get create,update,delete record routes working

.gitignore

···
+aip/

api/.env

···
-DATABASE_URL=postgresql://slice:slice@localhost:5432/slice
+DATABASE_URL=postgresql://slice:slice@localhost:5432/slice
+AUTH_BASE_URL=http://localhost:8081
+RUST_LOG=debug

api/.gitignore

···
 /target
+.env

api/Cargo.lock

···
 ]
 
 [[package]]
+name = "anyhow"
+version = "1.0.99"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b0674a1ddeecb70197781e945de4b3b8ffb61fa939a5597bcf48503737663100"
+
+[[package]]
 name = "arbitrary"
 version = "1.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
 
 [[package]]
+name = "atproto-client"
+version = "0.11.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "188c4bae6a3260c4d57149e7061415d440422ef11d68a16f581422ff181a66d9"
+dependencies = [
+ "anyhow",
+ "atproto-identity",
+ "atproto-oauth",
+ "atproto-record",
+ "bytes",
+ "reqwest",
+ "reqwest-chain",
+ "reqwest-middleware",
+ "serde",
+ "serde_json",
+ "thiserror 2.0.14",
+ "tokio",
+ "tracing",
+ "urlencoding",
+]
+
+[[package]]
+name = "atproto-identity"
+version = "0.11.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f4bf47131d663bcb76feaeb9403c09e12f00e5a2e0a7d805bd8caf4c6fdf01fa"
+dependencies = [
+ "anyhow",
+ "async-trait",
+ "ecdsa",
+ "elliptic-curve",
+ "hickory-resolver",
+ "k256",
+ "lru",
+ "multibase",
+ "p256",
+ "p384",
+ "rand 0.8.5",
+ "reqwest",
+ "serde",
+ "serde_ipld_dagcbor",
+ "serde_json",
+ "thiserror 2.0.14",
+ "tokio",
+ "tracing",
+]
+
+[[package]]
+name = "atproto-oauth"
+version = "0.11.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "919d64f13696fb700ed604b09c526b223f6bf063eb35f46d691198079cfbc789"
+dependencies = [
+ "anyhow",
+ "async-trait",
+ "atproto-identity",
+ "base64",
+ "chrono",
+ "ecdsa",
+ "elliptic-curve",
+ "k256",
+ "lru",
+ "multibase",
+ "p256",
+ "p384",
+ "rand 0.8.5",
+ "reqwest",
+ "reqwest-chain",
+ "reqwest-middleware",
+ "serde",
+ "serde_ipld_dagcbor",
+ "serde_json",
+ "sha2",
+ "thiserror 2.0.14",
+ "tokio",
+ "tracing",
+ "ulid",
+]
+
+[[package]]
+name = "atproto-record"
+version = "0.11.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "623f3eb1ba1e7b99903dc525f8b115ea8b6439b0d598507201f1f88aa6a37646"
+dependencies = [
+ "anyhow",
+ "atproto-identity",
+ "base64",
+ "chrono",
+ "serde",
+ "serde_ipld_dagcbor",
+ "serde_json",
+ "thiserror 2.0.14",
+]
+
+[[package]]
 name = "autocfg"
 version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 ]
 
 [[package]]
+name = "base-x"
+version = "0.2.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4cbbc9d0964165b47557570cce6c952866c2678457aca742aafc9fb771d30270"
+
+[[package]]
+name = "base16ct"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c7f02d4ea65f2c1853089ffd8d2787bdbc63de2f0d29dedbcf8ccdfa0ccd4cf"
+
+[[package]]
 name = "base64"
 version = "0.22.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 ]
 
 [[package]]
+name = "cbor4ii"
+version = "0.2.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b544cf8c89359205f4f990d0e6f3828db42df85b5dac95d09157a250eb0749c4"
+dependencies = [
+ "serde",
+]
+
+[[package]]
 name = "cc"
 version = "1.2.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9555578bc9e57714c812a1f84e4fc5b4d21fcb063490c624de019f7464c91268"
+
+[[package]]
+name = "cfg_aliases"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
 
 [[package]]
 name = "chrono"
···
 ]
 
 [[package]]
+name = "cid"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3147d8272e8fa0ccd29ce51194dd98f79ddfb8191ba9e3409884e751798acf3a"
+dependencies = [
+ "core2",
+ "multibase",
+ "multihash",
+ "serde",
+ "serde_bytes",
+ "unsigned-varint",
+]
+
+[[package]]
 name = "cipher"
 version = "0.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
 
 [[package]]
+name = "core2"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b49ba7ef1ad6107f8824dbe97de947cbaac53c44e7f9756a1fba0d37c1eec505"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
 name = "cpufeatures"
 version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 ]
 
 [[package]]
+name = "critical-section"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "790eea4361631c5e7d22598ecd5723ff611904e3344ce8720784c93e3d83d40b"
+
+[[package]]
+name = "crossbeam-channel"
+version = "0.5.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "82b8f8f868b36967f9606790d1903570de9ceaf870a7bf9fbbd3016d636a2cb2"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-epoch"
+version = "0.9.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
 name = "crossbeam-queue"
 version = "0.3.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28"
 
 [[package]]
+name = "crypto-bigint"
+version = "0.5.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0dc92fb57ca44df6db8059111ab3af99a63d5d0f8375d9972e319a379c6bab76"
+dependencies = [
+ "generic-array",
+ "rand_core 0.6.4",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
 name = "crypto-common"
 version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 checksum = "2a2330da5de22e8a3cb63252ce2abb30116bf5265e89c0e01bc17015ce30a476"
 
 [[package]]
+name = "data-encoding-macro"
+version = "0.1.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47ce6c96ea0102f01122a185683611bd5ac8d99e62bc59dd12e6bda344ee673d"
+dependencies = [
+ "data-encoding",
+ "data-encoding-macro-internal",
+]
+
+[[package]]
+name = "data-encoding-macro-internal"
+version = "0.1.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8d162beedaa69905488a8da94f5ac3edb4dd4788b732fadb7bd120b2625c1976"
+dependencies = [
+ "data-encoding",
+ "syn",
+]
+
+[[package]]
 name = "deflate64"
 version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 checksum = "1aaf95b3e5c8f23aa320147307562d361db0ae0d51242340f558153b4eb2439b"
 
 [[package]]
+name = "ecdsa"
+version = "0.16.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee27f32b5c5292967d2d4a9d7f1e0b0aed2c15daded5a60300e4abb9d8020bca"
+dependencies = [
+ "der",
+ "digest",
+ "elliptic-curve",
+ "rfc6979",
+ "serdect",
+ "signature",
+ "spki",
+]
+
+[[package]]
 name = "either"
 version = "1.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 ]
 
 [[package]]
+name = "elliptic-curve"
+version = "0.13.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b5e6043086bf7973472e0c7dff2142ea0b680d30e18d9cc40f267efbf222bd47"
+dependencies = [
+ "base16ct",
+ "base64ct",
+ "crypto-bigint",
+ "digest",
+ "ff",
+ "generic-array",
+ "group",
+ "hkdf",
+ "pem-rfc7468",
+ "pkcs8",
+ "rand_core 0.6.4",
+ "sec1",
+ "serde_json",
+ "serdect",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
 name = "encoding_rs"
 version = "0.8.35"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "75030f3c4f45dafd7586dd6780965a8c7e8e285a5ecb86713e63a79c5b2766f3"
 dependencies = [
  "cfg-if",
+]
+
+[[package]]
+name = "enum-as-inner"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1e6a265c649f3f5979b601d26f1d05ada116434c87741c9493cb56218f76cbc"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn",
 ]
 
 [[package]]
···
 version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "37909eebbb50d72f9059c3b6d82c0463f2ff062c9e95845c43a6c9c0355411be"
+
+[[package]]
+name = "ff"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0b50bfb653653f9ca9095b427bed08ab8d75a137839d9ad64eb11810d5b6393"
+dependencies = [
+ "rand_core 0.6.4",
+ "subtle",
+]
 
 [[package]]
 name = "flate2"
···
 ]
 
 [[package]]
+name = "generator"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d18470a76cb7f8ff746cf1f7470914f900252ec36bbc40b569d74b1258446827"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "libc",
+ "log",
+ "rustversion",
+ "windows",
+]
+
+[[package]]
 name = "generic-array"
 version = "0.14.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 dependencies = [
  "typenum",
  "version_check",
+ "zeroize",
 ]
 
 [[package]]
···
 checksum = "335ff9f135e4384c8150d6f27c6daed433577f86b4750418338c01a1a2528592"
 dependencies = [
  "cfg-if",
+ "js-sys",
  "libc",
  "wasi 0.11.1+wasi-snapshot-preview1",
+ "wasm-bindgen",
 ]
 
 [[package]]
···
 checksum = "26145e563e54f2cadc477553f1ec5ee650b00862f0a58bcd12cbdc5f0ea2d2f4"
 dependencies = [
  "cfg-if",
+ "js-sys",
  "libc",
  "r-efi",
  "wasi 0.14.2+wasi-0.2.4",
+ "wasm-bindgen",
 ]
 
 [[package]]
···
 checksum = "07e28edb80900c19c28f1072f2e8aeca7fa06b23cd4169cefe1af5aa3260783f"
 
 [[package]]
+name = "group"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0f9ef7462f7c099f518d754361858f86d8a07af53ba9af0fe635bbccb151a63"
+dependencies = [
+ "ff",
+ "rand_core 0.6.4",
+ "subtle",
+]
+
+[[package]]
 name = "h2"
 version = "0.4.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
 
 [[package]]
+name = "hickory-proto"
+version = "0.25.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8a6fe56c0038198998a6f217ca4e7ef3a5e51f46163bd6dd60b5c71ca6c6502"
+dependencies = [
+ "async-trait",
+ "cfg-if",
+ "data-encoding",
+ "enum-as-inner",
+ "futures-channel",
+ "futures-io",
+ "futures-util",
+ "idna",
+ "ipnet",
+ "once_cell",
+ "rand 0.9.2",
+ "ring",
+ "thiserror 2.0.14",
+ "tinyvec",
+ "tokio",
+ "tracing",
+ "url",
+]
+
+[[package]]
+name = "hickory-resolver"
+version = "0.25.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc62a9a99b0bfb44d2ab95a7208ac952d31060efc16241c87eaf36406fecf87a"
+dependencies = [
+ "cfg-if",
+ "futures-util",
+ "hickory-proto",
+ "ipconfig",
+ "moka",
+ "once_cell",
+ "parking_lot",
+ "rand 0.9.2",
+ "resolv-conf",
+ "smallvec",
+ "thiserror 2.0.14",
+ "tokio",
+ "tracing",
+]
+
+[[package]]
 name = "hkdf"
 version = "0.12.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
  "tokio",
  "tokio-rustls",
  "tower-service",
+ "webpki-roots 1.0.2",
 ]
 
 [[package]]
···
  "libc",
  "percent-encoding",
  "pin-project-lite",
- "socket2",
+ "socket2 0.6.0",
  "system-configuration",
  "tokio",
  "tower-service",
···
 ]
 
 [[package]]
+name = "ipconfig"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b58db92f96b720de98181bbbe63c831e87005ab460c1bf306eb2622b4707997f"
+dependencies = [
+ "socket2 0.5.10",
+ "widestring",
+ "windows-sys 0.48.0",
+ "winreg",
+]
+
+[[package]]
+name = "ipld-core"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "104718b1cc124d92a6d01ca9c9258a7df311405debb3408c445a36452f9bf8db"
+dependencies = [
+ "cid",
+ "serde",
+ "serde_bytes",
+]
+
+[[package]]
 name = "ipnet"
 version = "2.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 ]
 
 [[package]]
+name = "k256"
+version = "0.13.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6e3919bbaa2945715f0bb6d3934a173d1e9a59ac23767fbaaef277265a7411b"
+dependencies = [
+ "cfg-if",
+ "ecdsa",
+ "elliptic-curve",
+ "once_cell",
+ "sha2",
+ "signature",
+]
+
+[[package]]
 name = "lazy_static"
 version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 checksum = "13dc2df351e3202783a1fe0d44375f7295ffb4049267b0f3018346dc122a1d94"
 
 [[package]]
+name = "loom"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "419e0dc8046cb947daa77eb95ae174acfbddb7673b4151f56d1eed8e93fbfaca"
+dependencies = [
+ "cfg-if",
+ "generator",
+ "scoped-tls",
+ "tracing",
+ "tracing-subscriber",
+]
+
+[[package]]
+name = "lru"
+version = "0.12.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "234cf4f4a04dc1f57e24b96cc0cd600cf2af460d4161ac5ecdd0af8e1f3b2a38"
+dependencies = [
+ "hashbrown",
+]
+
+[[package]]
+name = "lru-slab"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154"
+
+[[package]]
 name = "matchers"
 version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
 
 [[package]]
+name = "mime_guess"
+version = "2.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f7c44f8e672c00fe5308fa235f821cb4198414e1c77935c1ab6948d3fd78550e"
+dependencies = [
+ "mime",
+ "unicase",
+]
+
+[[package]]
 name = "minijinja"
 version = "2.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 ]
 
 [[package]]
+name = "moka"
+version = "0.12.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a9321642ca94a4282428e6ea4af8cc2ca4eac48ac7a6a4ea8f33f76d0ce70926"
+dependencies = [
+ "crossbeam-channel",
+ "crossbeam-epoch",
+ "crossbeam-utils",
+ "loom",
+ "parking_lot",
+ "portable-atomic",
+ "rustc_version",
+ "smallvec",
+ "tagptr",
+ "thiserror 1.0.69",
+ "uuid",
+]
+
+[[package]]
 name = "multer"
 version = "3.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 ]
 
 [[package]]
+name = "multibase"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b3539ec3c1f04ac9748a260728e855f261b4977f5c3406612c884564f329404"
+dependencies = [
+ "base-x",
+ "data-encoding",
+ "data-encoding-macro",
+]
+
+[[package]]
+name = "multihash"
+version = "0.19.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6b430e7953c29dd6a09afc29ff0bb69c6e306329ee6794700aee27b76a1aea8d"
+dependencies = [
+ "core2",
+ "serde",
+ "unsigned-varint",
+]
+
+[[package]]
 name = "native-tls"
 version = "0.2.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
  "num-integer",
  "num-iter",
  "num-traits",
- "rand",
+ "rand 0.8.5",
  "smallvec",
  "zeroize",
 ]
···
 version = "1.21.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
+dependencies = [
+ "critical-section",
+ "portable-atomic",
+]
 
 [[package]]
 name = "openssl"
···
 checksum = "b15813163c1d831bf4a13c3610c05c0d03b39feb07f7e09fa234dac9b15aaf39"
 
 [[package]]
+name = "p256"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c9863ad85fa8f4460f9c48cb909d38a0d689dba1f6f6988a5e3e0d31071bcd4b"
+dependencies = [
+ "ecdsa",
+ "elliptic-curve",
+ "primeorder",
+ "serdect",
+ "sha2",
+]
+
+[[package]]
+name = "p384"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fe42f1670a52a47d448f14b6a5c61dd78fce51856e68edaa38f7ae3a46b8d6b6"
+dependencies = [
+ "ecdsa",
+ "elliptic-curve",
+ "primeorder",
+ "serdect",
+ "sha2",
+]
+
+[[package]]
 name = "parking"
 version = "2.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 checksum = "7edddbd0b52d732b21ad9a5fab5c704c14cd949e5e9a1ec5929a24fded1b904c"
 
 [[package]]
+name = "portable-atomic"
+version = "1.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f84267b20a16ea918e43c6a88433c2d54fa145c92a811b5b047ccbe153674483"
+
+[[package]]
 name = "potential_utf"
 version = "0.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 ]
 
 [[package]]
+name = "primeorder"
+version = "0.13.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "353e1ca18966c16d9deb1c69278edbc5f194139612772bd9537af60ac231e1e6"
+dependencies = [
+ "elliptic-curve",
+ "serdect",
+]
+
+[[package]]
 name = "proc-macro2"
 version = "1.0.97"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 ]
 
 [[package]]
+name = "quinn"
+version = "0.11.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "626214629cda6781b6dc1d316ba307189c85ba657213ce642d9c77670f8202c8"
+dependencies = [
+ "bytes",
+ "cfg_aliases",
+ "pin-project-lite",
+ "quinn-proto",
+ "quinn-udp",
+ "rustc-hash",
+ "rustls",
+ "socket2 0.5.10",
+ "thiserror 2.0.14",
+ "tokio",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "quinn-proto"
+version = "0.11.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49df843a9161c85bb8aae55f101bc0bac8bcafd637a620d9122fd7e0b2f7422e"
+dependencies = [
+ "bytes",
+ "getrandom 0.3.3",
+ "lru-slab",
+ "rand 0.9.2",
+ "ring",
+ "rustc-hash",
+ "rustls",
+ "rustls-pki-types",
+ "slab",
+ "thiserror 2.0.14",
+ "tinyvec",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "quinn-udp"
+version = "0.5.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fcebb1209ee276352ef14ff8732e24cc2b02bbac986cd74a4c81bcb2f9881970"
+dependencies = [
+ "cfg_aliases",
+ "libc",
+ "once_cell",
+ "socket2 0.5.10",
+ "tracing",
+ "windows-sys 0.59.0",
+]
+
+[[package]]
 name = "quote"
 version = "1.0.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
 dependencies = [
  "libc",
- "rand_chacha",
- "rand_core",
+ "rand_chacha 0.3.1",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand"
+version = "0.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6db2770f06117d490610c7488547d543617b21bfa07796d7a12f6f1bd53850d1"
+dependencies = [
+ "rand_chacha 0.9.0",
+ "rand_core 0.9.3",
 ]
 
 [[package]]
···
 checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
 dependencies = [
  "ppv-lite86",
- "rand_core",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.9.3",
 ]
 
 [[package]]
···
 ]
 
 [[package]]
+name = "rand_core"
+version = "0.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "99d9a13982dcf210057a8a78572b2217b667c3beacbf3a0d8b454f6f82837d38"
+dependencies = [
+ "getrandom 0.3.3",
+]
+
+[[package]]
 name = "redox_syscall"
 version = "0.5.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
  "js-sys",
  "log",
  "mime",
+ "mime_guess",
  "native-tls",
  "percent-encoding",
  "pin-project-lite",
+ "quinn",
+ "rustls",
  "rustls-pki-types",
  "serde",
  "serde_json",
···
  "sync_wrapper",
  "tokio",
  "tokio-native-tls",
+ "tokio-rustls",
  "tokio-util",
  "tower",
  "tower-http",
···
  "wasm-bindgen-futures",
  "wasm-streams",
  "web-sys",
+ "webpki-roots 1.0.2",
+]
+
+[[package]]
+name = "reqwest-chain"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da5c014fb79a8227db44a0433d748107750d2550b7fca55c59a3d7ee7d2ee2b2"
+dependencies = [
+ "anyhow",
+ "async-trait",
+ "http",
+ "reqwest-middleware",
+]
+
+[[package]]
+name = "reqwest-middleware"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "57f17d28a6e6acfe1733fe24bcd30774d13bffa4b8a22535b4c8c98423088d4e"
+dependencies = [
+ "anyhow",
+ "async-trait",
+ "http",
+ "reqwest",
+ "serde",
+ "thiserror 1.0.69",
+ "tower-service",
+]
+
+[[package]]
+name = "resolv-conf"
+version = "0.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "95325155c684b1c89f7765e30bc1c42e4a6da51ca513615660cb8a62ef9a88e3"
+
+[[package]]
+name = "rfc6979"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dd2a808d456c4a54e300a23e9f5a67e122c3024119acbfd73e3bf664491cb2"
+dependencies = [
+ "hmac",
+ "subtle",
 ]
 
 [[package]]
···
  "num-traits",
  "pkcs1",
  "pkcs8",
- "rand_core",
+ "rand_core 0.6.4",
  "signature",
  "spki",
  "subtle",
···
 checksum = "56f7d92ca342cea22a06f2121d944b4fd82af56988c270852495420f961d4ace"
 
 [[package]]
+name = "rustc-hash"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "357703d41365b4b27c590e3ed91eabb1b663f07c4c084095e60cbed4362dff0d"
+
+[[package]]
+name = "rustc_version"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cfcb3a22ef46e85b45de6ee7e79d063319ebb6594faafcf1c225ea92ab6e9b92"
+dependencies = [
+ "semver",
+]
+
+[[package]]
 name = "rustix"
 version = "1.0.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "229a4a4c221013e7e1f1a043678c5cc39fe5171437c88fb47151a21e6f5b5c79"
 dependencies = [
+ "web-time",
  "zeroize",
 ]
 
···
 dependencies = [
  "windows-sys 0.59.0",
 ]
+
+[[package]]
+name = "scoped-tls"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e1cf6437eb19a8f4a6cc0f7dca544973b0b78843adbfeb3683d1a94a0024a294"
 
 [[package]]
 name = "scopeguard"
···
 checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
 [[package]]
+name = "sec1"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3e97a565f76233a6003f9f5c54be1d9c5bdfa3eccfb189469f11ec4901c47dc"
+dependencies = [
+ "base16ct",
+ "der",
+ "generic-array",
+ "pkcs8",
+ "serdect",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
 name = "security-framework"
 version = "2.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 checksum = "0f7d95a54511e0c7be3f51e8867aa8cf35148d7b9445d44de2f943e2b206e749"
 
 [[package]]
+name = "semver"
+version = "1.0.26"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "56e6fa9c48d24d85fb3de5ad847117517440f6beceb7798af16b4a87d616b8d0"
+
+[[package]]
 name = "serde"
 version = "1.0.219"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 ]
 
 [[package]]
+name = "serde_bytes"
+version = "0.11.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8437fd221bde2d4ca316d61b90e337e9e702b3820b87d63caa9ba6c02bd06d96"
+dependencies = [
+ "serde",
+]
+
+[[package]]
 name = "serde_derive"
 version = "1.0.219"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 ]
 
 [[package]]
+name = "serde_ipld_dagcbor"
+version = "0.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "99600723cf53fb000a66175555098db7e75217c415bdd9a16a65d52a19dcc4fc"
+dependencies = [
+ "cbor4ii",
+ "ipld-core",
+ "scopeguard",
+ "serde",
+]
+
+[[package]]
 name = "serde_json"
 version = "1.0.142"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
  "form_urlencoded",
  "itoa",
  "ryu",
+ "serde",
+]
+
+[[package]]
+name = "serdect"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a84f14a19e9a014bb9f4512488d9829a68e04ecabffb0f9904cd1ace94598177"
+dependencies = [
+ "base16ct",
  "serde",
 ]
 
···
 checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
 dependencies = [
  "digest",
- "rand_core",
+ "rand_core 0.6.4",
 ]
 
 [[package]]
···
 name = "slice"
 version = "0.1.0"
 dependencies = [
+ "atproto-client",
+ "atproto-identity",
+ "atproto-oauth",
  "axum",
  "axum-extra",
  "chrono",
···
  "tower-http",
  "tracing",
  "tracing-subscriber",
+ "urlencoding",
  "uuid",
  "zip",
 ]
···
 checksum = "67b1b7a3b5fe4f1376887184045fcf45c69e92af734b7aaddc05fb777b6fbd03"
 dependencies = [
  "serde",
+]
+
+[[package]]
+name = "socket2"
+version = "0.5.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e22376abed350d73dd1cd119b57ffccad95b4e585a7cda43e286245ce23c0678"
+dependencies = [
+ "libc",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
···
  "memchr",
  "once_cell",
  "percent-encoding",
- "rand",
+ "rand 0.8.5",
  "rsa",
  "serde",
  "sha1",
···
  "md-5",
  "memchr",
  "once_cell",
- "rand",
+ "rand 0.8.5",
  "serde",
  "serde_json",
  "sha2",
···
 ]
 
 [[package]]
+name = "tagptr"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b2093cf4c8eb1e67749a6762251bc9cd836b6fc171623bd0a9d324d37af2417"
+
+[[package]]
 name = "tempfile"
 version = "3.20.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
  "pin-project-lite",
  "signal-hook-registry",
  "slab",
- "socket2",
+ "socket2 0.6.0",
  "tokio-macros",
  "windows-sys 0.59.0",
 ]
···
  "http",
  "httparse",
  "log",
- "rand",
+ "rand 0.8.5",
  "sha1",
  "thiserror 1.0.69",
  "utf-8",
···
 checksum = "1dccffe3ce07af9386bfd29e80c0ab1a8205a2fc34e4bcd40364df902cfa8f3f"
 
 [[package]]
+name = "ulid"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "470dbf6591da1b39d43c14523b2b469c86879a53e8b758c8e090a470fe7b1fbe"
+dependencies = [
+ "rand 0.9.2",
+ "web-time",
+]
+
+[[package]]
+name = "unicase"
+version = "2.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75b844d17643ee918803943289730bec8aac480150456169e647ed0b576ba539"
+
+[[package]]
 name = "unicode-bidi"
 version = "0.3.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 checksum = "e70f2a8b45122e719eb623c01822704c4e0907e7e426a05927e1a1cfff5b75d0"
 
 [[package]]
+name = "unsigned-varint"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eb066959b24b5196ae73cb057f45598450d2c5f71460e98c49b738086eff9c06"
+
+[[package]]
 name = "untrusted"
 version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
  "idna",
  "percent-encoding",
 ]
+
+[[package]]
+name = "urlencoding"
+version = "2.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "daf8dba3b7eb870caf1ddeed7bc9d2a049f3cfdfae7cb521b087cc33ae4c49da"
 
 [[package]]
 name = "utf-8"
···
 ]
 
 [[package]]
+name = "web-time"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a6580f308b1fad9207618087a65c04e7a10bc77e02c8e84e9b00dd4b12fa0bb"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
 name = "webpki-roots"
 version = "0.26.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 ]
 
 [[package]]
+name = "widestring"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dd7cf3379ca1aac9eea11fba24fd7e315d621f8dfe35c8d7d2be8b793726e07d"
+
+[[package]]
 name = "winapi"
 version = "0.3.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
+name = "windows"
+version = "0.61.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9babd3a767a4c1aef6900409f85f5d53ce2544ccdfaa86dad48c91782c6d6893"
+dependencies = [
+ "windows-collections",
+ "windows-core",
+ "windows-future",
+ "windows-link",
+ "windows-numerics",
+]
+
+[[package]]
+name = "windows-collections"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3beeceb5e5cfd9eb1d76b381630e82c4241ccd0d27f1a39ed41b2760b255c5e8"
+dependencies = [
+ "windows-core",
+]
+
+[[package]]
 name = "windows-core"
 version = "0.61.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 ]
 
 [[package]]
+name = "windows-future"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc6a41e98427b19fe4b73c550f060b59fa592d7d686537eebf9385621bfbad8e"
+dependencies = [
+ "windows-core",
+ "windows-link",
+ "windows-threading",
+]
+
+[[package]]
 name = "windows-implement"
 version = "0.60.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 checksum = "5e6ad25900d524eaabdbbb96d20b4311e1e7ae1699af4fb28c17ae66c80d798a"
 
 [[package]]
+name = "windows-numerics"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9150af68066c4c5c07ddc0ce30421554771e528bde427614c61038bc2c92c2b1"
+dependencies = [
+ "windows-core",
+ "windows-link",
+]
+
+[[package]]
 name = "windows-registry"
 version = "0.5.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
  "windows_x86_64_gnu 0.53.0",
  "windows_x86_64_gnullvm 0.53.0",
  "windows_x86_64_msvc 0.53.0",
+]
+
+[[package]]
+name = "windows-threading"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b66463ad2e0ea3bbf808b7f1d371311c80e115c0b71d60efc142cafbcfb057a6"
+dependencies = [
+ "windows-link",
 ]
 
 [[package]]
···
 version = "0.53.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "271414315aff87387382ec3d271b52d7ae78726f5d44ac98b4f4030c91880486"
+
+[[package]]
+name = "winreg"
+version = "0.50.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "524e57b2c537c0f9b1e69f1965311ec12182b4122e45035b1508cd24d2adadb1"
+dependencies = [
+ "cfg-if",
+ "windows-sys 0.48.0",
+]
 
 [[package]]
 name = "wit-bindgen-rt"

api/Cargo.toml

···
 zip = "4.3"
 multer = "3.1"
 futures-util = "0.3"
+
+# URL encoding for OAuth
+urlencoding = "2.1"
+
+# AT Protocol client
+atproto-client = "0.11.2"
+atproto-identity = "0.11.2"
+atproto-oauth = "0.11.2"

api/scripts/generate-typescript.ts

···
 
 // Add base interfaces
 function addBaseInterfaces(): void {
+  // OAuth interfaces
+  sourceFile.addInterface({
+    name: "OAuthAuthorizeParams",
+    isExported: true,
+    properties: [
+      { name: "loginHint", type: "string" },
+      { name: "redirectUri", type: "string" },
+      { name: "scope", type: "string[]", hasQuestionToken: true },
+      { name: "state", type: "string", hasQuestionToken: true },
+    ],
+  });
+
+  sourceFile.addInterface({
+    name: "OAuthAuthorizeResponse",
+    isExported: true,
+    properties: [
+      { name: "authorizationUrl", type: "string" },
+      { name: "codeVerifier", type: "string" },
+      { name: "state", type: "string" },
+    ],
+  });
+
+  sourceFile.addInterface({
+    name: "OAuthCallbackParams",
+    isExported: true,
+    properties: [
+      { name: "code", type: "string" },
+      { name: "state", type: "string" },
+      { name: "codeVerifier", type: "string" },
+      { name: "redirectUri", type: "string" },
+    ],
+  });
+
+  sourceFile.addInterface({
+    name: "OAuthTokenResponse",
+    isExported: true,
+    properties: [
+      { name: "access_token", type: "string" },
+      { name: "token_type", type: "string" },
+      { name: "expires_in", type: "number", hasQuestionToken: true },
+      { name: "refresh_token", type: "string", hasQuestionToken: true },
+      { name: "scope", type: "string", hasQuestionToken: true },
+    ],
+  });
+
+  sourceFile.addInterface({
+    name: "PKCEChallenge",
+    isExported: true,
+    properties: [
+      { name: "codeVerifier", type: "string" },
+      { name: "codeChallenge", type: "string" },
+      { name: "codeChallengeMethod", type: "'S256'" },
+    ],
+  });
+
+  sourceFile.addInterface({
+    name: "TokenStorage",
+    isExported: true,
+    properties: [
+      { name: "accessToken", type: "string", hasQuestionToken: true },
+      { name: "refreshToken", type: "string", hasQuestionToken: true },
+      { name: "expiresAt", type: "number", hasQuestionToken: true },
+      { name: "tokenType", type: "string", hasQuestionToken: true },
+      { name: "scope", type: "string", hasQuestionToken: true },
+    ],
+  });
+
   // RecordResponse interface
   sourceFile.addInterface({
     name: "RecordResponse",
···
   }
 }
 
-// Add base client class with shared request logic
+// Add PKCE utility class
+function addPKCEUtilsClass(): void {
+  sourceFile.addClass({
+    name: "PKCEUtils",
+    isExported: true,
+    methods: [
+      {
+        name: "generateCodeVerifier",
+        isStatic: true,
+        returnType: "string",
+        statements: [
+          `const array = new Uint8Array(32);`,
+          `crypto.getRandomValues(array);`,
+          `return btoa(String.fromCharCode.apply(null, Array.from(array)))`,
+          `  .replace(/\\+/g, '-')`,
+          `  .replace(/\\//g, '_')`,
+          `  .replace(/=/g, '');`,
+        ],
+      },
+      {
+        name: "generateCodeChallenge",
+        isStatic: true,
+        isAsync: true,
+        parameters: [{ name: "verifier", type: "string" }],
+        returnType: "Promise<string>",
+        statements: [
+          `const encoder = new TextEncoder();`,
+          `const data = encoder.encode(verifier);`,
+          `const digest = await crypto.subtle.digest('SHA-256', data);`,
+          `return btoa(String.fromCharCode.apply(null, Array.from(new Uint8Array(digest))))`,
+          `  .replace(/\\+/g, '-')`,
+          `  .replace(/\\//g, '_')`,
+          `  .replace(/=/g, '');`,
+        ],
+      },
+      {
+        name: "generatePKCEChallenge",
+        isStatic: true,
+        isAsync: true,
+        returnType: "Promise<PKCEChallenge>",
+        statements: [
+          `const codeVerifier = this.generateCodeVerifier();`,
+          `const codeChallenge = await this.generateCodeChallenge(codeVerifier);`,
+          `return {`,
+          `  codeVerifier,`,
+          `  codeChallenge,`,
+          `  codeChallengeMethod: 'S256'`,
+          `};`,
+        ],
+      },
+    ],
+  });
+}
+
+// Add base client class with OAuth token management
 function addBaseClientClass(): void {
   sourceFile.addClass({
     name: "BaseClient",
     properties: [
       { name: "baseUrl", type: "string", scope: "protected", isReadonly: true },
+      {
+        name: "authBaseUrl",
+        type: "string",
+        scope: "protected",
+        isReadonly: true,
+      },
+      {
+        name: "clientId",
+        type: "string",
+        scope: "protected",
+        isReadonly: true,
+      },
+      {
+        name: "clientSecret",
+        type: "string",
+        scope: "protected",
+        isReadonly: true,
+      },
+      {
+        name: "tokenStorage",
+        type: "TokenStorage",
+        scope: "private",
+        isStatic: true,
+        initializer: "{}",
+      },
+      {
+        name: "refreshPromise",
+        type: "Promise<void>",
+        scope: "private",
+        hasQuestionToken: true,
+      },
     ],
     ctors: [
       {
-        parameters: [{ name: "baseUrl", type: "string" }],
-        statements: ["this.baseUrl = baseUrl;"],
+        parameters: [
+          { name: "baseUrl", type: "string" },
+          { name: "authBaseUrl", type: "string" },
+          { name: "clientId", type: "string" },
+          { name: "clientSecret", type: "string" },
+        ],
+        statements: [
+          "this.baseUrl = baseUrl;",
+          "this.authBaseUrl = authBaseUrl;",
+          "this.clientId = clientId;",
+          "this.clientSecret = clientSecret;",
+        ],
       },
     ],
     methods: [
       {
+        name: "setTokens",
+        scope: "protected",
+        parameters: [{ name: "tokenResponse", type: "OAuthTokenResponse" }],
+        returnType: "void",
+        statements: [
+          `// Ensure token type is properly capitalized`,
+          `const tokenType = tokenResponse.token_type `,
+          `  ? tokenResponse.token_type.charAt(0).toUpperCase() + tokenResponse.token_type.slice(1).toLowerCase()`,
+          `  : "Bearer";`,
+          ``,
+          `BaseClient.tokenStorage = {`,
+          `  accessToken: tokenResponse.access_token,`,
+          `  refreshToken: tokenResponse.refresh_token,`,
+          `  tokenType: tokenType,`,
+          `  scope: tokenResponse.scope,`,
+          `  expiresAt: tokenResponse.expires_in`,
+          `    ? Date.now() + (tokenResponse.expires_in * 1000)`,
+          `    : undefined`,
+          `};`,
+        ],
+      },
+      {
+        name: "isTokenExpired",
+        scope: "private",
+        returnType: "boolean",
+        statements: [
+          `if (!BaseClient.tokenStorage.expiresAt) return false;`,
+          `return Date.now() >= (BaseClient.tokenStorage.expiresAt - 30000);`,
+        ],
+      },
+      {
+        name: "ensureValidToken",
+        scope: "private",
+        isAsync: true,
+        returnType: "Promise<void>",
+        statements: [
+          `if (!BaseClient.tokenStorage.accessToken) {`,
+          `  throw new Error('No access token available. Please authenticate first.');`,
+          `}`,
+          ``,
+          `if (!this.isTokenExpired()) {`,
+          `  return;`,
+          `}`,
+          ``,
+          `if (!BaseClient.tokenStorage.refreshToken) {`,
+          `  throw new Error('Access token expired and no refresh token available. Please re-authenticate.');`,
+          `}`,
+          ``,
+          `if (this.refreshPromise) {`,
+          `  return this.refreshPromise;`,
+          `}`,
+          ``,
+          `this.refreshPromise = this.refreshAccessToken();`,
+          `try {`,
+          `  await this.refreshPromise;`,
+          `} finally {`,
+          `  this.refreshPromise = undefined;`,
+          `}`,
+        ],
+      },
+      {
+        name: "refreshAccessToken",
+        scope: "private",
+        isAsync: true,
+        returnType: "Promise<void>",
+        statements: [
+          `if (!BaseClient.tokenStorage.refreshToken) {`,
+          `  throw new Error('No refresh token available');`,
+          `}`,
+          ``,
+          `try {`,
+          `  const response = await fetch(\`\${this.authBaseUrl}/oauth/token\`, {`,
+          `    method: 'POST',`,
+          `    headers: {`,
+          `      'Content-Type': 'application/x-www-form-urlencoded',`,
+          `    },`,
+          `    body: new URLSearchParams({`,
+          `      grant_type: 'refresh_token',`,
+          `      refresh_token: BaseClient.tokenStorage.refreshToken,`,
+          `      client_id: this.clientId,`,
+          `      client_secret: this.clientSecret,`,
+          `    }),`,
+          `  });`,
+          ``,
+          `  if (!response.ok) {`,
+          `    throw new Error(\`Token refresh failed: \${response.status} \${response.statusText}\`);`,
+          `  }`,
+          ``,
+          `  const tokenResponse: OAuthTokenResponse = await response.json();`,
+          `  this.setTokens(tokenResponse);`,
+          `} catch (error) {`,
+          `  BaseClient.tokenStorage = {};`,
+          `  throw new Error(\`Failed to refresh token: \${error}\`);`,
+          `}`,
+        ],
+      },
+      {
+        name: "getTokenInfo",
+        scope: "protected",
+        returnType: "{ hasToken: boolean; expiresAt?: number; scope?: string }",
+        statements: [
+          `return {`,
+          `  hasToken: !!BaseClient.tokenStorage.accessToken,`,
+          `  expiresAt: BaseClient.tokenStorage.expiresAt,`,
+          `  scope: BaseClient.tokenStorage.scope,`,
+          `};`,
+        ],
+      },
+      {
+        name: "clearTokens",
+        scope: "protected",
+        returnType: "void",
+        statements: [`BaseClient.tokenStorage = {};`],
+      },
+      {
+        name: "setTokensFromSession",
+        scope: "public",
+        parameters: [{ name: "tokens", type: "TokenStorage" }],
+        returnType: "void",
+        statements: [`BaseClient.tokenStorage = tokens;`],
+      },
+      {
+        name: "getTokenStorage",
+        scope: "public",
+        returnType: "TokenStorage",
+        statements: [`return BaseClient.tokenStorage;`],
+      },
+      {
         name: "makeRequest",
         scope: "protected",
         isAsync: true,
···
         returnType: "Promise<any>",
         statements: [
           `const httpMethod = method || 'GET';`,
-          `let url = \`\${this.baseUrl}/xrpc/\${endpoint}\`;`,
-          `let requestInit: RequestInit = {`,
-          `    method: httpMethod`,
+          `let url = endpoint.startsWith('oauth/')`,
+          `  ? \`\${this.authBaseUrl}/\${endpoint}\``,
+          `  : \`\${this.baseUrl}/xrpc/\${endpoint}\`;`,
+          ``,
+          `const requestInit: RequestInit = {`,
+          `  method: httpMethod,`,
+          `  headers: {}`,
           `};`,
           ``,
+          `// Add authorization header for protected endpoints`,
+          `const needsAuth = !endpoint.startsWith('oauth/') || endpoint === 'oauth/userinfo';`,
+          `const needsClientAuth = endpoint === 'oauth/par' || endpoint === 'oauth/token';`,
+          ``,
+          `if (needsAuth) {`,
+          `  await this.ensureValidToken();`,
+          ``,
+          `  if (BaseClient.tokenStorage.accessToken) {`,
+          `    (requestInit.headers as any)['Authorization'] =`,
+          `      \`\${BaseClient.tokenStorage.tokenType} \${BaseClient.tokenStorage.accessToken}\`;`,
+          `  }`,
+          `} else if (needsClientAuth) {`,
+          `  // Use HTTP Basic Auth for client authentication`,
+          `  const credentials = btoa(\`\${this.clientId}:\${this.clientSecret}\`);`,
+          `  (requestInit.headers as any)['Authorization'] = \`Basic \${credentials}\`;`,
+          `}`,
+          ``,
           `if (httpMethod === 'GET' && params) {`,
-          `    const searchParams = new URLSearchParams();`,
-          `    Object.entries(params).forEach(([key, value]) => {`,
-          `        if (value !== undefined && value !== null) {`,
-          `            searchParams.append(key, String(value));`,
-          `        }`,
-          `    });`,
-          `    const queryString = searchParams.toString();`,
-          `    if (queryString) {`,
-          `        url += '?' + queryString;`,
+          `  const searchParams = new URLSearchParams();`,
+          `  Object.entries(params).forEach(([key, value]) => {`,
+          `    if (value !== undefined && value !== null) {`,
+          `      searchParams.append(key, String(value));`,
           `    }`,
+          `  });`,
+          `  const queryString = searchParams.toString();`,
+          `  if (queryString) {`,
+          `    url += '?' + queryString;`,
+          `  }`,
           `} else if (httpMethod !== 'GET' && params) {`,
-          `    requestInit.headers = { 'Content-Type': 'application/json' };`,
+          `  if (endpoint.startsWith('oauth/') && endpoint !== 'oauth/userinfo') {`,
+          `    // OAuth token endpoints expect form data`,
+          `    (requestInit.headers as any)['Content-Type'] = 'application/x-www-form-urlencoded';`,
+          `    requestInit.body = new URLSearchParams(params);`,
+          `  } else {`,
+          `    // Regular API endpoints and userinfo expect JSON`,
+          `    (requestInit.headers as any)['Content-Type'] = 'application/json';`,
           `    requestInit.body = JSON.stringify(params);`,
+          `  }`,
           `}`,
           ``,
           `const response = await fetch(url, requestInit);`,
           `if (!response.ok) {`,
-          `    throw new Error(\`Request failed: \${response.status} \${response.statusText}\`);`,
+          `  throw new Error(\`Request failed: \${response.status} \${response.statusText}\`);`,
           `}`,
           `return await response.json();`,
         ],
···
           parameters: [{ name: "params", type: "GetRecordParams" }],
           returnType: `Promise<RecordResponse<${value}>>`,
         });
+        // Add create, update, delete methods
+        methods.push({
+          name: "createRecord",
+          parameters: [{ name: "record", type: value as string }],
+          returnType: `Promise<{ uri: string; cid: string }>`,
+        });
+        methods.push({
+          name: "updateRecord",
+          parameters: [
+            { name: "rkey", type: "string" },
+            { name: "record", type: value as string }
+          ],
+          returnType: `Promise<{ uri: string; cid: string }>`,
+        });
+        methods.push({
+          name: "deleteRecord",
+          parameters: [{ name: "rkey", type: "string" }],
+          returnType: `Promise<void>`,
+        });
       } else if (key === "_collectionPath") {
         collectionPath = value as string;
       } else if (typeof value === "object" && Object.keys(value).length > 0) {
···
             type: p.type,
             isReadonly: true,
           })),
+          // Add OAuth client to the main AtProtoClient
+          ...(className === "Client"
+            ? [{ name: "oauth", type: "OAuthClient", isReadonly: true }]
+            : []),
         ],
       });
 
       // Add constructor
       const ctor = classDeclaration.addConstructor({
-        parameters: [{ name: "baseUrl", type: "string" }],
+        parameters: [
+          { name: "baseUrl", type: "string" },
+          { name: "authBaseUrl", type: "string" },
+          { name: "clientId", type: "string" },
+          { name: "clientSecret", type: "string" },
+        ],
       });
       ctor.addStatements([
-        "super(baseUrl);",
-        ...properties.map((p) => `this.${p.name} = new ${p.type}(baseUrl);`),
+        "super(baseUrl, authBaseUrl, clientId, clientSecret);",
+        ...properties.map(
+          (p) => `this.${p.name} = new ${p.type}(baseUrl, authBaseUrl, clientId, clientSecret);`
+        ),
+        // Add OAuth client initialization for main AtProtoClient
+        ...(className === "Client"
+          ? ["this.oauth = new OAuthClient(baseUrl, authBaseUrl, clientId, clientSecret);"]
+          : []),
       ]);
 
       // Add methods with implementations
···
           methodDecl.addStatements([
             `return await this.makeRequest('${collectionPath}.get', 'GET', params);`,
           ]);
+        } else if (method.name === "createRecord") {
+          methodDecl.addStatements([
+            `const recordWithType = { $type: '${collectionPath}', ...record };`,
+            `return await this.makeRequest('${collectionPath}.create', 'POST', recordWithType);`,
+          ]);
+        } else if (method.name === "updateRecord") {
+          methodDecl.addStatements([
+            `const recordWithType = { $type: '${collectionPath}', ...record };`,
+            `return await this.makeRequest('${collectionPath}.update', 'POST', { rkey, record: recordWithType });`,
+          ]);
+        } else if (method.name === "deleteRecord") {
+          methodDecl.addStatements([
+            `return await this.makeRequest('${collectionPath}.delete', 'POST', { rkey });`,
+          ]);
         }
       }
     }
···
   }
 }
 
+// Add OAuth client class
+function addOAuthClientClass(): void {
+  sourceFile.addClass({
+    name: "OAuthClient",
+    extends: "BaseClient",
+    ctors: [
+      {
+        parameters: [
+          { name: "baseUrl", type: "string" },
+          { name: "authBaseUrl", type: "string" },
+          { name: "clientId", type: "string" },
+          { name: "clientSecret", type: "string" },
+        ],
+        statements: ["super(baseUrl, authBaseUrl, clientId, clientSecret);"],
+      },
+    ],
+    methods: [
+      {
+        name: "authorize",
+        isAsync: true,
+        parameters: [{ name: "params", type: "OAuthAuthorizeParams" }],
+        returnType: "Promise<OAuthAuthorizeResponse>",
+        statements: [
+          `const pkce = await PKCEUtils.generatePKCEChallenge();`,
+          `const state = params.state || this.generateState();`,
+          ``,
+          `// Step 1: Push authorization request (PAR)`,
+          `const parParams = {`,
+          `  client_id: this.clientId,`,
+          `  response_type: 'code',`,
+          `  redirect_uri: params.redirectUri,`,
+          `  state,`,
+          `  code_challenge: pkce.codeChallenge,`,
+          `  code_challenge_method: pkce.codeChallengeMethod,`,
+          `  scope: params.scope?.join(' ') || 'atproto:atproto atproto:transition:generic',`,
+          `  login_hint: params.loginHint`,
+          `};`,
+          ``,
+          `// POST to PAR endpoint`,
+          `const parResponse = await this.makeRequest('oauth/par', 'POST', parParams);`,
+          ``,
+          `// Step 2: Build authorization URL with request_uri`,
+          `const authParams = new URLSearchParams({`,
+          `  client_id: this.clientId,`,
+          `  request_uri: parResponse.request_uri`,
+          `});`,
+          ``,
+          `const authorizationUrl = \`\${this.authBaseUrl}/oauth/authorize?\${authParams.toString()}\`;`,
+          ``,
+          `return {`,
+          `  authorizationUrl,`,
+          `  codeVerifier: pkce.codeVerifier,`,
+          `  state`,
+          `};`,
+        ],
+      },
+      {
+        name: "handleCallback",
+        isAsync: true,
+        parameters: [{ name: "params", type: "OAuthCallbackParams" }],
+        returnType: "Promise<void>",
+        statements: [
+          `const tokenResponse: OAuthTokenResponse = await this.makeRequest('oauth/token', 'POST', {`,
+          `  grant_type: 'authorization_code',`,
+          `  code: params.code,`,
+          `  redirect_uri: params.redirectUri,`,
+          `  client_id: this.clientId,`,
+          `  client_secret: this.clientSecret,`,
+          `  code_verifier: params.codeVerifier`,
+          `});`,
+          ``,
+          `this.setTokens(tokenResponse);`,
+        ],
+      },
+      {
+        name: "isAuthenticated",
+        returnType: "boolean",
+        statements: [`return this.getTokenInfo().hasToken;`],
+      },
+      {
+        name: "logout",
+        returnType: "void",
+        statements: [`this.clearTokens();`],
+      },
+      {
+        name: "getAuthenticationInfo",
+        returnType: "{ isAuthenticated: boolean; expiresAt?: number; scope?: string }",
+        statements: [
+          `const tokenInfo = this.getTokenInfo();`,
+          `return {`,
+          `  isAuthenticated: tokenInfo.hasToken,`,
+          `  expiresAt: tokenInfo.expiresAt,`,
+          `  scope: tokenInfo.scope`,
+          `};`,
+        ],
+      },
+      {
+        name: "getUserInfo",
+        isAsync: true,
+        returnType: "Promise<{ sub: string; did?: string } | null>",
+        statements: [
+          `if (!this.isAuthenticated()) {`,
+          `  return null;`,
+          `}`,
+          ``,
+          `try {`,
+          `  const userInfo = await this.makeRequest('oauth/userinfo', 'GET');`,
+          `  return userInfo;`,
+          `} catch (error) {`,
+          `  console.error('Failed to fetch user info:', error);`,
+          `  return null;`,
+          `}`,
+        ],
+      },
+      {
+        name: "generateState",
+        scope: "private",
+        returnType: "string",
+        statements: [
+          `const array = new Uint8Array(16);`,
+          `crypto.getRandomValues(array);`,
+          `return btoa(String.fromCharCode.apply(null, Array.from(array)))`,
+          `  .replace(/\\+/g, '-')`,
+          `  .replace(/\\//g, '_')`,
+          `  .replace(/=/g, '');`,
+        ],
+      },
+    ],
+  });
+}
+
 // Generate the TypeScript
 addBaseInterfaces();
 addLexiconInterfaces();
+addPKCEUtilsClass();
 addBaseClientClass();
+addOAuthClientClass();
 addClientClass();
 
 // Get the generated code and add header
 const generatedCode = sourceFile.getFullText();
-const finalCode = headerComment + generatedCode;
+const unformattedCode = headerComment + generatedCode;
+
+// Format the code using deno fmt via temp file
+async function formatCode(code: string): Promise<string> {
+  try {
+    // @ts-ignore
+    const tempFile = await Deno.makeTempFile({ suffix: ".ts" });
+
+    // Write unformatted code to temp file
+    // @ts-ignore
+    await Deno.writeTextFile(tempFile, code);
+
+    // Format the temp file
+    // @ts-ignore
+    const process = new Deno.Command("deno", {
+      args: ["fmt", tempFile],
+      stdout: "piped",
+      stderr: "piped",
+    });
+
+    const output = await process.output();
+
+    if (output.success) {
+      // Read the formatted code back
+      // @ts-ignore
+      const formattedCode = await Deno.readTextFile(tempFile);
+      // @ts-ignore
+      await Deno.remove(tempFile);
+      return formattedCode;
+    } else {
+      const error = new TextDecoder().decode(output.stderr);
+      console.warn("deno fmt failed, using unformatted code:", error);
+      // @ts-ignore
+      await Deno.remove(tempFile);
+      return code;
+    }
+  } catch (error) {
+    console.warn("deno fmt not available, using unformatted code:", error);
+    return code;
+  }
+}
+
+const finalCode = await formatCode(unformattedCode);
 
 // Output to stdout for the Rust handler to capture
 // @ts-ignore

api/scripts/generated_client.ts

···
-// Generated TypeScript client for AT Protocol records
-// Generated at: 2025-08-18 03:54:49 UTC
-// Lexicons: 2
-
-export interface RecordResponse<T extends any> {
-    uri: string;
-    cid: string;
-    did: string;
-    collection: string;
-    value: T;
-    indexed_at: string;
-}
-
-export interface ListRecordsResponse<T extends any> {
-    records: RecordResponse<T>[];
-    cursor?: string;
-}
-
-export interface ListRecordsParams {
-    author?: string;
-    limit?: number;
-    cursor?: string;
-}
-
-export interface GetRecordParams {
-    uri: string;
-}
-
-export interface CollectionOperations<T> {
-    listRecords(params?: ListRecordsParams): Promise<ListRecordsResponse<T>>;
-    getRecord(params: GetRecordParams): Promise<RecordResponse<T>>;
-}
-
-export interface SocialGrainGalleryRecord {
-    createdAt: string;
-    description?: string;
-    /** Annotations of description text (mentions, URLs, hashtags, etc) */
-    facets?: any[];
-    /** Self-label values for this post. Effectively content warnings. */
-    labels?: any;
-    title: string;
-    updatedAt?: string;
-}
-
-export interface SocialGrainCommentRecord {
-    createdAt: string;
-    /** Annotations of description text (mentions and URLs, hashtags, etc) */
-    facets?: any[];
-    focus?: string;
-    replyTo?: string;
-    subject: string;
-    text: string;
-}
-
-class BaseClient {
-    protected readonly baseUrl: string;
-
-    constructor(baseUrl: string) {
-        this.baseUrl = baseUrl;
-    }
-
-    protected async makeRequest(endpoint: string, method?: "GET" | "POST" | "PUT" | "DELETE", params?: any): Promise<any> {
-        const httpMethod = method || 'GET';
-        let url = `${this.baseUrl}/xrpc/${endpoint}`;
-        let requestInit: RequestInit = {
-            method: httpMethod
-        };
-        
-        if (httpMethod === 'GET' && params) {
-            const searchParams = new URLSearchParams();
-            Object.entries(params).forEach(([key, value]) => {
-                if (value !== undefined && value !== null) {
-                    searchParams.append(key, String(value));
-                }
-
-            });
-            const queryString = searchParams.toString();
-            if (queryString) {
-                url += '?' + queryString;
-            }
-
-        } else if (httpMethod !== 'GET' && params) {
-            requestInit.headers = { 'Content-Type': 'application/json' };
-            requestInit.body = JSON.stringify(params);
-        }
-
-        
-
-        const response = await fetch(url, requestInit);
-        if (!response.ok) {
-            throw new Error(`Request failed: ${response.status} ${response.statusText}`);
-        }
-
-        return await response.json();
-    }
-}
-
-class GalleryGrainSocialClient extends BaseClient {
-    constructor(baseUrl: string) {
-        super(baseUrl);
-    }
-
-    async listRecords(params?: ListRecordsParams): Promise<ListRecordsResponse<SocialGrainGalleryRecord>> {
-        return await this.makeRequest('social.grain.gallery.list', 'GET', params);
-    }
-
-    async getRecord(params: GetRecordParams): Promise<RecordResponse<SocialGrainGalleryRecord>> {
-        return await this.makeRequest('social.grain.gallery.get', 'GET', params);
-    }
-}
-
-class CommentGrainSocialClient extends BaseClient {
-    constructor(baseUrl: string) {
-        super(baseUrl);
-    }
-
-    async listRecords(params?: ListRecordsParams): Promise<ListRecordsResponse<SocialGrainCommentRecord>> {
-        return await this.makeRequest('social.grain.comment.list', 'GET', params);
-    }
-
-    async getRecord(params: GetRecordParams): Promise<RecordResponse<SocialGrainCommentRecord>> {
-        return await this.makeRequest('social.grain.comment.get', 'GET', params);
-    }
-}
-
-class GrainSocialClient extends BaseClient {
-    readonly gallery: GalleryGrainSocialClient;
-    readonly comment: CommentGrainSocialClient;
-
-    constructor(baseUrl: string) {
-        super(baseUrl);
-        this.gallery = new GalleryGrainSocialClient(baseUrl);
-        this.comment = new CommentGrainSocialClient(baseUrl);
-    }
-}
-
-class SocialClient extends BaseClient {
-    readonly grain: GrainSocialClient;
-
-    constructor(baseUrl: string) {
-        super(baseUrl);
-        this.grain = new GrainSocialClient(baseUrl);
-    }
-}
-
-export class AtProtoClient extends BaseClient {
-    readonly social: SocialClient;
-
-    constructor(baseUrl: string) {
-        super(baseUrl);
-        this.social = new SocialClient(baseUrl);
-    }
-}
-
+null

api/src/database.rs

···
         Ok(())
     }
 
-    #[allow(dead_code)]
-    pub async fn get_record(&self, uri: &str) -> Result<Option<Record>, DatabaseError> {
+    pub async fn get_record(&self, uri: &str) -> Result<Option<IndexedRecord>, DatabaseError> {
         let record = sqlx::query_as::<_, Record>(
             r#"SELECT "uri", "cid", "did", "collection", "json", "indexedAt"
                FROM "record"
···
         .fetch_optional(&self.pool)
         .await?;
 
-        Ok(record)
+        let indexed_record = record.map(|record| IndexedRecord {
+            uri: record.uri,
+            cid: record.cid,
+            did: record.did,
+            collection: record.collection,
+            value: record.json,
+            indexed_at: record.indexed_at.to_rfc3339(),
+        });
+
+        Ok(indexed_record)
     }
 
     pub async fn list_records(&self, params: ListRecordsParams) -> Result<Vec<IndexedRecord>, DatabaseError> {

api/src/handler_dynamic_xrpc.rs

···
 use axum::{
     extract::{Path, Query, State},
-    http::StatusCode,
+    http::{HeaderMap, StatusCode},
     response::Json,
 };
 use serde::{Deserialize, Serialize};
 use chrono::Utc;
+use atproto_client::{client::DPoPAuth, com::atproto::repo::{CreateRecordRequest, PutRecordRequest, DeleteRecordRequest, create_record, put_record, delete_record, CreateRecordResponse, PutRecordResponse}};
+use atproto_identity::key::KeyData;
+use atproto_oauth::jwk::WrappedJsonWebKey;
 
 use crate::models::{ListRecordsParams, ListRecordsOutput, Record};
 use crate::AppState;
···
     pub cid: String,
 }
 
+#[derive(Serialize, Deserialize, Debug)]
+pub struct UserInfoResponse {
+    sub: String,
+    did: Option<String>,
+}
+
+// Extract bearer token from Authorization header
+fn extract_bearer_token(headers: &HeaderMap) -> Result<String, StatusCode> {
+    let auth_header = headers
+        .get("authorization")
+        .and_then(|h| h.to_str().ok())
+        .ok_or(StatusCode::UNAUTHORIZED)?;
+
+    if !auth_header.starts_with("Bearer ") {
+        println!("Auth header does not start with 'Bearer ': {}", auth_header);
+        return Err(StatusCode::UNAUTHORIZED);
+    }
+
+    let token = auth_header.strip_prefix("Bearer ").unwrap().to_string();
+    println!("Extracted token: {}...", &token[..20.min(token.len())]);
+    Ok(token)
+}
+
+// Verify OAuth token with auth server
+async fn verify_oauth_token(token: &str, auth_base_url: &str) -> Result<UserInfoResponse, StatusCode> {
+    let client = reqwest::Client::new();
+    let userinfo_url = format!("{}/oauth/userinfo", auth_base_url);
+    println!("Verifying token with URL: {}", userinfo_url);
+    println!("Token prefix: {}...", &token[..20.min(token.len())]);
+
+    let response = client
+        .get(&userinfo_url)
+        .header("Authorization", format!("Bearer {}", token))
+        .send()
+        .await
+        .map_err(|e| {
+            println!("Failed to send request to auth server: {}", e);
+            StatusCode::INTERNAL_SERVER_ERROR
+        })?;
+
+    println!("Auth server response status: {}", response.status());
+
+    if !response.status().is_success() {
+        let error_text = response.text().await.unwrap_or_else(|_| "unknown".to_string());
+        println!("Auth server error response: {}", error_text);
+        return Err(StatusCode::UNAUTHORIZED);
+    }
+
+    let user_info: UserInfoResponse = response
+        .json()
+        .await
+        .map_err(|e| {
+            println!("Failed to parse user info JSON: {}", e);
+            StatusCode::INTERNAL_SERVER_ERROR
+        })?;
+
+    println!("Successfully verified token for user: {:?}", user_info);
+    Ok(user_info)
+}
+
+// Get AT Protocol DPoP auth and PDS URL for the user
+async fn get_atproto_auth_for_user(
+    token: &str,
+    auth_base_url: &str,
+) -> Result<(DPoPAuth, String), StatusCode> {
+    // First get session info from auth server
+    let client = reqwest::Client::new();
+    let session_url = format!("{}/api/atprotocol/session", auth_base_url);
+    println!("Getting session info from: {}", session_url);
+
+    let session_response = client
+        .get(&session_url)
+        .header("Authorization", format!("Bearer {}", token))
+        .send()
+        .await
+        .map_err(|e| {
+            println!("Failed to get session info: {}", e);
+            StatusCode::INTERNAL_SERVER_ERROR
+        })?;
+
+    println!("Session response status: {}", session_response.status());
+
+    if !session_response.status().is_success() {
+        let error_text = session_response.text().await.unwrap_or_else(|_| "unknown".to_string());
+        println!("Session error response: {}", error_text);
+        return Err(StatusCode::UNAUTHORIZED);
+    }
+
+    let session_data: serde_json::Value = session_response
+        .json()
+        .await
+        .map_err(|e| {
+            println!("Failed to parse session JSON: {}", e);
+            StatusCode::INTERNAL_SERVER_ERROR
+        })?;
+
+    println!("Session data: {}", serde_json::to_string_pretty(&session_data).unwrap_or_else(|_| "invalid".to_string()));
+
+    // Extract PDS URL from session
+    let pds_url = session_data["pds_endpoint"]
+        .as_str()
+        .ok_or_else(|| {
+            println!("No pds_endpoint found in session data");
+            StatusCode::INTERNAL_SERVER_ERROR
+        })?
+        .to_string();
+
+    println!("Extracted PDS URL: {}", pds_url);
+
+    // Extract AT Protocol access token from session data
+    let atproto_access_token = session_data["access_token"]
+        .as_str()
+        .ok_or_else(|| {
+            println!("No access_token found in session data");
+            StatusCode::INTERNAL_SERVER_ERROR
+        })?
+        .to_string();
+
+    println!("Using AT Protocol access token: {}...", &atproto_access_token[..20.min(atproto_access_token.len())]);
+
+    // Extract DPoP private key from session data - convert JWK to KeyData
+    let dpop_jwk: WrappedJsonWebKey = serde_json::from_value(session_data["dpop_jwk"].clone())
+        .map_err(|e| {
+            println!("Failed to deserialize dpop_jwk: {}", e);
+            StatusCode::INTERNAL_SERVER_ERROR
+        })?;
+
+    println!("Parsed DPoP JWK successfully");
+
+    let dpop_private_key_data = KeyData::try_from(dpop_jwk)
+        .map_err(|e| {
+            println!("Failed to convert JWK to KeyData: {}", e);
+            StatusCode::INTERNAL_SERVER_ERROR
+        })?;
+
+    println!("Successfully created KeyData from DPoP JWK");
+
+    let dpop_auth = DPoPAuth {
+        dpop_private_key_data,
+        oauth_access_token: atproto_access_token,
+    };
+
+    Ok((dpop_auth, pds_url))
+}
+
 // Dynamic XRPC handler that routes based on method name (for GET requests)
 pub async fn dynamic_xrpc_handler(
     Path(method): Path<String>,
···
 pub async fn dynamic_xrpc_post_handler(
     Path(method): Path<String>,
     State(state): State<AppState>,
+    headers: HeaderMap,
     Json(body): Json<serde_json::Value>,
 ) -> Result<Json<serde_json::Value>, StatusCode> {
-    if method == "com.atproto.repo.createRecord" {
-        dynamic_create_record_impl(state, body).await
-    } else if method == "com.atproto.repo.putRecord" {
-        dynamic_update_record_impl(state, body).await
-    } else if method == "com.atproto.repo.deleteRecord" {
-        dynamic_delete_record_impl(state, body).await
+    println!("=== DYNAMIC POST HANDLER CALLED ===");
+    println!("Method: {}", method);
+
+    // Handle dynamic collection methods (e.g., social.grain.gallery.create)
+    if method.ends_with(".create") {
+        let collection = method.trim_end_matches(".create").to_string();
+        dynamic_collection_create_impl(state, headers, body, collection).await
+    } else if method.ends_with(".update") {
+        let collection = method.trim_end_matches(".update").to_string();
+        dynamic_collection_update_impl(state, headers, body, collection).await
+    } else if method.ends_with(".delete") {
+        let collection = method.trim_end_matches(".delete").to_string();
+        dynamic_collection_delete_impl(state, headers, body, collection).await
     } else {
         Err(StatusCode::NOT_FOUND)
     }
···
 
 // Implementation for get record
 async fn dynamic_get_record_impl(
-    collection: String,
+    _collection: String,
     state: AppState,
     params: serde_json::Value,
 ) -> Result<Json<serde_json::Value>, StatusCode> {
     let get_params: GetRecordParams = serde_json::from_value(params)
         .map_err(|_| StatusCode::BAD_REQUEST)?;
 
-    // Extract the record key from the URI
-    // AT Protocol URIs are like: at://did:plc:example/collection/rkey
-    let uri_parts: Vec<&str> = get_params.uri.split('/').collect();
-    if uri_parts.len() < 3 {
-        return Err(StatusCode::BAD_REQUEST);
-    }
-
-    // For now, we'll use the existing list_records with a filter
-    // In a real implementation, you'd want a dedicated get_record method
-    let list_params = ListRecordsParams {
-        collection,
-        author: None,
-        limit: Some(1),
-        cursor: None,
-    };
-
-    match state.database.list_records(list_params).await {
-        Ok(records) => {
-            // Find the record with matching URI
-            if let Some(record) = records.into_iter().find(|r| r.uri == get_params.uri) {
-                let json_value = serde_json::to_value(record)
-                    .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
-                Ok(Json(json_value))
-            } else {
-                Err(StatusCode::NOT_FOUND)
-            }
+    // Use direct database query by URI for efficiency
+    match state.database.get_record(&get_params.uri).await {
+        Ok(Some(record)) => {
+            let json_value = serde_json::to_value(record)
+                .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+            Ok(Json(json_value))
         },
-        Err(_) => Err(StatusCode::INTERNAL_SERVER_ERROR),
+        Ok(None) => {
+            Err(StatusCode::NOT_FOUND)
+        },
+        Err(e) => {
+            println!("Database error: {:?}", e);
+            Err(StatusCode::INTERNAL_SERVER_ERROR)
+        },
     }
 }
 
-// Implementation for create record
-async fn dynamic_create_record_impl(
+// Dynamic collection create (e.g., social.grain.gallery.create)
+async fn dynamic_collection_create_impl(
     state: AppState,
+    headers: HeaderMap,
     body: serde_json::Value,
+    collection: String,
 ) -> Result<Json<serde_json::Value>, StatusCode> {
-    let params: CreateRecordParams = serde_json::from_value(body)
-        .map_err(|_| StatusCode::BAD_REQUEST)?;
+    // Debug logging removed - slice creation is working
+
+    // Extract and verify OAuth token
+    let token = extract_bearer_token(&headers)?;
+    let user_info = verify_oauth_token(&token, &state.config.auth_base_url).await?;
+
+    // Get AT Protocol DPoP auth and PDS URL
+    let (dpop_auth, pds_url) = get_atproto_auth_for_user(&token, &state.config.auth_base_url).await?;
 
-    // Generate a record key if not provided (using timestamp)
-    let rkey = params.rkey.unwrap_or_else(|| {
-        // Simple TID-like generation using timestamp
-        let now = Utc::now();
-        now.format("%Y%m%dT%H%M%S").to_string()
-    });
+    // Extract the repo DID from user info
+    let repo = user_info.did.unwrap_or(user_info.sub);
+
+    // Create HTTP client
+    let http_client = reqwest::Client::new();
+
+    // Create record using AT Protocol functions with DPoP
+    let create_request = CreateRecordRequest {
+        repo: repo.clone(),
+        collection: collection.clone(),
+        record_key: None, // Let PDS generate
+        record: body.clone(),
+        swap_commit: None,
+        validate: false,
+    };
+
+    println!("About to create record with PDS: {}", pds_url);
+    println!("Create request: repo={}, collection={}", create_request.repo, create_request.collection);
+    println!("Record data: {}", serde_json::to_string_pretty(&create_request.record).unwrap_or_else(|_| "invalid".to_string()));
+
+    let result = create_record(&http_client, &dpop_auth, &pds_url, create_request)
+        .await
+        .map_err(|e| {
+            println!("Failed to create record: {}", e);
+            StatusCode::INTERNAL_SERVER_ERROR
+        })?;
+
+    println!("Create record result: {:?}", result);
 
-    // Construct the AT-URI
-    let uri = format!("at://{}/{}/{}", params.repo, params.collection, rkey);
-    
-    // Generate a simple CID (in a real implementation, this would be a proper CID)
-    let cid = format!("baf{}", &uri.chars().take(50).collect::<String>().replace(":", "").replace("/", ""));
+    // Extract URI and CID from the response enum
+    let (uri, cid) = match result {
+        CreateRecordResponse::StrongRef { uri, cid, .. } => (uri, cid),
+        CreateRecordResponse::Error(_) => return Err(StatusCode::INTERNAL_SERVER_ERROR),
+    };
 
+    // Also store in local database for indexing
     let record = Record {
         uri: uri.clone(),
         cid: cid.clone(),
-        did: params.repo,
-        collection: params.collection,
-        json: params.record,
+        did: repo,
+        collection,
+        json: body,
         indexed_at: Utc::now(),
     };
 
-    match state.database.insert_record(&record).await {
-        Ok(_) => {
-            let output = CreateRecordOutput { uri, cid };
-            let json_value = serde_json::to_value(output)
-                .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
-            Ok(Json(json_value))
-        },
-        Err(_) => Err(StatusCode::INTERNAL_SERVER_ERROR),
-    }
+    // Store in local database (ignore errors as AT Protocol operation succeeded)
+    let _ = state.database.insert_record(&record).await;
+
+    Ok(Json(serde_json::json!({
+        "uri": uri,
+        "cid": cid,
+    })))
 }
 
-// Implementation for update record
-async fn dynamic_update_record_impl(
+// Dynamic collection update (e.g., social.grain.gallery.update)
+async fn dynamic_collection_update_impl(
     state: AppState,
+    headers: HeaderMap,
     body: serde_json::Value,
+    collection: String,
 ) -> Result<Json<serde_json::Value>, StatusCode> {
-    let params: UpdateRecordParams = serde_json::from_value(body)
-        .map_err(|_| StatusCode::BAD_REQUEST)?;
+    // Extract and verify OAuth token
+    let token = extract_bearer_token(&headers)?;
+    let user_info = verify_oauth_token(&token, &state.config.auth_base_url).await?;
+
+    // Get AT Protocol DPoP auth and PDS URL
+    let (dpop_auth, pds_url) = get_atproto_auth_for_user(&token, &state.config.auth_base_url).await?;
+
+    // Extract repo and rkey from body
+    let repo = user_info.did.unwrap_or(user_info.sub);
+    let rkey = body["rkey"].as_str().ok_or(StatusCode::BAD_REQUEST)?.to_string();
+    let record_data = body["record"].clone();
+
+    // Create HTTP client
+    let http_client = reqwest::Client::new();
 
-    let uri = format!("at://{}/{}/{}", params.repo, params.collection, params.rkey);
-    
-    // Generate a new CID for the updated record
-    let cid = format!("baf{}", &uri.chars().take(50).collect::<String>().replace(":", "").replace("/", ""));
+    // Update record using AT Protocol functions with DPoP
+    let put_request = PutRecordRequest {
+        repo: repo.clone(),
+        collection: collection.clone(),
+        record_key: rkey,
+        record: record_data.clone(),
+        swap_record: None,
+        swap_commit: None,
+        validate: false,
+    };
+
+    let result = put_record(&http_client, &dpop_auth, &pds_url, put_request)
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+
+    // Extract URI and CID from the response enum
+    let (uri, cid) = match result {
+        PutRecordResponse::StrongRef { uri, cid, .. } => (uri, cid),
+        PutRecordResponse::Error(_) => return Err(StatusCode::INTERNAL_SERVER_ERROR),
+    };
 
+    // Also update in local database for indexing
     let record = Record {
         uri: uri.clone(),
         cid: cid.clone(),
-        did: params.repo,
-        collection: params.collection,
-        json: params.record,
+        did: repo,
+        collection,
+        json: record_data,
         indexed_at: Utc::now(),
     };
 
-    match state.database.update_record(&record).await {
-        Ok(_) => {
-            let output = CreateRecordOutput { uri, cid };
-            let json_value = serde_json::to_value(output)
-                .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
-            Ok(Json(json_value))
-        },
-        Err(_) => Err(StatusCode::NOT_FOUND),
-    }
+    // Update in local database (ignore errors as AT Protocol operation succeeded)
+    let _ = state.database.update_record(&record).await;
+
+    Ok(Json(serde_json::json!({
+        "uri": uri,
+        "cid": cid,
+    })))
 }
 
-// Implementation for delete record
-async fn dynamic_delete_record_impl(
+// Dynamic collection delete (e.g., social.grain.gallery.delete)
+async fn dynamic_collection_delete_impl(
     state: AppState,
+    headers: HeaderMap,
     body: serde_json::Value,
+    collection: String,
 ) -> Result<Json<serde_json::Value>, StatusCode> {
-    let params: DeleteRecordParams = serde_json::from_value(body)
-        .map_err(|_| StatusCode::BAD_REQUEST)?;
+    // Extract and verify OAuth token
+    let token = extract_bearer_token(&headers)?;
+    let user_info = verify_oauth_token(&token, &state.config.auth_base_url).await?;
+
+    // Get AT Protocol DPoP auth and PDS URL
+    let (dpop_auth, pds_url) = get_atproto_auth_for_user(&token, &state.config.auth_base_url).await?;
+
+    // Extract repo and rkey from body
+    let repo = user_info.did.unwrap_or(user_info.sub);
+    let rkey = body["rkey"].as_str().ok_or(StatusCode::BAD_REQUEST)?.to_string();
+
+    // Create HTTP client
+    let http_client = reqwest::Client::new();
+
+    // Delete record using AT Protocol functions with DPoP
+    let delete_request = DeleteRecordRequest {
+        repo: repo.clone(),
+        collection: collection.clone(),
+        record_key: rkey.clone(),
+        swap_record: None,
+        swap_commit: None,
+    };
+
+    delete_record(&http_client, &dpop_auth, &pds_url, delete_request)
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
 
-    let uri = format!("at://{}/{}/{}", params.repo, params.collection, params.rkey);
+    // Also delete from local database
+    let uri = format!("at://{}/{}/{}", repo, collection, rkey);
+    let _ = state.database.delete_record(&uri).await;
 
-    match state.database.delete_record(&uri).await {
-        Ok(_) => {
-            // Return empty success response
-            Ok(Json(serde_json::json!({})))
-        },
-        Err(_) => Err(StatusCode::NOT_FOUND),
-    }
+    Ok(Json(serde_json::json!({})))
 }

api/src/handler_oauth.rs

···
-use axum::{
-    extract::State,
-    http::StatusCode,
-    response::Json,
-};
-use serde::{Deserialize, Serialize};
-
-use crate::AppState;
-
-#[derive(Deserialize)]
-pub struct OAuthAuthorizeParams {
-    pub handle: String,
-}
-
-#[derive(Serialize)]
-pub struct OAuthAuthorizeResponse {
-    pub success: bool,
-    pub message: String,
-}
-
-pub async fn oauth_authorize(
-    State(_state): State<AppState>,
-    Json(params): Json<OAuthAuthorizeParams>,
-) -> Result<Json<OAuthAuthorizeResponse>, StatusCode> {
-    // TODO: Implement OAuth authorize flow
-    // 1. Resolve handle to DID
-    // 2. Discover user's PDS
-    // 3. Initiate OAuth flow with user's PDS
-    // 4. Return authorization URL or handle the callback
-    
-    let response = OAuthAuthorizeResponse {
-        success: true,
-        message: format!("OAuth authorize initiated for handle: {}", params.handle),
-    };
-
-    Ok(Json(response))
-}

api/src/main.rs

···
 mod handler_codegen;
 mod handler_dynamic_xrpc;
 mod handler_lexicon;
-mod handler_oauth;
 mod handler_upload_lexicon;
 mod handler_xrpc_codegen;
 mod models;
···
 mod web;
 
 use axum::{
+    Router,
     extract::{Query, State},
     http::StatusCode,
     response::Json,
     routing::{get, post},
-    Router,
 };
 use sqlx::PgPool;
 use std::env;
 use tower_http::{cors::CorsLayer, trace::TraceLayer};
-use tracing::{info, Level};
+use tracing::info;
 use tracing_subscriber;
 
 use crate::database::Database;
 use crate::errors::AppError;
-use crate::models::{BulkSyncOutput, BulkSyncParams, ListRecordsOutput, ListRecordsParams, SmartSyncParams};
+use crate::models::{
+    BulkSyncOutput, BulkSyncParams, ListRecordsOutput, ListRecordsParams, SmartSyncParams,
+};
 use crate::sync::SyncService;
 use crate::web::WebService;
 
 #[derive(Clone)]
+pub struct Config {
+    pub auth_base_url: String,
+}
+
+#[derive(Clone)]
 pub struct AppState {
     database: Database,
     sync_service: SyncService,
     #[allow(dead_code)]
     web_service: WebService,
+    config: Config,
 }
 
 #[tokio::main]
···
 
     // Initialize tracing
     tracing_subscriber::fmt()
-        .with_max_level(Level::INFO)
+        .with_env_filter(tracing_subscriber::EnvFilter::from_default_env())
         .init();
 
     // Database connection
···
     let sync_service = SyncService::new(database.clone());
     let web_service = WebService::new();
 
+    let auth_base_url = env::var("AUTH_BASE_URL")
+        .unwrap_or_else(|_| "https://auth.grainsocial.network".to_string());
+
+    let config = Config {
+        auth_base_url,
+    };
+
     let state = AppState {
         database: database.clone(),
         sync_service,
         web_service,
+        config,
     };
 
     // Build application with routes
···
         .route("/xrpc/com.indexer.records.list", get(list_records))
         .route("/xrpc/com.indexer.collections.bulkSync", post(bulk_sync))
         .route("/xrpc/com.indexer.repos.smartSync", post(smart_sync))
-        .route("/xrpc/com.indexer.codegen.generate", post(handler_xrpc_codegen::generate_client_xrpc))
+        .route(
+            "/xrpc/com.indexer.codegen.generate",
+            post(handler_xrpc_codegen::generate_client_xrpc),
+        )
         // Dynamic collection-specific XRPC endpoints
-        .route("/xrpc/*method", get(handler_dynamic_xrpc::dynamic_xrpc_handler))
-        .route("/xrpc/*method", post(handler_dynamic_xrpc::dynamic_xrpc_post_handler))
-        // OAuth endpoints
-        .route("/oauth/authorize", post(handler_oauth::oauth_authorize))
+        .route(
+            "/xrpc/*method",
+            get(handler_dynamic_xrpc::dynamic_xrpc_handler),
+        )
+        .route(
+            "/xrpc/*method",
+            post(handler_dynamic_xrpc::dynamic_xrpc_post_handler),
+        )
         // Web interface
         .route("/", get(web::index))
         .route("/records", get(web::records_page))
···
         .route("/codegen", get(web::codegen_page))
         .route("/codegen/generate", post(handler_codegen::generate_client))
         .route("/lexicon", get(handler_lexicon::lexicon_page))
-        .route("/upload-lexicons", post(handler_upload_lexicon::upload_lexicons))
+        .route(
+            "/upload-lexicons",
+            post(handler_upload_lexicon::upload_lexicons),
+        )
         .layer(TraceLayer::new_for_http())
         .layer(CorsLayer::permissive())
         .with_state(state);
···
     State(state): State<AppState>,
     axum::extract::Json(params): axum::extract::Json<BulkSyncParams>,
 ) -> Result<Json<BulkSyncOutput>, StatusCode> {
-    match state.sync_service.backfill_collections(&params.collections, params.repos.as_deref()).await {
+    match state
+        .sync_service
+        .backfill_collections(&params.collections, params.repos.as_deref())
+        .await
+    {
         Ok(_) => {
             let total_records = state.database.get_total_record_count().await.unwrap_or(0);
             Ok(Json(BulkSyncOutput {
···
                 repos_processed: params.repos.map(|r| r.len() as i64).unwrap_or(0),
                 message: "Bulk sync completed successfully".to_string(),
             }))
-        },
-        Err(e) => {
-            Ok(Json(BulkSyncOutput {
-                success: false,
-                total_records: 0,
-                collections_synced: vec![],
-                repos_processed: 0,
-                message: format!("Bulk sync failed: {}", e),
-            }))
         }
+        Err(e) => Ok(Json(BulkSyncOutput {
+            success: false,
+            total_records: 0,
+            collections_synced: vec![],
+            repos_processed: 0,
+            message: format!("Bulk sync failed: {}", e),
+        })),
     }
 }
 
···
                 total_records,
                 collections_synced: params.collections.unwrap_or_default(),
                 repos_processed: 1,
-                message: format!("Smart sync completed for {}: {} records", params.did, records_count),
-            }))
-        },
-        Err(e) => {
-            Ok(Json(BulkSyncOutput {
-                success: false,
-                total_records: 0,
-                collections_synced: vec![],
-                repos_processed: 0,
-                message: format!("Smart sync failed for {}: {}", params.did, e),
+                message: format!(
+                    "Smart sync completed for {}: {} records",
+                    params.did, records_count
+                ),
             }))
         }
+        Err(e) => Ok(Json(BulkSyncOutput {
+            success: false,
+            total_records: 0,
+            collections_synced: vec![],
+            repos_processed: 0,
+            message: format!("Smart sync failed for {}: {}", params.did, e),
+        })),
     }
 }

frontend/.gitignore

···
-node_modules
+node_modules
+.env

frontend/components/Layout.tsx frontend/src/components/Layout.tsx

···
 interface LayoutProps {
   title?: string;
   children: JSX.Element | JSX.Element[];
+  currentUser?: { handle?: string; isAuthenticated: boolean };
 }
 
 export function Layout({
   title = "Slice",
   children,
+  currentUser,
 }: LayoutProps) {
   return (
     <html lang="en">
···
             <a href="/" className="text-xl font-bold hover:text-blue-200">
               Slice
             </a>
+            <div className="flex items-center space-x-4">
+              {currentUser?.isAuthenticated ? (
+                <div className="flex items-center space-x-3">
+                  <span className="text-sm text-blue-100">
+                    {currentUser.handle || "Authenticated User"}
+                  </span>
+                  <form method="post" action="/logout" className="inline">
+                    <button
+                      type="submit"
+                      className="text-sm bg-blue-700 hover:bg-blue-800 px-3 py-1 rounded"
+                    >
+                      Logout
+                    </button>
+                  </form>
+                </div>
+              ) : (
+                <a href="/login" className="text-sm bg-blue-700 hover:bg-blue-800 px-3 py-1 rounded">
+                  Login
+                </a>
+              )}
+            </div>
           </div>
         </nav>
         <main className="container mx-auto mt-8 px-4">{children}</main>

frontend/deno.json

···
 {
   "tasks": {
-    "start": "deno run --allow-net main.tsx",
-    "dev": "deno run --allow-net --watch main.tsx"
+    "start": "deno run -A --env-file=.env src/main.tsx",
+    "dev": "deno run -A --env-file=.env --watch src/main.tsx"
   },
   "fmt": {
     "useTabs": false,
···
   "imports": {
     "preact": "npm:preact@^10.27.1",
     "preact-render-to-string": "npm:preact-render-to-string@^6.5.13",
-    "typed-htmx": "npm:typed-htmx@^0.3.1"
+    "typed-htmx": "npm:typed-htmx@^0.3.1",
+    "@std/http": "jsr:@std/http@^1.0.20"
   },
   "nodeModulesDir": "auto"
 }

frontend/deno.lock

···
 {
   "version": "5",
   "specifiers": {
+    "jsr:@std/http@^1.0.20": "1.0.20",
     "npm:preact-render-to-string@^6.5.13": "6.5.13_preact@10.27.1",
     "npm:preact@^10.27.1": "10.27.1",
     "npm:typed-htmx@~0.3.1": "0.3.1"
+  },
+  "jsr": {
+    "@std/http@1.0.20": {
+      "integrity": "b5cc33fc001bccce65ed4c51815668c9891c69ccd908295997e983d8f56070a1"
+    }
   },
   "npm": {
     "preact-render-to-string@6.5.13_preact@10.27.1": {
···
   },
   "workspace": {
     "dependencies": [
+      "jsr:@std/http@^1.0.20",
       "npm:preact-render-to-string@^6.5.13",
       "npm:preact@^10.27.1",
       "npm:typed-htmx@~0.3.1"

frontend/main.tsx

···
-import { render } from "preact-render-to-string";
-import { IndexPage } from "./pages/IndexPage.tsx";
-import { LoginPage } from "./pages/LoginPage.tsx";
-import { SlicePage } from "./pages/SlicePage.tsx";
-import { SliceCodegenPage } from "./pages/SliceCodegenPage.tsx";
-import { SliceLexiconPage } from "./pages/SliceLexiconPage.tsx";
-import { SliceRecordsPage } from "./pages/SliceRecordsPage.tsx";
-import { SliceSyncPage } from "./pages/SliceSyncPage.tsx";
-
-const handler = (req: Request): Response => {
-  const url = new URL(req.url);
-  const pathname = url.pathname;
-
-  let html: string;
-
-  // Parse slice routes
-  const sliceMatch = pathname.match(/^\/slices\/([^\/]+)(.*)$/);
-  
-  if (pathname === "/") {
-    // Slice list page
-    const indexData = {
-      slices: [
-        { id: "example", name: "Example Slice", createdAt: "2024-01-15T10:00:00Z" },
-        { id: "demo", name: "Demo Slice", createdAt: "2024-01-14T15:30:00Z" },
-      ],
-    };
-    html = render(<IndexPage slices={indexData.slices} />);
-  } else if (pathname === "/login") {
-    // Login page
-    html = render(<LoginPage />);
-  } else if (sliceMatch) {
-    const sliceId = sliceMatch[1];
-    const subPath = sliceMatch[2] || "";
-
-    const mockSliceData = {
-      sliceId,
-      sliceName: sliceId === "example" ? "Example Slice" : "Demo Slice",
-      totalRecords: 1250,
-      collections: [
-        { name: "com.chadtmiller.slice", count: 5 },
-        { name: "social.grain.gallery", count: 850 },
-        { name: "social.grain.comment", count: 400 },
-      ],
-    };
-
-    switch (subPath) {
-      case "": {
-        // Slice overview page
-        html = render(<SlicePage {...mockSliceData} currentTab="overview" />);
-        break;
-      }
-      
-      case "/records": {
-        // Slice records page
-        const recordsData = {
-          ...mockSliceData,
-          records: [
-            {
-              uri: `at://did:plc:example/com.chadtmiller.slice/3k2a4b5c6d`,
-              indexed_at: "2024-01-15 12:45:00",
-              collection: "com.chadtmiller.slice",
-              did: "did:plc:example",
-              cid: "bafyreigbtj4x7ip5legnfznufuopl4sg4knzc2cof6duas4b3q2fy6swua",
-              value: true,
-              pretty_value: `{\n  "name": "${mockSliceData.sliceName}",\n  "createdAt": "2024-01-15T12:45:00.000Z",\n  "$type": "com.chadtmiller.slice"\n}`,
-            },
-          ],
-          availableCollections: mockSliceData.collections,
-        };
-        html = render(<SliceRecordsPage {...recordsData} />);
-        break;
-      }
-
-      case "/sync": {
-        html = render(<SliceSyncPage {...mockSliceData} />);
-        break;
-      }
-
-      case "/lexicon": {
-        const lexiconData = {
-          ...mockSliceData,
-          lexicons: [
-            {
-              nsid: "com.chadtmiller.slice",
-              updated_at: "2024-01-15 10:30:00",
-              pretty_definitions: `{\n  "lexicon": 1,\n  "id": "com.chadtmiller.slice",\n  "defs": {\n    "main": {\n      "type": "record",\n      "description": "Slice application record type"\n    }\n  }\n}`,
-            },
-          ],
-        };
-        html = render(<SliceLexiconPage {...lexiconData} />);
-        break;
-      }
-
-      case "/codegen": {
-        const codegenData = {
-          ...mockSliceData,
-          lexicons: [
-            { nsid: "com.chadtmiller.slice" },
-            { nsid: "social.grain.gallery" },
-          ],
-        };
-        html = render(<SliceCodegenPage {...codegenData} />);
-        break;
-      }
-
-      default:
-        // 404 for unknown slice subpaths
-        return Response.redirect(new URL("/", req.url), 302);
-    }
-  } else {
-    // 404 page - redirect to home for now
-    return Response.redirect(new URL("/", req.url), 302);
-  }
-
-  return new Response(`<!DOCTYPE html>${html}`, {
-    status: 200,
-    headers: {
-      "content-type": "text/html",
-    },
-  });
-};
-
-Deno.serve(
-  {
-    port: 8000,
-    onListen: () => {
-      console.log("Frontend server running on http://localhost:8000");
-    },
-  },
-  handler
-);

frontend/pages/IndexPage.tsx frontend/src/pages/IndexPage.tsx

···
 
 interface IndexPageProps {
   slices?: Slice[];
+  currentUser?: { handle?: string; isAuthenticated: boolean };
 }
 
-export function IndexPage({ slices = [] }: IndexPageProps) {
+export function IndexPage({ slices = [], currentUser }: IndexPageProps) {
   return (
-    <Layout title="Slices">
+    <Layout title="Slices" currentUser={currentUser}>
       <div className="max-w-4xl mx-auto">
         <div className="flex justify-between items-center mb-8">
           <h1 className="text-3xl font-bold text-gray-800">
             Slices
           </h1>
-          <button className="bg-blue-500 hover:bg-blue-600 text-white px-4 py-2 rounded">
+          <button 
+            className="bg-blue-500 hover:bg-blue-600 text-white px-4 py-2 rounded"
+            hx-get="/dialogs/create-slice"
+            hx-target="body"
+            hx-swap="beforeend"
+          >
             + Create Slice
           </button>
         </div>
···
             <p className="text-gray-500 mb-6">
               Create your first slice to get started organizing your AT Protocol data.
             </p>
-            <button className="bg-blue-500 hover:bg-blue-600 text-white px-6 py-2 rounded">
+            <button 
+              className="bg-blue-500 hover:bg-blue-600 text-white px-6 py-2 rounded"
+              hx-get="/dialogs/create-slice"
+              hx-target="body"
+              hx-swap="beforeend"
+            >
               Create Your First Slice
             </button>
           </div>

frontend/pages/LoginPage.tsx frontend/src/pages/LoginPage.tsx

···
 
 interface LoginPageProps {
   error?: string;
+  currentUser?: { handle?: string; isAuthenticated: boolean };
 }
 
-export function LoginPage({ error }: LoginPageProps) {
+export function LoginPage({ error, currentUser }: LoginPageProps) {
   return (
-    <Layout title="Login - Slice">
+    <Layout title="Login - Slice" currentUser={currentUser}>
       <div className="max-w-md mx-auto mt-16">
         <div className="bg-white rounded-lg shadow-md p-8">
           <div className="text-center mb-8">
···
             </div>
           )}
 
-          <form method="post" action="/login" className="space-y-6">
+          <form method="post" action="/oauth/authorize" className="space-y-6">
             <div>
               <label
-                htmlFor="handle"
+                htmlFor="loginHint"
                 className="block text-sm font-medium text-gray-700 mb-2"
               >
                 AT Protocol Handle
               </label>
               <input
                 type="text"
-                id="handle"
-                name="handle"
+                id="loginHint"
+                name="loginHint"
                 placeholder="alice.bsky.social"
                 className="w-full px-3 py-2 border border-gray-300 rounded-md focus:outline-none focus:ring-2 focus:ring-blue-500 focus:border-blue-500"
                 required
···
               type="submit"
               className="w-full bg-blue-500 hover:bg-blue-600 text-white font-medium py-2 px-4 rounded-md transition-colors"
             >
-              Sign In
+              Sign In with OAuth
             </button>
           </form>
 

frontend/pages/SliceCodegenPage.tsx frontend/src/pages/SliceCodegenPage.tsx

···
 interface SliceCodegenPageProps {
   sliceName?: string;
   sliceId?: string;
+  currentUser?: { handle?: string; isAuthenticated: boolean };
 }
 
 export function SliceCodegenPage({
   sliceName = "My Slice",
   sliceId = "example",
+  currentUser,
 }: SliceCodegenPageProps) {
   const tabs = [
     { id: "overview", name: "Overview", href: `/slices/${sliceId}` },
···
     { id: "sync", name: "Sync", href: `/slices/${sliceId}/sync` },
     { id: "lexicon", name: "Lexicons", href: `/slices/${sliceId}/lexicon` },
     { id: "codegen", name: "Code Gen", href: `/slices/${sliceId}/codegen` },
+    { id: "settings", name: "Settings", href: `/slices/${sliceId}/settings` },
   ];
 
   return (
-    <Layout title={`${sliceName} - Code Generation`}>
+    <Layout title={`${sliceName} - Code Generation`} currentUser={currentUser}>
       <div className="max-w-4xl mx-auto">
         <div className="flex items-center justify-between mb-8">
           <div className="flex items-center">

frontend/pages/SliceLexiconPage.tsx frontend/src/pages/SliceLexiconPage.tsx

···
 interface SliceLexiconPageProps {
   sliceName?: string;
   sliceId?: string;
+  currentUser?: { handle?: string; isAuthenticated: boolean };
 }
 
 export function SliceLexiconPage({
   sliceName = "My Slice",
   sliceId = "example",
+  currentUser,
 }: SliceLexiconPageProps) {
   const tabs = [
     { id: "overview", name: "Overview", href: `/slices/${sliceId}` },
···
     { id: "sync", name: "Sync", href: `/slices/${sliceId}/sync` },
     { id: "lexicon", name: "Lexicons", href: `/slices/${sliceId}/lexicon` },
     { id: "codegen", name: "Code Gen", href: `/slices/${sliceId}/codegen` },
+    { id: "settings", name: "Settings", href: `/slices/${sliceId}/settings` },
   ];
 
   return (
-    <Layout title={`${sliceName} - Lexicons`}>
+    <Layout title={`${sliceName} - Lexicons`} currentUser={currentUser}>
       <div className="max-w-4xl mx-auto">
         <div className="flex items-center justify-between mb-8">
           <div className="flex items-center">

frontend/pages/SlicePage.tsx frontend/src/pages/SlicePage.tsx

···
   sliceName?: string;
   sliceId?: string;
   currentTab?: string;
+  currentUser?: { handle?: string; isAuthenticated: boolean };
 }
 
 export function SlicePage({
···
   sliceName = "My Slice",
   sliceId = "example",
   currentTab = "overview",
+  currentUser,
 }: SlicePageProps) {
   const tabs = [
     { id: "overview", name: "Overview", href: `/slices/${sliceId}` },
···
     { id: "sync", name: "Sync", href: `/slices/${sliceId}/sync` },
     { id: "lexicon", name: "Lexicons", href: `/slices/${sliceId}/lexicon` },
     { id: "codegen", name: "Code Gen", href: `/slices/${sliceId}/codegen` },
+    { id: "settings", name: "Settings", href: `/slices/${sliceId}/settings` },
   ];
 
   return (
-    <Layout title={sliceName}>
+    <Layout title={sliceName} currentUser={currentUser}>
       <div className="max-w-4xl mx-auto">
         <div className="flex items-center justify-between mb-8">
           <div className="flex items-center">

frontend/pages/SliceRecordsPage.tsx frontend/src/pages/SliceRecordsPage.tsx

···
   author?: string;
   sliceName?: string;
   sliceId?: string;
+  currentUser?: { handle?: string; isAuthenticated: boolean };
 }
 
 export function SliceRecordsPage({
···
   author = "",
   sliceName = "My Slice",
   sliceId = "example",
+  currentUser,
 }: SliceRecordsPageProps) {
   const tabs = [
     { id: "overview", name: "Overview", href: `/slices/${sliceId}` },
···
     { id: "sync", name: "Sync", href: `/slices/${sliceId}/sync` },
     { id: "lexicon", name: "Lexicons", href: `/slices/${sliceId}/lexicon` },
     { id: "codegen", name: "Code Gen", href: `/slices/${sliceId}/codegen` },
+    { id: "settings", name: "Settings", href: `/slices/${sliceId}/settings` },
   ];
 
   return (
-    <Layout title={`${sliceName} - Records`}>
+    <Layout title={`${sliceName} - Records`} currentUser={currentUser}>
       <div className="max-w-4xl mx-auto">
         <div className="flex items-center justify-between mb-8">
           <div className="flex items-center">

frontend/pages/SliceSyncPage.tsx frontend/src/pages/SliceSyncPage.tsx

···
 interface SliceSyncPageProps {
   sliceName?: string;
   sliceId?: string;
+  currentUser?: { handle?: string; isAuthenticated: boolean };
 }
 
 export function SliceSyncPage({
   sliceName = "My Slice",
   sliceId = "example",
+  currentUser,
 }: SliceSyncPageProps) {
   const tabs = [
     { id: "overview", name: "Overview", href: `/slices/${sliceId}` },
···
     { id: "sync", name: "Sync", href: `/slices/${sliceId}/sync` },
     { id: "lexicon", name: "Lexicons", href: `/slices/${sliceId}/lexicon` },
     { id: "codegen", name: "Code Gen", href: `/slices/${sliceId}/codegen` },
+    { id: "settings", name: "Settings", href: `/slices/${sliceId}/settings` },
   ];
 
   return (
-    <Layout title={`${sliceName} - Sync`}>
+    <Layout title={`${sliceName} - Sync`} currentUser={currentUser}>
       <div className="max-w-4xl mx-auto">
         <div className="flex items-center justify-between mb-8">
           <div className="flex items-center">

frontend/scripts/register-oauth-client.sh

···
+#!/bin/bash
+
+# OAuth Dynamic Client Registration Script for AT Protocol
+# Registers a new OAuth client with the AIP server per RFC 7591
+# Usage: bash scripts/register-oauth-client.sh
+
+set -e  # Exit on any error
+
+# Configuration
+AIP_BASE="${AIP_BASE_URL:-http://localhost:8081}"
+CLIENT_BASE_URL="${CLIENT_BASE_URL:-http://localhost:8080}"
+CLIENT_NAME="${CLIENT_NAME:-Slice AT Proto Client}"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
+CONFIG_FILE="$ROOT_DIR/.env"
+
+echo "🚀 OAuth Dynamic Client Registration for Slice"
+echo "AIP Server: $AIP_BASE"
+echo "Client Base URL: $CLIENT_BASE_URL"
+echo "Client Name: $CLIENT_NAME"
+echo
+
+# Check if client is already registered
+if [ -f "$CONFIG_FILE" ]; then
+    echo "⚠️  Existing OAuth client configuration found at $CONFIG_FILE"
+    echo -n "Do you want to register a new client? This will overwrite the existing config. (y/N): "
+    read -r OVERWRITE
+    if [ "$OVERWRITE" != "y" ] && [ "$OVERWRITE" != "Y" ]; then
+        echo "❌ Registration cancelled"
+        exit 1
+    fi
+fi
+
+echo "🔍 Using OAuth registration endpoint..."
+REGISTRATION_ENDPOINT="$AIP_BASE/oauth/clients/register"
+
+echo "✅ Registration endpoint: $REGISTRATION_ENDPOINT"
+echo
+
+# Create client registration request
+echo "📝 Creating client registration request..."
+REDIRECT_URI="$CLIENT_BASE_URL/oauth/callback"
+
+REGISTRATION_REQUEST=$(cat <<EOF
+{
+    "client_name": "$CLIENT_NAME",
+    "redirect_uris": ["$REDIRECT_URI"],
+    "scope": "atproto:atproto atproto:transition:generic",
+    "grant_types": ["authorization_code", "refresh_token"],
+    "response_types": ["code"],
+    "token_endpoint_auth_method": "client_secret_basic"
+}
+EOF
+)
+
+echo "Registration request:"
+echo "$REGISTRATION_REQUEST" | jq '.' 2>/dev/null || echo "$REGISTRATION_REQUEST"
+echo
+
+# Register the client
+echo "🔄 Registering client with AIP server..."
+REGISTRATION_RESPONSE=$(curl -s -X POST "$REGISTRATION_ENDPOINT" \
+    -H "Content-Type: application/json" \
+    -d "$REGISTRATION_REQUEST" || {
+        echo "❌ Failed to register client with AIP server"
+        echo "Make sure the AIP server is running at $AIP_BASE"
+        exit 1
+    })
+
+echo "Registration response:"
+echo "$REGISTRATION_RESPONSE" | jq '.' 2>/dev/null || echo "$REGISTRATION_RESPONSE"
+echo
+
+# Extract client credentials
+CLIENT_ID=$(echo "$REGISTRATION_RESPONSE" | grep -o '"client_id":"[^"]*' | cut -d'"' -f4)
+CLIENT_SECRET=$(echo "$REGISTRATION_RESPONSE" | grep -o '"client_secret":"[^"]*' | cut -d'"' -f4)
+
+if [ -z "$CLIENT_ID" ] || [ -z "$CLIENT_SECRET" ]; then
+    echo "❌ Failed to extract client credentials from registration response"
+    echo "Expected client_id and client_secret in response"
+    echo "Response was: $REGISTRATION_RESPONSE"
+    exit 1
+fi
+
+echo "✅ Client registered successfully!"
+echo "Client ID: $CLIENT_ID"
+echo "Client Secret: [REDACTED]"
+echo
+
+# Save credentials to .env.oauth file
+echo "💾 Saving client credentials to $CONFIG_FILE..."
+cat > "$CONFIG_FILE" <<EOF
+# OAuth Client Credentials for Slice AT Proto Client
+# Generated on $(date)
+# AIP Server: $AIP_BASE
+
+OAUTH_CLIENT_ID="$CLIENT_ID"
+OAUTH_CLIENT_SECRET="$CLIENT_SECRET"
+OAUTH_REDIRECT_URI="$REDIRECT_URI"
+OAUTH_AIP_BASE_URL="$AIP_BASE"
+EOF
+
+echo "✅ Client registration complete!"
+echo
+echo "📋 Summary:"
+echo "  - Client ID: $CLIENT_ID"
+echo "  - Client Name: $CLIENT_NAME"
+echo "  - Redirect URI: $REDIRECT_URI"
+echo "  - Scopes: atproto:atproto atproto:transition:generic"
+echo "  - Config saved to: $CONFIG_FILE"
+echo
+echo "🔧 Environment variables saved to $CONFIG_FILE:"
+echo "  OAUTH_CLIENT_ID"
+echo "  OAUTH_CLIENT_SECRET"
+echo "  OAUTH_REDIRECT_URI"
+echo "  OAUTH_AIP_BASE_URL"
+echo
+echo "💡 To use these credentials in your application:"
+echo "  source $CONFIG_FILE"
+echo "  # Or load them in your .env file"
+echo
+echo "🧪 To test the OAuth flow, you can now use the registered credentials"
+echo "    with your AtProtoClient in TypeScript/Deno."

frontend/src/client.ts

···
+// Generated TypeScript client for AT Protocol records
+// Generated at: 2025-08-21 16:58:09 UTC
+// Lexicons: 1
+
+export interface OAuthAuthorizeParams {
+  loginHint: string;
+  redirectUri: string;
+  scope?: string[];
+  state?: string;
+}
+
+export interface OAuthAuthorizeResponse {
+  authorizationUrl: string;
+  codeVerifier: string;
+  state: string;
+}
+
+export interface OAuthCallbackParams {
+  code: string;
+  state: string;
+  codeVerifier: string;
+  redirectUri: string;
+}
+
+export interface OAuthTokenResponse {
+  access_token: string;
+  token_type: string;
+  expires_in?: number;
+  refresh_token?: string;
+  scope?: string;
+}
+
+export interface PKCEChallenge {
+  codeVerifier: string;
+  codeChallenge: string;
+  codeChallengeMethod: "S256";
+}
+
+export interface TokenStorage {
+  accessToken?: string;
+  refreshToken?: string;
+  expiresAt?: number;
+  tokenType?: string;
+  scope?: string;
+}
+
+export interface RecordResponse<T extends any> {
+  uri: string;
+  cid: string;
+  did: string;
+  collection: string;
+  value: T;
+  indexed_at: string;
+}
+
+export interface ListRecordsResponse<T extends any> {
+  records: RecordResponse<T>[];
+  cursor?: string;
+}
+
+export interface ListRecordsParams {
+  author?: string;
+  limit?: number;
+  cursor?: string;
+}
+
+export interface GetRecordParams {
+  uri: string;
+}
+
+export interface CollectionOperations<T> {
+  listRecords(params?: ListRecordsParams): Promise<ListRecordsResponse<T>>;
+  getRecord(params: GetRecordParams): Promise<RecordResponse<T>>;
+}
+
+export interface XyzSliceatSliceRecord {
+  /** When the slice was created */
+  createdAt: string;
+  /** Name of the slice */
+  name: string;
+}
+
+export class PKCEUtils {
+  static generateCodeVerifier(): string {
+    const array = new Uint8Array(32);
+    crypto.getRandomValues(array);
+    return btoa(String.fromCharCode.apply(null, Array.from(array)))
+      .replace(/\+/g, "-")
+      .replace(/\//g, "_")
+      .replace(/=/g, "");
+  }
+
+  static async generateCodeChallenge(verifier: string): Promise<string> {
+    const encoder = new TextEncoder();
+    const data = encoder.encode(verifier);
+    const digest = await crypto.subtle.digest("SHA-256", data);
+    return btoa(
+      String.fromCharCode.apply(null, Array.from(new Uint8Array(digest)))
+    )
+      .replace(/\+/g, "-")
+      .replace(/\//g, "_")
+      .replace(/=/g, "");
+  }
+
+  static async generatePKCEChallenge(): Promise<PKCEChallenge> {
+    const codeVerifier = this.generateCodeVerifier();
+    const codeChallenge = await this.generateCodeChallenge(codeVerifier);
+    return {
+      codeVerifier,
+      codeChallenge,
+      codeChallengeMethod: "S256",
+    };
+  }
+}
+
+class BaseClient {
+  protected readonly baseUrl: string;
+  protected readonly authBaseUrl: string;
+  protected readonly clientId: string;
+  protected readonly clientSecret: string;
+  private static tokenStorage: TokenStorage = {};
+  private refreshPromise?: Promise<void>;
+
+  constructor(
+    baseUrl: string,
+    authBaseUrl: string,
+    clientId: string,
+    clientSecret: string
+  ) {
+    this.baseUrl = baseUrl;
+    this.authBaseUrl = authBaseUrl;
+    this.clientId = clientId;
+    this.clientSecret = clientSecret;
+  }
+
+  protected setTokens(tokenResponse: OAuthTokenResponse): void {
+    // Ensure token type is properly capitalized
+    const tokenType = tokenResponse.token_type
+      ? tokenResponse.token_type.charAt(0).toUpperCase() +
+        tokenResponse.token_type.slice(1).toLowerCase()
+      : "Bearer";
+
+    BaseClient.tokenStorage = {
+      accessToken: tokenResponse.access_token,
+      refreshToken: tokenResponse.refresh_token,
+      tokenType: tokenType,
+      scope: tokenResponse.scope,
+      expiresAt: tokenResponse.expires_in
+        ? Date.now() + tokenResponse.expires_in * 1000
+        : undefined,
+    };
+  }
+
+  private isTokenExpired(): boolean {
+    if (!BaseClient.tokenStorage.expiresAt) return false;
+    return Date.now() >= BaseClient.tokenStorage.expiresAt - 30000;
+  }
+
+  private async ensureValidToken(): Promise<void> {
+    if (!BaseClient.tokenStorage.accessToken) {
+      throw new Error("No access token available. Please authenticate first.");
+    }
+
+    if (!this.isTokenExpired()) {
+      return;
+    }
+
+    if (!BaseClient.tokenStorage.refreshToken) {
+      throw new Error(
+        "Access token expired and no refresh token available. Please re-authenticate."
+      );
+    }
+
+    if (this.refreshPromise) {
+      return this.refreshPromise;
+    }
+
+    this.refreshPromise = this.refreshAccessToken();
+    try {
+      await this.refreshPromise;
+    } finally {
+      this.refreshPromise = undefined;
+    }
+  }
+
+  private async refreshAccessToken(): Promise<void> {
+    if (!BaseClient.tokenStorage.refreshToken) {
+      throw new Error("No refresh token available");
+    }
+
+    try {
+      const response = await fetch(`${this.authBaseUrl}/oauth/token`, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/x-www-form-urlencoded",
+        },
+        body: new URLSearchParams({
+          grant_type: "refresh_token",
+          refresh_token: BaseClient.tokenStorage.refreshToken,
+          client_id: this.clientId,
+          client_secret: this.clientSecret,
+        }),
+      });
+
+      if (!response.ok) {
+        throw new Error(
+          `Token refresh failed: ${response.status} ${response.statusText}`
+        );
+      }
+
+      const tokenResponse: OAuthTokenResponse = await response.json();
+      this.setTokens(tokenResponse);
+    } catch (error) {
+      BaseClient.tokenStorage = {};
+      throw new Error(`Failed to refresh token: ${error}`);
+    }
+  }
+
+  protected getTokenInfo(): {
+    hasToken: boolean;
+    expiresAt?: number;
+    scope?: string;
+  } {
+    return {
+      hasToken: !!BaseClient.tokenStorage.accessToken,
+      expiresAt: BaseClient.tokenStorage.expiresAt,
+      scope: BaseClient.tokenStorage.scope,
+    };
+  }
+
+  protected clearTokens(): void {
+    BaseClient.tokenStorage = {};
+  }
+
+  public setTokensFromSession(tokens: TokenStorage): void {
+    BaseClient.tokenStorage = tokens;
+  }
+
+  public getTokenStorage(): TokenStorage {
+    return BaseClient.tokenStorage;
+  }
+
+  protected async makeRequest(
+    endpoint: string,
+    method?: "GET" | "POST" | "PUT" | "DELETE",
+    params?: any
+  ): Promise<any> {
+    const httpMethod = method || "GET";
+    let url = endpoint.startsWith("oauth/")
+      ? `${this.authBaseUrl}/${endpoint}`
+      : `${this.baseUrl}/xrpc/${endpoint}`;
+
+    const requestInit: RequestInit = {
+      method: httpMethod,
+      headers: {},
+    };
+
+    // Add authorization header for protected endpoints
+    const needsAuth =
+      !endpoint.startsWith("oauth/") || endpoint === "oauth/userinfo";
+    const needsClientAuth =
+      endpoint === "oauth/par" || endpoint === "oauth/token";
+
+    if (needsAuth) {
+      await this.ensureValidToken();
+
+      if (BaseClient.tokenStorage.accessToken) {
+        (requestInit.headers as any)[
+          "Authorization"
+        ] = `${BaseClient.tokenStorage.tokenType} ${BaseClient.tokenStorage.accessToken}`;
+      }
+    } else if (needsClientAuth) {
+      // Use HTTP Basic Auth for client authentication
+      const credentials = btoa(`${this.clientId}:${this.clientSecret}`);
+      (requestInit.headers as any)["Authorization"] = `Basic ${credentials}`;
+    }
+
+    if (httpMethod === "GET" && params) {
+      const searchParams = new URLSearchParams();
+      Object.entries(params).forEach(([key, value]) => {
+        if (value !== undefined && value !== null) {
+          searchParams.append(key, String(value));
+        }
+      });
+      const queryString = searchParams.toString();
+      if (queryString) {
+        url += "?" + queryString;
+      }
+    } else if (httpMethod !== "GET" && params) {
+      if (endpoint.startsWith("oauth/") && endpoint !== "oauth/userinfo") {
+        // OAuth token endpoints expect form data
+        (requestInit.headers as any)["Content-Type"] =
+          "application/x-www-form-urlencoded";
+        requestInit.body = new URLSearchParams(params);
+      } else {
+        // Regular API endpoints and userinfo expect JSON
+        (requestInit.headers as any)["Content-Type"] = "application/json";
+        requestInit.body = JSON.stringify(params);
+      }
+    }
+
+    const response = await fetch(url, requestInit);
+    if (!response.ok) {
+      throw new Error(
+        `Request failed: ${response.status} ${response.statusText}`
+      );
+    }
+
+    return await response.json();
+  }
+}
+
+class OAuthClient extends BaseClient {
+  constructor(
+    baseUrl: string,
+    authBaseUrl: string,
+    clientId: string,
+    clientSecret: string
+  ) {
+    super(baseUrl, authBaseUrl, clientId, clientSecret);
+  }
+
+  async authorize(
+    params: OAuthAuthorizeParams
+  ): Promise<OAuthAuthorizeResponse> {
+    const pkce = await PKCEUtils.generatePKCEChallenge();
+    const state = params.state || this.generateState();
+
+    // Step 1: Push authorization request (PAR)
+    const parParams = {
+      client_id: this.clientId,
+      response_type: "code",
+      redirect_uri: params.redirectUri,
+      state,
+      code_challenge: pkce.codeChallenge,
+      code_challenge_method: pkce.codeChallengeMethod,
+      scope:
+        params.scope?.join(" ") || "atproto:atproto atproto:transition:generic",
+      login_hint: params.loginHint,
+    };
+
+    // POST to PAR endpoint
+    const parResponse = await this.makeRequest("oauth/par", "POST", parParams);
+
+    // Step 2: Build authorization URL with request_uri
+    const authParams = new URLSearchParams({
+      client_id: this.clientId,
+      request_uri: parResponse.request_uri,
+    });
+
+    const authorizationUrl = `${
+      this.authBaseUrl
+    }/oauth/authorize?${authParams.toString()}`;
+
+    return {
+      authorizationUrl,
+      codeVerifier: pkce.codeVerifier,
+      state,
+    };
+  }
+
+  async handleCallback(params: OAuthCallbackParams): Promise<void> {
+    const tokenResponse: OAuthTokenResponse = await this.makeRequest(
+      "oauth/token",
+      "POST",
+      {
+        grant_type: "authorization_code",
+        code: params.code,
+        redirect_uri: params.redirectUri,
+        client_id: this.clientId,
+        client_secret: this.clientSecret,
+        code_verifier: params.codeVerifier,
+      }
+    );
+
+    this.setTokens(tokenResponse);
+  }
+
+  isAuthenticated(): boolean {
+    return this.getTokenInfo().hasToken;
+  }
+
+  logout(): void {
+    this.clearTokens();
+  }
+
+  getAuthenticationInfo(): {
+    isAuthenticated: boolean;
+    expiresAt?: number;
+    scope?: string;
+  } {
+    const tokenInfo = this.getTokenInfo();
+    return {
+      isAuthenticated: tokenInfo.hasToken,
+      expiresAt: tokenInfo.expiresAt,
+      scope: tokenInfo.scope,
+    };
+  }
+
+  async getUserInfo(): Promise<{ sub: string; did?: string } | null> {
+    if (!this.isAuthenticated()) {
+      return null;
+    }
+
+    try {
+      const userInfo = await this.makeRequest("oauth/userinfo", "GET");
+      return userInfo;
+    } catch (error) {
+      console.error("Failed to fetch user info:", error);
+      return null;
+    }
+  }
+
+  private generateState(): string {
+    const array = new Uint8Array(16);
+    crypto.getRandomValues(array);
+    return btoa(String.fromCharCode.apply(null, Array.from(array)))
+      .replace(/\+/g, "-")
+      .replace(/\//g, "_")
+      .replace(/=/g, "");
+  }
+}
+
+class SliceSliceatXyzClient extends BaseClient {
+  constructor(
+    baseUrl: string,
+    authBaseUrl: string,
+    clientId: string,
+    clientSecret: string
+  ) {
+    super(baseUrl, authBaseUrl, clientId, clientSecret);
+  }
+
+  async listRecords(
+    params?: ListRecordsParams
+  ): Promise<ListRecordsResponse<XyzSliceatSliceRecord>> {
+    return await this.makeRequest("xyz.sliceat.slice.list", "GET", params);
+  }
+
+  async getRecord(
+    params: GetRecordParams
+  ): Promise<RecordResponse<XyzSliceatSliceRecord>> {
+    return await this.makeRequest("xyz.sliceat.slice.get", "GET", params);
+  }
+
+  async createRecord(
+    record: XyzSliceatSliceRecord
+  ): Promise<{ uri: string; cid: string }> {
+    const recordWithType = {
+      $type: "xyz.sliceat.slice",
+      ...record,
+    };
+    return await this.makeRequest("xyz.sliceat.slice.create", "POST", recordWithType);
+  }
+
+  async updateRecord(
+    rkey: string,
+    record: XyzSliceatSliceRecord
+  ): Promise<{ uri: string; cid: string }> {
+    const recordWithType = {
+      $type: "xyz.sliceat.slice",
+      ...record,
+    };
+    return await this.makeRequest("xyz.sliceat.slice.update", "POST", {
+      rkey,
+      record: recordWithType,
+    });
+  }
+
+  async deleteRecord(rkey: string): Promise<void> {
+    return await this.makeRequest("xyz.sliceat.slice.delete", "POST", { rkey });
+  }
+}
+
+class SliceatXyzClient extends BaseClient {
+  readonly slice: SliceSliceatXyzClient;
+
+  constructor(
+    baseUrl: string,
+    authBaseUrl: string,
+    clientId: string,
+    clientSecret: string
+  ) {
+    super(baseUrl, authBaseUrl, clientId, clientSecret);
+    this.slice = new SliceSliceatXyzClient(
+      baseUrl,
+      authBaseUrl,
+      clientId,
+      clientSecret
+    );
+  }
+}
+
+class XyzClient extends BaseClient {
+  readonly sliceat: SliceatXyzClient;
+
+  constructor(
+    baseUrl: string,
+    authBaseUrl: string,
+    clientId: string,
+    clientSecret: string
+  ) {
+    super(baseUrl, authBaseUrl, clientId, clientSecret);
+    this.sliceat = new SliceatXyzClient(
+      baseUrl,
+      authBaseUrl,
+      clientId,
+      clientSecret
+    );
+  }
+}
+
+export class AtProtoClient extends BaseClient {
+  readonly xyz: XyzClient;
+  readonly oauth: OAuthClient;
+
+  constructor(
+    baseUrl: string,
+    authBaseUrl: string,
+    clientId: string,
+    clientSecret: string
+  ) {
+    super(baseUrl, authBaseUrl, clientId, clientSecret);
+    this.xyz = new XyzClient(baseUrl, authBaseUrl, clientId, clientSecret);
+    this.oauth = new OAuthClient(baseUrl, authBaseUrl, clientId, clientSecret);
+  }
+}

frontend/src/components/CreateSliceDialog.tsx

···
+interface CreateSliceDialogProps {
+  error?: string;
+  name?: string;
+}
+
+export function CreateSliceDialog({ error, name = "" }: CreateSliceDialogProps) {
+  return (
+    <div 
+      id="create-slice-modal" 
+      className="fixed inset-0 bg-gray-600 bg-opacity-50 overflow-y-auto h-full w-full z-50"
+      hx-on:click="if (event.target === this) this.remove()"
+    >
+      <div className="relative top-20 mx-auto p-5 border w-96 shadow-lg rounded-md bg-white">
+        <div className="mt-3">
+          <div className="flex justify-between items-center mb-4">
+            <h3 className="text-lg font-medium text-gray-900">
+              Create New Slice
+            </h3>
+            <button 
+              type="button" 
+              className="text-gray-400 hover:text-gray-600"
+              onclick="document.getElementById('create-slice-modal').remove()"
+            >
+              <svg className="h-6 w-6" fill="none" viewBox="0 0 24 24" stroke="currentColor">
+                <path strokeLinecap="round" strokeLinejoin="round" strokeWidth={2} d="M6 18L18 6M6 6l12 12" />
+              </svg>
+            </button>
+          </div>
+
+          {error && (
+            <div className="mb-4 p-3 bg-red-100 border border-red-400 text-red-700 rounded">
+              {error}
+            </div>
+          )}
+
+          <form 
+            hx-post="/slices"
+            hx-target="#create-slice-modal"
+            hx-swap="outerHTML"
+            className="space-y-4"
+          >
+            <div>
+              <label htmlFor="name" className="block text-sm font-medium text-gray-700 mb-1">
+                Slice Name
+              </label>
+              <input
+                type="text"
+                id="name"
+                name="name"
+                value={name}
+                required
+                className="w-full px-3 py-2 border border-gray-300 rounded-md shadow-sm focus:outline-none focus:ring-blue-500 focus:border-blue-500"
+                placeholder="Enter slice name"
+              />
+            </div>
+
+            <div className="flex justify-end space-x-3 pt-4">
+              <button
+                type="button"
+                className="px-4 py-2 text-sm font-medium text-gray-700 bg-gray-200 hover:bg-gray-300 rounded-md"
+                onclick="document.getElementById('create-slice-modal').remove()"
+              >
+                Cancel
+              </button>
+              <button
+                type="submit"
+                className="px-4 py-2 text-sm font-medium text-white bg-blue-600 hover:bg-blue-700 rounded-md"
+              >
+                Create Slice
+              </button>
+            </div>
+          </form>
+        </div>
+      </div>
+    </div>
+  );
+}

frontend/src/components/UpdateResult.tsx

···
+interface UpdateResultProps {
+  type: "success" | "error";
+  message: string;
+  showRefresh?: boolean;
+}
+
+export function UpdateResult({ type, message, showRefresh = false }: UpdateResultProps) {
+  const colorClass = type === "success" ? "text-green-600" : "text-red-600";
+  
+  return (
+    <div className={`${colorClass} text-sm`}>
+      {message}
+      {showRefresh && (
+        <>
+          {" "}
+          <a 
+            href="#" 
+            onclick="window.location.reload()" 
+            className="underline"
+          >
+            Refresh page
+          </a>{" "}
+          to see changes.
+        </>
+      )}
+    </div>
+  );
+}

frontend/src/config.ts

···
+// OAuth configuration for Slice frontend
+import { AtProtoClient } from "./client.ts";
+
+// Load environment variables
+const OAUTH_CLIENT_ID = Deno.env.get("OAUTH_CLIENT_ID");
+const OAUTH_CLIENT_SECRET = Deno.env.get("OAUTH_CLIENT_SECRET");
+const OAUTH_REDIRECT_URI = Deno.env.get("OAUTH_REDIRECT_URI");
+const OAUTH_AIP_BASE_URL = Deno.env.get("OAUTH_AIP_BASE_URL");
+const SESSION_ENCRYPTION_KEY = Deno.env.get("SESSION_ENCRYPTION_KEY");
+
+if (
+  !OAUTH_CLIENT_ID ||
+  !OAUTH_CLIENT_SECRET ||
+  !OAUTH_REDIRECT_URI ||
+  !OAUTH_AIP_BASE_URL ||
+  !SESSION_ENCRYPTION_KEY
+) {
+  throw new Error(
+    "Missing OAuth configuration. Please ensure .env file contains:\n" +
+      "OAUTH_CLIENT_ID, OAUTH_CLIENT_SECRET, OAUTH_REDIRECT_URI, OAUTH_AIP_BASE_URL, SESSION_ENCRYPTION_KEY"
+  );
+}
+
+// Create configured client instance
+export const atprotoClient = new AtProtoClient(
+  "http://localhost:3000", // Your API base URL
+  OAUTH_AIP_BASE_URL, // AIP OAuth service URL
+  OAUTH_CLIENT_ID, // OAuth client ID
+  OAUTH_CLIENT_SECRET // OAuth client secret
+);
+
+export const oauthConfig = {
+  redirectUri: OAUTH_REDIRECT_URI,
+  scopes: ["atproto:atproto", "atproto:transition:generic"],
+};
+
+// Simple in-memory storage for OAuth state
+export class OAuthStateManager {
+  private static states = new Map<
+    string,
+    { codeVerifier: string; timestamp: number }
+  >();
+
+  static store(state: string, codeVerifier: string): void {
+    this.states.set(state, {
+      codeVerifier,
+      timestamp: Date.now(),
+    });
+
+    // Auto-cleanup expired states (older than 10 minutes)
+    this.cleanup();
+  }
+
+  static retrieve(state: string): string | null {
+    const stored = this.states.get(state);
+    if (!stored) return null;
+
+    this.states.delete(state); // Use once and delete
+    return stored.codeVerifier;
+  }
+
+  private static cleanup(): void {
+    const now = Date.now();
+    for (const [key, value] of this.states.entries()) {
+      if (now - value.timestamp > 10 * 60 * 1000) {
+        // 10 minutes
+        this.states.delete(key);
+      }
+    }
+  }
+}
+
+class SecureCookies {
+  private static get key(): string {
+    return SESSION_ENCRYPTION_KEY!;
+  }
+
+  // Encrypt data using AES-GCM
+  static async encrypt(plaintext: string): Promise<string> {
+    const encoder = new TextEncoder();
+    const data = encoder.encode(plaintext);
+
+    // Generate a random IV
+    const iv = crypto.getRandomValues(new Uint8Array(12));
+
+    // Import key for AES-GCM
+    const keyData = encoder.encode(this.key.padEnd(32, "0").slice(0, 32)); // Ensure 32 bytes
+    const cryptoKey = await crypto.subtle.importKey(
+      "raw",
+      keyData,
+      { name: "AES-GCM" },
+      false,
+      ["encrypt"]
+    );
+
+    // Encrypt the data
+    const encrypted = await crypto.subtle.encrypt(
+      { name: "AES-GCM", iv: iv },
+      cryptoKey,
+      data
+    );
+
+    // Combine IV and encrypted data
+    const combined = new Uint8Array(iv.length + encrypted.byteLength);
+    combined.set(iv);
+    combined.set(new Uint8Array(encrypted), iv.length);
+
+    return btoa(String.fromCharCode(...combined));
+  }
+
+  // Decrypt data using AES-GCM
+  static async decrypt(encryptedData: string): Promise<string | null> {
+    try {
+      const encoder = new TextEncoder();
+      const decoder = new TextDecoder();
+      const combined = new Uint8Array(
+        atob(encryptedData)
+          .split("")
+          .map((c) => c.charCodeAt(0))
+      );
+
+      // Extract IV and encrypted data
+      const iv = combined.slice(0, 12);
+      const encrypted = combined.slice(12);
+
+      // Import key for AES-GCM
+      const keyData = encoder.encode(this.key.padEnd(32, "0").slice(0, 32));
+      const cryptoKey = await crypto.subtle.importKey(
+        "raw",
+        keyData,
+        { name: "AES-GCM" },
+        false,
+        ["decrypt"]
+      );
+
+      // Decrypt the data
+      const decrypted = await crypto.subtle.decrypt(
+        { name: "AES-GCM", iv: iv },
+        cryptoKey,
+        encrypted
+      );
+
+      return decoder.decode(decrypted);
+    } catch (_e) {
+      return null;
+    }
+  }
+
+  // Create HMAC signature for cookie integrity
+  static async sign(value: string): Promise<string> {
+    const encoder = new TextEncoder();
+    const keyData = encoder.encode(this.key);
+    const valueData = encoder.encode(value);
+
+    const cryptoKey = await crypto.subtle.importKey(
+      "raw",
+      keyData,
+      { name: "HMAC", hash: "SHA-256" },
+      false,
+      ["sign"]
+    );
+
+    const signature = await crypto.subtle.sign("HMAC", cryptoKey, valueData);
+    const signatureBase64 = btoa(
+      String.fromCharCode(...new Uint8Array(signature))
+    );
+
+    return `${value}.${signatureBase64}`;
+  }
+
+  // Verify HMAC signature and extract value
+  static async verify(signedValue: string): Promise<string | null> {
+    const parts = signedValue.split(".");
+    if (parts.length !== 2) return null;
+
+    const [value, _signature] = parts;
+    const expectedSigned = await this.sign(value);
+
+    // Constant-time comparison to prevent timing attacks
+    if (expectedSigned === signedValue) {
+      return value;
+    }
+
+    return null;
+  }
+
+  // Encrypt then sign for authenticated encryption
+  static async encryptAndSign(plaintext: string): Promise<string> {
+    const encrypted = await this.encrypt(plaintext);
+    return await this.sign(encrypted);
+  }
+
+  // Verify signature then decrypt
+  static async verifyAndDecrypt(
+    signedEncrypted: string
+  ): Promise<string | null> {
+    const encrypted = await this.verify(signedEncrypted);
+    if (!encrypted) return null;
+
+    return await this.decrypt(encrypted);
+  }
+}
+
+// Types for session data
+interface TokenStorage {
+  accessToken?: string;
+  refreshToken?: string;
+  expiresAt?: number;
+  tokenType?: string;
+}
+
+interface UserData {
+  handle?: string;
+  sub?: string;
+  tokens?: TokenStorage;
+  timestamp?: number;
+}
+
+// Cookie-based user session and token storage with HMAC signing
+export class UserSessionManager {
+  static async refreshUserInfo(): Promise<UserData> {
+    const userInfo = await atprotoClient.oauth.getUserInfo();
+
+    // Get current token info from client
+    const tokens = atprotoClient.getTokenStorage();
+
+    if (userInfo) {
+      const userData = {
+        handle: userInfo.did, // Use DID as handle for now
+        sub: userInfo.sub,
+        tokens: tokens,
+      };
+
+      return userData;
+    }
+
+    return {};
+  }
+
+  static async getCurrentUser(
+    req: Request
+  ): Promise<{ handle?: string; sub?: string; isAuthenticated: boolean }> {
+    // Parse session data from signed cookie
+    const cookies = req.headers.get("cookie") || "";
+    const sessionCookie = cookies
+      .split("; ")
+      .find((row) => row.startsWith("user_session="));
+
+    let userData: UserData = {};
+    if (sessionCookie) {
+      try {
+        const signedEncryptedValue = decodeURIComponent(
+          sessionCookie.split("=")[1]
+        );
+        const decryptedValue = await SecureCookies.verifyAndDecrypt(
+          signedEncryptedValue
+        );
+
+        if (decryptedValue) {
+          userData = JSON.parse(decryptedValue);
+
+          // Restore tokens to client if available and not expired
+          if (userData.tokens) {
+            const now = Date.now();
+            const isExpired =
+              userData.tokens.expiresAt && now >= userData.tokens.expiresAt;
+
+            if (!isExpired) {
+              // Restore tokens to client using the public method
+              atprotoClient.setTokensFromSession(userData.tokens);
+            }
+          }
+        }
+      } catch (_e) {
+        // Silently ignore invalid cookies
+      }
+    }
+
+    const authInfo = atprotoClient.oauth.getAuthenticationInfo();
+    return {
+      handle: userData.handle,
+      sub: userData.sub,
+      isAuthenticated: authInfo.isAuthenticated,
+    };
+  }
+
+  static async createSessionCookie(userData: UserData): Promise<string> {
+    const dataToStore = {
+      handle: userData.handle,
+      sub: userData.sub,
+      tokens: userData.tokens,
+      timestamp: Date.now(), // Add timestamp for freshness checks
+    };
+
+    const jsonValue = JSON.stringify(dataToStore);
+    const encryptedSignedValue = await SecureCookies.encryptAndSign(jsonValue);
+    const cookieValue = encodeURIComponent(encryptedSignedValue);
+
+    // Production cookie settings - 30 days expiration
+    return `user_session=${cookieValue}; HttpOnly; Secure; SameSite=Strict; Path=/; Max-Age=2592000`; // 30 days
+  }
+
+  static createClearCookie(): string {
+    return `user_session=; HttpOnly; Secure; SameSite=Strict; Path=/; Max-Age=0`;
+  }
+}

frontend/src/main.tsx

···
+import { route } from "@std/http/unstable-route";
+import { allRoutes } from "./routes/index.ts";
+
+function defaultHandler(req: Request) {
+  return Response.redirect(new URL("/", req.url), 302);
+}
+
+Deno.serve(
+  {
+    port: 8080,
+    onListen: () => console.log("Frontend server running on http://localhost:8080"),
+  },
+  route(allRoutes, defaultHandler)
+);

frontend/src/pages/SliceSettingsPage.tsx

···
+import { Layout } from "../components/Layout.tsx";
+
+interface SliceSettingsPageProps {
+  sliceName?: string;
+  sliceId?: string;
+  currentUser?: { handle?: string; isAuthenticated: boolean };
+}
+
+export function SliceSettingsPage({
+  sliceName = "My Slice",
+  sliceId = "example",
+  currentUser,
+}: SliceSettingsPageProps) {
+  const tabs = [
+    { id: "overview", name: "Overview", href: `/slices/${sliceId}` },
+    { id: "records", name: "Records", href: `/slices/${sliceId}/records` },
+    { id: "sync", name: "Sync", href: `/slices/${sliceId}/sync` },
+    { id: "lexicon", name: "Lexicons", href: `/slices/${sliceId}/lexicon` },
+    { id: "codegen", name: "Code Gen", href: `/slices/${sliceId}/codegen` },
+    { id: "settings", name: "Settings", href: `/slices/${sliceId}/settings` },
+  ];
+
+  return (
+    <Layout title={`${sliceName} - Settings`} currentUser={currentUser}>
+      <div className="max-w-4xl mx-auto">
+        <div className="flex items-center justify-between mb-8">
+          <div className="flex items-center">
+            <a
+              href="/"
+              className="text-blue-600 hover:text-blue-800 mr-4"
+            >
+              ← Back to Slices
+            </a>
+            <h1 className="text-3xl font-bold text-gray-800">
+              {sliceName}
+            </h1>
+          </div>
+        </div>
+
+        {/* Tab Navigation */}
+        <div className="border-b border-gray-200 mb-8">
+          <nav className="-mb-px flex space-x-8">
+            {tabs.map((tab) => (
+              <a
+                key={tab.id}
+                href={tab.href}
+                className={`py-2 px-1 border-b-2 font-medium text-sm ${
+                  tab.id === "settings"
+                    ? "border-blue-500 text-blue-600"
+                    : "border-transparent text-gray-500 hover:text-gray-700 hover:border-gray-300"
+                }`}
+              >
+                {tab.name}
+              </a>
+            ))}
+          </nav>
+        </div>
+
+        {/* Settings Content */}
+        <div className="space-y-8">
+          {/* Edit Name Section */}
+          <div className="bg-white rounded-lg shadow-md p-6">
+            <h2 className="text-xl font-semibold text-gray-800 mb-4">
+              ⚙️ Edit Slice Name
+            </h2>
+            <p className="text-gray-600 mb-4">
+              Change the display name of your slice.
+            </p>
+            <form 
+              hx-put={`/api/slices/${sliceId}/name`}
+              hx-target="#name-form-result"
+              hx-swap="innerHTML"
+            >
+              <div className="flex gap-4 items-end">
+                <div className="flex-1">
+                  <label htmlFor="slice-name" className="block text-sm font-medium text-gray-700 mb-2">
+                    Slice Name
+                  </label>
+                  <input
+                    type="text"
+                    id="slice-name"
+                    name="name"
+                    defaultValue={sliceName}
+                    required
+                    className="w-full px-3 py-2 border border-gray-300 rounded-md shadow-sm focus:ring-blue-500 focus:border-blue-500"
+                    placeholder="Enter slice name..."
+                  />
+                </div>
+                <button
+                  type="submit"
+                  className="bg-blue-500 hover:bg-blue-600 text-white px-6 py-2 rounded-md font-medium"
+                >
+                  Update Name
+                </button>
+              </div>
+              <div id="name-form-result" className="mt-4"></div>
+            </form>
+          </div>
+
+          {/* Danger Zone */}
+          <div className="bg-white rounded-lg shadow-md p-6 border-l-4 border-red-500">
+            <h2 className="text-xl font-semibold text-red-800 mb-4">
+              🚨 Danger Zone
+            </h2>
+            <p className="text-gray-600 mb-4">
+              Permanently delete this slice and all associated data. This action cannot be undone.
+            </p>
+            <button
+              hx-delete={`/api/slices/${sliceId}`}
+              hx-confirm="Are you sure you want to delete this slice? This action cannot be undone."
+              hx-target="body"
+              hx-push-url="/"
+              className="bg-red-600 hover:bg-red-700 text-white px-6 py-2 rounded-md font-medium"
+            >
+              Delete Slice
+            </button>
+          </div>
+        </div>
+      </div>
+    </Layout>
+  );
+}

frontend/src/routes/dialogs.tsx

···
+import type { Route } from "@std/http/unstable-route";
+import { render } from "preact-render-to-string";
+import { withAuth, requireAuth } from "./middleware.ts";
+import { CreateSliceDialog } from "../components/CreateSliceDialog.tsx";
+
+async function handleCreateSliceDialog(req: Request): Promise<Response> {
+  const context = await withAuth(req);
+  const authResponse = requireAuth(context, req);
+  if (authResponse) return authResponse;
+
+  const dialogHtml = render(<CreateSliceDialog />);
+  return new Response(dialogHtml, {
+    status: 200,
+    headers: { "content-type": "text/html" },
+  });
+}
+
+export const dialogRoutes: Route[] = [
+  {
+    method: "GET",
+    pattern: new URLPattern({ pathname: "/dialogs/create-slice" }),
+    handler: handleCreateSliceDialog,
+  },
+];

frontend/src/routes/index.ts

···
+import type { Route } from "@std/http/unstable-route";
+import { oauthRoutes } from "./oauth.ts";
+import { sliceRoutes } from "./slices.tsx";
+import { dialogRoutes } from "./dialogs.tsx";
+import { pageRoutes } from "./pages.tsx";
+
+export const allRoutes: Route[] = [
+  ...oauthRoutes,
+  ...sliceRoutes,
+  ...dialogRoutes,
+  ...pageRoutes,
+];

frontend/src/routes/middleware.ts

···
+import { UserSessionManager } from "../config.ts";
+
+export interface AuthenticatedUser {
+  handle?: string;
+  sub?: string;
+  isAuthenticated: boolean;
+}
+
+export interface RouteContext {
+  currentUser: AuthenticatedUser;
+  sessionCookieHeader?: string;
+}
+
+export async function withAuth(req: Request): Promise<RouteContext> {
+  // Get current user info (this already restores tokens from session)
+  const currentUser = await UserSessionManager.getCurrentUser(req);
+
+  // Check if we need to refresh the session cookie with updated tokens
+  let sessionCookieHeader: string | undefined;
+  if (currentUser.isAuthenticated) {
+    const { atprotoClient } = await import("../config.ts");
+    const tokens = atprotoClient.getTokenStorage();
+    if (tokens && tokens.accessToken) {
+      // Refresh the session cookie to extend expiration and update any refreshed tokens
+      const userData = {
+        handle: currentUser.handle,
+        sub: currentUser.sub,
+        tokens: tokens,
+      };
+      sessionCookieHeader = await UserSessionManager.createSessionCookie(
+        userData
+      );
+    }
+  }
+
+  return {
+    currentUser,
+    sessionCookieHeader,
+  };
+}
+
+export function requireAuth(
+  context: RouteContext,
+  req: Request
+): Response | null {
+  if (!context.currentUser.isAuthenticated) {
+    return Response.redirect(new URL("/login", req.url), 302);
+  }
+  return null;
+}

frontend/src/routes/oauth.ts

···
+import type { Route } from "@std/http/unstable-route";
+import {
+  atprotoClient,
+  oauthConfig,
+  OAuthStateManager,
+  UserSessionManager,
+} from "../config.ts";
+
+async function handleOAuthAuthorize(req: Request): Promise<Response> {
+  try {
+    // Clear any existing auth state before new login attempt
+    atprotoClient.oauth.logout();
+
+    const formData = await req.formData();
+    const loginHint = formData.get("loginHint") as string;
+
+    if (!loginHint) {
+      return new Response("Missing login hint", { status: 400 });
+    }
+
+    const authResult = await atprotoClient.oauth.authorize({
+      loginHint,
+      redirectUri: oauthConfig.redirectUri,
+      scope: oauthConfig.scopes,
+    });
+
+    // Store OAuth state for later verification
+    OAuthStateManager.store(authResult.state, authResult.codeVerifier);
+
+    // Redirect to authorization URL
+    return Response.redirect(authResult.authorizationUrl, 302);
+  } catch (error) {
+    console.error("OAuth authorize error:", error);
+    return Response.redirect(
+      new URL(
+        "/login?error=" + encodeURIComponent("OAuth initialization failed"),
+        req.url
+      ),
+      302
+    );
+  }
+}
+
+async function handleOAuthCallback(req: Request): Promise<Response> {
+  try {
+    const url = new URL(req.url);
+    const code = url.searchParams.get("code");
+    const state = url.searchParams.get("state");
+
+    if (!code || !state) {
+      return Response.redirect(
+        new URL(
+          "/login?error=" + encodeURIComponent("Invalid OAuth callback"),
+          req.url
+        ),
+        302
+      );
+    }
+
+    // Retrieve stored code verifier
+    const codeVerifier = OAuthStateManager.retrieve(state);
+    if (!codeVerifier) {
+      return Response.redirect(
+        new URL(
+          "/login?error=" +
+            encodeURIComponent("Invalid or expired OAuth state"),
+          req.url
+        ),
+        302
+      );
+    }
+
+    // Exchange code for tokens
+    await atprotoClient.oauth.handleCallback({
+      code,
+      state,
+      codeVerifier,
+      redirectUri: oauthConfig.redirectUri,
+    });
+
+    // Fetch and store user info
+    const userData = await UserSessionManager.refreshUserInfo();
+
+    // Redirect to main app on successful login with session cookie
+    const sessionCookie = await UserSessionManager.createSessionCookie(
+      userData
+    );
+    return new Response(null, {
+      status: 302,
+      headers: {
+        Location: new URL("/", req.url).toString(),
+        "Set-Cookie": sessionCookie,
+      },
+    });
+  } catch (error) {
+    console.error("OAuth callback error:", error);
+    return Response.redirect(
+      new URL(
+        "/login?error=" + encodeURIComponent("Authentication failed"),
+        req.url
+      ),
+      302
+    );
+  }
+}
+
+async function handleLogout(req: Request): Promise<Response> {
+  atprotoClient.oauth.logout();
+  return new Response(null, {
+    status: 302,
+    headers: {
+      Location: new URL("/login", req.url).toString(),
+      "Set-Cookie": UserSessionManager.createClearCookie(),
+    },
+  });
+}
+
+export const oauthRoutes: Route[] = [
+  {
+    method: "POST",
+    pattern: new URLPattern({ pathname: "/oauth/authorize" }),
+    handler: handleOAuthAuthorize,
+  },
+  {
+    method: "GET",
+    pattern: new URLPattern({ pathname: "/oauth/callback" }),
+    handler: handleOAuthCallback,
+  },
+  {
+    method: "POST",
+    pattern: new URLPattern({ pathname: "/logout" }),
+    handler: handleLogout,
+  },
+];

frontend/src/routes/pages.tsx

···
+import type { Route } from "@std/http/unstable-route";
+import { render } from "preact-render-to-string";
+import { withAuth } from "./middleware.ts";
+import { atprotoClient } from "../config.ts";
+import { IndexPage } from "../pages/IndexPage.tsx";
+import { LoginPage } from "../pages/LoginPage.tsx";
+import { SlicePage } from "../pages/SlicePage.tsx";
+import { SliceRecordsPage } from "../pages/SliceRecordsPage.tsx";
+import { SliceSyncPage } from "../pages/SliceSyncPage.tsx";
+import { SliceLexiconPage } from "../pages/SliceLexiconPage.tsx";
+import { SliceCodegenPage } from "../pages/SliceCodegenPage.tsx";
+import { SliceSettingsPage } from "../pages/SliceSettingsPage.tsx";
+
+async function handleIndexPage(req: Request): Promise<Response> {
+  const context = await withAuth(req);
+
+  // Slice list page - get real slices from AT Protocol
+  let slices: Array<{ id: string; name: string; createdAt: string }> = [];
+
+  if (context.currentUser.isAuthenticated) {
+    try {
+      const sliceRecords =
+        await atprotoClient.xyz.sliceat.slice.listRecords();
+
+      slices = sliceRecords.records.map((record) => {
+        // Extract slice ID from URI
+        const uriParts = record.uri.split("/");
+        const id = uriParts[uriParts.length - 1];
+
+        return {
+          id,
+          name: record.value.name,
+          createdAt: record.value.createdAt,
+        };
+      });
+    } catch (error) {
+      console.error("Failed to fetch slices:", error);
+      // Fall back to empty array if fetch fails
+    }
+  }
+
+  const html = render(<IndexPage slices={slices} currentUser={context.currentUser} />);
+
+  const responseHeaders: Record<string, string> = {
+    "content-type": "text/html",
+  };
+
+  // Add session cookie header if we need to refresh it
+  if (context.sessionCookieHeader) {
+    responseHeaders["Set-Cookie"] = context.sessionCookieHeader;
+  }
+
+  return new Response(`<!DOCTYPE html>${html}`, {
+    status: 200,
+    headers: responseHeaders,
+  });
+}
+
+async function handleLoginPage(req: Request): Promise<Response> {
+  const context = await withAuth(req);
+  const url = new URL(req.url);
+  
+  // Login page with optional error message
+  const error = url.searchParams.get("error");
+  const html = render(
+    <LoginPage error={error || undefined} currentUser={context.currentUser} />
+  );
+
+  const responseHeaders: Record<string, string> = {
+    "content-type": "text/html",
+  };
+
+  if (context.sessionCookieHeader) {
+    responseHeaders["Set-Cookie"] = context.sessionCookieHeader;
+  }
+
+  return new Response(`<!DOCTYPE html>${html}`, {
+    status: 200,
+    headers: responseHeaders,
+  });
+}
+
+async function handleSlicePage(req: Request, params: any): Promise<Response> {
+  const context = await withAuth(req);
+  const sliceId = params?.pathname.groups.id;
+
+  if (!sliceId) {
+    return Response.redirect(new URL("/", req.url), 302);
+  }
+
+  // Get real slice data from AT Protocol
+  let sliceData = {
+    sliceId,
+    sliceName: "Unknown Slice",
+    totalRecords: 0,
+    collections: [] as Array<{ name: string; count: number }>,
+  };
+
+  if (context.currentUser.isAuthenticated) {
+    try {
+      // Construct the full URI for this slice
+      const sliceUri = `at://${
+        context.currentUser.sub || "unknown"
+      }/xyz.sliceat.slice/${sliceId}`;
+
+      const sliceRecord = await atprotoClient.xyz.sliceat.slice.getRecord({
+        uri: sliceUri,
+      });
+
+      sliceData = {
+        sliceId,
+        sliceName: sliceRecord.value.name,
+        totalRecords: 1, // For now, just showing this slice
+        collections: [{ name: "xyz.sliceat.slice", count: 1 }],
+      };
+    } catch (error) {
+      // Fall back to default data
+    }
+  }
+
+  const html = render(
+    <SlicePage
+      {...sliceData}
+      currentTab="overview"
+      currentUser={context.currentUser}
+    />
+  );
+
+  const responseHeaders: Record<string, string> = {
+    "content-type": "text/html",
+  };
+
+  if (context.sessionCookieHeader) {
+    responseHeaders["Set-Cookie"] = context.sessionCookieHeader;
+  }
+
+  return new Response(`<!DOCTYPE html>${html}`, {
+    status: 200,
+    headers: responseHeaders,
+  });
+}
+
+async function handleSliceTabPage(req: Request, params: any): Promise<Response> {
+  const context = await withAuth(req);
+  const sliceId = params?.pathname.groups.id;
+  const tab = params?.pathname.groups.tab;
+
+  if (!sliceId || !tab) {
+    return Response.redirect(new URL("/", req.url), 302);
+  }
+
+  // Get real slice data from AT Protocol
+  let sliceData = {
+    sliceId,
+    sliceName: "Unknown Slice",
+    totalRecords: 0,
+    collections: [] as Array<{ name: string; count: number }>,
+  };
+
+  if (context.currentUser.isAuthenticated) {
+    try {
+      // Construct the full URI for this slice
+      const sliceUri = `at://${
+        context.currentUser.sub || "unknown"
+      }/xyz.sliceat.slice/${sliceId}`;
+
+      const sliceRecord = await atprotoClient.xyz.sliceat.slice.getRecord({
+        uri: sliceUri,
+      });
+
+      sliceData = {
+        sliceId,
+        sliceName: sliceRecord.value.name,
+        totalRecords: 1, // For now, just showing this slice
+        collections: [{ name: "xyz.sliceat.slice", count: 1 }],
+      };
+    } catch (error) {
+      console.error("Failed to fetch slice:", error);
+      // Fall back to default data
+    }
+  }
+
+  let html: string;
+
+  switch (tab) {
+    case "records": {
+      const recordsData = {
+        ...sliceData,
+        records: [
+          {
+            uri: `at://did:plc:example/com.chadtmiller.slice/3k2a4b5c6d`,
+            indexed_at: "2024-01-15 12:45:00",
+            collection: "com.chadtmiller.slice",
+            did: "did:plc:example",
+            cid: "bafyreigbtj4x7ip5legnfznufuopl4sg4knzc2cof6duas4b3q2fy6swua",
+            value: true,
+            pretty_value: `{\n  "name": "${sliceData.sliceName}",\n  "createdAt": "2024-01-15T12:45:00.000Z",\n  "$type": "com.chadtmiller.slice"\n}`,
+          },
+        ],
+        availableCollections: sliceData.collections,
+      };
+      html = render(
+        <SliceRecordsPage {...recordsData} currentUser={context.currentUser} />
+      );
+      break;
+    }
+
+    case "sync": {
+      html = render(
+        <SliceSyncPage {...sliceData} currentUser={context.currentUser} />
+      );
+      break;
+    }
+
+    case "lexicon": {
+      const lexiconData = {
+        ...sliceData,
+        lexicons: [
+          {
+            nsid: "com.chadtmiller.slice",
+            updated_at: "2024-01-15 10:30:00",
+            pretty_definitions: `{\n  "lexicon": 1,\n  "id": "com.chadtmiller.slice",\n  "defs": {\n    "main": {\n      "type": "record",\n      "description": "Slice application record type"\n    }\n  }\n}`,
+          },
+        ],
+      };
+      html = render(
+        <SliceLexiconPage {...lexiconData} currentUser={context.currentUser} />
+      );
+      break;
+    }
+
+    case "codegen": {
+      const codegenData = {
+        ...sliceData,
+        lexicons: [
+          { nsid: "com.chadtmiller.slice" },
+          { nsid: "social.grain.gallery" },
+        ],
+      };
+      html = render(
+        <SliceCodegenPage {...codegenData} currentUser={context.currentUser} />
+      );
+      break;
+    }
+
+    case "settings": {
+      html = render(
+        <SliceSettingsPage {...sliceData} currentUser={context.currentUser} />
+      );
+      break;
+    }
+
+    default:
+      // 404 for unknown slice subpaths
+      return Response.redirect(new URL("/", req.url), 302);
+  }
+
+  const responseHeaders: Record<string, string> = {
+    "content-type": "text/html",
+  };
+
+  if (context.sessionCookieHeader) {
+    responseHeaders["Set-Cookie"] = context.sessionCookieHeader;
+  }
+
+  return new Response(`<!DOCTYPE html>${html}`, {
+    status: 200,
+    headers: responseHeaders,
+  });
+}
+
+export const pageRoutes: Route[] = [
+  {
+    pattern: new URLPattern({ pathname: "/" }),
+    handler: handleIndexPage,
+  },
+  {
+    pattern: new URLPattern({ pathname: "/login" }),
+    handler: handleLoginPage,
+  },
+  {
+    pattern: new URLPattern({ pathname: "/slices/:id" }),
+    handler: handleSlicePage,
+  },
+  {
+    pattern: new URLPattern({ pathname: "/slices/:id/:tab" }),
+    handler: handleSliceTabPage,
+  },
+];

frontend/src/routes/slices.tsx

···
+import type { Route } from "@std/http/unstable-route";
+import { render } from "preact-render-to-string";
+import { withAuth, requireAuth } from "./middleware.ts";
+import { atprotoClient } from "../config.ts";
+import { CreateSliceDialog } from "../components/CreateSliceDialog.tsx";
+import { UpdateResult } from "../components/UpdateResult.tsx";
+
+async function handleCreateSlice(req: Request): Promise<Response> {
+  const context = await withAuth(req);
+  const authResponse = requireAuth(context, req);
+  if (authResponse) return authResponse;
+
+  // Ensure client has tokens before attempting API calls
+  const authInfo = atprotoClient.oauth.getAuthenticationInfo();
+  if (!authInfo.isAuthenticated) {
+    const dialogHtml = render(
+      <CreateSliceDialog error="Session expired. Please log in again." />
+    );
+    return new Response(dialogHtml, {
+      status: 200,
+      headers: { "content-type": "text/html" },
+    });
+  }
+
+  try {
+    const formData = await req.formData();
+    const name = formData.get("name") as string;
+
+    if (!name || name.trim().length === 0) {
+      const dialogHtml = render(
+        <CreateSliceDialog error="Slice name is required" name={name} />
+      );
+      return new Response(dialogHtml, {
+        status: 200,
+        headers: { "content-type": "text/html" },
+      });
+    }
+
+    // Create actual slice using AT Protocol
+    try {
+      const result = await atprotoClient.xyz.sliceat.slice.createRecord({
+        name: name.trim(),
+        createdAt: new Date().toISOString(),
+      });
+
+      // Extract record key from URI (format: at://did:plc:example/xyz.sliceat.slice/rkey)
+      const uriParts = result.uri.split("/");
+      const sliceId = uriParts[uriParts.length - 1];
+
+      return new Response("", {
+        status: 200,
+        headers: {
+          "HX-Redirect": `/slices/${sliceId}`,
+        },
+      });
+    } catch (createError) {
+      const dialogHtml = render(
+        <CreateSliceDialog
+          error="Failed to create slice record. Please try again."
+          name={name}
+        />
+      );
+      return new Response(dialogHtml, {
+        status: 200,
+        headers: { "content-type": "text/html" },
+      });
+    }
+  } catch (error) {
+    const dialogHtml = render(
+      <CreateSliceDialog error="Failed to create slice" />
+    );
+    return new Response(dialogHtml, {
+      status: 200,
+      headers: { "content-type": "text/html" },
+    });
+  }
+}
+
+async function handleUpdateSliceName(req: Request, params: any): Promise<Response> {
+  const context = await withAuth(req);
+  const authResponse = requireAuth(context, req);
+  if (authResponse) return authResponse;
+
+  const sliceId = params?.pathname.groups.id;
+  if (!sliceId) {
+    return new Response("Invalid slice ID", { status: 400 });
+  }
+
+  try {
+    const formData = await req.formData();
+    const name = formData.get("name") as string;
+
+    if (!name || name.trim().length === 0) {
+      const resultHtml = render(
+        <UpdateResult type="error" message="Slice name is required" />
+      );
+      return new Response(resultHtml, {
+        status: 200,
+        headers: { "content-type": "text/html" },
+      });
+    }
+
+    // Construct the URI for this slice
+    const sliceUri = `at://${context.currentUser.sub}/xyz.sliceat.slice/${sliceId}`;
+    
+    // Get the current record first
+    const currentRecord = await atprotoClient.xyz.sliceat.slice.getRecord({
+      uri: sliceUri,
+    });
+
+    // Update the record with new name
+    const updatedRecord = {
+      ...currentRecord.value,
+      name: name.trim(),
+    };
+
+    await atprotoClient.xyz.sliceat.slice.updateRecord(
+      sliceId,
+      updatedRecord
+    );
+
+    const resultHtml = render(
+      <UpdateResult 
+        type="success" 
+        message="Slice name updated successfully!" 
+        showRefresh
+      />
+    );
+    return new Response(resultHtml, {
+      status: 200,
+      headers: { "content-type": "text/html" },
+    });
+  } catch (error) {
+    const resultHtml = render(
+      <UpdateResult 
+        type="error" 
+        message="Failed to update slice name. Please try again." 
+      />
+    );
+    return new Response(resultHtml, {
+      status: 200,
+      headers: { "content-type": "text/html" },
+    });
+  }
+}
+
+async function handleDeleteSlice(req: Request, params: any): Promise<Response> {
+  const context = await withAuth(req);
+  const authResponse = requireAuth(context, req);
+  if (authResponse) return authResponse;
+
+  const sliceId = params?.pathname.groups.id;
+  if (!sliceId) {
+    return new Response("Invalid slice ID", { status: 400 });
+  }
+
+  try {
+    // Delete the slice record from AT Protocol
+    await atprotoClient.xyz.sliceat.slice.deleteRecord(sliceId);
+
+    // Redirect to home page
+    return new Response("", {
+      status: 200,
+      headers: {
+        "HX-Redirect": "/",
+      },
+    });
+  } catch (error) {
+    return new Response("Failed to delete slice", { status: 500 });
+  }
+}
+
+export const sliceRoutes: Route[] = [
+  {
+    method: "POST",
+    pattern: new URLPattern({ pathname: "/slices" }),
+    handler: handleCreateSlice,
+  },
+  {
+    method: "PUT",
+    pattern: new URLPattern({ pathname: "/api/slices/:id/name" }),
+    handler: handleUpdateSliceName,
+  },
+  {
+    method: "DELETE",
+    pattern: new URLPattern({ pathname: "/api/slices/:id" }),
+    handler: handleDeleteSlice,
+  },
+];

lexicons/com/chadtmiller/slice.json lexicons/xyz/sliceat/slice.json

···
 {
   "lexicon": 1,
-  "id": "com.chadtmiller.slice",
+  "id": "xyz.sliceat.slice",
   "description": "Slice application record type",
   "defs": {
     "main": {