refactor: Streamline documentation and add client authentication binaries

* Simplify README files across all crates to be more concise and focused
* Add comprehensive client authentication CLI tools:
* atproto-client-app-password for app password management
* atproto-client-auth for OAuth flow testing
* Extend atproto-client with server operations and improved HTTP client functionality
* Update Dockerfile to include new atproto-jetstream-consumer binary
* Consolidate project documentation to focus on practical usage over detailed implementation
* Update CLAUDE.prompts.md with iterative development approach

CLAUDE.prompts.md

···
 
 Using `cargo clippy`, satisfy warnings. Think very hard about how to do this.
 
-Using `cargo build`, `cargo fmt`, `cargo check`, `cargo clippy`, and `cargo test` identity and resolve and warnings or errors. Think very hard.
+Using `cargo build`, `cargo fmt`, `cargo check`, `cargo clippy`, and `cargo test` identity and resolve and warnings or errors. Work iteratively and think very hard.
 
 ## Cleanup and Check
 
···
 
 5. Update the `README.md` file in the root of the project that describes the project as collection of components used to create ATProtocol applications. Note that parts of this was extracted from the open sourced https://tangled.sh/@smokesignal.events/smokesignal project. This project is open source under the MIT license.
 
-6. Ensure all crates can be packaged and published.
+6. Ensure the Dockerfile is accurate and correct.
 
 Avoid introducing new dependencies. Think very very hard.
+
+## Release
+
+Ensure all crates can be packaged and published.

Dockerfile

···
 COPY --from=builder /usr/src/app/target/release/atproto-oauth-tool .
 COPY --from=builder /usr/src/app/target/release/atproto-client-dpop .
 COPY --from=builder /usr/src/app/target/release/atproto-xrpcs-helloworld .
+COPY --from=builder /usr/src/app/target/release/atproto-jetstream-consumer .
 
 # Default to the main resolution tool
 # Users can override with specific binary: docker run <image> atproto-identity-resolve --help
···
 LABEL org.opencontainers.image.licenses="MIT"
 
 # Document available binaries
-LABEL binaries="atproto-identity-resolve,atproto-identity-sign,atproto-identity-validate,atproto-identity-key,atproto-record-sign,atproto-record-verify,atproto-oauth-tool,atproto-client-dpop,atproto-xrpcs-helloworld"
+LABEL binaries="atproto-identity-resolve,atproto-identity-sign,atproto-identity-validate,atproto-identity-key,atproto-record-sign,atproto-record-verify,atproto-oauth-tool,atproto-client-dpop,atproto-xrpcs-helloworld,atproto-jetstream-consumer"

README.md

···
-# AT Protocol Identity & Record Library
+# atproto-identity-rs
 
-A comprehensive collection of Rust crates for building AT Protocol applications. This workspace provides complete functionality for identity management, record operations, OAuth 2.0 flows, event streaming, XRPC services, and HTTP client operations across multiple DID methods.
+A comprehensive collection of Rust crates for building AT Protocol applications. This workspace provides identity management, record operations, OAuth 2.0 flows, HTTP client operations, XRPC services, and event streaming capabilities.
 
-This project was extracted from the open-sourced [smokesignal.events](https://tangled.sh/@smokesignal.events/smokesignal) project and is released under the MIT license.
+Parts of this project were extracted from the open-source [smokesignal.events](https://tangled.sh/@smokesignal.events/smokesignal) project and are licensed under the MIT license.
 
-## Project Overview
+## Components
 
-This workspace provides a complete toolkit for AT Protocol operations including identity resolution, record signing/verification, OAuth 2.0 flows, HTTP client operations, and web server integration. The library is designed to be modular, secure, and fully compliant with AT Protocol specifications.
+### Core Libraries
 
-## Crates
+- **[`atproto-identity`](crates/atproto-identity/)** - Identity management with DID resolution and cryptographic operations. Includes 4 CLI tools for identity resolution, key management, signing, and validation.
+- **[`atproto-record`](crates/atproto-record/)** - AT Protocol record signature operations. Includes 2 CLI tools for signing and verifying records.
+- **[`atproto-oauth`](crates/atproto-oauth/)** - OAuth 2.0 implementation with AT Protocol security extensions including PKCE, DPoP, and JWT operations.
+- **[`atproto-client`](crates/atproto-client/)** - HTTP client with DPoP authentication and repository operations. Includes 3 CLI tools for client authentication testing.
 
-This workspace contains eight specialized crates:
+### Web Framework Integration
 
-### [`atproto-identity`](crates/atproto-identity/) 
-**Core identity management and cryptographic operations**
+- **[`atproto-oauth-axum`](crates/atproto-oauth-axum/)** - Axum web handlers for OAuth endpoints. Includes 1 CLI tool for OAuth client testing.
+- **[`atproto-xrpcs`](crates/atproto-xrpcs/)** - XRPC service components with JWT authorization extractors.
+- **[`atproto-xrpcs-helloworld`](crates/atproto-xrpcs-helloworld/)** - Example XRPC service implementation with DID web support.
 
-- **DID Resolution**: Support for `did:plc`, `did:web`, and `did:key` methods
-- **Handle Resolution**: DNS and HTTP-based handle resolution with validation  
-- **Identity Documents**: Complete DID document parsing and management
-- **Cryptographic Operations**: P-256 and K-256 elliptic curve support with signing/verification
-- **Key Management**: DID key identification, conversion, and JWK generation
-- **Validation**: Input validation for handles and DIDs
-- **Configuration**: Environment-based configuration with DNS and certificate customization
+### Event Streaming
 
-### [`atproto-record`](crates/atproto-record/)
-**AT Protocol record signature operations**
-
-- **Record Signing**: Create cryptographic signatures for AT Protocol records with proper `$sig` object handling
-- **Signature Verification**: Verify existing signatures against records and public keys
-- **IPLD Integration**: Proper IPLD DAG-CBOR serialization for consistent signature generation
-- **Multi-curve Support**: Support for P-256 and K-256 elliptic curves via `atproto-identity`
-- **Repository Context**: Include repository and collection context in signatures
-
-### [`atproto-oauth`](crates/atproto-oauth/)
-**Complete OAuth 2.0 operations with AT Protocol extensions**
-
-- **JWT Operations**: Complete JSON Web Token minting, verification, and validation with ES256/ES256K support
-- **JWK Management**: JSON Web Key generation and management for P-256 and K-256 curves
-- **PKCE Implementation**: RFC 7636 Proof Key for Code Exchange for secure OAuth flows
-- **DPoP Support**: RFC 9449 Demonstration of Proof-of-Possession with automatic retry middleware
-- **OAuth Resource Discovery**: RFC 8414 OAuth 2.0 authorization server and protected resource metadata discovery
-- **AT Protocol Validation**: Comprehensive validation of OAuth servers against AT Protocol requirements
-
-### [`atproto-client`](crates/atproto-client/)
-**HTTP client library for AT Protocol services**
-
-- **HTTP Client Operations**: Authenticated and unauthenticated HTTP GET/POST requests with JSON support
-- **DPoP Authentication**: RFC 9449 Demonstration of Proof-of-Possession with automatic retry middleware
-- **Repository Operations**: Complete CRUD operations for AT Protocol repository records  
-- **URL Building**: Flexible URL construction with parameter encoding and query string generation
-- **OAuth Integration**: Seamless integration with `atproto-oauth` for DPoP authentication
-
-### [`atproto-oauth-axum`](crates/atproto-oauth-axum/)
-**Axum web handlers for OAuth 2.0 authorization server endpoints**
-
-- **Complete OAuth Server Handlers**: Ready-to-use Axum handlers for all required OAuth 2.0 endpoints
-- **Client Metadata Endpoint**: RFC 7591 compliant client metadata for dynamic client registration  
-- **JWKS Endpoint**: JSON Web Key Set serving for JWT signature verification
-- **Authorization Callback Handler**: Complete OAuth callback processing with token exchange
-- **OAuth Login CLI Tool**: Full-featured command-line tool for testing and development OAuth flows
-
-### [`atproto-xrpcs`](crates/atproto-xrpcs/)
-**Core building blocks for implementing XRPC services**
-
-- **JWT Authorization Extractors**: Axum-compatible request extractors for JWT-based authorization
-- **DID Document Verification**: Automatic verification of caller identities through DID document resolution
-- **XRPC Service Components**: Core building blocks for implementing AT Protocol XRPC endpoints
-- **Structured Error Handling**: Comprehensive error types with detailed error codes and messages
-- **Axum Integration**: Native integration with Axum web framework for HTTP handlers
-
-### [`atproto-xrpcs-helloworld`](crates/atproto-xrpcs-helloworld/)
-**Complete example XRPC service implementation**
-
-- **DID Web Support**: Native DID web identity with automatic service document generation
-- **Well-Known Endpoints**: Standard AT Protocol discovery endpoints for identity and service metadata
-- **Hello World XRPC**: Example authenticated and unauthenticated XRPC endpoint implementation
-- **JWT Authentication**: Demonstrates integration with `atproto-xrpcs` authorization extractors
-- **Service Discovery**: Complete service document with verification methods and service endpoints
-
-### [`atproto-jetstream`](crates/atproto-jetstream/)
-**AT Protocol Jetstream event consumer library**
-
-- **Event Stream Consumer**: High-performance WebSocket-based event consumption from Jetstream instances
-- **Event Handler Registration**: Flexible event handler system supporting multiple concurrent handlers
-- **Compression Support**: Optional Zstandard compression with dictionary support for efficient data transfer
-- **Graceful Shutdown**: Cancellation token support for clean shutdown and resource cleanup
-- **Error Handling**: Comprehensive error types following project conventions with structured logging
-
-## Command Line Tools
-
-The library includes 10 command-line utilities across the crates:
-
-### Identity Operations (`atproto-identity`)
-- **`atproto-identity-resolve`** - Resolve AT Protocol handles and DIDs to identity documents
-- **`atproto-identity-sign`** - Sign JSON data with DID keys using IPLD DAG-CBOR serialization
-- **`atproto-identity-validate`** - Verify cryptographic signatures of JSON data
-- **`atproto-identity-key`** - Generate and manage cryptographic keys (P-256/K-256)
-
-### Record Operations (`atproto-record`) 
-- **`atproto-record-sign`** - Sign AT Protocol records with embedded signature metadata
-- **`atproto-record-verify`** - Verify AT Protocol record signatures with issuer authentication
-
-### HTTP Client Operations (`atproto-client`)
-- **`atproto-client-dpop`** - Test DPoP authentication flows with AT Protocol services
-
-### OAuth Operations (`atproto-oauth-axum`)
-- **`atproto-oauth-tool`** - Complete OAuth client flow with local server and token acquisition
-
-### XRPC Services (`atproto-xrpcs-helloworld`)
-- **`atproto-xrpcs-helloworld`** - Example AT Protocol XRPC service with DID web identity and authentication
-
-### Event Streaming (`atproto-jetstream`)
-- **`atproto-jetstream-consumer`** - Stream AT Protocol events from Jetstream instances with configurable handlers
+- **[`atproto-jetstream`](crates/atproto-jetstream/)** - WebSocket event stream consumer with compression support. Includes 1 CLI tool for event consumption.
 
 ## Quick Start
 
···
 ```toml
 [dependencies]
 atproto-identity = "0.6.0"
-atproto-record = "0.6.0" 
+atproto-record = "0.6.0"
 atproto-oauth = "0.6.0"
 atproto-client = "0.6.0"
-atproto-oauth-axum = "0.6.0"
-atproto-xrpcs = "0.6.0"
-atproto-jetstream = "0.6.0"
+# Add others as needed
 ```
 
 ### Basic Identity Resolution
···
     let http_client = reqwest::Client::new();
     let dns_resolver = create_resolver(&[]);
     
-    // Resolve a handle to a DID
     let did = resolve_subject(&http_client, &dns_resolver, "alice.bsky.social").await?;
     println!("Resolved DID: {}", did);
     
···
 }
 ```
 
-### Record Signing and Verification
+### Record Signing
 
 ```rust
 use atproto_identity::key::identify_key;
···
 
 #[tokio::main]
 async fn main() -> anyhow::Result<()> {
-    // Parse DID key for signing operations
     let signing_key = identify_key("did:key:zQ3shNzMp4oaaQ1gQRzCxMGXFrSW3NEM1M9T6KCY9eA7HhyEA")?;
     
-    // Create a record to sign
     let record = json!({
         "$type": "app.bsky.feed.post",
         "text": "Hello AT Protocol!",
         "createdAt": "2024-01-01T00:00:00.000Z"
     });
     
-    // Create signature object with issuer and timestamp
     let signature_object = json!({
         "issuer": "did:plc:issuer123",
         "issuedAt": "2024-01-01T00:00:00.000Z"
     });
     
-    // Sign the record
     let signed_record = signature::create(
         &signing_key,
         &record,
-        "did:plc:user123",     // repository
-        "app.bsky.feed.post",  // collection
+        "did:plc:user123",
+        "app.bsky.feed.post",
         signature_object,
     ).await?;
     
-    // Verify the signature
-    signature::verify(
-        "did:plc:issuer123",   // issuer
-        &signing_key,          // verification key
-        signed_record,         // signed record
-        "did:plc:user123",     // repository
-        "app.bsky.feed.post",  // collection
-    ).await?;
-    
-    println!("Signature verification successful");
-    
     Ok(())
 }
 ```
 
-### OAuth Operations
-
-```rust
-use atproto_oauth::jwt::{mint, Header, Claims, JoseClaims};
-use atproto_oauth::pkce;
-use atproto_identity::key::identify_key;
-
-#[tokio::main]
-async fn main() -> anyhow::Result<()> {
-    let key_data = identify_key("did:key:zQ3shNzMp4oaaQ1gQRzCxMGXFrSW3NEM1M9T6KCY9eA7HhyEA")?;
-    
-    // Generate PKCE parameters
-    let (code_verifier, code_challenge) = pkce::generate();
-    println!("PKCE Challenge: {}", code_challenge);
-    
-    // Create and sign JWT
-    let header = Header::default();
-    let claims = Claims::new(JoseClaims {
-        issuer: Some("did:plc:issuer123".to_string()),
-        subject: Some("did:plc:subject456".to_string()),
-        audience: Some("https://pds.example.com".to_string()),
-        ..Default::default()
-    });
-    
-    let token = mint(&key_data, &header, &claims)?;
-    println!("JWT: {}", token);
-    
-    Ok(())
-}
-```
-
-### XRPC Service Implementation
+### XRPC Service
 
 ```rust
 use atproto_xrpcs::authorization::ResolvingAuthorization;
···
     subject: Option<String>,
 }
 
-// XRPC handler with optional JWT authorization
-async fn handle_hello_xrpc(
+async fn handle_hello(
     params: Query<HelloParams>,
     authorization: Option<ResolvingAuthorization>,
 ) -> Json<serde_json::Value> {
     let subject = params.subject.as_deref().unwrap_or("World");
     
     let message = if let Some(auth) = authorization {
-        // Authenticated request - auth automatically validates JWT and resolves DID
         format!("Hello, authenticated {}! (caller: {})", subject, auth.subject())
     } else {
-        // Unauthenticated request
         format!("Hello, {}!", subject)
     };
     
···
 
 #[tokio::main]
 async fn main() -> anyhow::Result<()> {
-    // Set up Axum router with XRPC endpoint
     let app = Router::new()
-        .route("/xrpc/com.example.hello", get(handle_hello_xrpc))
-        .with_state(your_web_context); // Include identity resolver and storage
+        .route("/xrpc/com.example.hello", get(handle_hello))
+        .with_state(your_web_context);
 
     let listener = tokio::net::TcpListener::bind("0.0.0.0:8080").await?;
     axum::serve(listener, app).await?;
···
 }
 ```
 
-### Jetstream Event Streaming
+## Command Line Tools
 
-```rust
-use atproto_jetstream::{Consumer, ConsumerTaskConfig, EventHandler, JetstreamEvent, CancellationToken};
-use async_trait::async_trait;
-use std::sync::Arc;
-
-// Custom event handler
-struct PostEventHandler;
-
-#[async_trait]
-impl EventHandler for PostEventHandler {
-    async fn handle_event(&self, event: JetstreamEvent) -> anyhow::Result<()> {
-        if event.kind == "commit" {
-            println!("Received post event: {:?}", event);
-        }
-        Ok(())
-    }
-
-    fn handler_id(&self) -> String {
-        "post-handler".to_string()
-    }
-}
-
-#[tokio::main]
-async fn main() -> anyhow::Result<()> {
-    let config = ConsumerTaskConfig {
-        user_agent: "my-app/1.0".to_string(),
-        compression: false,
-        zstd_dictionary_location: String::new(),
-        jetstream_hostname: "jetstream1.us-east.bsky.network".to_string(),
-        collections: vec!["app.bsky.feed.post".to_string()],
-    };
-
-    let consumer = Consumer::new(config);
-    let handler = Arc::new(PostEventHandler);
-    
-    consumer.register_handler(handler).await?;
-    
-    let cancellation_token = CancellationToken::new();
-    consumer.run_background(cancellation_token).await?;
-    
-    Ok(())
-}
-```
-
-## CLI Usage Examples
+The workspace includes 12 command-line tools across the crates:
 
 ```bash
-# Resolve a handle or DID to identity document
+# Identity operations
 cargo run --bin atproto-identity-resolve alice.bsky.social
-
-# Get full DID document with verification methods
-cargo run --bin atproto-identity-resolve --did-document did:plc:user123
-
-# Generate a new P-256 private key
 cargo run --bin atproto-identity-key generate p256
-
-# Sign a record from file with all required context
-cargo run --bin atproto-record-sign \
-  did:key:zQ3shNzMp4oaaQ1... \
-  did:plc:issuer123 \
-  record.json \
-  repository=did:plc:user123 \
-  collection=app.bsky.feed.post
-
-# Verify a signed record
-cargo run --bin atproto-record-verify \
-  did:plc:issuer123 \
-  did:key:zQ3shNzMp4oaaQ1... \
-  signed_record.json \
-  repository=did:plc:user123 \
-  collection=app.bsky.feed.post
-
-# Start OAuth login flow (requires EXTERNAL_BASE environment variable)  
-EXTERNAL_BASE=localhost:8080 cargo run --bin atproto-oauth-tool login \
-  did:key:zQ3shNzMp4oaaQ1... \
-  alice.bsky.social
-
-# Run example XRPC service with DID web identity
-EXTERNAL_BASE=localhost:8080 SERVICE_KEY=did:key:zQ3shNzMp4oaaQ1... \
-  cargo run --bin atproto-xrpcs-helloworld
-
-# Stream events from Jetstream
-cargo run --bin atproto-jetstream-consumer \
-  --hostname jetstream1.us-east.bsky.network \
-  --collections app.bsky.feed.post \
-  --user-agent "my-consumer/1.0"
-
-# Stream with compression (requires dictionary file)
-cargo run --bin atproto-jetstream-consumer \
-  --hostname jetstream1.us-east.bsky.network \
-  --collections app.bsky.feed.post \
-  --compression \
-  --zstd-dictionary ./data/zstd_dictionary
-```
+cargo run --bin atproto-identity-sign did:key:... data.json
+cargo run --bin atproto-identity-validate did:key:... data.json signature
 
-## Features
+# Record operations  
+cargo run --bin atproto-record-sign did:key:... did:plc:issuer record.json repo=did:plc:user collection=app.bsky.feed.post
+cargo run --bin atproto-record-verify did:plc:issuer did:key:... signed_record.json repo=did:plc:user collection=app.bsky.feed.post
 
-- **Async/Await**: Built with modern Rust async patterns using Tokio
-- **Error Handling**: Comprehensive structured error types using `thiserror` with standardized error codes
-- **Security**: Forbids unsafe code, follows security best practices, and implements all required OAuth security extensions
-- **Standards Compliance**: Full AT Protocol, RFC 7636 (PKCE), RFC 9449 (DPoP), and RFC 8414 (OAuth Discovery) compliance
-- **Logging**: Structured logging with `tracing` for debugging and monitoring
-- **Multi-platform**: Works on all major platforms with configurable DNS and HTTP settings
-- **Modular Design**: Clean separation of concerns allowing selective usage of components
+# Client operations
+cargo run --bin atproto-client-auth --handle alice.bsky.social
+cargo run --bin atproto-client-app-password --identifier alice.bsky.social
+cargo run --bin atproto-client-dpop --private-key did:key:... --access-token token --url https://pds.example.com/xrpc/endpoint
 
-## Architecture
+# OAuth operations
+EXTERNAL_BASE=localhost:8080 cargo run --bin atproto-oauth-tool login did:key:... alice.bsky.social
 
-The library follows a layered architecture with clear separation of concerns:
+# XRPC service
+EXTERNAL_BASE=localhost:8080 SERVICE_KEY=did:key:... cargo run --bin atproto-xrpcs-helloworld
 
-```
-┌─────────────────────────────────────────────────────────────┐
-│                     Application Layer                       │
-│                 (CLI Tools & Web Handlers)                  │
-├─────────────────────────────────────────────────────────────┤
-│                    Protocol Layer                           │
-│              (atproto-client, atproto-record)               │
-├─────────────────────────────────────────────────────────────┤
-│                     OAuth Layer                             │
-│             (atproto-oauth, atproto-oauth-axum)             │
-├─────────────────────────────────────────────────────────────┤
-│                   Foundation Layer                          │
-│              (atproto-identity - Core Services)             │
-└─────────────────────────────────────────────────────────────┘
+# Event streaming
+cargo run --bin atproto-jetstream-consumer --hostname jetstream1.us-east.bsky.network --collections app.bsky.feed.post
 ```
 
-- **Foundation Layer**: Core identity, cryptographic, and DID operations
-- **OAuth Layer**: Complete OAuth 2.0 flows with AT Protocol extensions
-- **Protocol Layer**: Higher-level AT Protocol operations (records, client)
-- **Application Layer**: Ready-to-use tools and web framework integration
-
 ## Development
-
-### Building the Project
 
 ```bash
 # Build all crates
 cargo build
 
-# Build specific crate
-cargo build -p atproto-identity
-
-# Build with all features
-cargo build --all-features
-```
-
-### Running Tests
-
-```bash
-# Run all tests
+# Run all tests  
 cargo test
 
-# Run tests for specific crate  
-cargo test -p atproto-oauth
-
-# Run with output
-cargo test -- --nocapture
-```
-
-### Code Quality
-
-```bash
-# Format code
-cargo fmt
-
-# Lint code
-cargo clippy
-
-# Check without building
-cargo check
-
-# Run all quality checks
-cargo fmt && cargo clippy && cargo test
-```
-
-### Documentation
+# Format and lint
+cargo fmt && cargo clippy
 
-```bash
 # Generate documentation
-cargo doc --open
-
-# Generate documentation for all crates
 cargo doc --workspace --open
 ```
 
···
 
 This project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details.
 
-## Contributing
-
-Contributions are welcome! Please ensure that:
-
-1. All tests pass: `cargo test`
-2. Code is properly formatted: `cargo fmt`
-3. No linting issues: `cargo clippy`
-4. New functionality includes appropriate tests and documentation
-5. Error handling follows the project's structured error format
-
 ## Acknowledgments
 
-This library was extracted from the [smokesignal.events](https://tangled.sh/@smokesignal.events/smokesignal) project, an open-source event and RSVP management and discovery application built on AT Protocol. We thank the smokesignal.events contributors for their foundational work on AT Protocol identity management, record operations, and event streaming infrastructure.
+This library was extracted from the [smokesignal.events](https://tangled.sh/@smokesignal.events/smokesignal) project, an open-source AT Protocol event and RSVP management application.

crates/atproto-client/README.md

···
 # atproto-client
 
-A Rust HTTP client library for AT Protocol services, providing authenticated and unauthenticated HTTP operations with DPoP (Demonstration of Proof-of-Possession) authentication support.
+HTTP client library for AT Protocol services with DPoP authentication support.
 
 ## Overview
 
-`atproto-client` provides HTTP client functionality specifically designed for interacting with AT Protocol endpoints. This library handles both basic HTTP operations and advanced DPoP-authenticated requests required for secure AT Protocol communication, including full support for repository record operations.
+`atproto-client` provides HTTP client functionality specifically designed for interacting with AT Protocol endpoints. This library handles both basic HTTP operations and DPoP-authenticated requests required for secure AT Protocol communication.
 
-This project was extracted from the open-sourced [Smokesignal](https://tangled.sh/@smokesignal.events/smokesignal) project and is designed to be a standalone, reusable library for AT Protocol HTTP client operations.
+## Binaries
 
-## Features
-
-- **HTTP Client Operations**: Authenticated and unauthenticated HTTP GET/POST requests with JSON support
-- **DPoP Authentication**: RFC 9449 Demonstration of Proof-of-Possession with automatic retry middleware
-- **Repository Operations**: Complete CRUD operations for AT Protocol repository records
-- **URL Building**: Flexible URL construction with parameter encoding and query string generation
-- **Error Handling**: Structured error types with detailed error codes and messages
-- **OAuth Integration**: Seamless integration with `atproto-oauth` for DPoP authentication
-- **Automatic Retries**: Built-in DPoP nonce retry middleware for robust authentication
-- **Structured Logging**: Built-in tracing support for debugging and monitoring
-
-## Installation
-
-Add this to your `Cargo.toml`:
-
-```toml
-[dependencies]
-atproto-client = "0.6.0"
-```
+- **atproto-client-auth**: OAuth authentication flow helper
+- **atproto-client-app-password**: App password management tool
+- **atproto-client-dpop**: DPoP authentication testing tool
 
 ## Usage
 
···
 use atproto_client::client;
 use reqwest::Client;
 
-#[tokio::main]
-async fn main() -> anyhow::Result<()> {
-    let http_client = Client::new();
-    
-    // Unauthenticated GET request
-    let response = client::get_json(&http_client, "https://api.example.com/data").await?;
-    println!("Response: {}", response);
-    
-    Ok(())
-}
+let http_client = Client::new();
+let response = client::get_json(&http_client, "https://api.example.com/data").await?;
 ```
 
 ### DPoP Authentication
 
 ```rust
-use atproto_client::client::{DPoPAuth, get_dpop_json, post_dpop_json};
+use atproto_client::client::{DPoPAuth, get_dpop_json};
 use atproto_identity::key::identify_key;
-use reqwest::Client;
-use serde_json::json;
 
-#[tokio::main]
-async fn main() -> anyhow::Result<()> {
-    let http_client = Client::new();
-    
-    // Set up DPoP authentication
-    let dpop_auth = DPoPAuth {
-        dpop_private_key_data: identify_key("did:key:zQ3shNz...")?,
-        oauth_access_token: "your_access_token".to_string(),
-        oauth_issuer: "did:plc:issuer123".to_string(),
-    };
-    
-    // Authenticated GET request
-    let response = get_dpop_json(
-        &http_client,
-        &dpop_auth,
-        "https://pds.example.com/xrpc/com.atproto.repo.listRecords?repo=did:plc:user123&collection=app.bsky.feed.post"
-    ).await?;
-    
-    // Authenticated POST request
-    let record_data = json!({
-        "$type": "app.bsky.feed.post",
-        "text": "Hello AT Protocol!",
-        "createdAt": "2024-01-01T00:00:00Z"
-    });
-    
-    let post_response = post_dpop_json(
-        &http_client,
-        &dpop_auth,
-        "https://pds.example.com/xrpc/com.atproto.repo.createRecord",
-        record_data
-    ).await?;
-    
-    println!("Created record: {}", post_response);
-    
-    Ok(())
-}
-```
-
-### Repository Operations
-
-```rust
-use atproto_client::com::atproto::repo::{
-    get_record, list_records, create_record, put_record,
-    CreateRecordRequest, PutRecordRequest, ListRecordsParams
+let dpop_auth = DPoPAuth {
+    dpop_private_key_data: identify_key("did:key:zQ3sh...")?,
+    oauth_access_token: "your_access_token".to_string(),
+    oauth_issuer: "did:plc:issuer123".to_string(),
 };
-use atproto_client::client::DPoPAuth;
-use atproto_identity::key::identify_key;
-use reqwest::Client;
-use serde_json::json;
 
-#[tokio::main]
-async fn main() -> anyhow::Result<()> {
-    let http_client = Client::new();
-    let pds_url = "https://pds.example.com";
-    
-    let dpop_auth = DPoPAuth {
-        dpop_private_key_data: identify_key("did:key:zQ3shNz...")?,
-        oauth_access_token: "your_access_token".to_string(),
-        oauth_issuer: "did:plc:issuer123".to_string(),
-    };
-    
-    // Get a specific record
-    let record_response = get_record(
-        &http_client,
-        &dpop_auth,
-        pds_url,
-        "did:plc:user123",
-        "app.bsky.feed.post",
-        "3l2uygzaf5c2b",
-        None // Optional CID for specific version
-    ).await?;
-    
-    // List records in a collection with parameters
-    let list_response = list_records::<serde_json::Value>(
-        &http_client,
-        &dpop_auth,
-        pds_url,
-        "did:plc:user123".to_string(),
-        "app.bsky.feed.post".to_string(),
-        ListRecordsParams::new()
-            .limit(50)
-            .reverse(false)
-    ).await?;
-    
-    // Create a new record
-    let create_request = CreateRecordRequest {
-        repo: "did:plc:user123".to_string(),
-        collection: "app.bsky.feed.post".to_string(),
-        record_key: None,  // Let server generate key
-        validate: true,
-        record: json!({
-            "$type": "app.bsky.feed.post",
-            "text": "Hello from atproto-client!",
-            "createdAt": "2024-01-01T00:00:00Z"
-        }),
-        swap_commit: None,
-    };
-    
-    let create_response = create_record(
-        &http_client,
-        &dpop_auth,
-        pds_url,
-        create_request
-    ).await?;
-    
-    // Update a record with specific key
-    let put_request = PutRecordRequest {
-        repo: "did:plc:user123".to_string(),
-        collection: "app.bsky.feed.post".to_string(),
-        record_key: "3l2uygzaf5c2b".to_string(),
-        validate: true,
-        record: json!({
-            "$type": "app.bsky.feed.post",
-            "text": "Updated post content",
-            "createdAt": "2024-01-01T00:00:00Z"
-        }),
-        swap_commit: None,
-        swap_record: None,
-    };
-    
-    let put_response = put_record(
-        &http_client,
-        &dpop_auth,
-        pds_url,
-        put_request
-    ).await?;
-    
-    Ok(())
-}
-```
-
-### URL Building
-
-```rust
-use atproto_client::url::{URLBuilder, build_url};
-
-fn main() {
-    // Using URLBuilder for complex URLs
-    let mut builder = URLBuilder::new("pds.example.com");
-    builder.path("/xrpc/com.atproto.repo.listRecords");
-    builder.param("repo", "did:plc:user123");
-    builder.param("collection", "app.bsky.feed.post");
-    builder.param("limit", "50");
-    
-    let url = builder.build();
-    // Result: "https://pds.example.com/xrpc/com.atproto.repo.listRecords?repo=did%3Aplc%3Auser123&collection=app.bsky.feed.post&limit=50"
-    
-    // Using convenience function for simple URLs
-    let simple_url = build_url(
-        "pds.example.com",
-        "/xrpc/com.atproto.repo.getRecord",
-        vec![
-            Some(("repo", "did:plc:user123")),
-            Some(("collection", "app.bsky.feed.post")),
-            Some(("rkey", "3l2uygzaf5c2b")),
-            None, // Optional parameters can be None
-        ]
-    );
-    
-    println!("Built URL: {}", simple_url);
-}
+let response = get_dpop_json(&http_client, &dpop_auth, "https://pds.example.com/xrpc/...").await?;
 ```
 
-## AT Protocol Repository Operations
-
-The `com::atproto::repo` module provides client functions for the core AT Protocol repository XRPC methods:
-
-### Supported Operations
-
-- **`get_record()`**: Retrieve a specific record by repository, collection, and record key
-- **`list_records()`**: List records in a collection with pagination and filtering support
-- **`create_record()`**: Create a new record in a repository with optional record key
-- **`put_record()`**: Update or create a record with a specific record key
-
-### Request/Response Types
-
-- **`ListRecordsParams`**: Builder-style parameters for listing records with pagination
-- **`CreateRecordRequest<T>`**: Strongly-typed request for creating new records
-- **`PutRecordRequest<T>`**: Strongly-typed request for updating records
-- **`GetRecordResponse`**: Response containing record data, URI, and CID
-- **`ListRecordsResponse<T>`**: Paginated response with cursor support
-- **`CreateRecordResponse`**: Response with created record URI and CID
-- **`PutRecordResponse`**: Response with updated record URI and CID
-
-All operations support:
-- Generic record types with serde serialization/deserialization
-- Validation options for record schema compliance
-- Atomic commit operations with swap parameters
-- Comprehensive error handling with structured error types
-
-## Modules
-
-- **[`client`]** - Core HTTP client operations with DPoP authentication support
-- **[`com::atproto::repo`]** - AT Protocol repository operations for record management
-- **[`url`]** - URL construction utilities with parameter encoding
-- **[`errors`]** - Structured error types for client operations
-
-## Error Handling
-
-The crate uses structured error types with detailed error codes:
+### Repository Operations
 
 ```rust
-use atproto_client::errors::{ClientError, DPoPError};
-
-// Example error handling
-match result {
-    Err(ClientError::HttpRequestFailed { url, error }) => {
-        println!("HTTP request to {} failed: {}", url, error);
-    },
-    Err(ClientError::JsonParseFailed { url, error }) => {
-        println!("JSON parsing failed for {}: {}", url, error);
-    },
-    Ok(response) => println!("Success: {:?}", response),
-}
-
-// DPoP authentication errors
-match dpop_result {
-    Err(DPoPError::ProofGenerationFailed { error }) => {
-        println!("DPoP proof generation failed: {}", error);
-    },
-    Err(DPoPError::HttpRequestFailed { url, error }) => {
-        println!("DPoP authenticated request to {} failed: {}", url, error);
-    },
-    Ok(response) => println!("Authenticated request successful: {:?}", response),
-}
-```
-
-### Error Format
+use atproto_client::com::atproto::repo::{create_record, CreateRecordRequest};
 
-All errors follow the standardized format:
+let create_request = CreateRecordRequest {
+    repo: "did:plc:user123".to_string(),
+    collection: "app.bsky.feed.post".to_string(),
+    record: json!({"$type": "app.bsky.feed.post", "text": "Hello!"}),
+    // ...
+};
 
-```
-error-atproto-client-<domain>-<number> <message>: <details>
+let response = create_record(&http_client, &dpop_auth, pds_url, create_request).await?;
 ```
 
-Example error codes:
-- `error-atproto-client-http-1` - HTTP request failures
-- `error-atproto-client-http-2` - JSON parsing failures  
-- `error-atproto-client-dpop-1` - DPoP proof generation failures
-- `error-atproto-client-dpop-2` - DPoP authenticated request failures
-- `error-atproto-client-dpop-3` - DPoP response parsing failures
-
-## Authentication
-
-### DPoP Authentication
-
-The library supports DPoP (Demonstration of Proof-of-Possession) authentication as specified in RFC 9449:
-
-- Automatic DPoP proof generation for each request
-- Built-in retry middleware for nonce-based challenges
-- Integration with OAuth access tokens
-- Support for both authorization and resource requests
-
-### Key Requirements
-
-- Private key for DPoP proof signing (P-256 or K-256)
-- OAuth access token from authorization server
-- Issuer identifier for proof validation
-
-## Dependencies
-
-This crate builds on:
-
-- [`atproto-identity`](../atproto-identity) - Cryptographic key operations and DID resolution
-- [`atproto-record`](../atproto-record) - AT Protocol record operations
-- [`atproto-oauth`](../atproto-oauth) - OAuth 2.0 and DPoP implementation
-- `reqwest` - HTTP client for network operations
-- `reqwest-middleware` - HTTP middleware support for DPoP retry logic
-- `reqwest-chain` - Middleware chaining for authentication flows
-- `serde_json` - JSON serialization for AT Protocol data structures
-- `tokio` - Async runtime for HTTP operations
-- `tracing` - Structured logging for debugging and monitoring
-- `thiserror` - Structured error type derivation
-
-## Command Line Tools
-
-The crate includes one command-line tool for DPoP authentication testing:
-
-### `atproto-client-dpop`
-
-A command-line tool for testing DPoP authentication flows with AT Protocol services. This tool demonstrates the complete DPoP authentication process including proof generation, HTTP request signing, and token usage.
-
-**Features:**
-- **DPoP Proof Generation**: Creates DPoP proofs for HTTP requests using private keys
-- **OAuth Integration**: Supports OAuth access tokens with DPoP binding
-- **HTTP Client Testing**: Tests DPoP authentication against real AT Protocol endpoints
-- **Request Signing**: Demonstrates proper DPoP header generation and validation
-- **Token Management**: Shows how to use DPoP-bound access tokens for API requests
+## Command Line Examples
 
 ```bash
-# Test DPoP authentication with an AT Protocol endpoint
+# Test DPoP authentication
 cargo run --bin atproto-client-dpop \
-  --private-key did:key:zQ3shNzMp4oaaQ1gQRzCxMGXFrSW3NEM1M9T6KCY9eA7HhyEA \
-  --access-token your_access_token \
-  --issuer did:plc:issuer123 \
-  --url https://pds.example.com/xrpc/com.atproto.repo.listRecords \
+  --private-key did:key:zQ3sh... \
+  --access-token token \
+  --issuer did:plc:issuer \
+  --url https://pds.example.com/xrpc/... \
   --method GET
-
-# Example POST request with DPoP authentication
-cargo run --bin atproto-client-dpop \
-  --private-key did:key:zQ3shNzMp4oaaQ1gQRzCxMGXFrSW3NEM1M9T6KCY9eA7HhyEA \
-  --access-token your_access_token \
-  --issuer did:plc:issuer123 \
-  --url https://pds.example.com/xrpc/com.atproto.repo.createRecord \
-  --method POST \
-  --data '{"repo":"did:plc:user123","collection":"app.bsky.feed.post","record":{"$type":"app.bsky.feed.post","text":"Hello AT Protocol!"}}'
 ```
 
-**Arguments:**
-- `--private-key` - DID key string for DPoP proof signing
-- `--access-token` - OAuth access token for authentication
-- `--issuer` - Issuer DID for proof validation
-- `--url` - Target URL for the authenticated request
-- `--method` - HTTP method (GET, POST, PUT, DELETE)
-- `--data` - Optional JSON data for POST/PUT requests
-
-This tool is useful for:
-- Testing DPoP implementation against AT Protocol services
-- Validating authentication flows during development
-- Debugging DPoP proof generation and validation
-- Learning how DPoP authentication works in practice
-
-## Contributing
-
-Contributions are welcome! Please ensure that:
-
-1. All tests pass: `cargo test`
-2. Code is properly formatted: `cargo fmt`
-3. No linting issues: `cargo clippy`
-4. New functionality includes appropriate tests and documentation
-5. Error handling follows the project's structured error format
-
 ## License
 
-This project is licensed under the MIT License. See the LICENSE file for details.
-
-## Acknowledgments
-
-This library was extracted from the [Smokesignal](https://tangled.sh/@smokesignal.events/smokesignal) project, an open-source event and RSVP management and discovery application.
+MIT License

crates/atproto-client/src/bin/atproto-client-app-password.rs

···
+//! AT Protocol client app password tool for making authenticated XRPC calls.
+//!
+//! This binary tool makes XRPC calls using app password authentication by resolving
+//! subjects to DID documents and constructing authenticated requests.
+
+use anyhow::Result;
+use atproto_client::client::{
+    AppPasswordAuth, get_apppassword_json_with_headers, post_apppassword_json_with_headers,
+};
+use atproto_identity::{
+    config::{CertificateBundles, DnsNameservers, default_env, optional_env, version},
+    plc,
+    resolve::{create_resolver, resolve_subject},
+    web,
+};
+use reqwest::header::HeaderMap;
+use std::{collections::HashMap, env};
+
+fn print_usage() {
+    println!("AT Protocol Client App Password Tool");
+    println!();
+    println!("Usage:");
+    println!("  atproto-client-app-password <subject> <access_token> <xrpc_path> [args...]");
+    println!();
+    println!("Arguments:");
+    println!("  subject               Subject identifier to resolve");
+    println!("  access_token          App password JWT access token");
+    println!("  xrpc_path             XRPC path with optional prefix:");
+    println!("                        - query:<path> for GET requests (default)");
+    println!("                        - procedure:<path> for POST requests");
+    println!("                        - <path> defaults to GET request");
+    println!(
+        "  key=value             Additional query parameters (for GET requests)
+  header=name=value     Additional HTTP headers
+  <file_path>           JSON file path (required for procedure: prefix)"
+    );
+    println!();
+    println!("Examples:");
+    println!("  # GET request (default behavior without prefix)");
+    println!(
+        "  atproto-client-app-password alice.bsky.social eyJ0... com.atproto.repo.listRecords repo=alice.bsky.social collection=app.bsky.feed.post"
+    );
+    println!("  # GET request (explicit query: prefix)");
+    println!(
+        "  atproto-client-app-password alice.bsky.social eyJ0... query:com.atproto.repo.listRecords repo=alice.bsky.social collection=app.bsky.feed.post"
+    );
+    println!("  # POST request (requires procedure: prefix and JSON file)");
+    println!(
+        "  atproto-client-app-password alice.bsky.social eyJ0... procedure:com.atproto.repo.createRecord data.json"
+    );
+}
+
+#[tokio::main]
+async fn main() -> Result<()> {
+    // Parse command line arguments
+    let args: Vec<String> = env::args().skip(1).collect();
+
+    if args.len() < 3 || args.iter().any(|arg| arg == "--help" || arg == "-h") {
+        print_usage();
+        return Ok(());
+    }
+
+    let subject = &args[0];
+    let access_token = &args[1];
+    let xrpc_path_with_prefix = &args[2];
+
+    // Parse the xrpc_path prefix (optional, defaults to query:)
+    let (is_procedure, xrpc_path) = if let Some(path) = xrpc_path_with_prefix.strip_prefix("query:")
+    {
+        (false, path)
+    } else if let Some(path) = xrpc_path_with_prefix.strip_prefix("procedure:") {
+        (true, path)
+    } else {
+        // Default to query if no prefix is provided
+        (false, xrpc_path_with_prefix.as_str())
+    };
+
+    // Parse additional arguments based on request type
+    let mut query_params = HashMap::new();
+    let mut header_params = HashMap::new();
+    let mut json_data: Option<serde_json::Value> = None;
+    let mut arg_index = 3;
+
+    // For procedure calls, expect the next argument to be a file path
+    if is_procedure {
+        if arg_index >= args.len() {
+            anyhow::bail!("procedure: prefix requires a JSON file path as the next argument");
+        }
+        let file_path = &args[arg_index];
+        let file_content = std::fs::read_to_string(file_path)
+            .map_err(|e| anyhow::anyhow!("Failed to read file '{}': {}", file_path, e))?;
+        json_data = Some(serde_json::from_str(&file_content).map_err(|e| {
+            anyhow::anyhow!("Failed to parse JSON from file '{}': {}", file_path, e)
+        })?);
+        arg_index += 1;
+    }
+
+    // Parse remaining key=value arguments and header=name=value arguments
+    for arg in &args[arg_index..] {
+        if let Some((key, value)) = arg.split_once('=') {
+            if key == "header" {
+                // Parse header=name=value format
+                if let Some((header_name, header_value)) = value.split_once('=') {
+                    header_params.insert(header_name.to_string(), header_value.to_string());
+                } else {
+                    eprintln!("Warning: Ignoring invalid header format: {}", arg);
+                    eprintln!("Expected format: header=name=value");
+                }
+            } else if is_procedure {
+                eprintln!(
+                    "Warning: Query parameters are not supported for procedure calls. Ignoring: {}",
+                    arg
+                );
+            } else {
+                query_params.insert(key.to_string(), value.to_string());
+            }
+        } else {
+            eprintln!("Warning: Ignoring invalid argument format: {}", arg);
+            eprintln!("Expected format: key=value or header=name=value");
+        }
+    }
+
+    println!("Making app password authenticated XRPC call");
+    println!("Subject: {}", subject);
+    println!(
+        "Request Type: {}",
+        if is_procedure {
+            "POST (procedure)"
+        } else {
+            "GET (query)"
+        }
+    );
+    println!("XRPC Path: {}", xrpc_path);
+    if !query_params.is_empty() {
+        println!("Query Parameters: {:?}", query_params);
+    }
+    if !header_params.is_empty() {
+        println!("Additional Headers: {:?}", header_params);
+    }
+    if let Some(ref data) = json_data {
+        println!("JSON Data: {}", serde_json::to_string_pretty(data)?);
+    }
+
+    // Set up HTTP client configuration
+    let certificate_bundles: CertificateBundles = optional_env("CERTIFICATE_BUNDLES").try_into()?;
+    let default_user_agent = format!(
+        "atproto-identity-rs ({}; +https://tangled.sh/@smokesignal.events/atproto-identity-rs)",
+        version()?
+    );
+    let user_agent = default_env("USER_AGENT", &default_user_agent);
+    let dns_nameservers: DnsNameservers = optional_env("DNS_NAMESERVERS").try_into()?;
+    let plc_hostname = default_env("PLC_HOSTNAME", "plc.directory");
+
+    let mut client_builder = reqwest::Client::builder();
+    for ca_certificate in certificate_bundles.as_ref() {
+        let cert = std::fs::read(ca_certificate)?;
+        let cert = reqwest::Certificate::from_pem(&cert)?;
+        client_builder = client_builder.add_root_certificate(cert);
+    }
+
+    client_builder = client_builder.user_agent(user_agent);
+    let http_client = client_builder.build()?;
+
+    let dns_resolver = create_resolver(dns_nameservers.as_ref());
+
+    println!("Resolving subject: {}", subject);
+
+    // Resolve the subject to a DID
+    let did = resolve_subject(&http_client, &dns_resolver, subject).await?;
+
+    println!("Resolved DID: {}", did);
+
+    // Get the DID document based on DID type
+    let document = if did.starts_with("did:plc:") {
+        plc::query(&http_client, &plc_hostname, &did).await?
+    } else if did.starts_with("did:web:") {
+        web::query(&http_client, &did).await?
+    } else {
+        anyhow::bail!("Unsupported DID method: {}", did);
+    };
+
+    println!("Retrieved DID document for: {}", document.id);
+
+    // Get PDS endpoint from the DID document
+    let pds_endpoints = document.pds_endpoints();
+    let pds_endpoint = pds_endpoints
+        .first()
+        .ok_or_else(|| anyhow::anyhow!("No PDS endpoint found in DID document"))?;
+
+    println!("Using PDS endpoint: {}", pds_endpoint);
+
+    // Construct the URL
+    let mut url = format!("{}/xrpc/{}", pds_endpoint, xrpc_path);
+
+    // Add query parameters if any (only for GET requests)
+    if !is_procedure && !query_params.is_empty() {
+        let query_string: Vec<String> = query_params
+            .iter()
+            .map(|(k, v)| format!("{}={}", urlencoding::encode(k), urlencoding::encode(v)))
+            .collect();
+        url.push('?');
+        url.push_str(&query_string.join("&"));
+    }
+
+    println!("Request URL: {}", url);
+
+    // Create app password auth
+    let app_auth = AppPasswordAuth {
+        access_token: access_token.to_string(),
+    };
+
+    // Create HeaderMap from header parameters
+    let mut additional_headers = HeaderMap::new();
+    for (name, value) in header_params {
+        if let (Ok(header_name), Ok(header_value)) = (
+            name.parse::<reqwest::header::HeaderName>(),
+            value.parse::<reqwest::header::HeaderValue>(),
+        ) {
+            additional_headers.insert(header_name, header_value);
+        } else {
+            eprintln!("Warning: Invalid header name or value: {}={}", name, value);
+        }
+    }
+
+    // Make the authenticated request
+    println!("Making app password authenticated request...");
+
+    let response = if is_procedure {
+        let data =
+            json_data.ok_or_else(|| anyhow::anyhow!("No JSON data provided for procedure call"))?;
+        post_apppassword_json_with_headers(&http_client, &app_auth, &url, data, &additional_headers)
+            .await?
+    } else {
+        get_apppassword_json_with_headers(&http_client, &app_auth, &url, &additional_headers)
+            .await?
+    };
+
+    // Print the response
+    println!("Response:");
+    println!("{}", serde_json::to_string_pretty(&response)?);
+
+    Ok(())
+}

crates/atproto-client/src/bin/atproto-client-auth.rs

···
+//! AT Protocol client authentication tool for app password session management.
+//!
+//! This binary tool provides commands for creating and refreshing app password
+//! authentication sessions with AT Protocol servers.
+
+use anyhow::Result;
+use atproto_identity::{
+    config::{CertificateBundles, DnsNameservers, default_env, optional_env, version},
+    plc,
+    resolve::{create_resolver, resolve_subject},
+    web,
+};
+use serde_json::json;
+use std::env;
+
+// Import from public module
+use atproto_client::com::atproto::server::{create_session, refresh_session};
+
+fn print_usage() {
+    println!("AT Protocol Client Authentication Tool");
+    println!();
+    println!("Usage:");
+    println!("  atproto-client-auth <command> [args...]");
+    println!();
+    println!("Commands:");
+    println!("  login <identifier> <password> [auth_factor_token]");
+    println!("    Create a new app-password session");
+    println!("    identifier:         Handle or email for authentication");
+    println!("    password:          App password or account password");
+    println!("    auth_factor_token: Optional 2FA token");
+    println!();
+    println!("  refresh <refresh_token>");
+    println!("    Refresh an existing app-password session");
+    println!("    refresh_token: JWT refresh token from previous session");
+    println!();
+    println!("Environment Variables:");
+    println!("  CERTIFICATE_BUNDLES: Custom CA certificate bundles");
+    println!("  USER_AGENT:         Custom user agent string");
+    println!("  DNS_NAMESERVERS:    Custom DNS nameservers");
+    println!("  PDS_ENDPOINT:       Override PDS endpoint (skips DID resolution)");
+    println!();
+    println!("Examples:");
+    println!("  # Login with handle and app password");
+    println!("  atproto-client-auth login alice.bsky.social app-password-here");
+    println!();
+    println!("  # Login with email and 2FA");
+    println!("  atproto-client-auth login [e-mail] password123 123456");
+    println!();
+    println!("  # Refresh session");
+    println!("  atproto-client-auth refresh eyJ0eXAiOiJKV1QiLCJhbGciOiJFUzI1NiJ9...");
+}
+
+#[tokio::main]
+async fn main() -> Result<()> {
+    // Parse command line arguments
+    let args: Vec<String> = env::args().skip(1).collect();
+
+    if args.is_empty() || args.iter().any(|arg| arg == "--help" || arg == "-h") {
+        print_usage();
+        return Ok(());
+    }
+
+    let command = &args[0];
+
+    // Set up HTTP client configuration
+    let certificate_bundles: CertificateBundles = optional_env("CERTIFICATE_BUNDLES").try_into()?;
+    let default_user_agent = format!(
+        "atproto-identity-rs ({}; +https://tangled.sh/@smokesignal.events/atproto-identity-rs)",
+        version()?
+    );
+    let user_agent = default_env("USER_AGENT", &default_user_agent);
+    let dns_nameservers: DnsNameservers = optional_env("DNS_NAMESERVERS").try_into()?;
+    let plc_hostname = default_env("PLC_HOSTNAME", "plc.directory");
+
+    let mut client_builder = reqwest::Client::builder();
+    for ca_certificate in certificate_bundles.as_ref() {
+        let cert = std::fs::read(ca_certificate)?;
+        let cert = reqwest::Certificate::from_pem(&cert)?;
+        client_builder = client_builder.add_root_certificate(cert);
+    }
+
+    client_builder = client_builder.user_agent(user_agent);
+    let http_client = client_builder.build()?;
+
+    let dns_resolver = create_resolver(dns_nameservers.as_ref());
+
+    match command.as_str() {
+        "login" => {
+            if args.len() < 3 {
+                eprintln!("Error: login command requires identifier and password");
+                eprintln!();
+                print_usage();
+                return Ok(());
+            }
+
+            let identifier = &args[1];
+            let password = &args[2];
+            let auth_factor_token = args.get(3).map(|s| s.as_str());
+
+            println!("Creating app password session");
+            println!("Identifier: {}", identifier);
+
+            // Determine PDS endpoint
+            let pds_endpoint = if let Ok(endpoint) = env::var("PDS_ENDPOINT") {
+                println!("Using PDS endpoint from environment: {}", endpoint);
+                endpoint
+            } else {
+                println!("Resolving identifier to find PDS endpoint...");
+
+                // Resolve the identifier to a DID
+                let did = resolve_subject(&http_client, &dns_resolver, identifier).await?;
+                println!("Resolved DID: {}", did);
+
+                // Get the DID document based on DID type
+                let document = if did.starts_with("did:plc:") {
+                    plc::query(&http_client, &plc_hostname, &did).await?
+                } else if did.starts_with("did:web:") {
+                    web::query(&http_client, &did).await?
+                } else {
+                    anyhow::bail!("Unsupported DID method: {}", did);
+                };
+
+                println!("Retrieved DID document for: {}", document.id);
+
+                // Get PDS endpoint from the DID document
+                let pds_endpoints = document.pds_endpoints();
+                let pds_endpoint = pds_endpoints
+                    .first()
+                    .ok_or_else(|| anyhow::anyhow!("No PDS endpoint found in DID document"))?;
+
+                println!("Found PDS endpoint: {}", pds_endpoint);
+                pds_endpoint.to_string()
+            };
+
+            // Create session
+            println!("Creating session...");
+            let session = create_session(
+                &http_client,
+                &pds_endpoint,
+                identifier,
+                password,
+                auth_factor_token,
+            )
+            .await?;
+
+            println!("Session created successfully!");
+            println!();
+            println!("Session Details:");
+            println!("  DID: {}", session.did);
+            println!("  Handle: {}", session.handle);
+            println!("  Email: {}", session.email);
+            println!();
+            println!("Tokens (save these for authenticated requests):");
+            println!("  Access Token: {}", session.access_jwt);
+            println!("  Refresh Token: {}", session.refresh_jwt);
+            println!();
+            println!("Session JSON:");
+            println!(
+                "{}",
+                serde_json::to_string_pretty(&json!({
+                    "did": session.did,
+                    "handle": session.handle,
+                    "email": session.email,
+                    "accessJwt": session.access_jwt,
+                    "refreshJwt": session.refresh_jwt
+                }))?
+            );
+        }
+
+        "refresh" => {
+            if args.len() < 2 {
+                eprintln!("Error: refresh command requires refresh_token");
+                eprintln!();
+                print_usage();
+                return Ok(());
+            }
+
+            let refresh_token = &args[1];
+
+            println!("Refreshing app password session");
+
+            // Determine PDS endpoint
+            let pds_endpoint = if let Ok(endpoint) = env::var("PDS_ENDPOINT") {
+                println!("Using PDS endpoint from environment: {}", endpoint);
+                endpoint
+            } else {
+                // For refresh, we don't have the identifier, so require PDS_ENDPOINT
+                eprintln!("Error: PDS_ENDPOINT environment variable required for refresh command");
+                eprintln!("Set PDS_ENDPOINT to your PDS URL (e.g., https://bsky.social)");
+                return Ok(());
+            };
+
+            // Refresh session
+            println!("Refreshing session...");
+            let refreshed_session =
+                refresh_session(&http_client, &pds_endpoint, refresh_token).await?;
+
+            println!("Session refreshed successfully!");
+            println!();
+            println!("Updated Session Details:");
+            println!("  DID: {}", refreshed_session.did);
+            println!("  Handle: {}", refreshed_session.handle);
+            if let Some(active) = refreshed_session.active {
+                println!("  Active: {}", active);
+            }
+            if let Some(ref status) = refreshed_session.status {
+                println!("  Status: {}", status);
+            }
+            println!();
+            println!("New Tokens (save these for authenticated requests):");
+            println!("  Access Token: {}", refreshed_session.access_jwt);
+            println!("  Refresh Token: {}", refreshed_session.refresh_jwt);
+            println!();
+            println!("Session JSON:");
+            println!(
+                "{}",
+                serde_json::to_string_pretty(&json!({
+                    "did": refreshed_session.did,
+                    "handle": refreshed_session.handle,
+                    "accessJwt": refreshed_session.access_jwt,
+                    "refreshJwt": refreshed_session.refresh_jwt,
+                    "active": refreshed_session.active,
+                    "status": refreshed_session.status
+                }))?
+            );
+        }
+
+        _ => {
+            eprintln!("Error: Unknown command '{}'", command);
+            eprintln!();
+            print_usage();
+        }
+    }
+
+    Ok(())
+}

crates/atproto-client/src/client.rs

···
     pub oauth_issuer: String,
 }
 
+/// App password authentication credentials for authenticated HTTP requests.
+///
+/// Contains the JWT access token for Bearer token authentication.
+pub struct AppPasswordAuth {
+    /// JWT access token for the Authorization header
+    pub access_token: String,
+}
+
 /// Performs an unauthenticated HTTP GET request and parses the response as JSON.
 ///
 /// # Arguments
···
 
     Ok(value)
 }
+
+/// Performs an unauthenticated HTTP POST request with JSON body and parses the response as JSON.
+///
+/// # Arguments
+///
+/// * `http_client` - The HTTP client to use for the request
+/// * `url` - The URL to request
+/// * `data` - The JSON data to send in the request body
+///
+/// # Returns
+///
+/// The parsed JSON response as a `serde_json::Value`
+///
+/// # Errors
+///
+/// Returns `ClientError::HttpRequestFailed` if the HTTP request fails,
+/// or `ClientError::JsonParseFailed` if JSON parsing fails.
+pub async fn post_json(
+    http_client: &reqwest::Client,
+    url: &str,
+    data: serde_json::Value,
+) -> Result<serde_json::Value> {
+    let empty = HeaderMap::default();
+    post_json_with_headers(http_client, url, data, &empty).await
+}
+
+/// Performs an unauthenticated HTTP POST request with JSON body and additional headers, and parses the response as JSON.
+///
+/// # Arguments
+///
+/// * `http_client` - The HTTP client to use for the request
+/// * `url` - The URL to request
+/// * `data` - The JSON data to send in the request body
+/// * `additional_headers` - Additional HTTP headers to include in the request
+///
+/// # Returns
+///
+/// The parsed JSON response as a `serde_json::Value`
+///
+/// # Errors
+///
+/// Returns `ClientError::HttpRequestFailed` if the HTTP request fails,
+/// or `ClientError::JsonParseFailed` if JSON parsing fails.
+pub async fn post_json_with_headers(
+    http_client: &reqwest::Client,
+    url: &str,
+    data: serde_json::Value,
+    additional_headers: &HeaderMap,
+) -> Result<serde_json::Value> {
+    let http_response = http_client
+        .post(url)
+        .headers(additional_headers.clone())
+        .json(&data)
+        .send()
+        .instrument(tracing::info_span!("post_json_with_headers", url = %url))
+        .await
+        .map_err(|error| ClientError::HttpRequestFailed {
+            url: url.to_string(),
+            error,
+        })?;
+
+    let value = http_response
+        .json::<serde_json::Value>()
+        .await
+        .map_err(|error| ClientError::JsonParseFailed {
+            url: url.to_string(),
+            error,
+        })?;
+
+    Ok(value)
+}
+
+/// Performs an app password-authenticated HTTP GET request and parses the response as JSON.
+///
+/// # Arguments
+///
+/// * `http_client` - The HTTP client to use for the request
+/// * `app_auth` - App password authentication credentials
+/// * `url` - The URL to request
+///
+/// # Returns
+///
+/// The parsed JSON response as a `serde_json::Value`
+///
+/// # Errors
+///
+/// Returns `ClientError::HttpRequestFailed` if the HTTP request fails,
+/// or `ClientError::JsonParseFailed` if JSON parsing fails.
+pub async fn get_apppassword_json(
+    http_client: &reqwest::Client,
+    app_auth: &AppPasswordAuth,
+    url: &str,
+) -> Result<serde_json::Value> {
+    let empty = HeaderMap::default();
+    get_apppassword_json_with_headers(http_client, app_auth, url, &empty).await
+}
+
+/// Performs an app password-authenticated HTTP GET request with additional headers and parses the response as JSON.
+///
+/// # Arguments
+///
+/// * `http_client` - The HTTP client to use for the request
+/// * `app_auth` - App password authentication credentials
+/// * `url` - The URL to request
+/// * `additional_headers` - Additional HTTP headers to include in the request
+///
+/// # Returns
+///
+/// The parsed JSON response as a `serde_json::Value`
+///
+/// # Errors
+///
+/// Returns `ClientError::HttpRequestFailed` if the HTTP request fails,
+/// or `ClientError::JsonParseFailed` if JSON parsing fails.
+pub async fn get_apppassword_json_with_headers(
+    http_client: &reqwest::Client,
+    app_auth: &AppPasswordAuth,
+    url: &str,
+    additional_headers: &HeaderMap,
+) -> Result<serde_json::Value> {
+    let mut headers = additional_headers.clone();
+    headers.insert(
+        reqwest::header::AUTHORIZATION,
+        reqwest::header::HeaderValue::from_str(&format!("Bearer {}", app_auth.access_token))?,
+    );
+
+    let http_response = http_client
+        .get(url)
+        .headers(headers)
+        .send()
+        .instrument(tracing::info_span!("get_apppassword_json_with_headers", url = %url))
+        .await
+        .map_err(|error| ClientError::HttpRequestFailed {
+            url: url.to_string(),
+            error,
+        })?;
+
+    let value = http_response
+        .json::<serde_json::Value>()
+        .await
+        .map_err(|error| ClientError::JsonParseFailed {
+            url: url.to_string(),
+            error,
+        })?;
+
+    Ok(value)
+}
+
+/// Performs an app password-authenticated HTTP POST request with JSON body and parses the response as JSON.
+///
+/// # Arguments
+///
+/// * `http_client` - The HTTP client to use for the request
+/// * `app_auth` - App password authentication credentials
+/// * `url` - The URL to request
+/// * `data` - The JSON data to send in the request body
+///
+/// # Returns
+///
+/// The parsed JSON response as a `serde_json::Value`
+///
+/// # Errors
+///
+/// Returns `ClientError::HttpRequestFailed` if the HTTP request fails,
+/// or `ClientError::JsonParseFailed` if JSON parsing fails.
+pub async fn post_apppassword_json(
+    http_client: &reqwest::Client,
+    app_auth: &AppPasswordAuth,
+    url: &str,
+    data: serde_json::Value,
+) -> Result<serde_json::Value> {
+    let empty = HeaderMap::default();
+    post_apppassword_json_with_headers(http_client, app_auth, url, data, &empty).await
+}
+
+/// Performs an app password-authenticated HTTP POST request with JSON body and additional headers, and parses the response as JSON.
+///
+/// # Arguments
+///
+/// * `http_client` - The HTTP client to use for the request
+/// * `app_auth` - App password authentication credentials
+/// * `url` - The URL to request
+/// * `data` - The JSON data to send in the request body
+/// * `additional_headers` - Additional HTTP headers to include in the request
+///
+/// # Returns
+///
+/// The parsed JSON response as a `serde_json::Value`
+///
+/// # Errors
+///
+/// Returns `ClientError::HttpRequestFailed` if the HTTP request fails,
+/// or `ClientError::JsonParseFailed` if JSON parsing fails.
+pub async fn post_apppassword_json_with_headers(
+    http_client: &reqwest::Client,
+    app_auth: &AppPasswordAuth,
+    url: &str,
+    data: serde_json::Value,
+    additional_headers: &HeaderMap,
+) -> Result<serde_json::Value> {
+    let mut headers = additional_headers.clone();
+    headers.insert(
+        reqwest::header::AUTHORIZATION,
+        reqwest::header::HeaderValue::from_str(&format!("Bearer {}", app_auth.access_token))?,
+    );
+
+    let http_response = http_client
+        .post(url)
+        .headers(headers)
+        .json(&data)
+        .send()
+        .instrument(tracing::info_span!("post_apppassword_json_with_headers", url = %url))
+        .await
+        .map_err(|error| ClientError::HttpRequestFailed {
+            url: url.to_string(),
+            error,
+        })?;
+
+    let value = http_response
+        .json::<serde_json::Value>()
+        .await
+        .map_err(|error| ClientError::JsonParseFailed {
+            url: url.to_string(),
+            error,
+        })?;
+
+    Ok(value)
+}

crates/atproto-client/src/com_atproto_server.rs

···
+//! AT Protocol server operations for session management.
+//!
+//! This module provides client functions for interacting with AT Protocol server endpoints,
+//! including session creation and refresh operations using app passwords. Supports the
+//! `com.atproto.server` XRPC methods for authentication and session management.
+//!
+//! ## Operations
+//!
+//! - **`create_session()`**: Create a new authentication session with app password
+//! - **`refresh_session()`**: Refresh an existing authentication session
+//!
+//! ## Request/Response Types
+//!
+//! - **`CreateSessionRequest`**: Parameters for creating a new session
+//! - **`AppPasswordSession`**: Response containing session data and tokens
+//! - **`RefreshSessionResponse`**: Response from session refresh operation
+//!
+//! ## Authentication
+//!
+//! Session creation uses app password authentication, while session refresh requires
+//! the refresh JWT token from a previous session.
+
+use anyhow::Result;
+use serde::{Deserialize, Serialize};
+
+use crate::{client::post_json, url::URLBuilder};
+
+/// Request to create a new authentication session.
+#[derive(Debug, Serialize, Clone)]
+pub struct CreateSessionRequest {
+    /// Handle or other identifier supported by the server for the authenticating user
+    pub identifier: String,
+    /// User password or app password
+    pub password: String,
+    /// Optional two-factor authentication token
+    #[serde(skip_serializing_if = "Option::is_none", rename = "authFactorToken")]
+    pub auth_factor_token: Option<String>,
+}
+
+/// App password session data returned from successful authentication.
+#[derive(Debug, Deserialize, Clone)]
+pub struct AppPasswordSession {
+    /// Distributed identifier for the authenticated account
+    pub did: String,
+    /// Handle for the authenticated account
+    pub handle: String,
+    /// Email address for the authenticated account
+    pub email: String,
+    /// JWT access token for authenticated requests
+    #[serde(rename = "accessJwt")]
+    pub access_jwt: String,
+    /// JWT refresh token for obtaining new access tokens
+    #[serde(rename = "refreshJwt")]
+    pub refresh_jwt: String,
+}
+
+/// Response from refreshing an authentication session.
+#[derive(Debug, Deserialize, Clone)]
+pub struct RefreshSessionResponse {
+    /// Distributed identifier for the authenticated account
+    pub did: String,
+    /// Handle for the authenticated account
+    pub handle: String,
+    /// JWT access token for authenticated requests
+    #[serde(rename = "accessJwt")]
+    pub access_jwt: String,
+    /// JWT refresh token for obtaining new access tokens
+    #[serde(rename = "refreshJwt")]
+    pub refresh_jwt: String,
+    /// Whether the account is active
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub active: Option<bool>,
+    /// Account status (e.g., "takendown", "suspended", "deactivated")
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub status: Option<String>,
+}
+
+/// Creates a new authentication session using app password credentials.
+///
+/// # Arguments
+///
+/// * `http_client` - HTTP client for making requests
+/// * `base_url` - Base URL of the AT Protocol server
+/// * `identifier` - Handle or other identifier for the user
+/// * `password` - User password or app password
+/// * `auth_factor_token` - Optional two-factor authentication token
+///
+/// # Returns
+///
+/// The created session data including access and refresh tokens
+///
+/// # Errors
+///
+/// Returns errors for HTTP request failures, authentication failures,
+/// or JSON parsing failures.
+pub async fn create_session(
+    http_client: &reqwest::Client,
+    base_url: &str,
+    identifier: &str,
+    password: &str,
+    auth_factor_token: Option<&str>,
+) -> Result<AppPasswordSession> {
+    let mut url_builder = URLBuilder::new(base_url);
+    url_builder.path("/xrpc/com.atproto.server.createSession");
+    let url = url_builder.build();
+
+    tracing::info!(?url, identifier = %identifier, "create_session");
+
+    let request = CreateSessionRequest {
+        identifier: identifier.to_string(),
+        password: password.to_string(),
+        auth_factor_token: auth_factor_token.map(|s| s.to_string()),
+    };
+
+    let value = serde_json::to_value(request)?;
+
+    post_json(http_client, &url, value)
+        .await
+        .and_then(|value| serde_json::from_value(value).map_err(|err| err.into()))
+}
+
+/// Refreshes an existing authentication session using a refresh token.
+///
+/// # Arguments
+///
+/// * `http_client` - HTTP client for making requests
+/// * `base_url` - Base URL of the AT Protocol server
+/// * `refresh_token` - JWT refresh token from a previous session
+///
+/// # Returns
+///
+/// The refreshed session data with new access and refresh tokens
+///
+/// # Errors
+///
+/// Returns errors for HTTP request failures, authentication failures,
+/// or JSON parsing failures.
+pub async fn refresh_session(
+    http_client: &reqwest::Client,
+    base_url: &str,
+    refresh_token: &str,
+) -> Result<RefreshSessionResponse> {
+    let mut url_builder = URLBuilder::new(base_url);
+    url_builder.path("/xrpc/com.atproto.server.refreshSession");
+    let url = url_builder.build();
+
+    tracing::info!(?url, "refresh_session");
+
+    // Create a new client with the refresh token in Authorization header
+    let mut headers = reqwest::header::HeaderMap::new();
+    headers.insert(
+        reqwest::header::AUTHORIZATION,
+        reqwest::header::HeaderValue::from_str(&format!("Bearer {}", refresh_token))?,
+    );
+
+    let response = http_client.post(&url).headers(headers).send().await?;
+
+    let value = response.json::<serde_json::Value>().await?;
+
+    serde_json::from_value(value).map_err(|err| err.into())
+}

crates/atproto-client/src/lib.rs

···
-//! # AT Protocol HTTP Client
-//!
-//! Comprehensive HTTP client functionality for AT Protocol services with support for
-//! authenticated requests, DPoP authentication, and structured error handling.
-//!
-//! ## Features
-//!
-//! - **Authenticated HTTP Requests**: DPoP-based authentication for secure API access
-//! - **URL Building**: Utilities for constructing AT Protocol service URLs
-//! - **Error Handling**: Structured error types for client operations
-//! - **Repository Operations**: Built-in support for AT Protocol repository endpoints
-//!
-//! ## Modules
-//!
-//! - [`client`]: Core HTTP client with authentication support
-//! - [`errors`]: Structured error types for client operations
-//! - [`url`]: URL building utilities for AT Protocol services
-//! - [`com::atproto::repo`]: Repository operation implementations
+//! HTTP client for AT Protocol services with DPoP authentication and XRPC support.
 //!
-//! ## CLI Tools
-//!
-//! This crate provides the following binary tools:
-//!
-//! - **`atproto-client-dpop`**: Command-line tool for making authenticated XRPC calls
-//!   using DPoP authentication
+//! Provides binaries:
+//! - `atproto-client-dpop`: Make authenticated XRPC calls using DPoP tokens
+//! - `atproto-client-auth`: Manage app password authentication and sessions
+//! - `atproto-client-app-password`: Make authenticated XRPC calls using Bearer tokens
 
 #![warn(missing_docs)]
 
···
 pub mod url;
 
 mod com_atproto_repo;
+mod com_atproto_server;
 
 /// AT Protocol namespace modules.
 pub mod com {
···
         /// Repository operations for AT Protocol records.
         pub mod repo {
             pub use crate::com_atproto_repo::*;
+        }
+        /// Server operations for AT Protocol authentication and session management.
+        pub mod server {
+            pub use crate::com_atproto_server::*;
         }
     }
 }

crates/atproto-identity/README.md

···
 # atproto-identity
 
-A Rust library for AT Protocol identity resolution and management.
+Identity management library for AT Protocol with DID resolution and cryptographic operations.
 
 ## Overview
 
-`atproto-identity` provides comprehensive support for resolving and managing identities in the AT Protocol ecosystem. This library handles multiple DID (Decentralized Identifier) methods including `did:plc` and `did:web`, as well as AT Protocol handle resolution via both DNS and HTTP methods.
-
-This project was extracted from the open-sourced [Smokesignal](https://tangled.sh/@smokesignal.events/smokesignal) project and is designed to be a standalone, reusable library for AT Protocol identity operations.
-
-## Features
-
-- **Handle Resolution**: Resolve AT Protocol handles to DIDs using DNS TXT records and HTTP well-known endpoints
-- **DID Document Retrieval**: Fetch and parse DID documents for `did:plc` and `did:web` identifiers
-- **Multiple Resolution Methods**: Supports both DNS and HTTP-based handle resolution with conflict detection
-- **Configurable DNS**: Custom DNS nameserver support with fallback to system defaults
-- **Cryptographic Key Operations**: Support for P-256 and K-256 key identification, signature validation, and signing
-- **Structured Logging**: Built-in tracing support for debugging and monitoring
-- **Type Safety**: Comprehensive error handling with structured error types
-
-## Supported DID Methods
+`atproto-identity` provides comprehensive support for resolving and managing identities in the AT Protocol ecosystem. This library handles multiple DID methods including `did:plc` and `did:web`, as well as AT Protocol handle resolution via DNS and HTTP methods.
 
-- **did-method-plc**: Public Ledger of Credentials DIDs via PLC directory
-- **did-method-web**: Web-based DIDs following the did:web specification with URL conversion utilities
-- **ATProtocol Handle Resolution**: AT Protocol handles (e.g., `ngerakines.me`) can be resolved to DIDs
+## Binaries
 
-## Installation
-
-Add this to your `Cargo.toml`:
-
-```toml
-[dependencies]
-atproto-identity = "0.6.0"
-```
+- **atproto-identity-resolve**: Resolves handles and DIDs to their canonical identifiers
+- **atproto-identity-key**: Generates and manages P-256 and K-256 cryptographic keys
+- **atproto-identity-sign**: Creates cryptographic signatures for JSON data  
+- **atproto-identity-validate**: Verifies signatures against public keys
 
 ## Usage
 
···
 ```rust
 use atproto_identity::resolve::{resolve_subject, create_resolver};
 
-#[tokio::main]
-async fn main() -> anyhow::Result<()> {
-    let http_client = reqwest::Client::new();
-    let dns_resolver = create_resolver(&[]);
-    
-    let did = resolve_subject(&http_client, &dns_resolver, "ngerakines.me").await?;
-    println!("Resolved DID: {}", did);
-    
-    Ok(())
-}
-```
-
-### DID Document Retrieval
-
-```rust
-use atproto_identity::{plc, web};
+let http_client = reqwest::Client::new();
+let dns_resolver = create_resolver(&[]);
 
-#[tokio::main]
-async fn main() -> anyhow::Result<()> {
-    let http_client = reqwest::Client::new();
-    
-    // Query PLC DID document
-    let plc_doc = plc::query(&http_client, "plc.directory", "did:plc:example123").await?;
-    
-    // Query Web DID document
-    let web_doc = web::query(&http_client, "did:web:example.com").await?;
-    
-    // Convert Web DID to URL (for custom processing)
-    let did_url = web::did_web_to_url("did:web:example.com")?;
-    println!("DID document URL: {}", did_url);
-    
-    Ok(())
-}
+let did = resolve_subject(&http_client, &dns_resolver, "alice.bsky.social").await?;
 ```
 
-### Web DID URL Conversion
-
-The `web` module provides utilities for converting DID identifiers to their HTTPS document URLs:
+### Key Operations
 
 ```rust
-use atproto_identity::web;
+use atproto_identity::key::{identify_key, validate};
 
-fn main() -> anyhow::Result<()> {
-    // Convert simple hostname DID
-    let url = web::did_web_to_url("did:web:example.com")?;
-    // Returns: "https://example.com/.well-known/did.json"
-    
-    // Convert DID with path components  
-    let url = web::did_web_to_url("did:web:example.com:path:subpath")?;
-    // Returns: "https://example.com/path/subpath/did.json"
-    
-    Ok(())
-}
+let key_data = identify_key("did:key:zQ3sh...")?;
+validate(&key_data, &signature, content)?;
 ```
 
-### Cryptographic Key Operations
-
-The `key` module provides utilities for working with cryptographic keys:
-
-```rust
-use atproto_identity::key::{identify_key, validate, KeyType};
-
-fn main() -> Result<(), Box<dyn std::error::Error>> {
-    // Identify a key from a DID key string
-    let key_data = identify_key("did:key:zQ3shNzMp4oaaQ1gQRzCxMGXFrSW3NEM1M9T6KCY9eA7HhyEA")?;
-    
-    match key_data.0 {
-        KeyType::K256Public => println!("K-256 public key"),
-        KeyType::P256Public => println!("P-256 public key"),
-        KeyType::K256Private => println!("K-256 private key"),
-        KeyType::P256Private => println!("P-256 private key"),
-    }
-    
-    // Validate a signature (example with dummy data)
-    let content = b"hello world";
-    let signature = vec![0u8; 64]; // Replace with actual signature
-    validate(&key_data, &signature, content)?;
-    
-    Ok(())
-}
-```
-
-### Configuration
-
-The library supports various configuration options through environment variables:
-
-```bash
-# Custom PLC directory hostname
-export PLC_HOSTNAME=plc.directory
-
-# Custom DNS nameservers (semicolon-separated)
-export DNS_NAMESERVERS=8.8.8.8;1.1.1.1
-
-# Custom CA certificate bundles (semicolon-separated paths)
-export CERTIFICATE_BUNDLES=/path/to/cert1.pem;/path/to/cert2.pem
-
-# Custom User-Agent string
-export USER_AGENT="my-app/1.0"
-```
-
-## Command Line Tools
-
-The library includes four command-line tools for AT Protocol identity operations:
-
-### `atproto-identity-resolve`
-
-Resolves AT Protocol handles and DIDs to their canonical DID identifiers and optionally retrieves full DID documents. This tool supports both `did:plc` and `did:web` methods with configurable DNS and HTTP settings for comprehensive identity resolution.
-
-**Features:**
-- **Handle Resolution**: Converts AT Protocol handles (e.g., `alice.bsky.social`) to DIDs
-- **DID Document Retrieval**: Fetches complete DID documents with verification methods
-- **Multi-Method Support**: Handles both PLC directory and Web DID resolution
-- **DNS Configuration**: Supports custom DNS nameservers and certificate bundles
-- **Output Options**: Choose between DID-only output or full document retrieval
+## Command Line Examples
 
 ```bash
-# Resolve a handle to its DID
+# Resolve a handle to DID
 cargo run --bin atproto-identity-resolve alice.bsky.social
 
-# Resolve a DID and get full DID document
-cargo run --bin atproto-identity-resolve --did-document did:plc:user123
-
-# Resolve with custom configuration
-PLC_HOSTNAME=plc.directory DNS_NAMESERVERS="8.8.8.8;1.1.1.1" \
-  cargo run --bin atproto-identity-resolve --did-document alice.bsky.social
-```
-
-### `atproto-identity-sign`
-
-Creates cryptographic signatures of JSON data using AT Protocol DID keys. This tool reads JSON files, serializes them using IPLD DAG-CBOR format for consistency, and produces multibase-encoded signatures suitable for AT Protocol operations.
-
-**Features:**
-- **DID Key Support**: Works with both P-256 and K-256 private keys
-- **JSON Processing**: Handles arbitrary JSON data structures
-- **IPLD Serialization**: Uses DAG-CBOR for deterministic serialization
-- **Multibase Output**: Produces signatures in multibase format
-- **File Input**: Reads JSON data from specified files
-
-```bash
-# Sign a JSON file with a DID private key
-cargo run --bin atproto-identity-sign did:key:zQ3shNzMp4oaaQ1... data.json
-
-# Example output: multibase-encoded signature string
-# uEiB5vJz8aZhpx3bY2nKfRzPpLmQwA8Z9qXhNvYtF2gH7...
-```
-
-### `atproto-identity-validate`
-
-Verifies cryptographic signatures of JSON data using AT Protocol DID keys. This tool validates that signatures were created by the holder of a specific private key, ensuring data integrity and authenticity for AT Protocol operations.
-
-**Features:**
-- **Signature Verification**: Validates multibase-encoded signatures
-- **DID Key Support**: Works with P-256 and K-256 public keys
-- **IPLD Deserialization**: Uses DAG-CBOR for consistent verification
-- **File Processing**: Reads JSON data and signatures from files
-- **Exit Code Reporting**: Returns appropriate exit codes for success/failure
-
-```bash
-# Validate a signature against a JSON file
-cargo run --bin atproto-identity-validate did:key:zQ3shNzMp4oaaQ1... data.json uEiB5vJz8aZ...
-
-# Successful validation returns exit code 0
-# Failed validation returns exit code 1
-```
-
-**Arguments:**
-- `<public_key>` - DID key string for verification (did:key:...)
-- `<data_file>` - JSON file containing the original data
-- `<signature>` - Multibase-encoded signature to verify
-
-### `atproto-identity-key`
-
-Provides comprehensive cryptographic key management capabilities for AT Protocol operations, including key generation and inspection for both P-256 and K-256 elliptic curves.
-
-**Features:**
-- **Key Generation**: Creates new private keys for both curve types
-- **Secure Random**: Uses cryptographically secure random number generation
-- **DID Key Format**: Outputs keys in standard DID key format
-- **Multiple Algorithms**: Supports both P-256 (secp256r1) and K-256 (secp256k1) curves
-- **Development Ready**: Generated keys ready for use in AT Protocol operations
-
-```bash
-# Generate a new P-256 private key (recommended for most AT Protocol use)
+# Generate a new P-256 key
 cargo run --bin atproto-identity-key generate p256
 
-# Generate a new K-256 private key (Bitcoin-style curve)
-cargo run --bin atproto-identity-key generate k256
+# Sign JSON data
+cargo run --bin atproto-identity-sign did:key:zQ3sh... data.json
 
-# Example output format:
-# did:key:zQ3shNzMp4oaaQ1gQRzCxMGXFrSW3NEM1M9T6KCY9eA7HhyEA
+# Verify a signature
+cargo run --bin atproto-identity-validate did:key:zQ3sh... data.json signature
 ```
 
-**Key Types:**
-- **P-256**: NIST P-256 curve (secp256r1) - Recommended for new applications
-- **K-256**: secp256k1 curve (same as Bitcoin) - For Bitcoin-compatible operations
-
-**Security Note:** Generated keys are output to stdout and should be stored securely. Never commit private keys to version control or share them publicly.
-
-## Architecture
-
-The library is organized into several modules:
-
-- **resolve**: Core resolution logic for handles and DIDs
-- **plc**: PLC directory client for `did:plc` resolution
-- **web**: Web DID client for `did:web` resolution and URL conversion
-- **model**: Data structures for DID documents and AT Protocol entities
-- **validation**: Input validation for handles and DIDs
-- **config**: Configuration management and environment variable handling
-- **errors**: Structured error types following project conventions
-- **key**: Cryptographic key operations including signature validation and key identification for P-256 and K-256 curves
-
-## Error Handling
-
-All errors follow a structured format:
-
-```
-error-atproto-identity-<domain>-<number> <message>: <details>
-```
-
-Examples:
-- `error-atproto-identity-resolve-1 Multiple DIDs resolved for method`
-- `error-atproto-identity-plc-1 HTTP request failed: https://plc.directory/did:plc:example Not Found`
-- `error-did-web-1 Invalid DID format: missing 'did:web:' prefix`
-
-## Contributing
-
-Contributions are welcome! Please ensure that:
-
-1. All tests pass: `cargo test`
-2. Code is properly formatted: `cargo fmt`
-3. No linting issues: `cargo clippy`
-4. New functionality includes appropriate tests
-
 ## License
 
-This project is licensed under the MIT License. See the LICENSE file for details.
-
-## Acknowledgments
-
-This library was extracted from the [Smokesignal](https://tangled.sh/@smokesignal.events/smokesignal) project, an open-source event and RSVP management and discovery application.
+MIT License

crates/atproto-identity/src/lib.rs

···
-//! # atproto-identity
-//!
-//! A comprehensive Rust library for AT Protocol identity management providing DID resolution,
-//! handle resolution, and identity document management across multiple DID methods.
-//!
-//! ## Core Modules
-//!
-//! - [`resolve`] - Core resolution logic for handles and DIDs with DNS/HTTP resolution
-//! - [`plc`] - PLC directory client for `did:plc` resolution
-//! - [`web`] - Web DID client for `did:web` resolution and URL conversion
-//! - [`model`] - Data structures for DID documents and AT Protocol entities
-//! - [`validation`] - Input validation for handles and DIDs
-//! - [`config`] - Configuration management and environment variable handling
-//! - [`errors`] - Structured error types following project conventions
-//! - [`key`] - Cryptographic key operations for P-256 and K-256 curves
-//! - [`storage`] - DID document storage abstraction for CRUD operations
-//! - [`storage_lru`] - LRU-based implementation of DID document storage (requires `lru` feature)
-//!
-//! ## Usage
-//!
-//! This library supports both programmatic usage and CLI tooling for identity resolution
-//! across the AT Protocol ecosystem.
+//! AT Protocol identity management library for DID resolution, handle resolution, and cryptographic key operations.
 //!
+//! Provides binaries:
+//! - `atproto-identity-resolve`: Resolve handles and DIDs to identity documents
+//! - `atproto-identity-key`: Generate and manage cryptographic keys
+//! - `atproto-identity-sign`: Sign data with private keys
+//! - `atproto-identity-validate`: Validate handles and DIDs
 
 #![warn(missing_docs)]
 

crates/atproto-jetstream/README.md

···
 # atproto-jetstream
 
-A Rust library for consuming AT Protocol Jetstream events with high-performance WebSocket streaming, flexible event handling, and optional Zstandard compression support.
+WebSocket event stream consumer library for AT Protocol Jetstream.
 
 ## Overview
 
 `atproto-jetstream` provides a comprehensive async stream consumer for AT Protocol Jetstream events. This library enables real-time consumption of AT Protocol repository events, identity changes, and account updates through WebSocket connections with support for filtering, compression, and graceful shutdown patterns.
 
-This project was extracted from the open-sourced [Smokesignal](https://tangled.sh/@smokesignal.events/smokesignal) project and is designed to be a standalone, reusable library for AT Protocol event stream consumption.
+## Binaries
+
+- **atproto-jetstream-consumer**: Real-time event stream consumer with filtering and compression support
 
 ## Features
 
-- **High-Performance WebSocket Streaming**: Async WebSocket-based event consumption with automatic reconnection
-- **Flexible Event Handler System**: Register multiple custom event handlers with unique identifiers
-- **Zstandard Compression**: Optional compression support with custom dictionaries for bandwidth optimization
-- **Event Filtering**: Filter events by collections and DIDs for targeted consumption
-- **Graceful Shutdown**: Cancellation token support for clean shutdown and resource cleanup
-- **Message Size Management**: Configurable maximum message sizes and rate limiting
-- **Cursor Support**: Resume streaming from specific points using cursor positioning
-- **Structured Error Handling**: Comprehensive error types with detailed error codes following project conventions
-- **Built-in Event Broadcasting**: Event broadcasting to multiple consumers with `tokio::sync::broadcast`
-- **Tracing Integration**: Full structured logging support for debugging and monitoring
+- High-performance WebSocket streaming with automatic reconnection
+- Flexible event handler system with multiple custom handlers
+- Zstandard compression support with custom dictionaries
+- Event filtering by collections and DIDs
+- Graceful shutdown with cancellation token support
+- Structured error handling with detailed error codes
 
 ## Usage
 
···
 ```rust
 use atproto_jetstream::{Consumer, ConsumerTaskConfig, EventHandler, JetstreamEvent, CancellationToken};
 use async_trait::async_trait;
-use anyhow::Result;
 
-// Create a custom event handler
 struct MyEventHandler;
 
 #[async_trait]
 impl EventHandler for MyEventHandler {
-    async fn handle_event(&self, event: JetstreamEvent) -> Result<()> {
+    async fn handle_event(&self, event: JetstreamEvent) -> anyhow::Result<()> {
         println!("Received event: {:?}", event);
         Ok(())
     }
···
     }
 }
 
-#[tokio::main]
-async fn main() -> Result<()> {
-    let config = ConsumerTaskConfig {
-        user_agent: "my-app/1.0".to_string(),
-        compression: false,
-        zstd_dictionary_location: String::new(),
-        jetstream_hostname: "jetstream1.us-east.bsky.network".to_string(),
-        collections: vec!["app.bsky.feed.post".to_string()],
-    };
+let config = ConsumerTaskConfig {
+    user_agent: "my-app/1.0".to_string(),
+    compression: false,
+    zstd_dictionary_location: String::new(),
+    jetstream_hostname: "jetstream1.us-east.bsky.network".to_string(),
+    collections: vec!["app.bsky.feed.post".to_string()],
+};
 
-    let consumer = Consumer::new(config);
-    let handler = std::sync::Arc::new(MyEventHandler);
-    
-    consumer.register_handler(handler).await?;
-    
-    let cancellation_token = CancellationToken::new();
-    consumer.run_background(cancellation_token).await?;
-    
-    Ok(())
-}
-```
-
-### Using Multiple Event Handlers
-
-```rust
-use atproto_jetstream::{Consumer, LoggingHandler};
-use std::sync::Arc;
-
-// Register multiple handlers
 let consumer = Consumer::new(config);
+consumer.register_handler(std::sync::Arc::new(MyEventHandler)).await?;
 
-let logging_handler = Arc::new(LoggingHandler::new("logger".to_string()));
-let custom_handler = Arc::new(MyEventHandler);
-
-consumer.register_handler(logging_handler).await?;
-consumer.register_handler(custom_handler).await?;
+let cancellation_token = CancellationToken::new();
+consumer.run_background(cancellation_token).await?;
 ```
 
-### With Compression Support
+### With Compression
 
 ```rust
 let config = ConsumerTaskConfig {
-    user_agent: "my-app/1.0".to_string(),
     compression: true,
     zstd_dictionary_location: "./data/zstd_dictionary".to_string(),
-    jetstream_hostname: "jetstream1.us-east.bsky.network".to_string(),
-    collections: vec!["app.bsky.feed.post".to_string()],
+    // ... other config
 };
 
-// Download the Zstandard dictionary first:
-// mkdir -p data/
+// Download dictionary first:
 // curl -o data/zstd_dictionary https://github.com/bluesky-social/jetstream/raw/refs/heads/main/pkg/models/zstd_dictionary
 ```
 
-## Installation
-
-Add this to your `Cargo.toml`:
-
-```toml
-[dependencies]
-atproto-jetstream = "0.1.0"
-```
-
-## Command Line Tools
-
-The crate includes a command-line tool for consuming AT Protocol Jetstream events:
-
-### `atproto-jetstream-consumer`
-
-A comprehensive command-line tool for consuming AT Protocol Jetstream events with real-time streaming, filtering capabilities, and optional compression support. This tool provides an easy way to monitor AT Protocol event streams for development, testing, and production monitoring.
-
-**Features:**
-- **Real-Time Event Streaming**: Connects to AT Protocol Jetstream instances for live event consumption
-- **Event Filtering**: Filter events by specific collections and DIDs for targeted monitoring
-- **Compression Support**: Optional Zstandard compression with dictionary support for bandwidth optimization
-- **Flexible Output**: Structured JSON output for each event with customizable logging levels
-- **Connection Management**: Automatic reconnection handling and graceful shutdown on interruption
-- **Configurable Parameters**: Extensive configuration options for hostname, collections, message sizes, and more
+## Command Line Examples
 
 ```bash
-# Basic event streaming from Jetstream
+# Basic streaming
 cargo run --bin atproto-jetstream-consumer \
     --hostname jetstream1.us-east.bsky.network \
     --collections app.bsky.feed.post \
     --user-agent "my-consumer/1.0"
 
-# Stream specific collections with filtering
-cargo run --bin atproto-jetstream-consumer \
-    --hostname jetstream1.us-east.bsky.network \
-    --collections "app.bsky.feed.post,app.bsky.actor.profile" \
-    --dids "did:plc:user123,did:plc:user456" \
-    --user-agent "filtered-consumer/1.0"
-
-# With Zstandard compression enabled
+# With compression
 cargo run --bin atproto-jetstream-consumer \
     --hostname jetstream1.us-east.bsky.network \
     --collections app.bsky.feed.post \
     --compression \
-    --zstd-dictionary ./data/zstd_dictionary \
-    --user-agent "compressed-consumer/1.0"
-
-# Advanced configuration with message size limits and cursor
-cargo run --bin atproto-jetstream-consumer \
-    --hostname jetstream1.us-east.bsky.network \
-    --collections app.bsky.feed.post \
-    --max-message-size 1048576 \
-    --cursor 1234567890 \
-    --require-hello \
-    --user-agent "advanced-consumer/1.0"
-```
-
-**Command Line Arguments:**
-- `--hostname` - Jetstream hostname to connect to (e.g., jetstream1.us-east.bsky.network)
-- `--collections` - Comma-separated list of AT Protocol collections to subscribe to
-- `--dids` - Optional comma-separated list of DIDs to filter events for
-- `--user-agent` - User-Agent string for the WebSocket connection
-- `--compression` - Enable Zstandard compression (requires zstd-dictionary)
-- `--zstd-dictionary` - Path to Zstandard dictionary file for compression
-- `--max-message-size` - Maximum message size in bytes (default: 56000)
-- `--cursor` - Optional cursor position to start streaming from
-- `--require-hello` - Require hello message before receiving events (default: true)
-
-**Setting up Compression:**
-To use compression, you need to download the Zstandard dictionary:
+    --zstd-dictionary ./data/zstd_dictionary
 
-```bash
-# Create data directory and download dictionary
-mkdir -p data/
-curl -o data/zstd_dictionary \
-  https://github.com/bluesky-social/jetstream/raw/refs/heads/main/pkg/models/zstd_dictionary
-
-# Use with compression enabled
+# With filtering
 cargo run --bin atproto-jetstream-consumer \
     --hostname jetstream1.us-east.bsky.network \
-    --collections app.bsky.feed.post \
-    --compression \
-    --zstd-dictionary ./data/zstd_dictionary
-```
-
-**Output Format:**
-The tool outputs structured JSON for each received event:
-
-```json
-{
-  "kind": "commit",
-  "time_us": 1704067200000000,
-  "did": "did:plc:user123",
-  "commit": {
-    "rev": "3l2uygzaf5c2b",
-    "operation": "create",
-    "collection": "app.bsky.feed.post",
-    "rkey": "3l2uygzaf5c2c",
-    "cid": "bafyreif5n4jf6jfczjqzckzqxdxm5qnz4jf6jfczjqzckzqxdxm5qnz4",
-    "record": {
-      "$type": "app.bsky.feed.post",
-      "text": "Hello AT Protocol!",
-      "createdAt": "2024-01-01T00:00:00Z"
-    }
-  }
-}
-```
-
-This tool is ideal for:
-- **Development and Testing**: Monitor AT Protocol events during application development
-- **Production Monitoring**: Track repository changes and user activity in real-time
-- **Data Analysis**: Collect AT Protocol events for analysis and research
-- **Integration Testing**: Verify that your applications are generating expected events
-- **System Monitoring**: Monitor the health and activity of AT Protocol networks
-
-## Event Types
-
-The library handles `JetstreamEvent` structures with the following fields:
-
-- `kind`: Event type (e.g., "commit", "identity", "account")
-- `time_us`: Event timestamp in microseconds
-- `commit`: Optional commit data for repository events
-- `identity`: Optional identity change data
-- `account`: Optional account-related data
-
-## Modules
-
-- **[`consumer`]** - Core consumer implementation with WebSocket streaming and event handling
-- **[`lib`]** - Public library interface and re-exports
-
-## Error Handling
-
-The crate uses comprehensive structured error types with unique identifiers:
-
-```
-error-atproto-jetstream-<domain>-<number> <message>: <details>
-```
-
-All errors follow the project convention:
-
-- `ConsumerError::ConnectionFailed` - WebSocket connection establishment failures
-- `ConsumerError::DecompressionFailed` - Zstandard decompression operation failures  
-- `ConsumerError::DeserializationFailed` - JSON event parsing failures
-- `ConsumerError::HandlerRegistrationFailed` - Event handler registration conflicts
-- `ConsumerError::EventSenderNotInitialized` - Event broadcasting setup errors
-- `ConsumerError::MessageConversionFailed` - WebSocket message format errors
-- `ConsumerError::UpdateSerializationFailed` - Subscription update serialization errors
-- `ConsumerError::UpdateSendFailed` - Subscription update transmission errors
-- `ConsumerError::DecompressorCreationFailed` - Zstandard decompressor initialization errors
-
-```rust
-use atproto_jetstream::consumer::ConsumerError;
-
-// Example error handling
-match consumer_result {
-    Err(ConsumerError::ConnectionFailed(details)) => {
-        println!("Failed to connect to Jetstream: {}", details);
-    }
-    Err(ConsumerError::DecompressionFailed(error)) => {
-        println!("Decompression failed: {}", error);
-    }
-    Err(ConsumerError::HandlerRegistrationFailed(error)) => {
-        println!("Handler registration failed: {}", error);
-    }
-    Ok(()) => println!("Consumer operation successful"),
-}
+    --collections "app.bsky.feed.post,app.bsky.actor.profile" \
+    --dids "did:plc:user123,did:plc:user456"
 ```
 
-## Dependencies
-
-This crate builds on:
-
-- `tokio` - Async runtime for WebSocket connections and event handling
-- `tokio-websockets` - WebSocket client implementation for Jetstream connections  
-- `tokio-util` - Additional utilities including cancellation token support
-- `futures` - Stream and sink traits for async WebSocket operations
-- `zstd` - Zstandard compression support with dictionary-based decompression
-- `serde_json` - JSON serialization and deserialization for AT Protocol events
-- `http` - HTTP types for WebSocket headers and URI parsing
-- `urlencoding` - URL encoding for query parameters in WebSocket connections
-- `async_trait` - Async trait support for event handler implementations
-- `anyhow` - Error handling utilities and result types
-- `tracing` - Structured logging for debugging and monitoring
-- `thiserror` - Structured error type derivation
-
-## AT Protocol Jetstream
-
-This library implements a client for [AT Protocol Jetstream](https://github.com/bluesky-social/jetstream), which provides:
-
-- **Real-Time Event Streaming**: Live consumption of AT Protocol repository events
-- **Efficient Compression**: Zstandard compression with custom dictionaries for bandwidth optimization
-- **Event Filtering**: Server-side filtering by collections and DIDs for targeted consumption
-- **High Performance**: WebSocket-based streaming designed for high-throughput event processing
-- **Reliability**: Built-in connection management and error recovery patterns
-
-## Contributing
-
-Contributions are welcome! Please ensure that:
-
-1. All tests pass: `cargo test`
-2. Code is properly formatted: `cargo fmt`
-3. No linting issues: `cargo clippy`
-4. New functionality includes appropriate tests and documentation
-5. Error handling follows the project's structured error format
-
 ## License
 
-This project is licensed under the MIT License. See the LICENSE file for details.
-
-## Acknowledgments
-
-This library was extracted from the [Smokesignal](https://tangled.sh/@smokesignal.events/smokesignal) project, an open-source event and RSVP management and discovery application.
+MIT License

crates/atproto-jetstream/src/lib.rs

···
-//! AT Protocol Jetstream event consumer library.
-//!
-//! Provides async stream consumption and event handling for AT Protocol Jetstream
-//! with support for WebSocket connections, event dispatching, and handler registration.
-//!
-//! ## Key Features
+//! WebSocket-based event stream consumer for AT Protocol Jetstream with Zstandard compression.
 //!
-//! - **Async Stream Consumer**: High-performance WebSocket-based event consumption
-//! - **Event Handler Registration**: Flexible event handler system with multiple handlers
-//! - **Compression Support**: Optional Zstandard compression with dictionary support
-//! - **Graceful Shutdown**: Cancellation token support for clean shutdown
-//! - **Error Handling**: Comprehensive error types following project conventions
+//! Provides binary:
+//! - `atproto-jetstream-consumer`: Consume and log Jetstream events from AT Protocol relays
 
 #![warn(missing_docs)]
 

crates/atproto-oauth-axum/README.md

···
 # atproto-oauth-axum
 
-A Rust library providing complete Axum web handlers for AT Protocol OAuth 2.0 authorization server endpoints, including client metadata, JWKS, authorization callback handling, and a comprehensive command-line OAuth login tool.
+Axum web handlers for AT Protocol OAuth 2.0 authorization server endpoints.
 
 ## Overview
 
-`atproto-oauth-axum` provides ready-to-use Axum web handlers that implement the complete AT Protocol OAuth 2.0 authorization server specification. This library handles OAuth client metadata discovery, JSON Web Key Set (JWKS) endpoints, authorization callback processing, and includes a full-featured command-line tool for OAuth login flows.
+`atproto-oauth-axum` provides ready-to-use Axum web handlers that implement the complete AT Protocol OAuth 2.0 authorization server specification. This library handles OAuth client metadata discovery, JWKS endpoints, authorization callback processing, and includes a command-line OAuth login tool.
+
+## Binaries
 
-This project was extracted from the open-sourced [Smokesignal](https://tangled.sh/@smokesignal.events/smokesignal) project and is designed to be a standalone, reusable library for AT Protocol OAuth server implementations.
+- **atproto-oauth-tool**: Complete OAuth login CLI tool for AT Protocol services
 
 ## Features
 
-- **Complete OAuth Server Handlers**: Ready-to-use Axum handlers for all required OAuth 2.0 endpoints
-- **Client Metadata Endpoint**: RFC 7591 compliant client metadata for dynamic client registration
-- **JWKS Endpoint**: JSON Web Key Set serving for JWT signature verification
-- **Authorization Callback Handler**: Complete OAuth callback processing with token exchange
-- **OAuth Login CLI Tool**: Full-featured command-line tool for testing and development OAuth flows
-- **Axum Integration**: Native Axum state management and request extractors
-- **Error Handling**: Comprehensive structured error types with proper HTTP responses
-- **AT Protocol Compliance**: Implements all AT Protocol-specific OAuth requirements
-
-## Installation
-
-Add this to your `Cargo.toml`:
-
-```toml
-[dependencies]
-atproto-oauth-axum = "0.6.0"
-```
+- Complete OAuth server handlers for Axum web applications
+- Client metadata endpoint with RFC 7591 compliance
+- JWKS endpoint for JSON Web Key Set serving
+- Authorization callback handler with token exchange
+- Native Axum state management and request extractors
+- AT Protocol compliance validation
 
 ## Usage
 
-### Basic Axum Server Setup
+### Basic Server Setup
 
 ```rust
 use atproto_oauth_axum::{
···
     state::OAuthClientConfig,
 };
 use axum::{routing::get, Router};
-use atproto_identity::key::identify_key;
 
-#[tokio::main]
-async fn main() -> anyhow::Result<()> {
-    // Set up OAuth client configuration
-    let oauth_config = OAuthClientConfig {
-        client_uri: "https://your-app.com".to_string(),
-        client_id: "https://your-app.com/oauth/client-metadata.json".to_string(),
-        redirect_uris: "https://your-app.com/oauth/callback".to_string(),
-        jwks_uri: "https://your-app.com/.well-known/jwks.json".to_string(),
-        signing_keys: vec![
-            identify_key("did:key:zQ3shNzMp4oaaQ1gQRzCxMGXFrSW3NEM1M9T6KCY9eA7HhyEA")?
-        ],
-    };
-
-    // Create Axum router with OAuth handlers
-    let app = Router::new()
-        .route("/oauth/client-metadata.json", get(handle_oauth_metadata))
-        .route("/.well-known/jwks.json", get(handle_oauth_jwks))
-        .route("/oauth/callback", get(handle_oauth_callback))
-        .with_state(oauth_config);
-
-    // Start the server
-    let listener = tokio::net::TcpListener::bind("0.0.0.0:8080").await?;
-    axum::serve(listener, app).await?;
+let oauth_config = OAuthClientConfig {
+    client_uri: "https://your-app.com".to_string(),
+    client_id: "https://your-app.com/oauth/client-metadata.json".to_string(),
+    redirect_uris: "https://your-app.com/oauth/callback".to_string(),
+    jwks_uri: "https://your-app.com/.well-known/jwks.json".to_string(),
+    signing_keys: vec![identify_key("did:key:zQ3sh...")?],
+};
 
-    Ok(())
-}
-```
-
-### OAuth Client Metadata Handler
-
-```rust
-use atproto_oauth_axum::{handler_metadata::handle_oauth_metadata, state::OAuthClientConfig};
-use axum::{routing::get, Router};
-
-// The metadata handler automatically generates RFC 7591 compliant client metadata
 let app = Router::new()
     .route("/oauth/client-metadata.json", get(handle_oauth_metadata))
-    .with_state(oauth_config);
-
-// Returns JSON like:
-// {
-//   "client_id": "https://your-app.com/oauth/client-metadata.json",
-//   "client_uri": "https://your-app.com",
-//   "dpop_bound_access_tokens": true,
-//   "application_type": "web",
-//   "redirect_uris": ["https://your-app.com/oauth/callback"],
-//   "grant_types": ["authorization_code", "refresh_token"],
-//   "response_types": ["code"],
-//   "scope": "atproto transition:generic",
-//   "token_endpoint_auth_method": "private_key_jwt",
-//   "jwks_uri": "https://your-app.com/.well-known/jwks.json"
-// }
-```
-
-### JWKS Endpoint Handler
-
-```rust
-use atproto_oauth_axum::{handle_jwks::handle_oauth_jwks, state::OAuthClientConfig};
-use axum::{routing::get, Router};
-
-// The JWKS handler automatically converts your signing keys to JWK format
-let app = Router::new()
     .route("/.well-known/jwks.json", get(handle_oauth_jwks))
+    .route("/oauth/callback", get(handle_oauth_callback))
     .with_state(oauth_config);
-
-// Returns JSON Web Key Set with your public keys for signature verification
 ```
 
-### OAuth Callback Handler
+### OAuth Handlers
 
-```rust
-use atproto_oauth_axum::{
-    handle_complete::handle_oauth_callback,
-    state::{OAuthClientConfig, HttpClient},
-};
-use atproto_identity::axum::state::{DidDocumentStorageExtractor, KeyProviderExtractor};
-use atproto_oauth::axum::state::OAuthRequestStorageExtractor;
-use axum::{routing::get, Router};
+The library provides ready-to-use handlers for:
 
-// The callback handler processes OAuth authorization callbacks
-// It automatically:
-// - Validates OAuth state parameters
-// - Exchanges authorization codes for tokens
-// - Validates DPoP proofs
-// - Returns complete OAuth response with tokens
+- **Client Metadata**: Generates RFC 7591 compliant metadata
+- **JWKS Endpoint**: Serves JSON Web Key Sets for signature verification
+- **Callback Processing**: Handles OAuth authorization callbacks with token exchange
 
-let app = Router::new()
-    .route("/oauth/callback", get(handle_oauth_callback))
-    .with_state(web_context); // Includes all required state
-```
-
-### Integration with Other Libraries
-
-```rust
-use atproto_oauth_axum::state::{OAuthClientConfig, HttpClient};
-use atproto_identity::{
-    axum::state::{DidDocumentStorageExtractor, KeyProviderExtractor},
-    storage_lru::LruDidDocumentStorage,
-    key::KeyProvider,
-};
-use atproto_oauth::{
-    axum::state::OAuthRequestStorageExtractor,
-    storage_lru::LruOAuthRequestStorage,
-};
-use std::{num::NonZeroUsize, sync::Arc};
-
-// Set up storage and state for full OAuth server
-let did_storage = Arc::new(LruDidDocumentStorage::new(NonZeroUsize::new(256).unwrap()));
-let oauth_storage = Arc::new(LruOAuthRequestStorage::new(NonZeroUsize::new(256).unwrap()));
-let key_provider = Arc::new(your_key_provider_impl);
-
-// The handlers automatically extract these from your application state
-```
-
-## Command Line Tools
-
-The crate includes a comprehensive command-line tool for OAuth operations:
-
-### `atproto-oauth-tool`
-
-A complete OAuth login CLI tool that implements the full AT Protocol OAuth client flow. This tool sets up a local web server to handle OAuth callbacks and guides users through the complete authorization process from subject resolution to token acquisition.
-
-**Features:**
-- **Subject Resolution**: Automatically resolves AT Protocol handles or DIDs to their identity documents
-- **DID Document Retrieval**: Fetches and validates DID documents from PLC directory or Web DID endpoints
-- **PDS Discovery**: Discovers Personal Data Server (PDS) endpoints from DID documents
-- **Authorization Server Discovery**: Retrieves OAuth authorization server metadata from PDS resources
-- **PKCE Implementation**: Generates secure PKCE parameters for authorization code flows
-- **DPoP Key Generation**: Creates DPoP keys for bound access tokens
-- **Local OAuth Server**: Runs temporary web server to handle authorization callbacks
-- **Complete Token Exchange**: Handles full OAuth flow from authorization to token acquisition
+## Command Line Examples
 
 ```bash
 # Start OAuth login flow for a handle
···
 
 # Start OAuth login flow for a DID
 cargo run --bin atproto-oauth-tool login did:key:zQ3sh... did:plc:user123
-
-# The tool will:
-# 1. Resolve the subject to a DID
-# 2. Fetch the DID document
-# 3. Discover the PDS endpoint
-# 4. Get OAuth authorization server configuration
-# 5. Generate PKCE and DPoP parameters
-# 6. Start a local server on http://localhost:8080
-# 7. Display the authorization URL to visit
-# 8. Handle the OAuth callback
-# 9. Exchange authorization code for tokens
-# 10. Display the complete OAuth response including access tokens and DPoP key
-
-# Example output:
-# OAuth server started on http://0.0.0.0:8080
-# 🔐 OAuth Authorization URL:
-# https://auth.bsky.social/oauth/authorize?client_id=https://localhost:8080/oauth/client-metadata.json&request_uri=urn:ietf:params:oauth:request_uri:abc123
-# 
-# Please visit this URL in your browser to complete the OAuth flow.
-# The callback will be handled at: https://localhost:8080/oauth/callback
 ```
 
-**Server Endpoints:**
-The tool automatically sets up these endpoints during the OAuth flow:
-- `GET /oauth/client-metadata.json` - OAuth client metadata
-- `GET /.well-known/jwks.json` - JSON Web Key Set
-- `GET /oauth/callback` - Authorization callback handler
-
-**Environment Variables:**
-```bash
-# Required: Your application's external base URL
-export EXTERNAL_BASE=your-app.com
-
-# Optional: Custom PLC directory
-export PLC_HOSTNAME=plc.directory
-
-# Optional: Custom DNS nameservers
-export DNS_NAMESERVERS=8.8.8.8;1.1.1.1
-
-# Optional: Custom CA certificates
-export CERTIFICATE_BUNDLES=/path/to/cert.pem
-
-# Optional: Custom User-Agent
-export USER_AGENT="my-oauth-client/1.0"
-```
-
-**Security Features:**
-- Cryptographically secure PKCE code verifier generation
-- DPoP proof-of-possession for bound access tokens
-- State parameter validation for CSRF protection
-- Automatic nonce handling for DPoP challenges
-- Private key security with no key storage
-
-## Modules
-
-- **[`handle_complete`]** - OAuth authorization callback handler with token exchange
-- **[`handler_metadata`]** - OAuth client metadata endpoint (RFC 7591)
-- **[`handle_jwks`]** - JSON Web Key Set endpoint for signature verification
-- **[`handle_init`]** - OAuth authorization initiation (reserved for future use)
-- **[`state`]** - Axum state management and request extractors
-- **[`errors`]** - Structured error types for OAuth operations
-
-## Error Handling
-
-The crate uses comprehensive structured error types:
-
-```rust
-use atproto_oauth_axum::errors::{OAuthCallbackError, OAuthLoginError};
-
-// OAuth callback handler errors
-match callback_result {
-    Err(OAuthCallbackError::NoOAuthRequestFound) => {
-        println!("OAuth state not found - possible CSRF attack");
-    },
-    Err(OAuthCallbackError::InvalidIssuer { expected, actual }) => {
-        println!("Issuer mismatch: expected {}, got {}", expected, actual);
-    },
-    Err(OAuthCallbackError::NoDIDDocumentFound) => {
-        println!("DID document not found for OAuth request");
-    },
-    Ok(response) => println!("OAuth callback successful"),
-}
-
-// OAuth login CLI errors
-match login_result {
-    Err(OAuthLoginError::SubjectResolutionFailed { error }) => {
-        println!("Failed to resolve subject: {}", error);
-    },
-    Err(OAuthLoginError::NoPDSEndpointFound) => {
-        println!("No PDS endpoint found in DID document");
-    },
-    Err(OAuthLoginError::OAuthInitFailed { error }) => {
-        println!("OAuth initialization failed: {}", error);
-    },
-    Ok(()) => println!("OAuth login completed successfully"),
-}
-```
-
-### Error Format
-
-All errors follow the standardized format:
-
-```
-error-atproto-oauth-axum-<domain>-<number> <message>: <details>
-```
-
-Example error codes:
-- `error-atproto-oauth-axum-callback-1` through `error-atproto-oauth-axum-callback-7` - OAuth callback errors
-- `error-atproto-oauth-axum-login-1` through `error-atproto-oauth-axum-login-11` - OAuth login CLI errors
-
-## AT Protocol Compliance
-
-This library implements all AT Protocol OAuth requirements:
-
-### OAuth Server Requirements
-- Support for `authorization_code` and `refresh_token` grant types
-- PKCE with `S256` code challenge method
-- DPoP bound access tokens
-- `private_key_jwt` token endpoint authentication
-- `ES256` signing algorithm support
-- Required OAuth scopes (`atproto`, `transition:generic`)
-
-### Client Requirements
-- Dynamic client registration metadata
-- JWKS endpoint for public key discovery
-- Proper redirect URI validation
-- State parameter CSRF protection
-
-## Dependencies
-
-This crate builds on:
-
-- [`atproto-identity`](../atproto-identity) - Identity resolution and cryptographic operations
-- [`atproto-oauth`](../atproto-oauth) - Core OAuth 2.0 operations and security extensions
-- `axum` - Web framework for HTTP handlers
-- `reqwest` - HTTP client for OAuth server communication
-- `tokio` - Async runtime for web server operations
-- `serde_json` - JSON serialization for OAuth responses
-- `chrono` - Date and time handling for OAuth flows
-- `anyhow` - Error handling utilities
-- `thiserror` - Structured error type derivation
-
-## Development and Testing
-
-This crate is ideal for:
-
-- **OAuth Server Development**: Complete Axum handlers for AT Protocol OAuth servers
-- **OAuth Client Testing**: CLI tool for testing OAuth flows against AT Protocol services
-- **Integration Testing**: Ready-to-use handlers for OAuth endpoint testing
-- **Development Workflows**: Local OAuth server for development and debugging
-
-## Contributing
-
-Contributions are welcome! Please ensure that:
-
-1. All tests pass: `cargo test`
-2. Code is properly formatted: `cargo fmt`
-3. No linting issues: `cargo clippy`
-4. New functionality includes appropriate tests and documentation
-5. Error handling follows the project's structured error format
+The tool provides a complete OAuth client implementation with:
+- Subject resolution and DID document retrieval
+- PDS and authorization server discovery
+- PKCE and DPoP parameter generation
+- Local web server for callback handling
+- Complete token exchange flow
 
 ## License
 
-This project is licensed under the MIT License. See the LICENSE file for details.
-
-## Acknowledgments
-
-This library was extracted from the [Smokesignal](https://tangled.sh/@smokesignal.events/smokesignal) project, an open-source event and RSVP management and discovery application.
+MIT License

crates/atproto-oauth-axum/src/lib.rs

···
-//! Axum web framework integration for AT Protocol OAuth workflows.
-//!
-//! This crate provides complete Axum web handlers and request extractors for implementing
-//! AT Protocol OAuth 2.0 client endpoints. It includes RFC-compliant client metadata serving,
-//! JWKS public key distribution, and OAuth authorization callback handling.
-//!
-//! ## Features
-//!
-//! - **OAuth Client Metadata**: RFC 7591 compliant client metadata endpoint
-//! - **JWKS Endpoint**: JSON Web Key Set serving for signature verification
-//! - **Authorization Callbacks**: Complete OAuth authorization code flow handling
-//! - **DPoP Support**: Demonstration of Proof-of-Possession token binding
-//! - **Request Extractors**: Axum state management for OAuth configuration
-//! - **Error Handling**: Structured error types for OAuth workflows
-//!
-//! ## OAuth Endpoints
-//!
-//! The crate provides handlers for standard OAuth 2.0 endpoints:
-//!
-//! - `/oauth/client-metadata.json` - OAuth client metadata (RFC 7591)
-//! - `/.well-known/jwks.json` - JSON Web Key Set for public keys
-//! - `/oauth/callback` - OAuth authorization callback handler
-//!
-//! ## CLI Tool
-//!
-//! The `atproto-oauth-tool` binary provides a complete OAuth client implementation:
-//!
-//! ```bash
-//! # Start OAuth login flow
-//! atproto-oauth-tool login <private_signing_key> <subject>
-//!
-//! # Refresh OAuth tokens
-//! atproto-oauth-tool refresh <private_signing_key> <subject> <private_dpop_key> <refresh_token>
-//! ```
-//!
-//! ## Example Integration
-//!
-//! ```rust,no_run
-//! use axum::{routing::get, Router};
-//! use atproto_oauth_axum::{
-//!     handle_jwks::handle_oauth_jwks,
-//!     handler_metadata::handle_oauth_metadata,
-//!     state::OAuthClientConfig,
-//! };
-//!
-//! # async fn example() -> Result<(), Box<dyn std::error::Error>> {
-//! let router = Router::new()
-//!     .route("/oauth/client-metadata.json", get(handle_oauth_metadata))
-//!     .route("/.well-known/jwks.json", get(handle_oauth_jwks));
-//!     // Note: handle_oauth_callback requires additional state extractors
-//!     // .route("/oauth/callback", get(handle_oauth_callback))
-//!     // .with_state(oauth_config);
-//! # Ok(())
-//! # }
-//! ```
-//!
-//! ## Dependencies
+//! Axum web handlers for AT Protocol OAuth 2.0 client endpoints with DPoP support.
 //!
-//! This crate integrates with:
-//! - [`atproto-oauth`]: Core OAuth workflow logic and PKCE implementation
-//! - [`atproto-identity`]: AT Protocol identity resolution and key management
-//! - [`axum`]: Web framework for HTTP request handling
+//! Provides binary:
+//! - `atproto-oauth-tool`: OAuth client for login and token refresh operations
 
 #![warn(missing_docs)]
 

crates/atproto-oauth/README.md

···
 # atproto-oauth
 
-A Rust library for AT Protocol OAuth 2.0 operations, providing comprehensive support for OAuth security extensions, JWT operations, and AT Protocol-specific OAuth flows.
+OAuth 2.0 implementation library for AT Protocol with security extensions.
 
 ## Overview
 
-`atproto-oauth` provides OAuth 2.0 functionality specifically designed for the AT Protocol ecosystem. This library implements the security extensions and cryptographic operations required for secure OAuth flows in AT Protocol applications, including support for DPoP (Demonstration of Proof-of-Possession), PKCE (Proof Key for Code Exchange), and AT Protocol-specific OAuth resource validation.
-
-This project was extracted from the open-sourced [Smokesignal](https://tangled.sh/@smokesignal.events/smokesignal) project and is designed to be a standalone, reusable library for AT Protocol OAuth operations.
+`atproto-oauth` provides OAuth 2.0 functionality specifically designed for the AT Protocol ecosystem. This library implements DPoP (Demonstration of Proof-of-Possession), PKCE (Proof Key for Code Exchange), JWT operations, and AT Protocol-specific OAuth validation.
 
 ## Features
 
-- **JWT Operations**: Complete JSON Web Token minting, verification, and validation with ES256/ES256K support
-- **JWK Management**: JSON Web Key generation, conversion, and management for P-256 and K-256 curves
-- **PKCE Implementation**: RFC 7636 Proof Key for Code Exchange for secure OAuth flows
-- **DPoP Support**: RFC 9449 Demonstration of Proof-of-Possession with automatic retry middleware
-- **OAuth Resource Discovery**: RFC 8414 OAuth 2.0 authorization server and protected resource metadata discovery
-- **AT Protocol Validation**: Comprehensive validation of OAuth servers against AT Protocol requirements
-- **Structured Error Handling**: Type-safe error handling with detailed error codes and messages
-- **Cryptographic Integration**: Seamless integration with `atproto-identity` for key operations
-
-## Supported OAuth Extensions
-
-- **PKCE (RFC 7636)**: Proof Key for Code Exchange with S256 code challenge method
-- **DPoP (RFC 9449)**: Demonstration of Proof-of-Possession with ES256 signing algorithm
-- **OAuth 2.0 Resource Discovery (RFC 8414)**: Authorization server and protected resource metadata
-- **JWT Bearer Tokens (RFC 7523)**: Private key JWT authentication for token endpoints
-
-## Installation
-
-Add this to your `Cargo.toml`:
-
-```toml
-[dependencies]
-atproto-oauth = "0.6.0"
-```
+- JWT minting, verification, and validation with ES256/ES256K support
+- JWK generation and management for P-256 and K-256 curves
+- PKCE implementation for secure OAuth flows
+- DPoP support with automatic retry middleware
+- OAuth resource discovery and AT Protocol validation
+- Structured error handling with detailed error codes
 
 ## Usage
 
···
 use atproto_oauth::jwt::{mint, verify, Header, Claims, JoseClaims};
 use atproto_identity::key::identify_key;
 
-#[tokio::main]
-async fn main() -> anyhow::Result<()> {
-    // Parse a private key
-    let key_data = identify_key("did:key:zQ3shNzMp4oaaQ1gQRzCxMGXFrSW3NEM1M9T6KCY9eA7HhyEA")?;
-    
-    // Create JWT header
-    let header = Header {
-        algorithm: Some("ES256".to_string()),
-        type_: Some("JWT".to_string()),
-        ..Default::default()
-    };
-    
-    // Create JWT claims
-    let claims = Claims::new(JoseClaims {
-        issuer: Some("did:plc:issuer123".to_string()),
-        subject: Some("did:plc:subject456".to_string()),
-        audience: Some("https://pds.example.com".to_string()),
-        expiration: Some(chrono::Utc::now().timestamp() as u64 + 3600),
-        ..Default::default()
-    });
-    
-    // Mint JWT
-    let token = mint(&key_data, &header, &claims)?;
-    println!("JWT: {}", token);
-    
-    // Verify JWT
-    verify(&key_data, &token).await?;
-    println!("JWT verified successfully!");
-    
-    Ok(())
-}
-```
-
-### PKCE Implementation
-
-```rust
-use atproto_oauth::pkce;
-
-fn main() {
-    // Generate PKCE parameters for authorization flow
-    let (code_verifier, code_challenge) = pkce::generate();
-    
-    println!("Code Challenge: {}", code_challenge);
-    println!("Code Verifier: {}", code_verifier);
-    
-    // Use code_challenge in authorization URL
-    let auth_url = format!(
-        "https://auth.example.com/oauth/authorize?code_challenge={}&code_challenge_method=S256",
-        code_challenge
-    );
-    
-    // Later, use code_verifier when exchanging authorization code for tokens
-    // (This would be in your token exchange request)
-}
-```
-
-### DPoP Proof Generation
-
-```rust
-use atproto_oauth::dpop::{auth_dpop, request_dpop};
-use atproto_identity::key::identify_key;
-
-#[tokio::main]
-async fn main() -> anyhow::Result<()> {
-    let key_data = identify_key("did:key:zQ3shNzMp4oaaQ1gQRzCxMGXFrSW3NEM1M9T6KCY9eA7HhyEA")?;
-    
-    // Create DPoP proof for authorization request
-    let (dpop_token, header, claims) = auth_dpop(
-        &key_data,
-        "POST",
-        "https://auth.example.com/oauth/token"
-    )?;
-    
-    println!("DPoP Authorization Proof: {}", dpop_token);
-    
-    // Create DPoP proof for resource request
-    let (resource_token, _, _) = request_dpop(
-        &key_data,
-        "GET",
-        "https://pds.example.com/api/resource",
-        "did:plc:issuer123",
-        "access_token_here"
-    )?;
-    
-    println!("DPoP Resource Proof: {}", resource_token);
-    
-    Ok(())
-}
-```
+let key_data = identify_key("did:key:zQ3sh...")?;
 
-### OAuth Resource Discovery and Validation
+let header = Header {
+    algorithm: Some("ES256".to_string()),
+    type_: Some("JWT".to_string()),
+    ..Default::default()
+};
 
-```rust
-use atproto_oauth::resources::{discover_protected_resource, discover_authorization_server, validate};
-use reqwest::Client;
+let claims = Claims::new(JoseClaims {
+    issuer: Some("did:plc:issuer123".to_string()),
+    subject: Some("did:plc:subject456".to_string()),
+    audience: Some("https://pds.example.com".to_string()),
+    expiration: Some(chrono::Utc::now().timestamp() as u64 + 3600),
+    ..Default::default()
+});
 
-#[tokio::main]
-async fn main() -> anyhow::Result<()> {
-    let client = Client::new();
-    let pds_url = "https://pds.example.com";
-    
-    // Discover OAuth protected resource configuration
-    let protected_resource = discover_protected_resource(&client, pds_url).await?;
-    println!("Resource: {}", protected_resource.resource);
-    
-    // Discover authorization server configuration
-    let auth_server_url = &protected_resource.authorization_servers[0];
-    let auth_server = discover_authorization_server(&client, auth_server_url).await?;
-    
-    // Validate AT Protocol requirements
-    validate::protected_resource(&protected_resource, pds_url)?;
-    validate::authorization_server(&auth_server, pds_url)?;
-    
-    println!("OAuth configuration validated for AT Protocol compliance!");
-    
-    Ok(())
-}
+let token = mint(&key_data, &header, &claims)?;
+verify(&key_data, &token).await?;
 ```
 
-### JWK Generation
+### PKCE Flow
 
 ```rust
-use atproto_oauth::jwk::{generate, WrappedJsonWebKeySet};
-use atproto_identity::key::identify_key;
+use atproto_oauth::pkce;
 
-fn main() -> anyhow::Result<()> {
-    let key_data = identify_key("did:key:zQ3shNzMp4oaaQ1gQRzCxMGXFrSW3NEM1M9T6KCY9eA7HhyEA")?;
-    
-    // Generate JWK from key data
-    let jwk = generate(&key_data)?;
-    println!("JWK Algorithm: {:?}", jwk.alg);
-    println!("JWK Key ID: {:?}", jwk.kid);
-    
-    // Create JWK Set
-    let jwk_set = WrappedJsonWebKeySet {
-        keys: vec![jwk],
-    };
-    
-    let jwk_json = serde_json::to_string_pretty(&jwk_set)?;
-    println!("JWK Set: {}", jwk_json);
-    
-    Ok(())
-}
+let (code_verifier, code_challenge) = pkce::generate();
+// Use code_challenge in authorization URL
+// Later use code_verifier for token exchange
 ```
 
-### DPoP Retry Middleware
+### DPoP Proofs
 
 ```rust
-use atproto_oauth::dpop::{DpopRetry, auth_dpop};
-use reqwest_middleware::ClientBuilder;
-use reqwest_chain::ChainableClient;
-use atproto_identity::key::identify_key;
-
-#[tokio::main]
-async fn main() -> anyhow::Result<()> {
-    let key_data = identify_key("did:key:zQ3shNzMp4oaaQ1gQRzCxMGXFrSW3NEM1M9T6KCY9eA7HhyEA")?;
-    
-    // Create DPoP proof components
-    let (_, header, claims) = auth_dpop(&key_data, "POST", "https://auth.example.com/oauth/token")?;
-    
-    // Create HTTP client with DPoP retry middleware
-    let retry_middleware = DpopRetry::new(header, claims, key_data);
-    let client = ClientBuilder::new(reqwest::Client::new())
-        .with_chainer(retry_middleware)
-        .build();
-    
-    // The client will automatically retry requests with DPoP nonce if needed
-    let response = client
-        .post("https://auth.example.com/oauth/token")
-        .send()
-        .await?;
-    
-    println!("Response status: {}", response.status());
-    
-    Ok(())
-}
-```
-
-## Modules
-
-- **[`jwt`]** - JSON Web Token minting, verification, and validation
-- **[`jwk`]** - JSON Web Key generation and management  
-- **[`pkce`]** - PKCE (Proof Key for Code Exchange) implementation
-- **[`dpop`]** - DPoP (Demonstration of Proof-of-Possession) implementation
-- **[`resources`]** - OAuth 2.0 resource discovery and AT Protocol validation
-- **[`encoding`]** - Base64 encoding and decoding utilities
-- **[`errors`]** - Structured error types for all OAuth operations
-
-## AT Protocol Requirements
-
-This library validates OAuth servers against AT Protocol requirements:
-
-### Authorization Server Requirements
-
-- Must support `authorization_code` and `refresh_token` grant types
-- Must support `S256` PKCE code challenge method
-- Must support `none` and `private_key_jwt` token endpoint authentication
-- Must support `ES256` algorithm for token endpoint authentication
-- Must support `atproto` and `transition:generic` scopes
-- Must support `ES256` algorithm for DPoP signing
-- Must support authorization response parameters, pushed requests, and client ID metadata
+use atproto_oauth::dpop::{auth_dpop, request_dpop};
 
-### Protected Resource Requirements
-
-- Resource URI must match the PDS base URL
-- Must specify exactly one authorization server
-- Authorization server must be properly configured for AT Protocol
-
-## Error Handling
-
-All errors follow a structured format with unique identifiers:
-
-```
-error-atproto-oauth-<domain>-<number> <message>: <details>
+let (dpop_token, header, claims) = auth_dpop(
+    &key_data,
+    "POST",
+    "https://auth.example.com/oauth/token"
+)?;
 ```
 
-Example error categories:
-
-- `error-atproto-oauth-jwt-1` through `error-atproto-oauth-jwt-9` - JWT validation errors
-- `error-atproto-oauth-client-1` through `error-atproto-oauth-client-12` - OAuth client errors  
-- `error-atproto-oauth-dpop-1` through `error-atproto-oauth-dpop-5` - DPoP operation errors
-- `error-atproto-oauth-resource-1` through `error-atproto-oauth-resource-3` - Resource validation errors
-- `error-atproto-oauth-auth-server-1` through `error-atproto-oauth-auth-server-12` - Authorization server validation errors
+### OAuth Discovery
 
 ```rust
-use atproto_oauth::errors::{JWTError, DpopError, OAuthClientError};
+use atproto_oauth::resources::{discover_protected_resource, discover_authorization_server};
 
-// Example error handling
-match result {
-    Err(JWTError::TokenExpired) => println!("JWT has expired"),
-    Err(JWTError::SignatureVerificationFailed) => println!("Invalid JWT signature"),
-    Err(DpopError::MissingDpopNonceHeader) => println!("Server didn't provide DPoP nonce"),
-    Err(OAuthClientError::InvalidAuthorizationServerResponse(e)) => {
-        println!("Authorization server error: {}", e);
-    }
-    Ok(result) => println!("Success: {:?}", result),
-}
+let protected_resource = discover_protected_resource(&client, pds_url).await?;
+let auth_server = discover_authorization_server(&client, auth_server_url).await?;
 ```
 
-## Dependencies
-
-This crate builds on:
-
-- [`atproto-identity`](../atproto-identity) - Cryptographic key operations and DID resolution
-- `reqwest` - HTTP client for OAuth server communication
-- `serde_json` - JSON serialization for OAuth messages and JWT claims
-- `chrono` - Date and time handling for JWT timestamps
-- `base64` - Base64 encoding for JWT and DPoP operations
-- `p256` / `k256` - Elliptic curve cryptography for ES256/ES256K signatures
-- `ulid` - Unique identifier generation for JWT IDs and key IDs
-- `thiserror` - Structured error type derivation
-
-## Security Considerations
-
-- Always validate OAuth server configurations against AT Protocol requirements
-- Use PKCE for all authorization code flows to prevent authorization code interception
-- Implement DPoP for token requests to bind tokens to specific clients
-- Verify JWT signatures and expiration times before accepting tokens
-- Use cryptographically secure random number generation for PKCE code verifiers
-- Follow RFC specifications for JWT, PKCE, and DPoP implementations
-
-## Library Only
-
-This crate is designed as a library and does not provide command line tools. All functionality is accessed programmatically through the Rust API. For command line operations, see the [`atproto-identity`](../atproto-identity) and [`atproto-record`](../atproto-record) crates which include CLI tools for identity resolution and record signing operations.
-
-## Contributing
-
-Contributions are welcome! Please ensure that:
-
-1. All tests pass: `cargo test`
-2. Code is properly formatted: `cargo fmt`  
-3. No linting issues: `cargo clippy`
-4. New functionality includes appropriate tests and documentation
-5. Error handling follows the project's structured error format
-
 ## License
 
-This project is licensed under the MIT License. See the LICENSE file for details.
-
-## Acknowledgments
-
-This library was extracted from the [Smokesignal](https://tangled.sh/@smokesignal.events/smokesignal) project, an open-source event and RSVP management and discovery application.
+MIT License

crates/atproto-oauth/src/lib.rs

···
-//! AT Protocol OAuth library providing comprehensive OAuth 2.0 functionality.
-//!
-//! This crate implements OAuth 2.0 security extensions and utilities specifically designed for
-//! AT Protocol, including JWT/JWK operations, DPoP proof generation, PKCE implementation,
-//! and OAuth resource discovery with AT Protocol-specific validation requirements.
+//! OAuth 2.0 implementation for AT Protocol with DPoP support, PKCE, and JWT operations.
 
 #![warn(missing_docs)]
 

crates/atproto-record/README.md

···
 # atproto-record
 
-A Rust library for AT Protocol record signature operations, providing cryptographic signing and verification capabilities for AT Protocol records.
+Record signature operations library for AT Protocol.
 
 ## Overview
 
-This crate provides functionality for:
+`atproto-record` provides cryptographic signing and verification capabilities for AT Protocol records. This library handles signature creation, verification, and IPLD DAG-CBOR serialization for consistent record signing.
 
-- **Record Signing**: Create cryptographic signatures for AT Protocol records
-- **Signature Verification**: Verify existing signatures against records and public keys
-- **Error Handling**: Structured error types for signature operations
-- **Multi-curve Support**: Support for P-256 and K-256 elliptic curves via `atproto-identity`
+## Binaries
 
-## Features
-
-- Create signatures for AT Protocol records with proper `$sig` object handling
-- Required signature object validation (must include `issuer` and `issued_at` fields)
-- Verify record signatures against issuer public keys
-- IPLD DAG-CBOR serialization for consistent signature generation
-- Multibase encoding for signature representation
-- Integration with `atproto-identity` for cryptographic key operations
-- Repository and collection context support in signature objects
-- Comprehensive error handling with structured error types including creation and verification errors
+- **atproto-record-sign**: Creates cryptographic signatures for JSON records
+- **atproto-record-verify**: Verifies signatures against public keys
 
 ## Usage
 
···
 
 ```rust
 use atproto_record::signature;
-use atproto_identity::key::{identify_key, KeyType};
+use atproto_identity::key::identify_key;
 use serde_json::json;
-use atproto_record::errors::VerificationError;
 
-# async fn example() -> Result<(), VerificationError> {
-// Prepare key data
-let key_data = identify_key("did:key:example...").map_err(|e| {
-    VerificationError::KeyOperationFailed(e)
-})?;
+let key_data = identify_key("did:key:zQ3sh...")?;
+let record = json!({"$type": "app.bsky.feed.post", "text": "Hello!"});
+let signature_object = json!({"issuer": "did:plc:issuer", "issued_at": "2024-01-01T00:00:00Z"});
 
-// Create a record to sign
-let record = json!({
-    "$type": "app.bsky.feed.post",
-    "text": "Hello AT Protocol!",
-    "createdAt": "2024-01-01T00:00:00Z"
-});
-
-// Create signature object with required fields
-let signature_object = json!({
-    "issuer": "did:plc:signer123",
-    "issued_at": "2024-01-01T00:00:00Z"
-});
-
-// Create signature
 let signed_record = signature::create(
     &key_data,
     &record,
-    "did:plc:user123",
+    "did:plc:repo",
     "app.bsky.feed.post",
     signature_object
 ).await?;
-# Ok(())
-# }
 ```
 
 ### Verifying Signatures
 
 ```rust
-use atproto_record::signature;
-use atproto_identity::key::identify_key;
-use atproto_record::errors::VerificationError;
+let issuer_key = identify_key("did:key:zQ3sh...")?;
 
-# async fn example() -> Result<(), VerificationError> {
-// Get the issuer's public key
-let issuer_key = identify_key("did:key:issuer...").map_err(|e| {
-    VerificationError::KeyOperationFailed(e)
-})?;
-
-// Verify the signature
 signature::verify(
-    "did:plc:issuer123",
+    "did:plc:issuer",
     &issuer_key,
     signed_record,
-    "did:plc:user123",
+    "did:plc:repo",
     "app.bsky.feed.post"
 ).await?;
-# Ok(())
-# }
 ```
 
-## Command Line Tools
-
-The crate includes two command-line tools for AT Protocol record signature operations:
-
-### `atproto-record-sign`
-
-Creates cryptographic signatures for AT Protocol records with proper `$sig` object handling and embedded signature metadata. This tool reads JSON records, applies cryptographic signatures using DID keys, and outputs signed records ready for AT Protocol repository storage.
-
-**Features:**
-- **Flexible Input**: Reads records from files or stdin
-- **DID Key Support**: Works with both P-256 and K-256 cryptographic keys
-- **Signature Object Creation**: Automatically creates required signature metadata with issuer and timestamp
-- **Repository Context**: Includes repository and collection context in signatures
-- **IPLD Serialization**: Uses DAG-CBOR serialization for consistent signature generation
-- **Multibase Encoding**: Outputs signatures in multibase format for AT Protocol compatibility
-
-```bash
-# Sign a record from a file with all required parameters
-cargo run --bin atproto-record-sign did:key:zQ3sh... did:plc:issuer123 record.json repository=did:plc:user123 collection=app.bsky.feed.post
-
-# Sign a record from stdin
-echo '{"$type":"app.bsky.feed.post","text":"Hello AT Protocol!"}' | \
-  cargo run --bin atproto-record-sign did:key:zQ3sh... did:plc:issuer123 -- \
-  repository=did:plc:user123 collection=app.bsky.feed.post
-
-# Example output: JSON record with embedded signatures array
-```
-
-**Arguments:**
-- `<signing_key>` - DID key string for signing (did:key:...)
-- `<issuer_did>` - DID of the signing entity
-- `<record_file>` - JSON file containing the record (optional, uses stdin if omitted)
-- `repository=<did>` - Repository DID where record will be stored
-- `collection=<nsid>` - Collection NSID (e.g., app.bsky.feed.post)
-
-### `atproto-record-verify`
-
-Verifies cryptographic signatures of AT Protocol records using embedded signature metadata. This tool validates that signed records contain authentic signatures from specified issuers, ensuring record integrity and authenticity.
-
-**Features:**
-- **Signature Validation**: Verifies embedded signatures against public keys
-- **Issuer Authentication**: Confirms signatures are from specified DID issuers
-- **Context Verification**: Validates repository and collection context in signatures
-- **Multi-Signature Support**: Handles records with multiple signatures
-- **IPLD Deserialization**: Uses DAG-CBOR for signature verification consistency
-- **Detailed Error Reporting**: Provides specific feedback on verification failures
+## Command Line Examples
 
 ```bash
-# Verify a signed record from a file
-cargo run --bin atproto-record-verify did:plc:issuer123 did:key:zQ3sh... signed_record.json \
-  repository=did:plc:user123 collection=app.bsky.feed.post
-
-# Verify a signed record from stdin
-echo '{"signatures":[{"issuer":"did:plc:issuer123","signature":"u..."}],"$type":"app.bsky.feed.post","text":"Hello"}' | \
-  cargo run --bin atproto-record-verify did:plc:issuer123 did:key:zQ3sh... -- \
-  repository=did:plc:user123 collection=app.bsky.feed.post
+# Sign a record
+cargo run --bin atproto-record-sign did:key:zQ3sh... did:plc:issuer record.json \
+  repository=did:plc:repo collection=app.bsky.feed.post
 
-# Successful verification returns exit code 0
-# Failed verification returns exit code 1 with error details
+# Verify a signature
+cargo run --bin atproto-record-verify did:plc:issuer did:key:zQ3sh... signed.json \
+  repository=did:plc:repo collection=app.bsky.feed.post
 ```
 
-**Arguments:**
-- `<issuer_did>` - DID of the expected signature issuer
-- `<public_key>` - DID key string for verification (did:key:...)
-- `<record_file>` - JSON file containing the signed record (optional, uses stdin if omitted)
-- `repository=<did>` - Repository DID context for verification
-- `collection=<nsid>` - Collection NSID context for verification
-
-**Exit Codes:**
-- `0` - Signature verification successful
-- `1` - Signature verification failed or invalid arguments
-- `2` - File I/O or parsing errors
-
-## Modules
-
-- [`signature`] - Core signature creation and verification functions
-- [`errors`] - Structured error types for signature operations
-
-## Error Handling
-
-The crate uses structured error types defined in the `errors` module:
-
-```rust
-use atproto_record::errors::VerificationError;
-use serde_json::json;
-
-// Example error handling for signature creation
-let signature_object = json!({ "missing": "required_fields" });
-
-match signature::create(&key_data, &record, "repo", "collection", signature_object).await {
-    Ok(signed_record) => println!("Signature created successfully!"),
-    Err(VerificationError::SignatureObjectMissingField { field }) => {
-        println!("Missing required field in signature object: {}", field);
-    }
-    Err(VerificationError::InvalidSignatureObjectType) => {
-        println!("Signature object must be a JSON object");
-    }
-    Err(VerificationError::KeyOperationFailed(e)) => {
-        println!("Cryptographic operation failed: {}", e);
-    }
-    Err(e) => println!("Other error: {}", e),
-}
-
-// Example error handling for signature verification
-match signature::verify("did:plc:issuer", &key_data, record, "repo", "collection").await {
-    Ok(()) => println!("Signature valid!"),
-    Err(VerificationError::NoValidSignatureForIssuer { issuer }) => {
-        println!("No valid signature found for issuer: {}", issuer);
-    }
-    Err(VerificationError::NoSignaturesField) => {
-        println!("Record contains no signatures field");
-    }
-    Err(e) => println!("Verification failed: {}", e),
-}
-```
-
-## Dependencies
-
-This crate builds on:
-
-- [`atproto-identity`](../atproto-identity) - Cryptographic key operations and DID resolution
-- `serde_ipld_dagcbor` - IPLD DAG-CBOR serialization for signature content
-- `multibase` - Base encoding for signature representation
-- `serde_json` - JSON handling for AT Protocol records
-- `anyhow` - Error handling utilities
-- `thiserror` - Structured error type derivation
-
 ## License
 
-Licensed under the MIT License.
+MIT License

crates/atproto-record/src/lib.rs

···
-//! # atproto-record
-//!
-//! A Rust library for AT Protocol record signature operations, providing cryptographic
-//! signing and verification capabilities for AT Protocol records.
-//!
-//! This crate handles the cryptographic aspects of AT Protocol record attestation,
-//! including signature creation and verification with proper `$sig` object handling
-//! and IPLD DAG-CBOR serialization.
-//!
-//! ## Core Modules
-//!
-//! - [`signature`] - Core signature creation and verification functions
-//! - [`errors`] - Structured error types for signature verification operations
-//!
-//! ## Key Features
+//! Cryptographic signature operations for AT Protocol records with IPLD DAG-CBOR serialization.
 //!
-//! - **Record Signing**: Create cryptographic signatures for AT Protocol records
-//! - **Signature Verification**: Verify existing signatures against records and public keys
-//! - **Multi-curve Support**: Support for P-256 and K-256 elliptic curves via `atproto-identity`
-//! - **IPLD Integration**: Proper IPLD DAG-CBOR serialization for signature content
-//! - **Error Handling**: Comprehensive structured error types following project conventions
-//!
-//! ## Usage Examples
-//!
-//! ### Creating a Signature
-//!
-//! ```rust
-//! use atproto_record::signature;
-//! use atproto_record::errors::VerificationError;
-//! use serde_json::json;
-//! use atproto_identity::key::{KeyData, KeyType};
-//! async fn example() -> Result<(), VerificationError> {
-//!   let key_data = KeyData::new(KeyType::P256Public, vec![]);
-//!
-//!   let record = json!({
-//!     "$type": "app.bsky.feed.post",
-//!     "text": "Hello AT Protocol!"
-//!   });
-//!
-//!   // Create signature object with required fields
-//!   let signature_object = json!({
-//!     "issuer": "did:plc:signer123",
-//!     "issued_at": "2024-01-01T00:00:00Z"
-//!   });
-//!
-//!   let signed_record = signature::create(
-//!     &key_data,
-//!     &record,
-//!     "did:plc:user123",
-//!     "app.bsky.feed.post",
-//!     signature_object
-//!   ).await?;
-//!   Ok(())
-//! }
-//! ```
-//!
-//! ### Verifying a Signature
-//!
-//! ```rust
-//! use atproto_record::signature;
-//! use atproto_record::errors::VerificationError;
-//! use atproto_identity::key::{KeyData, KeyType};
-//! use serde_json::json;
-//! async fn example() -> Result<(), VerificationError> {
-//!   let issuer_key = KeyData::new(KeyType::P256Public, vec![]);
-//!   let signed_record = json!({
-//!     "signatures": [{
-//!       "issuer": "did:plc:issuer123",
-//!       "signature": "uExample_signature_data"
-//!     }]
-//!   });
-//!
-//!   signature::verify(
-//!     "did:plc:issuer123",
-//!     &issuer_key,
-//!     signed_record,
-//!     "did:plc:user123",
-//!     "app.bsky.feed.post"
-//!   ).await?;
-//!   Ok(())
-//! }
-//! ```
-//!
-//! ## Error Handling
-//!
-//! All signature operations return structured errors defined in the [`errors`] module:
-//!
-//! ```rust
-//! use atproto_record::errors::VerificationError;
-//! use atproto_record::signature::create;
-//! use serde_json::json;
-//!
-//! // Example: handling signature creation errors
-//! async fn example() -> Result<(), Box<dyn std::error::Error>> {
-//!   let key_data = atproto_identity::key::KeyData::new(atproto_identity::key::KeyType::P256Public, vec![]);
-//!   let record = json!({});
-//!   let invalid_signature_object = json!({ "missing": "required_fields" });
-//!
-//!   match create(&key_data, &record, "repo", "collection", invalid_signature_object).await {
-//!     Ok(_) => println!("Signature created successfully!"),
-//!     Err(VerificationError::SignatureObjectMissingField { field }) => {
-//!         println!("Missing required field: {}", field);
-//!     }
-//!     Err(VerificationError::InvalidSignatureObjectType) => {
-//!         println!("Signature object must be a JSON object");
-//!     }
-//!     Err(VerificationError::KeyOperationFailed { .. }) => {
-//!         println!("Cryptographic operation failed");
-//!     }
-//!     Err(e) => println!("Other error: {}", e),
-//!   }
-//!   Ok(())
-//! }
-//! ```
+//! Provides binaries:
+//! - `atproto-record-sign`: Sign AT Protocol records with private keys
+//! - `atproto-record-verify`: Verify signatures on AT Protocol records
 
 #![warn(missing_docs)]
 

crates/atproto-xrpcs-helloworld/README.md

···
 # atproto-xrpcs-helloworld
 
-A complete example implementation of an AT Protocol XRPC service demonstrating DID web functionality, service document generation, and JWT-based authentication using the `atproto-xrpcs` library.
+Example XRPC service implementation demonstrating AT Protocol service patterns.
 
 ## Overview
 
-`atproto-xrpcs-helloworld` provides a fully functional AT Protocol XRPC service that serves as both a reference implementation and a development tool. This service demonstrates all the core concepts of AT Protocol XRPC services including DID web identity, service document generation, well-known endpoint handling, and authenticated XRPC endpoints.
+`atproto-xrpcs-helloworld` provides a complete AT Protocol XRPC service that demonstrates DID web identity, service document generation, well-known endpoint handling, and JWT-based authentication using the `atproto-xrpcs` library.
 
-This project was extracted from the open-sourced [Smokesignal](https://tangled.sh/@smokesignal.events/smokesignal) project and serves as an example of how to build complete AT Protocol services using the project's XRPC components.
+## Binaries
+
+- **atproto-xrpcs-helloworld**: Complete XRPC service with DID web identity and authentication
 
 ## Features
 
-- **Complete XRPC Service**: Full implementation of an AT Protocol XRPC service with authentication
-- **DID Web Support**: Native DID web identity with automatic service document generation
-- **Well-Known Endpoints**: Standard AT Protocol discovery endpoints for identity and service metadata
-- **Hello World XRPC**: Example authenticated and unauthenticated XRPC endpoint implementation
-- **JWT Authentication**: Demonstrates integration with `atproto-xrpcs` authorization extractors
-- **Service Discovery**: Complete service document with verification methods and service endpoints
-- **Development Ready**: Configured for immediate deployment and testing
+- Complete XRPC service implementation with authentication
+- DID web identity with automatic service document generation
+- Well-known endpoints for AT Protocol discovery
+- Example authenticated and unauthenticated XRPC endpoint
+- JWT authorization with DID document verification
 
-## Installation
+## Usage
 
-This crate produces a binary executable. Build it with:
+The service provides these endpoints:
 
-```bash
-cargo build --release --bin atproto-xrpcs-helloworld
-```
+- `GET /` - HTML hello world page
+- `GET /.well-known/did.json` - DID web document
+- `GET /.well-known/atproto-did` - AT Protocol DID discovery
+- `GET /xrpc/garden.lexicon.ngerakines.helloworld.Hello` - Example XRPC endpoint
 
-## Command Line Tool
-
-### `atproto-xrpcs-helloworld`
-
-A complete AT Protocol XRPC service implementation that demonstrates all core functionality for building production XRPC services. This tool sets up a full web server with DID web identity, service discovery endpoints, and authenticated XRPC endpoints.
-
-**Features:**
-- **DID Web Identity**: Automatically generates and serves DID web documents
-- **Service Document**: Creates complete AT Protocol service documents with verification methods
-- **Well-Known Endpoints**: Implements required discovery endpoints for AT Protocol services
-- **XRPC Hello World**: Example XRPC endpoint with both authenticated and unauthenticated access
-- **JWT Authorization**: Demonstrates proper JWT validation and DID document verification
-- **Configurable Identity**: Uses environment variables for service identity configuration
+### Environment Variables
 
 ```bash
-# Start the XRPC hello world service
-cargo run --bin atproto-xrpcs-helloworld
-
-# The service will start on http://0.0.0.0:8080 with the following endpoints:
-# GET  /                                           - HTML hello world page
-# GET  /.well-known/did.json                      - DID web document
-# GET  /.well-known/atproto-did                   - AT Protocol DID discovery
-# GET  /xrpc/garden.lexicon.ngerakines.helloworld.Hello - XRPC hello world endpoint
-
-# Example XRPC requests:
-# curl "http://localhost:8080/xrpc/garden.lexicon.ngerakines.helloworld.Hello?subject=Alice"
-# curl -H "Authorization: Bearer <jwt-token>" "http://localhost:8080/xrpc/garden.lexicon.ngerakines.helloworld.Hello?subject=Bob"
-```
-
-**Environment Variables:**
-
-```bash
-# Required: External base URL for service identity
+# Required
 export EXTERNAL_BASE=your-service.com
-
-# Required: Service private key for DID web identity
-export SERVICE_KEY=did:key:zQ3shNzMp4oaaQ1gQRzCxMGXFrSW3NEM1M9T6KCY9eA7HhyEA
+export SERVICE_KEY=did:key:zQ3sh...
 
-# Optional: Custom PLC directory hostname
+# Optional
 export PLC_HOSTNAME=plc.directory
-
-# Optional: Custom DNS nameservers (semicolon-separated)
 export DNS_NAMESERVERS=8.8.8.8;1.1.1.1
-
-# Optional: Custom CA certificate bundles (semicolon-separated paths)
-export CERTIFICATE_BUNDLES=/path/to/cert1.pem;/path/to/cert2.pem
-
-# Optional: Custom User-Agent string
 export USER_AGENT="my-xrpc-service/1.0"
 ```
 
-**Service Endpoints:**
-
-The service automatically provides these AT Protocol standard endpoints:
-
-1. **`GET /`** - Simple HTML hello world page for service status
-2. **`GET /.well-known/did.json`** - DID web document with verification methods and service endpoints
-3. **`GET /.well-known/atproto-did`** - AT Protocol DID discovery endpoint returning the service DID
-4. **`GET /xrpc/garden.lexicon.ngerakines.helloworld.Hello`** - Example XRPC endpoint with optional authentication
-
-**XRPC Endpoint Details:**
-
-The hello world XRPC endpoint demonstrates:
-- **Optional Authentication**: Works with or without JWT authorization headers
-- **Parameter Processing**: Accepts optional `subject` query parameter
-- **Different Responses**: Returns different messages for authenticated vs unauthenticated requests
-- **Proper XRPC Format**: Returns JSON responses following AT Protocol XRPC conventions
+### Example Requests
 
 ```bash
 # Unauthenticated request
 curl "http://localhost:8080/xrpc/garden.lexicon.ngerakines.helloworld.Hello?subject=World"
 # Response: {"message": "Hello, World!"}
 
-# Authenticated request (with valid JWT)
-curl -H "Authorization: Bearer <valid-jwt>" \
+# Authenticated request
+curl -H "Authorization: Bearer <jwt-token>" \
      "http://localhost:8080/xrpc/garden.lexicon.ngerakines.helloworld.Hello?subject=Alice"
 # Response: {"message": "Hello, authenticated Alice!"}
 ```
 
-**Service Document Structure:**
-
-The service automatically generates a complete DID web document:
-
-```json
-{
-  "@context": [
-    "https://www.w3.org/ns/did/v1",
-    "https://w3id.org/security/multikey/v1"
-  ],
-  "id": "did:web:your-service.com",
-  "verificationMethod": [{
-    "id": "did:web:your-service.com#atproto",
-    "type": "Multikey",
-    "controller": "did:web:your-service.com",
-    "publicKeyMultibase": "zQ3sh..."
-  }],
-  "service": [{
-    "id": "#bsky_appview",
-    "type": "BskyAppView",
-    "serviceEndpoint": "https://your-service.com"
-  }]
-}
-```
-
-## Use Cases
-
-This example service is ideal for:
-
-- **Learning AT Protocol**: Understanding how XRPC services work in practice
-- **Development Testing**: Testing AT Protocol clients against a known service
-- **Service Template**: Starting point for building production AT Protocol services
-- **Integration Testing**: Testing authentication and authorization flows
-- **DID Web Examples**: Understanding DID web document structure and endpoints
-
-## Implementation Details
-
-The service demonstrates several key AT Protocol concepts:
-
-### DID Web Identity
-- Automatic generation of DID web documents with verification methods
-- Service endpoint definitions for AT Protocol service discovery
-- Public key management for service authentication
-
-### XRPC Service Implementation
-- Proper XRPC endpoint naming following AT Protocol conventions
-- JSON request/response handling with serde integration
-- Parameter extraction and validation using Axum extractors
-
-### Authentication Integration
-- Optional JWT authorization using `ResolvingAuthorization` extractor
-- Automatic DID document resolution and signature verification
-- Different behavior for authenticated vs unauthenticated requests
-
-### Service Architecture
-- Modular state management using Axum's state system
-- Integration with `atproto-identity` for cryptographic operations
-- LRU caching for DID document storage and performance
-
-## Dependencies
-
-This binary builds on:
-
-- [`atproto-xrpcs`](../atproto-xrpcs) - XRPC service building blocks and authorization
-- [`atproto-identity`](../atproto-identity) - Identity resolution and cryptographic operations  
-- [`atproto-oauth`](../atproto-oauth) - OAuth 2.0 operations and JWT handling
-- [`atproto-record`](../atproto-record) - AT Protocol record operations
-- `axum` - Web framework for HTTP server implementation
-- `reqwest` - HTTP client for identity resolution
-- `tokio` - Async runtime for web service operations
-- `serde_json` - JSON handling for XRPC requests and responses
-
-## Development
-
-To run the service locally for development:
+## Command Line Examples
 
 ```bash
-# Set required environment variables
-export EXTERNAL_BASE=localhost:8080
-export SERVICE_KEY=did:key:zQ3shNzMp4oaaQ1gQRzCxMGXFrSW3NEM1M9T6KCY9eA7HhyEA
-
-# Run the service
+# Start the service
 cargo run --bin atproto-xrpcs-helloworld
 
-# Test the endpoints
+# Test endpoints
 curl http://localhost:8080/
 curl http://localhost:8080/.well-known/did.json
-curl http://localhost:8080/.well-known/atproto-did
 curl "http://localhost:8080/xrpc/garden.lexicon.ngerakines.helloworld.Hello?subject=Test"
 ```
 
-## Security Considerations
+## Use Cases
 
-- **Service Key Management**: The `SERVICE_KEY` environment variable contains private key material and should be handled securely
-- **JWT Validation**: The service performs full JWT signature validation against DID documents
-- **DID Verification**: All authentication goes through proper DID document resolution and verification
-- **HTTPS Recommended**: Production deployments should use HTTPS for all endpoints
+This example service is ideal for:
 
-## Contributing
-
-Contributions are welcome! Please ensure that:
-
-1. All tests pass: `cargo test`
-2. Code is properly formatted: `cargo fmt`
-3. No linting issues: `cargo clippy`
-4. New functionality includes appropriate tests and documentation
-5. Changes maintain compatibility with AT Protocol specifications
+- Learning AT Protocol XRPC service patterns
+- Testing AT Protocol clients against a known service
+- Starting point for building production services
+- Understanding DID web document structure
 
 ## License
 
-This project is licensed under the MIT License. See the LICENSE file for details.
-
-## Acknowledgments
-
-This service was extracted from the [Smokesignal](https://tangled.sh/@smokesignal.events/smokesignal) project, an open-source event and RSVP management and discovery application.
+MIT License

crates/atproto-xrpcs/README.md

···
 # atproto-xrpcs
 
-A Rust library providing core building blocks for implementing XRPC services in the AT Protocol ecosystem, with JWT-based authorization extractors for Axum web handlers and DID document verification support.
+XRPC service components library for AT Protocol with JWT authorization.
 
 ## Overview
 
-`atproto-xrpcs` provides foundational components for building AT Protocol XRPC (Cross-Protocol Remote Procedure Call) services. This library offers JWT-based authorization extractors that integrate with Axum web handlers, enabling secure XRPC endpoints with automatic DID document verification and structured error handling.
-
-This project was extracted from the open-sourced [Smokesignal](https://tangled.sh/@smokesignal.events/smokesignal) project and is designed to be a standalone, reusable library for AT Protocol XRPC service implementations.
+`atproto-xrpcs` provides foundational components for building AT Protocol XRPC services. This library offers JWT-based authorization extractors that integrate with Axum web handlers, enabling secure XRPC endpoints with automatic DID document verification.
 
 ## Features
 
-- **JWT Authorization Extractors**: Axum-compatible request extractors for JWT-based authorization
-- **DID Document Verification**: Automatic verification of caller identities through DID document resolution
-- **XRPC Service Components**: Core building blocks for implementing AT Protocol XRPC endpoints
-- **Structured Error Handling**: Comprehensive error types with detailed error codes and messages
-- **Axum Integration**: Native integration with Axum web framework for HTTP handlers
-- **Identity Resolution**: Built-in support for resolving AT Protocol identities and handles
-- **Security Features**: Robust authorization patterns with cryptographic verification
-
-## Installation
-
-Add this to your `Cargo.toml`:
-
-```toml
-[dependencies]
-atproto-xrpcs = "0.6.0"
-```
+- JWT authorization extractors for Axum web handlers
+- Automatic DID document verification for caller identities
+- Structured error handling with detailed error codes
+- Native Axum integration for HTTP handlers
+- Identity resolution support for AT Protocol
 
 ## Usage
 
-### Basic XRPC Service Setup
+### Basic XRPC Service
 
 ```rust
 use atproto_xrpcs::authorization::ResolvingAuthorization;
···
     name: Option<String>,
 }
 
-// XRPC handler with optional JWT authorization
 async fn handle_hello(
     params: Query<HelloParams>,
     authorization: Option<ResolvingAuthorization>,
···
     Json(json!({ "message": message }))
 }
 
-#[tokio::main]
-async fn main() -> anyhow::Result<()> {
-    // Set up your Axum router with XRPC endpoints
-    let app = Router::new()
-        .route("/xrpc/com.example.hello", get(handle_hello))
-        .with_state(your_web_context);
-
-    let listener = tokio::net::TcpListener::bind("0.0.0.0:8080").await?;
-    axum::serve(listener, app).await?;
-    
-    Ok(())
-}
+let app = Router::new()
+    .route("/xrpc/com.example.hello", get(handle_hello))
+    .with_state(your_web_context);
 ```
 
-### JWT Authorization with DID Verification
+### JWT Authorization
 
 ```rust
 use atproto_xrpcs::authorization::ResolvingAuthorization;
-use axum::{Json, extract::Query};
-use serde::Deserialize;
-use serde_json::json;
 
-#[derive(Deserialize)]
-struct SecureParams {
-    data: String,
-}
-
-// Handler that requires authentication
 async fn handle_secure_endpoint(
-    params: Query<SecureParams>,
     authorization: ResolvingAuthorization, // Required authorization
 ) -> Json<serde_json::Value> {
     // The ResolvingAuthorization extractor automatically:
     // 1. Validates the JWT token
-    // 2. Resolves the caller's DID document
+    // 2. Resolves the caller's DID document  
     // 3. Verifies the signature against the DID document
     // 4. Provides access to caller identity information
     
     let caller_did = authorization.subject();
-    
-    Json(json!({
-        "message": "Secure operation completed",
-        "caller": caller_did,
-        "data": params.data
-    }))
+    Json(json!({"caller": caller_did, "status": "authenticated"}))
 }
 ```
 
-### Error Handling in XRPC Services
+### Error Handling
 
 ```rust
 use atproto_xrpcs::errors::AuthorizationError;
 use axum::{response::IntoResponse, http::StatusCode};
 
-// XRPC services can handle authorization errors appropriately
 async fn protected_handler(
     authorization: Result<ResolvingAuthorization, AuthorizationError>,
 ) -> impl IntoResponse {
     match authorization {
-        Ok(auth) => {
-            // Handle authenticated request
-            (StatusCode::OK, "Access granted").into_response()
-        }
+        Ok(auth) => (StatusCode::OK, "Access granted").into_response(),
         Err(AuthorizationError::InvalidJWTToken { .. }) => {
             (StatusCode::UNAUTHORIZED, "Invalid token").into_response()
         }
···
 }
 ```
 
-### Integration with AT Protocol Identity System
-
-```rust
-use atproto_xrpcs::authorization::ResolvingAuthorization;
-use atproto_identity::{
-    axum::state::DidDocumentStorageExtractor,
-    resolve::IdentityResolver,
-};
-use axum::extract::State;
-
-// XRPC handlers can access the full AT Protocol identity system
-async fn handle_identity_operation(
-    authorization: ResolvingAuthorization,
-    State(identity_resolver): State<IdentityResolver>,
-    State(storage): State<DidDocumentStorageExtractor>,
-) -> Json<serde_json::Value> {
-    let caller_did = authorization.subject();
-    
-    // Use the identity resolver for additional operations
-    // Access DID document storage for caching and retrieval
-    
-    Json(json!({
-        "caller": caller_did,
-        "status": "Identity verified and processed"
-    }))
-}
-```
-
-## Modules
-
-- **[`authorization`]** - JWT-based authorization extractors with DID document verification
-- **[`errors`]** - Structured error types for XRPC authorization operations
-
 ## Authorization Flow
 
-The `ResolvingAuthorization` extractor implements a comprehensive authorization flow:
-
-1. **JWT Extraction**: Extracts JWT tokens from HTTP Authorization headers
-2. **Token Validation**: Validates JWT signature and claims structure
-3. **DID Resolution**: Resolves the token issuer's DID document
-4. **Signature Verification**: Verifies the JWT signature against the DID document's public keys
-5. **Identity Confirmation**: Confirms the caller's identity and authorization scope
-
-## Error Handling
-
-All errors follow a structured format with unique identifiers:
-
-```
-error-atproto-xrpcs-<domain>-<number> <message>: <details>
-```
-
-Example error categories:
-
-- `error-atproto-xrpcs-authorization-1` through `error-atproto-xrpcs-authorization-15` - JWT authorization errors
+The `ResolvingAuthorization` extractor implements:
 
-```rust
-use atproto_xrpcs::errors::AuthorizationError;
-
-// Example error handling
-match authorization_result {
-    Err(AuthorizationError::MissingAuthorizationHeader) => {
-        println!("No authorization header provided");
-    }
-    Err(AuthorizationError::InvalidJWTToken { error }) => {
-        println!("Invalid JWT token: {}", error);
-    }
-    Err(AuthorizationError::DIDDocumentResolutionFailed { did, error }) => {
-        println!("Failed to resolve DID {}: {}", did, error);
-    }
-    Ok(auth) => println!("Authorization successful for: {}", auth.subject()),
-}
-```
-
-## Security Features
-
-- **JWT Validation**: Comprehensive JWT token structure and signature validation
-- **DID Verification**: Automatic resolution and verification of caller DID documents
-- **Cryptographic Security**: Integration with `atproto-identity` for secure key operations
-- **Authorization Scope**: Support for AT Protocol authorization scopes and permissions
-- **Identity Binding**: Strong binding between JWT tokens and DID document public keys
-
-## Dependencies
-
-This crate builds on:
-
-- [`atproto-identity`](../atproto-identity) - Identity resolution and cryptographic operations
-- [`atproto-oauth`](../atproto-oauth) - OAuth 2.0 operations and JWT handling
-- [`atproto-record`](../atproto-record) - AT Protocol record operations
-- `axum` - Web framework for HTTP handlers and extractors
-- `reqwest` - HTTP client for DID document resolution
-- `serde_json` - JSON handling for XRPC request/response data
-- `tokio` - Async runtime for web service operations
-- `thiserror` - Structured error type derivation
-
-## AT Protocol XRPC
-
-This library implements components for [AT Protocol XRPC](https://atproto.com/specs/xrpc), which provides:
-
-- **Cross-Protocol Communication**: Standardized RPC over HTTP for AT Protocol services
-- **Schema-Driven APIs**: Type-safe API definitions using Lexicon schemas
-- **Authentication Integration**: Seamless integration with AT Protocol identity and authorization
-- **Service Discovery**: Support for AT Protocol service discovery and routing
-
-## Library Only
-
-This crate is designed as a library and does not provide command line tools. All functionality is accessed programmatically through the Rust API. For a complete example implementation, see the [`atproto-xrpcs-helloworld`](../atproto-xrpcs-helloworld) crate which demonstrates a full XRPC service using these components.
-
-## Contributing
-
-Contributions are welcome! Please ensure that:
-
-1. All tests pass: `cargo test`
-2. Code is properly formatted: `cargo fmt`
-3. No linting issues: `cargo clippy`
-4. New functionality includes appropriate tests and documentation
-5. Error handling follows the project's structured error format
+1. JWT extraction from HTTP Authorization headers
+2. Token validation (signature and claims structure)
+3. DID resolution for the token issuer
+4. Signature verification against DID document public keys
+5. Identity confirmation and authorization scope validation
 
 ## License
 
-This project is licensed under the MIT License. See the LICENSE file for details.
-
-## Acknowledgments
-
-This library was extracted from the [Smokesignal](https://tangled.sh/@smokesignal.events/smokesignal) project, an open-source event and RSVP management and discovery application.
+MIT License

crates/atproto-xrpcs/src/lib.rs

···
-//! # AT Protocol XRPC Service Components
-//!
-//! Core building blocks for implementing XRPC services in the AT Protocol ecosystem.
-//! Provides JWT-based authorization extractors for Axum web handlers with DID document
-//! verification and structured error handling.
+//! XRPC service components for AT Protocol with JWT authorization and DID verification.
 
 #![warn(missing_docs)]