update cli with new commands lexicon (pull, push), update oauth flows to use session id instead of only allowing one session at a time (whoops)

frontend/src/config.ts

···
 
 // OAuth setup
 const oauthStorage = new SQLiteOAuthStorage(DATABASE_URL);
-const oauthClient = new OAuthClient(
-  {
-    clientId: OAUTH_CLIENT_ID,
-    clientSecret: OAUTH_CLIENT_SECRET,
-    authBaseUrl: OAUTH_AIP_BASE_URL,
-    redirectUri: OAUTH_REDIRECT_URI,
-    scopes: [
-      "openid",
-      "email",
-      "profile",
-      "atproto",
-      "transition:generic",
-      "account:email",
-      "blob:image/*",
-      // "repo:network.slices.slice",
-      // "repo:network.slices.lexicon",
-      // "repo:network.slices.actor.profile",
-      // "repo:network.slices.waiting",
-    ],
-  },
-  oauthStorage
-);
+const oauthConfig = {
+  clientId: OAUTH_CLIENT_ID,
+  clientSecret: OAUTH_CLIENT_SECRET,
+  authBaseUrl: OAUTH_AIP_BASE_URL,
+  redirectUri: OAUTH_REDIRECT_URI,
+  scopes: [
+    "openid",
+    "email",
+    "profile",
+    "atproto",
+    "transition:generic",
+    "account:email",
+    "blob:image/*",
+    // "repo:network.slices.slice",
+    // "repo:network.slices.lexicon",
+    // "repo:network.slices.actor.profile",
+    // "repo:network.slices.waiting",
+  ],
+};
+
+// Export config and storage for creating session-scoped clients
+export { oauthConfig, oauthStorage };
 
 // Session setup (shared database)
 export const sessionStore = new SessionStore({
···
 });
 
 // OAuth + Session integration
-export const oauthSessions = withOAuthSession(sessionStore, oauthClient, {
-  autoRefresh: true,
-});
+export const oauthSessions = withOAuthSession(
+  sessionStore,
+  oauthConfig,
+  oauthStorage,
+  {
+    autoRefresh: true,
+  }
+);
 
-export const atprotoClient = new AtProtoClient(API_URL, SLICE_URI, oauthClient);
+// Helper function to create session-scoped OAuth client
+export function createOAuthClient(sessionId: string): OAuthClient {
+  return new OAuthClient(oauthConfig, oauthStorage, sessionId);
+}
+
+// Helper function to create authenticated AtProto client for a session
+export function createSessionClient(sessionId: string): AtProtoClient {
+  const sessionOAuthClient = createOAuthClient(sessionId);
+  return new AtProtoClient(API_URL!, SLICE_URI!, sessionOAuthClient);
+}
 
 // Public client for unauthenticated requests
 export const publicClient = new AtProtoClient(API_URL, SLICE_URI);

frontend/src/features/auth/handlers.tsx

···
 import type { Route } from "@std/http/unstable-route";
 import { withAuth } from "../../routes/middleware.ts";
-import { atprotoClient, oauthSessions, sessionStore } from "../../config.ts";
+import {
+  oauthSessions,
+  sessionStore,
+  oauthConfig,
+  oauthStorage,
+  publicClient,
+  createSessionClient,
+  createOAuthClient,
+} from "../../config.ts";
+import { OAuthClient } from "@slices/oauth";
 import { renderHTML } from "../../utils/render.tsx";
 import { LoginPage } from "./templates/LoginPage.tsx";
 import { SLICE_URI } from "../../config.ts";
···
 
     // Query for invites for this DID - using json field to query the record content
     const invitesResult =
-      await atprotoClient.network.slices.waitlist.invite.getRecords({
+      await publicClient.network.slices.waitlist.invite.getRecords({
         where: {
           slice: { eq: sliceUri },
           json: { contains: userDid },
···
 
     // Check if user is already on the waitlist - requests are created by the user so record.did is correct
     const requestsResult =
-      await atprotoClient.network.slices.waitlist.request.getRecords({
+      await publicClient.network.slices.waitlist.request.getRecords({
         where: {
           slice: { eq: sliceUri },
           json: { eq: userDid },
···
 
 async function handleOAuthAuthorize(req: Request): Promise<Response> {
   try {
-    // Clear any existing auth state before new login attempt
-    await atprotoClient.oauth?.logout();
-
     const formData = await req.formData();
     const loginHint = formData.get("loginHint") as string;
 
···
       return new Response("Missing login hint", { status: 400 });
     }
 
-    if (!atprotoClient.oauth) {
-      return new Response("OAuth client not configured", { status: 500 });
-    }
+    // Create a temporary OAuth client for the authorize flow
+    // We don't have a userId yet since this is the start of OAuth
+    const tempOAuthClient = new OAuthClient(
+      oauthConfig,
+      oauthStorage,
+      loginHint
+    );
 
-    const authResult = await atprotoClient.oauth.authorize({
+    const authResult = await tempOAuthClient.authorize({
       loginHint,
     });
 
···
       );
     }
 
-    if (!atprotoClient.oauth) {
-      return Response.redirect(
-        new URL(
-          "/login?error=" + encodeURIComponent("OAuth client not configured"),
-          req.url
-        ),
-        302
-      );
-    }
+    // Create a temporary OAuth client for callback
+    // We'll get the userId from the tokens
+    const tempOAuthClient = new OAuthClient(oauthConfig, oauthStorage, "temp");
 
-    // Exchange code for tokens - the OAuth client handles this internally
-    await atprotoClient.oauth.handleCallback({
-      code,
-      state,
-    });
+    // Exchange code for tokens
+    const tokens = await tempOAuthClient.handleCallback({ code, state });
 
-    // Create OAuth session with auto token management
-    const sessionId = await oauthSessions.createOAuthSession();
+    // Create OAuth session with tokens
+    const sessionId = await oauthSessions.createOAuthSession(tokens);
 
     if (!sessionId) {
       return Response.redirect(
···
     // Create session cookie
     const sessionCookie = sessionStore.createSessionCookie(sessionId);
 
-    // Get user info from OAuth session
+    // Create session-scoped OAuth client
+    const sessionOAuthClient = createOAuthClient(sessionId);
+    const sessionClient = createSessionClient(sessionId);
+
+    // Get user info from OAuth client
     let userInfo;
     try {
-      userInfo = await atprotoClient.oauth?.getUserInfo();
+      userInfo = await sessionOAuthClient.getUserInfo();
     } catch (error) {
       console.error("Failed to get user info:", error);
     }
···
       const { hasAccess, isOnWaitlist } = await checkUserAccess(userInfo.sub);
       if (!hasAccess) {
         // Clear OAuth session and redirect to waitlist page
-        await atprotoClient.oauth?.logout();
+        await sessionOAuthClient.logout();
 
         const errorCode = isOnWaitlist
           ? "already_on_waitlist"
···
     // Sync external collections first to ensure actor records are populated
     try {
       if (userInfo?.sub) {
-        await atprotoClient.network.slices.slice.syncUserCollections();
+        await sessionClient.network.slices.slice.syncUserCollections();
       }
     } catch (error) {
       console.error("Error during external collections sync:", error);
···
       try {
         // Check if user already has a profile record in our slice
         const existingProfile =
-          await atprotoClient.network.slices.actor.profile.getRecords({
+          await sessionClient.network.slices.actor.profile.getRecords({
             where: {
               did: { eq: userInfo.sub },
             },
···
           try {
             // Get their bsky profile data
             const bskyProfile =
-              await atprotoClient.app.bsky.actor.profile.getRecords({
+              await sessionClient.app.bsky.actor.profile.getRecords({
                 where: {
                   did: { eq: userInfo.sub },
                 },
···
           }
 
           // Create the profile record with the data using "self" as the rkey
-          await atprotoClient.network.slices.actor.profile.createRecord(
+          await sessionClient.network.slices.actor.profile.createRecord(
             profileData,
             true
           );
···
       return new Response("Missing handle", { status: 400 });
     }
 
-    // Clear any existing auth state
-    await atprotoClient.oauth?.logout();
-
-    if (!atprotoClient.oauth) {
-      return new Response("OAuth client not configured", { status: 500 });
-    }
+    // Create temporary OAuth client for waitlist flow
+    const tempOAuthClient = new OAuthClient(oauthConfig, oauthStorage, handle);
 
     // Store waitlist flag in state parameter
     const waitlistState = btoa(
···
     );
 
     // Initiate OAuth with minimal scope for waitlist, passing state directly
-    const authResult = await atprotoClient.oauth.authorize({
+    const authResult = await tempOAuthClient.authorize({
       loginHint: handle,
       scope: "atproto repo:network.slices.waitlist.request",
       state: waitlistState,
···
       console.error("Failed to decode waitlist state");
     }
 
-    if (!atprotoClient.oauth) {
-      return Response.redirect(
-        new URL("/waitlist?error=oauth_not_configured", req.url),
-        302
-      );
-    }
+    // Create temp session-scoped client for waitlist (not creating actual session)
+    const tempSessionId = "waitlist_" + Date.now();
+    const tempOAuthClient = new OAuthClient(
+      oauthConfig,
+      oauthStorage,
+      tempSessionId
+    );
 
     // Exchange code for tokens
-    await atprotoClient.oauth.handleCallback({ code, state });
+    const tokens = await tempOAuthClient.handleCallback({ code, state });
+
+    // Store tokens so we can fetch user info
+    await oauthStorage.setTokens(tokens, tempSessionId);
+
+    const sessionClient = createSessionClient(tempSessionId);
 
     // Get user info
-    const userInfo = await atprotoClient.oauth.getUserInfo();
+    const userInfo = await tempOAuthClient.getUserInfo();
 
     if (!userInfo) {
       return Response.redirect(
···
 
     // Create waitlist record
     try {
-      await atprotoClient.network.slices.waitlist.request.createRecord(
+      await sessionClient.network.slices.waitlist.request.createRecord(
         {
           slice: SLICE_URI!,
           createdAt: new Date().toISOString(),
···
 
       // Sync user collections to populate their Bluesky profile data
       try {
-        await atprotoClient.network.slices.slice.syncUserCollections();
+        await sessionClient.network.slices.slice.syncUserCollections();
       } catch (syncError) {
         console.error(
           "Failed to sync user collections for waitlist user:",
···
       console.error("Failed to create waitlist record:", error);
     }
 
-    // Clear OAuth session since this is just for waitlist
-    await atprotoClient.oauth?.logout();
+    // Clear temp OAuth session since this is just for waitlist
+    await tempOAuthClient.logout();
 
     // Redirect back to waitlist page with success parameter
     const handle = userInfo.name || waitlistData.handle || "user";

frontend/src/features/dashboard/handlers.tsx

···
 import { renderHTML } from "../../utils/render.tsx";
 import { hxRedirect } from "../../utils/htmx.ts";
 import { requireAuth, withAuth } from "../../routes/middleware.ts";
-import { atprotoClient, publicClient } from "../../config.ts";
+import { publicClient, createSessionClient } from "../../config.ts";
 import { DashboardPage } from "./templates/DashboardPage.tsx";
 import { CreateSliceDialog } from "./templates/fragments/CreateSliceDialog.tsx";
 import { getSliceActor, getSlicesForActor } from "../../lib/api.ts";
···
   const authResponse = requireAuth(context);
   if (authResponse) return authResponse;
 
-  const authInfo = await atprotoClient.oauth?.getAuthenticationInfo();
-  if (!authInfo?.isAuthenticated) {
+  if (!context.currentUser.sub) {
     return renderHTML(
       <CreateSliceDialog error="Session expired. Please log in again." />
     );
   }
+
+  // Create session-scoped client
+  const sessionClient = createSessionClient(context.currentUser.sessionId!);
 
   try {
     const formData = await req.formData();
···
     }
 
     try {
-      const recordData = {
+      const result = await sessionClient.network.slices.slice.createRecord({
         name: name.trim(),
         domain: domain.trim(),
         createdAt: new Date().toISOString(),
-      };
-
-      const result = await atprotoClient.network.slices.slice.createRecord(
-        recordData
-      );
+      });
 
       const uriParts = result.uri.split("/");
       const sliceRkey = uriParts[uriParts.length - 1];

frontend/src/features/settings/handlers.tsx

···
 import { renderHTML } from "../../utils/render.tsx";
 import { hxRedirect } from "../../utils/htmx.ts";
 import { requireAuth, withAuth } from "../../routes/middleware.ts";
-import { atprotoClient } from "../../config.ts";
+import { createSessionClient, publicClient } from "../../config.ts";
 import { buildAtUri } from "../../utils/at-uri.ts";
 import type { SocialSlicesActorProfile } from "../../client.ts";
 import { SettingsPage } from "./templates/SettingsPage.tsx";
···
     | undefined;
 
   try {
-    const profileRecord = await atprotoClient.network.slices.actor.profile
+    const profileRecord = await publicClient.network.slices.actor.profile
       .getRecord({
         uri: buildAtUri({
           did: context.currentUser.sub!,
···
       createdAt: new Date().toISOString(),
     };
 
+    // Create user-scoped client for write operations
+    const sessionClient = createSessionClient(context.currentUser.sessionId!);
+
     if (avatarFile && avatarFile.size > 0) {
       try {
         const arrayBuffer = await avatarFile.arrayBuffer();
 
-        const blobResult = await atprotoClient.uploadBlob({
+        const blobResult = await sessionClient.uploadBlob({
           data: arrayBuffer,
           mimeType: avatarFile.type,
         });
···
         throw new Error("User DID (sub) is required for profile operations");
       }
 
-      const existingProfile = await atprotoClient.network.slices.actor.profile
+      const existingProfile = await publicClient.network.slices.actor.profile
         .getRecord({
           uri: buildAtUri({
             did: context.currentUser.sub,
···
           updatedProfile.avatar = existingProfile.value.avatar;
         }
 
-        await atprotoClient.network.slices.actor.profile.updateRecord(
+        await sessionClient.network.slices.actor.profile.updateRecord(
           "self",
           updatedProfile,
         );
       } else {
-        await atprotoClient.network.slices.actor.profile.createRecord(
+        await sessionClient.network.slices.actor.profile.createRecord(
           profileData,
           true,
         );

frontend/src/features/slices/api-docs/handlers.tsx

···
   withSliceAccess,
 } from "../../../routes/slice-middleware.ts";
 import { extractSliceParams } from "../../../utils/slice-params.ts";
-import { atprotoClient } from "../../../config.ts";
+import { createOAuthClient } from "../../../config.ts";
 import { SliceApiDocsPage } from "./templates/SliceApiDocsPage.tsx";
 
 async function handleSliceApiDocsPage(
···
   const accessError = requireSliceAccess(context);
   if (accessError) return accessError;
 
-  // Get OAuth access token directly from OAuth client (clean separation)
+  // Get OAuth access token for the current user
   let accessToken: string | undefined;
-  try {
-    // Tokens are managed by @slices/oauth, not stored in sessions
-    const tokens = await atprotoClient.oauth?.ensureValidToken();
-    accessToken = tokens?.accessToken;
-  } catch (error) {
-    console.log("Could not get OAuth token:", error);
+  if (authContext.currentUser.sessionId) {
+    try {
+      const sessionOAuthClient = createOAuthClient(authContext.currentUser.sessionId);
+      const tokens = await sessionOAuthClient.ensureValidToken();
+      accessToken = tokens?.accessToken;
+    } catch (error) {
+      console.log("Could not get OAuth token:", error);
+    }
   }
 
   return renderHTML(

frontend/src/features/slices/jetstream/handlers.tsx

···
   withSliceAccess,
 } from "../../../routes/slice-middleware.ts";
 import { getSliceClient } from "../../../utils/client.ts";
-import { atprotoClient } from "../../../config.ts";
+import { publicClient } from "../../../config.ts";
 import { renderHTML } from "../../../utils/render.tsx";
 import { Layout } from "../../../shared/fragments/Layout.tsx";
 import { extractSliceParams } from "../../../utils/slice-params.ts";
···
     const handle = url.searchParams.get("handle");
     const isCompact = url.searchParams.get("compact") === "true";
 
-    // Fetch jetstream status using the atproto client
-    const data = await atprotoClient.network.slices.slice.getJetstreamStatus();
+    // Fetch jetstream status using the public client
+    const data = await publicClient.network.slices.slice.getJetstreamStatus();
 
     // Render compact version for logs page
     if (isCompact) {

frontend/src/features/slices/settings/handlers.tsx

···
 import type { Route } from "@std/http/unstable-route";
 import { withAuth } from "../../../routes/middleware.ts";
-import { atprotoClient } from "../../../config.ts";
+import { createSessionClient, publicClient } from "../../../config.ts";
 import { buildSliceUri } from "../../../utils/at-uri.ts";
 import { renderHTML } from "../../../utils/render.tsx";
 import { hxRedirect } from "../../../utils/htmx.ts";
···
     // Construct the URI for this slice
     const sliceUri = buildSliceUri(context.currentUser.sub!, sliceId);
 
-    // Get the current record first
-    const currentRecord = await atprotoClient.network.slices.slice.getRecord({
+    // Get the current record first (read operation, use public client)
+    const currentRecord = await publicClient.network.slices.slice.getRecord({
       uri: sliceUri,
     });
 
+    // Create user-scoped client for write operation
+    const sessionClient = createSessionClient(context.currentUser.sessionId!);
+
     // Update the record with new name and domain
-    await atprotoClient.network.slices.slice.updateRecord(sliceId, {
+    await sessionClient.network.slices.slice.updateRecord(sliceId, {
       ...currentRecord.value,
       name: name.trim(),
       domain: domain.trim(),
···
   }
 
   try {
+    // Create user-scoped client for delete operation
+    const sessionClient = createSessionClient(context.currentUser.sessionId!);
+
     // Delete the slice record from AT Protocol
-    await atprotoClient.network.slices.slice.deleteRecord(sliceId);
+    await sessionClient.network.slices.slice.deleteRecord(sliceId);
 
     return hxRedirect(`/profile/${context.currentUser.handle}`);
   } catch (_error) {

frontend/src/features/slices/sync/handlers.tsx

···
 import { requireAuth, withAuth } from "../../../routes/middleware.ts";
 import { getSliceClient } from "../../../utils/client.ts";
 import { buildSliceUri } from "../../../utils/at-uri.ts";
-import { atprotoClient } from "../../../config.ts";
+import { publicClient } from "../../../config.ts";
 import {
   requireSliceAccess,
   withSliceAccess,
···
 
     // Get slice info for domain comparison
     const sliceUri = buildSliceUri(context.currentUser.sub!, sliceId);
-    const sliceRecord = await atprotoClient.network.slices.slice.getRecord({
+    const sliceRecord = await publicClient.network.slices.slice.getRecord({
       uri: sliceUri,
     });
     const sliceDomain = sliceRecord.value.domain;

frontend/src/routes/middleware.ts

···
-import { atprotoClient, sessionStore } from "../config.ts";
+import { sessionStore, createSessionClient } from "../config.ts";
 import { recordBlobToCdnUrl } from "@slices/client";
 import { getSliceActor } from "../lib/api.ts";
 
 export interface AuthenticatedUser {
+  sessionId?: string;
   handle?: string;
   sub?: string;
   isAuthenticated: boolean;
···
   const currentUser = await sessionStore.getCurrentUser(req);
 
   // If user is authenticated, try to fetch their profile data
-  if (currentUser.isAuthenticated && currentUser.sub) {
+  if (currentUser.isAuthenticated && currentUser.sessionId && currentUser.sub) {
+    // Create session-scoped client
+    const sessionClient = createSessionClient(currentUser.sessionId);
+
     try {
       // Get the user's profile from network.slices.actor.profile
-      const profile = await getSliceActor(atprotoClient, currentUser.sub);
+      const profile = await getSliceActor(sessionClient, currentUser.sub);
       if (profile) {
         currentUser.displayName = profile.displayName;
         currentUser.avatar = profile.avatar;
···
     // Fallback to Bluesky profile for avatar if not found in slices profile
     if (!currentUser.avatar) {
       try {
-        const profileRecords = await atprotoClient.app.bsky.actor.profile
+        const profileRecords = await sessionClient.app.bsky.actor.profile
           .getRecords({
             where: {
               did: { eq: currentUser.sub },

frontend/src/utils/client.ts

···
 import { AtProtoClient } from "../client.ts";
-import { atprotoClient } from "../config.ts";
+import { createOAuthClient } from "../config.ts";
 import { buildAtUri } from "./at-uri.ts";
 
 interface AuthContext {
   currentUser: {
+    sessionId?: string;
     sub?: string;
   };
 }
···
   });
 
   // Use authenticated client if user is authenticated, otherwise public client
-  return context.currentUser.sub
-    ? new AtProtoClient(API_URL, sliceUri, atprotoClient.oauth)
-    : new AtProtoClient(API_URL, sliceUri);
+  if (context.currentUser.sessionId) {
+    const sessionOAuthClient = createOAuthClient(context.currentUser.sessionId);
+    return new AtProtoClient(API_URL, sliceUri, sessionOAuthClient);
+  } else {
+    return new AtProtoClient(API_URL, sliceUri);
+  }
 }

packages/cli/src/auth/config.ts

···
 
   async logout(): Promise<void> {
     await this.save({ auth: undefined });
-    logger.info("Logged out successfully");
+    console.log("Logged out successfully");
   }
 
   getAuthHeaders(): Record<string, string> {

packages/cli/src/auth/device_flow.ts

···
   const config = new ConfigManager();
   await config.load();
 
-  logger.step("🚀 Starting OAuth 2.0 Device Authorization Grant flow");
-  logger.info(`📡 AIP Server: ${aipBaseUrl}`);
-  logger.info(`🆔 Client ID: ${clientId}`);
-  logger.info(`📋 Scope: ${scope}`);
-
   try {
-    // Step 1: Request device authorization
-    logger.step("📤 Requesting device authorization...");
     const authResponse = await deviceClient.requestDeviceAuthorization(scope);
 
-    console.log("\n📱 Device Authorization Required");
-    console.log("━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━");
-    console.log(`📋 User Code: ${authResponse.user_code}`);
-    console.log(`🌐 Verification URL: ${authResponse.verification_uri}`);
+    console.log(`\n${authResponse.verification_uri_complete}`);
+    console.log(`Code: ${authResponse.user_code}\n`);
 
-    if (authResponse.verification_uri_complete) {
-      console.log(`🔗 Quick Link: ${authResponse.verification_uri_complete}`);
-      console.log("\n💡 Open the quick link above to skip manual code entry!");
+    const openCommand = Deno.build.os === "darwin"
+      ? `open "${authResponse.verification_uri_complete}"`
+      : Deno.build.os === "windows"
+      ? `start "${authResponse.verification_uri_complete}"`
+      : `xdg-open "${authResponse.verification_uri_complete}"`;
+
+    try {
+      await new Deno.Command(Deno.build.os === "darwin" ? "open" : Deno.build.os === "windows" ? "cmd" : "xdg-open", {
+        args: Deno.build.os === "windows"
+          ? ["/c", "start", authResponse.verification_uri_complete]
+          : [authResponse.verification_uri_complete],
+      }).output();
+    } catch {
+      console.log("Could not open browser automatically. Please open the link manually.\n");
     }
 
-    console.log(`⏰ Code expires in ${authResponse.expires_in} seconds`);
-    console.log("\n🎯 Next Steps:");
-    console.log(`   1. Open ${authResponse.verification_uri} in your browser`);
-    console.log(`   2. Enter the user code: ${authResponse.user_code}`);
-    console.log("   3. Complete the authentication process");
-    console.log("   4. Return here - the CLI will automatically detect completion\n");
-
-    // Step 2: Poll for access token
-    logger.step("🔄 Waiting for user authorization...");
     const tokenResponse = await deviceClient.pollForToken(
       authResponse.device_code,
       authResponse.interval || 5,
       authResponse.expires_in,
     );
 
-    logger.success("✅ Authentication Successful!");
-    logger.info(`🎫 Access Token: ${tokenResponse.access_token.slice(0, 8)}...${tokenResponse.access_token.slice(-8)}`);
-
-    if (tokenResponse.expires_in) {
-      logger.info(`⏰ Expires in: ${tokenResponse.expires_in} seconds`);
-    }
-
-    // Step 3: Get user info and save config
-    logger.step("🔍 Getting user information...");
     const userInfo: OAuthUserInfo = await deviceClient.getUserInfo(tokenResponse.access_token);
 
     const expiresAt = tokenResponse.expires_in
···
       },
     });
 
-    logger.success(`👤 Logged in as: ${userInfo.did}`);
-    logger.success("🎉 Device flow complete! You can now use the CLI to manage lexicons.");
+    console.log(`✓ Logged in as ${userInfo.did}`);
 
   } catch (error) {
     const err = error as Error;

packages/cli/src/commands/codegen.ts

···
     logger.error("--slice is required");
     if (!slicesConfig.slice) {
       logger.info(
-        "💡 Tip: Create a slices.json file with your slice URI to avoid passing --slice every time"
+        "Tip: Create a slices.json file with your slice URI to avoid passing --slice every time"
       );
     }
     console.log("\nRun 'slices codegen --help' for usage information.");
···
     logger.success(`Generated client: ${outputPath}`);
 
     if (!excludeSlices) {
-      logger.result("Includes network.slices XRPC client methods");
+      logger.info("Includes network.slices XRPC client methods");
     }
   } catch (error) {
     const err = error as Error;

packages/cli/src/commands/init.ts

···
   const projectName = parsed.name || parsed._[0] as string;
 
   if (!projectName) {
-    console.error("Error: Project name is required");
-    console.error("Usage: slices init <project-name> or slices init --name <project-name>");
+    logger.error("Project name is required");
+    console.log("Usage: slices init <project-name> or slices init --name <project-name>");
     Deno.exit(1);
   }
 
   // Validate project name
   if (!/^[a-zA-Z0-9_-]+$/.test(projectName)) {
-    console.error("Error: Project name can only contain letters, numbers, hyphens, and underscores");
+    logger.error("Project name can only contain letters, numbers, hyphens, and underscores");
     Deno.exit(1);
   }
 
···
   try {
     const stat = await Deno.stat(targetDir);
     if (stat.isDirectory) {
-      console.error(`Error: Directory '${projectName}' already exists`);
+      logger.error(`Directory '${projectName}' already exists`);
       Deno.exit(1);
     }
   } catch {
···
     // Extract embedded templates
     await extractEmbeddedTemplates(targetDir, projectName);
 
-    logger.info("✅ Project created successfully!");
+    logger.success(`Created project: ${projectName}`);
     console.log(`
-📁 Created project: ${projectName}
-
-🚀 Get started:
-   cd ${projectName}
-   cp .env.example .env
-   # Edit .env with your OAuth configuration
-   deno task dev
+Get started:
+  cd ${projectName}
+  cp .env.example .env
+  deno task dev
 
-📖 Documentation:
-   - README.md: Setup instructions
-   - CLAUDE.md: Architecture guide for AI assistance
-   - See /auth/login for OAuth implementation
-
-🔧 Available commands:
-   deno task dev      # Start development server
-   deno task start    # Start production server
-   deno fmt           # Format code
+Available commands:
+  deno task dev      Start development server
+  deno task start    Start production server
+  deno fmt           Format code
 `);
   } catch (error) {
     const err = error as Error;

packages/cli/src/commands/lexicon.ts

···
-import { importCommand } from "./lexicon/import.ts";
+import { pushCommand } from "./lexicon/push.ts";
+import { pullCommand } from "./lexicon/pull.ts";
 import { listCommand } from "./lexicon/list.ts";
 
 function showLexiconHelp() {
···
     slices lexicon <SUBCOMMAND> [OPTIONS]
 
 SUBCOMMANDS:
-    import      Import lexicon files to your slice
+    push        Push lexicon files to your slice
+    pull        Pull lexicon files from your slice
     list        List lexicons in your slice
     help        Show this help message
 
···
     -h, --help  Show help information
 
 EXAMPLES:
-    slices lexicon import --slice at://did:plc:example/slice
+    slices lexicon push --slice at://did:plc:example/slice
+    slices lexicon pull --slice at://did:plc:example/slice
     slices lexicon list --slice at://did:plc:example/slice
     slices lexicon help
 `);
···
 
   try {
     switch (subcommand) {
-      case "import":
-        await importCommand(subcommandArgs, globalArgs);
+      case "push":
+        await pushCommand(subcommandArgs, globalArgs);
+        break;
+      case "pull":
+        await pullCommand(subcommandArgs, globalArgs);
         break;
       case "list":
         await listCommand(subcommandArgs, globalArgs);

packages/cli/src/commands/lexicon/import.ts packages/cli/src/commands/lexicon/push.ts

···
 } from "../../utils/lexicon.ts";
 import type { LexiconDoc } from "@slices/lexicon";
 
-function showImportHelp() {
+function showPushHelp() {
   console.log(`
-slices lexicon import - Import lexicon files to your slice
+slices lexicon push - Push lexicon files to your slice
 
 USAGE:
-    slices lexicon import [OPTIONS]
+    slices lexicon push [OPTIONS]
 
 OPTIONS:
     --path <PATH>          Directory containing lexicon files (default: ./lexicons or from slices.json)
     --slice <SLICE_URI>    Target slice URI (required, or from slices.json)
+    --exclude-from-sync    Exclude these lexicons from sync (sets excludedFromSync: true)
     --validate-only        Only validate files, don't upload
     --dry-run             Show what would be imported without uploading
     --api-url <URL>       Slices API base URL (default: https://api.slices.network or from slices.json)
     -h, --help            Show this help message
 
 EXAMPLES:
-    slices lexicon import --slice at://did:plc:example/slice
-    slices lexicon import --path ./my-lexicons --slice at://did:plc:example/slice
-    slices lexicon import --validate-only --path ./lexicons
-    slices lexicon import --dry-run --slice at://did:plc:example/slice
-    slices lexicon import  # Uses config from slices.json
+    slices lexicon push --slice at://did:plc:example/slice
+    slices lexicon push --path ./my-lexicons --slice at://did:plc:example/slice
+    slices lexicon push --exclude-from-sync --slice at://did:plc:example/slice
+    slices lexicon push --validate-only --path ./lexicons
+    slices lexicon push --dry-run --slice at://did:plc:example/slice
+    slices lexicon push  # Uses config from slices.json
 `);
 }
 
···
   validationResult: LexiconValidationResult,
   sliceUri: string,
   client: AtProtoClient,
-  dryRun = false
+  dryRun = false,
+  excludeFromSync = false
 ): Promise<ImportStats> {
   const stats: ImportStats = {
     attempted: 0,
···
         nsid: nsid,
         definitions: JSON.stringify(lexicon.defs || lexicon.definitions),
         slice: sliceUri,
+        excludedFromSync: excludeFromSync,
       };
 
       if (existingRecord) {
···
 }
 
 
-export async function importCommand(commandArgs: unknown[], _globalArgs: Record<string, unknown>): Promise<void> {
+export async function pushCommand(commandArgs: unknown[], _globalArgs: Record<string, unknown>): Promise<void> {
   const args = parseArgs(commandArgs as string[], {
-    boolean: ["help", "validate-only", "dry-run"],
+    boolean: ["help", "validate-only", "dry-run", "exclude-from-sync"],
     string: ["path", "slice", "api-url"],
     alias: {
       h: "help",
···
   });
 
   if (args.help) {
-    showImportHelp();
+    showPushHelp();
     return;
   }
 
···
   if (!args["validate-only"] && !mergedConfig.slice) {
     logger.error("--slice is required unless using --validate-only");
     if (!slicesConfig.slice) {
-      logger.info("💡 Tip: Create a slices.json file with your slice URI to avoid passing --slice every time");
+      logger.info("Tip: Create a slices.json file with your slice URI to avoid passing --slice every time");
     }
-    console.log("\nRun 'slices lexicon import --help' for usage information.");
+    console.log("\nRun 'slices lexicon push --help' for usage information.");
     Deno.exit(1);
   }
 
···
   const apiUrl = mergedConfig.apiUrl!;
   const validateOnly = args["validate-only"] as boolean;
   const dryRun = args["dry-run"] as boolean;
+  const excludeFromSync = args["exclude-from-sync"] as boolean;
 
   const lexiconFiles = await findLexiconFiles(lexiconPath);
 
···
 
   if (validationResult.invalidFiles > 0) {
     printValidationSummary(validationResult);
-    logger.error("Please fix validation errors before importing");
+    logger.error("Please fix validation errors before pushing");
     Deno.exit(1);
   }
 
···
   }
 
   if (validationResult.validFiles === 0) {
-    logger.error("No valid lexicon files to import");
+    logger.error("No valid lexicon files to push");
     Deno.exit(1);
   }
 
···
     validationResult,
     sliceUri,
     client,
-    dryRun
+    dryRun,
+    excludeFromSync
   );
 
   if (importStats.failed > 0) {
···
   } else {
     const total = importStats.created + importStats.updated;
     if (total > 0) {
-      logger.success(`Imported ${total} lexicons (${importStats.created} created, ${importStats.updated} updated)`);
+      logger.success(`Pushed ${total} lexicons (${importStats.created} created, ${importStats.updated} updated)`);
     } else {
       logger.success("All lexicons up to date");
     }

packages/cli/src/commands/lexicon/pull.ts

···
+import { parseArgs } from "@std/cli/parse-args";
+import { join, dirname } from "@std/path";
+import { ensureDir } from "@std/fs";
+import type { AtProtoClient } from "../../generated_client.ts";
+import { ConfigManager } from "../../auth/config.ts";
+import { createAuthenticatedClient } from "../../utils/client.ts";
+import { logger } from "../../utils/logger.ts";
+import { SlicesConfigLoader, mergeConfig } from "../../utils/config.ts";
+
+function showPullHelp() {
+  console.log(`
+slices lexicon pull - Pull lexicon files from your slice
+
+USAGE:
+    slices lexicon pull [OPTIONS]
+
+OPTIONS:
+    --path <PATH>          Directory to save lexicon files (default: ./lexicons or from slices.json)
+    --slice <SLICE_URI>    Source slice URI (required, or from slices.json)
+    --nsid <PATTERN>      Filter lexicons by NSID pattern (supports wildcards with *)
+    --api-url <URL>       Slices API base URL (default: https://api.slices.network or from slices.json)
+    -h, --help            Show this help message
+
+EXAMPLES:
+    slices lexicon pull --slice at://did:plc:example/slice
+    slices lexicon pull --path ./my-lexicons --slice at://did:plc:example/slice
+    slices lexicon pull --nsid "app.bsky.*" --slice at://did:plc:example/slice
+    slices lexicon pull --nsid "app.bsky.actor.*" --slice at://did:plc:example/slice
+    slices lexicon pull  # Uses config from slices.json
+
+NOTE:
+    When using wildcards (*), wrap the pattern in quotes to prevent shell expansion
+`);
+}
+
+interface PullStats {
+  fetched: number;
+  written: number;
+  failed: number;
+  errors: Array<{ nsid: string; error: string }>;
+}
+
+function nsidToPath(nsid: string, basePath: string): string {
+  const parts = nsid.split(".");
+  const dirParts = parts.slice(0, -1);
+  const fileName = parts[parts.length - 1] + ".json";
+
+  return join(basePath, ...dirParts, fileName);
+}
+
+function matchesNsidPattern(nsid: string, pattern: string): boolean {
+  const regexPattern = pattern.replace(/\./g, "\\.").replace(/\*/g, ".*");
+  const regex = new RegExp(`^${regexPattern}$`);
+  return regex.test(nsid);
+}
+
+async function pullLexicons(
+  sliceUri: string,
+  lexiconPath: string,
+  client: AtProtoClient,
+  nsidPattern?: string
+): Promise<PullStats> {
+  const stats: PullStats = {
+    fetched: 0,
+    written: 0,
+    failed: 0,
+    errors: [],
+  };
+
+  try {
+    const response = await client.network.slices.lexicon.getRecords({
+      where: { slice: { eq: sliceUri } },
+      limit: 100,
+    });
+
+    stats.fetched = response.records.length;
+
+    for (const record of response.records) {
+      try {
+        const nsid = record.value.nsid;
+
+        if (nsidPattern && !matchesNsidPattern(nsid, nsidPattern)) {
+          continue;
+        }
+        const definitions = JSON.parse(record.value.definitions);
+
+        const lexiconDoc = {
+          lexicon: 1,
+          id: nsid,
+          defs: definitions,
+        };
+
+        const filePath = nsidToPath(nsid, lexiconPath);
+
+        await ensureDir(dirname(filePath));
+
+        await Deno.writeTextFile(
+          filePath,
+          JSON.stringify(lexiconDoc, null, 2) + "\n"
+        );
+
+        logger.info(`Wrote: ${filePath}`);
+        stats.written++;
+      } catch (error) {
+        const err = error as Error;
+        stats.failed++;
+        stats.errors.push({
+          nsid: record.value.nsid,
+          error: err.message,
+        });
+      }
+    }
+  } catch (error) {
+    const err = error as Error;
+    logger.error(`Failed to fetch lexicons: ${err.message}`);
+    throw error;
+  }
+
+  return stats;
+}
+
+export async function pullCommand(
+  commandArgs: unknown[],
+  _globalArgs: Record<string, unknown>
+): Promise<void> {
+  const args = parseArgs(commandArgs as string[], {
+    boolean: ["help"],
+    string: ["path", "slice", "api-url", "nsid"],
+    alias: {
+      h: "help",
+    },
+  });
+
+  if (args.help) {
+    showPullHelp();
+    return;
+  }
+
+  const configLoader = new SlicesConfigLoader();
+  const slicesConfig = await configLoader.load();
+  const mergedConfig = mergeConfig(slicesConfig, args);
+
+  if (!mergedConfig.slice) {
+    logger.error("--slice is required");
+    if (!slicesConfig.slice) {
+      logger.info(
+        "Tip: Create a slices.json file with your slice URI to avoid passing --slice every time"
+      );
+    }
+    console.log("\nRun 'slices lexicon pull --help' for usage information.");
+    Deno.exit(1);
+  }
+
+  const lexiconPath = mergedConfig.lexiconPath!;
+  const sliceUri = mergedConfig.slice!;
+  const apiUrl = mergedConfig.apiUrl!;
+  const nsidPattern = args.nsid as string | undefined;
+
+  const config = new ConfigManager();
+  await config.load();
+
+  if (!config.isAuthenticated()) {
+    logger.error("Not authenticated. Run 'slices login' first.");
+    Deno.exit(1);
+  }
+
+  const client = await createAuthenticatedClient(sliceUri, apiUrl);
+
+  const pullStats = await pullLexicons(
+    sliceUri,
+    lexiconPath,
+    client,
+    nsidPattern
+  );
+
+  if (pullStats.failed > 0) {
+    logger.warn(`${pullStats.failed} lexicons failed to write`);
+    for (const error of pullStats.errors) {
+      logger.error(`${error.nsid}: ${error.error}`);
+    }
+  }
+
+  if (pullStats.written > 0) {
+    const filterMsg = nsidPattern ? ` matching '${nsidPattern}'` : "";
+    logger.success(
+      `Pulled ${pullStats.written} lexicons${filterMsg} to ${lexiconPath}`
+    );
+  } else {
+    const filterMsg = nsidPattern ? ` matching '${nsidPattern}'` : "";
+    logger.info(`No lexicons found${filterMsg}`);
+  }
+}

packages/cli/src/commands/login.ts

···
   // Check if already authenticated
   if (!args.force && config.isAuthenticated()) {
     const authConfig = config.get().auth!;
-    logger.success("✅ Already authenticated!");
-    logger.info(`👤 User: ${authConfig.did}`);
-
-    if (authConfig.expiresAt) {
-      const expiresIn = Math.round((authConfig.expiresAt - Date.now()) / 1000);
-      if (expiresIn > 0) {
-        logger.info(`⏰ Token expires in: ${expiresIn} seconds`);
-      }
-    }
-
-    logger.info("💡 Use --force to login again");
+    console.log(`Already authenticated as ${authConfig.did}`);
+    console.log("Use --force to login again");
     return;
   }
 
···
   const scope = args.scope as string;
 
   if (args.force && config.isAuthenticated()) {
-    logger.info("🔄 Forcing re-authentication...");
     await config.logout();
   }
 

packages/cli/src/commands/status.ts

···
   const config = new ConfigManager();
   await config.load();
 
-  console.log("\n📊 Slices CLI Status");
-  console.log("━━━━━━━━━━━━━━━━━━━━");
-
   if (config.isAuthenticated()) {
     const authConfig = config.get().auth!;
 
-    logger.success("✅ Authentication Status: Authenticated");
-    logger.info(`👤 User DID: ${authConfig.did}`);
-    logger.info(`📡 AIP Server: ${authConfig.aipBaseUrl}`);
+    console.log(`Authenticated as ${authConfig.did}`);
+    console.log(`API: ${config.get().apiBaseUrl}`);
 
     if (authConfig.expiresAt) {
       const expiresIn = Math.round((authConfig.expiresAt - Date.now()) / 1000);
       if (expiresIn > 0) {
         const hours = Math.floor(expiresIn / 3600);
         const minutes = Math.floor((expiresIn % 3600) / 60);
-        const seconds = expiresIn % 60;
 
         if (hours > 0) {
-          logger.info(`⏰ Token expires in: ${hours}h ${minutes}m ${seconds}s`);
+          console.log(`Token expires in ${hours}h ${minutes}m`);
         } else if (minutes > 0) {
-          logger.info(`⏰ Token expires in: ${minutes}m ${seconds}s`);
+          console.log(`Token expires in ${minutes}m`);
         } else {
-          logger.info(`⏰ Token expires in: ${seconds}s`);
+          console.log(`Token expires in ${expiresIn}s`);
         }
       } else {
-        logger.warn("⚠️  Token has expired");
-        logger.info("💡 Run 'slices login' to re-authenticate");
+        console.log("Token has expired - run 'slices login' to re-authenticate");
       }
-    } else {
-      logger.info("⏰ Token expiration: Not specified");
-    }
-
-    if (authConfig.refreshToken) {
-      logger.info("🔄 Refresh token: Available");
-    } else {
-      logger.info("🔄 Refresh token: Not available");
     }
   } else {
-    logger.warn("❌ Authentication Status: Not authenticated");
-    logger.info("💡 Run 'slices login' to authenticate");
-  }
-
-  const fullConfig = config.get();
-  logger.info(`🌐 API Base URL: ${fullConfig.apiBaseUrl}`);
-
-  if (fullConfig.defaultSliceUri) {
-    logger.info(`📄 Default Slice: ${fullConfig.defaultSliceUri}`);
-  } else {
-    logger.info("📄 Default Slice: Not configured");
+    console.log("Not authenticated - run 'slices login' to authenticate");
   }
-
-  const configPath = `~/.config/slices/config.json`;
-  logger.info(`⚙️  Config file: ${configPath}`);
 }

packages/cli/src/mod.ts

···
 COMMANDS:
     init        Initialize a new Deno SSR project with OAuth
     login       Authenticate with Slices using device code flow
-    lexicon     Manage lexicons (import, list)
+    lexicon     Manage lexicons (push, pull, list)
     codegen     Generate TypeScript client from lexicon files
     status      Show authentication and configuration status
     help        Show this help message
···
 EXAMPLES:
     slices init my-app
     slices login
-    slices lexicon import --path ./lexicons --slice at://did:plc:example/slice
+    slices lexicon push --path ./lexicons --slice at://did:plc:example/slice
     slices lexicon list --slice at://did:plc:example/slice
     slices status
 `);

packages/cli/src/utils/logger.ts

···
 
   info(message: string, ...args: unknown[]) {
     if (this.level <= LogLevel.INFO) {
-      console.log("       ", message, ...args);
+      console.log("• ", message, ...args);
     }
   }
 
   warn(message: string, ...args: unknown[]) {
     if (this.level <= LogLevel.WARN) {
-      console.warn(yellow("  warn"), message, ...args);
+      console.warn(yellow("!"), message, ...args);
     }
   }
 
   error(message: string, ...args: unknown[]) {
     if (this.level <= LogLevel.ERROR) {
-      console.error(red("  error"), message, ...args);
+      console.error(red("✗"), message, ...args);
     }
   }
 
   success(message: string, ...args: unknown[]) {
-    console.log(green("  ✓"), message, ...args);
+    console.log(green("✓"), message, ...args);
   }
 
   step(message: string, ...args: unknown[]) {
-    console.log(cyan("  →"), message, ...args);
+    console.log(cyan("→"), message, ...args);
   }
 
   progress(message: string, current: number, total: number) {
···
 
   list(items: string[]) {
     items.forEach(item => {
-      console.log(`  • ${item}`);
+      console.log(`• ${item}`);
     });
   }
 

packages/client/src/mod.ts

···
 import type { OAuthClient } from "@slices/oauth";
 
 // Minimal auth interface that only requires what we actually use
+// AuthProvider should be a user-scoped instance (e.g., OAuthClient created with userId)
 export interface AuthProvider {
   ensureValidToken(): Promise<{ accessToken: string; tokenType?: string }>;
+  refreshAccessToken(): Promise<{ accessToken: string; tokenType?: string }>;
 }
 
 // Base interfaces
···
   indexedAt: string;
 }
 
-// Slice records parameters
-// These are internal interfaces not meant for export
-interface SliceRecordsParams<TSortField extends string = string> {
-  slice: string;
-  limit?: number;
-  cursor?: string;
-  where?: { [K in TSortField | IndexedRecordFields]?: WhereCondition };
-  orWhere?: { [K in TSortField | IndexedRecordFields]?: WhereCondition };
-  sortBy?: SortField<TSortField>[];
-}
-
 // Export these for use in generated clients
 export interface SliceLevelRecordsParams<TRecord = Record<string, unknown>> {
   slice: string;
···
   readonly sliceUri: string; // Make public so collection classes can access it
   protected readonly authProvider?: OAuthClient | AuthProvider;
 
-  constructor(baseUrl: string, sliceUri: string, authProvider?: OAuthClient | AuthProvider) {
+  constructor(
+    baseUrl: string,
+    sliceUri: string,
+    authProvider?: OAuthClient | AuthProvider
+  ) {
     this.baseUrl = baseUrl;
     this.sliceUri = sliceUri;
     this.authProvider = authProvider;
···
             "Authorization"
           ] = `${tokens.tokenType} ${tokens.accessToken}`;
         }
-      } catch (tokenError) {
+      } catch (_tokenError) {
         // For write operations, OAuth tokens are required (excluding read endpoints that use POST)
         const isReadEndpoint =
           endpoint.includes(".getRecords") ||
···
         !isReadEndpoint
       ) {
         try {
-          // Force token refresh by calling ensureValidToken again
-          await this.authProvider.ensureValidToken();
+          // Force token refresh by calling refreshAccessToken
+          await this.authProvider.refreshAccessToken();
           // Retry the request once with refreshed tokens
           return this.makeRequestWithRetry(endpoint, method, params, true);
         } catch (_refreshError) {
···
         } else if (errorBody?.error) {
           errorMessage += ` - ${errorBody.error}`;
         }
-
       } catch {
         // If we can't parse the response body, just use the status message
       }
···
     );
   }
 
+  async syncUserCollections<T = any>(params?: {
+    timeoutSeconds?: number;
+  }): Promise<T> {
+    const requestParams = { slice: this.sliceUri, ...params };
+    return await this.makeRequest<T>(
+      "network.slices.slice.syncUserCollections",
+      "POST",
+      requestParams
+    );
+  }
+
   async uploadBlob(request: UploadBlobRequest): Promise<UploadBlobResponse> {
     return this.uploadBlobWithRetry(request, false);
   }
···
       // Handle 401 Unauthorized - attempt token refresh and retry once
       if (response.status === 401 && !isRetry && this.authProvider) {
         try {
-          // Force token refresh by calling ensureValidToken again
-          await this.authProvider.ensureValidToken();
+          // Force token refresh by calling refreshAccessToken
+          await this.authProvider.refreshAccessToken();
           // Retry the request once with refreshed tokens
           return this.uploadBlobWithRetry(request, true);
         } catch (_refreshError) {

packages/oauth/README.md

···
 
 ### Standard OAuth Flow (Web Applications)
 
+OAuth clients are session-scoped. Each client instance is tied to a specific session ID, enabling proper multi-device support where each session has independent OAuth tokens.
+
 ```typescript
 import { OAuthClient, SQLiteOAuthStorage } from "@slices/oauth";
 
 // Set up storage
 const storage = new SQLiteOAuthStorage("oauth.db");
 
-// Create OAuth client
-const client = new OAuthClient({
+// OAuth configuration
+const config = {
   clientId: "your-client-id",
   clientSecret: "your-client-secret",
   authBaseUrl: "https://auth.example.com",
   redirectUri: "http://localhost:8000/oauth/callback",
   scopes: ["atproto"],
-}, storage);
+};
 
-// Start authorization flow
-const result = await client.authorize({ loginHint: "user.bsky.social" });
+// Start authorization flow (before we have a session)
+const tempClient = new OAuthClient(config, storage, "temp");
+const result = await tempClient.authorize({ loginHint: "user.bsky.social" });
 // Redirect user to result.authorizationUrl
 
 // Handle callback
-const tokens = await client.handleCallback({ code, state });
+const tokens = await tempClient.handleCallback({ code, state });
+
+// Create session and store tokens by sessionId
+// (typically done via @slices/session - see Session Integration below)
+const sessionId = "user-session-id"; // from session store
+const sessionClient = new OAuthClient(config, storage, sessionId);
+await storage.setTokens(tokens, sessionId);
+
+// Use the session-scoped client for API calls
+const userInfo = await sessionClient.getUserInfo();
+```
+
+### Session-Scoped Pattern
+
+The key concept: **one OAuth client per session**. This enables:
+- Multiple active sessions per user (different devices)
+- Independent token management per session
+- Proper logout isolation (logging out one device doesn't affect others)
+
+```typescript
+// Each session gets its own OAuth client
+function createSessionClient(sessionId: string) {
+  return new OAuthClient(config, storage, sessionId);
+}
+
+// Session 1 (laptop)
+const laptopClient = createSessionClient("session-laptop-123");
+
+// Session 2 (phone) - completely independent tokens
+const phoneClient = createSessionClient("session-phone-456");
 ```
 
 ### Device Authorization Grant (CLI Applications)
···
     try {
       const tokens = await this.client.pollForTokens(deviceAuth);
       console.log("✅ Authentication successful!");
+
+      // Get user info to find out who authenticated
+      const userInfo = await this.getUserInfo(tokens);
+      console.log("Authenticated as:", userInfo?.sub);
+
       return tokens;
     } catch (error) {
       if (error.message.includes("expired")) {
···
 
 ### Token Management
 
-Both OAuth flows support automatic token refresh:
+Both OAuth flows support automatic token refresh. The client handles token refresh automatically:
 
 ```typescript
-// Check if token needs refresh
-if (client.needsRefresh(tokens)) {
-  const newTokens = await client.refresh(tokens.refresh_token);
-  // Store the new tokens
-}
+// The client ensures tokens are valid before making requests
+const sessionClient = new OAuthClient(config, storage, sessionId);
 
-// Get user info
-const userInfo = await client.getUserInfo(tokens.access_token);
+// Automatically refreshes if needed
+const tokens = await sessionClient.ensureValidToken();
+
+// Get user info (automatically uses valid tokens)
+const userInfo = await sessionClient.getUserInfo();
 console.log("Authenticated as:", userInfo.sub);
+
+// Manual refresh if needed
+const refreshedTokens = await sessionClient.refreshAccessToken();
 ```
 
 ### Storage Backends
 
-The library provides pluggable storage backends:
+The library provides pluggable storage backends. All storage backends store tokens by `sessionId`:
 
 ```typescript
 // SQLite storage (persistent)
···
 
 // Deno KV storage (persistent)
 import { DenoKVOAuthStorage } from "@slices/oauth";
-const kvStorage = new DenoKVOAuthStorage();
+const kvStorage = new DenoKVOAuthStorage(await Deno.openKv());
 
-// In-memory storage (for testing)
-import { MemoryOAuthStorage } from "@slices/oauth";
-const memoryStorage = new MemoryOAuthStorage();
+// Use with OAuthClient (requires sessionId)
+const client = new OAuthClient(config, storage, sessionId);
+```
 
-// Use with OAuthClient
-const client = new OAuthClient(config, storage);
-```
+**Note:** Tokens are stored with `sessionId` as the key, enabling multiple independent sessions per user.

packages/oauth/src/client.ts

···
 export class OAuthClient {
   private config: OAuthConfig;
   private storage: OAuthStorage;
+  private sessionId: string;
   private refreshPromise?: Promise<void>;
-  private forceRefresh = false; // Flag to force refresh regardless of expiry
 
-  constructor(config: OAuthConfig, storage: OAuthStorage) {
+  constructor(config: OAuthConfig, storage: OAuthStorage, sessionId: string) {
     this.config = config;
     this.storage = storage;
+    this.sessionId = sessionId;
   }
 
   async authorize(params: {
···
     );
 
     const tokens = this.transformTokenResponse(tokenResponse);
-    await this.storage.setTokens(tokens);
+
     await this.storage.clearState(params.state);
 
     return tokens;
   }
 
   async refreshAccessToken(): Promise<OAuthTokens> {
-    const tokens = await this.storage.getTokens();
+    const tokens = await this.storage.getTokens(this.sessionId);
     if (!tokens?.refreshToken) {
       throw new Error("No refresh token available");
     }
···
       );
 
       const newTokens = this.transformTokenResponse(tokenResponse);
-      await this.storage.setTokens(newTokens);
+      await this.storage.setTokens(newTokens, this.sessionId);
       return newTokens;
     } catch (error) {
-      await this.storage.clearTokens();
+      await this.storage.clearTokens(this.sessionId);
       throw new Error(`Failed to refresh token: ${error}`);
     }
   }
 
   async ensureValidToken(): Promise<OAuthTokens> {
-    const tokens = await this.storage.getTokens();
+    const tokens = await this.storage.getTokens(this.sessionId);
 
     if (!tokens) {
       throw new Error("No access token available. Please authenticate first.");
     }
 
-    // Check if we need to refresh (either expired or force refresh flag is set)
-    if (!this.forceRefresh && !this.isTokenExpired(tokens)) {
+    // Check if token is still valid
+    if (!this.isTokenExpired(tokens)) {
       return tokens;
     }
 
···
       );
     }
 
+    // Check if a refresh is already in progress
     if (this.refreshPromise) {
       await this.refreshPromise;
-      const refreshedTokens = await this.storage.getTokens();
+      const refreshedTokens = await this.storage.getTokens(this.sessionId);
       if (!refreshedTokens) {
         throw new Error("Failed to refresh tokens");
       }
-      this.forceRefresh = false; // Reset flag after successful refresh
       return refreshedTokens;
     }
 
+    // Start a new refresh
     this.refreshPromise = this.refreshAccessToken().then(() => undefined);
+
     try {
       await this.refreshPromise;
-      const refreshedTokens = await this.storage.getTokens();
+      const refreshedTokens = await this.storage.getTokens(this.sessionId);
       if (!refreshedTokens) {
         throw new Error("Failed to refresh tokens");
       }
-      this.forceRefresh = false; // Reset flag after successful refresh
       return refreshedTokens;
     } finally {
       this.refreshPromise = undefined;
···
   }
 
   async getUserInfo(): Promise<OAuthUserInfo | null> {
-    const isAuthenticated = await this.isAuthenticated();
-    if (!isAuthenticated) {
+    const tokens = await this.storage.getTokens(this.sessionId);
+    if (!tokens) {
       return null;
     }
 
     try {
-      const userInfo = await this.makeRequest<OAuthUserInfo>(
+      const userInfo = await this.makeRequestWithTokens<OAuthUserInfo>(
         "oauth/userinfo",
         "GET",
-        undefined,
-        true
+        tokens,
+        undefined
       );
       return userInfo;
     } catch (error) {
···
   }
 
   async isAuthenticated(): Promise<boolean> {
-    const tokens = await this.storage.getTokens();
+    const tokens = await this.storage.getTokens(this.sessionId);
     return !!tokens?.accessToken;
   }
 
   async logout(): Promise<void> {
-    await this.storage.clearTokens();
-  }
-
-  /**
-   * Marks the current token as invalid, forcing the next ensureValidToken()
-   * call to refresh regardless of expiry time. Use this when the server
-   * rejects a token with 401 Unauthorized.
-   */
-  invalidateCurrentToken(): void {
-    this.forceRefresh = true;
+    await this.storage.clearTokens(this.sessionId);
   }
 
   async getAuthenticationInfo(): Promise<{
···
     expiresAt?: number;
     scope?: string;
   }> {
-    const tokens = await this.storage.getTokens();
+    const tokens = await this.storage.getTokens(this.sessionId);
     return {
       isAuthenticated: !!tokens?.accessToken,
       expiresAt: tokens?.expiresAt,
···
     };
   }
 
+  private async makeRequestWithTokens<T = unknown>(
+    endpoint: string,
+    method: "GET" | "POST",
+    tokens: OAuthTokens,
+    params?: Record<string, string | undefined>
+  ): Promise<T> {
+    const url = `${this.config.authBaseUrl}/${endpoint}`;
+
+    const requestInit: RequestInit = {
+      method,
+      headers: {
+        Authorization: `${tokens.tokenType} ${tokens.accessToken}`,
+      },
+    };
+
+    if (method === "GET" && params) {
+      const searchParams = new URLSearchParams();
+      Object.entries(params).forEach(([key, value]) => {
+        if (value !== undefined && value !== null) {
+          searchParams.append(key, String(value));
+        }
+      });
+      const queryString = searchParams.toString();
+      if (queryString) {
+        const urlWithParams = `${url}?${queryString}`;
+        const response = await fetch(urlWithParams, requestInit);
+        if (!response.ok) {
+          throw new Error(
+            `Request failed: ${response.status} ${response.statusText}`
+          );
+        }
+        return (await response.json()) as T;
+      }
+    } else if (method === "POST" && params) {
+      (requestInit.headers as Record<string, string>)["Content-Type"] =
+        "application/x-www-form-urlencoded";
+      requestInit.body = new URLSearchParams(params as Record<string, string>);
+    }
+
+    const response = await fetch(url, requestInit);
+    if (!response.ok) {
+      throw new Error(
+        `Request failed: ${response.status} ${response.statusText}`
+      );
+    }
+
+    return (await response.json()) as T;
+  }
+
   private async makeRequest<T = unknown>(
     endpoint: string,
     method: "GET" | "POST",
···
   }
 
   async getTokens(): Promise<OAuthTokens | null> {
-    return await this.storage.getTokens();
+    return await this.storage.getTokens(this.sessionId);
+  }
+
+  getSessionId(): string {
+    return this.sessionId;
   }
 }

packages/oauth/src/storage/deno-kv.ts

···
 export class DenoKVOAuthStorage implements OAuthStorage {
   constructor(private kv: Deno.Kv) {}
 
-  async getTokens(): Promise<OAuthTokens | null> {
-    const result = await this.kv.get<OAuthTokens>(["oauth_tokens"]);
+  async getTokens(sessionId: string): Promise<OAuthTokens | null> {
+    const result = await this.kv.get<OAuthTokens>(["oauth_tokens", sessionId]);
     return result.value;
   }
 
-  async setTokens(tokens: OAuthTokens): Promise<void> {
+  async setTokens(tokens: OAuthTokens, sessionId: string): Promise<void> {
     const expirationMs = 30 * 24 * 60 * 60 * 1000; // 30 days
-    await this.kv.set(["oauth_tokens"], tokens, { expireIn: expirationMs });
+    await this.kv.set(["oauth_tokens", sessionId], tokens, { expireIn: expirationMs });
   }
 
-  async clearTokens(): Promise<void> {
-    await this.kv.delete(["oauth_tokens"]);
+  async clearTokens(sessionId: string): Promise<void> {
+    await this.kv.delete(["oauth_tokens", sessionId]);
   }
 
   async getState(state: string): Promise<string | null> {

packages/oauth/src/storage/sqlite.ts

···
     this.db.exec(`
       CREATE TABLE IF NOT EXISTS oauth_tokens (
         id INTEGER PRIMARY KEY,
+        session_id TEXT,
         access_token TEXT NOT NULL,
         token_type TEXT NOT NULL,
         expires_at INTEGER,
         refresh_token TEXT,
         scope TEXT,
-        created_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now') * 1000)
+        created_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now') * 1000),
+        UNIQUE(session_id)
       )
     `);
 
···
     `);
   }
 
-  getTokens(): Promise<OAuthTokens | null> {
+  getTokens(sessionId: string): Promise<OAuthTokens | null> {
     const stmt = this.db.prepare(`
       SELECT access_token, token_type, expires_at, refresh_token, scope
-      FROM oauth_tokens 
-      ORDER BY created_at DESC 
+      FROM oauth_tokens
+      WHERE session_id = ?
       LIMIT 1
     `);
-    
-    const row = stmt.get() as {
+
+    const row = stmt.get(sessionId) as {
       access_token: string;
       token_type: string;
       expires_at?: number;
···
     });
   }
 
-  async setTokens(tokens: OAuthTokens): Promise<void> {
-    // Clear existing tokens first
-    await this.clearTokens();
+  async setTokens(tokens: OAuthTokens, sessionId: string): Promise<void> {
+    await this.clearTokens(sessionId);
 
     const stmt = this.db.prepare(`
-      INSERT INTO oauth_tokens (access_token, token_type, expires_at, refresh_token, scope)
-      VALUES (?, ?, ?, ?, ?)
+      INSERT INTO oauth_tokens (session_id, access_token, token_type, expires_at, refresh_token, scope)
+      VALUES (?, ?, ?, ?, ?, ?)
     `);
 
     stmt.run(
+      sessionId,
       tokens.accessToken,
       tokens.tokenType,
       tokens.expiresAt || null,
···
     );
   }
 
-  clearTokens(): Promise<void> {
-    const stmt = this.db.prepare("DELETE FROM oauth_tokens");
-    stmt.run();
+  clearTokens(sessionId: string): Promise<void> {
+    const stmt = this.db.prepare("DELETE FROM oauth_tokens WHERE session_id = ?");
+    stmt.run(sessionId);
     return Promise.resolve();
   }
 

packages/oauth/src/types.ts

···
 }
 
 export interface OAuthStorage {
-  getTokens(): Promise<OAuthTokens | null>;
-  setTokens(tokens: OAuthTokens): Promise<void>;
-  clearTokens(): Promise<void>;
-  
+  getTokens(sessionId: string): Promise<OAuthTokens | null>;
+  setTokens(tokens: OAuthTokens, sessionId: string): Promise<void>;
+  clearTokens(sessionId: string): Promise<void>;
+
   getState(state: string): Promise<string | null>;
   setState(state: string, codeVerifier: string): Promise<void>;
   clearState(state: string): Promise<void>;

packages/session/README.md

···
 
 ```typescript
 import { SessionStore, SQLiteAdapter, withOAuthSession } from "@slices/session";
-import { OAuthClient } from "@slices/oauth";
+import { OAuthClient, SQLiteOAuthStorage } from "@slices/oauth";
 
 const sessionStore = new SessionStore({
   adapter: new SQLiteAdapter("./sessions.db")
 });
 
-const oauthClient = new OAuthClient({
+const oauthStorage = new SQLiteOAuthStorage("./oauth.db");
+const oauthConfig = {
   clientId: "your-client-id",
   clientSecret: "your-client-secret",
-  authBaseUrl: "https://auth.example.com"
-});
+  authBaseUrl: "https://auth.example.com",
+  redirectUri: "http://localhost:8000/oauth/callback",
+  scopes: ["atproto"],
+};
 
-const oauthSessions = withOAuthSession(sessionStore, oauthClient);
+const oauthSessions = withOAuthSession(
+  sessionStore,
+  oauthConfig,
+  oauthStorage,
+  {
+    autoRefresh: true
+  }
+);
 
-// Create OAuth session
-const sessionId = await oauthSessions.createOAuthSession(request);
+// OAuth callback flow
+const tempClient = new OAuthClient(oauthConfig, oauthStorage, "temp");
+const tokens = await tempClient.handleCallback({ code, state });
+
+// Create OAuth session (handles user info fetch and token storage)
+const sessionId = await oauthSessions.createOAuthSession(tokens);
 
 // Get session with auto token refresh
 const session = await oauthSessions.getOAuthSession(sessionId);
+
+// Create session-scoped OAuth client
+const sessionClient = new OAuthClient(oauthConfig, oauthStorage, sessionId);
+const userInfo = await sessionClient.getUserInfo();
 ```
 
 ### Storage Adapters
···
 
 ### OAuthSessionManager
 
-OAuth-enabled session management.
+OAuth-enabled session management with session-scoped tokens.
 
 ```typescript
-const manager = withOAuthSession(sessionStore, oauthClient, {
-  autoRefresh: true,  // Auto-refresh expired tokens
-  onTokenRefresh: async (sessionId, tokens) => {
-    // Handle token refresh
-  },
-  onLogout: async (sessionId) => {
-    // Handle logout
+const manager = withOAuthSession(
+  sessionStore,
+  oauthConfig,
+  oauthStorage,
+  {
+    autoRefresh: true,  // Auto-refresh expired tokens
+    onTokenRefresh: async (sessionId, tokens) => {
+      // Handle token refresh
+    },
+    onLogout: async (sessionId) => {
+      // Handle logout
+    }
   }
-});
+);
 ```
 
 #### Methods
 
-- `createOAuthSession(request)` - Create session with OAuth tokens
+- `createOAuthSession(tokens)` - Create session with OAuth tokens (fetches user info, stores tokens by sessionId)
 - `getOAuthSession(sessionId)` - Get session with token refresh
 - `logout(sessionId)` - OAuth logout and session cleanup
 - `hasValidOAuthTokens(sessionId)` - Check token validity
 - `getAccessToken(sessionId)` - Get access token for API calls
 
+#### How it works
+
+1. **OAuth callback** returns tokens without `sub`
+2. `createOAuthSession(tokens)`:
+   - Creates temp OAuth client
+   - Fetches user info to get `sub`
+   - Creates session with userId
+   - Stores tokens by sessionId (not userId!)
+3. All subsequent operations use sessionId for token lookup
+
 ### Session Data Structure
 
 ```typescript
···
 });
 ```
 
+## Multi-Device Support
+
+The session-scoped OAuth pattern enables proper multi-device support:
+
+```typescript
+// User logs in on laptop
+const laptopSessionId = await oauthSessions.createOAuthSession(laptopTokens);
+const laptopClient = new OAuthClient(config, storage, laptopSessionId);
+
+// Same user logs in on phone
+const phoneSessionId = await oauthSessions.createOAuthSession(phoneTokens);
+const phoneClient = new OAuthClient(config, storage, phoneSessionId);
+
+// Each device has independent tokens
+// Logging out laptop doesn't affect phone session
+await oauthSessions.logout(laptopSessionId); // Only laptop session cleared
+```
+
 ## Security
 
 - Sessions are stored with secure, httpOnly cookies by default
···
 - CSRF protection through SameSite cookies
 - Secure session ID generation using crypto.randomUUID()
 - Optional token refresh to keep OAuth sessions valid
+- Session-scoped tokens prevent multi-device conflicts
 
 ## License
 

packages/session/src/oauth-integration.ts

···
 import type { SessionStore } from "./store.ts";
 import type { SessionData } from "./types.ts";
-import type { OAuthClient, OAuthTokens } from "@slices/oauth";
+import {
+  OAuthClient,
+  type OAuthTokens,
+  type OAuthConfig,
+  type OAuthStorage,
+} from "@slices/oauth";
 
 export interface OAuthSessionOptions {
   sessionStore: SessionStore;
-  oauthClient: OAuthClient;
+  oauthConfig: OAuthConfig;
+  oauthStorage: OAuthStorage;
   autoRefresh?: boolean;
   onTokenRefresh?: (sessionId: string, tokens: OAuthTokens) => Promise<void>;
   onLogout?: (sessionId: string) => Promise<void>;
···
     this.options = options;
   }
 
-  // Create a session linked to OAuth (no token duplication)
-  async createOAuthSession(): Promise<string | null> {
+  async createOAuthSession(tokens: OAuthTokens): Promise<string | null> {
     try {
-      // Verify OAuth tokens exist (but don't store them)
-      const tokens = await this.options.oauthClient.ensureValidToken();
-      if (!tokens.accessToken) {
-        return null;
-      }
+      // Create temporary OAuth client to fetch user info
+      const tempClient = new OAuthClient(
+        this.options.oauthConfig,
+        this.options.oauthStorage,
+        "temp_" + Date.now()
+      );
+
+      // Temporarily store tokens to fetch user info
+      await this.options.oauthStorage.setTokens(
+        tokens,
+        tempClient.getSessionId()
+      );
 
       // Get user info from OAuth
-      const userInfo = await this.options.oauthClient.getUserInfo();
+      const userInfo = await tempClient.getUserInfo();
       if (!userInfo) {
+        await this.options.oauthStorage.clearTokens(tempClient.getSessionId());
         return null;
       }
 
-      // Create session with user data only (no token storage)
+      // Clean up temp tokens
+      await this.options.oauthStorage.clearTokens(tempClient.getSessionId());
+
+      // Create session FIRST to get sessionId
       const sessionId = await this.options.sessionStore.createSession(
         userInfo.sub,
         userInfo.name,
···
             ...userInfo,
             handle: userInfo.name,
           },
-          // OAuth tokens are managed separately by @slices/oauth
-          // No token duplication here
         }
       );
+
+      // NOW store tokens by sessionId
+      await this.options.oauthStorage.setTokens(tokens, sessionId);
 
       return sessionId;
     } catch (error) {
···
     }
   }
 
-  // Get session (tokens managed separately by OAuth client)
   async getOAuthSession(sessionId: string): Promise<SessionData | null> {
     const session = await this.options.sessionStore.getSession(sessionId);
     if (!session) {
···
     // Auto-refresh is handled by OAuth client, not session storage
     if (this.options.autoRefresh) {
       try {
+        // Create session-scoped OAuth client
+        const sessionClient = new OAuthClient(
+          this.options.oauthConfig,
+          this.options.oauthStorage,
+          sessionId
+        );
+
         // This ensures tokens are fresh in OAuth storage
-        await this.options.oauthClient.ensureValidToken();
+        await sessionClient.ensureValidToken();
 
         // Call refresh callback if provided
         if (this.options.onTokenRefresh) {
-          const tokens = await this.options.oauthClient.ensureValidToken();
-          await this.options.onTokenRefresh(sessionId, tokens);
+          const tokens = await sessionClient.getTokens();
+          if (tokens) {
+            await this.options.onTokenRefresh(sessionId, tokens);
+          }
         }
       } catch (error) {
         console.error("Failed to refresh OAuth tokens:", error);
···
     return session;
   }
 
-  // Logout and cleanup OAuth session
   async logout(sessionId: string): Promise<void> {
     try {
-      // Call OAuth logout
-      await this.options.oauthClient.logout();
+      // Create session-scoped OAuth client and logout
+      const sessionClient = new OAuthClient(
+        this.options.oauthConfig,
+        this.options.oauthStorage,
+        sessionId
+      );
+      await sessionClient.logout();
 
       // Delete session
       await this.options.sessionStore.deleteSession(sessionId);
···
     }
   }
 
-  // Check if session has valid OAuth tokens (via OAuth client)
   async hasValidOAuthTokens(sessionId: string): Promise<boolean> {
     const session = await this.getOAuthSession(sessionId);
     if (!session) return false;
 
     try {
+      // Create session-scoped OAuth client
+      const sessionClient = new OAuthClient(
+        this.options.oauthConfig,
+        this.options.oauthStorage,
+        sessionId
+      );
       // Let OAuth client determine token validity
-      const tokens = await this.options.oauthClient.ensureValidToken();
+      const tokens = await sessionClient.ensureValidToken();
       return !!tokens.accessToken;
     } catch (_error) {
       return false;
     }
   }
 
-  // Get OAuth access token for API calls (from OAuth client, not session)
   async getAccessToken(sessionId: string): Promise<string | null> {
     const session = await this.getOAuthSession(sessionId);
     if (!session) return null;
 
     try {
+      // Create session-scoped OAuth client
+      const sessionClient = new OAuthClient(
+        this.options.oauthConfig,
+        this.options.oauthStorage,
+        sessionId
+      );
       // Get fresh tokens from OAuth client
-      const tokens = await this.options.oauthClient.ensureValidToken();
+      const tokens = await sessionClient.ensureValidToken();
       return tokens.accessToken || null;
     } catch (_error) {
       return null;
···
 // Convenience function to create an OAuth-enabled session store
 export function withOAuthSession(
   sessionStore: SessionStore,
-  oauthClient: OAuthClient,
-  options: Partial<OAuthSessionOptions> = {}
+  oauthConfig: OAuthConfig,
+  oauthStorage: OAuthStorage,
+  options: Partial<
+    Omit<OAuthSessionOptions, "sessionStore" | "oauthConfig" | "oauthStorage">
+  > = {}
 ): OAuthSessionManager {
   return new OAuthSessionManager({
     sessionStore,
-    oauthClient,
+    oauthConfig,
+    oauthStorage,
     autoRefresh: true,
     ...options,
   });
···
       };
     },
 
-    // Login handler
-    async login(): Promise<Response> {
-      const sessionId = await manager.createOAuthSession();
+    // Login handler - expects tokens from OAuth callback
+    async login(tokens: OAuthTokens): Promise<Response> {
+      const sessionId = await manager.createOAuthSession(tokens);
       if (!sessionId) {
         return new Response("Authentication failed", { status: 401 });
       }

packages/session/src/store.ts

···
   // Get user info from session
   async getCurrentUser(request: Request): Promise<SessionUser> {
     const session = await this.getSessionFromRequest(request);
-    
+
     if (!session) {
       return {
         isAuthenticated: false,
···
     }
 
     return {
+      sessionId: session.sessionId,
       sub: session.userId,
       handle: session.handle,
       isAuthenticated: session.isAuthenticated,

packages/session/src/types.ts

···
 }
 
 export interface SessionUser {
+  sessionId?: string;
   sub?: string;
   handle?: string;
   isAuthenticated: boolean;