More structure, nice oauth flow on the CLI (localhost-only, but honestly fine)

Probably going to redo
the appview stuff entirely

.zed/settings.json

···
         }
       }
     }
+  },
+  "rust-analyzer": {
+    "binary": {
+      "path_lookup": true
+    }
   }
 }

Cargo.lock

···
 checksum = "512761e0bb2578dd7380c6baaa0f4ce03e84f95e960231d1dec8bf4d7d6e2627"
 
 [[package]]
+name = "adler32"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aae1277d39aeec15cb388266ecc24b11c80469deae6067e17a1a7aa9e5c1f234"
+
+[[package]]
 name = "ahash"
 version = "0.8.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 checksum = "8e60d3430d3a69478ad0993f19238d2df97c507009a52b3c10addcd7f6bcb916"
 dependencies = [
  "memchr",
+]
+
+[[package]]
+name = "alloc-no-stdlib"
+version = "2.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc7bb162ec39d46ab1ca8c77bf72e890535becd1751bb45f64c597edb4c8c6b3"
+
+[[package]]
+name = "alloc-stdlib"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94fb8275041c72129eb51b7d0322c29b8387a0386127718b096429201a5d6ece"
+dependencies = [
+ "alloc-no-stdlib",
 ]
 
 [[package]]
···
 checksum = "7d902e3d592a523def97af8f317b08ce16b7ab854c1985a0c671e6f15cebc236"
 
 [[package]]
+name = "ascii"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d92bec98840b8f03a5ff5413de5293bfcd8bf96467cf5452609f939ec6f5de16"
+
+[[package]]
 name = "async-compression"
 version = "0.4.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
  "quote",
  "syn",
 ]
+
+[[package]]
+name = "atomic-waker"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
 
 [[package]]
 name = "atrium-api"
···
  "jose-jwa",
  "jose-jwk",
  "p256",
- "rand",
+ "rand 0.8.5",
  "reqwest",
  "serde",
  "serde_html_form",
···
 checksum = "89e25b6adfb930f02d1981565a6e5d9c547ac15a96606256d3b59040e5cd4ca3"
 
 [[package]]
+name = "bincode"
+version = "1.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1f45e9417d87227c7a56d22e471c6206462cba514c7590c09aff4cf6d1ddcad"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "bitflags"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
+[[package]]
 name = "bitflags"
 version = "2.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 ]
 
 [[package]]
+name = "borrow-or-share"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3eeab4423108c5d7c744f4d234de88d18d636100093ae04caf4825134b9c3a32"
+
+[[package]]
+name = "brotli"
+version = "3.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d640d25bc63c50fb1f0b545ffd80207d2e10a4c965530809b40ba3386825c391"
+dependencies = [
+ "alloc-no-stdlib",
+ "alloc-stdlib",
+ "brotli-decompressor",
+]
+
+[[package]]
+name = "brotli-decompressor"
+version = "2.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4e2e4afe60d7dd600fdd3de8d0f08c2b7ec039712e3b6137ff98b7004e82de4f"
+dependencies = [
+ "alloc-no-stdlib",
+ "alloc-stdlib",
+]
+
+[[package]]
+name = "buf_redux"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b953a6887648bb07a535631f2bc00fbdb2a2216f135552cb3f534ed136b9c07f"
+dependencies = [
+ "memchr",
+ "safemem",
+]
+
+[[package]]
 name = "bumpalo"
 version = "3.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 ]
 
 [[package]]
+name = "chunked_transfer"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e4de3bc4ea267985becf712dc6d9eed8b04c953b3fcfb339ebc87acd9804901"
+
+[[package]]
 name = "cid"
 version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
  "itoa",
  "rustversion",
  "ryu",
+ "serde",
  "static_assertions",
 ]
 
 [[package]]
+name = "compact_string"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5255b88d8ea09573f588088dea17fbea682b4442abea6761a15d1da2c3a76c5c"
+dependencies = [
+ "serde",
+ "thiserror 1.0.69",
+]
+
+[[package]]
 name = "concurrent-queue"
 version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 checksum = "0dc92fb57ca44df6db8059111ab3af99a63d5d0f8375d9972e319a379c6bab76"
 dependencies = [
  "generic-array",
- "rand_core",
+ "rand_core 0.6.4",
  "subtle",
  "zeroize",
 ]
···
 ]
 
 [[package]]
+name = "curve25519-dalek"
+version = "4.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97fb8b7c4503de7d6ae7b42ab72a5a59857b4c937ec27a3d4539dba95b5ab2be"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "curve25519-dalek-derive",
+ "digest",
+ "fiat-crypto",
+ "rustc_version",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "curve25519-dalek-derive"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f46882e17999c6cc590af592290432be3bce0428cb0d5f8b6715e4dc7b383eb3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
 name = "darling"
 version = "0.20.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 ]
 
 [[package]]
+name = "deadpool"
+version = "0.12.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5ed5957ff93768adf7a65ab167a17835c3d2c3c50d084fe305174c112f468e2f"
+dependencies = [
+ "deadpool-runtime",
+ "num_cpus",
+ "tokio",
+]
+
+[[package]]
+name = "deadpool-runtime"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "092966b41edc516079bdf31ec78a2e0588d1d0c08f78b91d8307215928642b2b"
+
+[[package]]
+name = "deflate"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c86f7e25f518f4b81808a2cf1c50996a61f5c2eb394b2393bd87f2a4780a432f"
+dependencies = [
+ "adler32",
+ "gzip-header",
+]
+
+[[package]]
 name = "der"
 version = "0.7.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb"
 dependencies = [
  "const-oid",
+ "pem-rfc7468",
  "zeroize",
 ]
 
···
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ff3e1edb1f37b4953dd5176916347289ed43d7119cc2e6c7c3f7849ff44ea506"
 dependencies = [
+ "bitflags 2.9.0",
+ "byteorder",
+ "chrono",
  "diesel_derives",
+ "itoa",
  "libsqlite3-sys",
+ "pq-sys",
+ "serde_json",
  "time",
 ]
 
 [[package]]
+name = "diesel-async"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "51a307ac00f7c23f526a04a77761a0519b9f0eb2838ebf5b905a58580095bdcb"
+dependencies = [
+ "async-trait",
+ "deadpool",
+ "diesel",
+ "futures-util",
+ "scoped-futures",
+ "tokio",
+ "tokio-postgres",
+]
+
+[[package]]
 name = "diesel_derives"
 version = "2.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 ]
 
 [[package]]
+name = "diesel_migrations"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a73ce704bad4231f001bff3314d91dce4aba0770cee8b233991859abc15c1f6"
+dependencies = [
+ "diesel",
+ "migrations_internals",
+ "migrations_macros",
+]
+
+[[package]]
 name = "diesel_table_macro_syntax"
 version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
  "elliptic-curve",
  "rfc6979",
  "signature",
+ "spki",
+]
+
+[[package]]
+name = "ed25519"
+version = "2.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "115531babc129696a58c64a4fef0a8bf9e9698629fb97e9e40767d235cfbcd53"
+dependencies = [
+ "signature",
+]
+
+[[package]]
+name = "ed25519-dalek"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4a3daa8e81a3963a60642bcc1f90a670680bd4a77535faa384e9d1c79d620871"
+dependencies = [
+ "curve25519-dalek",
+ "ed25519",
+ "rand_core 0.6.4",
+ "sha2",
+ "subtle",
+ "zeroize",
 ]
 
 [[package]]
···
 checksum = "b5e6043086bf7973472e0c7dff2142ea0b680d30e18d9cc40f267efbf222bd47"
 dependencies = [
  "base16ct",
+ "base64ct",
  "crypto-bigint",
  "digest",
  "ff",
  "generic-array",
  "group",
- "rand_core",
+ "pem-rfc7468",
+ "pkcs8",
+ "rand_core 0.6.4",
  "sec1",
+ "serde_json",
+ "serdect",
  "subtle",
  "zeroize",
+]
+
+[[package]]
+name = "encoding_rs"
+version = "0.8.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75030f3c4f45dafd7586dd6780965a8c7e8e285a5ecb86713e63a79c5b2766f3"
+dependencies = [
+ "cfg-if",
 ]
 
 [[package]]
···
 ]
 
 [[package]]
+name = "facet"
+version = "0.9.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "36b55e98a6cc63c843db91f6db4be9f47067b9bd07d93560da0ba4c0f55f20fd"
+dependencies = [
+ "facet-core",
+ "facet-derive",
+]
+
+[[package]]
+name = "facet-core"
+version = "0.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5227e1c925a1f21ea3ebff90e08af0b34b59975171cf00fcee36b917941d1ac0"
+dependencies = [
+ "bitflags 2.9.0",
+ "camino",
+ "impls",
+]
+
+[[package]]
+name = "facet-derive"
+version = "0.9.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9982f286c2121f36d6921c7ecedde49158a5ba8eef622a4fd777ff502c1348e3"
+dependencies = [
+ "facet-core",
+ "facet-derive-emit",
+]
+
+[[package]]
+name = "facet-derive-emit"
+version = "0.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2ed20e29f8aa502cf1263eb040e3442ef84636e89a88ee8dffcda336a1152a38"
+dependencies = [
+ "facet-derive-parse",
+]
+
+[[package]]
+name = "facet-derive-parse"
+version = "0.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "71ea122ff95ac65c86bf18d0ba7f04f087ef5dd20f7dc76cb5bd69cbb14bd8ad"
+dependencies = [
+ "unsynn",
+]
+
+[[package]]
+name = "fallible-iterator"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4443176a9f2c162692bd3d352d745ef9413eec5782a80d8fd6f8a1ac692a07f7"
+
+[[package]]
 name = "fallible-iterator"
 version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c0b50bfb653653f9ca9095b427bed08ab8d75a137839d9ad64eb11810d5b6393"
 dependencies = [
- "rand_core",
+ "rand_core 0.6.4",
  "subtle",
 ]
 
 [[package]]
+name = "fiat-crypto"
+version = "0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d"
+
+[[package]]
+name = "filetime"
+version = "0.2.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "35c0522e981e68cbfa8c3f978441a5f34b30b96e146b33cd3359176b50fe8586"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "libredox",
+ "windows-sys 0.59.0",
+]
+
+[[package]]
 name = "flate2"
 version = "1.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 ]
 
 [[package]]
+name = "fluent-uri"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1918b65d96df47d3591bed19c5cca17e3fa5d0707318e4b5ef2eae01764df7e5"
+dependencies = [
+ "borrow-or-share",
+ "ref-cast",
+]
+
+[[package]]
 name = "fnv"
 version = "1.0.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
  "diatomic-waker",
  "futures-core",
  "pin-project-lite",
- "spin",
+ "spin 0.9.8",
 ]
 
 [[package]]
···
 checksum = "2dff15bf788c671c1934e366d07e30c1814a8ef514e1af724a602e8a2fbe1b10"
 dependencies = [
  "futures-core",
+ "futures-sink",
 ]
 
 [[package]]
···
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
 dependencies = [
+ "serde",
  "typenum",
  "version_check",
  "zeroize",
···
 checksum = "335ff9f135e4384c8150d6f27c6daed433577f86b4750418338c01a1a2528592"
 dependencies = [
  "cfg-if",
+ "js-sys",
  "libc",
  "wasi 0.11.0+wasi-snapshot-preview1",
+ "wasm-bindgen",
 ]
 
 [[package]]
···
 checksum = "f0f9ef7462f7c099f518d754361858f86d8a07af53ba9af0fe635bbccb151a63"
 dependencies = [
  "ff",
- "rand_core",
+ "rand_core 0.6.4",
  "subtle",
 ]
 
 [[package]]
+name = "gzip-header"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "95cc527b92e6029a62960ad99aa8a6660faa4555fe5f731aab13aa6a921795a2"
+dependencies = [
+ "crc32fast",
+]
+
+[[package]]
+name = "h2"
+version = "0.4.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a9421a676d1b147b16b82c9225157dc629087ef8ec4d5e2960f9437a90dac0a5"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "fnv",
+ "futures-core",
+ "futures-sink",
+ "http",
+ "indexmap 2.9.0",
+ "slab",
+ "tokio",
+ "tokio-util",
+ "tracing",
+]
+
+[[package]]
 name = "half"
 version = "1.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
  "allocator-api2",
  "equivalent",
  "foldhash",
+ "serde",
 ]
 
 [[package]]
···
 checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
 
 [[package]]
+name = "hermit-abi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d231dfb89cfffdbc30e7fc41579ed6066ad03abda9e567ccafae602b97ec5024"
+
+[[package]]
 name = "hex"
 version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
  "idna",
  "ipnet",
  "once_cell",
- "rand",
+ "rand 0.8.5",
  "thiserror 1.0.69",
  "tinyvec",
  "tokio",
···
  "lru-cache",
  "once_cell",
  "parking_lot",
- "rand",
+ "rand 0.8.5",
  "resolv-conf",
  "smallvec",
  "thiserror 1.0.69",
···
  "bytes",
  "futures-channel",
  "futures-util",
+ "h2",
  "http",
  "http-body",
  "httparse",
···
 ]
 
 [[package]]
+name = "hyper-rustls"
+version = "0.27.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2d191583f3da1305256f22463b9bb0471acad48a4e534a5218b9963e9c1f59b2"
+dependencies = [
+ "futures-util",
+ "http",
+ "hyper",
+ "hyper-util",
+ "rustls 0.23.27",
+ "rustls-pki-types",
+ "tokio",
+ "tokio-rustls",
+ "tower-service",
+ "webpki-roots 0.26.11",
+]
+
+[[package]]
 name = "hyper-tls"
 version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 ]
 
 [[package]]
+name = "impls"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a46645bbd70538861a90d0f26c31537cdf1e44aae99a794fb75a664b70951bc"
+
+[[package]]
 name = "indexmap"
 version = "1.9.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 checksum = "4a5f13b858c8d314ee3e8f639011f7ccefe71f97f96e50151fb991f267928e2c"
 
 [[package]]
+name = "jose"
+version = "0.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "de791f8b277ef903d49b0c6f3f3b866569ae8cb1d0829825eea28374cc4c803c"
+dependencies = [
+ "base64ct",
+ "cfg-if",
+ "digest",
+ "ecdsa",
+ "ed25519-dalek",
+ "elliptic-curve",
+ "fluent-uri",
+ "generic-array",
+ "hashbrown 0.15.3",
+ "hmac",
+ "k256",
+ "mediatype",
+ "p256",
+ "p384",
+ "rand_core 0.6.4",
+ "rsa",
+ "secrecy",
+ "serde",
+ "serde-value",
+ "serde_json",
+ "sha2",
+ "signature",
+ "subtle",
+ "thiserror 2.0.12",
+ "zeroize",
+]
+
+[[package]]
 name = "jose-b64"
 version = "0.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
  "jose-b64",
  "jose-jwa",
  "p256",
+ "p384",
+ "rsa",
  "serde",
  "zeroize",
 ]
···
 ]
 
 [[package]]
+name = "k256"
+version = "0.13.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6e3919bbaa2945715f0bb6d3934a173d1e9a59ac23767fbaaef277265a7411b"
+dependencies = [
+ "cfg-if",
+ "ecdsa",
+ "elliptic-curve",
+ "sha2",
+]
+
+[[package]]
+name = "kdl"
+version = "6.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "12661358400b02cbbf1fbd05f0a483335490e8a6bd1867620f2eeb78f304a22f"
+dependencies = [
+ "miette",
+ "num",
+ "thiserror 1.0.69",
+ "winnow 0.6.24",
+]
+
+[[package]]
 name = "langtag"
 version = "0.3.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
+dependencies = [
+ "spin 0.9.8",
+]
 
 [[package]]
 name = "lexical-parse-float"
···
 checksum = "d750af042f7ef4f724306de029d18836c26c1765a54a6a3f094cbd23a7267ffa"
 
 [[package]]
+name = "libm"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f9fbbcab51052fe104eb5e5d351cf728d30a5be1fe14d9be8a3b097481fb97de"
+
+[[package]]
+name = "libredox"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0ff37bd590ca25063e35af745c343cb7a0271906fb7b37e4813e8f79f00268d"
+dependencies = [
+ "bitflags 2.9.0",
+ "libc",
+ "redox_syscall",
+]
+
+[[package]]
 name = "libsqlite3-sys"
 version = "0.30.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 version = "0.13.0"
 source = "git+https://github.com/rsform/markdown-weaver#34bc7ad2d7e6e9b9604ba61602b68589f271404e"
 dependencies = [
- "bitflags",
+ "bitflags 2.9.0",
  "getopts",
  "markdown-weaver-escape",
  "memchr",
···
 checksum = "47e1ffaa40ddd1f3ed91f717a33c8c0ee23fff369e3aa8772b9605cc1d22f4c3"
 
 [[package]]
+name = "md-5"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d89e7ee0cfbedfc4da3340218492196241d89eefb6dab27de5df917a6d2e78cf"
+dependencies = [
+ "cfg-if",
+ "digest",
+]
+
+[[package]]
+name = "mediatype"
+version = "0.19.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "33746aadcb41349ec291e7f2f0a3aa6834d1d7c58066fb4b01f68efc4c4b7631"
+dependencies = [
+ "serde",
+]
+
+[[package]]
 name = "memchr"
 version = "2.7.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
  "camino",
  "compact_bytes",
  "compact_str",
- "ordered-float",
+ "ordered-float 4.6.0",
  "rusqlite",
+ "serde",
  "time",
 ]
 
···
  "supports-color",
  "supports-hyperlinks",
  "supports-unicode",
+ "syntect",
  "terminal_size",
  "textwrap",
  "unicode-width 0.1.14",
···
 ]
 
 [[package]]
+name = "migrations_internals"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fd01039851e82f8799046eabbb354056283fb265c8ec0996af940f4e85a380ff"
+dependencies = [
+ "serde",
+ "toml",
+]
+
+[[package]]
+name = "migrations_macros"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ffb161cc72176cb37aa47f1fc520d3ef02263d67d661f44f05d05a079e1237fd"
+dependencies = [
+ "migrations_internals",
+ "proc-macro2",
+ "quote",
+]
+
+[[package]]
 name = "mime"
 version = "0.3.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dd72e8b4e42274540edabec853f607c015c73436159b06c39c7af85a20433155"
 dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "minijinja-contrib"
+version = "2.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "457f85f9c4c5b17d11fcf9bbe7c0dbba64843c5ee040005956f1a510b6679fe2"
+dependencies = [
+ "minijinja",
  "serde",
 ]
 
···
 ]
 
 [[package]]
+name = "multipart"
+version = "0.18.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "00dec633863867f29cb39df64a397cdf4a6354708ddd7759f70c7fb51c5f9182"
+dependencies = [
+ "buf_redux",
+ "httparse",
+ "log",
+ "mime",
+ "mime_guess",
+ "quick-error",
+ "rand 0.8.5",
+ "safemem",
+ "tempfile",
+ "twoway",
+]
+
+[[package]]
+name = "mutants"
+version = "0.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc0287524726960e07b119cebd01678f852f147742ae0d925e6a520dca956126"
+
+[[package]]
 name = "n0-future"
 version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 ]
 
 [[package]]
+name = "num"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "35bd024e8b2ff75562e5f34e7f4905839deb4b22955ef5e73d2fea1b9813cb23"
+dependencies = [
+ "num-bigint",
+ "num-complex",
+ "num-integer",
+ "num-iter",
+ "num-rational",
+ "num-traits",
+]
+
+[[package]]
+name = "num-bigint"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a5e44f723f1133c9deac646763579fdb3ac745e418f2a7af9cd0c431da1f20b9"
+dependencies = [
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-bigint-dig"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc84195820f291c7697304f3cbdadd1cb7199c0efc917ff5eafd71225c136151"
+dependencies = [
+ "byteorder",
+ "lazy_static",
+ "libm",
+ "num-integer",
+ "num-iter",
+ "num-traits",
+ "rand 0.8.5",
+ "smallvec",
+ "zeroize",
+]
+
+[[package]]
+name = "num-complex"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "73f88a1307638156682bada9d7604135552957b7818057dcef22705b4d509495"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
 name = "num-conv"
 version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9"
 
 [[package]]
+name = "num-integer"
+version = "0.1.46"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7969661fd2958a5cb096e56c8e1ad0444ac2bbcd0061bd28660485a44879858f"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "num-iter"
+version = "0.1.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1429034a0490724d0075ebb2bc9e875d6503c3cf69e235a8941aa757d83ef5bf"
+dependencies = [
+ "autocfg",
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-rational"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f83d14da390562dca69fc84082e73e548e1ad308d24accdedd2720017cb37824"
+dependencies = [
+ "num-bigint",
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
 name = "num-traits"
 version = "0.2.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
 dependencies = [
  "autocfg",
+ "libm",
+]
+
+[[package]]
+name = "num_cpus"
+version = "1.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4161fcb6d602d4d2081af7c3a45852d875a03dd337a6bfdd6e06407b61342a43"
+dependencies = [
+ "hermit-abi",
+ "libc",
+]
+
+[[package]]
+name = "num_threads"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c7398b9c8b70908f6371f47ed36737907c87c52af34c268fed0bf0ceb92ead9"
+dependencies = [
+ "libc",
 ]
 
 [[package]]
···
 checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
 
 [[package]]
+name = "onig"
+version = "6.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8c4b31c8722ad9171c6d77d3557db078cab2bd50afcc9d09c8b315c59df8ca4f"
+dependencies = [
+ "bitflags 1.3.2",
+ "libc",
+ "once_cell",
+ "onig_sys",
+]
+
+[[package]]
+name = "onig_sys"
+version = "69.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b829e3d7e9cc74c7e315ee8edb185bf4190da5acde74afd7fc59c35b1f086e7"
+dependencies = [
+ "cc",
+ "pkg-config",
+]
+
+[[package]]
 name = "openssl"
 version = "0.10.72"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fedfea7d58a1f73118430a55da6a286e7b044961736ce96a16a17068ea25e5da"
 dependencies = [
- "bitflags",
+ "bitflags 2.9.0",
  "cfg-if",
  "foreign-types",
  "libc",
···
 
 [[package]]
 name = "ordered-float"
+version = "2.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68f19d67e5a2795c94e73e0bb1cc1a7edeb2e28efd39e2e1c9b7a40c1108b11c"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "ordered-float"
 version = "4.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7bb71e1b3fa6ca1c61f383464aaf2bb0e2f8e772a1f01d486832464de363b951"
···
 ]
 
 [[package]]
+name = "p384"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fe42f1670a52a47d448f14b6a5c61dd78fce51856e68edaa38f7ae3a46b8d6b6"
+dependencies = [
+ "ecdsa",
+ "elliptic-curve",
+ "primeorder",
+ "sha2",
+]
+
+[[package]]
 name = "parking"
 version = "2.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 checksum = "57c0d7b74b563b49d38dae00a0c37d4d6de9b432382b2892f0574ddcae73fd0a"
 
 [[package]]
+name = "pem-rfc7468"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "88b39c9bfcfc231068454382784bb460aae594343fb030d46e9f50a645418412"
+dependencies = [
+ "base64ct",
+]
+
+[[package]]
 name = "percent-encoding"
 version = "2.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e3148f5046208a5d56bcfc03053e3ca6334e51da8dfb19b6cdc8b306fae3283e"
+
+[[package]]
+name = "phf"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fd6780a80ae0c52cc120a26a1a42c1ae51b247a253e4e06113d23d2c2edd078"
+dependencies = [
+ "phf_shared",
+]
+
+[[package]]
+name = "phf_shared"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67eabc2ef2a60eb7faa00097bd1ffdb5bd28e62bf39990626a582201b7a754e5"
+dependencies = [
+ "siphasher",
+]
 
 [[package]]
 name = "pin-project"
···
 checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
 
 [[package]]
+name = "pkcs1"
+version = "0.7.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8ffb9f10fa047879315e6625af03c164b16962a5368d724ed16323b68ace47f"
+dependencies = [
+ "der",
+ "pkcs8",
+ "spki",
+]
+
+[[package]]
+name = "pkcs8"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7"
+dependencies = [
+ "der",
+ "spki",
+]
+
+[[package]]
 name = "pkg-config"
 version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7edddbd0b52d732b21ad9a5fab5c704c14cd949e5e9a1ec5929a24fded1b904c"
 
 [[package]]
+name = "plist"
+version = "1.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eac26e981c03a6e53e0aee43c113e3202f5581d5360dae7bd2c70e800dd0451d"
+dependencies = [
+ "base64 0.22.1",
+ "indexmap 2.9.0",
+ "quick-xml",
+ "serde",
+ "time",
+]
+
+[[package]]
 name = "portable-atomic"
 version = "1.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "350e9b48cbc6b0e028b0473b114454c6316e57336ee184ceab6e53f72c178b3e"
 
 [[package]]
+name = "postgres-protocol"
+version = "0.6.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "76ff0abab4a9b844b93ef7b81f1efc0a366062aaef2cd702c76256b5dc075c54"
+dependencies = [
+ "base64 0.22.1",
+ "byteorder",
+ "bytes",
+ "fallible-iterator 0.2.0",
+ "hmac",
+ "md-5",
+ "memchr",
+ "rand 0.9.1",
+ "sha2",
+ "stringprep",
+]
+
+[[package]]
+name = "postgres-types"
+version = "0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "613283563cd90e1dfc3518d548caee47e0e725455ed619881f5cf21f36de4b48"
+dependencies = [
+ "bytes",
+ "fallible-iterator 0.2.0",
+ "postgres-protocol",
+]
+
+[[package]]
 name = "potential_utf"
 version = "0.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 ]
 
 [[package]]
+name = "pq-sys"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41c852911b98f5981956037b2ca976660612e548986c30af075e753107bc3400"
+dependencies = [
+ "libc",
+ "vcpkg",
+]
+
+[[package]]
 name = "prettyplease"
 version = "0.2.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 ]
 
 [[package]]
+name = "quick-error"
+version = "1.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1d01941d82fa2ab50be1e79e6714289dd7cde78eba4c074bc5a4374f650dfe0"
+
+[[package]]
+name = "quick-xml"
+version = "0.32.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d3a6e5838b60e0e8fa7a43f22ade549a37d61f8bdbe636d0d7816191de969c2"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "quinn"
+version = "0.11.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "62e96808277ec6f97351a2380e6c25114bc9e67037775464979f3037c92d05ef"
+dependencies = [
+ "bytes",
+ "pin-project-lite",
+ "quinn-proto",
+ "quinn-udp",
+ "rustc-hash",
+ "rustls 0.23.27",
+ "socket2",
+ "thiserror 2.0.12",
+ "tokio",
+ "tracing",
+]
+
+[[package]]
+name = "quinn-proto"
+version = "0.11.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2fe5ef3495d7d2e377ff17b1a8ce2ee2ec2a18cde8b6ad6619d65d0701c135d"
+dependencies = [
+ "bytes",
+ "getrandom 0.2.16",
+ "rand 0.8.5",
+ "ring 0.17.14",
+ "rustc-hash",
+ "rustls 0.23.27",
+ "rustls-pki-types",
+ "slab",
+ "thiserror 2.0.12",
+ "tinyvec",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "quinn-udp"
+version = "0.5.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1c40286217b4ba3a71d644d752e6a0b71f13f1b6a2c5311acfcbe0c2418ed904"
+dependencies = [
+ "cfg_aliases",
+ "libc",
+ "once_cell",
+ "socket2",
+ "tracing",
+ "windows-sys 0.59.0",
+]
+
+[[package]]
 name = "quote"
 version = "1.0.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
 dependencies = [
  "libc",
- "rand_chacha",
- "rand_core",
+ "rand_chacha 0.3.1",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9fbfd9d094a40bf3ae768db9361049ace4c0e04a4fd6b359518bd7b73a73dd97"
+dependencies = [
+ "rand_chacha 0.9.0",
+ "rand_core 0.9.3",
 ]
 
 [[package]]
···
 checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
 dependencies = [
  "ppv-lite86",
- "rand_core",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.9.3",
 ]
 
 [[package]]
···
 ]
 
 [[package]]
+name = "rand_core"
+version = "0.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "99d9a13982dcf210057a8a78572b2217b667c3beacbf3a0d8b454f6f82837d38"
+dependencies = [
+ "getrandom 0.3.3",
+]
+
+[[package]]
 name = "redox_syscall"
 version = "0.5.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "928fca9cf2aa042393a8325b9ead81d2f0df4cb12e1e24cef072922ccd99c5af"
 dependencies = [
- "bitflags",
+ "bitflags 2.9.0",
+]
+
+[[package]]
+name = "ref-cast"
+version = "1.0.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4a0ae411dbe946a674d89546582cea4ba2bb8defac896622d6496f14c23ba5cf"
+dependencies = [
+ "ref-cast-impl",
+]
+
+[[package]]
+name = "ref-cast-impl"
+version = "1.0.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1165225c21bff1f3bbce98f5a1f889949bc902d3575308cc7b0de30b4f6d27c7"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
 ]
 
 [[package]]
···
  "async-compression",
  "base64 0.22.1",
  "bytes",
+ "encoding_rs",
  "futures-core",
  "futures-util",
+ "h2",
  "http",
  "http-body",
  "http-body-util",
  "hyper",
+ "hyper-rustls",
  "hyper-tls",
  "hyper-util",
  "ipnet",
···
  "once_cell",
  "percent-encoding",
  "pin-project-lite",
- "rustls-pemfile",
+ "quinn",
+ "rustls 0.23.27",
+ "rustls-pemfile 2.2.0",
+ "rustls-pki-types",
  "serde",
  "serde_json",
  "serde_urlencoded",
  "sync_wrapper",
+ "system-configuration",
  "tokio",
  "tokio-native-tls",
+ "tokio-rustls",
  "tokio-util",
  "tower",
  "tower-service",
···
  "wasm-bindgen",
  "wasm-bindgen-futures",
  "web-sys",
+ "webpki-roots 0.26.11",
  "windows-registry",
 ]
 
···
 ]
 
 [[package]]
+name = "ring"
+version = "0.16.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3053cf52e236a3ed746dfc745aa9cacf1b791d846bdaf412f60a8d7d6e17c8fc"
+dependencies = [
+ "cc",
+ "libc",
+ "once_cell",
+ "spin 0.5.2",
+ "untrusted 0.7.1",
+ "web-sys",
+ "winapi",
+]
+
+[[package]]
+name = "ring"
+version = "0.17.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "getrandom 0.2.16",
+ "libc",
+ "untrusted 0.9.0",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
 name = "rmp"
 version = "0.8.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 ]
 
 [[package]]
+name = "rouille"
+version = "3.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3716fbf57fc1084d7a706adf4e445298d123e4a44294c4e8213caf1b85fcc921"
+dependencies = [
+ "base64 0.13.1",
+ "brotli",
+ "chrono",
+ "deflate",
+ "filetime",
+ "multipart",
+ "percent-encoding",
+ "rand 0.8.5",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "sha1_smol",
+ "threadpool",
+ "time",
+ "tiny_http",
+ "url",
+]
+
+[[package]]
+name = "rsa"
+version = "0.9.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78928ac1ed176a5ca1d17e578a1825f3d81ca54cf41053a592584b020cfd691b"
+dependencies = [
+ "const-oid",
+ "digest",
+ "num-bigint-dig",
+ "num-integer",
+ "num-traits",
+ "pkcs1",
+ "pkcs8",
+ "rand_core 0.6.4",
+ "signature",
+ "spki",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
 name = "rusqlite"
 version = "0.32.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7753b721174eb8ff87a9a0e799e2d7bc3749323e773db92e0984debb00019d6e"
 dependencies = [
- "bitflags",
- "fallible-iterator",
+ "bitflags 2.9.0",
+ "fallible-iterator 0.3.0",
  "fallible-streaming-iterator",
  "hashlink 0.9.1",
  "libsqlite3-sys",
···
 checksum = "719b953e2095829ee67db738b3bfa9fa368c94900df327b3f07fe6e794d2fe1f"
 
 [[package]]
+name = "rustc-hash"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "357703d41365b4b27c590e3ed91eabb1b663f07c4c084095e60cbed4362dff0d"
+
+[[package]]
 name = "rustc_version"
 version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c71e83d6afe7ff64890ec6b71d6a69bb8a610ab78ce364b3352876bb4c801266"
 dependencies = [
- "bitflags",
+ "bitflags 2.9.0",
  "errno",
  "libc",
  "linux-raw-sys",
···
 ]
 
 [[package]]
+name = "rustls"
+version = "0.20.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b80e3dec595989ea8510028f30c408a4630db12c9cbb8de34203b89d6577e99"
+dependencies = [
+ "log",
+ "ring 0.16.20",
+ "sct",
+ "webpki",
+]
+
+[[package]]
+name = "rustls"
+version = "0.23.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "730944ca083c1c233a75c09f199e973ca499344a2b7ba9e755c457e86fb4a321"
+dependencies = [
+ "once_cell",
+ "ring 0.17.14",
+ "rustls-pki-types",
+ "rustls-webpki",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-pemfile"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5eebeaeb360c87bfb72e84abdb3447159c0eaececf1bef2aecd65a8be949d1c9"
+dependencies = [
+ "base64 0.13.1",
+]
+
+[[package]]
 name = "rustls-pemfile"
 version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "229a4a4c221013e7e1f1a043678c5cc39fe5171437c88fb47151a21e6f5b5c79"
 dependencies = [
+ "web-time",
  "zeroize",
+]
+
+[[package]]
+name = "rustls-webpki"
+version = "0.103.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e4a72fe2bcf7a6ac6fd7d0b9e5cb68aeb7d4c0a0271730218b3e92d43b4eb435"
+dependencies = [
+ "ring 0.17.14",
+ "rustls-pki-types",
+ "untrusted 0.9.0",
 ]
 
 [[package]]
···
 checksum = "28d3b2b1366ec20994f1fd18c3c594f05c5dd4bc44d8bb0c1c632c8d6829481f"
 
 [[package]]
+name = "safemem"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef703b7cb59335eae2eb93ceb664c0eb7ea6bf567079d843e09420219668e072"
+
+[[package]]
+name = "same-file"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93fc1dc3aaa9bfed95e02e6eadabb4baf7e3078b0bd1b4d7b6b0b68378900502"
+dependencies = [
+ "winapi-util",
+]
+
+[[package]]
 name = "schannel"
 version = "0.1.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 ]
 
 [[package]]
+name = "scoped-futures"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b24aae2d0636530f359e9d5ef0c04669d11c5e756699b27a6a6d845d8329091"
+dependencies = [
+ "pin-project-lite",
+]
+
+[[package]]
 name = "scoped-tls"
 version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
+
+[[package]]
+name = "sct"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da046153aa2352493d6cb7da4b6e5c0c057d8a1d0a9aa8560baffdd945acd414"
+dependencies = [
+ "ring 0.17.14",
+ "untrusted 0.9.0",
+]
 
 [[package]]
 name = "sec1"
···
  "base16ct",
  "der",
  "generic-array",
+ "pkcs8",
+ "serdect",
  "subtle",
  "zeroize",
 ]
 
 [[package]]
+name = "secrecy"
+version = "0.10.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e891af845473308773346dc847b2c23ee78fe442e0472ac50e22a18a93d3ae5a"
+dependencies = [
+ "serde",
+ "zeroize",
+]
+
+[[package]]
 name = "security-framework"
 version = "2.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "897b2245f0b511c87893af39b033e5ca9cce68824c4d7e7630b5a1d339658d02"
 dependencies = [
- "bitflags",
+ "bitflags 2.9.0",
  "core-foundation",
  "core-foundation-sys",
  "libc",
···
 ]
 
 [[package]]
+name = "serde-value"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3a1a3341211875ef120e117ea7fd5228530ae7e7036a779fdc9117be6b3282c"
+dependencies = [
+ "ordered-float 2.10.1",
+ "serde",
+]
+
+[[package]]
 name = "serde_bytes"
 version = "0.11.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 ]
 
 [[package]]
+name = "serdect"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a84f14a19e9a014bb9f4512488d9829a68e04ecabffb0f9904cd1ace94598177"
+dependencies = [
+ "base16ct",
+ "serde",
+]
+
+[[package]]
+name = "sha1_smol"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbfa15b3dddfee50a0fff136974b3e1bde555604ba463834a7eb7deb6417705d"
+
+[[package]]
 name = "sha2"
 version = "0.10.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
  "cpufeatures",
  "digest",
 ]
+
+[[package]]
+name = "shadow_counted"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "65da48d447333cebe1aadbdd3662f3ba56e76e67f53bc46f3dd5f67c74629d6b"
 
 [[package]]
 name = "sharded-slab"
···
 checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
 dependencies = [
  "digest",
- "rand_core",
+ "rand_core 0.6.4",
 ]
+
+[[package]]
+name = "siphasher"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "56199f7ddabf13fe5074ce809e7d3f42b42ae711800501b5b16ea82ad029c39d"
 
 [[package]]
 name = "slab"
···
 
 [[package]]
 name = "spin"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e63cff320ae2c57904679ba7cb63280a3dc4613885beafb148ee7bf9aa9042d"
+
+[[package]]
+name = "spin"
 version = "0.9.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67"
+
+[[package]]
+name = "spki"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d"
+dependencies = [
+ "base64ct",
+ "der",
+]
 
 [[package]]
 name = "stable_deref_trait"
···
 checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"
 
 [[package]]
+name = "stringprep"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b4df3d392d81bd458a8a621b8bffbd2302a12ffe288a9d931670948749463b1"
+dependencies = [
+ "unicode-bidi",
+ "unicode-normalization",
+ "unicode-properties",
+]
+
+[[package]]
 name = "strsim"
 version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 ]
 
 [[package]]
+name = "syntect"
+version = "5.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "874dcfa363995604333cf947ae9f751ca3af4522c60886774c4963943b4746b1"
+dependencies = [
+ "bincode",
+ "bitflags 1.3.2",
+ "flate2",
+ "fnv",
+ "once_cell",
+ "onig",
+ "plist",
+ "regex-syntax 0.8.5",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "thiserror 1.0.69",
+ "walkdir",
+ "yaml-rust",
+]
+
+[[package]]
+name = "system-configuration"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c879d448e9d986b661742763247d3693ed13609438cf3d006f51f5368a5ba6b"
+dependencies = [
+ "bitflags 2.9.0",
+ "core-foundation",
+ "system-configuration-sys",
+]
+
+[[package]]
+name = "system-configuration-sys"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e1d1b10ced5ca923a1fcb8d03e96b8d3268065d724548c0211415ff6ac6bac4"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
 name = "tagptr"
 version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 ]
 
 [[package]]
+name = "threadpool"
+version = "1.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d050e60b33d41c19108b32cea32164033a9013fe3b46cbd4457559bfbf77afaa"
+dependencies = [
+ "num_cpus",
+]
+
+[[package]]
 name = "time"
 version = "0.3.41"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 dependencies = [
  "deranged",
  "itoa",
+ "libc",
  "num-conv",
+ "num_threads",
  "powerfmt",
  "serde",
  "time-core",
···
 ]
 
 [[package]]
+name = "tiny_http"
+version = "0.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "389915df6413a2e74fb181895f933386023c71110878cd0825588928e64cdc82"
+dependencies = [
+ "ascii",
+ "chunked_transfer",
+ "httpdate",
+ "log",
+ "rustls 0.20.9",
+ "rustls-pemfile 0.2.1",
+ "zeroize",
+]
+
+[[package]]
 name = "tinystr"
 version = "0.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 ]
 
 [[package]]
+name = "tokio-postgres"
+version = "0.7.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c95d533c83082bb6490e0189acaa0bbeef9084e60471b696ca6988cd0541fb0"
+dependencies = [
+ "async-trait",
+ "byteorder",
+ "bytes",
+ "fallible-iterator 0.2.0",
+ "futures-channel",
+ "futures-util",
+ "log",
+ "parking_lot",
+ "percent-encoding",
+ "phf",
+ "pin-project-lite",
+ "postgres-protocol",
+ "postgres-types",
+ "rand 0.9.1",
+ "socket2",
+ "tokio",
+ "tokio-util",
+ "whoami",
+]
+
+[[package]]
+name = "tokio-rustls"
+version = "0.26.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e727b36a1a0e8b74c376ac2211e40c2c8af09fb4013c60d910495810f008e9b"
+dependencies = [
+ "rustls 0.23.27",
+ "tokio",
+]
+
+[[package]]
 name = "tokio-util"
 version = "0.7.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "05ae329d1f08c4d17a59bed7ff5b5a769d062e64a62d34a3261b219e62cd5aae"
 dependencies = [
+ "indexmap 2.9.0",
  "serde",
  "serde_spanned",
  "toml_datetime",
···
  "serde_spanned",
  "toml_datetime",
  "toml_write",
- "winnow",
+ "winnow 0.7.10",
 ]
 
 [[package]]
···
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0fdb0c213ca27a9f57ab69ddb290fd80d970922355b83ae380b395d3986b8a2e"
 dependencies = [
- "bitflags",
+ "bitflags 2.9.0",
  "bytes",
  "futures-util",
  "http",
···
  "tower-layer",
  "tower-service",
  "tracing",
+ "uuid",
 ]
 
 [[package]]
···
 ]
 
 [[package]]
+name = "tracing-appender"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3566e8ce28cc0a3fe42519fc80e6b4c943cc4c8cef275620eb8dac2d3d4e06cf"
+dependencies = [
+ "crossbeam-channel",
+ "parking_lot",
+ "thiserror 1.0.69",
+ "time",
+ "tracing-subscriber",
+]
+
+[[package]]
 name = "tracing-attributes"
 version = "0.1.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 ]
 
 [[package]]
+name = "tracing-serde"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "704b1aeb7be0d0a84fc9828cae51dab5970fee5088f83d1dd7ee6f6246fc6ff1"
+dependencies = [
+ "serde",
+ "tracing-core",
+]
+
+[[package]]
 name = "tracing-subscriber"
 version = "0.3.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
  "nu-ansi-term",
  "once_cell",
  "regex",
+ "serde",
+ "serde_json",
  "sharded-slab",
  "smallvec",
  "thread_local",
  "tracing",
  "tracing-core",
  "tracing-log",
+ "tracing-serde",
 ]
 
 [[package]]
···
 checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
 
 [[package]]
+name = "twoway"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59b11b2b5241ba34be09c3cc85a36e56e48f9888862e19cedf23336d35316ed1"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
 name = "typenum"
 version = "1.18.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 version = "2.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "75b844d17643ee918803943289730bec8aac480150456169e647ed0b576ba539"
+
+[[package]]
+name = "unicode-bidi"
+version = "0.3.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c1cb5db39152898a79168971543b1cb5020dff7fe43c8dc468b0885f5e29df5"
 
 [[package]]
 name = "unicode-ident"
···
 checksum = "3b09c83c3c29d37506a3e260c08c03743a6bb66a9cd432c6934ab501a190571f"
 
 [[package]]
+name = "unicode-normalization"
+version = "0.1.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5033c97c4262335cded6d6fc3e5c18ab755e1a3dc96376350f3d8e9f009ad956"
+dependencies = [
+ "tinyvec",
+]
+
+[[package]]
+name = "unicode-properties"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e70f2a8b45122e719eb623c01822704c4e0907e7e426a05927e1a1cfff5b75d0"
+
+[[package]]
 name = "unicode-width"
 version = "0.1.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 checksum = "eb066959b24b5196ae73cb057f45598450d2c5f71460e98c49b738086eff9c06"
 
 [[package]]
+name = "unsynn"
+version = "0.0.26"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "14013db4ac11f92d4df4b56edb431eab9c1d9f7aee4791f3205b6a1119b83f54"
+dependencies = [
+ "mutants",
+ "proc-macro2",
+ "shadow_counted",
+]
+
+[[package]]
+name = "untrusted"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a156c684c91ea7d62626509bce3cb4e1d9ed5c4d978f7b4352658f96a4c26b4a"
+
+[[package]]
+name = "untrusted"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
+
+[[package]]
 name = "url"
 version = "2.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 checksum = "458f7a779bf54acc9f347480ac654f68407d3aab21269a6e3c9f922acd9e2da9"
 dependencies = [
  "getrandom 0.3.3",
+ "serde",
 ]
 
 [[package]]
···
 checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
 
 [[package]]
+name = "walkdir"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29790946404f91d9c5d06f9874efddea1dc06c5efe94541a7d6863108e3a5e4b"
+dependencies = [
+ "same-file",
+ "winapi-util",
+]
+
+[[package]]
 name = "want"
 version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 dependencies = [
  "wit-bindgen-rt",
 ]
+
+[[package]]
+name = "wasite"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8dad83b4f25e74f184f64c43b150b91efe7647395b42289f38e50566d82855b"
 
 [[package]]
 name = "wasm-bindgen"
···
  "atrium-oauth",
  "atrium-xrpc",
  "axum 0.8.4",
+ "chrono",
  "clap",
+ "dashmap",
  "diesel",
+ "diesel-async",
+ "diesel_migrations",
  "dotenvy",
+ "facet",
+ "hyper",
+ "jose",
+ "jose-jwk",
+ "kdl",
+ "merde",
+ "miette",
+ "minijinja",
+ "minijinja-contrib",
+ "reqwest",
+ "serde",
+ "serde_json",
+ "thiserror 2.0.12",
  "tokio",
+ "toml",
  "tower",
  "tower-cookies",
  "tower-http",
+ "tracing",
+ "tracing-appender",
+ "tracing-subscriber",
+ "uuid",
  "weaver-common",
  "weaver-workspace-hack",
 ]
···
  "hickory-resolver",
  "miette",
  "n0-future",
+ "rouille",
  "serde_html_form",
  "tokio",
  "weaver-common",
···
  "atrium-oauth",
  "atrium-xrpc",
  "atrium-xrpc-client",
+ "compact_string",
  "esquema-codegen",
  "hickory-resolver",
  "http",
+ "jose",
+ "jose-jwk",
  "libsqlite3-sys",
  "markdown-weaver",
  "merde",
···
  "minijinja",
  "n0-future",
  "owo-colors",
+ "reqwest",
  "serde",
  "serde_bytes",
  "serde_cbor",
···
 ]
 
 [[package]]
+name = "webpki"
+version = "0.22.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed63aea5ce73d0ff405984102c42de94fc55a6b75765d621c65262469b3c9b53"
+dependencies = [
+ "ring 0.17.14",
+ "untrusted 0.9.0",
+]
+
+[[package]]
+name = "webpki-roots"
+version = "0.26.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "521bc38abb08001b01866da9f51eb7c5d647a19260e00054a8c7fd5f9e57f7a9"
+dependencies = [
+ "webpki-roots 1.0.0",
+]
+
+[[package]]
+name = "webpki-roots"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2853738d1cc4f2da3a225c18ec6c3721abb31961096e9dbf5ab35fa88b19cfdb"
+dependencies = [
+ "rustls-pki-types",
+]
+
+[[package]]
+name = "whoami"
+version = "1.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6994d13118ab492c3c80c1f81928718159254c53c472bf9ce36f8dae4add02a7"
+dependencies = [
+ "redox_syscall",
+ "wasite",
+ "web-sys",
+]
+
+[[package]]
 name = "widestring"
 version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
+[[package]]
+name = "winapi-util"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf221c93e13a30d793f7645a0e7762c55d169dbb0a49671918a2319d289b10bb"
+dependencies = [
+ "windows-sys 0.59.0",
+]
 
 [[package]]
 name = "winapi-x86_64-pc-windows-gnu"
···
 
 [[package]]
 name = "winnow"
+version = "0.6.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8d71a593cc5c42ad7876e2c1fda56f314f3754c084128833e64f1345ff8a03a"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "winnow"
 version = "0.7.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c06928c8748d81b05c9be96aad92e1b6ff01833332f281e8cfca3be4b35fc9ec"
···
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6f42320e61fe2cfd34354ecb597f86f413484a798ba44a8ca1165c58d42da6c1"
 dependencies = [
- "bitflags",
+ "bitflags 2.9.0",
 ]
 
 [[package]]
···
 version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ea2f10b9bb0928dfb1b42b65e1f9e36f7f54dbdf08457afefb38afcdec4fa2bb"
+
+[[package]]
+name = "yaml-rust"
+version = "0.4.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "56c1936c4cc7a1c9ab21a1ebb602eb942ba868cbd44a99cb7cdc5892335e1c85"
+dependencies = [
+ "linked-hash-map",
+]
 
 [[package]]
 name = "yaml-rust2"
···
 checksum = "ced3678a2879b30306d323f4542626697a464a97c0a07c9aebf7ebca65cd4dde"
 dependencies = [
  "serde",
+ "zeroize_derive",
+]
+
+[[package]]
+name = "zeroize_derive"
+version = "1.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce36e65b0d2999d2aafac989fb249189a141aee1f53c612c1f37d72631959f69"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
 ]
 
 [[package]]

Cargo.toml

···
 
 minijinja = { version = "2.9.0", default-features = false }
 minijinja-contrib = { version = "2.9.0", default-features = false }
-miette = { version = "7.5.0" }
+miette = { version = "7.6" }
 owo-colors = { version = "4.2.0" }
 thiserror = "2.0"
 syntect = "5.2.0"

crates/weaver-appview/Cargo.toml

···
 license.workspace = true
 publish = false
 
+[features]
+default = []
+embedded-db = ["diesel/sqlite", "diesel-async/sync-connection-wrapper"]
+
 [dependencies]
-weaver-common = { path = "../weaver-common" }
+weaver-common = { path = "../weaver-common", default-features = false }
 weaver-workspace-hack = { version = "0.1", path = "../weaver-workspace-hack" }
 clap = { version = "4.5", features = ["derive", "env", "cargo", "unicode"] }
+dotenvy = "0.15"
+
+tracing = "0.1.40"
+tracing-subscriber = { version = "0.3.18", features = ["json", "env-filter"] }
+tracing-appender = { version = "0.2.3", features = ["parking_lot"] }
+
+chrono = "0.4.41"
+serde = { version = "1.0.210", features = ["derive"] }
+serde_json = "1.0.128"
+uuid = { version = "1.8.0", features = ["v7", "serde"] }
+merde.workspace = true
 
 axum = "0.8"
-tower = "0.5"
-tower-http = { version = "0.6", features = ["fs"] }
+hyper = "1.4.1"
+tower = { version = "0.5", features = [] }
 tower-cookies = "0.11"
+tower-http = { version = "0.6", features = [
+"fs",
+    "trace",
+    "timeout",
+    "request-id",
+    "cors",
+    "normalize-path",
+] }
 
+reqwest = { version = "0.12.7", default-features = false, features = [
+    "json",
+    "rustls-tls",
+] }
 
 tokio = { version = "1.44", features = ["full"] }
 atrium-oauth = "0.1.1"
···
 atrium-common = "0.1.1"
 atrium-identity = "0.1.3"
 
+miette = { workspace = true, features = ["fancy", "syntect-highlighter"] }
+thiserror = { workspace = true }
 
-diesel = { version = "2.2.0", features = ["sqlite", "returning_clauses_for_sqlite_3_35"] }
-# build libsqlite3 as part of the build process
-# uncomment this line if you run into setup issues
-# libsqlite3-sys = { version = "0.30", features = ["bundled"] }
-dotenvy = "0.15"
+diesel =  { version = "2.2.0", features = ["postgres", "serde_json","chrono"] }
+diesel-async = { version = "0.5.2", features = ["postgres", "deadpool"] }
+diesel_migrations = "2.2.0"
+facet = { workspace = true }
+
+kdl = "6.3.4"
+toml = { version = "0.8.22", features = ["preserve_order"] }
+jose = { version = "0.0.2", features = ["crypto-rustcrypto"] }
+jose-jwk = "0.1.2"
+
+minijinja = { version = "2.9.0" }
+minijinja-contrib = { version = "2.9.0" }
+dashmap = "6.1.0"

crates/weaver-appview/build.rs

···
+fn main() {
+    println!("cargo:rerun-if-changed=migrations");
+}

crates/weaver-appview/migrations/00000000000000_diesel_initial_setup/down.sql

···
+-- This file was automatically created by Diesel to setup helper functions
+-- and other internal bookkeeping. This file is safe to edit, any future
+-- changes will be added to existing projects as new migrations.
+
+DROP FUNCTION IF EXISTS diesel_manage_updated_at(_tbl regclass);
+DROP FUNCTION IF EXISTS diesel_set_updated_at();

crates/weaver-appview/migrations/00000000000000_diesel_initial_setup/up.sql

···
+-- This file was automatically created by Diesel to setup helper functions
+-- and other internal bookkeeping. This file is safe to edit, any future
+-- changes will be added to existing projects as new migrations.
+
+
+
+
+-- Sets up a trigger for the given table to automatically set a column called
+-- `updated_at` whenever the row is modified (unless `updated_at` was included
+-- in the modified columns)
+--
+-- # Example
+--
+-- ```sql
+-- CREATE TABLE users (id SERIAL PRIMARY KEY, updated_at TIMESTAMP NOT NULL DEFAULT NOW());
+--
+-- SELECT diesel_manage_updated_at('users');
+-- ```
+CREATE OR REPLACE FUNCTION diesel_manage_updated_at(_tbl regclass) RETURNS VOID AS $$
+BEGIN
+    EXECUTE format('CREATE TRIGGER set_updated_at BEFORE UPDATE ON %s
+                    FOR EACH ROW EXECUTE PROCEDURE diesel_set_updated_at()', _tbl);
+END;
+$$ LANGUAGE plpgsql;
+
+CREATE OR REPLACE FUNCTION diesel_set_updated_at() RETURNS trigger AS $$
+BEGIN
+    IF (
+        NEW IS DISTINCT FROM OLD AND
+        NEW.updated_at IS NOT DISTINCT FROM OLD.updated_at
+    ) THEN
+        NEW.updated_at := current_timestamp;
+    END IF;
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;

crates/weaver-appview/migrations/2025-05-15-230036_create_appviewdb/down.sql

···
+-- This file should undo anything in `up.sql`
+drop table if exists profile_pronouns;
+
+drop table if exists profile_links;
+
+drop table if exists profile;
+
+drop table if exists emails;
+
+drop table if exists _jetstream;
+
+drop table if exists follows;
+
+drop table if exists public_keys;
+
+drop table if exists registrations;
+
+drop table if exists oauth_sessions;
+
+drop table if exists oauth_requests;

crates/weaver-appview/migrations/2025-05-15-230036_create_appviewdb/up.sql

···
+create table if not exists registrations (
+  id serial primary key,
+  domain text not null unique,
+  did text not null,
+  secret text not null,
+  created timestamp
+  with
+    time zone not null default (now () at time zone 'utc'),
+    registered text
+);
+
+create table if not exists public_keys (
+  id serial primary key,
+  did text not null,
+  name text not null,
+  key_contents text not null,
+  rkey text not null,
+  created timestamp
+  with
+    time zone not null default (now () at time zone 'utc'),
+    unique (did, name, key_contents)
+);
+
+create table if not exists follows (
+  user_did text not null,
+  subject_did text not null,
+  rkey text not null,
+  followed_at timestamp
+  with
+    time zone not null default (now () at time zone 'utc'),
+    primary key (user_did, subject_did),
+    check (user_did <> subject_did)
+);
+
+create table if not exists _jetstream (
+  id serial primary key,
+  last_time_us integer not null
+);
+
+create table if not exists emails (
+  id serial primary key,
+  did text not null,
+  email text not null,
+  verified integer not null default 0,
+  verification_code text not null,
+  last_sent timestamp
+  with
+    time zone not null default (now () at time zone 'utc'),
+    is_primary integer not null default 0,
+    created timestamp
+  with
+    time zone not null default (now () at time zone 'utc'),
+    unique (did, email)
+);
+
+create table if not exists profile (
+  -- id
+  id serial primary key,
+  did text not null,
+  -- data
+  avatar text,
+  description text not null,
+  include_bluesky boolean not null default false,
+  include_tangled boolean not null default false,
+  location text,
+  pinned_post jsonb,
+  created_at timestamp
+  with
+    time zone default (now () at time zone 'utc'),
+    -- constraints
+    unique (did)
+);
+
+create table if not exists profile_links (
+  -- id
+  id serial primary key,
+  did text not null,
+  -- data
+  link text not null,
+  -- constraints
+  foreign key (did) references profile (did) on delete cascade
+);
+
+create table if not exists profile_pronouns (
+  -- id
+  id serial primary key,
+  did text not null,
+  -- data
+  pronoun text not null,
+  -- constraints
+  foreign key (did) references profile (did) on delete cascade
+);
+
+create table if not exists oauth_requests (
+  id serial primary key,
+  auth_server_iss text not null,
+  state text,
+  did text not null,
+  pkce_verifier text not null,
+  dpop_key jsonb not null
+);
+
+create table if not exists oauth_sessions (
+  id serial primary key,
+  did text not null,
+  pds_url text not null,
+  session jsonb not null,
+  expiry text
+);

crates/weaver-appview/src/api_error.rs

···
+use axum::{
+    Json,
+    extract::rejection::JsonRejection,
+    response::{IntoResponse, Response},
+};
+use hyper::StatusCode;
+use miette::Diagnostic;
+use serde::{Deserialize, Serialize};
+use thiserror::Error;
+use tracing::error;
+
+/// Custom error type for the API.
+/// The `#[from]` attribute allows for easy conversion from other error types.
+#[derive(Error, Debug, Diagnostic)]
+pub enum ApiError {
+    /// Converts from an Axum built-in extractor error.
+    #[diagnostic_source]
+    #[error("Invalid payload.")]
+    InvalidJsonBody(#[from] JsonRejection),
+
+    /// For errors that occur during manual validation.
+    #[error("Invalid request: {0}")]
+    #[diagnostic()]
+    InvalidRequest(String),
+
+    /// Converts from `sqlx::Error`.
+    #[error("A database error has occurred.")]
+    #[diagnostic_source]
+    DatabaseError(#[from] diesel::result::Error),
+
+    #[error("A Weaver error has occurred.")]
+    #[diagnostic(transparent)]
+    WeaverError(#[from] weaver_common::error::Error),
+    /// Converts from any `anyhow::Error`.
+    #[error("An internal server error has occurred.")]
+    #[diagnostic(transparent)]
+    InternalError(miette::Report),
+}
+
+impl From<miette::Report> for ApiError {
+    fn from(err: miette::Report) -> Self {
+        ApiError::InternalError(err)
+    }
+}
+
+#[derive(Serialize, Deserialize)]
+pub struct ApiErrorResp {
+    pub message: String,
+}
+
+// The IntoResponse implementation for ApiError logs the error message.
+//
+// To avoid exposing implementation details to API consumers, we separate
+// the message that we log from the API response message.
+impl IntoResponse for ApiError {
+    fn into_response(self) -> Response {
+        // Log detailed error for telemetry.
+        let error_to_log = match &self {
+            ApiError::InvalidJsonBody(err) => match err {
+                JsonRejection::JsonDataError(e) => e.body_text(),
+                JsonRejection::JsonSyntaxError(e) => e.body_text(),
+                JsonRejection::MissingJsonContentType(_) => {
+                    "Missing `Content-Type: application/json` header".to_string()
+                }
+                JsonRejection::BytesRejection(_) => "Failed to buffer request body".to_string(),
+                _ => "Unknown error".to_string(),
+            },
+            ApiError::InvalidRequest(_) => format!("{}", self),
+            ApiError::WeaverError(err) => format!("{}", err),
+            ApiError::DatabaseError(err) => format!("{}", err),
+            ApiError::InternalError(err) => format!("{}", err),
+        };
+        error!("{}", error_to_log);
+
+        // Create a generic response to hide specific implementation details.
+        let resp = ApiErrorResp {
+            message: self.to_string(),
+        };
+
+        // Determine the appropriate status code.
+        let status = match self {
+            ApiError::InvalidJsonBody(_) | ApiError::InvalidRequest(_) => StatusCode::BAD_REQUEST,
+            ApiError::WeaverError(_) | ApiError::DatabaseError(_) | ApiError::InternalError(_) => {
+                StatusCode::INTERNAL_SERVER_ERROR
+            }
+        };
+
+        (status, Json(resp)).into_response()
+    }
+}

crates/weaver-appview/src/config.rs

···
+use miette::miette;
+use serde::{Deserialize, Serialize};
+use std::{env, fs};
+
+#[derive(Deserialize, Serialize, Clone)]
+pub struct OauthConfig {
+    pub jwks: Vec<jose_jwk::Jwk>,
+}
+
+#[derive(Deserialize, Serialize, Clone)]
+pub struct JetstreamConfig {
+    pub endpoint: String,
+}
+
+impl Default for JetstreamConfig {
+    fn default() -> Self {
+        Self {
+            endpoint: "wss://jetstream1.us-east.bsky.network/subscribe".into(),
+        }
+    }
+}
+
+#[derive(Deserialize, Serialize, Clone)]
+pub struct CoreConfig {
+    pub db_path: String,
+    pub listen_addr: String,
+    pub appview_host: String,
+    pub cookie_secret: String,
+}
+
+impl Default for CoreConfig {
+    fn default() -> Self {
+        Self {
+            db_path: "postgres://postgres:@localhost/weaver_appview".into(),
+            listen_addr: "0.0.0.0:4000".into(),
+            appview_host: "https://appview.weaver.sh".into(),
+            cookie_secret: "00000000000000000000000000000000".into(),
+        }
+    }
+}
+
+#[derive(Deserialize, Serialize, Clone)]
+pub struct Config {
+    pub oauth: OauthConfig,
+    pub jetstream: JetstreamConfig,
+    pub core: CoreConfig,
+}
+
+impl Config {
+    pub fn load(config_file: &str) -> miette::Result<Config> {
+        let mut config_string = fs::read_to_string(config_file)
+            .map_err(|e| miette!("error reading config file {}", e))?;
+        // substitute environment variables in config file
+        for (k, v) in env::vars() {
+            config_string = config_string.replace(&format!("${}", k), &v);
+        }
+
+        Ok(toml::from_str(&config_string)
+            .map_err(|e| miette!("error parsing config file {}", e))?)
+    }
+}

crates/weaver-appview/src/db.rs

···
+use diesel::prelude::*;
+use diesel_migrations::{EmbeddedMigrations, MigrationHarness, embed_migrations};
+pub const MIGRATIONS: EmbeddedMigrations = embed_migrations!();
+use diesel_async::RunQueryDsl;
+use diesel_async::pooled_connection::AsyncDieselConnectionManager;
+use diesel_async::pooled_connection::deadpool::Pool;
+
+#[derive(Clone)]
+pub struct Db {
+    pub pool: Pool<diesel_async::AsyncPgConnection>,
+}
+
+impl Db {
+    /// Yes, this fuction can and WILL panic if it can't create the connection pool
+    /// for some reason. We just want to bail because the appview
+    /// does not work without a database.
+    pub async fn new(db_path: Option<String>) -> Self {
+        let database_url = if let Some(db_path) = db_path {
+            db_path
+        } else {
+            std::env::var("DATABASE_URL").expect("DATABASE_URL must be set")
+        };
+        let config =
+            AsyncDieselConnectionManager::<diesel_async::AsyncPgConnection>::new(database_url);
+        let pool = Pool::builder(config)
+            .build()
+            .expect("Failed to create pool");
+        Self { pool }
+    }
+}
+
+pub fn run_migrations(
+    db_path: Option<String>,
+) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
+    let database_url = if let Some(db_path) = db_path {
+        db_path
+    } else {
+        std::env::var("DATABASE_URL").expect("DATABASE_URL must be set")
+    };
+    let mut connection = PgConnection::establish(&database_url)
+        .unwrap_or_else(|_| panic!("Error connecting to {}", database_url));
+    // This will run the necessary migrations.
+    //
+    // See the documentation for `MigrationHarness` for
+    // all available methods.
+    println!("Attempting migrations...");
+    let result = connection.run_pending_migrations(MIGRATIONS);
+    println!("{:?}", result);
+    if result.is_err() {
+        println!("Failed to run migrations");
+        return result.map(|_| ());
+    }
+    println!("Migrations Applied:");
+    let applied_migrations = connection.applied_migrations()?;
+    for migration in applied_migrations {
+        println!("  * {}", migration);
+    }
+    Ok(())
+}

crates/weaver-appview/src/main.rs

···
-mod oauth;
+pub mod api_error;
+
+pub mod config;
+pub mod db;
+pub mod middleware;
+pub mod models;
+pub mod oauth;
+pub mod routes;
+pub mod schema;
+pub mod state;
+pub mod telemetry;
+
+use axum::Router;
+use clap::Parser;
+use config::*;
+use db::*;
+use diesel::prelude::*;
+use diesel_async::{AsyncConnection, AsyncPgConnection, RunQueryDsl};
+use dotenvy::dotenv;
+use miette::IntoDiagnostic;
+use miette::miette;
+use state::*;
+use std::env;
+
+use tokio::net::TcpListener;
+use tracing::{debug, error, info};
+
+#[derive(Parser)]
+#[command(author, version, about, long_about = None)]
+struct Cli {
+    #[arg(
+        short,
+        long,
+        value_name = "FILE",
+        default_value = "appview-config.toml"
+    )]
+    config: String,
+}
 
 #[tokio::main]
-async fn main() {}
+async fn main() -> miette::Result<()> {
+    let config = initialize()?;
+    // Run any migrations before we do anything else.
+    let db_path = config.core.db_path.clone();
+    let _ = tokio::task::spawn_blocking(|| db::run_migrations(Some(db_path)))
+        .await
+        .into_diagnostic()?;
+    let db = Db::new(Some(config.core.db_path.clone())).await;
+    debug!("Connected to database");
+    // Spin up our server.
+    info!("Starting server on {}", config.core.listen_addr);
+    let listener = TcpListener::bind(&config.core.listen_addr)
+        .await
+        .expect("Failed to bind address");
+    let router = router(config, db);
+    axum::serve(listener, router)
+        .await
+        .expect("Failed to start server");
+    Ok(())
+}
+
+pub fn router(cfg: Config, db: Db) -> Router {
+    let app_state = AppState::new(cfg, db);
+
+    // Middleware that adds high level tracing to a Service.
+    // Trace comes with good defaults but also supports customizing many aspects of the output:
+    // https://docs.rs/tower-http/latest/tower_http/trace/index.html
+    let trace_layer = telemetry::trace_layer();
+
+    // Sets 'x-request-id' header with randomly generated uuid v7.
+    let request_id_layer = middleware::request_id_layer();
+
+    // Propagates 'x-request-id' header from the request to the response.
+    let propagate_request_id_layer = middleware::propagate_request_id_layer();
+
+    // Layer that applies the Cors middleware which adds headers for CORS.
+    let cors_layer = middleware::cors_layer();
+
+    // Layer that applies the Timeout middleware, which sets a timeout for requests.
+    // The default value is 15 seconds.
+    let timeout_layer = middleware::timeout_layer();
+
+    // Any trailing slashes from request paths will be removed. For example, a request with `/foo/`
+    // will be changed to `/foo` before reaching the internal service.
+    let normalize_path_layer = middleware::normalize_path_layer();
+
+    // Create the router with the routes.
+    let router = routes::router();
+
+    // Combine all the routes and apply the middleware layers.
+    // The order of the layers is important. The first layer is the outermost layer.
+    Router::new()
+        .merge(router)
+        .layer(normalize_path_layer)
+        .layer(cors_layer)
+        .layer(timeout_layer)
+        .layer(propagate_request_id_layer)
+        .layer(trace_layer)
+        .layer(request_id_layer)
+        .with_state(app_state)
+}
+
+pub fn initialize() -> miette::Result<Config> {
+    miette::set_hook(Box::new(|_| {
+        Box::new(
+            miette::MietteHandlerOpts::new()
+                .terminal_links(true)
+                //.rgb_colors(miette::RgbColors::)
+                .with_cause_chain()
+                .with_syntax_highlighting(miette::highlighters::SyntectHighlighter::default())
+                .color(true)
+                .context_lines(5)
+                .tab_width(2)
+                .break_words(true)
+                .build(),
+        )
+    }))
+    .map_err(|e| miette!("Failed to set miette hook: {}", e))?;
+    miette::set_panic_hook();
+    dotenv().ok();
+    let cli = Cli::parse();
+    let config = config::Config::load(&cli.config);
+    let config = if let Err(e) = config {
+        error!("{}", e);
+        config::Config::load(
+            &env::var("APPVIEW_CONFIG").expect("Either set APPVIEW_CONFIG to the path to your config file, pass --config FILE to specify the path, or create a file called appview-config.toml in the directory where you are running the binary from."),
+        )
+        .map_err(|e| miette!(e))
+    } else {
+        config
+    }?;
+    let log_dir = env::var("LOG_DIR").unwrap_or_else(|_| "/tmp/appview".to_string());
+    std::fs::create_dir_all(&log_dir).unwrap();
+    let _guard = telemetry::setup_tracing(&log_dir);
+    Ok(config)
+}

crates/weaver-appview/src/middleware.rs

···
+use std::time::Duration;
+
+use axum::http::HeaderName;
+use hyper::Request;
+use tower_http::{
+    cors::{AllowHeaders, Any, CorsLayer},
+    normalize_path::NormalizePathLayer,
+    request_id::{MakeRequestId, PropagateRequestIdLayer, RequestId, SetRequestIdLayer},
+    timeout::TimeoutLayer,
+};
+
+#[derive(Clone, Default)]
+pub struct Id;
+
+impl MakeRequestId for Id {
+    fn make_request_id<B>(&mut self, _: &Request<B>) -> Option<RequestId> {
+        let id = uuid::Uuid::now_v7().to_string().parse().unwrap();
+        Some(RequestId::new(id))
+    }
+}
+
+/// Sets the 'x-request-id' header with a randomly generated UUID v7.
+///
+/// SetRequestId will not override request IDs if they are already present
+/// on requests or responses.
+pub fn request_id_layer() -> SetRequestIdLayer<Id> {
+    let x_request_id = HeaderName::from_static("x-request-id");
+    SetRequestIdLayer::new(x_request_id.clone(), Id)
+}
+
+// Propagates 'x-request-id' header from the request to the response.
+///
+/// PropagateRequestId wont override request ids if its already
+/// present on requests or responses.
+pub fn propagate_request_id_layer() -> PropagateRequestIdLayer {
+    let x_request_id = HeaderName::from_static("x-request-id");
+    PropagateRequestIdLayer::new(x_request_id)
+}
+
+/// Layer that applies the Cors middleware which adds headers for CORS.
+pub fn cors_layer() -> CorsLayer {
+    CorsLayer::new()
+        .allow_origin(Any)
+        .allow_methods(Any)
+        .allow_headers(AllowHeaders::mirror_request())
+        .max_age(Duration::from_secs(600))
+}
+
+/// Layer that applies the Timeout middleware which apply a timeout to requests.
+/// The default timeout value is set to 15 seconds.
+pub fn timeout_layer() -> TimeoutLayer {
+    TimeoutLayer::new(Duration::from_secs(15))
+}
+
+/// Middleware that normalizes paths.
+///
+/// Any trailing slashes from request paths will be removed. For example, a request with `/foo/`
+/// will be changed to `/foo` before reaching the inner service.
+pub fn normalize_path_layer() -> NormalizePathLayer {
+    NormalizePathLayer::trim_trailing_slash()
+}

crates/weaver-appview/src/models.rs

···
+use chrono::{DateTime, Utc};
+use diesel::prelude::*;
+
+#[derive(Queryable, Selectable)]
+#[diesel(table_name = crate::schema::profile)]
+pub struct Profile {
+    pub id: i32,
+    pub did: String,
+    pub avatar: Option<String>,
+    pub description: String,
+    pub include_bluesky: bool,
+    pub include_tangled: bool,
+    pub location: Option<String>,
+    pub pinned_post: Option<serde_json::Value>,
+    pub created_at: Option<DateTime<Utc>>,
+}
+
+#[derive(Queryable, Selectable)]
+#[diesel(table_name = crate::schema::registrations)]
+pub struct Registration {
+    pub id: i32,
+    pub domain: String,
+    pub did: String,
+    pub secret: String,
+    pub created: DateTime<Utc>,
+    pub registered: Option<String>,
+}
+
+#[derive(Queryable, Selectable)]
+#[diesel(table_name = crate::schema::public_keys)]
+pub struct PublicKey {
+    pub id: i32,
+    pub did: String,
+    pub name: String,
+    pub key_contents: String,
+    pub rkey: String,
+    pub created: DateTime<Utc>,
+}
+
+#[derive(Queryable, Selectable)]
+#[diesel(table_name = crate::schema::follows)]
+pub struct Follow {
+    pub user_did: String,
+    pub subject_did: String,
+    pub rkey: String,
+    pub followed_at: DateTime<Utc>,
+}
+
+#[derive(Queryable, Selectable)]
+#[diesel(table_name = crate::schema::_jetstream)]
+pub struct Jetstream {
+    pub id: i32,
+    pub last_time_us: i32,
+}
+
+#[derive(Queryable, Selectable)]
+#[diesel(table_name = crate::schema::emails)]
+pub struct Email {
+    pub id: i32,
+    pub did: String,
+    pub email: String,
+    pub verified: i32,
+    pub verification_code: String,
+    pub last_sent: DateTime<Utc>,
+    pub is_primary: i32,
+    pub created: DateTime<Utc>,
+}
+
+#[derive(Queryable, Selectable)]
+#[diesel(table_name = crate::schema::profile_links)]
+pub struct ProfileLink {
+    pub id: i32,
+    pub did: String,
+    pub link: String,
+}
+
+#[derive(Queryable, Selectable)]
+#[diesel(table_name = crate::schema::profile_pronouns)]
+pub struct ProfilePronoun {
+    pub id: i32,
+    pub did: String,
+    pub pronoun: String,
+}
+
+#[derive(Queryable, Selectable)]
+#[diesel(table_name = crate::schema::oauth_requests)]
+pub struct OauthRequest {
+    pub id: i32,
+    pub auth_server_iss: String,
+    pub state: Option<String>,
+    pub did: String,
+    pub pkce_verifier: String,
+    pub dpop_key: serde_json::Value,
+}
+
+#[derive(Queryable, Selectable, Insertable)]
+#[diesel(table_name = crate::schema::oauth_sessions)]
+pub struct OauthSession {
+    pub id: i32,
+    pub did: String,
+    pub pds_url: String,
+    pub session: serde_json::Value,
+    pub expiry: Option<String>,
+}

crates/weaver-appview/src/oauth.rs

···
+use atrium_api::types::string::Did;
+use atrium_identity::did::CommonDidResolver;
+use atrium_identity::handle::AtprotoHandleResolver;
+use atrium_oauth::DefaultHttpClient;
+use atrium_oauth::store::session::Session;
+use atrium_oauth::store::state::InternalStateData;
+use diesel::prelude::*;
+use diesel_async::RunQueryDsl;
+use jose_jwk::Key;
+use miette::IntoDiagnostic;
+use miette::Result;
+use miette::miette;
+use weaver_common::client::WeaverHttpClient;
+use weaver_common::oauth::WeaverOAuthClient;
+use weaver_common::resolver::HickoryDnsTxtResolver;
+
+use crate::api_error::ApiError;
+use crate::models::OauthRequest;
+use crate::models::OauthSession;
+
+/// Basic implementation of the atrium-common Store trait for a database using diesel-async and deadpool to store OAuth sessions.
+pub struct DBSessionStore {
+    pub db: crate::db::Db,
+}
+
+impl DBSessionStore {
+    pub fn new(db: &crate::db::Db) -> Self {
+        Self { db: db.clone() }
+    }
+
+    pub async fn get(&self, user_did: &Did) -> Result<Option<Session>> {
+        use crate::schema::oauth_sessions::dsl::*;
+        let mut conn = self.db.pool.get().await.into_diagnostic()?;
+
+        let results: Vec<OauthSession> = oauth_sessions
+            .filter(did.eq(user_did.as_str()))
+            .limit(1)
+            .select(OauthSession::as_select())
+            .load(&mut conn)
+            .await
+            .into_diagnostic()?;
+
+        if let Some(sess) = results.get(0) {
+            let sess: Option<Session> = serde_json::from_value(sess.session.clone()).ok();
+            Ok(sess)
+        } else {
+            Ok(None)
+        }
+    }
+
+    async fn set(&self, key: Did, value: Session) -> Result<()> {
+        use crate::schema::oauth_sessions::dsl::*;
+        let mut conn = self.db.pool.get().await.into_diagnostic()?;
+        // do an upsert or similar here?
+        let sess = OauthSession {
+            id: 0,
+            did: key.as_str().to_string(),
+            pds_url: value.token_set.aud.clone(),
+            session: serde_json::to_value(&value).unwrap(),
+            expiry: value.token_set.expires_at.map(|t| t.as_str().to_string()),
+        };
+
+        diesel::insert_into(oauth_sessions)
+            .values(&sess)
+            .execute(&mut conn)
+            .await
+            .into_diagnostic()?;
+
+        Ok(())
+    }
+
+    async fn del(&self, key: &Did) -> Result<()> {
+        use crate::schema::oauth_sessions::dsl::*;
+        let mut conn = self.db.pool.get().await.into_diagnostic()?;
+        let query = diesel::delete(oauth_sessions.filter(did.eq(key.as_str())));
+        query.execute(&mut conn).await.into_diagnostic()?;
+        Ok(())
+    }
+
+    async fn clear(&self) -> Result<()> {
+        Err(miette!(
+            "this would clear the whole fucking table in the database so nope!"
+        ))
+    }
+}
+
+impl atrium_common::store::Store<Did, Session> for DBSessionStore {
+    type Error = ApiError;
+
+    async fn get(&self, did: &Did) -> Result<Option<Session>, Self::Error> {
+        Ok(self.get(did).await?)
+    }
+
+    async fn set(&self, key: Did, value: Session) -> Result<(), Self::Error> {
+        Ok(self.set(key, value).await?)
+    }
+
+    async fn del(&self, key: &Did) -> Result<(), Self::Error> {
+        Ok(self.del(key).await?)
+    }
+
+    async fn clear(&self) -> Result<(), Self::Error> {
+        Ok(self.clear().await?)
+    }
+}
+
+impl atrium_oauth::store::session::SessionStore for DBSessionStore {}
+
+pub struct DBStateStore {
+    pub db: crate::db::Db,
+}
+
+impl DBStateStore {
+    pub fn new(db: &crate::db::Db) -> Self {
+        Self { db: db.clone() }
+    }
+
+    pub async fn get(&self, key: &str) -> Result<Option<InternalStateData>> {
+        use crate::schema::oauth_requests::dsl::*;
+        let mut conn = self.db.pool.get().await.into_diagnostic()?;
+
+        let results: Vec<OauthRequest> = oauth_requests
+            .filter(state.eq(key))
+            .limit(1)
+            .select(OauthRequest::as_select())
+            .load(&mut conn)
+            .await
+            .into_diagnostic()?;
+
+        if let Some(req) = results.get(0) {
+            if let Ok(key) = serde_json::from_value::<Key>(req.dpop_key.clone()) {
+                Ok(Some(InternalStateData {
+                    iss: req.auth_server_iss.clone(),
+                    dpop_key: key,
+                    verifier: req.pkce_verifier.clone(),
+                    app_state: req.state.clone(),
+                }))
+            } else {
+                Ok(None)
+            }
+        } else {
+            Ok(None)
+        }
+    }
+}
+
+impl atrium_common::store::Store<String, InternalStateData> for DBStateStore {
+    type Error = ApiError;
+
+    async fn get(&self, key: &String) -> Result<Option<InternalStateData>, Self::Error> {
+        Ok(self.get(key).await?)
+    }
+
+    async fn set(&self, key: String, value: InternalStateData) -> Result<(), Self::Error> {
+        todo!()
+    }
+
+    async fn del(&self, key: &String) -> Result<(), Self::Error> {
+        todo!()
+    }
+
+    async fn clear(&self) -> Result<(), Self::Error> {
+        todo!()
+    }
+}
+
+impl atrium_oauth::store::state::StateStore for DBStateStore {}
+
+pub type AppviewOAuthSession = atrium_oauth::OAuthSession<
+    DefaultHttpClient,
+    CommonDidResolver<WeaverHttpClient>,
+    AtprotoHandleResolver<HickoryDnsTxtResolver, WeaverHttpClient>,
+    DBSessionStore,
+>;
+
+pub type AppviewOAuthClient = WeaverOAuthClient<DBStateStore, DBSessionStore>;

crates/weaver-appview/src/routes/health_check.rs

···
+use axum::Json;
+use serde_json::{Value, json};
+
+use crate::api_error::ApiError;
+
+pub async fn health_check() -> Result<Json<Value>, ApiError> {
+    Ok(Json(json!({ "status": "ok" })))
+}

crates/weaver-appview/src/routes/login.rs

···
+use axum::Json;
+use serde_json::{Value, json};
+
+use crate::api_error::ApiError;

crates/weaver-appview/src/routes/logout.rs

···
+use axum::Json;
+use serde_json::{Value, json};
+
+use crate::api_error::ApiError;

crates/weaver-appview/src/routes/mod.rs

···
+use axum::{Router, routing::get};
+
+pub mod health_check;
+pub mod oauth;
+
+use crate::AppState;
+
+pub fn router() -> Router<AppState> {
+    Router::new().route("/health_check", get(health_check::health_check))
+}

crates/weaver-appview/src/routes/oauth.rs

···
+use atrium_oauth::{AuthorizeOptions, CallbackParams};
+use axum::{
+    Form, Json,
+    extract::{Query, State},
+};
+use hyper::StatusCode;
+use miette::{IntoDiagnostic, Result, miette};
+use serde_json::{Value, json};
+
+use crate::{api_error::ApiError, state::AppState};
+
+/// Passthrough callback for native endpoint
+pub async fn callback_native(
+    Query(params): Query<CallbackParams>,
+) -> Result<Json<Value>, ApiError> {
+    Ok(Json(json! ({
+        "code": params.code,
+        "iss": params.iss,
+        "state": params.state,
+    })))
+}
+
+pub async fn callback(
+    State(state): State<AppState>,
+    Query(params): Query<CallbackParams>,
+) -> Result<Json<Value>, ApiError> {
+    let oauth_client = state.oauth_client();
+    let active_sessions = state.active_sessions();
+    let (session, state) = oauth_client
+        .callback(params)
+        .await
+        .expect("oauth callback failed");
+    if let Some(ref state) = state {
+        active_sessions.insert(state.clone(), session);
+    }
+    Ok(Json(json!({
+        "status": "authenticated",
+        "state": state
+    })))
+}
+
+pub async fn get_client_metadata(State(state): State<AppState>) -> Result<Json<Value>, ApiError> {
+    let client_metadata = &state.oauth_client().client_metadata;
+
+    Ok(Json(serde_json::to_value(client_metadata).map_err(
+        |e| ApiError::InternalError(miette!("json serialization error: {e}")),
+    )?))
+}
+
+pub async fn get_jwks(State(state): State<AppState>) -> Result<Json<Value>, ApiError> {
+    let jwks = state.oauth_client().jwks();
+
+    Ok(Json(serde_json::to_value(jwks).map_err(|e| {
+        ApiError::InternalError(miette!("json serialization error: {e}"))
+    })?))
+}
+
+pub async fn login(State(state): State<AppState>) -> Result<Json<Value>, ApiError> {
+    Ok(Json(json!({ "status": "ok" })))
+}
+
+pub struct AuthorizeParams(String, AuthorizeOptions);
+
+pub async fn authorize(
+    State(state): State<AppState>,
+    Form(AuthorizeParams(endpoint, options)): Form<AuthorizeParams>,
+) -> Result<Json<Value>, ApiError> {
+    let url = state
+        .oauth_client()
+        .authorize(endpoint, options)
+        .await
+        .map_err(|e| ApiError::InternalError(miette!("oauth authorize error: {e}")))?;
+    Ok(Json(json!({ "url": url })))
+}
+
+pub async fn logout(State(state): State<AppState>) -> Result<Json<Value>, ApiError> {
+    Ok(Json(json!({ "status": "ok" })))
+}

crates/weaver-appview/src/schema.rs

···
+// @generated automatically by Diesel CLI.
+
+diesel::table! {
+    _jetstream (id) {
+        id -> Int4,
+        last_time_us -> Int4,
+    }
+}
+
+diesel::table! {
+    emails (id) {
+        id -> Int4,
+        did -> Text,
+        email -> Text,
+        verified -> Int4,
+        verification_code -> Text,
+        last_sent -> Timestamptz,
+        is_primary -> Int4,
+        created -> Timestamptz,
+    }
+}
+
+diesel::table! {
+    follows (user_did, subject_did) {
+        user_did -> Text,
+        subject_did -> Text,
+        rkey -> Text,
+        followed_at -> Timestamptz,
+    }
+}
+
+diesel::table! {
+    oauth_requests (id) {
+        id -> Int4,
+        auth_server_iss -> Text,
+        state -> Nullable<Text>,
+        did -> Text,
+        pkce_verifier -> Text,
+        dpop_key -> Jsonb,
+    }
+}
+
+diesel::table! {
+    oauth_sessions (id) {
+        id -> Int4,
+        did -> Text,
+        pds_url -> Text,
+        session -> Jsonb,
+        expiry -> Nullable<Text>,
+    }
+}
+
+diesel::table! {
+    profile (id) {
+        id -> Int4,
+        did -> Text,
+        avatar -> Nullable<Text>,
+        description -> Text,
+        include_bluesky -> Bool,
+        include_tangled -> Bool,
+        location -> Nullable<Text>,
+        pinned_post -> Nullable<Jsonb>,
+        created_at -> Nullable<Timestamptz>,
+    }
+}
+
+diesel::table! {
+    profile_links (id) {
+        id -> Int4,
+        did -> Text,
+        link -> Text,
+    }
+}
+
+diesel::table! {
+    profile_pronouns (id) {
+        id -> Int4,
+        did -> Text,
+        pronoun -> Text,
+    }
+}
+
+diesel::table! {
+    public_keys (id) {
+        id -> Int4,
+        did -> Text,
+        name -> Text,
+        key_contents -> Text,
+        rkey -> Text,
+        created -> Timestamptz,
+    }
+}
+
+diesel::table! {
+    registrations (id) {
+        id -> Int4,
+        domain -> Text,
+        did -> Text,
+        secret -> Text,
+        created -> Timestamptz,
+        registered -> Nullable<Text>,
+    }
+}
+
+diesel::allow_tables_to_appear_in_same_query!(
+    _jetstream,
+    emails,
+    follows,
+    oauth_requests,
+    oauth_sessions,
+    profile,
+    profile_links,
+    profile_pronouns,
+    public_keys,
+    registrations,
+);

crates/weaver-appview/src/state.rs

···
+use crate::oauth::AppviewOAuthClient;
+use dashmap::DashMap;
+
+use crate::config::Config;
+use crate::db::Db;
+use crate::oauth::{AppviewOAuthSession, DBSessionStore, DBStateStore};
+use std::sync::Arc;
+
+pub struct AppStateInner {
+    pub cfg: Config,
+    pub oauth_client: AppviewOAuthClient,
+    pub active_sessions: DashMap<String, AppviewOAuthSession>,
+}
+
+#[derive(Clone)]
+pub struct AppState {
+    pub db: Db,
+    inner: Arc<AppStateInner>,
+}
+
+impl AppState {
+    pub fn new(cfg: Config, db: Db) -> Self {
+        let oauth_client = weaver_common::oauth::oauth_client(
+            &cfg.core.appview_host,
+            Some(cfg.oauth.jwks.clone()),
+            DBSessionStore::new(&db),
+            DBStateStore::new(&db),
+        )
+        .unwrap();
+        Self {
+            db,
+            inner: Arc::new(AppStateInner {
+                cfg,
+                oauth_client,
+                active_sessions: DashMap::new(),
+            }),
+        }
+    }
+
+    pub fn cfg(&self) -> &Config {
+        &self.inner.as_ref().cfg
+    }
+
+    pub fn oauth_client(&self) -> &AppviewOAuthClient {
+        &self.inner.as_ref().oauth_client
+    }
+
+    pub fn active_sessions(&self) -> &DashMap<String, AppviewOAuthSession> {
+        &self.inner.as_ref().active_sessions
+    }
+}

crates/weaver-appview/src/telemetry.rs

···
+use tower_http::{
+    classify::{ServerErrorsAsFailures, SharedClassifier},
+    trace::{DefaultMakeSpan, DefaultOnRequest, DefaultOnResponse, TraceLayer},
+};
+use tracing::Level;
+use tracing_appender::{self, non_blocking, non_blocking::WorkerGuard, rolling::daily};
+use tracing_subscriber::{
+    EnvFilter,
+    fmt::{self, layer, writer::MakeWriterExt},
+    layer::SubscriberExt,
+    registry,
+    util::SubscriberInitExt,
+};
+/// The `EnvFilter` type is used to filter log events based on the value of an environment variable.
+/// In this case, we are using the `try_from_default_env` method to attempt to read the `RUST_LOG` environment variable,
+/// which is used to set the log level for the application.
+/// If the environment variable is not set, we default to the log level of `debug`.
+/// The `RUST_LOG` environment variable is set in the Dockerfile and .env files.
+pub fn setup_tracing<S: AsRef<str>>(logdir: S) -> WorkerGuard {
+    let (non_blocking_appender, guard) = non_blocking(daily(logdir.as_ref(), "general.log"));
+    let env_filter_layer = EnvFilter::try_from_default_env().unwrap_or_else(|_| {
+        format!(
+					"debug,{}=debug,tower_http=debug,axum=debug,hyper=debug,axum::rejection=trace,markdown=info",
+					env!("CARGO_PKG_NAME"),
+				).into()
+    });
+    let formatting_layer = fmt::layer().json();
+    tracing_subscriber::registry()
+        .with(env_filter_layer)
+        .with(formatting_layer)
+        .with(
+            layer()
+                .with_writer(std::io::stdout.with_max_level(Level::DEBUG))
+                .event_format(tracing_subscriber::fmt::format().pretty()),
+        )
+        .with(layer().with_writer(non_blocking_appender.with_max_level(Level::INFO)))
+        .init();
+    guard
+}
+
+/// Returns a `TraceLayer` for HTTP requests and responses.
+/// The `TraceLayer` is used to trace requests and responses in the application.
+pub fn trace_layer() -> TraceLayer<SharedClassifier<ServerErrorsAsFailures>> {
+    TraceLayer::new_for_http()
+        .make_span_with(DefaultMakeSpan::new().level(Level::INFO))
+        .on_request(DefaultOnRequest::new().level(Level::INFO))
+        .on_response(DefaultOnResponse::new().level(Level::INFO))
+}

crates/weaver-cli/Cargo.toml

···
 
 # temp for testing
 tokio = { version = "1.45.0", features = ["full"] }
+rouille = { version = "3.6.2", features = ["rustls"] }

crates/weaver-cli/src/main.rs

···
 use atrium_api::agent::Agent;
-use atrium_api::xrpc::http::Uri;
 use atrium_oauth::AuthorizeOptions;
+use atrium_oauth::CallbackParams;
 use atrium_oauth::KnownScope;
 use atrium_oauth::Scope;
-use std::{
-    error,
-    io::{BufRead, Write, stdin, stdout},
-};
+use rouille::Server;
+use std::error;
+use tokio::sync::mpsc;
 
 #[tokio::main]
 async fn main() -> Result<(), Box<dyn error::Error>> {
-    let client = weaver_common::oauth::default_oauth_client("https://appview.weaver.sh")?;
+    let (tx, mut rx) = mpsc::channel(5);
+    let server = Server::new("0.0.0.0:4000", move |request| {
+        create_callback_router(request, tx.clone())
+    })
+    .expect("Could not start server");
+    let (server_handle, server_stop) = server.stoppable();
+    let client = weaver_common::oauth::default_native_oauth_client()?;
     println!(
-        "Authorization url: {}",
+        "To authenticate with your PDS, visit:\r\n\t {}",
         client
             .authorize(
                 std::env::var("HANDLE").unwrap_or(String::from("https://atproto.systems")),
···
             .await?
     );
 
-    print!("Redirected url: ");
-    stdout().lock().flush()?;
-    let mut url = String::new();
-    stdin().lock().read_line(&mut url)?;
-
-    let uri = url.trim().parse::<Uri>()?;
-    let params = serde_html_form::from_str(uri.query().unwrap())?;
+    let params = rx.recv().await.unwrap();
     let (session, _) = client.callback(params).await?;
+    server_stop.send(()).expect("Failed to stop callbackserver");
     let agent = Agent::new(session);
     let output = agent
         .api
···
     for feed in &output.feed {
         println!("{feed:?}");
     }
+    server_handle.join().unwrap();
     Ok(())
 }
+
+pub fn create_callback_router(
+    request: &rouille::Request,
+    tx: mpsc::Sender<CallbackParams>,
+) -> rouille::Response {
+    rouille::router!(request,
+            (GET) (/oauth/callback) => {
+                let state = request.get_param("state").unwrap();
+                let code = request.get_param("code").unwrap();
+                let iss = request.get_param("iss").unwrap();
+                let callback_params = CallbackParams {
+                    state: Some(state),
+                    code,
+                    iss: Some(iss),
+                };
+                tx.try_send(callback_params).unwrap();
+                rouille::Response::text("Logged in!")
+            },
+            _ => rouille::Response::empty_404()
+    )
+}

crates/weaver-common/Cargo.toml

···
 atrium-xrpc-client = "0.5.13"
 atrium-lex = { workspace = true }
 
-merde = { workspace = true, features = ["yaml"] }
+merde = { workspace = true, features = ["yaml", "serde"] }
 serde = { workspace = true }
 serde_json = { version = "1.0.140", features = ["preserve_order", "raw_value"] }
 serde_ipld_dagcbor = { version = "0.6.1", features = ["codec"] }
···
 tracing = { workspace = true }
 hickory-resolver = "0.24.1"
 toml = "0.8.22"
+compact_string = "0.1.0"
+jose = { version = "0.0.2", features = ["crypto-rustcrypto"] }
+jose-jwk = "0.1.2"
+reqwest = "0.12.15"
 
 
 

crates/weaver-common/src/client.rs

···
+use atrium_api::app::bsky::actor::defs::ProfileViewDetailedData;
+use atrium_api::{agent::SessionManager, types::string::AtIdentifier};
+
+use crate::Error;
+
+pub struct WeaverHttpClient {
+    pub client: reqwest::Client,
+}
+
+impl atrium_xrpc::HttpClient for WeaverHttpClient {
+    async fn send_http(
+        &self,
+        request: atrium_xrpc::http::Request<Vec<u8>>,
+    ) -> core::result::Result<
+        atrium_xrpc::http::Response<Vec<u8>>,
+        Box<dyn std::error::Error + Send + Sync + 'static>,
+    > {
+        let response = self.client.execute(request.try_into()?).await?;
+        let mut builder = atrium_xrpc::http::Response::builder().status(response.status());
+        for (k, v) in response.headers() {
+            builder = builder.header(k, v);
+        }
+        builder
+            .body(response.bytes().await?.to_vec())
+            .map_err(Into::into)
+    }
+}
+
+impl Default for WeaverHttpClient {
+    fn default() -> Self {
+        Self {
+            client: reqwest::Client::new(),
+        }
+    }
+}
+
+pub struct WeaverAgent<M>
+where
+    M: SessionManager + Send + Sync,
+{
+    pub a: atrium_api::agent::Agent<M>,
+}
+
+impl<M> WeaverAgent<M>
+where
+    M: SessionManager + Send + Sync,
+{
+    pub fn new(session_manager: M) -> Self {
+        Self {
+            a: atrium_api::agent::Agent::new(session_manager),
+        }
+    }
+
+    pub async fn get_profile(&self, actor: AtIdentifier) -> Result<ProfileViewDetailedData, Error> {
+        use atrium_api::app::bsky::actor::get_profile::*;
+        let resp = self
+            .a
+            .api
+            .app
+            .bsky
+            .actor
+            .get_profile(ParametersData { actor }.into())
+            .await?;
+
+        Ok(resp.data)
+    }
+}

crates/weaver-common/src/compat.rs

···
+// This module contains compatability shims for the atrium_api crate.

crates/weaver-common/src/error.rs

···
+use atrium_api::xrpc::Error as XrpcError;
 use miette::{Diagnostic, NamedSource, SourceOffset, SourceSpan};
 use std::borrow::Cow;
 use std::fmt;
 
 #[derive(thiserror::Error, Debug, Diagnostic)]
 #[error("error(s) in weaver")]
-pub struct Error<E: fmt::Debug> {
+pub struct Error {
     #[related]
-    errors: Vec<WeaverErrorKind<E>>,
+    errors: Vec<WeaverErrorKind>,
 
     #[help]
     advice: Option<String>,
 }
 
 #[derive(thiserror::Error, Debug, Diagnostic)]
-pub enum WeaverErrorKind<E: fmt::Debug> {
+pub enum WeaverErrorKind {
     #[error(transparent)]
     #[diagnostic_source]
     ParseError(ParseError),
···
     TaskError(#[from] n0_future::task::JoinError),
     #[error(transparent)]
     #[diagnostic_source]
-    AtprotoError(#[from] AtprotoError<E>),
+    AtprotoError(#[from] AtprotoError),
     #[error(transparent)]
     #[diagnostic_source]
     NetworkError(#[from] NetworkError),
···
 
 #[derive(thiserror::Error, Debug, Diagnostic)]
 #[error("io error")]
-pub struct AtprotoError<E: fmt::Debug> {
+pub struct AtprotoError {
     #[diagnostic_source]
-    kind: AtprotoErrorKind<E>,
+    kind: AtprotoErrorKind,
 }
 
 #[derive(thiserror::Error, Debug, Diagnostic)]
···
     HttpClient(Box<dyn std::error::Error + Send + Sync + 'static>),
 }
 
+/// Generic error type for XRPC errors.
+#[derive(thiserror::Error, Debug, Diagnostic)]
+pub enum GenericXrpcError {
+    Response {
+        status: http::StatusCode,
+        error: Option<String>,
+    },
+    Other(String),
+}
+
+impl std::fmt::Display for GenericXrpcError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Self::Response { status, error } => {
+                write!(f, "{}", status.as_str())?;
+                let Some(error) = &error else {
+                    return Ok(());
+                };
+                if !error.is_empty() {
+                    write!(f, " {error}")?;
+                }
+            }
+            Self::Other(s) => {
+                write!(f, "{s}")?;
+            }
+        }
+        Ok(())
+    }
+}
+
+impl<E> From<XrpcError<E>> for Error
+where
+    E: fmt::Debug,
+{
+    fn from(err: XrpcError<E>) -> Self {
+        if let XrpcError::XrpcResponse(e) = err {
+            Self {
+                errors: vec![WeaverErrorKind::AtprotoError(AtprotoError {
+                    kind: AtprotoErrorKind::AtriumXrpc(GenericXrpcError::Response {
+                        status: e.status,
+                        error: e.error.map(|e| match e {
+                            atrium_xrpc::error::XrpcErrorKind::Custom(_) => {
+                                String::from("custom error")
+                            }
+                            atrium_xrpc::error::XrpcErrorKind::Undefined(res) => res.to_string(),
+                        }),
+                    }),
+                })],
+                advice: None,
+            }
+        } else {
+            Self {
+                errors: vec![WeaverErrorKind::AtprotoError(AtprotoError {
+                    kind: AtprotoErrorKind::AtriumCatchall(GenericXrpcError::Other(format!(
+                        "{:?}",
+                        err
+                    ))),
+                })],
+                advice: None,
+            }
+        }
+    }
+}
+
 #[derive(thiserror::Error, Debug, Diagnostic)]
 #[non_exhaustive]
-pub enum AtprotoErrorKind<E: fmt::Debug> {
+pub enum AtprotoErrorKind {
     #[error(transparent)]
     #[diagnostic_source]
     AtriumApi(#[from] atrium_api::error::Error),
     #[error("XRPC error: {:?}", .0)]
     #[diagnostic_source]
-    AtriumXrpc(atrium_api::xrpc::error::XrpcError<E>),
+    AtriumXrpc(GenericXrpcError),
     #[error("Authentication error: {:?}", .0)]
     #[diagnostic_source]
     Auth(http::HeaderValue),
···
     UnexpectedResponseType,
     #[error("Atrium error: {:?}", .0)]
     #[diagnostic_source]
-    AtriumCatchall(atrium_api::xrpc::Error<E>),
+    AtriumCatchall(GenericXrpcError),
 }
 
 #[derive(thiserror::Error, Debug, Diagnostic)]
···
             atrium_api::xrpc::error::Error::SerdeJson(e) => Ok(Self::from(e)),
             atrium_api::xrpc::error::Error::SerdeHtmlForm(e) => Ok(Self::from(e)),
             _ => Err(err),
-        }
-    }
-}
-
-impl<E> From<atrium_api::xrpc::error::Error<E>> for WeaverErrorKind<E>
-where
-    E: fmt::Debug,
-{
-    fn from(err: atrium_api::xrpc::error::Error<E>) -> Self {
-        use atrium_api::xrpc::error::Error::*;
-
-        match err {
-            Authentication(e) => {
-                let atp_err = AtprotoError {
-                    kind: AtprotoErrorKind::Auth(e),
-                };
-                Self::AtprotoError(atp_err)
-            }
-            UnexpectedResponseType => {
-                let atp_err = AtprotoError {
-                    kind: AtprotoErrorKind::UnexpectedResponseType,
-                };
-                Self::AtprotoError(atp_err)
-            }
-            XrpcResponse(e) => Self::AtprotoError(AtprotoError {
-                kind: AtprotoErrorKind::AtriumXrpc(e),
-            }),
-            HttpRequest(e) => Self::NetworkError(NetworkError::HttpRequest(e)),
-            HttpClient(e) => Self::NetworkError(NetworkError::HttpClient(e)),
-            SerdeJson(e) => Self::SerdeError(SerDeError::SDJson(e)),
-            SerdeHtmlForm(e) => Self::SerdeError(SerDeError::SerHtmlForm(e)),
         }
     }
 }

crates/weaver-common/src/lib.rs

···
 pub mod client;
+pub mod compat;
 pub mod config;
 pub mod error;
 pub mod lexicons;
···
 
 pub use crate::error::{Error, IoError, ParseError, SerDeError};
 
-/// Canonical Cow for us, thanks Amos
 pub use merde::CowStr;
-
 /// too many cows, so we have conversions
 pub fn mcow_to_cow(cow: CowStr<'_>) -> std::borrow::Cow<'_, str> {
     match cow {

crates/weaver-common/src/oauth.rs

···
     did::{CommonDidResolver, CommonDidResolverConfig, DEFAULT_PLC_DIRECTORY_URL},
     handle::{AtprotoHandleResolver, AtprotoHandleResolverConfig},
 };
+
 #[cfg(not(feature = "dev"))]
-use atrium_oauth::AtprotoClientMetadata;
-#[cfg(feature = "dev")]
-use atrium_oauth::AtprotoLocalhostClientMetadata;
+use atrium_oauth::{AtprotoClientMetadata, GrantType};
+use atrium_oauth::{
+    AtprotoLocalhostClientMetadata, AuthorizeOptions, CallbackParams, OAuthSession,
+    store::{session::SessionStore, state::StateStore},
+};
 use atrium_oauth::{
     DefaultHttpClient, KnownScope, OAuthClient, OAuthClientConfig, OAuthResolverConfig, Scope,
     store::{
···
 
 use std::sync::Arc;
 
-use crate::resolver::HickoryDnsTxtResolver;
+use crate::{client::WeaverHttpClient, resolver::HickoryDnsTxtResolver};
+
+pub struct NativeOAuthClient {
+    oauth: NativeBasicOAuthClient,
+    pub http_client: Arc<WeaverHttpClient>,
+}
+
+impl NativeOAuthClient {
+    pub async fn authorize(
+        &self,
+        input: impl AsRef<str>,
+        options: AuthorizeOptions,
+    ) -> Result<String, atrium_oauth::Error> {
+        self.oauth.authorize(input, options).await
+    }
+
+    pub async fn callback(
+        &self,
+        params: CallbackParams,
+    ) -> Result<(NativeBasicOAuthSession, Option<String>), atrium_oauth::Error> {
+        self.oauth.callback(params).await
+    }
+}
+
+pub type NativeBasicOAuthSession = OAuthSession<
+    DefaultHttpClient,
+    CommonDidResolver<WeaverHttpClient>,
+    AtprotoHandleResolver<HickoryDnsTxtResolver, WeaverHttpClient>,
+    MemoryStore<Did, Session>,
+>;
+
+pub type NativeBasicOAuthClient = atrium_oauth::OAuthClient<
+    MemoryStore<String, InternalStateData>,
+    MemoryStore<Did, Session>,
+    CommonDidResolver<WeaverHttpClient>,
+    AtprotoHandleResolver<HickoryDnsTxtResolver, WeaverHttpClient>,
+    DefaultHttpClient,
+>;
+
+pub type BasicOAuthClient = atrium_oauth::OAuthClient<
+    MemoryStore<String, InternalStateData>,
+    MemoryStore<Did, Session>,
+    CommonDidResolver<WeaverHttpClient>,
+    AtprotoHandleResolver<HickoryDnsTxtResolver, WeaverHttpClient>,
+    DefaultHttpClient,
+>;
+
+pub type WeaverOAuthClient<STATE, SESS> = atrium_oauth::OAuthClient<
+    STATE,
+    SESS,
+    CommonDidResolver<WeaverHttpClient>,
+    AtprotoHandleResolver<HickoryDnsTxtResolver, WeaverHttpClient>,
+    DefaultHttpClient,
+>;
+
+pub fn oauth_client<STATE, SESS>(
+    url: impl AsRef<str>,
+    jwks: Option<Vec<jose_jwk::Jwk>>,
+    session_store: SESS,
+    state_store: STATE,
+) -> Result<WeaverOAuthClient<STATE, SESS>, atrium_oauth::Error>
+where
+    STATE: StateStore + Send + Sync + 'static,
+    SESS: SessionStore + Send + Sync + 'static,
+    STATE::Error: std::error::Error + Send + Sync + 'static,
+    SESS::Error: std::error::Error + Send + Sync + 'static,
+{
+    let http_client = Arc::new(WeaverHttpClient::default());
+    let config = OAuthClientConfig {
+        client_metadata: default_client_metadata(url.as_ref()),
+        keys: jwks.into(),
+        resolver: OAuthResolverConfig {
+            did_resolver: CommonDidResolver::new(CommonDidResolverConfig {
+                plc_directory_url: DEFAULT_PLC_DIRECTORY_URL.to_string(),
+                http_client: Arc::clone(&http_client),
+            }),
+            handle_resolver: AtprotoHandleResolver::new(AtprotoHandleResolverConfig {
+                dns_txt_resolver: HickoryDnsTxtResolver::default(),
+                http_client: Arc::clone(&http_client),
+            }),
+            authorization_server_metadata: Default::default(),
+            protected_resource_metadata: Default::default(),
+        },
+        state_store,
+        session_store,
+    };
+    let client = OAuthClient::new(config)?;
+    Ok(client)
+}
 
 pub fn default_oauth_client(
     url: impl AsRef<str>,
-) -> Result<
-    atrium_oauth::OAuthClient<
-        MemoryStore<String, InternalStateData>,
-        MemoryStore<Did, Session>,
-        CommonDidResolver<DefaultHttpClient>,
-        AtprotoHandleResolver<HickoryDnsTxtResolver, DefaultHttpClient>,
-        DefaultHttpClient,
-    >,
-    atrium_oauth::Error,
-> {
-    let http_client = Arc::new(atrium_oauth::DefaultHttpClient::default());
-    let keys = if cfg!(feature = "dev") { None } else { todo!() };
+    jwks: Option<Vec<jose_jwk::Jwk>>,
+) -> Result<BasicOAuthClient, atrium_oauth::Error> {
+    let http_client = Arc::new(WeaverHttpClient::default());
     let config = OAuthClientConfig {
         client_metadata: default_client_metadata(url.as_ref()),
-        keys,
+        keys: jwks.into(),
         resolver: OAuthResolverConfig {
             did_resolver: CommonDidResolver::new(CommonDidResolverConfig {
                 plc_directory_url: DEFAULT_PLC_DIRECTORY_URL.to_string(),
···
     Ok(client)
 }
 
+pub fn default_native_oauth_client() -> Result<NativeOAuthClient, atrium_oauth::Error> {
+    let http_client = Arc::new(WeaverHttpClient::default());
+    let config = OAuthClientConfig {
+        client_metadata: default_native_client_metadata(),
+        keys: None,
+        resolver: OAuthResolverConfig {
+            did_resolver: CommonDidResolver::new(CommonDidResolverConfig {
+                plc_directory_url: DEFAULT_PLC_DIRECTORY_URL.to_string(),
+                http_client: Arc::clone(&http_client),
+            }),
+            handle_resolver: AtprotoHandleResolver::new(AtprotoHandleResolverConfig {
+                dns_txt_resolver: HickoryDnsTxtResolver::default(),
+                http_client: Arc::clone(&http_client),
+            }),
+            authorization_server_metadata: Default::default(),
+            protected_resource_metadata: Default::default(),
+        },
+        state_store: MemoryStateStore::default(),
+        session_store: MemorySessionStore::default(),
+    };
+    let client = NativeOAuthClient {
+        oauth: OAuthClient::new(config)?,
+        http_client: Arc::clone(&http_client),
+    };
+    Ok(client)
+}
+
 #[cfg(feature = "dev")]
 pub fn default_client_metadata(_host: &str) -> AtprotoLocalhostClientMetadata {
     AtprotoLocalhostClientMetadata {
···
 #[cfg(not(feature = "dev"))]
 pub fn default_client_metadata(host: &str) -> AtprotoClientMetadata {
     AtprotoClientMetadata {
-        client_id: host.to_string(),
-        redirect_uris: make_redirect_uris(host),
-        scopes: make_scopes(),
-        token_endpoint_auth_method: AuthMethod::PrivateKeyJwt,
+        client_id: format!("{}/oauth/client-metadata.json", host),
+        client_uri: Some(host.to_string()),
+        jwks_uri: Some(format!("{}/oauth/jwks.json", host)),
+        redirect_uris: make_redirect_uris(host).unwrap(),
+        scopes: make_scopes().unwrap(),
+        token_endpoint_auth_method: atrium_oauth::AuthMethod::PrivateKeyJwt,
         grant_types: vec![GrantType::AuthorizationCode, GrantType::RefreshToken],
         token_endpoint_auth_signing_alg: Some(String::from("ES256")),
     }
 }
 
+pub fn default_native_client_metadata() -> AtprotoLocalhostClientMetadata {
+    AtprotoLocalhostClientMetadata {
+        redirect_uris: make_redirect_uris("http://127.0.0.1:4000"),
+        scopes: make_scopes(),
+    }
+}
+
 #[inline]
 fn make_redirect_uris(url: &str) -> Option<Vec<String>> {
     Some(vec![format!("{}/oauth/callback", url)])
 }
 
 #[inline]
-fn make_scopes() -> Option<Vec<Scope>> {
+pub fn make_scopes() -> Option<Vec<Scope>> {
     Some(vec![
         Scope::Known(KnownScope::Atproto),
         Scope::Known(KnownScope::TransitionGeneric),

flake.nix

···
         NIX_LD = lib.fileContents "${pkgs.stdenv.cc}/nix-support/dynamic-linker";
 
         LD_LIBRARY_PATH = "$LD_LIBRARY_PATH:$NIX_LD_LIBRARY_PATH";
-        DATABASE_URL = "./.db/weaver.db";
+        DATABASE_URL = "postgres://postgres:@localhost/weaver_appview";
 
         # Additional dev-shell environment variables can be set directly
         # MY_CUSTOM_DEVELOPMENT_VAR = "something else";
···
           nixd
           alejandra
           diesel-cli
+          postgresql
+          cargo-watch
+          jq
         ];
       };
     });