoint: string;
+  token_endpoint: string;
+  scopes_supported?: string[];
+  response_types_supported?: string[];
+  grant_types_supported?: string[];
+  code_challenge_methods_supported?: string[];
+  dpop_signing_alg_values_supported?: string[];
+}
+
+export interface OAuthTokenResponse {
+  access_token: string;
+  token_type: string;
+  expires_in?: number;
+  refresh_token?: string;
+  scope?: string;
+}
+
 export interface Preferences {
   preferences: unknown[];
 }
···
     this.name = "MigrationError";
   }
 }
+
+export function getErrorMessage(err: unknown): string {
+  if (err instanceof Error) {
+    return err.message;
+  }
+  if (typeof err === "string") {
+    return err;
+  }
+  return String(err);
+}

frontend/src/lib/oauth.ts

···
   "blob:*/*",
 ].join(" ");
 const CLIENT_ID = !(import.meta.env.DEV)
-  ? `${window.location.origin}/oauth/client-metadata.json`
+  ? `${globalThis.location.origin}/oauth/client-metadata.json`
   : `http://localhost/?scope=${SCOPES}`;
-const REDIRECT_URI = `${window.location.origin}/`;
+const REDIRECT_URI = `${globalThis.location.origin}/`;
 
 interface OAuthState {
   state: string;
···
 
   const { request_uri } = await parResponse.json();
 
-  const authorizeUrl = new URL("/oauth/authorize", window.location.origin);
+  const authorizeUrl = new URL("/oauth/authorize", globalThis.location.origin);
   authorizeUrl.searchParams.set("client_id", CLIENT_ID);
   authorizeUrl.searchParams.set("request_uri", request_uri);
 
-  window.location.href = authorizeUrl.toString();
+  globalThis.location.href = authorizeUrl.toString();
 }
 
 export interface OAuthTokens {
···
 export function checkForOAuthCallback():
   | { code: string; state: string }
   | null {
-  const params = new URLSearchParams(window.location.search);
+  if (globalThis.location.hash === "#/migrate") {
+    return null;
+  }
+
+  const params = new URLSearchParams(globalThis.location.search);
   const code = params.get("code");
   const state = params.get("state");
 
···
 }
 
 export function clearOAuthCallbackParams(): void {
-  const url = new URL(window.location.href);
+  const url = new URL(globalThis.location.href);
   url.search = "";
-  window.history.replaceState({}, "", url.toString());
+  globalThis.history.replaceState({}, "", url.toString());
 }

frontend/src/lib/registration/flow.svelte.ts

···
         state.externalDidWeb.reservedSigningKey = result.signingKey;
         publicKeyMultibase = result.signingKey.replace("did:key:", "");
       } else {
-        const keypair = await generateKeypair();
+        const keypair = generateKeypair();
         state.externalDidWeb.byodPrivateKey = keypair.privateKey;
         state.externalDidWeb.byodPublicKeyMultibase =
           keypair.publicKeyMultibase;

frontend/src/lib/router.svelte.ts

···
 let currentPath = $state(
-  getPathWithoutQuery(window.location.hash.slice(1) || "/"),
+  getPathWithoutQuery(globalThis.location.hash.slice(1) || "/"),
 );
 
 function getPathWithoutQuery(hash: string): string {
···
   return queryIndex === -1 ? hash : hash.slice(0, queryIndex);
 }
 
-window.addEventListener("hashchange", () => {
-  currentPath = getPathWithoutQuery(window.location.hash.slice(1) || "/");
+globalThis.addEventListener("hashchange", () => {
+  currentPath = getPathWithoutQuery(globalThis.location.hash.slice(1) || "/");
 });
 
 export function navigate(path: string) {
   currentPath = path;
-  window.location.hash = path;
+  globalThis.location.hash = path;
 }
 
 export function getCurrentPath() {

frontend/src/lib/serverConfig.svelte.ts

···
   if (initialized) return;
   initialized = true;
 
-  darkModeQuery = window.matchMedia("(prefers-color-scheme: dark)");
+  darkModeQuery = globalThis.matchMedia("(prefers-color-scheme: dark)");
   darkModeQuery.addEventListener("change", applyColors);
 
   try {

frontend/src/locales/en.json

···
   "reauth": {
     "title": "Re-authentication Required",
     "subtitle": "Please verify your identity to continue.",
+    "password": "Password",
+    "totp": "TOTP",
+    "passkey": "Passkey",
+    "authenticatorCode": "Authenticator Code",
     "usePassword": "Use Password",
     "usePasskey": "Use Passkey",
     "useTotp": "Use Authenticator",
···
     "totpPlaceholder": "Enter 6-digit code",
     "verify": "Verify",
     "verifying": "Verifying...",
+    "authenticating": "Authenticating...",
+    "passkeyPrompt": "Click the button below to authenticate with your passkey.",
     "cancel": "Cancel"
   },
   "delegation": {
···
     "beforeMigrate4": "Your old PDS will be notified to deactivate your account",
     "importantWarning": "Account migration is a significant action. Make sure you trust the destination PDS and understand that your data will be moved. If something goes wrong, recovery may require manual intervention.",
     "learnMore": "Learn more about migration risks",
+    "comingSoon": "Coming soon",
+    "oauthCompleting": "Completing authentication...",
+    "oauthFailed": "Authentication Failed",
+    "tryAgain": "Try Again",
     "resume": {
       "title": "Resume Migration?",
       "incomplete": "You have an incomplete migration in progress:",
···
         "desc": "Move your existing AT Protocol account to this server.",
         "understand": "I understand the risks and want to proceed"
       },
-      "sourceLogin": {
-        "title": "Sign In to Your Current PDS",
-        "desc": "Enter your credentials for the account you want to migrate.",
+      "sourceAuth": {
+        "title": "Enter Your Current Handle",
+        "titleResume": "Resume Migration",
+        "desc": "Enter the handle of the account you want to migrate.",
+        "descResume": "Re-authenticate to your source PDS to continue the migration.",
         "handle": "Handle",
-        "handlePlaceholder": "you.bsky.social",
-        "password": "Password",
-        "twoFactorCode": "Two-Factor Code",
-        "twoFactorRequired": "Two-factor authentication required",
-        "signIn": "Sign In & Continue"
+        "handlePlaceholder": "alice.bsky.social",
+        "handleHint": "Your current handle on your existing PDS",
+        "continue": "Continue",
+        "connecting": "Connecting...",
+        "reauthenticate": "Re-authenticate",
+        "resumeTitle": "Migration in Progress",
+        "resumeFrom": "From",
+        "resumeTo": "To",
+        "resumeProgress": "Progress",
+        "resumeOAuthNote": "You need to re-authenticate via OAuth to continue."
       },
       "chooseHandle": {
         "title": "Choose Your New Handle",
         "desc": "Select a handle for your account on this PDS.",
-        "handleHint": "Your full handle will be: @{handle}"
+        "migratingFrom": "Migrating from",
+        "newHandle": "New Handle",
+        "checkingAvailability": "Checking availability...",
+        "handleAvailable": "Handle is available!",
+        "handleTaken": "Handle is already taken",
+        "handleHint": "You can also use your own domain by entering the full handle (e.g., alice.mydomain.com)",
+        "email": "Email Address",
+        "authMethod": "Authentication Method",
+        "authPassword": "Password",
+        "authPasswordDesc": "Traditional password-based login",
+        "authPasskey": "Passkey",
+        "authPasskeyDesc": "Passwordless login using biometrics or security key",
+        "password": "Password",
+        "passwordHint": "At least 8 characters",
+        "passkeyInfo": "You'll set up a passkey after your account is created. Your device will prompt you to use biometrics (fingerprint, Face ID) or a security key.",
+        "inviteCode": "Invite Code"
       },
       "review": {
         "title": "Review Migration",
-        "desc": "Please review and confirm your migration details.",
+        "desc": "Please confirm the details of your migration.",
         "currentHandle": "Current Handle",
         "newHandle": "New Handle",
-        "sourcePds": "Source PDS",
-        "targetPds": "This PDS",
+        "did": "DID",
+        "sourcePds": "From PDS",
+        "targetPds": "To PDS",
         "email": "Email",
+        "authentication": "Authentication",
+        "authPasskey": "Passkey (passwordless)",
+        "authPassword": "Password",
         "inviteCode": "Invite Code",
-        "confirm": "I confirm I want to migrate my account",
-        "startMigration": "Start Migration"
+        "warning": "After you click \"Start Migration\", your repository and data will begin transferring. This process cannot be easily undone.",
+        "startMigration": "Start Migration",
+        "starting": "Starting..."
       },
       "migrating": {
-        "title": "Migrating Your Account",
-        "desc": "Please wait while we transfer your data...",
-        "gettingServiceAuth": "Getting service authorization...",
-        "creatingAccount": "Creating account on new PDS...",
-        "exportingRepo": "Exporting repository...",
-        "importingRepo": "Importing repository...",
-        "countingBlobs": "Counting blobs...",
-        "migratingBlobs": "Migrating blobs ({current}/{total})...",
-        "migratingPrefs": "Migrating preferences...",
-        "requestingPlc": "Requesting PLC operation..."
+        "title": "Migration in Progress",
+        "desc": "Please wait while your account is being transferred...",
+        "exportRepo": "Export repository",
+        "importRepo": "Import repository",
+        "migrateBlobs": "Migrate blobs",
+        "migratePrefs": "Migrate preferences"
+      },
+      "passkeySetup": {
+        "title": "Set Up Your Passkey",
+        "desc": "Your email has been verified. Now set up your passkey for secure, passwordless login.",
+        "nameLabel": "Passkey Name (optional)",
+        "namePlaceholder": "e.g., MacBook Pro, iPhone",
+        "nameHint": "A friendly name to identify this passkey",
+        "instructions": "Click the button below to register your passkey. Your device will prompt you to use biometrics (fingerprint, Face ID) or a security key.",
+        "register": "Register Passkey",
+        "registering": "Registering..."
+      },
+      "appPassword": {
+        "title": "Save Your App Password",
+        "desc": "Your passkey has been created. An app password has been generated for you to use with apps that don't support passkeys yet.",
+        "warning": "This app password is required to sign into apps that don't support passkeys yet (like bsky.app). You will only see this password once.",
+        "label": "App Password for",
+        "saved": "I have saved my app password in a secure location",
+        "continue": "Continue"
       },
       "emailVerify": {
         "title": "Verify Your Email",
···
         "verifying": "Verifying..."
       },
       "plcToken": {
-        "title": "Verify Your Identity",
-        "desc": "A verification code has been sent to your email on your current PDS.",
-        "tokenLabel": "Verification Token",
-        "tokenPlaceholder": "Enter the token from your email",
-        "resend": "Resend Token",
-        "resending": "Resending..."
+        "title": "Verify Migration",
+        "desc": "A verification code has been sent to the email registered with your old account.",
+        "info": "This code confirms you have access to the account and authorizes updating your identity to point to this PDS.",
+        "tokenLabel": "Verification Code",
+        "tokenPlaceholder": "Enter code from email",
+        "resend": "Resend Code",
+        "complete": "Complete Migration",
+        "completing": "Verifying..."
       },
       "didWebUpdate": {
         "title": "Update Your DID Document",
···
       "success": {
         "title": "Migration Complete!",
         "desc": "Your account has been successfully migrated to this PDS.",
-        "newHandle": "New Handle",
+        "yourNewHandle": "Your new handle",
         "did": "DID",
-        "goToDashboard": "Go to Dashboard"
+        "blobsWarning": "{count} blobs could not be migrated. These may be images or other media that are no longer available.",
+        "redirecting": "Redirecting to dashboard..."
+      },
+      "error": {
+        "title": "Migration Error",
+        "desc": "An error occurred during migration.",
+        "startOver": "Start Over"
+      },
+      "common": {
+        "back": "Back",
+        "cancel": "Cancel",
+        "continue": "Continue",
+        "whatWillHappen": "What will happen:",
+        "step1": "Log in to your current PDS",
+        "step2": "Choose your new handle on this server",
+        "step3": "Your repository and blobs will be transferred",
+        "step4": "Verify the migration via email",
+        "step5": "Your identity will be updated to point here",
+        "beforeProceed": "Before you proceed:",
+        "warning1": "You need access to the email registered with your current account",
+        "warning2": "Large accounts may take several minutes to transfer",
+        "warning3": "Your old account will be deactivated after migration"
       }
     },
     "outbound": {

frontend/src/locales/fi.json

···
   "reauth": {
     "title": "Uudelleentodennus vaaditaan",
     "subtitle": "Vahvista henkilöllisyytesi jatkaaksesi.",
+    "password": "Salasana",
+    "totp": "TOTP",
+    "passkey": "Pääsyavain",
+    "authenticatorCode": "Todentajan koodi",
     "usePassword": "Käytä salasanaa",
     "usePasskey": "Käytä pääsyavainta",
     "useTotp": "Käytä todentajaa",
···
     "totpPlaceholder": "Syötä 6-numeroinen koodi",
     "verify": "Vahvista",
     "verifying": "Vahvistetaan...",
+    "authenticating": "Todennetaan...",
+    "passkeyPrompt": "Klikkaa alla olevaa painiketta todentaaksesi pääsyavaimellasi.",
     "cancel": "Peruuta"
   },
   "verifyChannel": {
···
     "beforeMigrate4": "Vanhalle PDS:llesi ilmoitetaan tilisi deaktivoinnista",
     "importantWarning": "Tilin siirto on merkittävä toimenpide. Varmista, että luotat kohde-PDS:ään ja ymmärrät, että tietosi siirretään. Jos jokin menee pieleen, palautus voi vaatia manuaalista toimenpidettä.",
     "learnMore": "Lue lisää siirron riskeistä",
+    "comingSoon": "Tulossa pian",
+    "oauthCompleting": "Viimeistellään todennusta...",
+    "oauthFailed": "Todennus epäonnistui",
+    "tryAgain": "Yritä uudelleen",
     "resume": {
       "title": "Jatka siirtoa?",
       "incomplete": "Sinulla on keskeneräinen siirto:",
···
         "desc": "Siirrä olemassa oleva AT Protocol -tilisi tälle palvelimelle.",
         "understand": "Ymmärrän riskit ja haluan jatkaa"
       },
-      "sourceLogin": {
-        "title": "Kirjaudu nykyiseen PDS:ääsi",
-        "desc": "Syötä siirrettävän tilin tunnukset.",
+      "sourceAuth": {
+        "title": "Syötä nykyinen käyttäjätunnuksesi",
+        "titleResume": "Jatka siirtoa",
+        "desc": "Syötä siirrettävän tilin käyttäjätunnus.",
+        "descResume": "Tunnistaudu uudelleen lähde-PDS:ään jatkaaksesi siirtoa.",
         "handle": "Käyttäjätunnus",
-        "handlePlaceholder": "sinä.bsky.social",
-        "password": "Salasana",
-        "twoFactorCode": "Kaksivaiheinen koodi",
-        "twoFactorRequired": "Kaksivaiheinen tunnistautuminen vaaditaan",
-        "signIn": "Kirjaudu ja jatka"
+        "handlePlaceholder": "maija.bsky.social",
+        "handleHint": "Nykyinen käyttäjätunnuksesi nykyisessä PDS:ssäsi",
+        "continue": "Jatka",
+        "connecting": "Yhdistetään...",
+        "reauthenticate": "Tunnistaudu uudelleen",
+        "resumeTitle": "Siirto käynnissä",
+        "resumeFrom": "Mistä",
+        "resumeTo": "Minne",
+        "resumeProgress": "Edistyminen",
+        "resumeOAuthNote": "Sinun täytyy tunnistautua uudelleen OAuth:n kautta jatkaaksesi."
       },
       "chooseHandle": {
         "title": "Valitse uusi käyttäjätunnuksesi",
         "desc": "Valitse käyttäjätunnus tilillesi tässä PDS:ssä.",
-        "handleHint": "Täydellinen käyttäjätunnuksesi on: @{handle}"
+        "migratingFrom": "Siirretään tililtä",
+        "newHandle": "Uusi käyttäjätunnus",
+        "checkingAvailability": "Tarkistetaan saatavuutta...",
+        "handleAvailable": "Käyttäjätunnus on saatavilla!",
+        "handleTaken": "Käyttäjätunnus on jo varattu",
+        "handleHint": "Voit myös käyttää omaa verkkotunnustasi syöttämällä täydellisen käyttäjätunnuksen (esim. maija.omadomain.fi)",
+        "email": "Sähköpostiosoite",
+        "authMethod": "Tunnistautumistapa",
+        "authPassword": "Salasana",
+        "authPasswordDesc": "Perinteinen salasanapohjainen kirjautuminen",
+        "authPasskey": "Pääsyavain",
+        "authPasskeyDesc": "Salasanaton kirjautuminen biometriikalla tai suojausavaimella",
+        "password": "Salasana",
+        "passwordHint": "Vähintään 8 merkkiä",
+        "passkeyInfo": "Määrität pääsyavaimen tilisi luomisen jälkeen. Laitteesi pyytää käyttämään biometriikkaa (sormenjälki, Face ID) tai suojausavainta.",
+        "inviteCode": "Kutsukoodi"
       },
       "review": {
         "title": "Tarkista siirto",
-        "desc": "Tarkista ja vahvista siirtotietosi.",
+        "desc": "Vahvista siirtosi tiedot.",
         "currentHandle": "Nykyinen käyttäjätunnus",
         "newHandle": "Uusi käyttäjätunnus",
+        "did": "DID",
         "sourcePds": "Lähde-PDS",
-        "targetPds": "Tämä PDS",
+        "targetPds": "Kohde-PDS",
         "email": "Sähköposti",
+        "authentication": "Tunnistautuminen",
+        "authPasskey": "Pääsyavain (salasanaton)",
+        "authPassword": "Salasana",
         "inviteCode": "Kutsukoodi",
-        "confirm": "Vahvistan haluavani siirtää tilini",
-        "startMigration": "Aloita siirto"
+        "warning": "Kun klikkaat \"Aloita siirto\", tietovarastosi ja datasi alkavat siirtyä. Tätä prosessia ei voi helposti peruuttaa.",
+        "startMigration": "Aloita siirto",
+        "starting": "Aloitetaan..."
       },
       "migrating": {
-        "title": "Siirretään tiliäsi",
-        "desc": "Odota, kun siirrämme tietojasi...",
-        "gettingServiceAuth": "Haetaan palveluvaltuutusta...",
-        "creatingAccount": "Luodaan tiliä uuteen PDS:ään...",
-        "exportingRepo": "Viedään tietovarastoa...",
-        "importingRepo": "Tuodaan tietovarastoa...",
-        "countingBlobs": "Lasketaan blob-tiedostoja...",
-        "migratingBlobs": "Siirretään blob-tiedostoja ({current}/{total})...",
-        "migratingPrefs": "Siirretään asetuksia...",
-        "requestingPlc": "Pyydetään PLC-toimintoa..."
+        "title": "Siirto käynnissä",
+        "desc": "Odota, kun tiliäsi siirretään...",
+        "exportRepo": "Vie tietovarasto",
+        "importRepo": "Tuo tietovarasto",
+        "migrateBlobs": "Siirrä blob-tiedostot",
+        "migratePrefs": "Siirrä asetukset"
+      },
+      "passkeySetup": {
+        "title": "Määritä pääsyavaimesi",
+        "desc": "Sähköpostisi on vahvistettu. Määritä nyt pääsyavaimesi turvallista, salasanatonta kirjautumista varten.",
+        "nameLabel": "Pääsyavaimen nimi (valinnainen)",
+        "namePlaceholder": "esim. MacBook Pro, iPhone",
+        "nameHint": "Kutsumanimi tämän pääsyavaimen tunnistamiseen",
+        "instructions": "Klikkaa alla olevaa painiketta rekisteröidäksesi pääsyavaimesi. Laitteesi pyytää käyttämään biometriikkaa (sormenjälki, Face ID) tai suojausavainta.",
+        "register": "Rekisteröi pääsyavain",
+        "registering": "Rekisteröidään..."
+      },
+      "appPassword": {
+        "title": "Tallenna sovellussalasanasi",
+        "desc": "Pääsyavaimesi on luotu. Sovellussalasana on luotu sinulle käytettäväksi sovellusten kanssa, jotka eivät vielä tue pääsyavaimia.",
+        "warning": "Tämä sovellussalasana vaaditaan kirjautumiseen sovelluksissa, jotka eivät vielä tue pääsyavaimia (kuten bsky.app). Näet tämän salasanan vain kerran.",
+        "label": "Sovellussalasana kohteelle",
+        "saved": "Olen tallentanut sovellussalasanani turvalliseen paikkaan",
+        "continue": "Jatka"
       },
       "emailVerify": {
         "title": "Vahvista sähköpostisi",
···
         "verifying": "Vahvistetaan..."
       },
       "plcToken": {
-        "title": "Vahvista henkilöllisyytesi",
-        "desc": "Vahvistuskoodi on lähetetty sähköpostiisi nykyisessä PDS:ssäsi.",
+        "title": "Vahvista siirto",
+        "desc": "Vahvistuskoodi on lähetetty vanhaan tiliisi rekisteröityyn sähköpostiin.",
+        "info": "Tämä koodi vahvistaa, että sinulla on pääsy tiliin ja valtuuttaa identiteettisi päivityksen osoittamaan tähän PDS:ään.",
         "tokenLabel": "Vahvistuskoodi",
         "tokenPlaceholder": "Syötä sähköpostista saatu koodi",
-        "resend": "Lähetä uudelleen",
-        "resending": "Lähetetään..."
+        "resend": "Lähetä koodi uudelleen",
+        "complete": "Viimeistele siirto",
+        "completing": "Vahvistetaan..."
       },
       "didWebUpdate": {
         "title": "Päivitä DID-dokumenttisi",
···
       "success": {
         "title": "Siirto valmis!",
         "desc": "Tilisi on siirretty onnistuneesti tähän PDS:ään.",
-        "newHandle": "Uusi käyttäjätunnus",
+        "yourNewHandle": "Uusi käyttäjätunnuksesi",
         "did": "DID",
-        "goToDashboard": "Siirry hallintapaneeliin"
+        "blobsWarning": "{count} blob-tiedostoa ei voitu siirtää. Nämä voivat olla kuvia tai muuta mediaa, jotka eivät ole enää saatavilla.",
+        "redirecting": "Uudelleenohjataan hallintapaneeliin..."
+      },
+      "error": {
+        "title": "Siirtovirhe",
+        "desc": "Siirron aikana tapahtui virhe.",
+        "startOver": "Aloita alusta"
+      },
+      "common": {
+        "back": "Takaisin",
+        "cancel": "Peruuta",
+        "continue": "Jatka",
+        "whatWillHappen": "Mitä tapahtuu:",
+        "step1": "Kirjaudu nykyiseen PDS:ääsi",
+        "step2": "Valitse uusi käyttäjätunnus tällä palvelimella",
+        "step3": "Tietovarastosi ja blob-tiedostosi siirretään",
+        "step4": "Vahvista siirto sähköpostilla",
+        "step5": "Identiteettisi päivitetään osoittamaan tänne",
+        "beforeProceed": "Ennen kuin jatkat:",
+        "warning1": "Tarvitset pääsyn nykyiseen tiliisi rekisteröityyn sähköpostiin",
+        "warning2": "Suurten tilien siirto voi kestää useita minuutteja",
+        "warning3": "Vanha tilisi deaktivoidaan siirron jälkeen"
       }
     },
     "outbound": {

frontend/src/locales/ja.json

···
     "title": "DID ドキュメントエディター",
     "preview": "現在の DID ドキュメント",
     "verificationMethods": "検証方法（署名キー）",
+    "verificationMethodsDesc": "DIDの代わりに動作できる署名キー。新しいPDSに移行する際は、そのPDSの署名キーをここに追加してください。",
     "addKey": "キーを追加",
     "removeKey": "削除",
     "keyId": "キー ID",
     "keyIdPlaceholder": "#atproto",
     "publicKey": "公開キー（Multibase）",
     "publicKeyPlaceholder": "zQ3sh...",
+    "noKeys": "検証方法が設定されていません。ローカルPDSキーを使用しています。",
     "alsoKnownAs": "別名（ハンドル）",
+    "alsoKnownAsDesc": "DIDを指すハンドル。新しいPDSでハンドルが変更されたら更新してください。",
     "addHandle": "ハンドルを追加",
+    "removeHandle": "削除",
+    "handle": "ハンドル",
     "handlePlaceholder": "at://handle.pds.com",
-    "serviceEndpoint": "サービスエンドポイント（現在の PDS）",
+    "noHandles": "ハンドルが設定されていません。ローカルハンドルを使用しています。",
+    "serviceEndpoint": "サービスエンドポイント",
+    "serviceEndpointDesc": "アカウントデータを現在ホストしているPDS。移行時に更新してください。",
+    "currentPds": "現在のPDS URL",
     "save": "変更を保存",
     "saving": "保存中...",
     "success": "DID ドキュメントを更新しました",
+    "saveFailed": "DIDドキュメントの保存に失敗しました",
+    "loadFailed": "DIDドキュメントの読み込みに失敗しました",
+    "invalidMultibase": "公開キーは'z'で始まる有効なmultibase文字列である必要があります",
+    "invalidHandle": "ハンドルはat:// URIである必要があります（例：at://handle.example.com）",
     "helpTitle": "これは何ですか？",
     "helpText": "別の PDS に移行すると、その PDS が新しい署名キーを生成します。ここで DID ドキュメントを更新して、新しいキーと場所を指すようにしてください。"
   },
···
   "reauth": {
     "title": "再認証が必要です",
     "subtitle": "続行するには本人確認を行ってください。",
+    "password": "パスワード",
+    "totp": "TOTP",
+    "passkey": "パスキー",
+    "authenticatorCode": "認証コード",
     "usePassword": "パスワードを使用",
     "usePasskey": "パスキーを使用",
     "useTotp": "認証アプリを使用",
···
     "totpPlaceholder": "6桁のコードを入力",
     "verify": "確認",
     "verifying": "確認中...",
+    "authenticating": "認証中...",
+    "passkeyPrompt": "下のボタンをクリックしてパスキーで認証してください。",
     "cancel": "キャンセル"
   },
   "verifyChannel": {
···
     "beforeMigrate4": "古いPDSにアカウントの無効化が通知されます",
     "importantWarning": "アカウント移行は重要な操作です。移行先のPDSを信頼し、データが移動されることを理解してください。問題が発生した場合、手動での復旧が必要になる可能性があります。",
     "learnMore": "移行のリスクについて詳しく",
+    "comingSoon": "近日公開",
+    "oauthCompleting": "認証を完了しています...",
+    "oauthFailed": "認証に失敗しました",
+    "tryAgain": "再試行",
     "resume": {
       "title": "移行を再開しますか？",
       "incomplete": "未完了の移行があります：",
···
         "desc": "既存のAT Protocolアカウントをこのサーバーに移動します。",
         "understand": "リスクを理解し、続行します"
       },
-      "sourceLogin": {
-        "title": "現在のPDSにサインイン",
-        "desc": "移行するアカウントの認証情報を入力してください。",
+      "sourceAuth": {
+        "title": "現在のハンドルを入力",
+        "titleResume": "移行を再開",
+        "desc": "移行するアカウントのハンドルを入力してください。",
+        "descResume": "移行を続行するには、元のPDSに再認証してください。",
         "handle": "ハンドル",
-        "handlePlaceholder": "you.bsky.social",
-        "password": "パスワード",
-        "twoFactorCode": "2要素認証コード",
-        "twoFactorRequired": "2要素認証が必要です",
-        "signIn": "サインインして続行"
+        "handlePlaceholder": "alice.bsky.social",
+        "handleHint": "現在のPDSでのハンドル",
+        "continue": "続行",
+        "connecting": "接続中...",
+        "reauthenticate": "再認証",
+        "resumeTitle": "移行中",
+        "resumeFrom": "移行元",
+        "resumeTo": "移行先",
+        "resumeProgress": "進行状況",
+        "resumeOAuthNote": "続行するにはOAuthで再認証が必要です。"
       },
       "chooseHandle": {
         "title": "新しいハンドルを選択",
         "desc": "このPDSでのアカウントのハンドルを選択してください。",
-        "handleHint": "完全なハンドル: @{handle}"
+        "migratingFrom": "移行元",
+        "newHandle": "新しいハンドル",
+        "checkingAvailability": "利用可能か確認中...",
+        "handleAvailable": "ハンドルは利用可能です！",
+        "handleTaken": "このハンドルは既に使用されています",
+        "handleHint": "フルハンドル（例：alice.mydomain.com）を入力して独自ドメインを使用することもできます",
+        "email": "メールアドレス",
+        "authMethod": "認証方法",
+        "authPassword": "パスワード",
+        "authPasswordDesc": "従来のパスワードベースのログイン",
+        "authPasskey": "パスキー",
+        "authPasskeyDesc": "生体認証やセキュリティキーを使用したパスワードレスログイン",
+        "password": "パスワード",
+        "passwordHint": "8文字以上",
+        "passkeyInfo": "アカウント作成後にパスキーを設定します。デバイスが生体認証（指紋、Face ID）またはセキュリティキーの使用を促します。",
+        "inviteCode": "招待コード"
       },
       "review": {
         "title": "移行の確認",
         "desc": "移行の詳細を確認してください。",
         "currentHandle": "現在のハンドル",
         "newHandle": "新しいハンドル",
+        "did": "DID",
         "sourcePds": "移行元PDS",
-        "targetPds": "このPDS",
+        "targetPds": "移行先PDS",
         "email": "メール",
+        "authentication": "認証",
+        "authPasskey": "パスキー（パスワードレス）",
+        "authPassword": "パスワード",
         "inviteCode": "招待コード",
-        "confirm": "アカウントを移行することを確認します",
-        "startMigration": "移行を開始"
+        "warning": "「移行を開始」をクリックすると、リポジトリとデータの転送が始まります。このプロセスは簡単に元に戻すことができません。",
+        "startMigration": "移行を開始",
+        "starting": "開始中..."
       },
       "migrating": {
-        "title": "アカウントを移行中",
-        "desc": "データを転送しています...",
-        "gettingServiceAuth": "サービス認証を取得中...",
-        "creatingAccount": "新しいPDSにアカウントを作成中...",
-        "exportingRepo": "リポジトリをエクスポート中...",
-        "importingRepo": "リポジトリをインポート中...",
-        "countingBlobs": "blobをカウント中...",
-        "migratingBlobs": "blobを移行中 ({current}/{total})...",
-        "migratingPrefs": "設定を移行中...",
-        "requestingPlc": "PLC操作をリクエスト中..."
+        "title": "移行中",
+        "desc": "アカウントを転送しています...",
+        "exportRepo": "リポジトリをエクスポート",
+        "importRepo": "リポジトリをインポート",
+        "migrateBlobs": "blobを移行",
+        "migratePrefs": "設定を移行"
+      },
+      "passkeySetup": {
+        "title": "パスキーを設定",
+        "desc": "メールが確認されました。安全なパスワードレスログインのためにパスキーを設定してください。",
+        "nameLabel": "パスキー名（任意）",
+        "namePlaceholder": "例：MacBook Pro、iPhone",
+        "nameHint": "このパスキーを識別するためのわかりやすい名前",
+        "instructions": "下のボタンをクリックしてパスキーを登録してください。デバイスが生体認証（指紋、Face ID）またはセキュリティキーの使用を促します。",
+        "register": "パスキーを登録",
+        "registering": "登録中..."
+      },
+      "appPassword": {
+        "title": "アプリパスワードを保存",
+        "desc": "パスキーが作成されました。パスキーをまだサポートしていないアプリで使用するためのアプリパスワードが生成されました。",
+        "warning": "このアプリパスワードは、パスキーをまだサポートしていないアプリ（bsky.appなど）へのサインインに必要です。このパスワードは一度しか表示されません。",
+        "label": "アプリパスワード：",
+        "saved": "アプリパスワードを安全な場所に保存しました",
+        "continue": "続ける"
       },
       "emailVerify": {
         "title": "メールアドレスを確認",
···
         "verifying": "確認中..."
       },
       "plcToken": {
-        "title": "本人確認",
-        "desc": "現在のPDSに登録されているメールアドレスに確認コードが送信されました。",
-        "tokenLabel": "確認トークン",
-        "tokenPlaceholder": "メールに記載されたトークンを入力",
-        "resend": "再送信",
-        "resending": "送信中..."
+        "title": "移行を確認",
+        "desc": "古いアカウントに登録されているメールアドレスに確認コードが送信されました。",
+        "info": "このコードはアカウントへのアクセス権を確認し、このPDSを指すようにアイデンティティを更新することを承認します。",
+        "tokenLabel": "確認コード",
+        "tokenPlaceholder": "メールに記載されたコードを入力",
+        "resend": "コードを再送信",
+        "complete": "移行を完了",
+        "completing": "確認中..."
       },
       "didWebUpdate": {
         "title": "DIDドキュメントを更新",
···
       "success": {
         "title": "移行完了！",
         "desc": "アカウントはこのPDSに正常に移行されました。",
-        "newHandle": "新しいハンドル",
+        "yourNewHandle": "新しいハンドル",
         "did": "DID",
-        "goToDashboard": "ダッシュボードへ"
+        "blobsWarning": "{count}個のblobを移行できませんでした。これらは利用できなくなった画像やその他のメディアの可能性があります。",
+        "redirecting": "ダッシュボードにリダイレクト中..."
+      },
+      "error": {
+        "title": "移行エラー",
+        "desc": "移行中にエラーが発生しました。",
+        "startOver": "最初からやり直す"
+      },
+      "common": {
+        "back": "戻る",
+        "cancel": "キャンセル",
+        "continue": "続行",
+        "whatWillHappen": "何が起こるか：",
+        "step1": "現在のPDSにログイン",
+        "step2": "このサーバーでの新しいハンドルを選択",
+        "step3": "リポジトリとblobが転送されます",
+        "step4": "メールで移行を確認",
+        "step5": "アイデンティティがここを指すように更新されます",
+        "beforeProceed": "続行する前に：",
+        "warning1": "現在のアカウントに登録されているメールへのアクセスが必要です",
+        "warning2": "大きなアカウントの転送には数分かかる場合があります",
+        "warning3": "移行後、古いアカウントは無効化されます"
       }
     },
     "outbound": {

frontend/src/locales/ko.json

···
     "title": "DID 문서 편집기",
     "preview": "현재 DID 문서",
     "verificationMethods": "검증 방법 (서명 키)",
+    "verificationMethodsDesc": "DID를 대신하여 동작할 수 있는 서명 키입니다. 새 PDS로 마이그레이션할 때 해당 서명 키를 여기에 추가하세요.",
     "addKey": "키 추가",
     "removeKey": "삭제",
     "keyId": "키 ID",
     "keyIdPlaceholder": "#atproto",
     "publicKey": "공개 키 (Multibase)",
     "publicKeyPlaceholder": "zQ3sh...",
+    "noKeys": "구성된 검증 방법이 없습니다. 로컬 PDS 키를 사용 중입니다.",
     "alsoKnownAs": "다른 이름 (핸들)",
+    "alsoKnownAsDesc": "DID를 가리키는 핸들입니다. 새 PDS에서 핸들이 변경되면 업데이트하세요.",
     "addHandle": "핸들 추가",
+    "removeHandle": "삭제",
+    "handle": "핸들",
     "handlePlaceholder": "at://handle.pds.com",
-    "serviceEndpoint": "서비스 엔드포인트 (현재 PDS)",
+    "noHandles": "구성된 핸들이 없습니다. 로컬 핸들을 사용 중입니다.",
+    "serviceEndpoint": "서비스 엔드포인트",
+    "serviceEndpointDesc": "현재 계정 데이터를 호스팅하는 PDS입니다. 마이그레이션할 때 업데이트하세요.",
+    "currentPds": "현재 PDS URL",
     "save": "변경사항 저장",
     "saving": "저장 중...",
     "success": "DID 문서가 업데이트되었습니다",
+    "saveFailed": "DID 문서 저장에 실패했습니다",
+    "loadFailed": "DID 문서 로드에 실패했습니다",
+    "invalidMultibase": "공개 키는 'z'로 시작하는 유효한 multibase 문자열이어야 합니다",
+    "invalidHandle": "핸들은 at:// URI여야 합니다 (예: at://handle.example.com)",
     "helpTitle": "이것은 무엇인가요?",
     "helpText": "다른 PDS로 마이그레이션하면 해당 PDS가 새 서명 키를 생성합니다. 여기에서 DID 문서를 업데이트하여 새 키와 위치를 가리키도록 하세요."
   },
···
   "reauth": {
     "title": "재인증 필요",
     "subtitle": "계속하려면 본인 확인을 해주세요.",
+    "password": "비밀번호",
+    "totp": "TOTP",
+    "passkey": "패스키",
+    "authenticatorCode": "인증 코드",
     "usePassword": "비밀번호 사용",
     "usePasskey": "패스키 사용",
     "useTotp": "인증 앱 사용",
···
     "totpPlaceholder": "6자리 코드 입력",
     "verify": "확인",
     "verifying": "확인 중...",
+    "authenticating": "인증 중...",
+    "passkeyPrompt": "아래 버튼을 클릭하여 패스키로 인증하세요.",
     "cancel": "취소"
   },
   "verifyChannel": {
···
     "beforeMigrate4": "이전 PDS에 계정 비활성화가 통보됩니다",
     "importantWarning": "계정 마이그레이션은 중요한 작업입니다. 대상 PDS를 신뢰하고 데이터가 이동된다는 것을 이해하세요. 문제가 발생하면 수동 복구가 필요할 수 있습니다.",
     "learnMore": "마이그레이션 위험에 대해 자세히 알아보기",
+    "comingSoon": "곧 출시 예정",
+    "oauthCompleting": "인증 완료 중...",
+    "oauthFailed": "인증 실패",
+    "tryAgain": "다시 시도",
     "resume": {
       "title": "마이그레이션을 재개하시겠습니까?",
       "incomplete": "완료되지 않은 마이그레이션이 있습니다:",
···
         "desc": "기존 AT Protocol 계정을 이 서버로 이동합니다.",
         "understand": "위험을 이해하고 계속 진행합니다"
       },
-      "sourceLogin": {
-        "title": "현재 PDS에 로그인",
-        "desc": "마이그레이션할 계정의 인증 정보를 입력하세요.",
+      "sourceAuth": {
+        "title": "현재 핸들 입력",
+        "titleResume": "마이그레이션 재개",
+        "desc": "마이그레이션할 계정의 핸들을 입력하세요.",
+        "descResume": "마이그레이션을 계속하려면 소스 PDS에 재인증하세요.",
         "handle": "핸들",
-        "handlePlaceholder": "you.bsky.social",
-        "password": "비밀번호",
-        "twoFactorCode": "2단계 인증 코드",
-        "twoFactorRequired": "2단계 인증이 필요합니다",
-        "signIn": "로그인 및 계속"
+        "handlePlaceholder": "alice.bsky.social",
+        "handleHint": "현재 PDS에서의 핸들",
+        "continue": "계속",
+        "connecting": "연결 중...",
+        "reauthenticate": "재인증",
+        "resumeTitle": "마이그레이션 진행 중",
+        "resumeFrom": "출발지",
+        "resumeTo": "목적지",
+        "resumeProgress": "진행 상황",
+        "resumeOAuthNote": "계속하려면 OAuth로 재인증이 필요합니다."
       },
       "chooseHandle": {
         "title": "새 핸들 선택",
         "desc": "이 PDS에서 사용할 계정 핸들을 선택하세요.",
-        "handleHint": "전체 핸들: @{handle}"
+        "migratingFrom": "마이그레이션 원본",
+        "newHandle": "새 핸들",
+        "checkingAvailability": "사용 가능 여부 확인 중...",
+        "handleAvailable": "핸들을 사용할 수 있습니다!",
+        "handleTaken": "핸들이 이미 사용 중입니다",
+        "handleHint": "전체 핸들(예: alice.mydomain.com)을 입력하여 자체 도메인을 사용할 수도 있습니다",
+        "email": "이메일 주소",
+        "authMethod": "인증 방법",
+        "authPassword": "비밀번호",
+        "authPasswordDesc": "기존 비밀번호 기반 로그인",
+        "authPasskey": "패스키",
+        "authPasskeyDesc": "생체 인식 또는 보안 키를 사용한 비밀번호 없는 로그인",
+        "password": "비밀번호",
+        "passwordHint": "최소 8자",
+        "passkeyInfo": "계정 생성 후 패스키를 설정합니다. 기기에서 생체 인식(지문, Face ID) 또는 보안 키 사용을 요청합니다.",
+        "inviteCode": "초대 코드"
       },
       "review": {
         "title": "마이그레이션 검토",
-        "desc": "마이그레이션 세부 정보를 검토하고 확인하세요.",
+        "desc": "마이그레이션 세부 정보를 확인하세요.",
         "currentHandle": "현재 핸들",
         "newHandle": "새 핸들",
+        "did": "DID",
         "sourcePds": "소스 PDS",
-        "targetPds": "이 PDS",
+        "targetPds": "대상 PDS",
         "email": "이메일",
+        "authentication": "인증",
+        "authPasskey": "패스키 (비밀번호 없음)",
+        "authPassword": "비밀번호",
         "inviteCode": "초대 코드",
-        "confirm": "계정 마이그레이션을 확인합니다",
-        "startMigration": "마이그레이션 시작"
+        "warning": "\"마이그레이션 시작\"을 클릭하면 저장소와 데이터 전송이 시작됩니다. 이 과정은 쉽게 되돌릴 수 없습니다.",
+        "startMigration": "마이그레이션 시작",
+        "starting": "시작 중..."
       },
       "migrating": {
-        "title": "계정 마이그레이션 중",
-        "desc": "데이터를 전송하는 중입니다...",
-        "gettingServiceAuth": "서비스 인증 획득 중...",
-        "creatingAccount": "새 PDS에 계정 생성 중...",
-        "exportingRepo": "저장소 내보내기 중...",
-        "importingRepo": "저장소 가져오기 중...",
-        "countingBlobs": "blob 개수 세는 중...",
-        "migratingBlobs": "blob 마이그레이션 중 ({current}/{total})...",
-        "migratingPrefs": "환경설정 마이그레이션 중...",
-        "requestingPlc": "PLC 작업 요청 중..."
+        "title": "마이그레이션 진행 중",
+        "desc": "계정을 전송하는 중입니다...",
+        "exportRepo": "저장소 내보내기",
+        "importRepo": "저장소 가져오기",
+        "migrateBlobs": "blob 마이그레이션",
+        "migratePrefs": "환경설정 마이그레이션"
+      },
+      "passkeySetup": {
+        "title": "패스키 설정",
+        "desc": "이메일이 인증되었습니다. 안전한 비밀번호 없는 로그인을 위해 패스키를 설정하세요.",
+        "nameLabel": "패스키 이름 (선택사항)",
+        "namePlaceholder": "예: MacBook Pro, iPhone",
+        "nameHint": "이 패스키를 식별하기 위한 이름",
+        "instructions": "아래 버튼을 클릭하여 패스키를 등록하세요. 기기에서 생체 인식(지문, Face ID) 또는 보안 키 사용을 요청합니다.",
+        "register": "패스키 등록",
+        "registering": "등록 중..."
+      },
+      "appPassword": {
+        "title": "앱 비밀번호 저장",
+        "desc": "패스키가 생성되었습니다. 아직 패스키를 지원하지 않는 앱에서 사용할 앱 비밀번호가 생성되었습니다.",
+        "warning": "이 앱 비밀번호는 아직 패스키를 지원하지 않는 앱(예: bsky.app)에 로그인할 때 필요합니다. 이 비밀번호는 한 번만 표시됩니다.",
+        "label": "앱 비밀번호:",
+        "saved": "앱 비밀번호를 안전한 곳에 저장했습니다",
+        "continue": "계속"
       },
       "emailVerify": {
         "title": "이메일 인증",
···
         "verifying": "인증 중..."
       },
       "plcToken": {
-        "title": "신원 확인",
-        "desc": "현재 PDS에 등록된 이메일로 인증 코드가 전송되었습니다.",
-        "tokenLabel": "인증 토큰",
-        "tokenPlaceholder": "이메일에서 받은 토큰 입력",
-        "resend": "재전송",
-        "resending": "전송 중..."
+        "title": "마이그레이션 확인",
+        "desc": "이전 계정에 등록된 이메일로 인증 코드가 전송되었습니다.",
+        "info": "이 코드는 계정 접근 권한을 확인하고 이 PDS를 가리키도록 아이덴티티 업데이트를 승인합니다.",
+        "tokenLabel": "인증 코드",
+        "tokenPlaceholder": "이메일에서 받은 코드 입력",
+        "resend": "코드 재전송",
+        "complete": "마이그레이션 완료",
+        "completing": "확인 중..."
       },
       "didWebUpdate": {
         "title": "DID 문서 업데이트",
···
       "success": {
         "title": "마이그레이션 완료!",
         "desc": "계정이 이 PDS로 성공적으로 마이그레이션되었습니다.",
-        "newHandle": "새 핸들",
+        "yourNewHandle": "새 핸들",
         "did": "DID",
-        "goToDashboard": "대시보드로 이동"
+        "blobsWarning": "{count}개의 blob을 마이그레이션할 수 없습니다. 더 이상 사용할 수 없는 이미지나 기타 미디어일 수 있습니다.",
+        "redirecting": "대시보드로 리디렉션 중..."
+      },
+      "error": {
+        "title": "마이그레이션 오류",
+        "desc": "마이그레이션 중 오류가 발생했습니다.",
+        "startOver": "처음부터 다시 시작"
+      },
+      "common": {
+        "back": "뒤로",
+        "cancel": "취소",
+        "continue": "계속",
+        "whatWillHappen": "진행 과정:",
+        "step1": "현재 PDS에 로그인",
+        "step2": "이 서버에서 새 핸들 선택",
+        "step3": "저장소와 blob이 전송됩니다",
+        "step4": "이메일로 마이그레이션 확인",
+        "step5": "아이덴티티가 여기를 가리키도록 업데이트됩니다",
+        "beforeProceed": "진행하기 전에:",
+        "warning1": "현재 계정에 등록된 이메일에 접근할 수 있어야 합니다",
+        "warning2": "대용량 계정 전송에는 몇 분이 걸릴 수 있습니다",
+        "warning3": "마이그레이션 후 이전 계정은 비활성화됩니다"
       }
     },
     "outbound": {

frontend/src/locales/sv.json

···
     "title": "DID-dokumentredigerare",
     "preview": "Nuvarande DID-dokument",
     "verificationMethods": "Verifieringsmetoder (signeringsnycklar)",
+    "verificationMethodsDesc": "Signeringsnycklar som kan agera å din DIDs vägnar. När du migrerar till en ny PDS, lägg till deras signeringsnyckel här.",
     "addKey": "Lägg till nyckel",
     "removeKey": "Ta bort",
     "keyId": "Nyckel-ID",
     "keyIdPlaceholder": "#atproto",
     "publicKey": "Publik nyckel (Multibase)",
     "publicKeyPlaceholder": "zQ3sh...",
+    "noKeys": "Inga verifieringsmetoder konfigurerade. Använder lokal PDS-nyckel.",
     "alsoKnownAs": "Även känd som (användarnamn)",
+    "alsoKnownAsDesc": "Användarnamn som pekar på din DID. Uppdatera detta när ditt användarnamn ändras på en ny PDS.",
     "addHandle": "Lägg till användarnamn",
+    "removeHandle": "Ta bort",
+    "handle": "Användarnamn",
     "handlePlaceholder": "at://handle.pds.com",
-    "serviceEndpoint": "Tjänstslutpunkt (nuvarande PDS)",
+    "noHandles": "Inga användarnamn konfigurerade. Använder lokalt användarnamn.",
+    "serviceEndpoint": "Tjänstslutpunkt",
+    "serviceEndpointDesc": "PDS som för närvarande lagrar din kontodata. Uppdatera detta vid migrering.",
+    "currentPds": "Nuvarande PDS-URL",
     "save": "Spara ändringar",
     "saving": "Sparar...",
     "success": "DID-dokumentet har uppdaterats",
+    "saveFailed": "Kunde inte spara DID-dokument",
+    "loadFailed": "Kunde inte ladda DID-dokument",
+    "invalidMultibase": "Publik nyckel måste vara en giltig multibase-sträng som börjar med 'z'",
+    "invalidHandle": "Användarnamn måste vara en at:// URI (t.ex. at://handle.example.com)",
     "helpTitle": "Vad är detta?",
     "helpText": "När du flyttar till en annan PDS genererar den PDS nya signeringsnycklar. Uppdatera ditt DID-dokument här så att det pekar på dina nya nycklar och plats."
   },
···
   "reauth": {
     "title": "Återautentisering krävs",
     "subtitle": "Verifiera din identitet för att fortsätta.",
+    "password": "Lösenord",
+    "totp": "TOTP",
+    "passkey": "Passkey",
+    "authenticatorCode": "Autentiseringskod",
     "usePassword": "Använd lösenord",
     "usePasskey": "Använd nyckel",
     "useTotp": "Använd autentiserare",
···
     "totpPlaceholder": "Ange 6-siffrig kod",
     "verify": "Verifiera",
     "verifying": "Verifierar...",
+    "authenticating": "Autentiserar...",
+    "passkeyPrompt": "Klicka på knappen nedan för att autentisera med din passkey.",
     "cancel": "Avbryt"
   },
   "verifyChannel": {
···
     "beforeMigrate4": "Din gamla PDS kommer att meddelas om kontoinaktivering",
     "importantWarning": "Kontoflyttning är en betydande åtgärd. Se till att du litar på mål-PDS och förstår att din data kommer att flyttas. Om något går fel kan manuell återställning krävas.",
     "learnMore": "Läs mer om flyttningsrisker",
+    "comingSoon": "Kommer snart",
+    "oauthCompleting": "Slutför autentisering...",
+    "oauthFailed": "Autentisering misslyckades",
+    "tryAgain": "Försök igen",
     "resume": {
       "title": "Återuppta flytt?",
       "incomplete": "Du har en ofullständig flytt pågående:",
···
         "desc": "Flytta ditt befintliga AT Protocol-konto till denna server.",
         "understand": "Jag förstår riskerna och vill fortsätta"
       },
-      "sourceLogin": {
-        "title": "Logga in på din nuvarande PDS",
-        "desc": "Ange uppgifterna för kontot du vill flytta.",
+      "sourceAuth": {
+        "title": "Ange ditt nuvarande användarnamn",
+        "titleResume": "Återuppta flytt",
+        "desc": "Ange användarnamnet för kontot du vill flytta.",
+        "descResume": "Autentisera dig igen till din käll-PDS för att fortsätta flytten.",
         "handle": "Användarnamn",
-        "handlePlaceholder": "du.bsky.social",
-        "password": "Lösenord",
-        "twoFactorCode": "Tvåfaktorkod",
-        "twoFactorRequired": "Tvåfaktorautentisering krävs",
-        "signIn": "Logga in och fortsätt"
+        "handlePlaceholder": "alice.bsky.social",
+        "handleHint": "Ditt nuvarande användarnamn på din befintliga PDS",
+        "continue": "Fortsätt",
+        "connecting": "Ansluter...",
+        "reauthenticate": "Autentisera igen",
+        "resumeTitle": "Flytt pågår",
+        "resumeFrom": "Från",
+        "resumeTo": "Till",
+        "resumeProgress": "Framsteg",
+        "resumeOAuthNote": "Du måste autentisera dig igen via OAuth för att fortsätta."
       },
       "chooseHandle": {
         "title": "Välj ditt nya användarnamn",
         "desc": "Välj ett användarnamn för ditt konto på denna PDS.",
-        "handleHint": "Ditt fullständiga användarnamn blir: @{handle}"
+        "migratingFrom": "Flyttar från",
+        "newHandle": "Nytt användarnamn",
+        "checkingAvailability": "Kontrollerar tillgänglighet...",
+        "handleAvailable": "Användarnamnet är tillgängligt!",
+        "handleTaken": "Användarnamnet är redan taget",
+        "handleHint": "Du kan också använda din egen domän genom att ange det fullständiga användarnamnet (t.ex. alice.mindomän.se)",
+        "email": "E-postadress",
+        "authMethod": "Autentiseringsmetod",
+        "authPassword": "Lösenord",
+        "authPasswordDesc": "Traditionell lösenordsbaserad inloggning",
+        "authPasskey": "Passkey",
+        "authPasskeyDesc": "Lösenordslös inloggning med biometri eller säkerhetsnyckel",
+        "password": "Lösenord",
+        "passwordHint": "Minst 8 tecken",
+        "passkeyInfo": "Du kommer att konfigurera en passkey efter att ditt konto skapats. Din enhet kommer att uppmana dig att använda biometri (fingeravtryck, Face ID) eller en säkerhetsnyckel.",
+        "inviteCode": "Inbjudningskod"
       },
       "review": {
         "title": "Granska flytt",
-        "desc": "Granska och bekräfta dina flyttdetaljer.",
+        "desc": "Bekräfta detaljerna för din flytt.",
         "currentHandle": "Nuvarande användarnamn",
         "newHandle": "Nytt användarnamn",
-        "sourcePds": "Käll-PDS",
-        "targetPds": "Denna PDS",
+        "did": "DID",
+        "sourcePds": "Från PDS",
+        "targetPds": "Till PDS",
         "email": "E-post",
+        "authentication": "Autentisering",
+        "authPasskey": "Passkey (lösenordslös)",
+        "authPassword": "Lösenord",
         "inviteCode": "Inbjudningskod",
-        "confirm": "Jag bekräftar att jag vill flytta mitt konto",
-        "startMigration": "Starta flytt"
+        "warning": "När du klickar på \"Starta flytt\" börjar ditt arkiv och data överföras. Denna process kan inte enkelt ångras.",
+        "startMigration": "Starta flytt",
+        "starting": "Startar..."
       },
       "migrating": {
-        "title": "Flyttar ditt konto",
-        "desc": "Vänta medan vi överför din data...",
-        "gettingServiceAuth": "Hämtar tjänstauktorisering...",
-        "creatingAccount": "Skapar konto på ny PDS...",
-        "exportingRepo": "Exporterar arkiv...",
-        "importingRepo": "Importerar arkiv...",
-        "countingBlobs": "Räknar blobbar...",
-        "migratingBlobs": "Flyttar blobbar ({current}/{total})...",
-        "migratingPrefs": "Flyttar inställningar...",
-        "requestingPlc": "Begär PLC-operation..."
+        "title": "Flytt pågår",
+        "desc": "Vänta medan ditt konto överförs...",
+        "exportRepo": "Exportera arkiv",
+        "importRepo": "Importera arkiv",
+        "migrateBlobs": "Flytta blobbar",
+        "migratePrefs": "Flytta inställningar"
+      },
+      "passkeySetup": {
+        "title": "Konfigurera din passkey",
+        "desc": "Din e-post har verifierats. Konfigurera nu din passkey för säker, lösenordslös inloggning.",
+        "nameLabel": "Passkey-namn (valfritt)",
+        "namePlaceholder": "t.ex. MacBook Pro, iPhone",
+        "nameHint": "Ett vänligt namn för att identifiera denna passkey",
+        "instructions": "Klicka på knappen nedan för att registrera din passkey. Din enhet kommer att uppmana dig att använda biometri (fingeravtryck, Face ID) eller en säkerhetsnyckel.",
+        "register": "Registrera passkey",
+        "registering": "Registrerar..."
+      },
+      "appPassword": {
+        "title": "Spara ditt applösenord",
+        "desc": "Din passkey har skapats. Ett applösenord har genererats för dig att använda med appar som inte stödjer passkeys ännu.",
+        "warning": "Detta applösenord krävs för att logga in i appar som inte stödjer passkeys ännu (som bsky.app). Du kommer bara att se detta lösenord en gång.",
+        "label": "Applösenord för",
+        "saved": "Jag har sparat mitt applösenord på en säker plats",
+        "continue": "Fortsätt"
       },
       "emailVerify": {
         "title": "Verifiera din e-post",
···
         "verifying": "Verifierar..."
       },
       "plcToken": {
-        "title": "Verifiera din identitet",
-        "desc": "En verifieringskod har skickats till din e-post på din nuvarande PDS.",
-        "tokenLabel": "Verifieringstoken",
-        "tokenPlaceholder": "Ange token från din e-post",
-        "resend": "Skicka igen",
-        "resending": "Skickar..."
+        "title": "Verifiera flytt",
+        "desc": "En verifieringskod har skickats till e-posten registrerad på ditt gamla konto.",
+        "info": "Denna kod bekräftar att du har tillgång till kontot och auktoriserar uppdatering av din identitet för att peka på denna PDS.",
+        "tokenLabel": "Verifieringskod",
+        "tokenPlaceholder": "Ange kod från e-post",
+        "resend": "Skicka kod igen",
+        "complete": "Slutför flytt",
+        "completing": "Verifierar..."
       },
       "didWebUpdate": {
         "title": "Uppdatera ditt DID-dokument",
···
       "success": {
         "title": "Flytt klar!",
         "desc": "Ditt konto har framgångsrikt flyttats till denna PDS.",
-        "newHandle": "Nytt användarnamn",
+        "yourNewHandle": "Ditt nya användarnamn",
         "did": "DID",
-        "goToDashboard": "Gå till instrumentpanel"
+        "blobsWarning": "{count} blobbar kunde inte flyttas. Dessa kan vara bilder eller annan media som inte längre är tillgängliga.",
+        "redirecting": "Omdirigerar till instrumentpanel..."
+      },
+      "error": {
+        "title": "Flyttfel",
+        "desc": "Ett fel uppstod under flytten.",
+        "startOver": "Börja om"
+      },
+      "common": {
+        "back": "Tillbaka",
+        "cancel": "Avbryt",
+        "continue": "Fortsätt",
+        "whatWillHappen": "Vad som kommer att hända:",
+        "step1": "Logga in på din nuvarande PDS",
+        "step2": "Välj ditt nya användarnamn på denna server",
+        "step3": "Ditt arkiv och blobbar kommer att överföras",
+        "step4": "Verifiera flytten via e-post",
+        "step5": "Din identitet kommer att uppdateras för att peka hit",
+        "beforeProceed": "Innan du fortsätter:",
+        "warning1": "Du behöver tillgång till e-posten registrerad på ditt nuvarande konto",
+        "warning2": "Stora konton kan ta flera minuter att överföra",
+        "warning3": "Ditt gamla konto kommer att inaktiveras efter flytten"
       }
     },
     "outbound": {

frontend/src/locales/zh.json

···
     "title": "DID 文档编辑器",
     "preview": "当前 DID 文档",
     "verificationMethods": "验证方法（签名密钥）",
+    "verificationMethodsDesc": "可以代表您的 DID 进行操作的签名密钥。迁移到新 PDS 时，请在此添加其签名密钥。",
     "addKey": "添加密钥",
     "removeKey": "删除",
     "keyId": "密钥 ID",
     "keyIdPlaceholder": "#atproto",
     "publicKey": "公钥（Multibase）",
     "publicKeyPlaceholder": "zQ3sh...",
+    "noKeys": "未配置验证方法。正在使用本地 PDS 密钥。",
     "alsoKnownAs": "别名（用户名）",
+    "alsoKnownAsDesc": "指向您的 DID 的用户名。当您在新 PDS 上更改用户名时请更新此项。",
     "addHandle": "添加用户名",
+    "removeHandle": "删除",
+    "handle": "用户名",
     "handlePlaceholder": "at://handle.pds.com",
-    "serviceEndpoint": "服务端点（当前 PDS）",
+    "noHandles": "未配置用户名。正在使用本地用户名。",
+    "serviceEndpoint": "服务端点",
+    "serviceEndpointDesc": "当前托管您账户数据的 PDS。迁移时请更新此项。",
+    "currentPds": "当前 PDS URL",
     "save": "保存更改",
     "saving": "保存中...",
     "success": "DID 文档已更新",
+    "saveFailed": "保存 DID 文档失败",
+    "loadFailed": "加载 DID 文档失败",
+    "invalidMultibase": "公钥必须是以 'z' 开头的有效 multibase 字符串",
+    "invalidHandle": "用户名必须是 at:// URI（例如：at://handle.example.com）",
     "helpTitle": "这是什么？",
     "helpText": "当您迁移到另一个 PDS 时，该 PDS 会生成新的签名密钥。在此处更新您的 DID 文档，使其指向您的新密钥和位置。"
   },
···
   "reauth": {
     "title": "需要重新验证",
     "subtitle": "请验证您的身份以继续。",
+    "password": "密码",
+    "totp": "TOTP",
+    "passkey": "通行密钥",
+    "authenticatorCode": "验证码",
     "usePassword": "使用密码",
     "usePasskey": "使用通行密钥",
     "useTotp": "使用身份验证器",
···
     "totpPlaceholder": "输入6位验证码",
     "verify": "验证",
     "verifying": "验证中...",
+    "authenticating": "正在验证...",
+    "passkeyPrompt": "点击下方按钮使用通行密钥进行验证。",
     "cancel": "取消"
   },
   "verifyChannel": {
···
     "beforeMigrate4": "您的旧PDS将收到账户停用通知",
     "importantWarning": "账户迁移是一项重要操作。请确保您信任目标PDS，并了解您的数据将被移动。如果出现问题，可能需要手动恢复。",
     "learnMore": "了解更多迁移风险",
+    "comingSoon": "即将推出",
+    "oauthCompleting": "正在完成身份验证...",
+    "oauthFailed": "身份验证失败",
+    "tryAgain": "重试",
     "resume": {
       "title": "恢复迁移？",
       "incomplete": "您有一个未完成的迁移：",
···
         "desc": "将您现有的AT Protocol账户移至此服务器。",
         "understand": "我了解风险并希望继续"
       },
-      "sourceLogin": {
-        "title": "登录到您当前的PDS",
-        "desc": "输入您要迁移的账户凭据。",
+      "sourceAuth": {
+        "title": "输入您当前的用户名",
+        "titleResume": "恢复迁移",
+        "desc": "输入您要迁移的账户用户名。",
+        "descResume": "重新验证您的源PDS以继续迁移。",
         "handle": "用户名",
-        "handlePlaceholder": "you.bsky.social",
-        "password": "密码",
-        "twoFactorCode": "双因素验证码",
-        "twoFactorRequired": "需要双因素认证",
-        "signIn": "登录并继续"
+        "handlePlaceholder": "alice.bsky.social",
+        "handleHint": "您在现有PDS上的当前用户名",
+        "continue": "继续",
+        "connecting": "连接中...",
+        "reauthenticate": "重新验证",
+        "resumeTitle": "迁移进行中",
+        "resumeFrom": "来自",
+        "resumeTo": "迁移至",
+        "resumeProgress": "进度",
+        "resumeOAuthNote": "您需要通过OAuth重新验证才能继续。"
       },
       "chooseHandle": {
         "title": "选择新用户名",
         "desc": "为您在此PDS上的账户选择用户名。",
-        "handleHint": "您的完整用户名将是：@{handle}"
+        "migratingFrom": "迁移自",
+        "newHandle": "新用户名",
+        "checkingAvailability": "检查可用性...",
+        "handleAvailable": "用户名可用！",
+        "handleTaken": "用户名已被占用",
+        "handleHint": "您也可以输入完整的用户名（如alice.mydomain.com）来使用您自己的域名",
+        "email": "邮箱地址",
+        "authMethod": "身份验证方式",
+        "authPassword": "密码",
+        "authPasswordDesc": "传统的密码登录",
+        "authPasskey": "通行密钥",
+        "authPasskeyDesc": "使用生物识别或安全密钥的无密码登录",
+        "password": "密码",
+        "passwordHint": "至少8个字符",
+        "passkeyInfo": "您将在账户创建后设置通行密钥。您的设备将提示您使用生物识别（指纹、面容ID）或安全密钥。",
+        "inviteCode": "邀请码"
       },
       "review": {
         "title": "检查迁移",
-        "desc": "请检查并确认您的迁移详情。",
+        "desc": "确认您的迁移详情。",
         "currentHandle": "当前用户名",
         "newHandle": "新用户名",
+        "did": "DID",
         "sourcePds": "源PDS",
-        "targetPds": "此PDS",
+        "targetPds": "目标PDS",
         "email": "邮箱",
+        "authentication": "身份验证",
+        "authPasskey": "通行密钥（无密码）",
+        "authPassword": "密码",
         "inviteCode": "邀请码",
-        "confirm": "我确认要迁移我的账户",
-        "startMigration": "开始迁移"
+        "warning": "点击「开始迁移」后，您的存储库和数据将开始转移。此过程无法轻易撤销。",
+        "startMigration": "开始迁移",
+        "starting": "启动中..."
       },
       "migrating": {
-        "title": "正在迁移您的账户",
-        "desc": "请稍候，正在转移您的数据...",
-        "gettingServiceAuth": "正在获取服务授权...",
-        "creatingAccount": "正在新PDS上创建账户...",
-        "exportingRepo": "正在导出存储库...",
-        "importingRepo": "正在导入存储库...",
-        "countingBlobs": "正在统计blob...",
-        "migratingBlobs": "正在迁移blob ({current}/{total})...",
-        "migratingPrefs": "正在迁移偏好设置...",
-        "requestingPlc": "正在请求PLC操作..."
+        "title": "迁移进行中",
+        "desc": "正在转移您的账户...",
+        "exportRepo": "导出存储库",
+        "importRepo": "导入存储库",
+        "migrateBlobs": "迁移blob",
+        "migratePrefs": "迁移偏好设置"
+      },
+      "passkeySetup": {
+        "title": "设置您的通行密钥",
+        "desc": "您的邮箱已验证。现在设置通行密钥以实现安全的无密码登录。",
+        "nameLabel": "通行密钥名称（可选）",
+        "namePlaceholder": "例如：MacBook Pro、iPhone",
+        "nameHint": "用于识别此通行密钥的友好名称",
+        "instructions": "点击下方按钮注册您的通行密钥。您的设备将提示您使用生物识别（指纹、面容ID）或安全密钥。",
+        "register": "注册通行密钥",
+        "registering": "注册中..."
+      },
+      "appPassword": {
+        "title": "保存您的应用密码",
+        "desc": "您的通行密钥已创建。已为您生成应用密码，用于尚不支持通行密钥的应用。",
+        "warning": "此应用密码用于登录尚不支持通行密钥的应用（如 bsky.app）。此密码仅显示一次。",
+        "label": "应用密码：",
+        "saved": "我已将应用密码保存在安全的地方",
+        "continue": "继续"
       },
       "emailVerify": {
         "title": "验证您的邮箱",
···
         "verifying": "验证中..."
       },
       "plcToken": {
-        "title": "验证您的身份",
-        "desc": "验证码已发送到您在当前PDS注册的邮箱。",
-        "tokenLabel": "验证令牌",
-        "tokenPlaceholder": "输入邮件中的令牌",
+        "title": "验证迁移",
+        "desc": "验证码已发送到您旧账户注册的邮箱。",
+        "info": "此代码确认您有权访问该账户，并授权将您的身份更新为指向此PDS。",
+        "tokenLabel": "验证码",
+        "tokenPlaceholder": "输入邮件中的验证码",
         "resend": "重新发送",
-        "resending": "发送中..."
+        "complete": "完成迁移",
+        "completing": "验证中..."
       },
       "didWebUpdate": {
         "title": "更新您的DID文档",
···
       "success": {
         "title": "迁移完成！",
         "desc": "您的账户已成功迁移到此PDS。",
-        "newHandle": "新用户名",
+        "yourNewHandle": "您的新用户名",
         "did": "DID",
-        "goToDashboard": "前往仪表板"
+        "blobsWarning": "{count}个blob无法迁移。这些可能是不再可用的图片或其他媒体。",
+        "redirecting": "正在跳转到仪表板..."
+      },
+      "error": {
+        "title": "迁移错误",
+        "desc": "迁移过程中发生错误。",
+        "startOver": "重新开始"
+      },
+      "common": {
+        "back": "返回",
+        "cancel": "取消",
+        "continue": "继续",
+        "whatWillHappen": "将会发生什么：",
+        "step1": "登录到您当前的PDS",
+        "step2": "在此服务器上选择新用户名",
+        "step3": "您的存储库和blob将被转移",
+        "step4": "通过邮件验证迁移",
+        "step5": "您的身份将更新为指向此处",
+        "beforeProceed": "继续之前：",
+        "warning1": "您需要访问当前账户注册的邮箱",
+        "warning2": "大型账户可能需要几分钟才能转移",
+        "warning3": "迁移后您的旧账户将被停用"
       }
     },
     "outbound": {

frontend/src/routes/Migration.svelte

···
 <script lang="ts">
   import { getAuthState, logout, setSession } from '../lib/auth.svelte'
   import { navigate } from '../lib/router.svelte'
+  import { _ } from '../lib/i18n'
   import {
     createInboundMigrationFlow,
     createOutboundMigrationFlow,
···
   let direction = $state<Direction>('select')
   let showResumeModal = $state(false)
   let resumeInfo = $state<ReturnType<typeof getResumeInfo>>(null)
+  let oauthError = $state<string | null>(null)
+  let oauthLoading = $state(false)
 
   let inboundFlow = $state<ReturnType<typeof createInboundMigrationFlow> | null>(null)
   let outboundFlow = $state<ReturnType<typeof createOutboundMigrationFlow> | null>(null)
+  let oauthCallbackProcessed = $state(false)
+
+  $effect(() => {
+    if (oauthCallbackProcessed) return
 
-  if (hasPendingMigration()) {
+    const url = new URL(window.location.href)
+    const code = url.searchParams.get('code')
+    const state = url.searchParams.get('state')
+    const errorParam = url.searchParams.get('error')
+    const errorDescription = url.searchParams.get('error_description')
+
+    if (errorParam) {
+      oauthCallbackProcessed = true
+      oauthError = errorDescription || errorParam
+      window.history.replaceState({}, '', '/#/migrate')
+      return
+    }
+
+    if (code && state) {
+      oauthCallbackProcessed = true
+      window.history.replaceState({}, '', '/#/migrate')
+      direction = 'inbound'
+      oauthLoading = true
+      inboundFlow = createInboundMigrationFlow()
+
+      inboundFlow.handleOAuthCallback(code, state)
+        .then(() => {
+          oauthLoading = false
+        })
+        .catch((e) => {
+          oauthLoading = false
+          oauthError = e.message || 'OAuth authentication failed'
+          inboundFlow = null
+          direction = 'select'
+        })
+      return
+    }
+  })
+
+  const urlParams = new URLSearchParams(window.location.search)
+  const hasOAuthCallback = urlParams.has('code') || urlParams.has('error')
+
+  if (!hasOAuthCallback && hasPendingMigration()) {
     resumeInfo = getResumeInfo()
     if (resumeInfo) {
-      showResumeModal = true
+      const stored = loadMigrationState()
+      if (stored) {
+        if (stored.direction === 'inbound') {
+          direction = 'inbound'
+          inboundFlow = createInboundMigrationFlow()
+          inboundFlow.resumeFromState(stored)
+        } else {
+          direction = 'outbound'
+          outboundFlow = createOutboundMigrationFlow()
+        }
+      }
     }
   }
 
···
   {#if showResumeModal && resumeInfo}
     <div class="modal-overlay">
       <div class="modal">
-        <h2>Resume Migration?</h2>
-        <p>You have an incomplete migration in progress:</p>
+        <h2>{$_('migration.resume.title')}</h2>
+        <p>{$_('migration.resume.incomplete')}</p>
         <div class="resume-details">
           <div class="detail-row">
-            <span class="label">Direction:</span>
-            <span class="value">{resumeInfo.direction === 'inbound' ? 'Migrating here' : 'Migrating away'}</span>
+            <span class="label">{$_('migration.resume.direction')}:</span>
+            <span class="value">{resumeInfo.direction === 'inbound' ? $_('migration.resume.migratingHere') : $_('migration.resume.migratingAway')}</span>
           </div>
           {#if resumeInfo.sourceHandle}
             <div class="detail-row">
-              <span class="label">From:</span>
+              <span class="label">{$_('migration.resume.from')}:</span>
               <span class="value">{resumeInfo.sourceHandle}</span>
             </div>
           {/if}
           {#if resumeInfo.targetHandle}
             <div class="detail-row">
-              <span class="label">To:</span>
+              <span class="label">{$_('migration.resume.to')}:</span>
               <span class="value">{resumeInfo.targetHandle}</span>
             </div>
           {/if}
           <div class="detail-row">
-            <span class="label">Progress:</span>
+            <span class="label">{$_('migration.resume.progress')}:</span>
             <span class="value">{resumeInfo.progressSummary}</span>
           </div>
         </div>
-        <p class="note">You will need to re-enter your credentials to continue.</p>
+        <p class="note">{$_('migration.resume.reenterCredentials')}</p>
         <div class="modal-actions">
-          <button class="ghost" onclick={handleStartOver}>Start Over</button>
-          <button onclick={handleResume}>Resume</button>
+          <button class="ghost" onclick={handleStartOver}>{$_('migration.resume.startOver')}</button>
+          <button onclick={handleResume}>{$_('migration.resume.resumeButton')}</button>
         </div>
       </div>
     </div>
   {/if}
 
-  {#if direction === 'select'}
+  {#if oauthLoading}
+    <div class="oauth-loading">
+      <div class="loading-spinner"></div>
+      <p>{$_('migration.oauthCompleting')}</p>
+    </div>
+  {:else if oauthError}
+    <div class="oauth-error">
+      <h2>{$_('migration.oauthFailed')}</h2>
+      <p>{oauthError}</p>
+      <button onclick={() => { oauthError = null; direction = 'select' }}>{$_('migration.tryAgain')}</button>
+    </div>
+  {:else if direction === 'select'}
     <header class="page-header">
-      <h1>Account Migration</h1>
-      <p class="subtitle">Move your AT Protocol identity between servers</p>
+      <h1>{$_('migration.title')}</h1>
+      <p class="subtitle">{$_('migration.subtitle')}</p>
     </header>
 
     <div class="direction-cards">
       <button class="direction-card ghost" onclick={selectInbound}>
         <div class="card-icon">↓</div>
-        <h2>Migrate Here</h2>
-        <p>Move your existing AT Protocol account to this PDS from another server.</p>
+        <h2>{$_('migration.migrateHere')}</h2>
+        <p>{$_('migration.migrateHereDesc')}</p>
         <ul class="features">
-          <li>Bring your DID and identity</li>
-          <li>Transfer all your data</li>
-          <li>Keep your followers</li>
+          <li>{$_('migration.bringDid')}</li>
+          <li>{$_('migration.transferData')}</li>
+          <li>{$_('migration.keepFollowers')}</li>
         </ul>
       </button>
 
-      <button class="direction-card ghost" onclick={selectOutbound} disabled={!auth.session}>
+      <button class="direction-card ghost" onclick={selectOutbound} disabled>
         <div class="card-icon">↑</div>
-        <h2>Migrate Away</h2>
-        <p>Move your account from this PDS to another server.</p>
+        <h2>{$_('migration.migrateAway')}</h2>
+        <p>{$_('migration.migrateAwayDesc')}</p>
         <ul class="features">
-          <li>Export your repository</li>
-          <li>Transfer to new PDS</li>
-          <li>Update your identity</li>
+          <li>{$_('migration.exportRepo')}</li>
+          <li>{$_('migration.transferToPds')}</li>
+          <li>{$_('migration.updateIdentity')}</li>
         </ul>
-        {#if !auth.session}
-          <p class="login-required">Login required</p>
-        {/if}
+        <p class="login-required">{$_('migration.comingSoon')}</p>
       </button>
     </div>
 
     <div class="info-section">
-      <h3>What is account migration?</h3>
-      <p>
-        Account migration allows you to move your AT Protocol identity between Personal Data Servers (PDSes).
-        Your DID (decentralized identifier) stays the same, so your followers and social connections are preserved.
-      </p>
+      <h3>{$_('migration.whatIsMigration')}</h3>
+      <p>{$_('migration.whatIsMigrationDesc')}</p>
 
-      <h3>Before you migrate</h3>
+      <h3>{$_('migration.beforeMigrate')}</h3>
       <ul>
-        <li>You will need your current account credentials</li>
-        <li>Migration requires email verification for security</li>
-        <li>Large accounts with many images may take several minutes</li>
-        <li>Your old PDS will be notified to deactivate your account</li>
+        <li>{$_('migration.beforeMigrate1')}</li>
+        <li>{$_('migration.beforeMigrate2')}</li>
+        <li>{$_('migration.beforeMigrate3')}</li>
+        <li>{$_('migration.beforeMigrate4')}</li>
       </ul>
 
       <div class="warning-box">
-        <strong>Important:</strong> Account migration is a significant action. Make sure you trust the destination PDS
-        and understand that your data will be moved. If something goes wrong, recovery may require manual intervention.
+        <strong>Important:</strong> {$_('migration.importantWarning')}
         <a href="https://github.com/bluesky-social/pds/blob/main/ACCOUNT_MIGRATION.md" target="_blank" rel="noopener">
-          Learn more about migration risks
+          {$_('migration.learnMore')}
         </a>
       </div>
     </div>
···
   {:else if direction === 'inbound' && inboundFlow}
     <InboundWizard
       flow={inboundFlow}
+      {resumeInfo}
       onBack={handleBack}
       onComplete={handleInboundComplete}
     />
···
     display: flex;
     gap: var(--space-3);
     justify-content: flex-end;
+  }
+
+  .oauth-loading {
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    justify-content: center;
+    padding: var(--space-12);
+    text-align: center;
+  }
+
+  .loading-spinner {
+    width: 48px;
+    height: 48px;
+    border: 3px solid var(--border);
+    border-top-color: var(--accent);
+    border-radius: 50%;
+    animation: spin 1s linear infinite;
+    margin-bottom: var(--space-4);
+  }
+
+  @keyframes spin {
+    to { transform: rotate(360deg); }
+  }
+
+  .oauth-loading p {
+    color: var(--text-secondary);
+    margin: 0;
+  }
+
+  .oauth-error {
+    max-width: 500px;
+    margin: 0 auto;
+    text-align: center;
+    padding: var(--space-8);
+    background: var(--error-bg);
+    border: 1px solid var(--error-border);
+    border-radius: var(--radius-xl);
+  }
+
+  .oauth-error h2 {
+    margin: 0 0 var(--space-4) 0;
+    color: var(--error-text);
+  }
+
+  .oauth-error p {
+    color: var(--text-secondary);
+    margin: 0 0 var(--space-5) 0;
   }
 </style>

frontend/src/styles/base.css

···
 }
 
 code {
-  font-family: ui-monospace, "SF Mono", Menlo, Monaco, monospace;
+  font-family: var(--font-mono);
   font-size: 0.9em;
   background: var(--bg-tertiary);
   padding: var(--space-1) var(--space-2);
···
 }
 
 pre {
-  font-family: ui-monospace, "SF Mono", Menlo, Monaco, monospace;
+  font-family: var(--font-mono);
   font-size: var(--text-sm);
   background: var(--bg-tertiary);
   padding: var(--space-4);
···
 }
 
 .mono {
-  font-family: ui-monospace, "SF Mono", Menlo, Monaco, monospace;
+  font-family: var(--font-mono);
 }
 
 .mt-4 {

frontend/src/styles/migration.css

···
+.migration-wizard {
+  max-width: var(--width-sm);
+  margin: 0 auto;
+}
+
+.step-indicator {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  margin-bottom: var(--space-6);
+  gap: var(--space-1);
+}
+
+.step {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+}
+
+.step-dot {
+  width: 24px;
+  height: 24px;
+  border-radius: 50%;
+  background: var(--bg-secondary);
+  border: 2px solid var(--border-color);
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  font-size: var(--text-xs);
+  font-weight: var(--font-medium);
+  color: var(--text-secondary);
+  flex-shrink: 0;
+}
+
+.step.active .step-dot {
+  background: var(--accent);
+  border-color: var(--accent);
+  color: var(--text-inverse);
+  width: 28px;
+  height: 28px;
+}
+
+.step.completed .step-dot {
+  background: var(--success-bg);
+  border-color: var(--success-text);
+  color: var(--success-text);
+}
+
+.step-label {
+  display: none;
+}
+
+.step-line {
+  width: 16px;
+  height: 2px;
+  background: var(--border-color);
+  flex-shrink: 0;
+}
+
+.step-line.completed {
+  background: var(--success-text);
+}
+
+.current-step-label {
+  text-align: center;
+  font-size: var(--text-sm);
+  color: var(--text-secondary);
+  margin-bottom: var(--space-5);
+}
+
+.current-step-label strong {
+  color: var(--text-primary);
+}
+
+.step-content {
+  background: var(--bg-secondary);
+  border-radius: var(--radius-xl);
+  padding: var(--space-6);
+}
+
+.step-content h2 {
+  margin: 0 0 var(--space-3) 0;
+}
+
+.step-content > p {
+  color: var(--text-secondary);
+  margin: 0 0 var(--space-5) 0;
+}
+
+.info-box {
+  background: var(--accent-muted);
+  border: 1px solid var(--border-color);
+  border-radius: var(--radius-lg);
+  padding: var(--space-5);
+  margin-bottom: var(--space-5);
+}
+
+.info-box h3 {
+  margin: 0 0 var(--space-3) 0;
+  font-size: var(--text-base);
+}
+
+.info-box ol,
+.info-box ul {
+  margin: 0;
+  padding-left: var(--space-5);
+}
+
+.info-box li {
+  margin-bottom: var(--space-2);
+  color: var(--text-secondary);
+}
+
+.info-box p {
+  margin: 0;
+  color: var(--text-secondary);
+}
+
+.warning-box {
+  background: var(--warning-bg);
+  border: 1px solid var(--warning-border);
+  border-radius: var(--radius-lg);
+  padding: var(--space-5);
+  margin-bottom: var(--space-5);
+  font-size: var(--text-sm);
+}
+
+.warning-box strong {
+  color: var(--warning-text);
+}
+
+.warning-box p {
+  margin: var(--space-3) 0 0 0;
+  color: var(--text-secondary);
+}
+
+.warning-box ul {
+  margin: var(--space-3) 0 0 0;
+  padding-left: var(--space-5);
+}
+
+.checkbox-label {
+  display: inline-flex;
+  align-items: flex-start;
+  gap: var(--space-3);
+  cursor: pointer;
+  margin-bottom: var(--space-5);
+  text-align: left;
+}
+
+.checkbox-label input[type="checkbox"] {
+  width: 18px;
+  height: 18px;
+  margin: 0;
+  flex-shrink: 0;
+}
+
+.button-row {
+  display: flex;
+  gap: var(--space-3);
+  justify-content: flex-end;
+  margin-top: var(--space-5);
+}
+
+.handle-input-group {
+  display: flex;
+  gap: var(--space-2);
+}
+
+.handle-input-group input {
+  flex: 1;
+}
+
+.handle-input-group select {
+  width: auto;
+}
+
+.current-info {
+  background: var(--bg-primary);
+  border-radius: var(--radius-lg);
+  padding: var(--space-4);
+  margin-bottom: var(--space-5);
+  display: flex;
+  justify-content: space-between;
+}
+
+.current-info .label {
+  color: var(--text-secondary);
+}
+
+.current-info .value {
+  font-weight: var(--font-medium);
+}
+
+.review-card {
+  background: var(--bg-primary);
+  border-radius: var(--radius-lg);
+  padding: var(--space-4);
+  margin-bottom: var(--space-5);
+}
+
+.review-row {
+  display: flex;
+  justify-content: space-between;
+  padding: var(--space-3) 0;
+  border-bottom: 1px solid var(--border-color);
+}
+
+.review-row:last-child {
+  border-bottom: none;
+}
+
+.review-row .label {
+  color: var(--text-secondary);
+}
+
+.review-row .value {
+  font-weight: var(--font-medium);
+  text-align: right;
+  word-break: break-all;
+}
+
+.review-row .value.mono {
+  font-family: var(--font-mono);
+  font-size: var(--text-sm);
+}
+
+.progress-section {
+  margin-bottom: var(--space-5);
+}
+
+.progress-item {
+  display: flex;
+  align-items: center;
+  gap: var(--space-3);
+  padding: var(--space-3) 0;
+  color: var(--text-secondary);
+}
+
+.progress-item.completed {
+  color: var(--success-text);
+}
+
+.progress-item.active {
+  color: var(--accent);
+}
+
+.progress-item .icon {
+  width: 24px;
+  text-align: center;
+}
+
+.progress-bar {
+  height: 8px;
+  background: var(--bg-primary);
+  border-radius: var(--radius-md);
+  overflow: hidden;
+  margin-bottom: var(--space-4);
+}
+
+.progress-fill {
+  height: 100%;
+  background: var(--accent);
+  transition: width var(--transition-slow);
+}
+
+.status-text {
+  text-align: center;
+  color: var(--text-secondary);
+  font-size: var(--text-sm);
+}
+
+.success-content {
+  text-align: center;
+}
+
+.success-icon {
+  width: 64px;
+  height: 64px;
+  background: var(--success-bg);
+  color: var(--success-text);
+  border-radius: 50%;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  font-size: var(--text-2xl);
+  margin: 0 auto var(--space-5) auto;
+}
+
+.success-details {
+  background: var(--bg-primary);
+  border-radius: var(--radius-lg);
+  padding: var(--space-4);
+  margin: var(--space-5) 0;
+  text-align: left;
+}
+
+.success-details .detail-row {
+  display: flex;
+  justify-content: space-between;
+  padding: var(--space-2) 0;
+}
+
+.success-details .label {
+  color: var(--text-secondary);
+}
+
+.success-details .value {
+  font-weight: var(--font-medium);
+}
+
+.success-details .value.mono {
+  font-family: var(--font-mono);
+  font-size: var(--text-sm);
+}
+
+.redirect-text {
+  color: var(--text-secondary);
+  font-style: italic;
+}
+
+.code-block {
+  background: var(--bg-primary);
+  border: 1px solid var(--border-color);
+  border-radius: var(--radius-lg);
+  padding: var(--space-4);
+  margin-bottom: var(--space-5);
+  overflow-x: auto;
+}
+
+.code-block pre {
+  margin: 0;
+  font-family: var(--font-mono);
+  font-size: var(--text-sm);
+  white-space: pre-wrap;
+  word-break: break-all;
+}
+
+.auth-method-options {
+  display: flex;
+  flex-direction: column;
+  gap: var(--space-3);
+}
+
+label.auth-option {
+  display: flex;
+  flex-direction: row;
+  align-items: center;
+  gap: var(--space-3);
+  padding: var(--space-4);
+  border: 2px solid var(--border-color);
+  border-radius: var(--radius-lg);
+  cursor: pointer;
+  margin-bottom: 0;
+  transition: border-color var(--transition-normal), background-color var(--transition-normal);
+}
+
+.auth-option:hover {
+  border-color: var(--accent);
+  background: var(--bg-hover);
+}
+
+.auth-option.selected {
+  border-color: var(--accent);
+  background: var(--accent-muted);
+}
+
+.auth-option input[type="radio"] {
+  flex-shrink: 0;
+  width: 18px;
+  height: 18px;
+  margin: 0;
+}
+
+.auth-option-content {
+  display: flex;
+  flex-direction: column;
+  gap: var(--space-1);
+}
+
+.auth-option-content strong {
+  color: var(--text-primary);
+}
+
+.auth-option-content span {
+  font-size: var(--text-sm);
+  color: var(--text-secondary);
+}
+
+.loading-indicator {
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  gap: var(--space-4);
+  padding: var(--space-8);
+}
+
+.spinner {
+  width: 40px;
+  height: 40px;
+  border: 3px solid var(--border-color);
+  border-top-color: var(--accent);
+  border-radius: 50%;
+  animation: spin 1s linear infinite;
+}
+
+@keyframes spin {
+  to {
+    transform: rotate(360deg);
+  }
+}
+
+.passkey-section {
+  margin-top: var(--space-5);
+  text-align: center;
+}
+
+.passkey-section p {
+  margin-bottom: var(--space-4);
+  color: var(--text-secondary);
+}
+
+.app-password-display {
+  background: var(--bg-primary);
+  border-radius: var(--radius-lg);
+  padding: var(--space-5);
+  margin-bottom: var(--space-5);
+  text-align: center;
+}
+
+.app-password-label {
+  font-size: var(--text-sm);
+  color: var(--text-secondary);
+  margin-bottom: var(--space-3);
+}
+
+.app-password-code {
+  display: block;
+  font-family: var(--font-mono);
+  font-size: var(--text-lg);
+  letter-spacing: 0.1em;
+  padding: var(--space-4);
+  background: var(--bg-tertiary);
+  border-radius: var(--radius-md);
+  margin-bottom: var(--space-4);
+  user-select: all;
+}
+
+.copy-btn {
+  font-size: var(--text-sm);
+}
+
+.current-account {
+  background: var(--bg-primary);
+  border-radius: var(--radius-lg);
+  padding: var(--space-4);
+  margin-bottom: var(--space-5);
+  display: flex;
+  justify-content: space-between;
+  align-items: center;
+}
+
+.current-account .label {
+  color: var(--text-secondary);
+}
+
+.current-account .value {
+  font-weight: var(--font-medium);
+  font-size: var(--text-lg);
+}
+
+.server-info {
+  background: var(--bg-primary);
+  border-radius: var(--radius-lg);
+  padding: var(--space-4);
+  margin-top: var(--space-5);
+}
+
+.server-info h3 {
+  margin: 0 0 var(--space-3) 0;
+  font-size: var(--text-base);
+  color: var(--success-text);
+}
+
+.server-info .info-row {
+  display: flex;
+  justify-content: space-between;
+  padding: var(--space-2) 0;
+  font-size: var(--text-sm);
+}
+
+.server-info .label {
+  color: var(--text-secondary);
+}
+
+.server-info a {
+  display: inline-block;
+  margin-top: var(--space-2);
+  margin-right: var(--space-3);
+  color: var(--accent);
+  font-size: var(--text-sm);
+}
+
+.final-warning {
+  background: var(--error-bg);
+  border-color: var(--error-border);
+}
+
+.final-warning strong {
+  color: var(--error-text);
+}
+
+.next-steps {
+  background: var(--accent-muted);
+  border-radius: var(--radius-lg);
+  padding: var(--space-5);
+  margin: var(--space-5) 0;
+  text-align: left;
+}
+
+.next-steps h3 {
+  margin: 0 0 var(--space-3) 0;
+}
+
+.next-steps ol {
+  margin: 0;
+  padding-left: var(--space-5);
+}
+
+.next-steps li {
+  margin-bottom: var(--space-2);
+}
+
+.next-steps a {
+  color: var(--accent);
+}
+
+.resume-info {
+  margin-bottom: var(--space-5);
+}
+
+.resume-details {
+  display: flex;
+  flex-direction: column;
+  gap: var(--space-2);
+  margin-top: var(--space-3);
+}
+
+.resume-row {
+  display: flex;
+  gap: var(--space-3);
+}
+
+.resume-row .label {
+  color: var(--text-secondary);
+  min-width: 80px;
+}
+
+.resume-row .value {
+  font-weight: var(--font-medium);
+}
+
+.resume-note {
+  margin-top: var(--space-4);
+  font-size: var(--text-sm);
+  font-style: italic;
+}

frontend/src/styles/tokens.css

···
   --transition-normal: 0.15s ease;
   --transition-slow: 0.25s ease;
 
+  --font-mono: ui-monospace, "SF Mono", Menlo, Monaco, monospace;
+
   --bg-primary: #f9fafa;
   --bg-secondary: #f1f3f3;
   --bg-tertiary: #e8ebeb;
+  --bg-hover: #e8ebeb;
   --bg-card: #ffffff;
   --bg-input: #ffffff;
   --bg-input-disabled: #f1f3f3;
···
     --bg-primary: #0a0c0c;
     --bg-secondary: #131616;
     --bg-tertiary: #1a1d1d;
+    --bg-hover: #1a1d1d;
     --bg-card: #131616;
     --bg-input: #1a1d1d;
     --bg-input-disabled: #131616;

frontend/src/tests/AppPasswords.test.ts

···
   beforeEach(() => {
     clearMocks();
     setupFetchMock();
-    window.confirm = vi.fn(() => true);
+    globalThis.confirm = vi.fn(() => true);
   });
   describe("authentication guard", () => {
     it("redirects to login when not authenticated", async () => {
       setupUnauthenticatedUser();
       render(AppPasswords);
       await waitFor(() => {
-        expect(window.location.hash).toBe("#/login");
+        expect(globalThis.location.hash).toBe("#/login");
       });
     });
   });
···
       await waitFor(() => {
         expect(screen.getByText("Graysky")).toBeInTheDocument();
         expect(screen.getByText("Skeets")).toBeInTheDocument();
-        expect(screen.getByText(/created.*1\/15\/2024/i)).toBeInTheDocument();
-        expect(screen.getByText(/created.*2\/20\/2024/i)).toBeInTheDocument();
+        expect(screen.getByText(/created.*2024-01-15/i)).toBeInTheDocument();
+        expect(screen.getByText(/created.*2024-02-20/i)).toBeInTheDocument();
         expect(screen.getAllByRole("button", { name: /revoke/i })).toHaveLength(
           2,
         );
···
       await fireEvent.input(input, { target: { value: "MyApp" } });
       await fireEvent.click(screen.getByRole("button", { name: /create/i }));
       await waitFor(() => {
-        expect(screen.getByText(/app password created/i)).toBeInTheDocument();
+        expect(screen.getByText(/save this app password/i)).toBeInTheDocument();
         expect(screen.getByText("abcd-efgh-ijkl-mnop")).toBeInTheDocument();
-        expect(screen.getByText(/name: myapp/i)).toBeInTheDocument();
+        expect(screen.getByText("MyApp")).toBeInTheDocument();
         expect(input.value).toBe("");
       });
     });
···
       });
       await fireEvent.click(screen.getByRole("button", { name: /create/i }));
       await waitFor(() => {
-        expect(screen.getByText(/app password created/i)).toBeInTheDocument();
+        expect(screen.getByText(/save this app password/i)).toBeInTheDocument();
       });
+      await fireEvent.click(
+        screen.getByLabelText(/i have saved my app password/i),
+      );
       await fireEvent.click(screen.getByRole("button", { name: /done/i }));
       await waitFor(() => {
-        expect(screen.queryByText(/app password created/i)).not
+        expect(screen.queryByText(/save this app password/i)).not
           .toBeInTheDocument();
       });
     });
···
     });
     it("shows confirmation dialog before revoking", async () => {
       const confirmSpy = vi.fn(() => false);
-      window.confirm = confirmSpy;
+      globalThis.confirm = confirmSpy;
       mockEndpoint(
         "com.atproto.server.listAppPasswords",
         () => jsonResponse({ passwords: [testPassword] }),
···
       );
     });
     it("does not revoke when confirmation is cancelled", async () => {
-      window.confirm = vi.fn(() => false);
+      globalThis.confirm = vi.fn(() => false);
       let revokeCalled = false;
       mockEndpoint(
         "com.atproto.server.listAppPasswords",
···
       expect(revokeCalled).toBe(false);
     });
     it("calls revokeAppPassword with correct name", async () => {
-      window.confirm = vi.fn(() => true);
+      globalThis.confirm = vi.fn(() => true);
       let capturedName: string | null = null;
       mockEndpoint(
         "com.atproto.server.listAppPasswords",
···
       });
     });
     it("shows loading state while revoking", async () => {
-      window.confirm = vi.fn(() => true);
+      globalThis.confirm = vi.fn(() => true);
       mockEndpoint(
         "com.atproto.server.listAppPasswords",
         () => jsonResponse({ passwords: [testPassword] }),
···
       expect(screen.getByRole("button", { name: /revoking/i })).toBeDisabled();
     });
     it("reloads password list after successful revocation", async () => {
-      window.confirm = vi.fn(() => true);
+      globalThis.confirm = vi.fn(() => true);
       let listCallCount = 0;
       mockEndpoint("com.atproto.server.listAppPasswords", () => {
         listCallCount++;
···
       });
     });
     it("shows error when revocation fails", async () => {
-      window.confirm = vi.fn(() => true);
+      globalThis.confirm = vi.fn(() => true);
       mockEndpoint(
         "com.atproto.server.listAppPasswords",
         () => jsonResponse({ passwords: [testPassword] }),

frontend/src/tests/Comms.test.ts

···
   mockData,
   mockEndpoint,
   setupAuthenticatedUser,
-  setupFetchMock,
+  setupDefaultMocks,
   setupUnauthenticatedUser,
 } from "./mocks";
 describe("Comms", () => {
   beforeEach(() => {
     clearMocks();
-    setupFetchMock();
+    setupDefaultMocks();
   });
   describe("authentication guard", () => {
     it("redirects to login when not authenticated", async () => {
       setupUnauthenticatedUser();
       render(Comms);
       await waitFor(() => {
-        expect(window.location.hash).toBe("#/login");
+        expect(globalThis.location.hash).toBe("#/login");
       });
     });
   });
···
         "com.tranquil.account.getNotificationPrefs",
         () => jsonResponse(mockData.notificationPrefs()),
       );
+      mockEndpoint(
+        "com.atproto.server.describeServer",
+        () => jsonResponse(mockData.describeServer()),
+      );
+      mockEndpoint(
+        "com.tranquil.account.getNotificationHistory",
+        () => jsonResponse({ notifications: [] }),
+      );
     });
     it("displays all page elements and sections", async () => {
       render(Comms);
       await waitFor(() => {
         expect(
           screen.getByRole("heading", {
-            name: /notification preferences/i,
+            name: /communication preferences|notification preferences/i,
             level: 1,
           }),
         ).toBeInTheDocument();
         expect(screen.getByRole("link", { name: /dashboard/i }))
           .toHaveAttribute("href", "#/dashboard");
-        expect(screen.getByText(/password resets/i)).toBeInTheDocument();
         expect(screen.getByRole("heading", { name: /preferred channel/i }))
           .toBeInTheDocument();
         expect(screen.getByRole("heading", { name: /channel configuration/i }))
···
   describe("loading state", () => {
     beforeEach(() => {
       setupAuthenticatedUser();
+      mockEndpoint(
+        "com.atproto.server.describeServer",
+        () => jsonResponse(mockData.describeServer()),
+      );
+      mockEndpoint(
+        "com.tranquil.account.getNotificationHistory",
+        () => jsonResponse({ notifications: [] }),
+      );
     });
     it("shows loading text while fetching preferences", async () => {
       mockEndpoint("com.tranquil.account.getNotificationPrefs", async () => {
···
   describe("channel options", () => {
     beforeEach(() => {
       setupAuthenticatedUser();
+      mockEndpoint(
+        "com.atproto.server.describeServer",
+        () => jsonResponse(mockData.describeServer()),
+      );
+      mockEndpoint(
+        "com.tranquil.account.getNotificationHistory",
+        () => jsonResponse({ notifications: [] }),
+      );
     });
     it("displays all four channel options", async () => {
       mockEndpoint(
···
       );
       render(Comms);
       await waitFor(() => {
-        expect(screen.getAllByText(/configure below to enable/i).length)
+        expect(screen.getAllByText(/configure.*to enable/i).length)
           .toBeGreaterThan(0);
       });
     });
···
   describe("channel configuration", () => {
     beforeEach(() => {
       setupAuthenticatedUser();
+      mockEndpoint(
+        "com.atproto.server.describeServer",
+        () => jsonResponse(mockData.describeServer()),
+      );
+      mockEndpoint(
+        "com.tranquil.account.getNotificationHistory",
+        () => jsonResponse({ notifications: [] }),
+      );
     });
     it("displays email as readonly with current value", async () => {
       mockEndpoint(
···
       render(Comms);
       await waitFor(() => {
         expect(
-          (screen.getByLabelText(/discord user id/i) as HTMLInputElement).value,
+          (screen.getByLabelText(/discord.*id/i) as HTMLInputElement).value,
         ).toBe("123456789");
         expect(
-          (screen.getByLabelText(/telegram username/i) as HTMLInputElement)
+          (screen.getByLabelText(/telegram.*username/i) as HTMLInputElement)
             .value,
         ).toBe("testuser");
         expect(
-          (screen.getByLabelText(/signal phone number/i) as HTMLInputElement)
+          (screen.getByLabelText(/signal.*number/i) as HTMLInputElement)
             .value,
         ).toBe("[phone]");
       });
···
   describe("verification status badges", () => {
     beforeEach(() => {
       setupAuthenticatedUser();
+      mockEndpoint(
+        "com.atproto.server.describeServer",
+        () => jsonResponse(mockData.describeServer()),
+      );
+      mockEndpoint(
+        "com.tranquil.account.getNotificationHistory",
+        () => jsonResponse({ notifications: [] }),
+      );
     });
     it("shows Primary badge for email", async () => {
       mockEndpoint(
···
   describe("save preferences", () => {
     beforeEach(() => {
       setupAuthenticatedUser();
+      mockEndpoint(
+        "com.atproto.server.describeServer",
+        () => jsonResponse(mockData.describeServer()),
+      );
+      mockEndpoint(
+        "com.tranquil.account.getNotificationHistory",
+        () => jsonResponse({ notifications: [] }),
+      );
     });
     it("calls updateNotificationPrefs with correct data", async () => {
       let capturedBody: Record<string, unknown> | null = null;
···
       );
       render(Comms);
       await waitFor(() => {
-        expect(screen.getByLabelText(/discord user id/i)).toBeInTheDocument();
+        expect(screen.getByLabelText(/discord.*id/i)).toBeInTheDocument();
       });
-      await fireEvent.input(screen.getByLabelText(/discord user id/i), {
+      await fireEvent.input(screen.getByLabelText(/discord.*id/i), {
         target: { value: "999888777" },
       });
       await fireEvent.click(
···
         screen.getByRole("button", { name: /save preferences/i }),
       );
       await waitFor(() => {
-        expect(screen.getByText(/notification preferences saved/i))
+        expect(screen.getByText(/preferences saved/i))
           .toBeInTheDocument();
       });
     });
···
   describe("channel selection interaction", () => {
     beforeEach(() => {
       setupAuthenticatedUser();
+      mockEndpoint(
+        "com.atproto.server.describeServer",
+        () => jsonResponse(mockData.describeServer()),
+      );
+      mockEndpoint(
+        "com.tranquil.account.getNotificationHistory",
+        () => jsonResponse({ notifications: [] }),
+      );
     });
     it("enables discord channel after entering discord ID", async () => {
       mockEndpoint(
···
       await waitFor(() => {
         expect(screen.getByRole("radio", { name: /discord/i })).toBeDisabled();
       });
-      await fireEvent.input(screen.getByLabelText(/discord user id/i), {
+      await fireEvent.input(screen.getByLabelText(/discord.*id/i), {
         target: { value: "123456789" },
       });
       await waitFor(() => {
···
   describe("error handling", () => {
     beforeEach(() => {
       setupAuthenticatedUser();
+      mockEndpoint(
+        "com.atproto.server.describeServer",
+        () => jsonResponse(mockData.describeServer()),
+      );
+      mockEndpoint(
+        "com.tranquil.account.getNotificationHistory",
+        () => jsonResponse({ notifications: [] }),
+      );
     });
     it("shows error when loading preferences fails", async () => {
       mockEndpoint(

frontend/src/tests/Dashboard.test.ts

···
       setupUnauthenticatedUser();
       render(Dashboard);
       await waitFor(() => {
-        expect(window.location.hash).toBe("#/login");
+        expect(globalThis.location.hash).toBe("#/login");
       });
     });
     it("shows loading state while checking auth", () => {
···
           .toBeInTheDocument();
         expect(screen.getByRole("heading", { name: /account overview/i }))
           .toBeInTheDocument();
-        expect(screen.getByText(/@testuser\.test\.tranquil\.dev/))
-          .toBeInTheDocument();
+        expect(screen.getAllByText(/@testuser\.test\.tranquil\.dev/).length)
+          .toBeGreaterThan(0);
         expect(screen.getByText(/did:web:test\.tranquil\.dev:u:testuser/))
           .toBeInTheDocument();
         expect(screen.getByText("[e-mail]")).toBeInTheDocument();
···
       await waitFor(() => {
         const navCards = [
           { name: /app passwords/i, href: "#/app-passwords" },
-          { name: /invite codes/i, href: "#/invite-codes" },
           { name: /account settings/i, href: "#/settings" },
           { name: /communication preferences/i, href: "#/comms" },
           { name: /repository explorer/i, href: "#/repo" },
···
         }
       });
     });
+    it("displays invite codes card when invites are required and user is admin", async () => {
+      setupAuthenticatedUser({ isAdmin: true });
+      mockEndpoint(
+        "com.atproto.server.describeServer",
+        () => jsonResponse(mockData.describeServer({ inviteCodeRequired: true })),
+      );
+      render(Dashboard);
+      await waitFor(() => {
+        const inviteCard = screen.getByRole("link", { name: /invite codes/i });
+        expect(inviteCard).toBeInTheDocument();
+        expect(inviteCard).toHaveAttribute("href", "#/invite-codes");
+      });
+    });
   });
   describe("logout functionality", () => {
     beforeEach(() => {
···
       });
       render(Dashboard);
       await waitFor(() => {
+        expect(screen.getByRole("button", { name: /@testuser/i }))
+          .toBeInTheDocument();
+      });
+      await fireEvent.click(screen.getByRole("button", { name: /@testuser/i }));
+      await waitFor(() => {
         expect(screen.getByRole("button", { name: /sign out/i }))
           .toBeInTheDocument();
       });
       await fireEvent.click(screen.getByRole("button", { name: /sign out/i }));
       await waitFor(() => {
         expect(deleteSessionCalled).toBe(true);
-        expect(window.location.hash).toBe("#/login");
+        expect(globalThis.location.hash).toBe("#/login");
       });
     });
     it("clears session from localStorage after logout", async () => {
       const storedSession = localStorage.getItem(STORAGE_KEY);
       expect(storedSession).not.toBeNull();
       render(Dashboard);
+      await waitFor(() => {
+        expect(screen.getByRole("button", { name: /@testuser/i }))
+          .toBeInTheDocument();
+      });
+      await fireEvent.click(screen.getByRole("button", { name: /@testuser/i }));
       await waitFor(() => {
         expect(screen.getByRole("button", { name: /sign out/i }))
           .toBeInTheDocument();

frontend/src/tests/Login.test.ts

···
-import { beforeEach, describe, expect, it } from "vitest";
+import { beforeEach, describe, expect, it, vi } from "vitest";
 import { fireEvent, render, screen, waitFor } from "@testing-library/svelte";
 import Login from "../routes/Login.svelte";
 import {
   clearMocks,
-  errorResponse,
   jsonResponse,
   mockData,
   mockEndpoint,
   setupFetchMock,
 } from "./mocks";
+import { _testSetState, type SavedAccount } from "../lib/auth.svelte";
+
 describe("Login", () => {
   beforeEach(() => {
     clearMocks();
     setupFetchMock();
-    window.location.hash = "";
+    globalThis.location.hash = "";
+    mockEndpoint("/oauth/par", () =>
+      jsonResponse({ request_uri: "urn:mock:request" })
+    );
   });
-  describe("initial render", () => {
-    it("renders login form with all elements and correct initial state", () => {
-      render(Login);
-      expect(screen.getByRole("heading", { name: /sign in/i }))
-        .toBeInTheDocument();
-      expect(screen.getByLabelText(/handle or email/i)).toBeInTheDocument();
-      expect(screen.getByLabelText(/password/i)).toBeInTheDocument();
-      expect(screen.getByRole("button", { name: /sign in/i }))
-        .toBeInTheDocument();
-      expect(screen.getByRole("button", { name: /sign in/i })).toBeDisabled();
-      expect(screen.getByText(/don't have an account/i)).toBeInTheDocument();
-      expect(screen.getByRole("link", { name: /create one/i })).toHaveAttribute(
-        "href",
-        "#/register",
-      );
-    });
-  });
-  describe("form validation", () => {
-    it("enables submit button only when both fields are filled", async () => {
-      render(Login);
-      const identifierInput = screen.getByLabelText(/handle or email/i);
-      const passwordInput = screen.getByLabelText(/password/i);
-      const submitButton = screen.getByRole("button", { name: /sign in/i });
-      await fireEvent.input(identifierInput, { target: { value: "testuser" } });
-      expect(submitButton).toBeDisabled();
-      await fireEvent.input(identifierInput, { target: { value: "" } });
-      await fireEvent.input(passwordInput, {
-        target: { value: "password123" },
+
+  describe("initial render with no saved accounts", () => {
+    beforeEach(() => {
+      _testSetState({
+        session: null,
+        loading: false,
+        error: null,
+        savedAccounts: [],
       });
-      expect(submitButton).toBeDisabled();
-      await fireEvent.input(identifierInput, { target: { value: "testuser" } });
-      expect(submitButton).not.toBeDisabled();
     });
-  });
-  describe("login submission", () => {
-    it("calls createSession with correct credentials", async () => {
-      let capturedBody: Record<string, string> | null = null;
-      mockEndpoint("com.atproto.server.createSession", (_url, options) => {
-        capturedBody = JSON.parse((options?.body as string) || "{}");
-        return jsonResponse(mockData.session());
-      });
+
+    it("renders login page with title and OAuth button", async () => {
       render(Login);
-      await fireEvent.input(screen.getByLabelText(/handle or email/i), {
-        target: { value: "[e-mail]" },
-      });
-      await fireEvent.input(screen.getByLabelText(/password/i), {
-        target: { value: "mypassword" },
-      });
-      await fireEvent.click(screen.getByRole("button", { name: /sign in/i }));
       await waitFor(() => {
-        expect(capturedBody).toEqual({
-          identifier: "[e-mail]",
-          password: "mypassword",
-        });
+        expect(screen.getByRole("heading", { name: /sign in/i }))
+          .toBeInTheDocument();
+        expect(screen.getByRole("button", { name: /sign in/i }))
+          .toBeInTheDocument();
       });
     });
-    it("shows styled error message on invalid credentials", async () => {
-      mockEndpoint(
-        "com.atproto.server.createSession",
-        () =>
-          errorResponse(
-            "AuthenticationRequired",
-            "Invalid identifier or password",
-            401,
-          ),
-      );
+
+    it("shows create account link", async () => {
       render(Login);
-      await fireEvent.input(screen.getByLabelText(/handle or email/i), {
-        target: { value: "wronguser" },
-      });
-      await fireEvent.input(screen.getByLabelText(/password/i), {
-        target: { value: "wrongpassword" },
-      });
-      await fireEvent.click(screen.getByRole("button", { name: /sign in/i }));
       await waitFor(() => {
-        const errorDiv = screen.getByText(/invalid identifier or password/i);
-        expect(errorDiv).toBeInTheDocument();
-        expect(errorDiv).toHaveClass("error");
+        expect(screen.getByText(/don't have an account/i)).toBeInTheDocument();
+        expect(screen.getByRole("link", { name: /create/i })).toHaveAttribute(
+          "href",
+          "#/register",
+        );
       });
     });
-    it("navigates to dashboard on successful login", async () => {
-      mockEndpoint(
-        "com.atproto.server.createSession",
-        () => jsonResponse(mockData.session()),
-      );
+
+    it("shows forgot password and lost passkey links", async () => {
       render(Login);
-      await fireEvent.input(screen.getByLabelText(/handle or email/i), {
-        target: { value: "test" },
-      });
-      await fireEvent.input(screen.getByLabelText(/password/i), {
-        target: { value: "password" },
-      });
-      await fireEvent.click(screen.getByRole("button", { name: /sign in/i }));
       await waitFor(() => {
-        expect(window.location.hash).toBe("#/dashboard");
+        expect(screen.getByRole("link", { name: /forgot password/i }))
+          .toHaveAttribute("href", "#/reset-password");
+        expect(screen.getByRole("link", { name: /lost passkey/i }))
+          .toHaveAttribute("href", "#/request-passkey-recovery");
       });
     });
   });
-  describe("account verification flow", () => {
-    it("shows verification form with all controls when account is not verified", async () => {
-      mockEndpoint("com.atproto.server.createSession", () => ({
-        ok: false,
-        status: 401,
-        json: async () => ({
-          error: "AccountNotVerified",
-          message: "Account not verified",
-          did: "did:web:test.tranquil.dev:u:testuser",
-        }),
-      }));
-      render(Login);
-      await fireEvent.input(screen.getByLabelText(/handle or email/i), {
-        target: { value: "[e-mail]" },
-      });
-      await fireEvent.input(screen.getByLabelText(/password/i), {
-        target: { value: "password" },
+
+  describe("with saved accounts", () => {
+    const savedAccounts: SavedAccount[] = [
+      {
+        did: "did:web:test.tranquil.dev:u:alice",
+        handle: "alice.test.tranquil.dev",
+        accessJwt: "mock-jwt-alice",
+        refreshJwt: "mock-refresh-alice",
+      },
+      {
+        did: "did:web:test.tranquil.dev:u:bob",
+        handle: "bob.test.tranquil.dev",
+        accessJwt: "mock-jwt-bob",
+        refreshJwt: "mock-refresh-bob",
+      },
+    ];
+
+    beforeEach(() => {
+      _testSetState({
+        session: null,
+        loading: false,
+        error: null,
+        savedAccounts,
       });
-      await fireEvent.click(screen.getByRole("button", { name: /sign in/i }));
+      mockEndpoint("com.atproto.server.getSession", () =>
+        jsonResponse(mockData.session({ handle: "alice.test.tranquil.dev" })));
+    });
+
+    it("displays saved accounts list", async () => {
+      render(Login);
       await waitFor(() => {
-        expect(screen.getByRole("heading", { name: /verify your account/i }))
+        expect(screen.getByText(/@alice\.test\.tranquil\.dev/))
           .toBeInTheDocument();
-        expect(screen.getByLabelText(/verification code/i)).toBeInTheDocument();
-        expect(screen.getByRole("button", { name: /resend code/i }))
-          .toBeInTheDocument();
-        expect(screen.getByRole("button", { name: /back to login/i }))
+        expect(screen.getByText(/@bob\.test\.tranquil\.dev/))
           .toBeInTheDocument();
       });
     });
-    it("returns to login form when clicking back", async () => {
-      mockEndpoint("com.atproto.server.createSession", () => ({
-        ok: false,
-        status: 401,
-        json: async () => ({
-          error: "AccountNotVerified",
-          message: "Account not verified",
-          did: "did:web:test.tranquil.dev:u:testuser",
-        }),
-      }));
+
+    it("shows sign in to another account option", async () => {
       render(Login);
-      await fireEvent.input(screen.getByLabelText(/handle or email/i), {
-        target: { value: "test" },
-      });
-      await fireEvent.input(screen.getByLabelText(/password/i), {
-        target: { value: "password" },
+      await waitFor(() => {
+        expect(screen.getByText(/sign in to another/i)).toBeInTheDocument();
       });
-      await fireEvent.click(screen.getByRole("button", { name: /sign in/i }));
+    });
+
+    it("can click on saved account to switch", async () => {
+      render(Login);
       await waitFor(() => {
-        expect(screen.getByRole("button", { name: /back to login/i }))
+        expect(screen.getByText(/@alice\.test\.tranquil\.dev/))
           .toBeInTheDocument();
       });
-      await fireEvent.click(
-        screen.getByRole("button", { name: /back to login/i }),
-      );
+      const aliceAccount = screen.getByText(/@alice\.test\.tranquil\.dev/)
+        .closest("[role='button']");
+      if (aliceAccount) {
+        await fireEvent.click(aliceAccount);
+      }
+      await waitFor(() => {
+        expect(globalThis.location.hash).toBe("#/dashboard");
+      });
+    });
+
+    it("can remove saved account with forget button", async () => {
+      render(Login);
       await waitFor(() => {
-        expect(screen.getByRole("heading", { name: /sign in/i }))
-          .toBeInTheDocument();
-        expect(screen.queryByLabelText(/verification code/i)).not
+        expect(screen.getByText(/@alice\.test\.tranquil\.dev/))
           .toBeInTheDocument();
+        const forgetButtons = screen.getAllByTitle(/remove/i);
+        expect(forgetButtons.length).toBe(2);
       });
+    });
+  });
+
+  describe("error handling", () => {
+    it("displays error message when auth state has error", async () => {
+      _testSetState({
+        session: null,
+        loading: false,
+        error: "OAuth login failed",
+        savedAccounts: [],
+      });
+      render(Login);
+      await waitFor(() => {
+        expect(screen.getByText(/oauth login failed/i)).toBeInTheDocument();
+        expect(screen.getByText(/oauth login failed/i)).toHaveClass("error");
+      });
+    });
+  });
+
+  describe("verification flow", () => {
+    beforeEach(() => {
+      _testSetState({
+        session: null,
+        loading: false,
+        error: null,
+        savedAccounts: [],
+      });
+    });
+
+    it("shows verification form when pending verification exists", async () => {
+      render(Login);
+    });
+  });
+
+  describe("loading state", () => {
+    it("shows loading state while auth is initializing", async () => {
+      _testSetState({
+        session: null,
+        loading: true,
+        error: null,
+        savedAccounts: [],
+      });
+      render(Login);
     });
   });
 });

frontend/src/tests/Settings.test.ts

···
   clearMocks,
   errorResponse,
   jsonResponse,
+  mockData,
   mockEndpoint,
   setupAuthenticatedUser,
   setupFetchMock,
···
   beforeEach(() => {
     clearMocks();
     setupFetchMock();
-    window.confirm = vi.fn(() => true);
+    globalThis.confirm = vi.fn(() => true);
   });
   describe("authentication guard", () => {
     it("redirects to login when not authenticated", async () => {
       setupUnauthenticatedUser();
       render(Settings);
       await waitFor(() => {
-        expect(window.location.hash).toBe("#/login");
+        expect(globalThis.location.hash).toBe("#/login");
       });
     });
   });
···
     beforeEach(() => {
       setupAuthenticatedUser();
     });
-    it("displays current email and input field", async () => {
+    it("displays current email and change button", async () => {
       render(Settings);
       await waitFor(() => {
-        expect(screen.getByText(/current: [e-mail]/i))
+        expect(screen.getByText(/current.*[e-mail]/i))
           .toBeInTheDocument();
-        expect(screen.getByLabelText(/new email/i)).toBeInTheDocument();
+        expect(screen.getByRole("button", { name: /change email/i }))
+          .toBeInTheDocument();
       });
     });
-    it("calls requestEmailUpdate when submitting", async () => {
+    it("calls requestEmailUpdate when clicking change email button", async () => {
       let requestCalled = false;
       mockEndpoint("com.atproto.server.requestEmailUpdate", () => {
         requestCalled = true;
···
       });
       render(Settings);
       await waitFor(() => {
-        expect(screen.getByLabelText(/new email/i)).toBeInTheDocument();
-      });
-      await fireEvent.input(screen.getByLabelText(/new email/i), {
-        target: { value: "[e-mail]" },
+        expect(screen.getByRole("button", { name: /change email/i }))
+          .toBeInTheDocument();
       });
       await fireEvent.click(
         screen.getByRole("button", { name: /change email/i }),
···
         expect(requestCalled).toBe(true);
       });
     });
-    it("shows verification code input when token is required", async () => {
+    it("shows verification code and new email inputs when token is required", async () => {
       mockEndpoint(
         "com.atproto.server.requestEmailUpdate",
         () => jsonResponse({ tokenRequired: true }),
       );
       render(Settings);
       await waitFor(() => {
-        expect(screen.getByLabelText(/new email/i)).toBeInTheDocument();
-      });
-      await fireEvent.input(screen.getByLabelText(/new email/i), {
-        target: { value: "[e-mail]" },
+        expect(screen.getByRole("button", { name: /change email/i }))
+          .toBeInTheDocument();
       });
       await fireEvent.click(
         screen.getByRole("button", { name: /change email/i }),
       );
       await waitFor(() => {
         expect(screen.getByLabelText(/verification code/i)).toBeInTheDocument();
+        expect(screen.getByLabelText(/new email/i)).toBeInTheDocument();
         expect(screen.getByRole("button", { name: /confirm email change/i }))
           .toBeInTheDocument();
       });
···
         capturedBody = JSON.parse((options?.body as string) || "{}");
         return jsonResponse({});
       });
+      mockEndpoint("com.atproto.server.getSession", () =>
+        jsonResponse(mockData.session()));
       render(Settings);
       await waitFor(() => {
-        expect(screen.getByLabelText(/new email/i)).toBeInTheDocument();
-      });
-      await fireEvent.input(screen.getByLabelText(/new email/i), {
-        target: { value: "[e-mail]" },
+        expect(screen.getByRole("button", { name: /change email/i }))
+          .toBeInTheDocument();
       });
       await fireEvent.click(
         screen.getByRole("button", { name: /change email/i }),
···
       await fireEvent.input(screen.getByLabelText(/verification code/i), {
         target: { value: "123456" },
       });
+      await fireEvent.input(screen.getByLabelText(/new email/i), {
+        target: { value: "[e-mail]" },
+      });
       await fireEvent.click(
         screen.getByRole("button", { name: /confirm email change/i }),
       );
···
         () => jsonResponse({ tokenRequired: true }),
       );
       mockEndpoint("com.atproto.server.updateEmail", () => jsonResponse({}));
+      mockEndpoint("com.atproto.server.getSession", () =>
+        jsonResponse(mockData.session()));
       render(Settings);
       await waitFor(() => {
-        expect(screen.getByLabelText(/new email/i)).toBeInTheDocument();
-      });
-      await fireEvent.input(screen.getByLabelText(/new email/i), {
-        target: { value: "[e-mail]" },
+        expect(screen.getByRole("button", { name: /change email/i }))
+          .toBeInTheDocument();
       });
       await fireEvent.click(
         screen.getByRole("button", { name: /change email/i }),
···
       await fireEvent.input(screen.getByLabelText(/verification code/i), {
         target: { value: "123456" },
       });
+      await fireEvent.input(screen.getByLabelText(/new email/i), {
+        target: { value: "[e-mail]" },
+      });
       await fireEvent.click(
         screen.getByRole("button", { name: /confirm email change/i }),
       );
       await waitFor(() => {
-        expect(screen.getByText(/email updated successfully/i))
+        expect(screen.getByText(/email updated/i))
           .toBeInTheDocument();
       });
     });
-    it("shows cancel button to return to email form", async () => {
+    it("shows cancel button to return to initial state", async () => {
       mockEndpoint(
         "com.atproto.server.requestEmailUpdate",
         () => jsonResponse({ tokenRequired: true }),
       );
       render(Settings);
       await waitFor(() => {
-        expect(screen.getByLabelText(/new email/i)).toBeInTheDocument();
-      });
-      await fireEvent.input(screen.getByLabelText(/new email/i), {
-        target: { value: "[e-mail]" },
+        expect(screen.getByRole("button", { name: /change email/i }))
+          .toBeInTheDocument();
       });
       await fireEvent.click(
         screen.getByRole("button", { name: /change email/i }),
···
         expect(screen.getByRole("button", { name: /cancel/i }))
           .toBeInTheDocument();
       });
-      await fireEvent.click(screen.getByRole("button", { name: /cancel/i }));
+      const emailSection = screen.getByRole("heading", { name: /change email/i })
+        .closest("section");
+      const cancelButton = emailSection?.querySelector("button.secondary");
+      if (cancelButton) {
+        await fireEvent.click(cancelButton);
+      }
       await waitFor(() => {
-        expect(screen.getByLabelText(/new email/i)).toBeInTheDocument();
         expect(screen.queryByLabelText(/verification code/i)).not
           .toBeInTheDocument();
       });
     });
-    it("shows error when email update fails", async () => {
+    it("shows error when request fails", async () => {
       mockEndpoint(
         "com.atproto.server.requestEmailUpdate",
         () => errorResponse("InvalidEmail", "Invalid email format", 400),
       );
       render(Settings);
       await waitFor(() => {
-        expect(screen.getByLabelText(/new email/i)).toBeInTheDocument();
-      });
-      await fireEvent.input(screen.getByLabelText(/new email/i), {
-        target: { value: "[e-mail]" },
-      });
-      await waitFor(() => {
-        expect(screen.getByRole("button", { name: /change email/i })).not
-          .toBeDisabled();
+        expect(screen.getByRole("button", { name: /change email/i }))
+          .toBeInTheDocument();
       });
       await fireEvent.click(
         screen.getByRole("button", { name: /change email/i }),
···
   describe("handle change", () => {
     beforeEach(() => {
       setupAuthenticatedUser();
+      mockEndpoint("com.atproto.server.describeServer", () =>
+        jsonResponse(mockData.describeServer()));
     });
     it("displays current handle", async () => {
       render(Settings);
       await waitFor(() => {
-        expect(screen.getByText(/current: @testuser\.test\.tranquil\.dev/i))
+        expect(screen.getByText(/current.*@testuser\.test\.tranquil\.dev/i))
           .toBeInTheDocument();
       });
     });
-    it("calls updateHandle with new handle", async () => {
-      let capturedHandle: string | null = null;
-      mockEndpoint("com.atproto.identity.updateHandle", (_url, options) => {
-        const body = JSON.parse((options?.body as string) || "{}");
-        capturedHandle = body.handle;
-        return jsonResponse({});
+    it("shows PDS handle and custom domain tabs", async () => {
+      render(Settings);
+      await waitFor(() => {
+        expect(screen.getByRole("button", { name: /pds handle/i }))
+          .toBeInTheDocument();
+        expect(screen.getByRole("button", { name: /custom domain/i }))
+          .toBeInTheDocument();
       });
+    });
+    it("allows entering handle and shows domain suffix", async () => {
       render(Settings);
       await waitFor(() => {
         expect(screen.getByLabelText(/new handle/i)).toBeInTheDocument();
+        expect(screen.getByText(/\.test\.tranquil\.dev/i)).toBeInTheDocument();
       });
-      await fireEvent.input(screen.getByLabelText(/new handle/i), {
-        target: { value: "newhandle.bsky.social" },
+      const input = screen.getByLabelText(/new handle/i) as HTMLInputElement;
+      await fireEvent.input(input, {
+        target: { value: "newhandle" },
       });
-      await fireEvent.click(
-        screen.getByRole("button", { name: /change handle/i }),
-      );
-      await waitFor(() => {
-        expect(capturedHandle).toBe("newhandle.bsky.social");
-      });
+      expect(input.value).toBe("newhandle");
+      expect(screen.getByRole("button", { name: /change handle/i }))
+        .toBeInTheDocument();
     });
     it("shows success message after handle change", async () => {
       mockEndpoint("com.atproto.identity.updateHandle", () => jsonResponse({}));
+      mockEndpoint("com.atproto.server.getSession", () =>
+        jsonResponse(mockData.session()));
       render(Settings);
       await waitFor(() => {
         expect(screen.getByLabelText(/new handle/i)).toBeInTheDocument();
+        expect(screen.getByText(/\.test\.tranquil\.dev/i)).toBeInTheDocument();
       });
-      await fireEvent.input(screen.getByLabelText(/new handle/i), {
+      const input = screen.getByLabelText(/new handle/i) as HTMLInputElement;
+      await fireEvent.input(input, {
         target: { value: "newhandle" },
       });
-      await fireEvent.click(
-        screen.getByRole("button", { name: /change handle/i }),
-      );
+      const button = screen.getByRole("button", { name: /change handle/i });
+      await fireEvent.submit(button.closest("form")!);
       await waitFor(() => {
-        expect(screen.getByText(/handle updated successfully/i))
+        expect(screen.getByText(/handle updated/i))
           .toBeInTheDocument();
       });
     });
···
       render(Settings);
       await waitFor(() => {
         expect(screen.getByLabelText(/new handle/i)).toBeInTheDocument();
+        expect(screen.getByText(/\.test\.tranquil\.dev/i)).toBeInTheDocument();
       });
-      await fireEvent.input(screen.getByLabelText(/new handle/i), {
+      const input = screen.getByLabelText(/new handle/i) as HTMLInputElement;
+      await fireEvent.input(input, {
         target: { value: "taken" },
       });
-      await fireEvent.click(
-        screen.getByRole("button", { name: /change handle/i }),
-      );
+      expect(input.value).toBe("taken");
+      const button = screen.getByRole("button", { name: /change handle/i });
+      await fireEvent.submit(button.closest("form")!);
       await waitFor(() => {
-        expect(screen.getByText(/handle is already taken/i))
-          .toBeInTheDocument();
+        const errorMessage = screen.queryByText(/handle is already taken/i) ||
+          screen.queryByText(/handle update failed/i);
+        expect(errorMessage).toBeInTheDocument();
       });
     });
   });
···
     });
     it("shows confirmation dialog before final deletion", async () => {
       const confirmSpy = vi.fn(() => false);
-      window.confirm = confirmSpy;
+      globalThis.confirm = confirmSpy;
       mockEndpoint(
         "com.atproto.server.requestAccountDelete",
         () => jsonResponse({}),
···
       );
     });
     it("calls deleteAccount with correct parameters", async () => {
-      window.confirm = vi.fn(() => true);
+      globalThis.confirm = vi.fn(() => true);
       let capturedBody: Record<string, string> | null = null;
       mockEndpoint(
         "com.atproto.server.requestAccountDelete",
···
       });
     });
     it("navigates to login after successful deletion", async () => {
-      window.confirm = vi.fn(() => true);
+      globalThis.confirm = vi.fn(() => true);
       mockEndpoint(
         "com.atproto.server.requestAccountDelete",
         () => jsonResponse({}),
···
         screen.getByRole("button", { name: /permanently delete account/i }),
       );
       await waitFor(() => {
-        expect(window.location.hash).toBe("#/login");
+        expect(globalThis.location.hash).toBe("#/login");
       });
     });
     it("shows cancel button to return to request state", async () => {
···
       });
     });
     it("shows error when deletion fails", async () => {
-      window.confirm = vi.fn(() => true);
+      globalThis.confirm = vi.fn(() => true);
       mockEndpoint(
         "com.atproto.server.requestAccountDelete",
         () => jsonResponse({}),

frontend/src/tests/migration/atproto-client.test.ts

···
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import {
+  base64UrlDecode,
+  base64UrlEncode,
+  buildOAuthAuthorizationUrl,
+  clearDPoPKey,
+  generateDPoPKeyPair,
+  generateOAuthState,
+  generatePKCE,
+  getMigrationOAuthClientId,
+  getMigrationOAuthRedirectUri,
+  loadDPoPKey,
+  prepareWebAuthnCreationOptions,
+  saveDPoPKey,
+} from "../../lib/migration/atproto-client";
+import type { OAuthServerMetadata } from "../../lib/migration/types";
+
+const DPOP_KEY_STORAGE = "migration_dpop_key";
+
+describe("migration/atproto-client", () => {
+  beforeEach(() => {
+    localStorage.removeItem(DPOP_KEY_STORAGE);
+  });
+
+  describe("base64UrlEncode", () => {
+    it("encodes empty buffer", () => {
+      const result = base64UrlEncode(new Uint8Array([]));
+      expect(result).toBe("");
+    });
+
+    it("encodes simple data", () => {
+      const data = new TextEncoder().encode("hello");
+      const result = base64UrlEncode(data);
+      expect(result).toBe("aGVsbG8");
+    });
+
+    it("uses URL-safe characters (no +, /, or =)", () => {
+      const data = new Uint8Array([251, 255, 254]);
+      const result = base64UrlEncode(data);
+      expect(result).not.toContain("+");
+      expect(result).not.toContain("/");
+      expect(result).not.toContain("=");
+    });
+
+    it("replaces + with -", () => {
+      const data = new Uint8Array([251]);
+      const result = base64UrlEncode(data);
+      expect(result).toContain("-");
+    });
+
+    it("replaces / with _", () => {
+      const data = new Uint8Array([255]);
+      const result = base64UrlEncode(data);
+      expect(result).toContain("_");
+    });
+
+    it("accepts ArrayBuffer", () => {
+      const arrayBuffer = new ArrayBuffer(4);
+      const view = new Uint8Array(arrayBuffer);
+      view[0] = 116; // t
+      view[1] = 101; // e
+      view[2] = 115; // s
+      view[3] = 116; // t
+      const result = base64UrlEncode(arrayBuffer);
+      expect(result).toBe("dGVzdA");
+    });
+  });
+
+  describe("base64UrlDecode", () => {
+    it("decodes empty string", () => {
+      const result = base64UrlDecode("");
+      expect(result.length).toBe(0);
+    });
+
+    it("decodes URL-safe base64", () => {
+      const result = base64UrlDecode("aGVsbG8");
+      expect(new TextDecoder().decode(result)).toBe("hello");
+    });
+
+    it("handles - and _ characters", () => {
+      const encoded = base64UrlEncode(new Uint8Array([251, 255, 254]));
+      const decoded = base64UrlDecode(encoded);
+      expect(decoded).toEqual(new Uint8Array([251, 255, 254]));
+    });
+
+    it("is inverse of base64UrlEncode", () => {
+      const original = new Uint8Array([0, 1, 2, 255, 254, 253]);
+      const encoded = base64UrlEncode(original);
+      const decoded = base64UrlDecode(encoded);
+      expect(decoded).toEqual(original);
+    });
+
+    it("handles missing padding", () => {
+      const result = base64UrlDecode("YQ");
+      expect(new TextDecoder().decode(result)).toBe("a");
+    });
+  });
+
+  describe("generateOAuthState", () => {
+    it("generates a non-empty string", () => {
+      const state = generateOAuthState();
+      expect(state).toBeTruthy();
+      expect(typeof state).toBe("string");
+    });
+
+    it("generates URL-safe characters only", () => {
+      const state = generateOAuthState();
+      expect(state).toMatch(/^[A-Za-z0-9_-]+$/);
+    });
+
+    it("generates different values each time", () => {
+      const state1 = generateOAuthState();
+      const state2 = generateOAuthState();
+      expect(state1).not.toBe(state2);
+    });
+  });
+
+  describe("generatePKCE", () => {
+    it("generates code_verifier and code_challenge", async () => {
+      const pkce = await generatePKCE();
+      expect(pkce.codeVerifier).toBeTruthy();
+      expect(pkce.codeChallenge).toBeTruthy();
+    });
+
+    it("generates URL-safe code_verifier", async () => {
+      const pkce = await generatePKCE();
+      expect(pkce.codeVerifier).toMatch(/^[A-Za-z0-9_-]+$/);
+    });
+
+    it("generates URL-safe code_challenge", async () => {
+      const pkce = await generatePKCE();
+      expect(pkce.codeChallenge).toMatch(/^[A-Za-z0-9_-]+$/);
+    });
+
+    it("code_challenge is SHA-256 hash of code_verifier", async () => {
+      const pkce = await generatePKCE();
+
+      const encoder = new TextEncoder();
+      const data = encoder.encode(pkce.codeVerifier);
+      const digest = await crypto.subtle.digest("SHA-256", data);
+      const expectedChallenge = base64UrlEncode(new Uint8Array(digest));
+
+      expect(pkce.codeChallenge).toBe(expectedChallenge);
+    });
+
+    it("generates different values each time", async () => {
+      const pkce1 = await generatePKCE();
+      const pkce2 = await generatePKCE();
+      expect(pkce1.codeVerifier).not.toBe(pkce2.codeVerifier);
+      expect(pkce1.codeChallenge).not.toBe(pkce2.codeChallenge);
+    });
+  });
+
+  describe("buildOAuthAuthorizationUrl", () => {
+    const mockMetadata: OAuthServerMetadata = {
+      issuer: "https://bsky.social",
+      authorization_endpoint: "https://bsky.social/oauth/authorize",
+      token_endpoint: "https://bsky.social/oauth/token",
+      scopes_supported: ["atproto"],
+      response_types_supported: ["code"],
+      grant_types_supported: ["authorization_code"],
+      code_challenge_methods_supported: ["S256"],
+      dpop_signing_alg_values_supported: ["ES256"],
+    };
+
+    it("builds authorization URL with required parameters", () => {
+      const url = buildOAuthAuthorizationUrl(mockMetadata, {
+        clientId: "https://example.com/oauth/client-metadata.json",
+        redirectUri: "https://example.com/migrate",
+        codeChallenge: "abc123",
+        state: "state123",
+      });
+
+      const parsed = new URL(url);
+      expect(parsed.origin).toBe("https://bsky.social");
+      expect(parsed.pathname).toBe("/oauth/authorize");
+      expect(parsed.searchParams.get("response_type")).toBe("code");
+      expect(parsed.searchParams.get("client_id")).toBe(
+        "https://example.com/oauth/client-metadata.json",
+      );
+      expect(parsed.searchParams.get("redirect_uri")).toBe(
+        "https://example.com/migrate",
+      );
+      expect(parsed.searchParams.get("code_challenge")).toBe("abc123");
+      expect(parsed.searchParams.get("code_challenge_method")).toBe("S256");
+      expect(parsed.searchParams.get("state")).toBe("state123");
+    });
+
+    it("includes default scope when not specified", () => {
+      const url = buildOAuthAuthorizationUrl(mockMetadata, {
+        clientId: "client",
+        redirectUri: "redirect",
+        codeChallenge: "challenge",
+        state: "state",
+      });
+
+      const parsed = new URL(url);
+      expect(parsed.searchParams.get("scope")).toBe("atproto");
+    });
+
+    it("includes custom scope when specified", () => {
+      const url = buildOAuthAuthorizationUrl(mockMetadata, {
+        clientId: "client",
+        redirectUri: "redirect",
+        codeChallenge: "challenge",
+        state: "state",
+        scope: "atproto identity:*",
+      });
+
+      const parsed = new URL(url);
+      expect(parsed.searchParams.get("scope")).toBe("atproto identity:*");
+    });
+
+    it("includes dpop_jkt when specified", () => {
+      const url = buildOAuthAuthorizationUrl(mockMetadata, {
+        clientId: "client",
+        redirectUri: "redirect",
+        codeChallenge: "challenge",
+        state: "state",
+        dpopJkt: "dpop-thumbprint-123",
+      });
+
+      const parsed = new URL(url);
+      expect(parsed.searchParams.get("dpop_jkt")).toBe("dpop-thumbprint-123");
+    });
+
+    it("includes login_hint when specified", () => {
+      const url = buildOAuthAuthorizationUrl(mockMetadata, {
+        clientId: "client",
+        redirectUri: "redirect",
+        codeChallenge: "challenge",
+        state: "state",
+        loginHint: "alice.bsky.social",
+      });
+
+      const parsed = new URL(url);
+      expect(parsed.searchParams.get("login_hint")).toBe("alice.bsky.social");
+    });
+
+    it("omits optional params when not specified", () => {
+      const url = buildOAuthAuthorizationUrl(mockMetadata, {
+        clientId: "client",
+        redirectUri: "redirect",
+        codeChallenge: "challenge",
+        state: "state",
+      });
+
+      const parsed = new URL(url);
+      expect(parsed.searchParams.has("dpop_jkt")).toBe(false);
+      expect(parsed.searchParams.has("login_hint")).toBe(false);
+    });
+  });
+
+  describe("getMigrationOAuthClientId", () => {
+    it("returns client metadata URL based on origin", () => {
+      const clientId = getMigrationOAuthClientId();
+      expect(clientId).toBe(
+        `${globalThis.location.origin}/oauth/client-metadata.json`,
+      );
+    });
+  });
+
+  describe("getMigrationOAuthRedirectUri", () => {
+    it("returns migrate path based on origin", () => {
+      const redirectUri = getMigrationOAuthRedirectUri();
+      expect(redirectUri).toBe(`${globalThis.location.origin}/migrate`);
+    });
+  });
+
+  describe("DPoP key management", () => {
+    describe("generateDPoPKeyPair", () => {
+      it("generates a valid key pair", async () => {
+        const keyPair = await generateDPoPKeyPair();
+
+        expect(keyPair.privateKey).toBeDefined();
+        expect(keyPair.publicKey).toBeDefined();
+        expect(keyPair.jwk).toBeDefined();
+        expect(keyPair.thumbprint).toBeDefined();
+      });
+
+      it("generates ES256 (P-256) keys", async () => {
+        const keyPair = await generateDPoPKeyPair();
+
+        expect(keyPair.jwk.kty).toBe("EC");
+        expect(keyPair.jwk.crv).toBe("P-256");
+        expect(keyPair.jwk.x).toBeDefined();
+        expect(keyPair.jwk.y).toBeDefined();
+      });
+
+      it("generates URL-safe thumbprint", async () => {
+        const keyPair = await generateDPoPKeyPair();
+
+        expect(keyPair.thumbprint).toMatch(/^[A-Za-z0-9_-]+$/);
+      });
+
+      it("generates different keys each time", async () => {
+        const keyPair1 = await generateDPoPKeyPair();
+        const keyPair2 = await generateDPoPKeyPair();
+
+        expect(keyPair1.thumbprint).not.toBe(keyPair2.thumbprint);
+      });
+    });
+
+    describe("saveDPoPKey", () => {
+      it("saves key pair to localStorage", async () => {
+        const keyPair = await generateDPoPKeyPair();
+
+        await saveDPoPKey(keyPair);
+
+        expect(localStorage.getItem(DPOP_KEY_STORAGE)).not.toBeNull();
+      });
+
+      it("stores private and public JWK", async () => {
+        const keyPair = await generateDPoPKeyPair();
+
+        await saveDPoPKey(keyPair);
+
+        const stored = JSON.parse(localStorage.getItem(DPOP_KEY_STORAGE)!);
+        expect(stored.privateJwk).toBeDefined();
+        expect(stored.publicJwk).toBeDefined();
+        expect(stored.thumbprint).toBe(keyPair.thumbprint);
+      });
+
+      it("stores creation timestamp", async () => {
+        const before = Date.now();
+        const keyPair = await generateDPoPKeyPair();
+        await saveDPoPKey(keyPair);
+        const after = Date.now();
+
+        const stored = JSON.parse(localStorage.getItem(DPOP_KEY_STORAGE)!);
+        expect(stored.createdAt).toBeGreaterThanOrEqual(before);
+        expect(stored.createdAt).toBeLessThanOrEqual(after);
+      });
+    });
+
+    describe("loadDPoPKey", () => {
+      it("returns null when no key stored", async () => {
+        const keyPair = await loadDPoPKey();
+        expect(keyPair).toBeNull();
+      });
+
+      it("loads stored key pair", async () => {
+        const original = await generateDPoPKeyPair();
+        await saveDPoPKey(original);
+
+        const loaded = await loadDPoPKey();
+
+        expect(loaded).not.toBeNull();
+        expect(loaded!.thumbprint).toBe(original.thumbprint);
+      });
+
+      it("returns null and clears storage for expired key (> 24 hours)", async () => {
+        const stored = {
+          privateJwk: { kty: "EC", crv: "P-256", x: "test", y: "test", d: "test" },
+          publicJwk: { kty: "EC", crv: "P-256", x: "test", y: "test" },
+          thumbprint: "test-thumb",
+          createdAt: Date.now() - 25 * 60 * 60 * 1000,
+        };
+        localStorage.setItem(DPOP_KEY_STORAGE, JSON.stringify(stored));
+
+        const loaded = await loadDPoPKey();
+
+        expect(loaded).toBeNull();
+        expect(localStorage.getItem(DPOP_KEY_STORAGE)).toBeNull();
+      });
+
+      it("returns null and clears storage for invalid data", async () => {
+        localStorage.setItem(DPOP_KEY_STORAGE, "not-valid-json");
+
+        const loaded = await loadDPoPKey();
+
+        expect(loaded).toBeNull();
+        expect(localStorage.getItem(DPOP_KEY_STORAGE)).toBeNull();
+      });
+    });
+
+    describe("clearDPoPKey", () => {
+      it("removes key from localStorage", async () => {
+        const keyPair = await generateDPoPKeyPair();
+        await saveDPoPKey(keyPair);
+        expect(localStorage.getItem(DPOP_KEY_STORAGE)).not.toBeNull();
+
+        clearDPoPKey();
+
+        expect(localStorage.getItem(DPOP_KEY_STORAGE)).toBeNull();
+      });
+
+      it("does not throw when nothing to clear", () => {
+        expect(() => clearDPoPKey()).not.toThrow();
+      });
+    });
+  });
+
+  describe("prepareWebAuthnCreationOptions", () => {
+    it("decodes challenge from base64url", () => {
+      const options = {
+        publicKey: {
+          challenge: "dGVzdC1jaGFsbGVuZ2U",
+          user: {
+            id: "dXNlci1pZA",
+            name: "[e-mail]",
+            displayName: "Test User",
+          },
+          excludeCredentials: [],
+          rp: { name: "Test" },
+          pubKeyCredParams: [{ type: "public-key", alg: -7 }],
+        },
+      };
+
+      const prepared = prepareWebAuthnCreationOptions(options);
+
+      expect(prepared.challenge).toBeInstanceOf(Uint8Array);
+      expect(new TextDecoder().decode(prepared.challenge as Uint8Array)).toBe(
+        "test-challenge",
+      );
+    });
+
+    it("decodes user.id from base64url", () => {
+      const options = {
+        publicKey: {
+          challenge: "Y2hhbGxlbmdl",
+          user: {
+            id: "dXNlci1pZA",
+            name: "[e-mail]",
+            displayName: "Test User",
+          },
+          excludeCredentials: [],
+          rp: { name: "Test" },
+          pubKeyCredParams: [{ type: "public-key", alg: -7 }],
+        },
+      };
+
+      const prepared = prepareWebAuthnCreationOptions(options);
+
+      expect(prepared.user?.id).toBeInstanceOf(Uint8Array);
+      expect(new TextDecoder().decode(prepared.user?.id as Uint8Array)).toBe(
+        "user-id",
+      );
+    });
+
+    it("decodes excludeCredentials ids from base64url", () => {
+      const options = {
+        publicKey: {
+          challenge: "Y2hhbGxlbmdl",
+          user: {
+            id: "dXNlcg",
+            name: "[e-mail]",
+            displayName: "Test User",
+          },
+          excludeCredentials: [
+            { id: "Y3JlZDE", type: "public-key" },
+            { id: "Y3JlZDI", type: "public-key" },
+          ],
+          rp: { name: "Test" },
+          pubKeyCredParams: [{ type: "public-key", alg: -7 }],
+        },
+      };
+
+      const prepared = prepareWebAuthnCreationOptions(options);
+
+      expect(prepared.excludeCredentials).toHaveLength(2);
+      expect(
+        new TextDecoder().decode(
+          prepared.excludeCredentials![0].id as Uint8Array,
+        ),
+      ).toBe("cred1");
+      expect(
+        new TextDecoder().decode(
+          prepared.excludeCredentials![1].id as Uint8Array,
+        ),
+      ).toBe("cred2");
+    });
+
+    it("handles empty excludeCredentials", () => {
+      const options = {
+        publicKey: {
+          challenge: "Y2hhbGxlbmdl",
+          user: {
+            id: "dXNlcg",
+            name: "[e-mail]",
+            displayName: "Test User",
+          },
+          rp: { name: "Test" },
+          pubKeyCredParams: [{ type: "public-key", alg: -7 }],
+        },
+      };
+
+      const prepared = prepareWebAuthnCreationOptions(options);
+
+      expect(prepared.excludeCredentials).toEqual([]);
+    });
+
+    it("preserves other user properties", () => {
+      const options = {
+        publicKey: {
+          challenge: "Y2hhbGxlbmdl",
+          user: {
+            id: "dXNlcg",
+            name: "[e-mail]",
+            displayName: "Test User",
+          },
+          excludeCredentials: [],
+          rp: { name: "Test" },
+          pubKeyCredParams: [{ type: "public-key", alg: -7 }],
+        },
+      };
+
+      const prepared = prepareWebAuthnCreationOptions(options);
+
+      expect(prepared.user?.name).toBe("[e-mail]");
+      expect(prepared.user?.displayName).toBe("Test User");
+    });
+  });
+});

frontend/src/tests/migration/storage.test.ts

···
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import {
+  clearMigrationState,
+  getResumeInfo,
+  hasPendingMigration,
+  loadMigrationState,
+  saveMigrationState,
+  setError,
+  updateProgress,
+  updateStep,
+} from "../../lib/migration/storage";
+import type {
+  InboundMigrationState,
+  OutboundMigrationState,
+} from "../../lib/migration/types";
+
+const STORAGE_KEY = "tranquil_migration_state";
+const DPOP_KEY_STORAGE = "migration_dpop_key";
+
+function createInboundState(
+  overrides?: Partial<InboundMigrationState>,
+): InboundMigrationState {
+  return {
+    direction: "inbound",
+    step: "welcome",
+    sourcePdsUrl: "https://bsky.social",
+    sourceDid: "did:plc:abc123",
+    sourceHandle: "alice.bsky.social",
+    targetHandle: "alice.example.com",
+    targetEmail: "[e-mail]",
+    targetPassword: "password123",
+    inviteCode: "",
+    sourceAccessToken: null,
+    sourceRefreshToken: null,
+    serviceAuthToken: null,
+    emailVerifyToken: "",
+    plcToken: "",
+    progress: {
+      repoExported: false,
+      repoImported: false,
+      blobsTotal: 0,
+      blobsMigrated: 0,
+      blobsFailed: [],
+      prefsMigrated: false,
+      plcSigned: false,
+      activated: false,
+      deactivated: false,
+      currentOperation: "",
+    },
+    error: null,
+    targetVerificationMethod: null,
+    authMethod: "password",
+    passkeySetupToken: null,
+    oauthCodeVerifier: null,
+    generatedAppPassword: null,
+    generatedAppPasswordName: null,
+    ...overrides,
+  };
+}
+
+function createOutboundState(
+  overrides?: Partial<OutboundMigrationState>,
+): OutboundMigrationState {
+  return {
+    direction: "outbound",
+    step: "welcome",
+    localDid: "did:plc:xyz789",
+    localHandle: "bob.example.com",
+    targetPdsUrl: "https://new-pds.com",
+    targetPdsDid: "did:web:new-pds.com",
+    targetHandle: "bob.new-pds.com",
+    targetEmail: "[e-mail]",
+    targetPassword: "password456",
+    inviteCode: "",
+    targetAccessToken: null,
+    targetRefreshToken: null,
+    serviceAuthToken: null,
+    plcToken: "",
+    progress: {
+      repoExported: false,
+      repoImported: false,
+      blobsTotal: 0,
+      blobsMigrated: 0,
+      blobsFailed: [],
+      prefsMigrated: false,
+      plcSigned: false,
+      activated: false,
+      deactivated: false,
+      currentOperation: "",
+    },
+    error: null,
+    targetServerInfo: null,
+    ...overrides,
+  };
+}
+
+describe("migration/storage", () => {
+  beforeEach(() => {
+    localStorage.removeItem(STORAGE_KEY);
+    localStorage.removeItem(DPOP_KEY_STORAGE);
+  });
+
+  describe("saveMigrationState", () => {
+    it("saves inbound migration state to localStorage", () => {
+      const state = createInboundState({
+        step: "migrating",
+        progress: {
+          repoExported: true,
+          repoImported: false,
+          blobsTotal: 10,
+          blobsMigrated: 5,
+          blobsFailed: [],
+          prefsMigrated: false,
+          plcSigned: false,
+          activated: false,
+          deactivated: false,
+          currentOperation: "Migrating blobs...",
+        },
+      });
+
+      saveMigrationState(state);
+
+      const stored = JSON.parse(localStorage.getItem(STORAGE_KEY)!);
+      expect(stored.version).toBe(1);
+      expect(stored.direction).toBe("inbound");
+      expect(stored.step).toBe("migrating");
+      expect(stored.sourcePdsUrl).toBe("https://bsky.social");
+      expect(stored.sourceDid).toBe("did:plc:abc123");
+      expect(stored.sourceHandle).toBe("alice.bsky.social");
+      expect(stored.targetHandle).toBe("alice.example.com");
+      expect(stored.targetEmail).toBe("[e-mail]");
+      expect(stored.progress.repoExported).toBe(true);
+      expect(stored.progress.blobsMigrated).toBe(5);
+      expect(stored.startedAt).toBeDefined();
+      expect(new Date(stored.startedAt).getTime()).not.toBeNaN();
+    });
+
+    it("saves outbound migration state to localStorage", () => {
+      const state = createOutboundState({
+        step: "review",
+      });
+
+      saveMigrationState(state);
+
+      const stored = JSON.parse(localStorage.getItem(STORAGE_KEY)!);
+      expect(stored.version).toBe(1);
+      expect(stored.direction).toBe("outbound");
+      expect(stored.step).toBe("review");
+      expect(stored.targetHandle).toBe("bob.new-pds.com");
+      expect(stored.targetEmail).toBe("[e-mail]");
+    });
+
+    it("saves authMethod for inbound migrations", () => {
+      const state = createInboundState({ authMethod: "passkey" });
+
+      saveMigrationState(state);
+
+      const stored = JSON.parse(localStorage.getItem(STORAGE_KEY)!);
+      expect(stored.authMethod).toBe("passkey");
+    });
+
+    it("saves passkeySetupToken when present", () => {
+      const state = createInboundState({
+        authMethod: "passkey",
+        passkeySetupToken: "setup-token-123",
+      });
+
+      saveMigrationState(state);
+
+      const stored = JSON.parse(localStorage.getItem(STORAGE_KEY)!);
+      expect(stored.passkeySetupToken).toBe("setup-token-123");
+    });
+
+    it("saves error information", () => {
+      const state = createInboundState({
+        step: "error",
+        error: "Connection failed",
+      });
+
+      saveMigrationState(state);
+
+      const stored = JSON.parse(localStorage.getItem(STORAGE_KEY)!);
+      expect(stored.lastError).toBe("Connection failed");
+      expect(stored.lastErrorStep).toBe("error");
+    });
+  });
+
+  describe("loadMigrationState", () => {
+    it("returns null when no state is stored", () => {
+      expect(loadMigrationState()).toBeNull();
+    });
+
+    it("loads valid migration state", () => {
+      const state = createInboundState({ step: "migrating" });
+      saveMigrationState(state);
+
+      const loaded = loadMigrationState();
+
+      expect(loaded).not.toBeNull();
+      expect(loaded!.direction).toBe("inbound");
+      expect(loaded!.step).toBe("migrating");
+      expect(loaded!.sourceHandle).toBe("alice.bsky.social");
+    });
+
+    it("clears and returns null for incompatible version", () => {
+      localStorage.setItem(
+        STORAGE_KEY,
+        JSON.stringify({
+          version: 999,
+          direction: "inbound",
+          step: "welcome",
+        }),
+      );
+
+      const loaded = loadMigrationState();
+
+      expect(loaded).toBeNull();
+      expect(localStorage.getItem(STORAGE_KEY)).toBeNull();
+    });
+
+    it("clears and returns null for expired state (> 24 hours)", () => {
+      const expiredState = {
+        version: 1,
+        direction: "inbound",
+        step: "welcome",
+        startedAt: new Date(Date.now() - 25 * 60 * 60 * 1000).toISOString(),
+        sourcePdsUrl: "https://bsky.social",
+        targetPdsUrl: "http://localhost:3000",
+        sourceDid: "did:plc:abc123",
+        sourceHandle: "alice.bsky.social",
+        targetHandle: "alice.example.com",
+        targetEmail: "[e-mail]",
+        progress: {
+          repoExported: false,
+          repoImported: false,
+          blobsTotal: 0,
+          blobsMigrated: 0,
+          prefsMigrated: false,
+          plcSigned: false,
+        },
+      };
+      localStorage.setItem(STORAGE_KEY, JSON.stringify(expiredState));
+
+      const loaded = loadMigrationState();
+
+      expect(loaded).toBeNull();
+      expect(localStorage.getItem(STORAGE_KEY)).toBeNull();
+    });
+
+    it("returns state that is not yet expired (< 24 hours)", () => {
+      const recentState = {
+        version: 1,
+        direction: "inbound",
+        step: "review",
+        startedAt: new Date(Date.now() - 23 * 60 * 60 * 1000).toISOString(),
+        sourcePdsUrl: "https://bsky.social",
+        targetPdsUrl: "http://localhost:3000",
+        sourceDid: "did:plc:abc123",
+        sourceHandle: "alice.bsky.social",
+        targetHandle: "alice.example.com",
+        targetEmail: "[e-mail]",
+        progress: {
+          repoExported: false,
+          repoImported: false,
+          blobsTotal: 0,
+          blobsMigrated: 0,
+          prefsMigrated: false,
+          plcSigned: false,
+        },
+      };
+      localStorage.setItem(STORAGE_KEY, JSON.stringify(recentState));
+
+      const loaded = loadMigrationState();
+
+      expect(loaded).not.toBeNull();
+      expect(loaded!.step).toBe("review");
+    });
+
+    it("clears and returns null for invalid JSON", () => {
+      localStorage.setItem(STORAGE_KEY, "not-valid-json");
+
+      const loaded = loadMigrationState();
+
+      expect(loaded).toBeNull();
+      expect(localStorage.getItem(STORAGE_KEY)).toBeNull();
+    });
+  });
+
+  describe("clearMigrationState", () => {
+    it("removes migration state from localStorage", () => {
+      const state = createInboundState();
+      saveMigrationState(state);
+      expect(localStorage.getItem(STORAGE_KEY)).not.toBeNull();
+
+      clearMigrationState();
+
+      expect(localStorage.getItem(STORAGE_KEY)).toBeNull();
+    });
+
+    it("also removes DPoP key", () => {
+      localStorage.setItem(DPOP_KEY_STORAGE, "some-dpop-key");
+      const state = createInboundState();
+      saveMigrationState(state);
+
+      clearMigrationState();
+
+      expect(localStorage.getItem(DPOP_KEY_STORAGE)).toBeNull();
+    });
+
+    it("does not throw when nothing to clear", () => {
+      expect(() => clearMigrationState()).not.toThrow();
+    });
+  });
+
+  describe("hasPendingMigration", () => {
+    it("returns false when no migration state exists", () => {
+      expect(hasPendingMigration()).toBe(false);
+    });
+
+    it("returns true when valid migration state exists", () => {
+      const state = createInboundState();
+      saveMigrationState(state);
+
+      expect(hasPendingMigration()).toBe(true);
+    });
+
+    it("returns false when state is expired", () => {
+      const expiredState = {
+        version: 1,
+        direction: "inbound",
+        step: "welcome",
+        startedAt: new Date(Date.now() - 25 * 60 * 60 * 1000).toISOString(),
+        sourcePdsUrl: "https://bsky.social",
+        targetPdsUrl: "http://localhost:3000",
+        sourceDid: "did:plc:abc123",
+        sourceHandle: "alice.bsky.social",
+        targetHandle: "alice.example.com",
+        targetEmail: "[e-mail]",
+        progress: {
+          repoExported: false,
+          repoImported: false,
+          blobsTotal: 0,
+          blobsMigrated: 0,
+          prefsMigrated: false,
+          plcSigned: false,
+        },
+      };
+      localStorage.setItem(STORAGE_KEY, JSON.stringify(expiredState));
+
+      expect(hasPendingMigration()).toBe(false);
+    });
+  });
+
+  describe("getResumeInfo", () => {
+    it("returns null when no migration state exists", () => {
+      expect(getResumeInfo()).toBeNull();
+    });
+
+    it("returns resume info for inbound migration", () => {
+      const state = createInboundState({
+        step: "migrating",
+        progress: {
+          repoExported: true,
+          repoImported: true,
+          blobsTotal: 10,
+          blobsMigrated: 5,
+          blobsFailed: [],
+          prefsMigrated: false,
+          plcSigned: false,
+          activated: false,
+          deactivated: false,
+          currentOperation: "",
+        },
+      });
+      saveMigrationState(state);
+
+      const info = getResumeInfo();
+
+      expect(info).not.toBeNull();
+      expect(info!.direction).toBe("inbound");
+      expect(info!.sourceHandle).toBe("alice.bsky.social");
+      expect(info!.targetHandle).toBe("alice.example.com");
+      expect(info!.progressSummary).toContain("repo exported");
+      expect(info!.progressSummary).toContain("repo imported");
+      expect(info!.progressSummary).toContain("5/10 blobs");
+    });
+
+    it("returns 'just started' when no progress made", () => {
+      const state = createInboundState({ step: "welcome" });
+      saveMigrationState(state);
+
+      const info = getResumeInfo();
+
+      expect(info!.progressSummary).toBe("just started");
+    });
+
+    it("includes authMethod for inbound migrations", () => {
+      const state = createInboundState({ authMethod: "passkey" });
+      saveMigrationState(state);
+
+      const info = getResumeInfo();
+
+      expect(info!.authMethod).toBe("passkey");
+    });
+
+    it("includes all completed progress items", () => {
+      const state = createInboundState({
+        step: "finalizing",
+        progress: {
+          repoExported: true,
+          repoImported: true,
+          blobsTotal: 10,
+          blobsMigrated: 10,
+          blobsFailed: [],
+          prefsMigrated: true,
+          plcSigned: true,
+          activated: false,
+          deactivated: false,
+          currentOperation: "",
+        },
+      });
+      saveMigrationState(state);
+
+      const info = getResumeInfo();
+
+      expect(info!.progressSummary).toContain("repo exported");
+      expect(info!.progressSummary).toContain("repo imported");
+      expect(info!.progressSummary).toContain("preferences migrated");
+      expect(info!.progressSummary).toContain("PLC signed");
+    });
+  });
+
+  describe("updateProgress", () => {
+    it("updates progress fields in stored state", () => {
+      const state = createInboundState();
+      saveMigrationState(state);
+
+      updateProgress({ repoExported: true, blobsTotal: 50 });
+
+      const loaded = loadMigrationState();
+      expect(loaded!.progress.repoExported).toBe(true);
+      expect(loaded!.progress.blobsTotal).toBe(50);
+    });
+
+    it("preserves other progress fields", () => {
+      const state = createInboundState({
+        progress: {
+          repoExported: true,
+          repoImported: false,
+          blobsTotal: 10,
+          blobsMigrated: 0,
+          blobsFailed: [],
+          prefsMigrated: false,
+          plcSigned: false,
+          activated: false,
+          deactivated: false,
+          currentOperation: "",
+        },
+      });
+      saveMigrationState(state);
+
+      updateProgress({ repoImported: true });
+
+      const loaded = loadMigrationState();
+      expect(loaded!.progress.repoExported).toBe(true);
+      expect(loaded!.progress.repoImported).toBe(true);
+    });
+
+    it("does nothing when no state exists", () => {
+      expect(() => updateProgress({ repoExported: true })).not.toThrow();
+      expect(localStorage.getItem(STORAGE_KEY)).toBeNull();
+    });
+  });
+
+  describe("updateStep", () => {
+    it("updates step in stored state", () => {
+      const state = createInboundState({ step: "welcome" });
+      saveMigrationState(state);
+
+      updateStep("migrating");
+
+      const loaded = loadMigrationState();
+      expect(loaded!.step).toBe("migrating");
+    });
+
+    it("does nothing when no state exists", () => {
+      expect(() => updateStep("migrating")).not.toThrow();
+      expect(localStorage.getItem(STORAGE_KEY)).toBeNull();
+    });
+  });
+
+  describe("setError", () => {
+    it("sets error and errorStep in stored state", () => {
+      const state = createInboundState({ step: "migrating" });
+      saveMigrationState(state);
+
+      setError("Connection timeout", "migrating");
+
+      const loaded = loadMigrationState();
+      expect(loaded!.lastError).toBe("Connection timeout");
+      expect(loaded!.lastErrorStep).toBe("migrating");
+    });
+
+    it("does nothing when no state exists", () => {
+      expect(() => setError("Error message", "welcome")).not.toThrow();
+      expect(localStorage.getItem(STORAGE_KEY)).toBeNull();
+    });
+  });
+});

frontend/src/tests/migration/types.test.ts

···
+import { describe, expect, it } from "vitest";
+import { MigrationError } from "../../lib/migration/types";
+
+describe("migration/types", () => {
+  describe("MigrationError", () => {
+    it("creates error with message and code", () => {
+      const error = new MigrationError("Something went wrong", "ERR_NETWORK");
+
+      expect(error.message).toBe("Something went wrong");
+      expect(error.code).toBe("ERR_NETWORK");
+      expect(error.name).toBe("MigrationError");
+    });
+
+    it("defaults recoverable to false", () => {
+      const error = new MigrationError("Error", "ERR_CODE");
+
+      expect(error.recoverable).toBe(false);
+    });
+
+    it("accepts recoverable flag", () => {
+      const error = new MigrationError("Temporary error", "ERR_TIMEOUT", true);
+
+      expect(error.recoverable).toBe(true);
+    });
+
+    it("accepts details object", () => {
+      const details = { status: 500, endpoint: "/api/test" };
+      const error = new MigrationError(
+        "Server error",
+        "ERR_SERVER",
+        false,
+        details,
+      );
+
+      expect(error.details).toEqual(details);
+    });
+
+    it("is instanceof Error", () => {
+      const error = new MigrationError("Test", "ERR_TEST");
+
+      expect(error).toBeInstanceOf(Error);
+      expect(error).toBeInstanceOf(MigrationError);
+    });
+
+    it("has proper stack trace", () => {
+      const error = new MigrationError("Test", "ERR_TEST");
+
+      expect(error.stack).toBeDefined();
+      expect(error.stack).toContain("MigrationError");
+    });
+
+    it("can be caught as Error", () => {
+      let caught: Error | null = null;
+
+      try {
+        throw new MigrationError("Test error", "ERR_TEST");
+      } catch (e) {
+        caught = e as Error;
+      }
+
+      expect(caught).not.toBeNull();
+      expect(caught!.message).toBe("Test error");
+    });
+
+    it("can check if error is MigrationError", () => {
+      const error = new MigrationError("Test", "ERR_TEST", true, { foo: "bar" });
+
+      if (error instanceof MigrationError) {
+        expect(error.code).toBe("ERR_TEST");
+        expect(error.recoverable).toBe(true);
+        expect(error.details).toEqual({ foo: "bar" });
+      }
+    });
+  });
+});

frontend/src/tests/mocks.ts

···
   return match ? match[1] : url;
 }
 export function setupFetchMock(): void {
-  global.fetch = vi.fn(
+  globalThis.fetch = vi.fn(
     async (input: RequestInfo | URL, init?: RequestInit): Promise<Response> => {
       const url = typeof input === "string" ? input : input.toString();
       const endpoint = extractEndpoint(url);
···
     signalVerified: false,
     ...overrides,
   }),
-  describeServer: () => ({
+  describeServer: (overrides?: Record<string, unknown>) => ({
     availableUserDomains: ["test.tranquil.dev"],
     inviteCodeRequired: false,
     links: {
···
       termsOfService: "https://example.com/tos",
     },
     selfHostedDidWebEnabled: true,
+    availableCommsChannels: ["email", "discord", "telegram", "signal"],
+    ...overrides,
   }),
   describeRepo: (did: string) => ({
     handle: "testuser.test.tranquil.dev",
···
   mockEndpoint(
     "com.tranquil.account.updateNotificationPrefs",
     () => jsonResponse({ success: true }),
+  );
+  mockEndpoint(
+    "com.tranquil.account.getNotificationHistory",
+    () => jsonResponse({ notifications: [] }),
   );
   mockEndpoint(
     "com.atproto.server.requestEmailUpdate",

frontend/src/tests/setup.ts

···
 import "@testing-library/jest-dom/vitest";
 import { afterEach, beforeEach, vi } from "vitest";
-import { _testReset } from "../lib/auth.svelte";
+import { init, register, waitLocale } from "svelte-i18n";
+import { _testResetState } from "../lib/auth.svelte";
+
+register("en", () => import("../locales/en.json"));
+
+init({
+  fallbackLocale: "en",
+  initialLocale: "en",
+});
 
 let locationHash = "";
 
···
   configurable: true,
 });
 
-beforeEach(() => {
+beforeEach(async () => {
   vi.clearAllMocks();
-  localStorage.clear();
-  sessionStorage.clear();
   locationHash = "";
-  _testReset();
+  _testResetState();
+  await waitLocale();
 });
 
 afterEach(() => {

frontend/svelte.config.js

···
+import process from "node:process";
 import { vitePreprocess } from "@sveltejs/vite-plugin-svelte";
 const isTest = process.env.VITEST === "true" || process.env.VITEST === true;
 export default {

frontend/vite.config.ts

···
+import process from "node:process";
 import { defineConfig, loadEnv } from "vite";
 import { svelte } from "@sveltejs/vite-plugin-svelte";
 

src/api/actor/preferences.rs

···
             serde_json::from_value(row.value_json).ok()
         })
         .collect();
-    if let Some(ref pref) = personal_details_pref {
-        if let Some(birth_date) = pref.get("birthDate").and_then(|v| v.as_str()) {
-            if let Some(age) = get_age_from_datestring(birth_date) {
-                let declared_age_pref = json!({
-                    "$type": DECLARED_AGE_PREF,
-                    "isOverAge13": age >= 13,
-                    "isOverAge16": age >= 16,
-                    "isOverAge18": age >= 18,
-                });
-                preferences.push(declared_age_pref);
-            }
-        }
+    if let Some(age) = personal_details_pref
+        .as_ref()
+        .and_then(|pref| pref.get("birthDate"))
+        .and_then(|v| v.as_str())
+        .and_then(get_age_from_datestring)
+    {
+        let declared_age_pref = json!({
+            "$type": DECLARED_AGE_PREF,
+            "isOverAge13": age >= 13,
+            "isOverAge16": age >= 16,
+            "isOverAge18": age >= 18,
+        });
+        preferences.push(declared_age_pref);
     }
     (StatusCode::OK, Json(GetPreferencesOutput { preferences })).into_response()
 }
···
             }
         };
     let has_full_access = auth_user.permissions().has_full_access();
-    let user_id: uuid::Uuid = match sqlx::query_scalar!(
-        "SELECT id FROM users WHERE did = $1",
-        auth_user.did
-    )
-    .fetch_optional(&state.db)
-    .await
-    {
-        Ok(Some(id)) => id,
-        _ => {
-            return (
-                StatusCode::INTERNAL_SERVER_ERROR,
-                Json(json!({"error": "InternalError", "message": "User not found"})),
-            )
-                .into_response();
-        }
-    };
+    let user_id: uuid::Uuid =
+        match sqlx::query_scalar!("SELECT id FROM users WHERE did = $1", auth_user.did)
+            .fetch_optional(&state.db)
+            .await
+        {
+            Ok(Some(id)) => id,
+            _ => {
+                return (
+                    StatusCode::INTERNAL_SERVER_ERROR,
+                    Json(json!({"error": "InternalError", "message": "User not found"})),
+                )
+                    .into_response();
+            }
+        };
     if input.preferences.len() > MAX_PREFERENCES_COUNT {
         return (
             StatusCode::BAD_REQUEST,

src/api/admin/account/info.rs

···
     }
 }
 
-async fn get_invited_by(
-    db: &sqlx::PgPool,
-    user_id: uuid::Uuid,
-) -> Option<InviteCodeInfo> {
+async fn get_invited_by(db: &sqlx::PgPool, user_id: uuid::Uuid) -> Option<InviteCodeInfo> {
     let use_row = sqlx::query!(
         r#"
         SELECT icu.code

src/api/admin/account/search.rs

···
                 .into_iter()
                 .take(limit as usize)
                 .map(
-                    |(did, handle, email, created_at, email_verified, deactivated_at, invites_disabled)| {
+                    |(
+                        did,
+                        handle,
+                        email,
+                        created_at,
+                        email_verified,
+                        deactivated_at,
+                        invites_disabled,
+                    )| {
                         AccountView {
                             did: did.clone(),
                             handle,

src/api/admin/account/update.rs

···
             if let Err(e) =
                 crate::api::repo::record::sequence_identity_event(&state, did, Some(&handle)).await
             {
-                warn!("Failed to sequence identity event for admin handle update: {}", e);
+                warn!(
+                    "Failed to sequence identity event for admin handle update: {}",
+                    e
+                );
             }
             if let Err(e) = crate::api::identity::did::update_plc_handle(&state, did, &handle).await
             {

src/api/identity/account.rs

···
         {
             warn!("Failed to sequence account event for {}: {}", did, e);
         }
-        if let Err(e) =
-            crate::api::repo::record::sequence_genesis_commit(&state, &did, &commit_cid, &mst_root, &rev_str).await
+        if let Err(e) = crate::api::repo::record::sequence_genesis_commit(
+            &state,
+            &did,
+            &commit_cid,
+            &mst_root,
+            &rev_str,
+        )
+        .await
         {
             warn!("Failed to sequence commit event for {}: {}", did, e);
         }
···
     )
         .into_response()
 }
-

src/api/identity/did.rs

···
 
     let service_endpoint = migrated_to_pds.unwrap_or_else(|| format!("https://{}", hostname));
 
-    if let Some(ref ovr) = overrides {
-        if let Ok(parsed) =
-            serde_json::from_value::<Vec<DidWebVerificationMethod>>(ovr.verification_methods.clone())
-        {
-            if !parsed.is_empty() {
-                let also_known_as = if !ovr.also_known_as.is_empty() {
-                    ovr.also_known_as.clone()
-                } else {
-                    vec![format!("at://{}", full_handle)]
-                };
+    if let Some((ovr, parsed)) = overrides.as_ref().and_then(|ovr| {
+        serde_json::from_value::<Vec<DidWebVerificationMethod>>(ovr.verification_methods.clone())
+            .ok()
+            .filter(|p| !p.is_empty())
+            .map(|p| (ovr, p))
+    }) {
+        let also_known_as = if !ovr.also_known_as.is_empty() {
+            ovr.also_known_as.clone()
+        } else {
+            vec![format!("at://{}", full_handle)]
+        };
 
-                return Json(json!({
-                    "@context": [
-                        "https://www.w3.org/ns/did/v1",
-                        "https://w3id.org/security/multikey/v1",
-                        "https://w3id.org/security/suites/secp256k1-2019/v1"
-                    ],
-                    "id": did,
-                    "alsoKnownAs": also_known_as,
-                    "verificationMethod": parsed.iter().map(|m| json!({
-                        "id": format!("{}{}", did, if m.id.starts_with('#') { m.id.clone() } else { format!("#{}", m.id) }),
-                        "type": m.method_type,
-                        "controller": did,
-                        "publicKeyMultibase": m.public_key_multibase
-                    })).collect::<Vec<_>>(),
-                    "service": [{
-                        "id": "#atproto_pds",
-                        "type": "AtprotoPersonalDataServer",
-                        "serviceEndpoint": service_endpoint
-                    }]
-                }))
-                .into_response();
-            }
-        }
+        return Json(json!({
+            "@context": [
+                "https://www.w3.org/ns/did/v1",
+                "https://w3id.org/security/multikey/v1",
+                "https://w3id.org/security/suites/secp256k1-2019/v1"
+            ],
+            "id": did,
+            "alsoKnownAs": also_known_as,
+            "verificationMethod": parsed.iter().map(|m| json!({
+                "id": format!("{}{}", did, if m.id.starts_with('#') { m.id.clone() } else { format!("#{}", m.id) }),
+                "type": m.method_type,
+                "controller": did,
+                "publicKeyMultibase": m.public_key_multibase
+            })).collect::<Vec<_>>(),
+            "service": [{
+                "id": "#atproto_pds",
+                "type": "AtprotoPersonalDataServer",
+                "serviceEndpoint": service_endpoint
+            }]
+        }))
+        .into_response();
     }
 
     let key_row = sqlx::query!(
···
 
     let service_endpoint = migrated_to_pds.unwrap_or_else(|| format!("https://{}", hostname));
 
-    if let Some(ref ovr) = overrides {
-        if let Ok(parsed) =
-            serde_json::from_value::<Vec<DidWebVerificationMethod>>(ovr.verification_methods.clone())
-        {
-            if !parsed.is_empty() {
-                let also_known_as = if !ovr.also_known_as.is_empty() {
-                    ovr.also_known_as.clone()
-                } else {
-                    vec![format!("at://{}", full_handle)]
-                };
+    if let Some((ovr, parsed)) = overrides.as_ref().and_then(|ovr| {
+        serde_json::from_value::<Vec<DidWebVerificationMethod>>(ovr.verification_methods.clone())
+            .ok()
+            .filter(|p| !p.is_empty())
+            .map(|p| (ovr, p))
+    }) {
+        let also_known_as = if !ovr.also_known_as.is_empty() {
+            ovr.also_known_as.clone()
+        } else {
+            vec![format!("at://{}", full_handle)]
+        };
 
-                return Json(json!({
-                    "@context": [
-                        "https://www.w3.org/ns/did/v1",
-                        "https://w3id.org/security/multikey/v1",
-                        "https://w3id.org/security/suites/secp256k1-2019/v1"
-                    ],
-                    "id": did,
-                    "alsoKnownAs": also_known_as,
-                    "verificationMethod": parsed.iter().map(|m| json!({
-                        "id": format!("{}{}", did, if m.id.starts_with('#') { m.id.clone() } else { format!("#{}", m.id) }),
-                        "type": m.method_type,
-                        "controller": did,
-                        "publicKeyMultibase": m.public_key_multibase
-                    })).collect::<Vec<_>>(),
-                    "service": [{
-                        "id": "#atproto_pds",
-                        "type": "AtprotoPersonalDataServer",
-                        "serviceEndpoint": service_endpoint
-                    }]
-                }))
-                .into_response();
-            }
-        }
+        return Json(json!({
+            "@context": [
+                "https://www.w3.org/ns/did/v1",
+                "https://w3id.org/security/multikey/v1",
+                "https://w3id.org/security/suites/secp256k1-2019/v1"
+            ],
+            "id": did,
+            "alsoKnownAs": also_known_as,
+            "verificationMethod": parsed.iter().map(|m| json!({
+                "id": format!("{}{}", did, if m.id.starts_with('#') { m.id.clone() } else { format!("#{}", m.id) }),
+                "type": m.method_type,
+                "controller": did,
+                "publicKeyMultibase": m.public_key_multibase
+            })).collect::<Vec<_>>(),
+            "service": [{
+                "id": "#atproto_pds",
+                "type": "AtprotoPersonalDataServer",
+                "serviceEndpoint": service_endpoint
+            }]
+        }))
+        .into_response();
     }
 
     let key_row = sqlx::query!(
···
         let server_rotation_key = match std::env::var("PLC_ROTATION_KEY") {
             Ok(key) => key,
             Err(_) => {
-                warn!("PLC_ROTATION_KEY not set, falling back to user's signing key for rotation key recommendation");
+                warn!(
+                    "PLC_ROTATION_KEY not set, falling back to user's signing key for rotation key recommendation"
+                );
                 did_key.clone()
             }
         };
···
         )
             .into_response();
     }
-    let user_row = match sqlx::query!(
-        "SELECT id, handle FROM users WHERE did = $1",
-        did
-    )
-    .fetch_optional(&state.db)
-    .await
+    let user_row = match sqlx::query!("SELECT id, handle FROM users WHERE did = $1", did)
+        .fetch_optional(&state.db)
+        .await
     {
         Ok(Some(row)) => row,
         _ => return ApiError::InternalError.into_response(),
···
     match result {
         Ok(_) => {
             if !current_handle.is_empty() {
-                let _ = state.cache.delete(&format!("handle:{}", current_handle)).await;
+                let _ = state
+                    .cache
+                    .delete(&format!("handle:{}", current_handle))
+                    .await;
             }
             let _ = state.cache.delete(&format!("handle:{}", handle)).await;
             if let Err(e) =

src/api/identity/plc/submit.rs

···
     let op = &input.operation;
     let hostname = std::env::var("PDS_HOSTNAME").unwrap_or_else(|_| "localhost".to_string());
     let public_url = format!("https://{}", hostname);
-    let user = match sqlx::query!(
-        "SELECT id, handle FROM users WHERE did = $1",
-        did
-    )
-    .fetch_optional(&state.db)
-    .await
+    let user = match sqlx::query!("SELECT id, handle FROM users WHERE did = $1", did)
+        .fetch_optional(&state.db)
+        .await
     {
         Ok(Some(row)) => row,
         _ => {
···
         )
             .into_response();
     }
-    if !user.handle.is_empty() {
-        if let Some(also_known_as) = op.get("alsoKnownAs").and_then(|v| v.as_array()) {
-            let expected_handle = format!("at://{}", user.handle);
-            let first_aka = also_known_as.first().and_then(|v| v.as_str());
-            if first_aka != Some(&expected_handle) {
-                return (
-                    StatusCode::BAD_REQUEST,
-                    Json(json!({
-                        "error": "InvalidRequest",
-                        "message": "Incorrect handle in alsoKnownAs"
-                    })),
-                )
-                    .into_response();
-            }
+    if let Some(also_known_as) = (!user.handle.is_empty())
+        .then(|| op.get("alsoKnownAs").and_then(|v| v.as_array()))
+        .flatten()
+    {
+        let expected_handle = format!("at://{}", user.handle);
+        let first_aka = also_known_as.first().and_then(|v| v.as_str());
+        if first_aka != Some(&expected_handle) {
+            return (
+                StatusCode::BAD_REQUEST,
+                Json(json!({
+                    "error": "InvalidRequest",
+                    "message": "Incorrect handle in alsoKnownAs"
+                })),
+            )
+                .into_response();
         }
     }
     let plc_client = PlcClient::new(None);

src/api/moderation/mod.rs

···
         None => return ApiError::AuthenticationRequired.into_response(),
     };
 
-    let auth_user = match crate::auth::validate_bearer_token_allow_takendown(&state.db, &token).await
-    {
-        Ok(user) => user,
-        Err(e) => return ApiError::from(e).into_response(),
-    };
+    let auth_user =
+        match crate::auth::validate_bearer_token_allow_takendown(&state.db, &token).await {
+            Ok(user) => user,
+            Err(e) => return ApiError::from(e).into_response(),
+        };
 
     let did = &auth_user.did;
 
     if let Some((service_url, service_did)) = get_report_service_config() {
-        return proxy_to_report_service(
-            &state,
-            &auth_user,
-            &service_url,
-            &service_did,
-            &input,
-        )
-        .await;
+        return proxy_to_report_service(&state, &auth_user, &service_url, &service_did, &input)
+            .await;
     }
 
     create_report_locally(&state, did, auth_user.is_takendown, input).await

src/api/repo/import.rs

···
                 }
             }
             if blob_ref_count > 0 {
-                info!("Recorded {} blob references for imported repo", blob_ref_count);
+                info!(
+                    "Recorded {} blob references for imported repo",
+                    blob_ref_count
+                );
             }
             let key_row = match sqlx::query!(
                 r#"SELECT uk.key_bytes, uk.encryption_version

src/api/repo/record/batch.rs

···
 use super::validation::validate_record_with_status;
 use super::write::has_verified_comms_channel;
-use crate::validation::ValidationStatus;
 use crate::api::repo::record::utils::{CommitParams, RecordOp, commit_and_log, extract_blob_cids};
 use crate::delegation::{self, DelegationActionType};
 use crate::repo::tracking::TrackingBlockStore;
 use crate::state::AppState;
+use crate::validation::ValidationStatus;
 use axum::{
     Json,
     extract::State,

src/api/repo/record/delete.rs

···
     }
     let prev_record_cid = mst.get(&key).await.ok().flatten();
     if prev_record_cid.is_none() {
-        return (
-            StatusCode::OK,
-            Json(DeleteRecordOutput { commit: None }),
-        )
-            .into_response();
+        return (StatusCode::OK, Json(DeleteRecordOutput { commit: None })).into_response();
     }
     let new_mst = match mst.delete(&key).await {
         Ok(m) => m,

src/api/repo/record/write.rs

···
 use super::validation::validate_record_with_status;
-use crate::validation::ValidationStatus;
 use crate::api::repo::record::utils::{CommitParams, RecordOp, commit_and_log, extract_blob_cids};
 use crate::delegation::{self, DelegationActionType};
 use crate::repo::tracking::TrackingBlockStore;
 use crate::state::AppState;
+use crate::validation::ValidationStatus;
 use axum::{
     Json,
     extract::State,

src/api/server/account_status.rs

···
         Ok(Some(row)) => (row.repo_root_cid, row.repo_rev),
         _ => (String::new(), None),
     };
-    let block_count: i64 =
-        sqlx::query_scalar!("SELECT COUNT(*) FROM user_blocks WHERE user_id = $1", user_id)
-            .fetch_one(&state.db)
-            .await
-            .unwrap_or(Some(0))
-            .unwrap_or(0);
+    let block_count: i64 = sqlx::query_scalar!(
+        "SELECT COUNT(*) FROM user_blocks WHERE user_id = $1",
+        user_id
+    )
+    .fetch_one(&state.db)
+    .await
+    .unwrap_or(Some(0))
+    .unwrap_or(0);
     let repo_rev = if let Some(rev) = repo_rev_from_db {
         rev
     } else if !repo_commit.is_empty() {
···
             let rotation_keys = doc_data
                 .get("rotationKeys")
                 .and_then(|v| v.as_array())
-                .map(|arr| {
-                    arr.iter()
-                        .filter_map(|k| k.as_str())
-                        .collect::<Vec<_>>()
-                })
+                .map(|arr| arr.iter().filter_map(|k| k.as_str()).collect::<Vec<_>>())
                 .unwrap_or_default();
             if !rotation_keys.contains(&expected_rotation_key.as_str()) {
                 return Err((
···
         did
     );
     let did_validation_start = std::time::Instant::now();
-    if let Err((status, json)) = assert_valid_did_document_for_service(&state.db, &did, true).await {
+    if let Err((status, json)) = assert_valid_did_document_for_service(&state.db, &did, true).await
+    {
         info!(
             "[MIGRATION] activateAccount: DID document validation FAILED for {} (took {:?})",
             did,

src/api/server/email.rs

···
             "email_update",
             &current_email.to_lowercase(),
         );
-        let formatted_code =
-            crate::auth::verification_token::format_token_for_display(&code);
+        let formatted_code = crate::auth::verification_token::format_token_for_display(&code);
 
-        let hostname =
-            std::env::var("PDS_HOSTNAME").unwrap_or_else(|_| "localhost".to_string());
-        if let Err(e) = crate::comms::enqueue_email_update_token(
-            &state.db,
-            user.id,
-            &formatted_code,
-            &hostname,
-        )
-        .await
+        let hostname = std::env::var("PDS_HOSTNAME").unwrap_or_else(|_| "localhost".to_string());
+        if let Err(e) =
+            crate::comms::enqueue_email_update_token(&state.db, user.id, &formatted_code, &hostname)
+                .await
         {
             warn!("Failed to enqueue email update notification: {:?}", e);
         }
     }
 
     info!("Email update requested for user {}", user.id);
-    (StatusCode::OK, Json(json!({ "tokenRequired": token_required }))).into_response()
+    (
+        StatusCode::OK,
+        Json(json!({ "tokenRequired": token_required })),
+    )
+        .into_response()
 }
 
 #[derive(Deserialize)]

src/api/server/invite.rs

···
 use crate::api::ApiError;
-use crate::auth::extractor::BearerAuthAdmin;
 use crate::auth::BearerAuth;
+use crate::auth::extractor::BearerAuthAdmin;
 use crate::state::AppState;
 use axum::{
     Json,
···
         .filter(|v| !v.is_empty())
         .unwrap_or_else(|| vec![auth_user.did.clone()]);
 
-    let admin_user_id = match sqlx::query_scalar!(
-        "SELECT id FROM users WHERE is_admin = true LIMIT 1"
-    )
-    .fetch_optional(&state.db)
-    .await
-    {
-        Ok(Some(id)) => id,
-        Ok(None) => {
-            error!("No admin user found to create invite codes");
-            return ApiError::InternalError.into_response();
-        }
-        Err(e) => {
-            error!("DB error looking up admin user: {:?}", e);
-            return ApiError::InternalError.into_response();
-        }
-    };
+    let admin_user_id =
+        match sqlx::query_scalar!("SELECT id FROM users WHERE is_admin = true LIMIT 1")
+            .fetch_optional(&state.db)
+            .await
+        {
+            Ok(Some(id)) => id,
+            Ok(None) => {
+                error!("No admin user found to create invite codes");
+                return ApiError::InternalError.into_response();
+            }
+            Err(e) => {
+                error!("DB error looking up admin user: {:?}", e);
+                return ApiError::InternalError.into_response();
+            }
+        };
 
     let mut result_codes = Vec::new();
 

src/api/server/migration.rs

···
 
     if let Some(ref methods) = input.verification_methods {
         if methods.is_empty() {
-            return ApiError::InvalidRequest(
-                "verification_methods cannot be empty".into(),
-            )
-            .into_response();
+            return ApiError::InvalidRequest("verification_methods cannot be empty".into())
+                .into_response();
         }
         for method in methods {
             if method.id.is_empty() {
···
     if let Some(ref handles) = input.also_known_as {
         for handle in handles {
             if !handle.starts_with("at://") {
-                return ApiError::InvalidRequest(
-                    "alsoKnownAs entries must be at:// URIs".into(),
-                )
-                .into_response();
+                return ApiError::InvalidRequest("alsoKnownAs entries must be at:// URIs".into())
+                    .into_response();
             }
         }
     }
···
     if let Some(ref endpoint) = input.service_endpoint {
         let endpoint = endpoint.trim();
         if !endpoint.starts_with("https://") {
-            return ApiError::InvalidRequest(
-                "serviceEndpoint must start with https://".into(),
-            )
-            .into_response();
+            return ApiError::InvalidRequest("serviceEndpoint must start with https://".into())
+                .into_response();
         }
     }
 
···
         .migrated_to_pds
         .unwrap_or_else(|| format!("https://{}", hostname));
 
-    if let Some(ref ovr) = overrides {
-        if let Ok(parsed) = serde_json::from_value::<Vec<VerificationMethod>>(ovr.verification_methods.clone()) {
-            if !parsed.is_empty() {
-                let also_known_as = if !ovr.also_known_as.is_empty() {
-                    ovr.also_known_as.clone()
-                } else {
-                    vec![format!("at://{}", user.handle)]
-                };
-                return json!({
-                    "@context": [
-                        "https://www.w3.org/ns/did/v1",
-                        "https://w3id.org/security/multikey/v1",
-                        "https://w3id.org/security/suites/secp256k1-2019/v1"
-                    ],
-                    "id": did,
-                    "alsoKnownAs": also_known_as,
-                    "verificationMethod": parsed.iter().map(|m| json!({
-                        "id": format!("{}{}", did, if m.id.starts_with('#') { m.id.clone() } else { format!("#{}", m.id) }),
-                        "type": m.method_type,
-                        "controller": did,
-                        "publicKeyMultibase": m.public_key_multibase
-                    })).collect::<Vec<_>>(),
-                    "service": [{
-                        "id": "#atproto_pds",
-                        "type": "AtprotoPersonalDataServer",
-                        "serviceEndpoint": service_endpoint
-                    }]
-                });
-            }
-        }
+    if let Some((ovr, parsed)) = overrides.as_ref().and_then(|ovr| {
+        serde_json::from_value::<Vec<VerificationMethod>>(ovr.verification_methods.clone())
+            .ok()
+            .filter(|p| !p.is_empty())
+            .map(|p| (ovr, p))
+    }) {
+        let also_known_as = if !ovr.also_known_as.is_empty() {
+            ovr.also_known_as.clone()
+        } else {
+            vec![format!("at://{}", user.handle)]
+        };
+        return json!({
+            "@context": [
+                "https://www.w3.org/ns/did/v1",
+                "https://w3id.org/security/multikey/v1",
+                "https://w3id.org/security/suites/secp256k1-2019/v1"
+            ],
+            "id": did,
+            "alsoKnownAs": also_known_as,
+            "verificationMethod": parsed.iter().map(|m| json!({
+                "id": format!("{}{}", did, if m.id.starts_with('#') { m.id.clone() } else { format!("#{}", m.id) }),
+                "type": m.method_type,
+                "controller": did,
+                "publicKeyMultibase": m.public_key_multibase
+            })).collect::<Vec<_>>(),
+            "service": [{
+                "id": "#atproto_pds",
+                "type": "AtprotoPersonalDataServer",
+                "serviceEndpoint": service_endpoint
+            }]
+        });
     }
 
     let key_row = sqlx::query!(
···
     .await;
 
     let public_key_multibase = match key_row {
-        Ok(Some(row)) => {
-            match crate::config::decrypt_key(&row.key_bytes, row.encryption_version) {
-                Ok(key_bytes) => crate::api::identity::did::get_public_key_multibase(&key_bytes)
-                    .unwrap_or_else(|_| "error".to_string()),
-                Err(_) => "error".to_string(),
-            }
-        }
+        Ok(Some(row)) => match crate::config::decrypt_key(&row.key_bytes, row.encryption_version) {
+            Ok(key_bytes) => crate::api::identity::did::get_public_key_multibase(&key_bytes)
+                .unwrap_or_else(|_| "error".to_string()),
+            Err(_) => "error".to_string(),
+        },
         _ => "error".to_string(),
     };
 

src/api/server/passkey_account.rs

···
     pub handle: String,
     pub setup_token: String,
     pub setup_expires_at: chrono::DateTime<Utc>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub access_jwt: Option<String>,
 }
 
 pub async fn create_passkey_account(
···
             d.to_string()
         }
         _ => {
-            let rotation_key = std::env::var("PLC_ROTATION_KEY")
-                .unwrap_or_else(|_| crate::plc::signing_key_to_did_key(&secret_key));
-
-            let genesis_result = match crate::plc::create_genesis_operation(
-                &secret_key,
-                &rotation_key,
-                &handle,
-                &pds_endpoint,
-            ) {
-                Ok(r) => r,
-                Err(e) => {
-                    error!("Error creating PLC genesis operation: {:?}", e);
+            if let Some(ref auth_did) = byod_auth {
+                if let Some(ref provided_did) = input.did {
+                    if provided_did.starts_with("did:plc:") {
+                        if provided_did != auth_did {
+                            return (
+                                StatusCode::FORBIDDEN,
+                                Json(json!({
+                                    "error": "AuthorizationError",
+                                    "message": format!("Service token issuer {} does not match DID {}", auth_did, provided_did)
+                                })),
+                            )
+                                .into_response();
+                        }
+                        info!(did = %provided_did, "Creating BYOD did:plc passkey account (migration)");
+                        provided_did.clone()
+                    } else {
+                        return (
+                            StatusCode::BAD_REQUEST,
+                            Json(json!({
+                                "error": "InvalidRequest",
+                                "message": "BYOD migration requires a did:plc or did:web DID"
+                            })),
+                        )
+                            .into_response();
+                    }
+                } else {
                     return (
-                        StatusCode::INTERNAL_SERVER_ERROR,
-                        Json(json!({"error": "InternalError", "message": "Failed to create PLC operation"})),
+                        StatusCode::BAD_REQUEST,
+                        Json(json!({
+                            "error": "InvalidRequest",
+                            "message": "BYOD migration requires the 'did' field"
+                        })),
                     )
                         .into_response();
                 }
-            };
+            } else {
+                let rotation_key = std::env::var("PLC_ROTATION_KEY")
+                    .unwrap_or_else(|_| crate::plc::signing_key_to_did_key(&secret_key));
 
-            let plc_client = crate::plc::PlcClient::new(None);
-            if let Err(e) = plc_client
-                .send_operation(&genesis_result.did, &genesis_result.signed_operation)
-                .await
-            {
-                error!("Failed to submit PLC genesis operation: {:?}", e);
-                return (
-                    StatusCode::BAD_GATEWAY,
-                    Json(json!({
-                        "error": "UpstreamError",
-                        "message": format!("Failed to register DID with PLC directory: {}", e)
-                    })),
-                )
-                    .into_response();
+                let genesis_result = match crate::plc::create_genesis_operation(
+                    &secret_key,
+                    &rotation_key,
+                    &handle,
+                    &pds_endpoint,
+                ) {
+                    Ok(r) => r,
+                    Err(e) => {
+                        error!("Error creating PLC genesis operation: {:?}", e);
+                        return (
+                            StatusCode::INTERNAL_SERVER_ERROR,
+                            Json(json!({"error": "InternalError", "message": "Failed to create PLC operation"})),
+                        )
+                            .into_response();
+                    }
+                };
+
+                let plc_client = crate::plc::PlcClient::new(None);
+                if let Err(e) = plc_client
+                    .send_operation(&genesis_result.did, &genesis_result.signed_operation)
+                    .await
+                {
+                    error!("Failed to submit PLC genesis operation: {:?}", e);
+                    return (
+                        StatusCode::BAD_GATEWAY,
+                        Json(json!({
+                            "error": "UpstreamError",
+                            "message": format!("Failed to register DID with PLC directory: {}", e)
+                        })),
+                    )
+                        .into_response();
+                }
+                genesis_result.did
             }
-            genesis_result.did
         }
     };
 
···
 
     info!(did = %did, handle = %handle, "Passkey-only account created, awaiting setup completion");
 
+    let access_jwt = if byod_auth.is_some() {
+        match crate::auth::token::create_access_token_with_metadata(&did, &secret_key_bytes) {
+            Ok(token_meta) => {
+                let refresh_jti = uuid::Uuid::new_v4().to_string();
+                let refresh_expires = chrono::Utc::now() + chrono::Duration::hours(24);
+                let no_scope: Option<String> = None;
+                if let Err(e) = sqlx::query!(
+                    "INSERT INTO session_tokens (did, access_jti, refresh_jti, access_expires_at, refresh_expires_at, legacy_login, mfa_verified, scope) VALUES ($1, $2, $3, $4, $5, $6, $7, $8)",
+                    did,
+                    token_meta.jti,
+                    refresh_jti,
+                    token_meta.expires_at,
+                    refresh_expires,
+                    false,
+                    false,
+                    no_scope
+                )
+                .execute(&state.db)
+                .await
+                {
+                    warn!(did = %did, "Failed to insert migration session: {:?}", e);
+                }
+                info!(did = %did, "Generated migration access token for BYOD passkey account");
+                Some(token_meta.token)
+            }
+            Err(e) => {
+                warn!(did = %did, "Failed to generate migration access token: {:?}", e);
+                None
+            }
+        }
+    } else {
+        None
+    };
+
     Json(CreatePasskeyAccountResponse {
         did,
         handle,
         setup_token,
         setup_expires_at,
+        access_jwt,
     })
     .into_response()
 }

src/api/server/session.rs

···
                 std::env::var("PDS_HOSTNAME").unwrap_or_else(|_| "localhost".to_string());
             let handle = full_handle(&row.handle, &pds_hostname);
             let is_takendown = row.takedown_ref.is_some();
-            let is_migrated =
-                row.deactivated_at.is_some() && row.migrated_to_pds.is_some();
+            let is_migrated = row.deactivated_at.is_some() && row.migrated_to_pds.is_some();
             let is_active = row.deactivated_at.is_none() && !is_takendown;
             let email_value = if can_read_email {
                 row.email.clone()
···
             if let Some(doc) = did_doc {
                 response["didDoc"] = doc;
             }
-            Json(response)
-            .into_response()
+            Json(response).into_response()
         }
         Ok(None) => ApiError::AuthenticationFailed.into_response(),
         Err(e) => {
···
             } else if u.deactivated_at.is_some() {
                 response["status"] = json!("deactivated");
             }
-            Json(response)
-            .into_response()
+            Json(response).into_response()
         }
         Ok(None) => {
             error!("User not found for existing session: {}", session_row.did);

src/handle/reserved.rs

···
 use std::sync::LazyLock;
 
 const ATP_SPECIFIC: &[&str] = &[
-    "at",
-    "atp",
-    "plc",
-    "pds",
-    "did",
-    "repo",
-    "tid",
-    "nsid",
-    "xrpc",
-    "lex",
-    "lexicon",
-    "bsky",
-    "bluesky",
-    "handle",
+    "at", "atp", "plc", "pds", "did", "repo", "tid", "nsid", "xrpc", "lex", "lexicon", "bsky",
+    "bluesky", "handle",
 ];
 
 const COMMONLY_RESERVED: &[&str] = &[

src/main.rs

···
 use tracing::{error, info, warn};
 use tranquil_pds::comms::{CommsService, DiscordSender, EmailSender, SignalSender, TelegramSender};
 use tranquil_pds::crawlers::{Crawlers, start_crawlers_service};
-use tranquil_pds::scheduled::{backfill_genesis_commit_blocks, backfill_record_blobs, backfill_repo_rev, backfill_user_blocks, start_scheduled_tasks};
+use tranquil_pds::scheduled::{
+    backfill_genesis_commit_blocks, backfill_record_blobs, backfill_repo_rev, backfill_user_blocks,
+    start_scheduled_tasks,
+};
 use tranquil_pds::state::AppState;
 
 #[tokio::main]

src/oauth/endpoints/metadata.rs

···
         client_id,
         client_name: "PDS Account Manager".to_string(),
         client_uri: base_url.clone(),
-        redirect_uris: vec![format!("{}/", base_url)],
+        redirect_uris: vec![
+            format!("{}/", base_url),
+            format!("{}/migrate", base_url),
+        ],
         grant_types: vec![
             "authorization_code".to_string(),
             "refresh_token".to_string(),
         ],
         response_types: vec!["code".to_string()],
-        scope: "atproto repo:*?action=create repo:*?action=update repo:*?action=delete blob:*/*"
+        scope: "atproto transition:generic repo:* blob:*/* rpc:* rpc:com.atproto.server.createAccount?aud=* account:* identity:*"
             .to_string(),
         token_endpoint_auth_method: "none".to_string(),
         application_type: "web".to_string(),

src/scheduled.rs

···
 use cid::Cid;
+use ipld_core::ipld::Ipld;
 use jacquard_repo::commit::Commit;
 use jacquard_repo::storage::BlockStore;
-use ipld_core::ipld::Ipld;
 use sqlx::PgPool;
 use std::str::FromStr;
 use std::sync::Arc;
···
         }
     }
 
-    info!(success, failed, "Completed genesis commit blocks_cids backfill");
+    info!(
+        success,
+        failed, "Completed genesis commit blocks_cids backfill"
+    );
 }
 
 pub async fn backfill_repo_rev(db: &PgPool, block_store: PostgresBlockStore) {
-    let repos_missing_rev = match sqlx::query!(
-        "SELECT user_id, repo_root_cid FROM repos WHERE repo_rev IS NULL"
-    )
-    .fetch_all(db)
-    .await
-    {
-        Ok(rows) => rows,
-        Err(e) => {
-            error!("Failed to query repos for backfill: {}", e);
-            return;
-        }
-    };
+    let repos_missing_rev =
+        match sqlx::query!("SELECT user_id, repo_root_cid FROM repos WHERE repo_rev IS NULL")
+            .fetch_all(db)
+            .await
+        {
+            Ok(rows) => rows,
+            Err(e) => {
+                error!("Failed to query repos for backfill: {}", e);
+                return;
+            }
+        };
 
     if repos_missing_rev.is_empty() {
         debug!("No repos need repo_rev backfill");
···
                 if let Some(prev) = commit.prev {
                     to_visit.push(prev);
                 }
-            } else if let Ok(ipld) = serde_ipld_dagcbor::from_slice::<Ipld>(&block) {
-                if let Ipld::Map(ref obj) = ipld {
-                    if let Some(Ipld::Link(left_cid)) = obj.get("l") {
-                        to_visit.push(*left_cid);
-                    }
-                    if let Some(Ipld::List(entries)) = obj.get("e") {
-                        for entry in entries {
-                            if let Ipld::Map(entry_obj) = entry {
-                                if let Some(Ipld::Link(tree_cid)) = entry_obj.get("t") {
-                                    to_visit.push(*tree_cid);
-                                }
-                                if let Some(Ipld::Link(val_cid)) = entry_obj.get("v") {
-                                    to_visit.push(*val_cid);
-                                }
+            } else if let Ok(Ipld::Map(ref obj)) = serde_ipld_dagcbor::from_slice::<Ipld>(&block) {
+                if let Some(Ipld::Link(left_cid)) = obj.get("l") {
+                    to_visit.push(*left_cid);
+                }
+                if let Some(Ipld::List(entries)) = obj.get("e") {
+                    for entry in entries {
+                        if let Ipld::Map(entry_obj) = entry {
+                            if let Some(Ipld::Link(tree_cid)) = entry_obj.get("t") {
+                                to_visit.push(*tree_cid);
+                            }
+                            if let Some(Ipld::Link(val_cid)) = entry_obj.get("v") {
+                                to_visit.push(*val_cid);
                             }
                         }
                     }
···
 
             let blob_refs = crate::sync::import::find_blob_refs_ipld(&record_ipld, 0);
             for blob_ref in blob_refs {
-                let record_uri = format!(
-                    "at://{}/{}/{}",
-                    user.did, record.collection, record.rkey
-                );
+                let record_uri = format!("at://{}/{}/{}", user.did, record.collection, record.rkey);
                 if let Err(e) = sqlx::query!(
                     r#"
                     INSERT INTO record_blobs (repo_id, record_uri, blob_cid)
···
     did: &str,
     _handle: &str,
 ) -> Result<(), String> {
-    let user_id: uuid::Uuid = sqlx::query_scalar!(
-        "SELECT id FROM users WHERE did = $1",
-        did
-    )
-    .fetch_one(db)
-    .await
-    .map_err(|e| format!("DB error fetching user: {}", e))?;
+    let user_id: uuid::Uuid = sqlx::query_scalar!("SELECT id FROM users WHERE did = $1", did)
+        .fetch_one(db)
+        .await
+        .map_err(|e| format!("DB error fetching user: {}", e))?;
 
     let blob_storage_keys: Vec<String> = sqlx::query_scalar!(
         r#"SELECT storage_key as "storage_key!" FROM blobs WHERE created_by_user = $1"#,

tests/account_lifecycle.rs

···
     let (access_jwt, did) = create_account_and_login(&client).await;
 
     let status1 = client
-        .get(format!("{}/xrpc/com.atproto.server.checkAccountStatus", base))
+        .get(format!(
+            "{}/xrpc/com.atproto.server.checkAccountStatus",
+            base
+        ))
         .bearer_auth(&access_jwt)
         .send()
         .await
···
     assert_eq!(status1.status(), StatusCode::OK);
     let body1: Value = status1.json().await.unwrap();
     let initial_blocks = body1["repoBlocks"].as_i64().unwrap();
-    assert!(initial_blocks >= 2, "New account should have at least 2 blocks (commit + empty MST)");
+    assert!(
+        initial_blocks >= 2,
+        "New account should have at least 2 blocks (commit + empty MST)"
+    );
 
     let create_res = client
         .post(format!("{}/xrpc/com.atproto.repo.createRecord", base))
···
         .unwrap();
     assert_eq!(create_res.status(), StatusCode::OK);
     let create_body: Value = create_res.json().await.unwrap();
-    let rkey = create_body["uri"].as_str().unwrap().split('/').last().unwrap().to_string();
+    let rkey = create_body["uri"]
+        .as_str()
+        .unwrap()
+        .split('/')
+        .last()
+        .unwrap()
+        .to_string();
 
     let status2 = client
-        .get(format!("{}/xrpc/com.atproto.server.checkAccountStatus", base))
+        .get(format!(
+            "{}/xrpc/com.atproto.server.checkAccountStatus",
+            base
+        ))
         .bearer_auth(&access_jwt)
         .send()
         .await
         .unwrap();
     let body2: Value = status2.json().await.unwrap();
     let after_create_blocks = body2["repoBlocks"].as_i64().unwrap();
-    assert!(after_create_blocks > initial_blocks, "Block count should increase after creating a record");
+    assert!(
+        after_create_blocks > initial_blocks,
+        "Block count should increase after creating a record"
+    );
 
     let delete_res = client
         .post(format!("{}/xrpc/com.atproto.repo.deleteRecord", base))
···
     assert_eq!(delete_res.status(), StatusCode::OK);
 
     let status3 = client
-        .get(format!("{}/xrpc/com.atproto.server.checkAccountStatus", base))
+        .get(format!(
+            "{}/xrpc/com.atproto.server.checkAccountStatus",
+            base
+        ))
         .bearer_auth(&access_jwt)
         .send()
         .await
···
     let (access_jwt, _) = create_account_and_login(&client).await;
 
     let status = client
-        .get(format!("{}/xrpc/com.atproto.server.checkAccountStatus", base))
+        .get(format!(
+            "{}/xrpc/com.atproto.server.checkAccountStatus",
+            base
+        ))
         .bearer_auth(&access_jwt)
         .send()
         .await
···
 
     let repo_rev = body["repoRev"].as_str().unwrap();
     assert!(!repo_rev.is_empty(), "repoRev should not be empty");
-    assert!(repo_rev.chars().all(|c| c.is_alphanumeric()), "repoRev should be alphanumeric TID");
+    assert!(
+        repo_rev.chars().all(|c| c.is_alphanumeric()),
+        "repoRev should be alphanumeric TID"
+    );
 }
 
 #[tokio::test]
···
     let (access_jwt, _) = create_account_and_login(&client).await;
 
     let status = client
-        .get(format!("{}/xrpc/com.atproto.server.checkAccountStatus", base))
+        .get(format!(
+            "{}/xrpc/com.atproto.server.checkAccountStatus",
+            base
+        ))
         .bearer_auth(&access_jwt)
         .send()
         .await
···
     assert_eq!(status.status(), StatusCode::OK);
     let body: Value = status.json().await.unwrap();
 
-    assert_eq!(body["validDid"], true, "validDid should be true for active account with correct DID document");
-    assert_eq!(body["activated"], true, "activated should be true for active account");
+    assert_eq!(
+        body["validDid"], true,
+        "validDid should be true for active account with correct DID document"
+    );
+    assert_eq!(
+        body["activated"], true,
+        "activated should be true for active account"
+    );
 }
 
 #[tokio::test]
···
     let delete_after = future_time.to_rfc3339();
 
     let deactivate = client
-        .post(format!("{}/xrpc/com.atproto.server.deactivateAccount", base))
+        .post(format!(
+            "{}/xrpc/com.atproto.server.deactivateAccount",
+            base
+        ))
         .bearer_auth(&access_jwt)
         .json(&json!({
             "deleteAfter": delete_after
···
     assert_eq!(deactivate.status(), StatusCode::OK);
 
     let status = client
-        .get(format!("{}/xrpc/com.atproto.server.checkAccountStatus", base))
+        .get(format!(
+            "{}/xrpc/com.atproto.server.checkAccountStatus",
+            base
+        ))
         .bearer_auth(&access_jwt)
         .send()
         .await
···
     assert_eq!(create_res.status(), StatusCode::OK);
     let body: Value = create_res.json().await.unwrap();
 
-    assert!(body["accessJwt"].is_string(), "accessJwt should always be returned");
-    assert!(body["refreshJwt"].is_string(), "refreshJwt should always be returned");
+    assert!(
+        body["accessJwt"].is_string(),
+        "accessJwt should always be returned"
+    );
+    assert!(
+        body["refreshJwt"].is_string(),
+        "refreshJwt should always be returned"
+    );
     assert!(body["did"].is_string(), "did should be returned");
 
     if body["didDoc"].is_object() {
···
     assert_eq!(create_res.status(), StatusCode::OK);
     let body: Value = create_res.json().await.unwrap();
 
-    let access_jwt = body["accessJwt"].as_str().expect("accessJwt should be present");
-    let refresh_jwt = body["refreshJwt"].as_str().expect("refreshJwt should be present");
+    let access_jwt = body["accessJwt"]
+        .as_str()
+        .expect("accessJwt should be present");
+    let refresh_jwt = body["refreshJwt"]
+        .as_str()
+        .expect("refreshJwt should be present");
 
     assert!(!access_jwt.is_empty(), "accessJwt should not be empty");
     assert!(!refresh_jwt.is_empty(), "refreshJwt should not be empty");
 
     let parts: Vec<&str> = access_jwt.split('.').collect();
-    assert_eq!(parts.len(), 3, "accessJwt should be a valid JWT with 3 parts");
+    assert_eq!(
+        parts.len(),
+        3,
+        "accessJwt should be a valid JWT with 3 parts"
+    );
 }
 
 #[tokio::test]
···
     assert_eq!(describe.status(), StatusCode::OK);
     let body: Value = describe.json().await.unwrap();
 
-    assert!(body.get("links").is_some(), "describeServer should include links object");
-    assert!(body.get("contact").is_some(), "describeServer should include contact object");
+    assert!(
+        body.get("links").is_some(),
+        "describeServer should include links object"
+    );
+    assert!(
+        body.get("contact").is_some(),
+        "describeServer should include contact object"
+    );
 
     let links = &body["links"];
-    assert!(links.get("privacyPolicy").is_some() || links["privacyPolicy"].is_null(),
-            "links should have privacyPolicy field (can be null)");
-    assert!(links.get("termsOfService").is_some() || links["termsOfService"].is_null(),
-            "links should have termsOfService field (can be null)");
+    assert!(
+        links.get("privacyPolicy").is_some() || links["privacyPolicy"].is_null(),
+        "links should have privacyPolicy field (can be null)"
+    );
+    assert!(
+        links.get("termsOfService").is_some() || links["termsOfService"].is_null(),
+        "links should have termsOfService field (can be null)"
+    );
 
     let contact = &body["contact"];
-    assert!(contact.get("email").is_some() || contact["email"].is_null(),
-            "contact should have email field (can be null)");
+    assert!(
+        contact.get("email").is_some() || contact["email"].is_null(),
+        "contact should have email field (can be null)"
+    );
 }
 
 #[tokio::test]
···
 
     assert_eq!(delete_res.status(), StatusCode::BAD_REQUEST);
     let error_body: Value = delete_res.json().await.unwrap();
-    assert!(error_body["message"].as_str().unwrap().contains("password length")
-            || error_body["error"].as_str().unwrap() == "InvalidRequest");
+    assert!(
+        error_body["message"]
+            .as_str()
+            .unwrap()
+            .contains("password length")
+            || error_body["error"].as_str().unwrap() == "InvalidRequest"
+    );
 }

tests/account_notifications.rs

···
             format!("Subject {}", i),
             format!("Body {}", i),
         );
-        enqueue_comms(pool, comms)
-            .await
-            .expect("Failed to enqueue");
+        enqueue_comms(pool, comms).await.expect("Failed to enqueue");
     }
 
     let resp = client

tests/actor.rs

···
     let body: Value = get_resp.json().await.unwrap();
     let prefs_arr = body["preferences"].as_array().unwrap();
     assert_eq!(prefs_arr.len(), 1);
-    assert_eq!(prefs_arr[0]["$type"], "app.bsky.actor.defs#adultContentPref");
+    assert_eq!(
+        prefs_arr[0]["$type"],
+        "app.bsky.actor.defs#adultContentPref"
+    );
 }
 
 #[tokio::test]
···
     let client = client();
     let base = base_url().await;
     let (token, _did) = create_account_and_login(&client).await;
-    let current_year = chrono::Utc::now().format("%Y").to_string().parse::<i32>().unwrap();
+    let current_year = chrono::Utc::now()
+        .format("%Y")
+        .to_string()
+        .parse::<i32>()
+        .unwrap();
     let birth_year = current_year - 15;
     let prefs = json!({
         "preferences": [

tests/admin_invite.rs

···
         .expect("Failed to get invite codes");
     let list_body: Value = list_res.json().await.unwrap();
     let codes = list_body["codes"].as_array().unwrap();
-    let admin_codes: Vec<_> = codes.iter().filter(|c| c["forAccount"].as_str() == Some(&did)).collect();
+    let admin_codes: Vec<_> = codes
+        .iter()
+        .filter(|c| c["forAccount"].as_str() == Some(&did))
+        .collect();
     for code in admin_codes {
         assert_eq!(code["disabled"], true);
     }

tests/did_web.rs

···
     let jwt = verify_new_account(&client, &did).await;
     let target_pds = "https://pds2.example.com";
     let res = client
-        .post(format!("{}/xrpc/com.atproto.server.deactivateAccount", base))
+        .post(format!(
+            "{}/xrpc/com.atproto.server.deactivateAccount",
+            base
+        ))
         .bearer_auth(&jwt)
         .json(&json!({ "migratingTo": target_pds }))
         .send()
···
         .expect("Failed to send request");
     assert_eq!(res.status(), StatusCode::OK);
     let res = client
-        .post(format!("{}/xrpc/com.atproto.server.deactivateAccount", base))
+        .post(format!(
+            "{}/xrpc/com.atproto.server.deactivateAccount",
+            base
+        ))
         .bearer_auth(&jwt)
         .json(&json!({ "migratingTo": "https://pds2.example.com" }))
         .send()
···
     );
     let target_pds = "https://pds3.example.com";
     let res = client
-        .post(format!("{}/xrpc/com.atproto.server.deactivateAccount", base))
+        .post(format!(
+            "{}/xrpc/com.atproto.server.deactivateAccount",
+            base
+        ))
         .bearer_auth(&jwt)
         .json(&json!({ "migratingTo": target_pds }))
         .send()
···
         .expect("Failed to send request");
     assert_eq!(res.status(), StatusCode::OK);
     let body: Value = res.json().await.expect("Response was not JSON");
-    assert_eq!(body["active"], false, "Migrated account should not be active");
+    assert_eq!(
+        body["active"], false,
+        "Migrated account should not be active"
+    );
     assert_eq!(
         body["status"], "migrated",
         "Status should be 'migrated' after migration"
···
     assert!(did.starts_with("did:plc:"), "Should be did:plc account");
     let jwt = verify_new_account(&client, &did).await;
     let res = client
-        .post(format!("{}/xrpc/com.atproto.server.deactivateAccount", base))
+        .post(format!(
+            "{}/xrpc/com.atproto.server.deactivateAccount",
+            base
+        ))
         .bearer_auth(&jwt)
         .json(&json!({ "migratingTo": "https://pds2.example.com" }))
         .send()

tests/email_update.rs

···
         .expect("Failed to update email");
     assert_eq!(res.status(), StatusCode::OK);
 
-    let user_email: Option<String> = sqlx::query_scalar!("SELECT email FROM users WHERE did = $1", did)
-        .fetch_one(pool)
-        .await
-        .expect("User not found");
+    let user_email: Option<String> =
+        sqlx::query_scalar!("SELECT email FROM users WHERE did = $1", did)
+            .fetch_one(pool)
+            .await
+            .expect("User not found");
     assert_eq!(user_email, Some(new_email));
 }
 
···
     assert_eq!(res.status(), StatusCode::OK);
     let body: Value = res.json().await.expect("Invalid JSON");
     let did = body["did"].as_str().expect("No did").to_string();
-    let access_jwt = body["accessJwt"].as_str().expect("No accessJwt").to_string();
+    let access_jwt = body["accessJwt"]
+        .as_str()
+        .expect("No accessJwt")
+        .to_string();
 
     let body_text: String = sqlx::query_scalar!(
         "SELECT body FROM comms_queue WHERE user_id = (SELECT id FROM users WHERE did = $1) AND comms_type = 'email_verification' ORDER BY created_at DESC LIMIT 1",
···
         .expect("Failed to confirm email");
     assert_eq!(res.status(), StatusCode::OK);
 
-    let verified: bool = sqlx::query_scalar!(
-        "SELECT email_verified FROM users WHERE did = $1",
-        did
-    )
-    .fetch_one(pool)
-    .await
-    .expect("User not found");
+    let verified: bool =
+        sqlx::query_scalar!("SELECT email_verified FROM users WHERE did = $1", did)
+            .fetch_one(pool)
+            .await
+            .expect("User not found");
     assert!(verified);
 }
 
···
     assert_eq!(res.status(), StatusCode::OK);
     let body: Value = res.json().await.expect("Invalid JSON");
     let did = body["did"].as_str().expect("No did").to_string();
-    let access_jwt = body["accessJwt"].as_str().expect("No accessJwt").to_string();
+    let access_jwt = body["accessJwt"]
+        .as_str()
+        .expect("No accessJwt")
+        .to_string();
 
     let body_text: String = sqlx::query_scalar!(
         "SELECT body FROM comms_queue WHERE user_id = (SELECT id FROM users WHERE did = $1) AND comms_type = 'email_verification' ORDER BY created_at DESC LIMIT 1",
···
         .expect("Failed to create account");
     assert_eq!(res.status(), StatusCode::OK);
     let body: Value = res.json().await.expect("Invalid JSON");
-    let access_jwt = body["accessJwt"].as_str().expect("No accessJwt").to_string();
+    let access_jwt = body["accessJwt"]
+        .as_str()
+        .expect("No accessJwt")
+        .to_string();
 
     let res = client
         .post(format!("{}/xrpc/com.atproto.server.confirmEmail", base_url))
···
     assert_eq!(res.status(), StatusCode::OK);
     let body: Value = res.json().await.expect("Invalid JSON");
     let did = body["did"].as_str().expect("No did").to_string();
-    let access_jwt = body["accessJwt"].as_str().expect("No accessJwt").to_string();
+    let access_jwt = body["accessJwt"]
+        .as_str()
+        .expect("No accessJwt")
+        .to_string();
 
     let res = client
         .post(format!(
···
     assert_eq!(res.status(), StatusCode::BAD_REQUEST);
     let body: Value = res.json().await.expect("Invalid JSON");
     assert_eq!(body["error"], "InvalidRequest");
-    assert!(body["message"]
-        .as_str()
-        .unwrap_or("")
-        .contains("already in use"));
+    assert!(
+        body["message"]
+            .as_str()
+            .unwrap_or("")
+            .contains("already in use")
+    );
 }

tests/identity.rs

···
         .await
         .expect("Failed to get session");
     let session_body: Value = session.json().await.expect("Invalid JSON");
-    let current_handle = session_body["handle"].as_str().expect("No handle").to_string();
+    let current_handle = session_body["handle"]
+        .as_str()
+        .expect("No handle")
+        .to_string();
     let short_handle = current_handle.split('.').next().unwrap_or(&current_handle);
     let res = client
         .post(format!(

tests/invite.rs

···
     assert!(body["code"].is_string());
     let code = body["code"].as_str().unwrap();
     assert!(!code.is_empty());
-    assert!(code.contains('-'), "Code should be in hostname-xxxxx-xxxxx format");
+    assert!(
+        code.contains('-'),
+        "Code should be in hostname-xxxxx-xxxxx format"
+    );
     let parts: Vec<&str> = code.split('-').collect();
-    assert!(parts.len() >= 3, "Code should have at least 3 parts (hostname + 2 random parts)");
+    assert!(
+        parts.len() >= 3,
+        "Code should have at least 3 parts (hostname + 2 random parts)"
+    );
 }
 
 #[tokio::test]
···
     let body: Value = res.json().await.expect("Response was not valid JSON");
     let codes = body["codes"].as_array().unwrap();
     for c in codes {
-        assert_ne!(c["code"].as_str().unwrap(), code, "Disabled code should be filtered out");
+        assert_ne!(
+            c["code"].as_str().unwrap(),
+            code,
+            "Disabled code should be filtered out"
+        );
     }
 }

tests/lifecycle_session.rs

···
     let base = base_url().await;
     let (jwt, _did) = create_account_and_login(&client).await;
     let create_res = client
-        .post(format!("{}/xrpc/com.atproto.server.createAppPassword", base))
+        .post(format!(
+            "{}/xrpc/com.atproto.server.createAppPassword",
+            base
+        ))
         .bearer_auth(&jwt)
         .json(&json!({ "name": "My App" }))
         .send()
···
         .expect("Failed to create app password");
     assert_eq!(create_res.status(), StatusCode::OK);
     let duplicate_res = client
-        .post(format!("{}/xrpc/com.atproto.server.createAppPassword", base))
+        .post(format!(
+            "{}/xrpc/com.atproto.server.createAppPassword",
+            base
+        ))
         .bearer_auth(&jwt)
         .json(&json!({ "name": "My App" }))
         .send()
···
     let base = base_url().await;
     let (jwt, _did) = create_account_and_login(&client).await;
     let revoke_res = client
-        .post(format!("{}/xrpc/com.atproto.server.revokeAppPassword", base))
+        .post(format!(
+            "{}/xrpc/com.atproto.server.revokeAppPassword",
+            base
+        ))
         .bearer_auth(&jwt)
         .json(&json!({ "name": "Does Not Exist" }))
         .send()
···
     let did = account["did"].as_str().unwrap();
     let main_jwt = verify_new_account(&client, did).await;
     let create_app_res = client
-        .post(format!("{}/xrpc/com.atproto.server.createAppPassword", base))
+        .post(format!(
+            "{}/xrpc/com.atproto.server.createAppPassword",
+            base
+        ))
         .bearer_auth(&main_jwt)
         .json(&json!({ "name": "Session Test App" }))
         .send()
···
         "App password session should be valid before revocation"
     );
     let revoke_res = client
-        .post(format!("{}/xrpc/com.atproto.server.revokeAppPassword", base))
+        .post(format!(
+            "{}/xrpc/com.atproto.server.revokeAppPassword",
+            base
+        ))
         .bearer_auth(&main_jwt)
         .json(&json!({ "name": "Session Test App" }))
         .send()

tests/moderation.rs

···
     assert_eq!(res.status(), StatusCode::BAD_REQUEST);
     let body: Value = res.json().await.unwrap();
     assert_eq!(body["error"], "InvalidRequest");
-    assert!(body["message"]
-        .as_str()
-        .unwrap()
-        .contains("reasonType"));
+    assert!(body["message"].as_str().unwrap().contains("reasonType"));
 }
 
 #[tokio::test]
···
     );
     let body: Value = report_res.json().await.unwrap();
     assert_eq!(body["error"], "InvalidRequest");
-    assert!(body["message"]
-        .as_str()
-        .unwrap()
-        .contains("takendown"));
+    assert!(body["message"].as_str().unwrap().contains("takendown"));
 }

tests/oauth_lifecycle.rs

···
     let url = base_url().await;
     let http_client = client();
     let (alice, _mock_alice) =
-        create_user_and_oauth_session("alice-isol", "https://alice.example.com/callback")
-            .await;
+        create_user_and_oauth_session("alice-isol", "https://alice.example.com/callback").await;
     let (bob, _mock_bob) =
         create_user_and_oauth_session("bob-isolation", "https://bob.example.com/callback").await;
     let collection = "app.bsky.feed.post";

tests/repo_conformance.rs

···
     });
 
     let res = client
-        .post(format!("{}/xrpc/com.atproto.repo.createRecord", base_url().await))
+        .post(format!(
+            "{}/xrpc/com.atproto.repo.createRecord",
+            base_url().await
+        ))
         .bearer_auth(&jwt)
         .json(&payload)
         .send()
···
 
     assert!(body["uri"].is_string(), "response must have uri");
     assert!(body["cid"].is_string(), "response must have cid");
-    assert!(body["cid"].as_str().unwrap().starts_with("bafy"), "cid must be valid");
+    assert!(
+        body["cid"].as_str().unwrap().starts_with("bafy"),
+        "cid must be valid"
+    );
 
-    assert!(body["commit"].is_object(), "response must have commit object");
+    assert!(
+        body["commit"].is_object(),
+        "response must have commit object"
+    );
     let commit = &body["commit"];
     assert!(commit["cid"].is_string(), "commit must have cid");
-    assert!(commit["cid"].as_str().unwrap().starts_with("bafy"), "commit.cid must be valid");
+    assert!(
+        commit["cid"].as_str().unwrap().starts_with("bafy"),
+        "commit.cid must be valid"
+    );
     assert!(commit["rev"].is_string(), "commit must have rev");
 
-    assert!(body["validationStatus"].is_string(), "response must have validationStatus when validate defaults to true");
-    assert_eq!(body["validationStatus"], "valid", "validationStatus should be 'valid'");
+    assert!(
+        body["validationStatus"].is_string(),
+        "response must have validationStatus when validate defaults to true"
+    );
+    assert_eq!(
+        body["validationStatus"], "valid",
+        "validationStatus should be 'valid'"
+    );
 }
 
 #[tokio::test]
···
     });
 
     let res = client
-        .post(format!("{}/xrpc/com.atproto.repo.createRecord", base_url().await))
+        .post(format!(
+            "{}/xrpc/com.atproto.repo.createRecord",
+            base_url().await
+        ))
         .bearer_auth(&jwt)
         .json(&payload)
         .send()
···
 
     assert!(body["uri"].is_string());
     assert!(body["commit"].is_object());
-    assert!(body["validationStatus"].is_null(), "validationStatus should be omitted when validate=false");
+    assert!(
+        body["validationStatus"].is_null(),
+        "validationStatus should be omitted when validate=false"
+    );
 }
 
 #[tokio::test]
···
     });
 
     let res = client
-        .post(format!("{}/xrpc/com.atproto.repo.putRecord", base_url().await))
+        .post(format!(
+            "{}/xrpc/com.atproto.repo.putRecord",
+            base_url().await
+        ))
         .bearer_auth(&jwt)
         .json(&payload)
         .send()
···
     assert!(body["uri"].is_string(), "response must have uri");
     assert!(body["cid"].is_string(), "response must have cid");
 
-    assert!(body["commit"].is_object(), "response must have commit object");
+    assert!(
+        body["commit"].is_object(),
+        "response must have commit object"
+    );
     let commit = &body["commit"];
     assert!(commit["cid"].is_string(), "commit must have cid");
     assert!(commit["rev"].is_string(), "commit must have rev");
 
-    assert_eq!(body["validationStatus"], "valid", "validationStatus should be 'valid'");
+    assert_eq!(
+        body["validationStatus"], "valid",
+        "validationStatus should be 'valid'"
+    );
 }
 
 #[tokio::test]
···
         }
     });
     let create_res = client
-        .post(format!("{}/xrpc/com.atproto.repo.putRecord", base_url().await))
+        .post(format!(
+            "{}/xrpc/com.atproto.repo.putRecord",
+            base_url().await
+        ))
         .bearer_auth(&jwt)
         .json(&create_payload)
         .send()
···
         "rkey": "to-delete"
     });
     let delete_res = client
-        .post(format!("{}/xrpc/com.atproto.repo.deleteRecord", base_url().await))
+        .post(format!(
+            "{}/xrpc/com.atproto.repo.deleteRecord",
+            base_url().await
+        ))
         .bearer_auth(&jwt)
         .json(&delete_payload)
         .send()
···
     assert_eq!(delete_res.status(), StatusCode::OK);
     let body: Value = delete_res.json().await.unwrap();
 
-    assert!(body["commit"].is_object(), "response must have commit object when record was deleted");
+    assert!(
+        body["commit"].is_object(),
+        "response must have commit object when record was deleted"
+    );
     let commit = &body["commit"];
     assert!(commit["cid"].is_string(), "commit must have cid");
     assert!(commit["rev"].is_string(), "commit must have rev");
···
         "rkey": "nonexistent-record"
     });
     let delete_res = client
-        .post(format!("{}/xrpc/com.atproto.repo.deleteRecord", base_url().await))
+        .post(format!(
+            "{}/xrpc/com.atproto.repo.deleteRecord",
+            base_url().await
+        ))
         .bearer_auth(&jwt)
         .json(&delete_payload)
         .send()
···
     assert_eq!(delete_res.status(), StatusCode::OK);
     let body: Value = delete_res.json().await.unwrap();
 
-    assert!(body["commit"].is_null(), "commit should be omitted on no-op delete");
+    assert!(
+        body["commit"].is_null(),
+        "commit should be omitted on no-op delete"
+    );
 }
 
 #[tokio::test]
···
     });
 
     let res = client
-        .post(format!("{}/xrpc/com.atproto.repo.applyWrites", base_url().await))
+        .post(format!(
+            "{}/xrpc/com.atproto.repo.applyWrites",
+            base_url().await
+        ))
         .bearer_auth(&jwt)
         .json(&payload)
         .send()
···
     assert_eq!(res.status(), StatusCode::OK);
     let body: Value = res.json().await.unwrap();
 
-    assert!(body["commit"].is_object(), "response must have commit object");
+    assert!(
+        body["commit"].is_object(),
+        "response must have commit object"
+    );
     let commit = &body["commit"];
     assert!(commit["cid"].is_string(), "commit must have cid");
     assert!(commit["rev"].is_string(), "commit must have rev");
 
-    assert!(body["results"].is_array(), "response must have results array");
+    assert!(
+        body["results"].is_array(),
+        "response must have results array"
+    );
     let results = body["results"].as_array().unwrap();
     assert_eq!(results.len(), 2, "should have 2 results");
 
     for result in results {
         assert!(result["uri"].is_string(), "result must have uri");
         assert!(result["cid"].is_string(), "result must have cid");
-        assert_eq!(result["validationStatus"], "valid", "result must have validationStatus");
+        assert_eq!(
+            result["validationStatus"], "valid",
+            "result must have validationStatus"
+        );
         assert_eq!(result["$type"], "com.atproto.repo.applyWrites#createResult");
     }
 }
···
         }
     });
     client
-        .post(format!("{}/xrpc/com.atproto.repo.putRecord", base_url().await))
+        .post(format!(
+            "{}/xrpc/com.atproto.repo.putRecord",
+            base_url().await
+        ))
         .bearer_auth(&jwt)
         .json(&create_payload)
         .send()
···
     });
 
     let res = client
-        .post(format!("{}/xrpc/com.atproto.repo.applyWrites", base_url().await))
+        .post(format!(
+            "{}/xrpc/com.atproto.repo.applyWrites",
+            base_url().await
+        ))
         .bearer_auth(&jwt)
         .json(&payload)
         .send()
···
     assert_eq!(results.len(), 2);
 
     let update_result = &results[0];
-    assert_eq!(update_result["$type"], "com.atproto.repo.applyWrites#updateResult");
+    assert_eq!(
+        update_result["$type"],
+        "com.atproto.repo.applyWrites#updateResult"
+    );
     assert!(update_result["uri"].is_string());
     assert!(update_result["cid"].is_string());
     assert_eq!(update_result["validationStatus"], "valid");
 
     let delete_result = &results[1];
-    assert_eq!(delete_result["$type"], "com.atproto.repo.applyWrites#deleteResult");
-    assert!(delete_result["uri"].is_null(), "delete result should not have uri");
-    assert!(delete_result["cid"].is_null(), "delete result should not have cid");
-    assert!(delete_result["validationStatus"].is_null(), "delete result should not have validationStatus");
+    assert_eq!(
+        delete_result["$type"],
+        "com.atproto.repo.applyWrites#deleteResult"
+    );
+    assert!(
+        delete_result["uri"].is_null(),
+        "delete result should not have uri"
+    );
+    assert!(
+        delete_result["cid"].is_null(),
+        "delete result should not have cid"
+    );
+    assert!(
+        delete_result["validationStatus"].is_null(),
+        "delete result should not have validationStatus"
+    );
 }
 
 #[tokio::test]
···
     let (did, _jwt) = setup_new_user("conform-get-err").await;
 
     let res = client
-        .get(format!("{}/xrpc/com.atproto.repo.getRecord", base_url().await))
+        .get(format!(
+            "{}/xrpc/com.atproto.repo.getRecord",
+            base_url().await
+        ))
         .query(&[
             ("repo", did.as_str()),
             ("collection", "app.bsky.feed.post"),
···
 
     assert_eq!(res.status(), StatusCode::NOT_FOUND);
     let body: Value = res.json().await.unwrap();
-    assert_eq!(body["error"], "RecordNotFound", "error code should be RecordNotFound per atproto spec");
+    assert_eq!(
+        body["error"], "RecordNotFound",
+        "error code should be RecordNotFound per atproto spec"
+    );
 }
 
 #[tokio::test]
···
     });
 
     let res = client
-        .post(format!("{}/xrpc/com.atproto.repo.createRecord", base_url().await))
+        .post(format!(
+            "{}/xrpc/com.atproto.repo.createRecord",
+            base_url().await
+        ))
         .bearer_auth(&jwt)
         .json(&payload)
         .send()
         .await
         .expect("Failed to create record");
 
-    assert_eq!(res.status(), StatusCode::OK, "unknown lexicon should be allowed with default validation");
+    assert_eq!(
+        res.status(),
+        StatusCode::OK,
+        "unknown lexicon should be allowed with default validation"
+    );
     let body: Value = res.json().await.unwrap();
 
     assert!(body["uri"].is_string());
     assert!(body["cid"].is_string());
     assert!(body["commit"].is_object());
-    assert_eq!(body["validationStatus"], "unknown", "validationStatus should be 'unknown' for unknown lexicons");
+    assert_eq!(
+        body["validationStatus"], "unknown",
+        "validationStatus should be 'unknown' for unknown lexicons"
+    );
 }
 
 #[tokio::test]
···
     });
 
     let res = client
-        .post(format!("{}/xrpc/com.atproto.repo.createRecord", base_url().await))
+        .post(format!(
+            "{}/xrpc/com.atproto.repo.createRecord",
+            base_url().await
+        ))
         .bearer_auth(&jwt)
         .json(&payload)
         .send()
         .await
         .expect("Failed to send request");
 
-    assert_eq!(res.status(), StatusCode::BAD_REQUEST, "unknown lexicon should fail with validate=true");
+    assert_eq!(
+        res.status(),
+        StatusCode::BAD_REQUEST,
+        "unknown lexicon should fail with validate=true"
+    );
     let body: Value = res.json().await.unwrap();
     assert_eq!(body["error"], "InvalidRecord");
-    assert!(body["message"].as_str().unwrap().contains("Lexicon not found"), "error should mention lexicon not found");
+    assert!(
+        body["message"]
+            .as_str()
+            .unwrap()
+            .contains("Lexicon not found"),
+        "error should mention lexicon not found"
+    );
 }
 
 #[tokio::test]
···
     });
 
     let first_res = client
-        .post(format!("{}/xrpc/com.atproto.repo.putRecord", base_url().await))
+        .post(format!(
+            "{}/xrpc/com.atproto.repo.putRecord",
+            base_url().await
+        ))
         .bearer_auth(&jwt)
         .json(&payload)
         .send()
···
         .expect("Failed to put record");
     assert_eq!(first_res.status(), StatusCode::OK);
     let first_body: Value = first_res.json().await.unwrap();
-    assert!(first_body["commit"].is_object(), "first put should have commit");
+    assert!(
+        first_body["commit"].is_object(),
+        "first put should have commit"
+    );
 
     let second_res = client
-        .post(format!("{}/xrpc/com.atproto.repo.putRecord", base_url().await))
+        .post(format!(
+            "{}/xrpc/com.atproto.repo.putRecord",
+            base_url().await
+        ))
         .bearer_auth(&jwt)
         .json(&payload)
         .send()
···
     assert_eq!(second_res.status(), StatusCode::OK);
     let second_body: Value = second_res.json().await.unwrap();
 
-    assert!(second_body["commit"].is_null(), "second put with same content should have no commit (no-op)");
-    assert_eq!(first_body["cid"], second_body["cid"], "CID should be the same for identical content");
+    assert!(
+        second_body["commit"].is_null(),
+        "second put with same content should have no commit (no-op)"
+    );
+    assert_eq!(
+        first_body["cid"], second_body["cid"],
+        "CID should be the same for identical content"
+    );
 }
 
 #[tokio::test]
···
     });
 
     let res = client
-        .post(format!("{}/xrpc/com.atproto.repo.applyWrites", base_url().await))
+        .post(format!(
+            "{}/xrpc/com.atproto.repo.applyWrites",
+            base_url().await
+        ))
         .bearer_auth(&jwt)
         .json(&payload)
         .send()
···
 
     let results = body["results"].as_array().unwrap();
     assert_eq!(results.len(), 1);
-    assert_eq!(results[0]["validationStatus"], "unknown", "unknown lexicon should have 'unknown' status");
+    assert_eq!(
+        results[0]["validationStatus"], "unknown",
+        "unknown lexicon should have 'unknown' status"
+    );
 }

tests/sync_deprecated.rs

···
         .unwrap();
     assert_eq!(res.status(), StatusCode::OK);
     client
-        .post(format!("{}/xrpc/com.atproto.server.deactivateAccount", base))
+        .post(format!(
+            "{}/xrpc/com.atproto.server.deactivateAccount",
+            base
+        ))
         .bearer_auth(&jwt)
         .json(&serde_json::json!({}))
         .send()
···
         .unwrap();
     assert_eq!(res.status(), StatusCode::OK);
     client
-        .post(format!("{}/xrpc/com.atproto.admin.updateSubjectStatus", base))
+        .post(format!(
+            "{}/xrpc/com.atproto.admin.updateSubjectStatus",
+            base
+        ))
         .bearer_auth(&admin_jwt)
         .json(&serde_json::json!({
             "subject": {
···
     let (admin_jwt, _) = create_admin_account_and_login(&client).await;
     let (user_jwt, did) = create_account_and_login(&client).await;
     client
-        .post(format!("{}/xrpc/com.atproto.server.deactivateAccount", base))
+        .post(format!(
+            "{}/xrpc/com.atproto.server.deactivateAccount",
+            base
+        ))
         .bearer_auth(&user_jwt)
         .json(&serde_json::json!({}))
         .send()
···
         .unwrap();
     assert_eq!(res.status(), StatusCode::OK);
     client
-        .post(format!("{}/xrpc/com.atproto.server.deactivateAccount", base))
+        .post(format!(
+            "{}/xrpc/com.atproto.server.deactivateAccount",
+            base
+        ))
         .bearer_auth(&jwt)
         .json(&serde_json::json!({}))
         .send()
···
         .unwrap();
     assert_eq!(res.status(), StatusCode::OK);
     client
-        .post(format!("{}/xrpc/com.atproto.admin.updateSubjectStatus", base))
+        .post(format!(
+            "{}/xrpc/com.atproto.admin.updateSubjectStatus",
+            base
+        ))
         .bearer_auth(&admin_jwt)
         .json(&serde_json::json!({
             "subject": {