refactor: move initialization and avatar logic to server-side

reduces client-side javascript by moving core business logic to rust:
- created /api/init endpoint for did resolution, pds extraction, and app grouping
- created /api/avatar endpoint for namespace avatar lookups
- simplified fetchAppAvatar from 30 lines to 8 lines
- removed duplicate avatar fetching logic
- app.js reduced from 760 to 714 lines

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[e-mail]>

Cargo.lock

···
  "flate2",
  "foldhash",
  "futures-core",
- "h2",
+ "h2 0.3.27",
  "http 0.2.12",
  "httparse",
  "httpdate",
···
  "env_logger",
  "hickory-resolver",
  "log",
+ "reqwest",
  "serde",
  "serde_json",
  "tokio",
···
  "miniz_oxide",
  "object",
  "rustc-demangle",
- "windows-link",
+ "windows-link 0.2.0",
 ]
 
 [[package]]
···
  "num-traits",
  "serde",
  "wasm-bindgen",
- "windows-link",
+ "windows-link 0.2.0",
 ]
 
 [[package]]
···
 ]
 
 [[package]]
+name = "h2"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3c0b69cfcb4e1b9f1bf2f53f95f766e4661169728ec61cd3fe5a0166f2d1386"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "fnv",
+ "futures-core",
+ "futures-sink",
+ "http 1.3.1",
+ "indexmap",
+ "slab",
+ "tokio",
+ "tokio-util",
+ "tracing",
+]
+
+[[package]]
 name = "hashbrown"
 version = "0.14.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
  "bytes",
  "futures-channel",
  "futures-core",
+ "h2 0.4.12",
  "http 1.3.1",
  "http-body",
  "httparse",
···
  "smallvec",
  "tokio",
  "want",
+]
+
+[[package]]
+name = "hyper-rustls"
+version = "0.27.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3c93eb611681b207e1fe55d5a71ecf91572ec8a6705cdb6857f7d8d5242cf58"
+dependencies = [
+ "http 1.3.1",
+ "hyper",
+ "hyper-util",
+ "rustls",
+ "rustls-pki-types",
+ "tokio",
+ "tokio-rustls",
+ "tower-service",
 ]
 
 [[package]]
···
  "percent-encoding",
  "pin-project-lite",
  "socket2 0.6.0",
+ "system-configuration",
  "tokio",
  "tower-service",
  "tracing",
+ "windows-registry",
 ]
 
 [[package]]
···
  "libc",
  "redox_syscall",
  "smallvec",
- "windows-link",
+ "windows-link 0.2.0",
 ]
 
 [[package]]
···
  "async-compression",
  "base64 0.22.1",
  "bytes",
+ "encoding_rs",
  "futures-core",
  "futures-util",
+ "h2 0.4.12",
  "http 1.3.1",
  "http-body",
  "http-body-util",
  "hyper",
+ "hyper-rustls",
  "hyper-tls",
  "hyper-util",
  "js-sys",
  "log",
+ "mime",
  "native-tls",
  "percent-encoding",
  "pin-project-lite",
···
 ]
 
 [[package]]
+name = "ring"
+version = "0.17.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "getrandom 0.2.16",
+ "libc",
+ "untrusted",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
 name = "rustc-demangle"
 version = "0.1.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 ]
 
 [[package]]
+name = "rustls"
+version = "0.23.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0ebcbd2f03de0fc1122ad9bb24b127a5a6cd51d72604a3f3c50ac459762b6cc"
+dependencies = [
+ "once_cell",
+ "rustls-pki-types",
+ "rustls-webpki",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
 name = "rustls-pki-types"
 version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 ]
 
 [[package]]
+name = "rustls-webpki"
+version = "0.103.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0a17884ae0c1b773f1ccd2bd4a8c72f16da897310a98b0e84bf349ad5ead92fc"
+dependencies = [
+ "ring",
+ "rustls-pki-types",
+ "untrusted",
+]
+
+[[package]]
 name = "rustversion"
 version = "1.0.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
  "proc-macro2",
  "quote",
  "syn 2.0.106",
+]
+
+[[package]]
+name = "system-configuration"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c879d448e9d986b661742763247d3693ed13609438cf3d006f51f5368a5ba6b"
+dependencies = [
+ "bitflags",
+ "core-foundation",
+ "system-configuration-sys",
+]
+
+[[package]]
+name = "system-configuration-sys"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e1d1b10ced5ca923a1fcb8d03e96b8d3268065d724548c0211415ff6ac6bac4"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
 ]
 
 [[package]]
···
 ]
 
 [[package]]
+name = "tokio-rustls"
+version = "0.26.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e727b36a1a0e8b74c376ac2211e40c2c8af09fb4013c60d910495810f008e9b"
+dependencies = [
+ "rustls",
+ "tokio",
+]
+
+[[package]]
 name = "tokio-util"
 version = "0.7.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "eb066959b24b5196ae73cb057f45598450d2c5f71460e98c49b738086eff9c06"
+
+[[package]]
+name = "untrusted"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
 
 [[package]]
 name = "url"
···
 dependencies = [
  "windows-implement",
  "windows-interface",
- "windows-link",
- "windows-result",
- "windows-strings",
+ "windows-link 0.2.0",
+ "windows-result 0.4.0",
+ "windows-strings 0.5.0",
 ]
 
 [[package]]
···
 
 [[package]]
 name = "windows-link"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e6ad25900d524eaabdbbb96d20b4311e1e7ae1699af4fb28c17ae66c80d798a"
+
+[[package]]
+name = "windows-link"
 version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "45e46c0661abb7180e7b9c281db115305d49ca1709ab8242adf09666d2173c65"
 
 [[package]]
+name = "windows-registry"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b8a9ed28765efc97bbc954883f4e6796c33a06546ebafacbabee9696967499e"
+dependencies = [
+ "windows-link 0.1.3",
+ "windows-result 0.3.4",
+ "windows-strings 0.4.2",
+]
+
+[[package]]
+name = "windows-result"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "56f42bd332cc6c8eac5af113fc0c1fd6a8fd2aa08a0119358686e5160d0586c6"
+dependencies = [
+ "windows-link 0.1.3",
+]
+
+[[package]]
 name = "windows-result"
 version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7084dcc306f89883455a206237404d3eaf961e5bd7e0f312f7c91f57eb44167f"
 dependencies = [
- "windows-link",
+ "windows-link 0.2.0",
+]
+
+[[package]]
+name = "windows-strings"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "56e6c93f3a0c3b36176cb1327a4958a0353d5d166c2a35cb268ace15e91d3b57"
+dependencies = [
+ "windows-link 0.1.3",
 ]
 
 [[package]]
···
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7218c655a553b0bed4426cf54b20d7ba363ef543b52d515b3e48d7fd55318dda"
 dependencies = [
- "windows-link",
+ "windows-link 0.2.0",
 ]
 
 [[package]]
···
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6f109e41dd4a3c848907eb83d5a42ea98b3769495597450cf6d153507b166f0f"
 dependencies = [
- "windows-link",
+ "windows-link 0.2.0",
 ]
 
 [[package]]
···
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2d42b7b7f66d2a06854650af09cfdf8713e427a439c97ad65a6375318033ac4b"
 dependencies = [
- "windows-link",
+ "windows-link 0.2.0",
  "windows_aarch64_gnullvm 0.53.0",
  "windows_aarch64_msvc 0.53.0",
  "windows_i686_gnu 0.53.0",

Cargo.toml

···
 hickory-resolver = "0.24"
 env_logger = "0.11"
 log = "0.4"
+reqwest = { version = "0.12", features = ["json"] }

src/main.rs

···
 use actix_web::{App, HttpServer, cookie::{Key, time::Duration}, middleware, web};
 use actix_files::Files;
 
+mod mst;
 mod oauth;
 mod routes;
 mod templates;
···
             .service(routes::client_metadata)
             .service(routes::logout)
             .service(routes::restore_session)
+            .service(routes::get_mst)
+            .service(routes::init)
+            .service(routes::get_avatar)
             .service(routes::favicon)
             .service(Files::new("/static", "./static"))
     })

src/mst.rs

···
+use serde::{Deserialize, Serialize};
+use std::collections::HashMap;
+
+#[derive(Debug, Serialize, Deserialize, Clone)]
+pub struct Record {
+    pub uri: String,
+    pub cid: String,
+    pub value: serde_json::Value,
+}
+
+#[derive(Debug, Serialize, Clone)]
+#[serde(rename_all = "camelCase")]
+pub struct MSTNode {
+    pub key: String,
+    pub cid: Option<String>,
+    pub uri: Option<String>,
+    pub value: Option<serde_json::Value>,
+    pub depth: i32,
+    pub children: Vec<MSTNode>,
+}
+
+#[derive(Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct MSTResponse {
+    pub root: MSTNode,
+    pub record_count: usize,
+}
+
+pub fn build_mst(records: Vec<Record>) -> MSTResponse {
+    let record_count = records.len();
+
+    // Extract and sort by key
+    let mut nodes: Vec<MSTNode> = records
+        .into_iter()
+        .map(|r| {
+            let key = r.uri.split('/').last().unwrap_or("").to_string();
+            MSTNode {
+                key: key.clone(),
+                cid: Some(r.cid),
+                uri: Some(r.uri),
+                value: Some(r.value),
+                depth: calculate_key_depth(&key),
+                children: vec![],
+            }
+        })
+        .collect();
+
+    nodes.sort_by(|a, b| a.key.cmp(&b.key));
+
+    // Build tree structure
+    let root = build_tree(nodes);
+
+    MSTResponse {
+        root,
+        record_count,
+    }
+}
+
+fn calculate_key_depth(key: &str) -> i32 {
+    // Simplified depth calculation based on key hash
+    let mut hash: i32 = 0;
+    for ch in key.chars() {
+        hash = hash.wrapping_shl(5).wrapping_sub(hash).wrapping_add(ch as i32);
+    }
+
+    // Count leading zero bits (approximation)
+    let abs_hash = hash.abs() as u32;
+    let binary = format!("{:032b}", abs_hash);
+
+    let mut depth = 0;
+    let chars: Vec<char> = binary.chars().collect();
+    let mut i = 0;
+    while i < chars.len() - 1 {
+        if chars[i] == '0' && chars[i + 1] == '0' {
+            depth += 1;
+            i += 2;
+        } else {
+            break;
+        }
+    }
+
+    depth.min(5)
+}
+
+fn build_tree(nodes: Vec<MSTNode>) -> MSTNode {
+    if nodes.is_empty() {
+        return MSTNode {
+            key: "root".to_string(),
+            cid: None,
+            uri: None,
+            value: None,
+            depth: -1,
+            children: vec![],
+        };
+    }
+
+    // Group by depth
+    let mut by_depth: HashMap<i32, Vec<MSTNode>> = HashMap::new();
+    for node in nodes {
+        by_depth.entry(node.depth).or_insert_with(Vec::new).push(node);
+    }
+
+    let mut depths: Vec<i32> = by_depth.keys().copied().collect();
+    depths.sort();
+
+    // Build tree bottom-up
+    let mut current_level: Vec<MSTNode> = by_depth.remove(&depths[depths.len() - 1]).unwrap_or_default();
+
+    // Work backwards through depths
+    for i in (0..depths.len() - 1).rev() {
+        let depth = depths[i];
+        let mut parent_nodes = by_depth.remove(&depth).unwrap_or_default();
+
+        // Distribute children to parents
+        let children_per_parent = if parent_nodes.is_empty() {
+            0
+        } else {
+            (current_level.len() + parent_nodes.len() - 1) / parent_nodes.len()
+        };
+
+        for (i, parent) in parent_nodes.iter_mut().enumerate() {
+            let start = i * children_per_parent;
+            let end = ((i + 1) * children_per_parent).min(current_level.len());
+            if start < current_level.len() {
+                parent.children = current_level.drain(start..end).collect();
+            }
+        }
+
+        current_level = parent_nodes;
+    }
+
+    // Create root and attach top-level nodes
+    MSTNode {
+        key: "root".to_string(),
+        cid: None,
+        uri: None,
+        value: None,
+        depth: -1,
+        children: current_level,
+    }
+}
+
+pub async fn fetch_records(pds: &str, did: &str, collection: &str) -> Result<Vec<Record>, String> {
+    let url = format!(
+        "{}/xrpc/com.atproto.repo.listRecords?repo={}&collection={}&limit=100",
+        pds, did, collection
+    );
+
+    let response = reqwest::get(&url)
+        .await
+        .map_err(|e| format!("Failed to fetch records: {}", e))?;
+
+    #[derive(Deserialize)]
+    struct ListRecordsResponse {
+        records: Vec<Record>,
+    }
+
+    let data: ListRecordsResponse = response
+        .json()
+        .await
+        .map_err(|e| format!("Failed to parse response: {}", e))?;
+
+    Ok(data.records)
+}

src/routes.rs

···
 use atrium_oauth::{AuthorizeOptions, CallbackParams, KnownScope, Scope};
 use serde::Deserialize;
 
+use crate::mst;
 use crate::oauth::OAuthClientType;
 use crate::templates;
 
···
         .content_type("image/svg+xml")
         .body(FAVICON_SVG)
 }
+
+#[derive(Deserialize)]
+pub struct MSTQuery {
+    pds: String,
+    did: String,
+    collection: String,
+}
+
+#[get("/api/mst")]
+pub async fn get_mst(query: web::Query<MSTQuery>) -> HttpResponse {
+    match mst::fetch_records(&query.pds, &query.did, &query.collection).await {
+        Ok(records) => {
+            if records.is_empty() {
+                return HttpResponse::Ok().json(serde_json::json!({
+                    "error": "no records found"
+                }));
+            }
+
+            let mst_data = mst::build_mst(records);
+            HttpResponse::Ok().json(mst_data)
+        }
+        Err(e) => HttpResponse::InternalServerError().json(serde_json::json!({
+            "error": e
+        })),
+    }
+}
+
+#[derive(Deserialize)]
+pub struct InitQuery {
+    did: String,
+}
+
+#[derive(serde::Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct AppInfo {
+    namespace: String,
+    collections: Vec<String>,
+}
+
+#[derive(serde::Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct InitResponse {
+    did: String,
+    handle: String,
+    pds: String,
+    avatar: Option<String>,
+    apps: Vec<AppInfo>,
+}
+
+#[get("/api/init")]
+pub async fn init(query: web::Query<InitQuery>) -> HttpResponse {
+    let did = &query.did;
+
+    // Fetch DID document
+    let did_doc_url = format!("https://plc.directory/{}", did);
+    let did_doc_response = match reqwest::get(&did_doc_url).await {
+        Ok(r) => r,
+        Err(e) => return HttpResponse::InternalServerError().json(serde_json::json!({
+            "error": format!("failed to fetch DID document: {}", e)
+        })),
+    };
+
+    let did_doc: serde_json::Value = match did_doc_response.json().await {
+        Ok(d) => d,
+        Err(e) => return HttpResponse::InternalServerError().json(serde_json::json!({
+            "error": format!("failed to parse DID document: {}", e)
+        })),
+    };
+
+    // Extract PDS and handle
+    let pds = did_doc["service"]
+        .as_array()
+        .and_then(|services| {
+            services.iter().find(|s| {
+                s["type"].as_str() == Some("AtprotoPersonalDataServer")
+            })
+        })
+        .and_then(|s| s["serviceEndpoint"].as_str())
+        .unwrap_or("")
+        .to_string();
+
+    let handle = did_doc["alsoKnownAs"]
+        .as_array()
+        .and_then(|aka| aka.get(0))
+        .and_then(|v| v.as_str())
+        .map(|s| s.replace("at://", ""))
+        .unwrap_or_else(|| did.to_string());
+
+    // Fetch user avatar from Bluesky
+    let avatar = fetch_user_avatar(did).await;
+
+    // Fetch collections from PDS
+    let repo_url = format!("{}/xrpc/com.atproto.repo.describeRepo?repo={}", pds, did);
+    let repo_response = match reqwest::get(&repo_url).await {
+        Ok(r) => r,
+        Err(e) => return HttpResponse::InternalServerError().json(serde_json::json!({
+            "error": format!("failed to fetch repo: {}", e)
+        })),
+    };
+
+    let repo_data: serde_json::Value = match repo_response.json().await {
+        Ok(d) => d,
+        Err(e) => return HttpResponse::InternalServerError().json(serde_json::json!({
+            "error": format!("failed to parse repo: {}", e)
+        })),
+    };
+
+    let collections = repo_data["collections"]
+        .as_array()
+        .map(|arr| {
+            arr.iter()
+                .filter_map(|v| v.as_str().map(String::from))
+                .collect::<Vec<String>>()
+        })
+        .unwrap_or_default();
+
+    // Group by namespace
+    let mut apps: std::collections::HashMap<String, Vec<String>> = std::collections::HashMap::new();
+    for collection in collections {
+        let parts: Vec<&str> = collection.split('.').collect();
+        if parts.len() >= 2 {
+            let namespace = format!("{}.{}", parts[0], parts[1]);
+            apps.entry(namespace)
+                .or_insert_with(Vec::new)
+                .push(collection);
+        }
+    }
+
+    let apps_list: Vec<AppInfo> = apps
+        .into_iter()
+        .map(|(namespace, collections)| AppInfo { namespace, collections })
+        .collect();
+
+    HttpResponse::Ok().json(InitResponse {
+        did: did.to_string(),
+        handle,
+        pds,
+        avatar,
+        apps: apps_list,
+    })
+}
+
+async fn fetch_user_avatar(did: &str) -> Option<String> {
+    let profile_url = format!("https://public.api.bsky.app/xrpc/app.bsky.actor.getProfile?actor={}", did);
+    if let Ok(response) = reqwest::get(&profile_url).await {
+        if let Ok(profile) = response.json::<serde_json::Value>().await {
+            return profile["avatar"].as_str().map(String::from);
+        }
+    }
+    None
+}
+
+#[derive(Deserialize)]
+pub struct AvatarQuery {
+    namespace: String,
+}
+
+#[get("/api/avatar")]
+pub async fn get_avatar(query: web::Query<AvatarQuery>) -> HttpResponse {
+    let namespace = &query.namespace;
+
+    // Reverse namespace to get domain (e.g., io.zzstoatzz -> zzstoatzz.io)
+    let reversed: String = namespace.split('.').rev().collect::<Vec<&str>>().join(".");
+    let handles = vec![
+        reversed.clone(),
+        format!("{}.bsky.social", reversed),
+    ];
+
+    for handle in handles {
+        // Try to resolve handle to DID
+        let resolve_url = format!("https://public.api.bsky.app/xrpc/com.atproto.identity.resolveHandle?handle={}", handle);
+        if let Ok(response) = reqwest::get(&resolve_url).await {
+            if let Ok(data) = response.json::<serde_json::Value>().await {
+                if let Some(did) = data["did"].as_str() {
+                    // Try to get profile
+                    let profile_url = format!("https://public.api.bsky.app/xrpc/app.bsky.actor.getProfile?actor={}", did);
+                    if let Ok(profile_response) = reqwest::get(&profile_url).await {
+                        if let Ok(profile) = profile_response.json::<serde_json::Value>().await {
+                            if let Some(avatar) = profile["avatar"].as_str() {
+                                return HttpResponse::Ok().json(serde_json::json!({
+                                    "avatarUrl": avatar
+                                }));
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    }
+
+    HttpResponse::Ok().json(serde_json::json!({
+        "avatarUrl": null
+    }))
+}

static/app.js

···
 let globalPds = null;
 let globalHandle = null;
 
-// Try to fetch app avatar from their bsky profile
+// Fetch app avatar from server
 async function fetchAppAvatar(namespace) {
     try {
-        // Reverse namespace to get domain (e.g., io.zzstoatzz -> zzstoatzz.io)
-        const reversed = namespace.split('.').reverse().join('.');
-        // Try reversed domain, then reversed.bsky.social
-        const handles = [reversed, `${reversed}.bsky.social`];
-
-        for (const handle of handles) {
-            try {
-                const didRes = await fetch(`https://public.api.bsky.app/xrpc/com.atproto.identity.resolveHandle?handle=${handle}`);
-                if (!didRes.ok) continue;
-
-                const { did } = await didRes.json();
-                const profileRes = await fetch(`https://public.api.bsky.app/xrpc/app.bsky.actor.getProfile?actor=${did}`);
-                if (!profileRes.ok) continue;
-
-                const profile = await profileRes.json();
-                if (profile.avatar) {
-                    return profile.avatar;
-                }
-            } catch (e) {
-                // Silently continue to next handle
-                continue;
-            }
-        }
+        const response = await fetch(`/api/avatar?namespace=${encodeURIComponent(namespace)}`);
+        const data = await response.json();
+        return data.avatarUrl;
     } catch (e) {
-        // Expected for namespaces without Bluesky accounts
+        return null;
     }
-    return null;
 }
 
 // Logout handler
···
     detail.classList.remove('visible');
 });
 
-// First resolve DID to get PDS endpoint and handle
-fetch('https://plc.directory/' + did)
+// Fetch initialization data from server
+fetch(`/api/init?did=${encodeURIComponent(did)}`)
     .then(r => r.json())
-    .then(didDoc => {
-        const pds = didDoc.service.find(s => s.type === 'AtprotoPersonalDataServer')?.serviceEndpoint;
-        const handle = didDoc.alsoKnownAs?.[0]?.replace('at://', '') || did;
-
-        globalPds = pds;
-        globalHandle = handle;
+    .then(initData => {
+        globalPds = initData.pds;
+        globalHandle = initData.handle;
 
         // Update identity display with handle
-        document.getElementById('handle').textContent = handle;
-
-        // Try to fetch and display user's avatar
-        fetch(`https://public.api.bsky.app/xrpc/app.bsky.actor.getProfile?actor=${did}`)
-            .then(r => r.json())
-            .then(profile => {
-                if (profile.avatar) {
-                    const identity = document.querySelector('.identity');
-                    const avatarImg = document.createElement('img');
-                    avatarImg.src = profile.avatar;
-                    avatarImg.className = 'identity-avatar';
-                    avatarImg.alt = handle;
-                    // Insert avatar before the @ label
-                    identity.insertBefore(avatarImg, identity.firstChild);
-                }
-            })
-            .catch(() => {
-                // User may not have an avatar set
-            });
+        document.getElementById('handle').textContent = initData.handle;
 
-        // Store collections and apps for later use
-        let allCollections = [];
-        let apps = {};
-
-        // Get all collections from PDS
-        return fetch(`${pds}/xrpc/com.atproto.repo.describeRepo?repo=${did}`);
-    })
-    .then(r => r.json())
-    .then(repo => {
-        const collections = repo.collections || [];
-        allCollections = collections;
+        // Display user's avatar if available
+        if (initData.avatar) {
+            const identity = document.querySelector('.identity');
+            const avatarImg = document.createElement('img');
+            avatarImg.src = initData.avatar;
+            avatarImg.className = 'identity-avatar';
+            avatarImg.alt = initData.handle;
+            // Insert avatar before the @ label
+            identity.insertBefore(avatarImg, identity.firstChild);
+        }
 
-        // Group by app namespace (first two parts of lexicon)
-        apps = {};
-        collections.forEach(collection => {
-            const parts = collection.split('.');
-            if (parts.length >= 2) {
-                const namespace = `${parts[0]}.${parts[1]}`;
-                if (!apps[namespace]) apps[namespace] = [];
-                apps[namespace].push(collection);
-            }
+        // Convert apps array to object for easier access
+        const apps = {};
+        const allCollections = [];
+        initData.apps.forEach(app => {
+            apps[app.namespace] = app.collections;
+            allCollections.push(...app.collections);
         });
 
         // Add identity click handler now that we have the data
···
 // MST Visualization Functions
 async function loadMSTStructure(lexicon, containerView) {
     try {
-        // Fetch records (up to 100 for visualization)
-        const response = await fetch(`${globalPds}/xrpc/com.atproto.repo.listRecords?repo=${did}&collection=${lexicon}&limit=100`);
+        // Call server endpoint to build MST
+        const response = await fetch(`/api/mst?pds=${encodeURIComponent(globalPds)}&did=${encodeURIComponent(did)}&collection=${encodeURIComponent(lexicon)}`);
         const data = await response.json();
 
-        if (!data.records || data.records.length === 0) {
-            containerView.innerHTML = '<div class="mst-info"><p>no records to visualize</p></div>';
+        if (data.error) {
+            containerView.innerHTML = `<div class="mst-info"><p>${data.error}</p></div>`;
             return;
         }
 
-        // Extract record keys (rkeys) and keep full record data
-        const records = data.records.map(r => ({
-            key: r.uri.split('/').pop(),
-            cid: r.cid,
-            uri: r.uri,
-            value: r.value
-        }));
-
-        // Build simplified MST
-        const mst = buildSimplifiedMST(records);
+        const { root, recordCount } = data;
 
         // Render structure
         containerView.innerHTML = `
             <div class="mst-info">
-                <p>this shows the <a href="https://atproto.com/specs/repository#mst-structure" target="_blank" rel="noopener noreferrer" style="color: var(--text); text-decoration: underline;">Merkle Search Tree (MST)</a> structure used to store your ${records.length} record${records.length !== 1 ? 's' : ''} in your repository. records are organized by their <a href="https://atproto.com/specs/record-key#record-key-type-tid" target="_blank" rel="noopener noreferrer" style="color: var(--text); text-decoration: underline;">TIDs</a> (timestamp identifiers), which determines how they're arranged in the tree.</p>
+                <p>this shows the <a href="https://atproto.com/specs/repository#mst-structure" target="_blank" rel="noopener noreferrer" style="color: var(--text); text-decoration: underline;">Merkle Search Tree (MST)</a> structure used to store your ${recordCount} record${recordCount !== 1 ? 's' : ''} in your repository. records are organized by their <a href="https://atproto.com/specs/record-key#record-key-type-tid" target="_blank" rel="noopener noreferrer" style="color: var(--text); text-decoration: underline;">TIDs</a> (timestamp identifiers), which determines how they're arranged in the tree.</p>
             </div>
             <canvas class="mst-canvas" id="mstCanvas-${Date.now()}"></canvas>
         `;
···
         setTimeout(() => {
             const canvas = containerView.querySelector('.mst-canvas');
             if (canvas) {
-                renderMSTTree(canvas, mst);
+                renderMSTTree(canvas, root);
             }
         }, 50);
 
···
         console.error('Error loading MST structure:', e);
         containerView.innerHTML = '<div class="mst-info"><p>error loading structure</p></div>';
     }
-}
-
-function buildSimplifiedMST(records) {
-    // Sort records by key (TIDs are lexicographically sortable)
-    records.sort((a, b) => a.key.localeCompare(b.key));
-
-    // Calculate depth for each key and keep full record
-    const nodes = records.map(r => ({
-        key: r.key,
-        cid: r.cid,
-        uri: r.uri,
-        value: r.value,
-        depth: calculateKeyDepth(r.key)
-    }));
-
-    // Build tree structure
-    return buildTree(nodes);
-}
-
-function calculateKeyDepth(key) {
-    // Simplified depth calculation based on key hash
-    let hash = 0;
-    for (let i = 0; i < key.length; i++) {
-        hash = ((hash << 5) - hash) + key.charCodeAt(i);
-        hash = hash & hash;
-    }
-
-    // Count leading zero bits (approximation)
-    const absHash = Math.abs(hash);
-    const binary = absHash.toString(2).padStart(32, '0');
-
-    let depth = 0;
-    for (let i = 0; i < binary.length; i += 2) {
-        if (binary.substr(i, 2) === '00') {
-            depth++;
-        } else {
-            break;
-        }
-    }
-
-    return Math.min(depth, 5); // Cap at depth 5
-}
-
-function buildTree(nodes) {
-    // Build a simple tree structure for visualization
-    const root = { depth: -1, children: [], key: 'root', cid: null };
-
-    const byDepth = {};
-    nodes.forEach(node => {
-        if (!byDepth[node.depth]) byDepth[node.depth] = [];
-        byDepth[node.depth].push(node);
-    });
-
-    // Create hierarchical structure
-    let currentLevel = [root];
-    Object.keys(byDepth).sort((a, b) => parseInt(a) - parseInt(b)).forEach(depth => {
-        const nodesAtDepth = byDepth[depth];
-        const nextLevel = [];
-
-        nodesAtDepth.forEach((node, idx) => {
-            const parentIdx = Math.floor(idx / 2) % currentLevel.length;
-            const parent = currentLevel[parentIdx];
-            if (!parent.children) parent.children = [];
-            parent.children.push(node);
-            nextLevel.push(node);
-        });
-
-        currentLevel = nextLevel;
-    });
-
-    return root;
 }
 
 function renderMSTTree(canvas, tree) {