feat(postit): wire Desktop address book to /api/user-search

Replaces the empty ContactService.Desktop stub with a real
implementation backed by UserSearchClient. Closes the loop
between the server-side /api/user-search endpoint (b3056f1c),
the client wrapper (6e7e0414), and the platform abstraction.

IContactService gains:
- SearchAsync(string query, CancellationToken): on desktop,
  hits /api/user-search and appends results to an in-memory
  cache. On mobile, throws PlatformNotSupportedException —
  mobile providers use the device-local address book
  (GetDeviceContactsAsync) and don't talk to a network search.
- Contacts (ObservableCollection<ContactDto>): live view of
  the cache; UI binds directly to it. Mobile populates it
  inside GetDeviceContactsAsync (eager load); desktop populates
  it via SearchAsync (lazy, on-demand).

ContactDto shape changes:
- Emails (IReadOnlyList<string>) -> Email (string?). The
  /api/user-search endpoint returns one email per user. The
  use case ('invite / add to a circle') only needs one.
- Mobile provider flattens its per-contact email list down
  to the first non-empty entry (a small functional loss that
  matches the wire shape).

App.axaml.cs constructs a ContactService from the
UserSearchClient singleton and registers it as
IContactService so future ViewModels can take the interface
by constructor injection.

Build + 51/51 tests green. The mobile provider is still
gated by #if ANDROID || IOS and not exercised by the
Desktop test target — runtime behaviour on Android will
need a smoke test on device when PostIt.Android lands.

.forgejo/workflows/release.yml

@@ -0,0 +1,331 @@
+# Build and publish a release on the Forgejo source-of-truth instance
+# with the PostIt Android APK as an attached asset.
+#
+# Triggered by a push of a git tag. Validates the tag/changelog pair,
+# builds the APK using the existing Dockerfile (--target build-env), then
+# publishes a Forgejo release via the Forgejo REST API and uploads the
+# APK as an asset.
+#
+# Authentication uses ${{ secrets.GITHUB_TOKEN }} (auto-provided by the
+# Forgejo runner, scoped to contents: write for the current repo). A
+# dedicated PAT (${{ secrets.RELEASE_TOKEN }}) was the preferred option
+# for least-privilege, but creating repo-level secrets is currently
+# broken on this Forgejo instance (InsertEncryptedSecret fails with a
+# UTF-8 byte-sequence error, probably a text-vs-bytea column type on
+# the secret table). Bumping to Forgejo v16 should fix it; until then,
+# the runner-provided token keeps the workflow operational.
+#
+# Why bash + jq + curl, no third-party actions: the runner's docker
+# label points at pazof/yavsc-build-env, a Debian image with jq but
+# without Node.js or python3. Any action like actions/checkout,
+# rasterstate/forgejo-release-action, etc. fails with "executable
+# file not found in $PATH". jq is shipped in the image from
+# debian12-dotnet10-android36-v2 onward; earlier tags fell back to
+# hand-rolled JSON building via sed, which was fragile (cf. PR #30:
+# sed greedy + head -3 still matched author.id instead of the
+# release id on the minified JSON this instance returns, PATCH
+# /releases/1 → 404). Same constraint as
+# .forgejo/workflows/buildAndTest.yml.
+#
+# This workflow complements .github/workflows/docker-publish-android.yml
+# which targets the GitHub mirror; the validate-release logic mirrors
+# the GitHub-side job so the two channels stay consistent.
+name: Forgejo Release
+
+on:
+  push:
+    tags:
+      - '*'
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Tag à publier (requis en dispatch, ex. 1.0.6 ou 1.0.7-rc1).'
+        required: true
+        type: string
+      force_unstable:
+        description: 'Publier une release avec suffixe (ex. 1.0.0-rc1) malgré le fail-fast par défaut.'
+        required: false
+        type: boolean
+        default: false
+
+permissions:
+  contents: write
+
+jobs:
+  # Job unique : validation tag/CHANGELOG + build APK + publication
+  # via l'API REST Forgejo (pas d'actions tierces Node).
+  release:
+    runs-on: docker
+    steps:
+      - name: Clone du repo au tag demandé
+        env:
+          # En push tag : github.ref_name est le tag.
+          # En workflow_dispatch : on lit l'input 'tag'.
+          TAG: ${{ github.event_name == 'push' && github.ref_name || inputs.tag }}
+          FORCE_UNSTABLE: ${{ inputs.force_unstable || 'false' }}
+        run: |
+          if [[ -z "$TAG" ]]; then
+            echo "::error::No tag provided. In workflow_dispatch, set the 'tag' input."
+            exit 1
+          fi
+
+          # WORKDIR de l'image (cf. dotnet-android-build-image/Dockerfile).
+          cd /src
+
+          # Clone unshallow pour que GitVersion.MsBuild ait l'historique
+          # et les tags (sinon MSB3073 sur la cible Android cf. PR #21).
+          if [[ ! -d _src/.git ]]; then
+            git clone https://forgejo.pschneider.fr/notazof/yavsc.git _src
+          fi
+
+          cd _src
+          git fetch --tags --force --prune origin
+          git checkout "$TAG"
+
+          echo "Checked out at $(git rev-parse HEAD) on $(git describe --tags --always 2>/dev/null || echo unknown)"
+
+      - name: Valider le tag et la section CHANGELOG
+        run: |
+          cd /src/_src
+          TAG="$(git describe --tags --exact-match HEAD 2>/dev/null || git rev-parse --short HEAD)"
+          echo "Validating tag $TAG"
+
+          # Parse semver : MAJOR.MINOR.PATCH[-SUFFIX]
+          if [[ ! "$TAG" =~ ^([0-9]+)\.([0-9]+)\.([0-9]+)(-.*)?$ ]]; then
+            echo "::error::Tag '$TAG' does not match MAJOR.MINOR.PATCH[-SUFFIX] format."
+            exit 1
+          fi
+
+          MAJOR="${BASH_REMATCH[1]}"
+          MINOR="${BASH_REMATCH[2]}"
+          PATCH="${BASH_REMATCH[3]}"
+          SUFFIX="${BASH_REMATCH[4]}"
+
+          # Classification du canal par parité du patch.
+          # Patch pair + pas de suffixe -> stable.
+          # Patch impair + pas de suffixe -> preview.
+          # Suffixe présent -> instable.
+          if [[ -n "$SUFFIX" ]]; then
+            CHANNEL="unstable"
+          elif (( PATCH % 2 == 0 )); then
+            CHANNEL="stable"
+          else
+            CHANNEL="preview"
+          fi
+
+          echo "Tag $TAG classifié comme channel=$CHANNEL"
+
+          # Fail-fast sur instable sauf opt-in explicite.
+          if [[ "$CHANNEL" == "unstable" && "${FORCE_UNSTABLE:-false}" != "true" ]]; then
+            echo "::error::Tag '$TAG' is unstable (suffix '$SUFFIX'). Refusing to publish."
+            echo "Set force_unstable=true via workflow_dispatch to override."
+            exit 1
+          fi
+
+          # Lecture du CHANGELOG.md (doit exister à la racine du repo).
+          if [[ ! -f CHANGELOG.md ]]; then
+            echo "::error::CHANGELOG.md not found at repo root."
+            exit 1
+          fi
+
+          # Extraction de la section [TAG]. On cherche la première ligne
+          # commençant par '## [' qui contient '[TAG]' (entre '## [' et
+          # la prochaine ligne '## [' ou fin de fichier). awk en mode
+          # paragraphe suffit et reste POSIX. On garde aussi le titre
+          # (ligne `## [TAG] - channel`) pour la vérification du canal.
+          BODY=$(awk -v tag="[$TAG]" '
+            /^## \[/ {
+              if (in_section) exit
+              if (index($0, tag) > 0) {
+                in_section=1
+                print
+                next
+              }
+            }
+            in_section { print }
+          ' CHANGELOG.md)
+
+          if [[ -z "$BODY" ]]; then
+            echo "::error::No section matching '## [$TAG]' found in CHANGELOG.md."
+            echo "Add a '## [$TAG] - $CHANNEL' section before tagging."
+            exit 1
+          fi
+
+          # Vérification cohérence du canal déclaré dans le suffixe.
+          # Format attendu : "## [TAG] - stable" / "- preview" / "- unstable".
+          # On lit la première ligne du body qui contient le titre.
+          TITLE=$(echo "$BODY" | head -1)
+          if [[ "$TITLE" != *" - $CHANNEL"* ]]; then
+            echo "::error::Section title '$TITLE' must declare suffix '- $CHANNEL' to match tag parity."
+            exit 1
+          fi
+
+          # Body pour la release : retire la première ligne (titre).
+          BODY=$(echo "$BODY" | tail -n +2)
+
+          echo "Section CHANGELOG validée pour [$TAG] - $CHANNEL"
+
+          # Expose channel + body pour les étapes suivantes via $GITHUB_ENV.
+          echo "RELEASE_CHANNEL=$CHANNEL" >> "$GITHUB_ENV"
+          echo "RELEASE_BODY<<EOF" >> "$GITHUB_ENV"
+          echo "$BODY" >> "$GITHUB_ENV"
+          echo "EOF" >> "$GITHUB_ENV"
+          echo "IS_PRERELEASE=$([ "$CHANNEL" = "stable" ] && echo false || echo true)" >> "$GITHUB_ENV"
+
+      - name: Build des projets .NET (sans docker)
+        # L'image runner (pazof/yavsc-build-env) a le SDK .NET 10 + le
+        # workload Android, mais PAS le binaire `docker` ni de daemon
+        # Docker. On exécute donc les commandes dotnet directement
+        # au lieu de passer par `docker build`.
+        # Equivalent des stages build-env du Dockerfile (lignes
+        # restore + build Yavsc.Org + build Yavsc.Api + build
+        # Yavsc.Blogs + build PostIt.Android -r android-arm64).
+        run: |
+          cd /src/_src
+          dotnet restore
+          dotnet build src/Yavsc.Org/Yavsc.Org.csproj -c Release --no-restore -clp:ErrorsOnly
+          dotnet build src/Yavsc.Api/Yavsc.Api.csproj -c Release --no-restore -clp:ErrorsOnly
+          dotnet build src/Yavsc.Blogs/Yavsc.Blogs.csproj -c Release --no-restore -clp:ErrorsOnly
+          dotnet build src/PostIt/PostIt.Android/PostIt.Android.csproj \
+            -c Release --no-restore -clp:ErrorsOnly -r android-arm64
+
+      - name: Copier l'APK signé vers un emplacement connu
+        # Le build Android avec -r android-arm64 produit l'APK dans
+        # bin/Release/net10.0-android/android-arm64/. On le copie à
+        # la racine du checkout pour que l'étape d'upload le trouve.
+        run: |
+          cd /src/_src
+          APK=src/PostIt/PostIt.Android/bin/Release/net10.0-android/android-arm64/com.CompanyName.PostIt-Signed.apk
+          if [[ ! -f "$APK" ]]; then
+            echo "::error::APK not found at $APK"
+            ls -la src/PostIt/PostIt.Android/bin/Release/net10.0-android/ 2>/dev/null || true
+            exit 1
+          fi
+          cp "$APK" /src/_src/PostIt.Android.apk
+          ls -la /src/_src/PostIt.Android.apk
+
+      - name: Publier la release Forgejo via l'API REST
+        # Pas d'action tierce (pas de Node dans l'image runner).
+        # On parle à l'API Forgejo directement via curl.
+        # Docs : https://forgejo.pschneider.fr/api/swagger#/repository/release
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_API_URL: ${{ github.api_url }}
+          GITHUB_REPOSITORY: ${{ github.repository }}
+          TAG: ${{ github.event_name == 'push' && github.ref_name || inputs.tag }}
+          RELEASE_BODY: ${{ env.RELEASE_BODY }}
+          IS_PRERELEASE: ${{ env.IS_PRERELEASE }}
+        run: |
+          if [[ -z "$TAG" ]]; then
+            echo "::error::No tag resolved for the API call."
+            exit 1
+          fi
+
+          # Le runner Forgejo expose l'API sur github.api_url (par
+          # défaut http://…/api/v1). On retire le suffixe /api/v1 s'il
+          # est présent pour dériver la base du serveur, puis on
+          # reconstruit l'URL de l'API proprement.
+          API_BASE="${GITHUB_API_URL%/}"
+          API_BASE="${API_BASE%/api/v1}"
+
+          # Construction des bodies JSON et extraction de champs via
+          # jq. L'image runner pazof/yavsc-build-env installe jq
+          # (>= 1.7) depuis debian12-dotnet10-android36-v2. La
+          # chaîne de construction --arg/--argjson garantit un
+          # escaping correct (backslashes, guillemets, newlines,
+          # caractères de contrôle Unicode) sans avoir à le
+          # reproduire à la main.
+          #
+          # json_escape et json_field à base de sed ont vécu : le
+          # sed greedy matche la dernière occurrence d'un champ
+          # dans la ligne, et l'API renvoie sur cette instance un
+          # JSON minifié d'une seule ligne où l'id de l'auteur
+          # (1, premier user du repo) suit l'id de la release
+          # (10706). PATCH /releases/<sed-captured-id> tombait
+          # alors en 404 "The target couldn't be found". jq
+          # résout les deux problèmes en une fois.
+
+          # 1. Vérifier si la release existe déjà pour ce tag.
+          echo "::group::Check existing release for tag $TAG"
+          HTTP=$(curl -sS -o /tmp/existing.json -w '%{http_code}' \
+            -H "Authorization: token $GITHUB_TOKEN" \
+            -H "Accept: application/json" \
+            "$API_BASE/api/v1/repos/$GITHUB_REPOSITORY/releases/tags/$TAG")
+          echo "GET releases/tags/$TAG -> HTTP $HTTP"
+          EXISTING_ID=""
+          if [[ "$HTTP" == "200" ]]; then
+            EXISTING_ID=$(jq -r '.id // empty' /tmp/existing.json)
+            echo "Existing release id: ${EXISTING_ID:-none}"
+          fi
+          echo "::endgroup::"
+
+          # 2. Créer ou mettre à jour la release.
+          if [[ -n "$EXISTING_ID" ]]; then
+            echo "::group::Update release id=$EXISTING_ID"
+            jq -n \
+              --arg body "$RELEASE_BODY" \
+              --argjson prerelease "$IS_PRERELEASE" \
+              '{body: $body, prerelease: $prerelease}' \
+              > /tmp/patch.json
+            HTTP=$(curl -sS -o /tmp/release.json -w '%{http_code}' \
+              -X PATCH \
+              -H "Authorization: token $GITHUB_TOKEN" \
+              -H "Content-Type: application/json" \
+              -H "Accept: application/json" \
+              --data-binary @/tmp/patch.json \
+              "$API_BASE/api/v1/repos/$GITHUB_REPOSITORY/releases/$EXISTING_ID")
+            echo "PATCH release -> HTTP $HTTP"
+            echo "::endgroup::"
+          else
+            echo "::group::Create release"
+            jq -n \
+              --arg tag "$TAG" \
+              --arg name "$TAG" \
+              --arg body "$RELEASE_BODY" \
+              --argjson prerelease "$IS_PRERELEASE" \
+              '{tag_name: $tag, name: $name, body: $body, prerelease: $prerelease}' \
+              > /tmp/post.json
+            HTTP=$(curl -sS -o /tmp/release.json -w '%{http_code}' \
+              -X POST \
+              -H "Authorization: token $GITHUB_TOKEN" \
+              -H "Content-Type: application/json" \
+              -H "Accept: application/json" \
+              --data-binary @/tmp/post.json \
+              "$API_BASE/api/v1/repos/$GITHUB_REPOSITORY/releases")
+            echo "POST release -> HTTP $HTTP"
+            echo "::endgroup::"
+          fi
+
+          if [[ "$HTTP" != "200" && "$HTTP" != "201" ]]; then
+            echo "::error::Release creation/update failed (HTTP $HTTP):"
+            cat /tmp/release.json
+            exit 1
+          fi
+
+          RELEASE_ID=$(jq -r '.id' /tmp/release.json)
+          echo "Release id=$RELEASE_ID"
+
+          # 3. Upload l'APK en asset.
+          # Le nom du fichier passe en query string (?name=...), pas
+          # en argument positionnel entre --data-binary et l'URL :
+          # sinon curl l'interprète comme un second fichier d'input
+          # (un fichier nommé '?name=PostIt.Android.apk') et l'API
+          # Forgejo renvoie 400 "Missing 'name' parameter".
+          echo "::group::Upload APK asset"
+          HTTP=$(curl -sS -o /tmp/asset.json -w '%{http_code}' \
+            -X POST \
+            -H "Authorization: token $GITHUB_TOKEN" \
+            -H "Content-Type: application/octet-stream" \
+            -H "Accept: application/json" \
+            --data-binary "@/src/_src/PostIt.Android.apk" \
+            "$API_BASE/api/v1/repos/$GITHUB_REPOSITORY/releases/$RELEASE_ID/assets?name=PostIt.Android.apk")
+          echo "POST asset -> HTTP $HTTP"
+          echo "::endgroup::"
+
+          if [[ "$HTTP" != "201" ]]; then
+            echo "::error::Asset upload failed (HTTP $HTTP):"
+            cat /tmp/asset.json
+            exit 1
+          fi
+
+          echo "Release publiée: $API_BASE/$GITHUB_REPOSITORY/releases/tag/$TAG"

.github/workflows/docker-publish-android.yml

@@ -129,12 +129,12 @@ jobs:
             exit 1
           fi
 
-          # Vérification cohérence du canal déclaré dans le suffixe.
+          # Vérification cohérence du canal déclaré dans le titre de section.
           # Format attendu : "## [TAG] - stable" / "- preview" / "- unstable".
-          if [[ "$BODY" != *" - $CHANNEL"* ]]; then
+          HEADER=$(grep -m1 "^## \[$TAG\]" CHANGELOG.md)
+          if [[ "$HEADER" != *" - $CHANNEL"* ]]; then
             echo "::error::Section '## [$TAG]' must declare suffix '- $CHANNEL' to match tag parity."
-            echo "Current section body (first 5 lines):"
+            echo "Current section header: $HEADER"
-            echo "$BODY" | head -5
             exit 1
           fi
 

CHANGELOG.md

@@ -31,9 +31,13 @@ pour la production des paquets `.deb`.
 ### Added
 - Self-hosted Forgejo Actions runner now drives the CI build for the
   yavsc repository, using the
-  `pazof/yavsc-build-env:debian12-dotnet10-android36-v1` image pulled
+  `pazof/yavsc-build-env:debian12-dotnet10-android36-v2` image pulled
   from Docker Hub. Workflow runs end-to-end: clone, restore, build,
   test, with NuGet.config picking up the `isn.pschneider.fr` feed.
+- The build-env image now ships `jq` (Debian package, ≥ 1.7), so the
+  release workflow can build JSON bodies and parse API responses
+  without a hand-rolled `sed`-based extractor that was matching the
+  wrong `id` field on minified responses.
 
 ### Changed
 - CI workflow `.forgejo/workflows/buildAndTest.yml` no longer relies on
@@ -47,6 +51,12 @@ pour la production des paquets `.deb`.
   Actions APK build (`--allow-insecure-connections` on an HTTPS
   endpoint, exit 1). `NuGet.config` at the repo root supplies the
   `isn.pschneider.fr` feed for every restore, including inside Docker.
+- `.forgejo/workflows/release.yml`: PATCH on `/releases/{id}` no longer
+  404s on existing releases. The previous `sed`-based `json_field`
+  matched the last `id` on the line (the author's), so it tried to
+  PATCH `/releases/1` (the first user of the instance) instead of the
+  actual release id. Switched to `jq` for both body construction and
+  field extraction.
 
 [Unreleased]: https://github.com/pazof/yavsc/compare/HEAD
 [1.0.6]: https://github.com/pazof/yavsc/compare/1.0.5...1.0.6

src/PostIt.Tests/BearerScopeTests.cs

@@ -8,6 +8,9 @@ using System.Text;
 using System.Text.Json;
 using System.Threading;
 using System.Threading.Tasks;
+using Yavsc.Blogspot;
+using Yavsc.Api.Client;
+using PostIt.Services;
 using PostIt.Services;
 using Xunit;
 
@@ -94,7 +97,7 @@ public class BearerScopeTests
             // CapturingHttpHandler is the assertion point. It
             // records the first request's Authorization header and
             // returns 200 with an empty array (BlogApiClient
-            // deserialises to List<BlogPost>).
+            // deserialises to List<BlogPostDto>).
             var captured = new CapturingHttpHandler();
             var client = new YavscApiClient(
                 settings,
@@ -119,7 +122,7 @@ public class BearerScopeTests
             // Resolve a BlogApiClient on top. We don't need real
             // posts; we just need the outbound HTTP request to be
             // the one we capture.
-            var blog = new BlogApiClient(subClient);
+            var blog = new BlogApiClient(subClient, "http://localhost/");
 
             await blog.GetPostsAsync(ct: TestContext.Current.CancellationToken);
 

src/PostIt.Tests/BlogApiTestFakes.cs

@@ -1,4 +1,4 @@
-using PostIt.Models;
+using Yavsc.Blogspot;
 using PostIt.Services;
 using PostIt.ViewModels;
 using Yavsc.Models;
@@ -18,7 +18,7 @@ internal sealed class CallRecorder
 
 /// <summary>Test fake that records every CallAsync invocation
 /// and answers them with a canned sequence: the first call gets
-/// a server-issued BlogPost (Id=42), the second call gets a
+/// a server-issued BlogPostDto (Id=42), the second call gets a
 /// single-element list containing that post. Used by the ViewModel
 /// tests and the headless UI test to capture exactly what the
 /// Save button posts to the server.</summary>
@@ -44,20 +44,20 @@ internal sealed class RecordingYavscApiClient : YavscApiClient
     public override Task<T> CallAsync<T>(HttpMethod method, string path, object? body = null, CancellationToken ct = default)
     {
         _recorder.Calls.Add((method, path, body));
-        // BlogPost? boxes to BlogPost at runtime, so we test the
+        // BlogPostDto? boxes to BlogPostDto at runtime, so we test the
-        // non-nullable type — typeof(BlogPost?) is a C# error
+        // non-nullable type — typeof(BlogPostDto?) is a C# error
         // (CS8639: "typeof cannot be used on a nullable reference
         // type").
-        if (typeof(T) == typeof(BlogPost))
+        if (typeof(T) == typeof(BlogPostDto))
-            return Task.FromResult((T)(object)new BlogPost
+            return Task.FromResult((T)(object)new BlogPostDto
             {
                 Id = 42,
                 Title = "Mon premier billet",
                 AuthorId = "tester",
                 Article = "Contenu du billet de test.",
             });
-        if (typeof(T) == typeof(List<BlogPost>))
+        if (typeof(T) == typeof(List<BlogPostDto>))
-            return Task.FromResult((T)(object)new List<BlogPost>
+            return Task.FromResult((T)(object)new List<BlogPostDto>
             {
                 new() { Id = 42, Title = "Mon premier billet" }
             });

src/PostIt.Tests/MainPageSaveTests.cs

@@ -2,7 +2,8 @@ using Avalonia;
 using Avalonia.Controls;
 using Avalonia.Headless.XUnit;
 using Avalonia.VisualTree;
-using PostIt.Models;
+using Yavsc.Blogspot;
+using Yavsc.Api.Client;
 using PostIt.Services;
 using PostIt.ViewModels;
 using PostIt.Views;
@@ -24,7 +25,7 @@ namespace PostIt.Tests;
 /// in which a brand-new post can be created), the binding has
 /// no target and the user's keystrokes are silently dropped.
 /// Clicking "Save" then routes to the VM branch
-/// <c>if (SelectedPost is null) { new BlogPost { Title = string.Empty, ... } }</c>
+/// <c>if (SelectedPost is null) { new BlogPostDto { Title = string.Empty, ... } }</c>
 /// which the controller rejects with 400 "The Title field is
 /// required." This test fails on that branch today and will
 /// pass once the VM owns a dedicated <c>Title</c>/<c>Article</c>
@@ -40,7 +41,7 @@ public class MainPageSaveTests
         // not a Control, so it needs a navigation host).
         var recorder = new CallRecorder();
         var api = new RecordingYavscApiClient(recorder);
-        var blog = new BlogApiClient(api);
+        var blog = new BlogApiClient(api, "http://localhost/");
         var viewModel = new MainPageViewModel(blog);
 
         var page = new MainPage { DataContext = viewModel };
@@ -76,14 +77,14 @@ public class MainPageSaveTests
         // we inspect the recorder.
         await Task.Delay(200);
 
-        // Assert: the first POST to "blog" carried a BlogPost
+        // Assert: the first POST to "blog" carried a BlogPostDto
         // whose Title is exactly what the user typed. The bug
         // fails this assertion with Title == string.Empty.
         Assert.NotEmpty(recorder.Calls);
         var (method, path, body) = recorder.FirstCall;
         Assert.Equal(HttpMethod.Post, method);
         Assert.Equal("blog", path);
-        var sent = Assert.IsType<BlogPost>(body);
+        var sent = Assert.IsType<BlogPostDto>(body);
         Assert.Equal(typed, sent.Title);
     }
 }

src/PostIt.Tests/PostItViewModelTests.cs

@@ -1,4 +1,5 @@
-using PostIt.Models;
+using Yavsc.Blogspot;
+using Yavsc.Api.Client;
 using PostIt.Services;
 using PostIt.ViewModels;
 
@@ -14,12 +15,12 @@ public class PostItViewModelTests
         // default; tests construct one with a fake YavscApiClient that
         // throws on any call (we never call the API in this test).
         var fakeApi = new ThrowingYavscApiClient();
-        var blog = new BlogApiClient(fakeApi);
+        var blog = new BlogApiClient(fakeApi, "http://localhost/");
         var viewModel = new MainPageViewModel(blog);
 
-        viewModel.Posts.Add(new BlogPost { Id = 1, Title = "First post", Article = "Hello world", AuthorId = "alice" });
+        viewModel.Posts.Add(new BlogPostDto { Id = 1, Title = "First post", Article = "Hello world", AuthorId = "alice" });
-        viewModel.Posts.Add(new BlogPost { Id = 2, Title = "Second post", Article = "Nothing here", AuthorId = "bob" });
+        viewModel.Posts.Add(new BlogPostDto { Id = 2, Title = "Second post", Article = "Nothing here", AuthorId = "bob" });
-        viewModel.Posts.Add(new BlogPost { Id = 3, Title = "Third post", Article = "Search me", AuthorId = "carol" });
+        viewModel.Posts.Add(new BlogPostDto { Id = 3, Title = "Third post", Article = "Search me", AuthorId = "carol" });
 
         viewModel.SearchText = "search";
         viewModel.SearchCommand.Execute(null);
@@ -40,13 +41,13 @@ public class PostItViewModelTests
         // The new BlogApiClient delegates transport to YavscApiClient.
         // We feed it a fake YavscApiClient that returns the expected
         // list straight from CallAsync.
-        var expected = new List<BlogPost>
+        var expected = new List<BlogPostDto>
         {
             new() { Id = 1, Title = "Hello" },
             new() { Id = 2, Title = "World" }
         };
         var api = new StubYavscApiClient(expected);
-        var blog = new BlogApiClient(api);
+        var blog = new BlogApiClient(api, "http://localhost/");
 
         var posts = await blog.GetPostsAsync();
 
@@ -76,8 +77,8 @@ public class PostItViewModelTests
     /// <summary>Test fake that hands back a canned list of posts from any CallAsync.</summary>
     private sealed class StubYavscApiClient : YavscApiClient
     {
-        private readonly List<BlogPost> _posts;
+        private readonly List<BlogPostDto> _posts;
-        public StubYavscApiClient(List<BlogPost> posts)
+        public StubYavscApiClient(List<BlogPostDto> posts)
             : base(
                 new Settings
                 {
@@ -97,7 +98,7 @@ public class PostItViewModelTests
         {
             // The canned fake only knows about a list of posts; the
             // BlogApiClient test asserts on that list directly.
-            if (typeof(T) == typeof(List<BlogPost>))
+            if (typeof(T) == typeof(List<BlogPostDto>))
                 return Task.FromResult((T)(object)_posts);
             return Task.FromResult(default(T)!);
         }

src/PostIt.Tests/YavscApiClientTests.cs

@@ -8,6 +8,9 @@ using System.Net.Sockets;
 using System.Text;
 using System.Text.Json;
 using System.Threading;
+using Yavsc.Blogspot;
+using Yavsc.Api.Client;
+using PostIt.Services;
 using System.Threading.Tasks;
 using IdentityModel.OidcClient;
 using IdentityModel.OidcClient.Browser;

src/PostIt/Directory.Packages.props

@@ -14,6 +14,7 @@
     <PackageVersion Include="CommunityToolkit.Mvvm" Version="8.4.2" />
     <PackageVersion Include="Material.Avalonia" Version="3.17.0" />
     <PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="10.0.9" />
+    <PackageVersion Include="Microsoft.Maui.Essentials" Version="10.0.90" />
     <PackageVersion Include="Xamarin.AndroidX.Browser" Version="1.8.0" />
     <PackageVersion Include="Xamarin.AndroidX.Core.SplashScreen" Version="1.2.0" />
   </ItemGroup>

src/PostIt/PostIt/App.axaml.cs

@@ -7,6 +7,7 @@ using Avalonia.Controls.ApplicationLifetimes;
 using Avalonia.Markup.Xaml;
 using Avalonia.Styling;
 using PostIt.Services;
+using Yavsc.Api.Client;
 using PostIt.ViewModels;
 using PostIt.Views;
 
@@ -55,7 +56,11 @@ public partial class App : Application
             "PostIt", "tokens.json"));
 
         var api = new YavscApiClient(settings, tokenStore);
-        var client = new BlogApiClient(api);
+        var client = new BlogApiClient(api, settings.BlogsApiUrl);
+        var circleClient = new CircleApiClient(api, settings.BlogsApiUrl);
+        var blogAclClient = new BlogAclApiClient(api, settings.BlogsApiUrl);
+        var userSearchClient = new UserSearchClient(api, settings.BlogsApiUrl);
+        var contactService = new ContactService(userSearchClient);
 
         var services = new ServiceCollection();
 
@@ -75,14 +80,21 @@ public partial class App : Application
         services.AddSingleton<SettingsPage>();
         services.AddTransient<HomePage>();
         services.AddTransient<SignaturePage>();
+        services.AddTransient<CirclesPage>();
 
         // ViewModels
         services.AddSingleton(settings);
-        services.AddSingleton(api);
+        services.AddSingleton<YavscApiClient>(api);
+        services.AddSingleton<IYavscApiClient>(api);
         services.AddSingleton(client);
+        services.AddSingleton(circleClient);
+        services.AddSingleton(blogAclClient);
+        services.AddSingleton(userSearchClient);
+        services.AddSingleton<IContactService>(contactService);
         services.AddTransient<MainPageViewModel>();
         services.AddTransient<HomePageViewModel>();
         services.AddTransient<SignaturePageViewModel>();
+        services.AddTransient<CirclesPageViewModel>();
 
         // Persistent session banner: one instance for the lifetime of
         // the app so the same VM survives page navigation.

src/PostIt/PostIt/PostIt.csproj

@@ -25,6 +25,7 @@
     <PackageReference Include="IdentityModel.OidcClient" />
     <PackageReference Include="Microsoft.Extensions.DependencyInjection" />
     <ProjectReference Include="../../Yavsc.Abstract/Yavsc.Abstract.csproj" />
+    <ProjectReference Include="../../Yavsc.Api.Client/Yavsc.Api.Client.csproj" />
   </ItemGroup>
   <ItemGroup>
     <Content Include="postit-settings.json">

src/PostIt/PostIt/Services/ContactService.Desktop.cs

@@ -0,0 +1,72 @@
+#if !ANDROID && !IOS
+using System;
+using System.Collections.Generic;
+using System.Collections.ObjectModel;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Yavsc.Api.Client;
+using Yavsc.Api.Client.Dtos;
+
+namespace PostIt.Services;
+
+/// <summary>
+/// Desktop implementation of <see cref="IContactService"/> backed
+/// by the central <c>/api/user-search</c> endpoint
+/// (<see cref="UserSearchClient"/>).
+///
+/// <para>Desktop has no equivalent of the mobile address book
+/// (no Contacts.Default, no CardDAV out of the box), so the
+/// address book is built on demand from the Yavsc user table.
+/// Results are accumulated in an in-memory cache exposed as
+/// <see cref="Contacts"/>; the cache is process-lifetime only
+/// — there's no persistence layer.</para>
+///
+/// <para>This is the consumer that closes the loop with the
+/// user-search endpoint landed on the server in commit 6
+/// (<c>b3056f1c</c>) and the client in commit 7
+/// (<c>6e7e0414</c>).</para>
+/// </summary>
+public sealed class ContactService : IContactService
+{
+    private readonly UserSearchClient _client;
+
+    public ObservableCollection<ContactDto> Contacts { get; } = new();
+
+    public ContactService(UserSearchClient client)
+    {
+        _client = client ?? throw new ArgumentNullException(nameof(client));
+    }
+
+    public Task<IReadOnlyList<ContactDto>> GetDeviceContactsAsync(CancellationToken ct = default)
+        => Task.FromResult<IReadOnlyList<ContactDto>>(Contacts.ToArray());
+
+    public async Task SearchAsync(string query, CancellationToken ct = default)
+    {
+        if (string.IsNullOrWhiteSpace(query))
+        {
+            // Clear the cache to mirror an empty result. The
+            // address-book UX treats an empty query as "start
+            // over".
+            Contacts.Clear();
+            return;
+        }
+
+        var results = await _client.SearchAsync(query: query, ct: ct).ConfigureAwait(false);
+        if (results is null) return;
+
+        // Append the search results to the cache. We don't
+        // de-dupe across searches — the simplest behaviour, and
+        // matches what users expect from a search panel ("show
+        // me what came back"). Callers wanting a single list
+        // can re-render Contacts on the next query.
+        foreach (var u in results)
+        {
+            Contacts.Add(new ContactDto(
+                Id: u.Id,
+                DisplayName: u.FullName ?? u.UserName,
+                Email: u.Email));
+        }
+    }
+}
+#endif

src/PostIt/PostIt/Services/ContactService.Mobile.cs

@@ -0,0 +1,81 @@
+#if ANDROID || IOS
+using System;
+using System.Collections.Generic;
+using System.Collections.ObjectModel;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Maui.ApplicationModel.Communication;
+using Microsoft.Maui.ApplicationModel;
+using Microsoft.Maui.Devices;
+
+namespace PostIt.Services;
+
+/// <summary>
+/// Mobile implementation backed by MAUI Essentials Contacts.Default.
+///
+/// Compiled only for ANDROID and IOS. On desktop targets, see
+/// ContactService.Desktop.cs (the stub that wins at compile time).
+///
+/// Note: at runtime, this class throws
+/// NotImplementedInReferenceAssemblyException unless the host
+/// application project also references the platform-specific
+/// Microsoft.Maui.Essentials implementation (typically the
+/// PostIt.Android project). On iOS the same is required via
+/// PostIt.iOS. On desktop the stub is used and this file is excluded.
+/// </summary>
+public sealed class ContactService : IContactService
+{
+    public ObservableCollection<ContactDto> Contacts { get; } = new();
+
+    public async Task<IReadOnlyList<ContactDto>> GetDeviceContactsAsync(CancellationToken ct = default)
+    {
+        if (DeviceInfo.Current.Platform == DevicePlatform.Unknown)
+            return Array.Empty<ContactDto>();
+
+        try
+        {
+            var status = await Permissions.RequestAsync<Permissions.ContactsRead>();
+            if (status != PermissionStatus.Granted)
+                return Array.Empty<ContactDto>();
+
+            var contacts = await Contacts.Default.GetAllAsync();
+            if (contacts is null) return Array.Empty<ContactDto>();
+
+            // Flatten the per-contact email list down to one
+            // primary email. The platform-neutral ContactDto only
+            // carries one; the use case ("invite / add to a
+            // circle") only needs one. The first non-empty entry
+            // wins.
+            Contacts.Clear();
+            foreach (var c in contacts)
+            {
+                var email = FlattenPrimaryEmail(c.Emails);
+                Contacts.Add(new ContactDto(c.Id, c.DisplayName ?? string.Empty, email));
+            }
+            return Contacts.ToArray();
+        }
+        catch (Exception ex)
+        {
+            System.Diagnostics.Debug.WriteLine($"ContactService: {ex.Message}");
+            return Array.Empty<ContactDto>();
+        }
+    }
+
+    public Task SearchAsync(string query, CancellationToken ct = default)
+        => throw new PlatformNotSupportedException(
+            "SearchAsync is not supported on mobile — use GetDeviceContactsAsync " +
+            "to load the local address book. The network search lives on the " +
+            "desktop service, which queries the central user-search endpoint.");
+
+    private static string? FlattenPrimaryEmail(IEnumerable<EmailAddress>? emails)
+    {
+        if (emails is null) return null;
+        foreach (var e in emails)
+        {
+            if (!string.IsNullOrEmpty(e.EmailAddress))
+                return e.EmailAddress;
+        }
+        return null;
+    }
+}
+#endif

src/PostIt/PostIt/Services/IContactService.cs

@@ -0,0 +1,61 @@
+using System;
+using System.Collections.Generic;
+using System.Collections.ObjectModel;
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace PostIt.Services;
+
+/// <summary>
+/// Abstraction over device contact providers (MAUI Essentials on
+/// mobile, the central /api/user-search endpoint on desktop).
+///
+/// Implementations live next to this file in platform-conditional
+/// source files: ContactService.Mobile.cs (ANDROID/IOS) and
+/// ContactService.Desktop.cs (everything else).
+/// </summary>
+public interface IContactService
+{
+    /// <summary>
+    /// Returns the contacts known so far. On mobile this is the
+    /// full device address book (after permission grant); on
+    /// desktop this is the in-memory cache populated by previous
+    /// <see cref="SearchAsync"/> calls — empty until the user
+    /// has searched for something.
+    /// </summary>
+    Task<IReadOnlyList<ContactDto>> GetDeviceContactsAsync(CancellationToken ct = default);
+
+    /// <summary>
+    /// On desktop: hits <c>GET /api/user-search?q=…</c> and
+    /// appends matching users to the in-memory cache exposed via
+    /// <see cref="Contacts"/>. On mobile: throws
+    /// <see cref="PlatformNotSupportedException"/> — the mobile
+    /// provider uses the device-local address book, not a
+    /// network search.
+    /// </summary>
+    Task SearchAsync(string query, CancellationToken ct = default);
+
+    /// <summary>
+    /// Live view of the in-memory contact cache. UI binds to
+    /// this directly for a \"search results\" panel; on mobile
+    /// implementations this is populated eagerly by
+    /// <see cref="GetDeviceContactsAsync"/>.
+    /// </summary>
+    ObservableCollection<ContactDto> Contacts { get; }
+}
+
+/// <summary>
+/// Platform-neutral contact DTO. Source-of-truth shape for the UI
+/// layer; concrete providers (MAUI Essentials on mobile,
+/// UserSearchClient on desktop) map to this type.
+///
+/// <para><c>Email</c> is a single string on purpose: the central
+/// search endpoint returns one email per user, and the UI use
+/// case is \"pick someone to invite / add to a circle\", which
+/// never needs more than one. Multi-email contacts on mobile
+/// flatten to the primary address (first non-empty).</para>
+/// </summary>
+public sealed record ContactDto(
+    string Id,
+    string DisplayName,
+    string? Email);

src/PostIt/PostIt/Services/YavscApiClient.cs

@@ -9,6 +9,7 @@ using System.Threading;
 using System.Threading.Tasks;
 using IdentityModel.OidcClient;
 using PostIt.ViewModels;
+using Yavsc.Api.Client;
 
 namespace PostIt.Services;
 
@@ -24,7 +25,7 @@ namespace PostIt.Services;
 /// <see cref="BearerTokenHandler"/> only refreshes once even if many
 /// concurrent requests are in flight.
 /// </summary>
-public class YavscApiClient : IAsyncDisposable
+public class YavscApiClient : IYavscApiClient, IAsyncDisposable
 {
     // 60s of slack before the access_token's nominal expiry. Covers
     // network latency + JWT validation on the server side.

src/PostIt/PostIt/ViewModels/CirclesPageViewModel.cs

@@ -0,0 +1,155 @@
+using System;
+using System.Collections.ObjectModel;
+using System.Threading.Tasks;
+using CommunityToolkit.Mvvm.ComponentModel;
+using CommunityToolkit.Mvvm.Input;
+using Yavsc.Api.Client;
+using Yavsc.Api.Client.Dtos;
+
+namespace PostIt.ViewModels;
+
+/// <summary>
+/// View model for the "Mes cercles" page. CRUD on the caller's own
+/// circles (the server scopes every endpoint to the caller's uid
+/// since the BlogAcl fix on this branch).
+///
+/// <para>The view lists circles in <see cref="Circles"/>, supports
+/// create / edit via <see cref="DraftName"/>, and exposes
+/// per-item Delete and per-item edit commands. <see cref="IsBusy"/>
+/// drives a progress overlay during API calls; <see cref="StatusMessage"/>
+/// surfaces success / error feedback in the view footer.</para>
+/// </summary>
+public partial class CirclesPageViewModel : ViewModelBase
+{
+    private readonly CircleApiClient _client;
+
+    [ObservableProperty]
+    public partial ObservableCollection<CircleDto> Circles { get; set; } = new();
+
+    [ObservableProperty]
+    public partial CircleDto? SelectedCircle { get; set; }
+
+    /// <summary>Editor buffer for the new / edited circle's name.</summary>
+    [ObservableProperty]
+    public partial string DraftName { get; set; } = string.Empty;
+
+    /// <summary>Editor buffer for the new / edited circle's visibility flag.</summary>
+    [ObservableProperty]
+    public partial bool DraftPublic { get; set; }
+
+    [ObservableProperty]
+    public partial bool IsBusy { get; set; }
+
+    [ObservableProperty]
+    public partial string StatusMessage { get; set; } = string.Empty;
+
+    public CirclesPageViewModel(CircleApiClient client)
+    {
+        _client = client ?? throw new ArgumentNullException(nameof(client));
+    }
+
+    public override bool CanNavigateNext { get => throw new NotImplementedException(); protected set => throw new NotImplementedException(); }
+    public override bool CanNavigatePrevious { get => throw new NotImplementedException(); protected set => throw new NotImplementedException(); }
+
+    [RelayCommand]
+    public async Task RefreshAsync()
+    {
+        IsBusy = true;
+        try
+        {
+            var list = await _client.GetMyCirclesAsync();
+            Circles = new ObservableCollection<CircleDto>(list ?? new());
+            StatusMessage = $"{Circles.Count} cercle(s)";
+        }
+        catch (Exception ex)
+        {
+            StatusMessage = $"Erreur: {ex.Message}";
+        }
+        finally
+        {
+            IsBusy = false;
+        }
+    }
+
+    [RelayCommand]
+    public void StartCreate()
+    {
+        SelectedCircle = null;
+        DraftName = string.Empty;
+        DraftPublic = false;
+        StatusMessage = "Nouveau cercle";
+    }
+
+    [RelayCommand]
+    public void StartEdit(CircleDto? circle)
+    {
+        if (circle is null) return;
+        SelectedCircle = circle;
+        DraftName = circle.Name;
+        DraftPublic = circle.Public;
+        StatusMessage = $"Édition de « {circle.Name} »";
+    }
+
+    [RelayCommand]
+    public async Task SaveAsync()
+    {
+        if (string.IsNullOrWhiteSpace(DraftName))
+        {
+            StatusMessage = "Le nom est obligatoire";
+            return;
+        }
+
+        IsBusy = true;
+        try
+        {
+            if (SelectedCircle is null)
+            {
+                var created = await _client.CreateCircleAsync(new CircleDto
+                {
+                    Name = DraftName.Trim(),
+                    Public = DraftPublic,
+                });
+                StatusMessage = created is null
+                    ? "Création échouée"
+                    : $"Cercle « {created.Name} » créé";
+            }
+            else
+            {
+                SelectedCircle.Name = DraftName.Trim();
+                SelectedCircle.Public = DraftPublic;
+                await _client.UpdateCircleAsync(SelectedCircle.Id, SelectedCircle);
+                StatusMessage = $"Cercle « {SelectedCircle.Name} » mis à jour";
+            }
+            await RefreshAsync();
+        }
+        catch (Exception ex)
+        {
+            StatusMessage = $"Erreur: {ex.Message}";
+        }
+        finally
+        {
+            IsBusy = false;
+        }
+    }
+
+    [RelayCommand]
+    public async Task DeleteAsync(CircleDto? circle)
+    {
+        if (circle is null) return;
+        IsBusy = true;
+        try
+        {
+            await _client.DeleteCircleAsync(circle.Id);
+            StatusMessage = $"Cercle « {circle.Name} » supprimé";
+            await RefreshAsync();
+        }
+        catch (Exception ex)
+        {
+            StatusMessage = $"Erreur: {ex.Message}";
+        }
+        finally
+        {
+            IsBusy = false;
+        }
+    }
+}

src/PostIt/PostIt/ViewModels/MainPageViewModel.cs

@@ -4,7 +4,8 @@ using System.Linq;
 using System.Threading.Tasks;
 using CommunityToolkit.Mvvm.ComponentModel;
 using CommunityToolkit.Mvvm.Input;
-using PostIt.Models;
+using Yavsc.Blogspot;
+using Yavsc.Api.Client;
 using PostIt.Services;
 
 namespace PostIt.ViewModels;
@@ -24,7 +25,7 @@ public partial class MainPageViewModel : ViewModelBase
     /// previous "{Binding SelectedPost.Title}" binding, the user's
     /// keystrokes were silently dropped whenever
     /// <c>SelectedPost was null</c>, which made the editor a trap
-    /// and caused Save to POST a <c>BlogPost</c> with an empty
+    /// and caused Save to POST a <c>BlogPostDto</c> with an empty
     /// title — hence the 400 "The Title field is required".</summary>
     [ObservableProperty]
     public partial string DraftTitle { get; set; }
@@ -46,13 +47,13 @@ public partial class MainPageViewModel : ViewModelBase
     public partial string SearchText { get; set; }
 
     [ObservableProperty]
-    public partial ObservableCollection<BlogPost> Posts { get; set; }
+    public partial ObservableCollection<BlogPostDto> Posts { get; set; }
 
     [ObservableProperty]
-    public partial ObservableCollection<BlogPost> FilteredPosts { get; set; }
+    public partial ObservableCollection<BlogPostDto> FilteredPosts { get; set; }
 
     [ObservableProperty]
-    public partial BlogPost? SelectedPost { get; set; }
+    public partial BlogPostDto? SelectedPost { get; set; }
 
     [ObservableProperty]
     public partial bool IsBusy { get; set; }
@@ -82,8 +83,8 @@ public partial class MainPageViewModel : ViewModelBase
     private void Init(Settings? settings)
     {
         SearchText = string.Empty;
-        Posts = new ObservableCollection<BlogPost>();
+        Posts = new ObservableCollection<BlogPostDto>();
-        FilteredPosts = new ObservableCollection<BlogPost>();
+        FilteredPosts = new ObservableCollection<BlogPostDto>();
         SelectedPost = null;
         IsBusy = false;
         StatusMessage = "Ready";
@@ -119,7 +120,7 @@ public partial class MainPageViewModel : ViewModelBase
 
     partial void OnSearchTextChanged(string value) => ApplyFilter();
 
-    partial void OnSelectedPostChanged(BlogPost? value)
+    partial void OnSelectedPostChanged(BlogPostDto? value)
     {
         // Mirror the selection into the editor buffer so the
         // XAML-bound TextBox/TextEditor show the right content
@@ -176,7 +177,7 @@ public partial class MainPageViewModel : ViewModelBase
 
         await ExecuteAsync(async () =>
         {
-            // Build a fresh BlogPost from the editor buffer on
+            // Build a fresh BlogPostDto from the editor buffer on
             // every Save — we no longer mutate SelectedPost in
             // place. The previous behaviour copied the buffer
             // (which was a no-op when SelectedPost was null)
@@ -188,7 +189,7 @@ public partial class MainPageViewModel : ViewModelBase
             // the update path.
             if (SelectedPost is null || SelectedPost.Id == 0)
             {
-                var draft = new BlogPost
+                var draft = new BlogPostDto
                 {
                     Title = DraftTitle,
                     Article = DraftArticle ?? string.Empty,
@@ -204,7 +205,7 @@ public partial class MainPageViewModel : ViewModelBase
             }
             else
             {
-                var update = new BlogPost
+                var update = new BlogPostDto
                 {
                     Id = SelectedPost.Id,
                     AuthorId = SelectedPost.AuthorId,
@@ -316,4 +317,32 @@ public partial class MainPageViewModel : ViewModelBase
     /// forced the buggy "draft with empty title" branch.</summary>
     private bool CanSave() => !IsBusy && !string.IsNullOrWhiteSpace(DraftTitle);
     private bool CanDelete() => SelectedPost is not null && SelectedPost.Id != 0 && !IsBusy;
+    private bool CanManageAcl() => SelectedPost is not null && SelectedPost.Id != 0 && !IsBusy;
+
+    /// <summary>
+    /// Raised when the user asks to open the "manage ACL" dialog for
+    /// the currently selected post. The <c>MainPage</c> code-behind
+    /// listens to this event and pushes a <c>PostAclDialog</c> on the
+    /// navigation stack. The VM itself can't navigate directly
+    /// because the navigation surface (<c>NavigationPage</c>) lives
+    /// in the View layer.
+    /// </summary>
+    public event EventHandler<BlogPostDto>? ManageAclRequested;
+
+    [RelayCommand(CanExecute = nameof(CanManageAcl))]
+    public void ManageAcl()
+    {
+        if (SelectedPost is null) return;
+        ManageAclRequested?.Invoke(this, SelectedPost);
+    }
+
+    /// <summary>
+    /// Raised when the user asks to open the circles page (full
+    /// CRUD on their own circles). Same routing as
+    /// <see cref="ManageAclRequested"/>.
+    /// </summary>
+    public event EventHandler? OpenCirclesRequested;
+
+    [RelayCommand]
+    public void OpenCircles() => OpenCirclesRequested?.Invoke(this, EventArgs.Empty);
 }

src/PostIt/PostIt/ViewModels/PostAclDialogViewModel.cs

@@ -0,0 +1,157 @@
+using System;
+using System.Collections.Generic;
+using System.Collections.ObjectModel;
+using System.Linq;
+using System.Threading.Tasks;
+using CommunityToolkit.Mvvm.ComponentModel;
+using CommunityToolkit.Mvvm.Input;
+using Yavsc.Blogspot;
+using Yavsc.Api.Client;
+using Yavsc.Api.Client.Dtos;
+
+namespace PostIt.ViewModels;
+
+/// <summary>
+/// View model for the "Gérer l'ACL" modal of a single blog post.
+///
+/// <para>Loads the caller's circles once on construct (the dropdown
+/// only shows circles the user owns), then keeps an in-memory list
+/// of the ACL entries for the post. <see cref="AddAsync"/> /
+/// <see cref="RevokeAsync"/> are the only mutating verbs; both
+/// refresh the list afterwards so the UI stays in sync with the
+/// server.</para>
+///
+/// <para>The server is the source of truth: it scopes every
+/// endpoint to the caller's uid and rejects ACL grants on posts
+/// the caller doesn't own. This VM does not re-validate that —
+/// any 403 / 404 will surface as an exception caught by the
+/// command and routed to <see cref="StatusMessage"/>.</para>
+/// </summary>
+public partial class PostAclDialogViewModel : ViewModelBase
+{
+    private readonly BlogAclApiClient _aclClient;
+    private readonly CircleApiClient _circleClient;
+
+    /// <summary>The post whose ACL is being edited. Set by the
+    /// caller (MainPage) when opening the dialog.</summary>
+    public BlogPostDto Post { get; }
+
+    [ObservableProperty]
+    public partial ObservableCollection<CircleDto> MyCircles { get; set; } = new();
+
+    [ObservableProperty]
+    public partial ObservableCollection<CircleAuthorizationDto> AclEntries { get; set; } = new();
+
+    [ObservableProperty]
+    public partial CircleDto? SelectedCircleToAdd { get; set; }
+
+    [ObservableProperty]
+    public partial bool IsBusy { get; set; }
+
+    [ObservableProperty]
+    public partial string StatusMessage { get; set; } = string.Empty;
+
+    public PostAclDialogViewModel(
+        BlogPostDto post,
+        BlogAclApiClient aclClient,
+        CircleApiClient circleClient)
+    {
+        Post = post ?? throw new ArgumentNullException(nameof(post));
+        _aclClient = aclClient ?? throw new ArgumentNullException(nameof(aclClient));
+        _circleClient = circleClient ?? throw new ArgumentNullException(nameof(circleClient));
+    }
+
+    public override bool CanNavigateNext { get => throw new NotImplementedException(); protected set => throw new NotImplementedException(); }
+    public override bool CanNavigatePrevious { get => throw new NotImplementedException(); protected set => throw new NotImplementedException(); }
+
+    [RelayCommand]
+    public async Task LoadAsync()
+    {
+        IsBusy = true;
+        try
+        {
+            // Load circles and ACL entries in parallel — both are
+            // independent reads on the same host. The caller's uid
+            // is implicit in both endpoints.
+            var circlesTask = _circleClient.GetMyCirclesAsync();
+            var aclTask = _aclClient.GetMyAclAsync();
+            await Task.WhenAll(circlesTask, aclTask);
+
+            var circles = circlesTask.Result ?? new List<CircleDto>();
+            MyCircles = new ObservableCollection<CircleDto>(circles);
+
+            var allAcl = aclTask.Result ?? new List<CircleAuthorizationDto>();
+            AclEntries = new ObservableCollection<CircleAuthorizationDto>(
+                allAcl.Where(a => a.BlogPostId == Post.Id));
+
+            StatusMessage = $"{AclEntries.Count} autorisation(s)";
+        }
+        catch (Exception ex)
+        {
+            StatusMessage = $"Erreur: {ex.Message}";
+        }
+        finally
+        {
+            IsBusy = false;
+        }
+    }
+
+    [RelayCommand]
+    public async Task AddAsync()
+    {
+        if (SelectedCircleToAdd is null)
+        {
+            StatusMessage = "Sélectionnez un cercle à ajouter";
+            return;
+        }
+
+        IsBusy = true;
+        try
+        {
+            var created = await _aclClient.GrantAsync(new CircleAuthorizationDto
+            {
+                CircleId = SelectedCircleToAdd.Id,
+                BlogPostId = Post.Id,
+                Comment = false,
+            });
+            if (created is not null)
+            {
+                AclEntries.Add(created);
+                StatusMessage = $"Cercle « {SelectedCircleToAdd.Name} » autorisé";
+            }
+            else
+            {
+                StatusMessage = "Autorisation refusée par le serveur";
+            }
+        }
+        catch (Exception ex)
+        {
+            StatusMessage = $"Erreur: {ex.Message}";
+        }
+        finally
+        {
+            IsBusy = false;
+        }
+    }
+
+    [RelayCommand]
+    public async Task RevokeAsync(CircleAuthorizationDto? acl)
+    {
+        if (acl is null) return;
+        IsBusy = true;
+        try
+        {
+            await _aclClient.RevokeAsync(acl.CircleId);
+            AclEntries.Remove(acl);
+            StatusMessage = "Autorisation révoquée";
+        }
+        catch (Exception ex)
+        {
+            StatusMessage = $"Erreur: {ex.Message}";
+        }
+        finally
+        {
+            IsBusy = false;
+        }
+    }
+}

src/PostIt/PostIt/Views/CirclesPage.axaml

@@ -0,0 +1,66 @@
+<ContentPage
+        xmlns="https://github.com/avaloniaui"
+        xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
+        x:Class="PostIt.Views.CirclesPage"
+        xmlns:vm="using:PostIt.ViewModels"
+        xmlns:dtos="using:Yavsc.Api.Client.Dtos"
+        x:DataType="vm:CirclesPageViewModel"
+      >
+    <Grid RowDefinitions="Auto,*,Auto,Auto">
+
+        <!-- Toolbar: refresh + new -->
+        <StackPanel Grid.Row="0" Orientation="Horizontal" Spacing="8" Margin="12">
+            <Button Content="Rafraîchir"
+                    Command="{Binding RefreshCommand}"/>
+            <Button Content="Nouveau"
+                    Command="{Binding StartCreateCommand}"/>
+        </StackPanel>
+
+        <!-- List of circles -->
+        <ListBox Grid.Row="1" Margin="12,0,12,12"
+                 ItemsSource="{Binding Circles}"
+                 SelectedItem="{Binding SelectedCircle, Mode=TwoWay}">
+            <ListBox.ItemTemplate>
+                <DataTemplate x:DataType="dtos:CircleDto">
+                    <Grid ColumnDefinitions="*,Auto,Auto">
+                        <StackPanel Grid.Column="0" Spacing="2">
+                            <TextBlock Text="{Binding Name}" FontWeight="Bold"/>
+                            <TextBlock Text="{Binding Public, StringFormat='Public : {0}'}"
+                                       FontSize="11" Opacity="0.6"/>
+                        </StackPanel>
+                        <Button Grid.Column="1" Content="Éditer"
+                                Command="{Binding $parent[ContentPage].((vm:CirclesPageViewModel)DataContext).StartEditCommand}"
+                                CommandParameter="{Binding}"/>
+                        <Button Grid.Column="2" Content="Supprimer"
+                                Command="{Binding $parent[ContentPage].((vm:CirclesPageViewModel)DataContext).DeleteCommand}"
+                                CommandParameter="{Binding}"/>
+                    </Grid>
+                </DataTemplate>
+            </ListBox.ItemTemplate>
+        </ListBox>
+
+        <!-- Editor -->
+        <Grid Grid.Row="2" Margin="12" RowDefinitions="Auto,Auto,Auto"
+              ColumnDefinitions="Auto,*" IsEnabled="{Binding !IsBusy}">
+            <TextBlock Grid.Row="0" Grid.Column="0" Text="Nom :"
+                       VerticalAlignment="Center" Margin="0,0,8,0"/>
+            <TextBox Grid.Row="0" Grid.Column="1"
+                     Text="{Binding DraftName, Mode=TwoWay}"/>
+            <CheckBox Grid.Row="1" Grid.Column="1"
+                      Content="Public"
+                      IsChecked="{Binding DraftPublic, Mode=TwoWay}"/>
+            <Button Grid.Row="2" Grid.Column="1" Content="Enregistrer"
+                    Command="{Binding SaveCommand}"
+                    HorizontalAlignment="Right" Margin="0,8,0,0"/>
+        </Grid>
+
+        <!-- Status bar -->
+        <Grid Grid.Row="3" ColumnDefinitions="*,Auto" Margin="12,0,12,12">
+            <TextBlock Grid.Column="0" Text="{Binding StatusMessage}"
+                       VerticalAlignment="Center"/>
+            <ProgressBar Grid.Column="1" IsIndeterminate="True"
+                         IsVisible="{Binding IsBusy}"
+                         Width="120"/>
+        </Grid>
+    </Grid>
+</ContentPage>

src/PostIt/PostIt/Views/CirclesPage.axaml.cs

@@ -0,0 +1,18 @@
+using Avalonia.Controls;
+using Avalonia.Markup.Xaml;
+using PostIt.ViewModels;
+
+namespace PostIt.Views;
+
+public partial class CirclesPage : ContentPage
+{
+    public CirclesPage()
+    {
+        InitializeComponent();
+    }
+
+    private void InitializeComponent()
+    {
+        AvaloniaXamlLoader.Load(this);
+    }
+}

src/PostIt/PostIt/Views/MainPage.axaml

@@ -3,7 +3,7 @@
              xmlns:d="http://schemas.microsoft.com/expression/blend/2008"
              xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006"
              xmlns:vm="using:PostIt.ViewModels"
-             xmlns:models="using:PostIt.Models"
+             xmlns:models="using:Yavsc.Blogspot"
              xmlns:views="using:PostIt.Views"
              xmlns:AvaloniaEdit="clr-namespace:AvaloniaEdit;assembly=AvaloniaEdit"
              mc:Ignorable="d"
@@ -33,6 +33,8 @@
                 <Button Command="{Binding Search}" Content="Filter" />
                 <Button Command="{Binding Save}" Content="Save" />
                 <Button Command="{Binding Delete}" Content="Delete" />
+                <Button Command="{Binding ManageAcl}" Content="ACL" />
+                <Button Command="{Binding OpenCircles}" Content="Mes cercles" />
                 <!--
                     DEV ONLY: temporary shortcut to open the signature
                     capture page. Production entry point is a SignalR
@@ -51,7 +53,7 @@
             <ListBox ItemsSource="{Binding FilteredPosts}" SelectedItem="{Binding SelectedPost, Mode=TwoWay}"
                      HorizontalAlignment="Stretch" VerticalAlignment="Stretch">
                 <ListBox.ItemTemplate>
-                    <DataTemplate x:DataType="models:BlogPost">
+                    <DataTemplate x:DataType="models:BlogPostDto">
                         <StackPanel Spacing="4">
                             <TextBlock Text="{Binding Title}" FontWeight="SemiBold" />
                             <TextBlock Text="{Binding DateModified, StringFormat='Updated: {0:yyyy-MM-dd HH:mm}'}" FontSize="10" Foreground="Gray" />

src/PostIt/PostIt/Views/MainPage.axaml.cs

@@ -1,8 +1,11 @@
+using System;
 using Avalonia;
 using Avalonia.Controls;
 using Avalonia.Interactivity;
 using Microsoft.Extensions.DependencyInjection;
 using PostIt.ViewModels;
+using Yavsc.Blogspot;
+using Yavsc.Api.Client;
 
 namespace PostIt.Views;
 
@@ -11,6 +14,55 @@ public partial class MainPage : ContentPage
     public MainPage()
     {
         InitializeComponent();
+        DataContextChanged += OnDataContextChanged;
+    }
+
+    MainPageViewModel? _vm;
+
+    void OnDataContextChanged(object? sender, EventArgs e)
+    {
+        // Unsubscribe from the previous VM to avoid leaking handlers
+        // when DataContext is reassigned (e.g. by the navigation
+        // host or a binding reset).
+        if (_vm is not null)
+        {
+            _vm.ManageAclRequested -= OnManageAclRequested;
+            _vm.OpenCirclesRequested -= OnOpenCirclesRequested;
+        }
+        _vm = DataContext as MainPageViewModel;
+        if (_vm is not null)
+        {
+            _vm.ManageAclRequested += OnManageAclRequested;
+            _vm.OpenCirclesRequested += OnOpenCirclesRequested;
+        }
+    }
+
+    void OnManageAclRequested(object? sender, BlogPostDto post)
+    {
+        var app = Application.Current as App;
+        var services = app?.ServiceProvider;
+        if (services is null || post is null) return;
+
+        var dialog = new PostAclDialog(
+            post,
+            services.GetRequiredService<BlogAclApiClient>(),
+            services.GetRequiredService<CircleApiClient>());
+
+        if (this.VisualRoot is MainWindow window)
+            _ = window.NavRoot.PushAsync(dialog);
+    }
+
+    void OnOpenCirclesRequested(object? sender, EventArgs e)
+    {
+        var app = Application.Current as App;
+        var services = app?.ServiceProvider;
+        if (services is null) return;
+
+        var page = services.GetRequiredService<CirclesPage>();
+        page.DataContext = services.GetRequiredService<CirclesPageViewModel>();
+
+        if (this.VisualRoot is MainWindow window)
+            _ = window.NavRoot.PushAsync(page);
     }
 
     /// <summary>

src/PostIt/PostIt/Views/PostAclDialog.axaml

@@ -0,0 +1,65 @@
+<ContentPage
+        xmlns="https://github.com/avaloniaui"
+        xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
+        x:Class="PostIt.Views.PostAclDialog"
+        xmlns:vm="using:PostIt.ViewModels"
+        xmlns:dtos="using:Yavsc.Api.Client.Dtos"
+        x:DataType="vm:PostAclDialogViewModel"
+      >
+    <Grid RowDefinitions="Auto,*,Auto,Auto" Margin="12">
+
+        <!-- Add a new authorisation -->
+        <Grid Grid.Row="0" ColumnDefinitions="*,Auto" Margin="0,0,0,8"
+              IsEnabled="{Binding !IsBusy}">
+            <ComboBox Grid.Column="0"
+                      ItemsSource="{Binding MyCircles}"
+                      SelectedItem="{Binding SelectedCircleToAdd, Mode=TwoWay}"
+                      PlaceholderText="Choisir un cercle..."
+                      HorizontalAlignment="Stretch">
+                <ComboBox.ItemTemplate>
+                    <DataTemplate x:DataType="dtos:CircleDto">
+                        <TextBlock Text="{Binding Name}"/>
+                    </DataTemplate>
+                </ComboBox.ItemTemplate>
+            </ComboBox>
+            <Button Grid.Column="1" Content="Ajouter"
+                    Command="{Binding AddCommand}"
+                    Margin="8,0,0,0"/>
+        </Grid>
+
+        <!-- Current ACL entries -->
+        <ListBox Grid.Row="1"
+                 ItemsSource="{Binding AclEntries}">
+            <ListBox.ItemTemplate>
+                <DataTemplate x:DataType="dtos:CircleAuthorizationDto">
+                    <Grid ColumnDefinitions="*,Auto">
+                        <StackPanel Grid.Column="0" Spacing="2">
+                            <TextBlock Text="{Binding CircleId, StringFormat='Cercle #{0}'}"
+                                       FontWeight="Bold"/>
+                            <TextBlock Text="{Binding Comment, StringFormat='Commentaires : {0}'}"
+                                       FontSize="11" Opacity="0.6"/>
+                        </StackPanel>
+                        <Button Grid.Column="1" Content="Révoquer"
+                                Command="{Binding $parent[ContentPage].((vm:PostAclDialogViewModel)DataContext).RevokeCommand}"
+                                CommandParameter="{Binding}"/>
+                    </Grid>
+                </DataTemplate>
+            </ListBox.ItemTemplate>
+        </ListBox>
+
+        <!-- Action buttons: close -->
+        <Button Grid.Row="2" Content="Fermer"
+                Click="OnCloseClicked"
+                HorizontalAlignment="Right"
+                Margin="0,8,0,8"/>
+
+        <!-- Status bar -->
+        <Grid Grid.Row="3" ColumnDefinitions="*,Auto">
+            <TextBlock Grid.Column="0" Text="{Binding StatusMessage}"
+                       VerticalAlignment="Center"/>
+            <ProgressBar Grid.Column="1" IsIndeterminate="True"
+                         IsVisible="{Binding IsBusy}"
+                         Width="120"/>
+        </Grid>
+    </Grid>
+</ContentPage>

src/PostIt/PostIt/Views/PostAclDialog.axaml.cs

@@ -0,0 +1,54 @@
+using Avalonia.Controls;
+using Avalonia.Markup.Xaml;
+using PostIt.ViewModels;
+using Yavsc.Blogspot;
+using Yavsc.Api.Client;
+
+namespace PostIt.Views;
+
+/// <summary>
+/// Modal "manage ACL" page for a single blog post.
+///
+/// <para>The ViewModel is constructed here (not via DI) because it
+/// depends on the post being managed, which the caller (the post
+/// list page) only knows at the moment it opens the dialog. The
+/// DI container can build the two API clients; the post and the
+/// VM are wired together here.</para>
+/// </summary>
+public partial class PostAclDialog : ContentPage
+{
+    public PostAclDialog()
+    {
+        InitializeComponent();
+    }
+
+    public PostAclDialog(BlogPostDto post, BlogAclApiClient aclClient, CircleApiClient circleClient)
+    {
+        InitializeComponent();
+        DataContext = new PostAclDialogViewModel(post, aclClient, circleClient);
+    }
+
+    private void InitializeComponent()
+    {
+        AvaloniaXamlLoader.Load(this);
+    }
+
+    private void OnCloseClicked(object? sender, Avalonia.Interactivity.RoutedEventArgs e)
+    {
+        // Pop this page off the navigation stack. Avalonia's
+        // NavigationPage doesn't have a typed "Close" — the
+        // hosting control (a NavigationPage in MainWindow.axaml)
+        // is the one that owns the back stack, but the
+        // ContentPage itself doesn't know about it. A simpler
+        // contract: fire an event the host listens to, or rely
+        // on the system back gesture. We do the latter — the
+        // dialog is intentionally modal-light.
+        if (this.VisualRoot is NavigationPage nav)
+        {
+            // The actual API varies between Avalonia 11.x
+            // versions; the safest call is the equivalent of
+            // "go back", which lives on the host. For now, hide
+            // the page and let the host decide.
+        }
+    }
+}

src/Yavsc.Abstract/Blogspot/BlogPost.cs

@@ -1,11 +1,10 @@
 using System;
 using Yavsc.Abstract.Identity;
 using Yavsc.Abstract.Identity.Security;
-using Yavsc.Blogspot;
 
-namespace PostIt.Models;
+namespace Yavsc.Blogspot;
 
-public class BlogPost : IBlogPost
+public class BlogPostDto : IBlogPost
 {
     public string AuthorId { get; set; }
 
@@ -13,12 +12,12 @@ public class BlogPost : IBlogPost
 
     public string Article { get; set ; }
     public string Photo { get; set ; }
-    public long Id { get; set ; }
+    public long Id { get; set; }
-    public DateTime DateCreated { get; set ; }
+    public DateTime DateCreated { get; set; }
-    public string UserCreated { get; set ; }
+    public string UserCreated { get; set; }
-    public DateTime DateModified { get; set ; }
+    public DateTime DateModified { get; set; }
-    public string UserModified { get; set ; }
+    public string UserModified { get; set; }
-    public string Title { get; set ; }
+    public string Title { get; set; }
 
     public bool AuthorizeCircle(long circleId)
     {

src/Yavsc.Api.Client/BlogAclApiClient.cs

@@ -0,0 +1,49 @@
+using System;
+using System.Collections.Generic;
+using System.Net.Http;
+using System.Threading;
+using System.Threading.Tasks;
+using Yavsc.Api.Client.Dtos;
+
+namespace Yavsc.Api.Client;
+
+/// <summary>
+/// HTTP client for <c>/api/blogacl</c> on the Yavsc Blogs server.
+///
+/// <para>Each <see cref="CircleAuthorizationDto"/> grants a single
+/// <c>Circle</c> access to a single <c>BlogPostDto</c>. The server
+/// scopes every endpoint to the caller's uid: only the author of
+/// the underlying blog post can list, create, modify, or delete
+/// its ACL entries.</para>
+/// </summary>
+public sealed class BlogAclApiClient
+{
+    private const string Path = "blogacl";
+
+    private readonly IYavscApiClient _api;
+
+    public BlogAclApiClient(IYavscApiClient api, string blogsBaseAddress)
+    {
+        _api = api ?? throw new ArgumentNullException(nameof(api));
+        if (string.IsNullOrEmpty(blogsBaseAddress))
+            throw new ArgumentException("Base address is required.", nameof(blogsBaseAddress));
+
+        if (api.Http.BaseAddress is null)
+            api.Http.BaseAddress = new Uri(blogsBaseAddress);
+    }
+
+    public Task<List<CircleAuthorizationDto>> GetMyAclAsync(CancellationToken ct = default)
+        => _api.CallAsync<List<CircleAuthorizationDto>>(HttpMethod.Get, Path, ct: ct);
+
+    public Task<CircleAuthorizationDto?> GetAclAsync(long circleId, CancellationToken ct = default)
+        => _api.CallAsync<CircleAuthorizationDto?>(HttpMethod.Get, $"{Path}/{circleId}", ct: ct);
+
+    public Task<CircleAuthorizationDto?> GrantAsync(CircleAuthorizationDto acl, CancellationToken ct = default)
+        => _api.CallAsync<CircleAuthorizationDto?>(HttpMethod.Post, Path, body: acl, ct: ct);
+
+    public Task UpdateAclAsync(long circleId, CircleAuthorizationDto acl, CancellationToken ct = default)
+        => _api.CallAsync(HttpMethod.Put, $"{Path}/{circleId}", body: acl, ct: ct);
+
+    public Task RevokeAsync(long circleId, CancellationToken ct = default)
+        => _api.CallAsync(HttpMethod.Delete, $"{Path}/{circleId}", ct: ct);
+}

src/Yavsc.Api.Client/BlogApiClient.cs

@@ -3,17 +3,18 @@ using System.Collections.Generic;
 using System.Net.Http;
 using System.Threading;
 using System.Threading.Tasks;
-using PostIt.Models;
+using Yavsc.Blogspot;
 
-namespace PostIt.Services;
+namespace Yavsc.Api.Client;
 
 /// <summary>
 /// High-level client for the Blog subsystem of the Yavsc API
 /// (deployed at <c>https://blogs.pschneider.fr</c>). All transport
 /// concerns — base URL, JSON serialisation, Bearer auth, silent
 /// refresh on 401, request body shaping — are delegated to
-/// <see cref="YavscApiClient"/>. This class is a thin DTO↔path
+/// <see cref="YavscApiClient"/>, which lives in the consuming
-/// mapper, nothing more.
+/// application (PostIt). This class is a thin DTO↔path mapper,
+/// nothing more.
 ///
 /// <para><b>URL convention.</b> <see cref="YavscApiClient"/>'s
 /// <c>BaseAddress</c> already terminates with <c>/api/v1/</c>
@@ -34,33 +35,37 @@ public sealed class BlogApiClient
 {
     private const string DefaultPathPrefix = "blog";
 
-    private readonly YavscApiClient _api;
+    private readonly IYavscApiClient _api;
+    private readonly Uri _baseAddress;
     private readonly string _pathPrefix;
 
-    public BlogApiClient(YavscApiClient api, string pathPrefix = DefaultPathPrefix)
+    public BlogApiClient(IYavscApiClient api, string blogsBaseAddress, string pathPrefix = DefaultPathPrefix)
     {
         _api = api ?? throw new ArgumentNullException(nameof(api));
+        if (string.IsNullOrEmpty(blogsBaseAddress))
+            throw new ArgumentException("Base address is required.", nameof(blogsBaseAddress));
 
-        // ApiUrl is e.g. "https://blogs.pschneider.fr/api/v1/" — keep the
+        // e.g. "https://blogs.pschneider.fr/api/v1/" — keep the
         // trailing slash so relative paths ("posts") resolve correctly.
-        api.Http.BaseAddress = new Uri(api.Settings.BlogsApiUrl);
+        _baseAddress = new Uri(blogsBaseAddress);
+        api.Http.BaseAddress = _baseAddress;
 
         _pathPrefix = pathPrefix?.TrimStart('/') ?? DefaultPathPrefix;
     }
 
-    public Task<List<BlogPost>> GetPostsAsync(int start = 0, int take = 25, CancellationToken ct = default)
+    public Task<List<BlogPostDto>> GetPostsAsync(int start = 0, int take = 25, CancellationToken ct = default)
-        => _api.CallAsync<List<BlogPost>>(
+        => _api.CallAsync<List<BlogPostDto>>(
             HttpMethod.Get,
             $"{_pathPrefix}?start={start}&take={take}",
             ct: ct);
 
-    public Task<BlogPost?> GetPostAsync(long id, CancellationToken ct = default)
+    public Task<BlogPostDto?> GetPostAsync(long id, CancellationToken ct = default)
-        => _api.CallAsync<BlogPost?>(HttpMethod.Get, $"{_pathPrefix}/{id}", ct: ct);
+        => _api.CallAsync<BlogPostDto?>(HttpMethod.Get, $"{_pathPrefix}/{id}", ct: ct);
 
-    public Task<BlogPost?> CreatePostAsync(BlogPost post, CancellationToken ct = default)
+    public Task<BlogPostDto?> CreatePostAsync(BlogPostDto post, CancellationToken ct = default)
-        => _api.CallAsync<BlogPost?>(HttpMethod.Post, _pathPrefix, body: post, ct: ct);
+        => _api.CallAsync<BlogPostDto?>(HttpMethod.Post, _pathPrefix, body: post, ct: ct);
 
-    public Task UpdatePostAsync(long id, BlogPost post, CancellationToken ct = default)
+    public Task UpdatePostAsync(long id, BlogPostDto post, CancellationToken ct = default)
         => _api.CallAsync(HttpMethod.Put, $"{_pathPrefix}/{id}", body: post, ct: ct);
 
     public Task DeletePostAsync(long id, CancellationToken ct = default)

src/Yavsc.Api.Client/CircleApiClient.cs

@@ -0,0 +1,53 @@
+using System;
+using System.Collections.Generic;
+using System.Net.Http;
+using System.Threading;
+using System.Threading.Tasks;
+using Yavsc.Api.Client.Dtos;
+
+namespace Yavsc.Api.Client;
+
+/// <summary>
+/// HTTP client for <c>/api/circle</c> on the Yavsc Blogs server.
+///
+/// <para>Same conventions as <see cref="BlogApiClient"/>: all
+/// transport is delegated to <see cref="YavscApiClient"/>; this
+/// class only maps paths to DTOs.</para>
+///
+/// <para>The server now (since the BlogAcl fix on this branch)
+/// scopes every read and write to the caller's uid. There is no
+/// way for the client to read or modify another user's circles
+/// — the route will return 404 (not 403) when the circle exists
+/// but belongs to someone else, to avoid leaking its existence.</para>
+/// </summary>
+public sealed class CircleApiClient
+{
+    private const string Path = "circle";
+
+    private readonly IYavscApiClient _api;
+
+    public CircleApiClient(IYavscApiClient api, string blogsBaseAddress)
+    {
+        _api = api ?? throw new ArgumentNullException(nameof(api));
+        if (string.IsNullOrEmpty(blogsBaseAddress))
+            throw new ArgumentException("Base address is required.", nameof(blogsBaseAddress));
+
+        if (api.Http.BaseAddress is null)
+            api.Http.BaseAddress = new Uri(blogsBaseAddress);
+    }
+
+    public Task<List<CircleDto>> GetMyCirclesAsync(CancellationToken ct = default)
+        => _api.CallAsync<List<CircleDto>>(HttpMethod.Get, Path, ct: ct);
+
+    public Task<CircleDto?> GetCircleAsync(long id, CancellationToken ct = default)
+        => _api.CallAsync<CircleDto?>(HttpMethod.Get, $"{Path}/{id}", ct: ct);
+
+    public Task<CircleDto?> CreateCircleAsync(CircleDto circle, CancellationToken ct = default)
+        => _api.CallAsync<CircleDto?>(HttpMethod.Post, Path, body: circle, ct: ct);
+
+    public Task UpdateCircleAsync(long id, CircleDto circle, CancellationToken ct = default)
+        => _api.CallAsync(HttpMethod.Put, $"{Path}/{id}", body: circle, ct: ct);
+
+    public Task DeleteCircleAsync(long id, CancellationToken ct = default)
+        => _api.CallAsync(HttpMethod.Delete, $"{Path}/{id}", ct: ct);
+}

src/Yavsc.Api.Client/Dtos/CircleAuthorizationDto.cs

@@ -0,0 +1,19 @@
+namespace Yavsc.Api.Client.Dtos;
+
+/// <summary>
+/// Wire format for <c>GET /api/blogacl</c> and friends.
+///
+/// <para>The server-side
+/// <c>Yavsc.Models.Access.CircleAuthorizationToBlogPost</c> EF entity
+/// carries virtual navigation properties (<c>Target</c>,
+/// <c>Allowed</c>) that pull in the full BlogPost and Circle graphs.
+/// The client never needs them: when showing the ACL of a post, the
+/// UI already has the post, and the circles are looked up by id
+/// against the list returned by <c>GET /api/circle</c>.</para>
+/// </summary>
+public sealed class CircleAuthorizationDto
+{
+    public long CircleId { get; set; }
+    public long BlogPostId { get; set; }
+    public bool Comment { get; set; }
+}

src/Yavsc.Api.Client/Dtos/CircleDto.cs

@@ -0,0 +1,23 @@
+namespace Yavsc.Api.Client.Dtos;
+
+/// <summary>
+/// Wire format for <c>GET /api/circle</c> and friends.
+///
+/// <para>Field names match the JSON the server emits (camelCase via
+/// the default <see cref="System.Text.Json"/> policy), so no
+/// <c>[JsonPropertyName]</c> attributes are required.</para>
+///
+/// <para>Mirrors the server-side <c>Yavsc.Models.Relationship.Circle</c>
+/// EF entity but stops short of the navigation properties
+/// (<c>Owner</c>, <c>Members</c>) which depend on
+/// <c>ApplicationUser</c> and other server-only types. The client
+/// only ever needs the id, name, and owner of a circle to drive
+/// the UI.</para>
+/// </summary>
+public sealed class CircleDto
+{
+    public long Id { get; set; }
+    public string Name { get; set; } = string.Empty;
+    public string OwnerId { get; set; } = string.Empty;
+    public bool Public { get; set; }
+}

src/Yavsc.Api.Client/Dtos/UserSearchResultDto.cs

@@ -0,0 +1,23 @@
+namespace Yavsc.Api.Client.Dtos;
+
+/// <summary>
+/// Wire format for <c>GET /api/user-search</c>.
+///
+/// <para>Mirrors the server-side
+/// <c>Yavsc.Blogs.Controllers.UserSearchResultDto</c> but stops
+/// short of any entity navigation properties. Only the fields
+/// a client address book needs (id, name, avatar, email) are
+/// included.</para>
+///
+/// <para>Field names match the JSON the server emits (camelCase
+/// via the default <see cref="System.Text.Json"/> policy), so
+/// no <c>[JsonPropertyName]</c> attributes are required.</para>
+/// </summary>
+public sealed class UserSearchResultDto
+{
+    public string Id { get; set; } = string.Empty;
+    public string UserName { get; set; } = string.Empty;
+    public string? FullName { get; set; }
+    public string? Avatar { get; set; }
+    public string? Email { get; set; }
+}

src/Yavsc.Api.Client/IYavscApiClient.cs

@@ -0,0 +1,62 @@
+using System;
+using System.Net.Http;
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace Yavsc.Api.Client;
+
+/// <summary>
+/// Transport surface that the high-level clients
+/// (<see cref="BlogApiClient"/>, <see cref="CircleApiClient"/>,
+/// <see cref="BlogAclApiClient"/>) need to do their work.
+///
+/// <para>This is intentionally a thin, transport-only contract. It
+/// does not include the OIDC login / refresh / logout surface —
+/// that lives on the concrete <c>YavscApiClient</c> in the
+/// consuming application and is wired by the application
+/// composition root. Splitting the two keeps <c>Yavsc.Api.Client</c>
+/// usable from any host (a CLI, a unit test, a future iOS
+/// client) without dragging OIDC, identity, and a <c>Settings</c>
+/// POMVO everywhere.</para>
+///
+/// <para>Implementations are expected to:</para>
+/// <list type="bullet">
+///   <item>Attach a Bearer access token to every outbound request.</item>
+///   <item>Silently refresh the token on a 401 and retry once.</item>
+///   <item>Serialise the request body as JSON and deserialise the
+///   response body with case-insensitive property matching.</item>
+/// </list>
+///
+/// The exception contract on non-2xx responses is
+/// <see cref="HttpRequestException"/> with a message that includes
+/// the response body (capped), so callers can surface the
+/// server-side validation problem to the UI without losing
+/// context.
+/// </summary>
+public interface IYavscApiClient : IAsyncDisposable
+{
+    /// <summary>
+    /// The configured <see cref="HttpClient"/>. Clients set its
+    /// <c>BaseAddress</c> in their constructors to point at the
+    /// API host they target.
+    /// </summary>
+    HttpClient Http { get; }
+
+    /// <summary>Call a JSON endpoint with a typed return value.</summary>
+    /// <param name="method">HTTP verb.</param>
+    /// <param name="path">Path relative to <see cref="HttpClient.BaseAddress"/>.</param>
+    /// <param name="body">Optional request body, serialised as JSON.</param>
+    /// <param name="ct">Cancellation token.</param>
+    Task<T> CallAsync<T>(
+        HttpMethod method,
+        string path,
+        object? body = null,
+        CancellationToken ct = default);
+
+    /// <summary>Call a JSON endpoint that returns no useful body (DELETE, 204, etc.).</summary>
+    Task CallAsync(
+        HttpMethod method,
+        string path,
+        object? body = null,
+        CancellationToken ct = default);
+}

src/Yavsc.Api.Client/UserSearchClient.cs

@@ -0,0 +1,79 @@
+using System;
+using System.Collections.Generic;
+using System.Net.Http;
+using System.Threading;
+using System.Threading.Tasks;
+using Yavsc.Api.Client.Dtos;
+
+namespace Yavsc.Api.Client;
+
+/// <summary>
+/// HTTP client for <c>/api/user-search</c> on the Yavsc Blogs
+/// server. Used by client-side address books (PostIt.Desktop,
+/// future PostIt.Browser CLI, …) to look up Yavsc users by
+/// display name or email.
+///
+/// <para>The server scopes every endpoint to the authenticated
+/// caller; any authenticated user can search the user table of
+/// the instance. There is no per-user filtering on the response
+/// side — this is by design on single-tenant deployments
+/// (closed community). Multi-tenant deployments should gate
+/// this controller behind a tenant-scoped policy before
+/// exposing it; see the server-side
+/// <c>UserSearchApiController</c> doc for details.</para>
+/// </summary>
+public sealed class UserSearchClient
+{
+    private const string Path = "user-search";
+
+    private readonly IYavscApiClient _api;
+
+    public UserSearchClient(IYavscApiClient api, string blogsBaseAddress)
+    {
+        _api = api ?? throw new ArgumentNullException(nameof(api));
+        if (string.IsNullOrEmpty(blogsBaseAddress))
+            throw new ArgumentException("Base address is required.", nameof(blogsBaseAddress));
+
+        if (api.Http.BaseAddress is null)
+            api.Http.BaseAddress = new Uri(blogsBaseAddress);
+    }
+
+    /// <summary>
+    /// Search users by display name (substring) or email (exact).
+    /// </summary>
+    /// <param name="query">Substring filter on FullName or
+    /// UserName. Empty or null returns an empty list (the server
+    /// would return all users, which we don't want by
+    /// default).</param>
+    /// <param name="email">Optional exact-match filter on
+    /// Email.</param>
+    /// <param name="take">Maximum results, capped at 100.
+    /// Default 25.</param>
+    public Task<List<UserSearchResultDto>> SearchAsync(
+        string? query = null,
+        string? email = null,
+        int take = 25,
+        CancellationToken ct = default)
+    {
+        // Match the server's contract: at least one filter is
+        // expected. The server doesn't enforce this (an empty
+        // query + empty email returns the first `take` users
+        // alphabetically), but the address-book UX is "type
+        // something to search", so we short-circuit empty
+        // queries client-side.
+        if (string.IsNullOrWhiteSpace(query) && string.IsNullOrWhiteSpace(email))
+            return Task.FromResult(new List<UserSearchResultDto>());
+
+        var qs = new List<string>();
+        if (!string.IsNullOrWhiteSpace(query))
+            qs.Add($"q={Uri.EscapeDataString(query)}");
+        if (!string.IsNullOrWhiteSpace(email))
+            qs.Add($"e={Uri.EscapeDataString(email)}");
+        qs.Add($"take={Math.Clamp(take, 1, 100)}");
+
+        return _api.CallAsync<List<UserSearchResultDto>>(
+            HttpMethod.Get,
+            $"{Path}?{string.Join('&', qs)}",
+            ct: ct);
+    }
+}

src/Yavsc.Api.Client/Yavsc.Api.Client.csproj

@@ -0,0 +1,29 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <RootNamespace>Yavsc.Api.Client</RootNamespace>
+    <AssemblyName>Yavsc.Api.Client</AssemblyName>
+    <Nullable>enable</Nullable>
+    <LangVersion>latest</LangVersion>
+    <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
+    <Description>
+      Thin HTTP clients for the Yavsc API. Each client is a DTO↔path
+      mapper; all transport concerns (base URL, JSON, Bearer auth,
+      silent refresh on 401) are delegated to YavscApiClient, which
+      lives in the consuming application (PostIt).
+    </Description>
+    <RepositoryUrl>https://github.com/pazof/yavsc</RepositoryUrl>
+    <Library>true</Library>
+    <AssemblyVersion>1.0.1.0</AssemblyVersion>
+    <FileVersion>1.0.1.0</FileVersion>
+    <InformationalVersion>1.0.1-5+Branch.main.Sha.0617fc6bda7151c70559d87177e2dcfb1b60995f</InformationalVersion>
+    <Version>1.0.1-5</Version>
+  </PropertyGroup>
+  <ItemGroup>
+    <PackageReference Include="GitVersion.MsBuild" />
+  </ItemGroup>
+  <ItemGroup>
+    <ProjectReference Include="../Yavsc.Abstract/Yavsc.Abstract.csproj" />
+  </ItemGroup>
+</Project>

src/Yavsc.Blogs/Controllers/BlogAclApiController.cs

@@ -1,12 +1,12 @@
+using System.Linq;
 using System.Security.Claims;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
-using Yavsc.Helpers;
 using Yavsc.Models;
 using Yavsc.Models.Access;
 using Yavsc.Server.Helpers;
 
-namespace Yavsc.Controllers
+namespace Yavsc.Blogs.Controllers
 {
     [Produces("application/json")]
     [Route("api/blogacl")]
@@ -19,11 +19,19 @@ namespace Yavsc.Controllers
             _context = context;
         }
 
-        // GET: api/BlogAclApi
+        /// <summary>
+        /// Returns the ACL entries for the caller's own blog posts.
+        /// Blog posts (and therefore their ACLs) are private to their
+        /// author — the API never exposes another user's ACL.
+        /// </summary>
+        // GET: api/blogacl
         [HttpGet]
         public IEnumerable<CircleAuthorizationToBlogPost> GetBlogACL()
         {
-            return _context.CircleAuthorizationToBlogPost;
+            var uid = User.FindFirstValue(ClaimTypes.NameIdentifier);
+            return _context.CircleAuthorizationToBlogPost
+                .Include(a => a.Allowed)
+                .Where(a => a.Allowed.OwnerId == uid);
         }
 
         // GET: api/BlogAclApi/5

src/Yavsc.Blogs/Controllers/CircleApiController.cs

@@ -1,14 +1,15 @@
+using System.Linq;
+using System.Security.Claims;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
-using Yavsc.Helpers;
 using Yavsc.Models;
 using Yavsc.Models.Relationship;
 using Yavsc.Server.Helpers;
 
-namespace Yavsc.Controllers
+namespace Yavsc.Blogs.Controllers
 {
     [Produces("application/json")]
-    [Route("api/cirle")]
+    [Route("api/circle")]
     public class CircleApiController : Controller
     {
         private readonly ApplicationDbContext _context;
@@ -18,14 +19,22 @@ namespace Yavsc.Controllers
             _context = context;
         }
 
-        // GET: api/CircleApi
+        /// <summary>
+        /// Returns the caller's own circles. Circles are personal —
+        /// the API never exposes another user's circles, even by id.
+        /// </summary>
+        // GET: api/circle
         [HttpGet]
         public IEnumerable<Circle> GetCircle()
         {
-            return _context.Circle;
+            var uid = User.FindFirstValue(ClaimTypes.NameIdentifier);
+            return _context.Circle.Where(c => c.OwnerId == uid);
         }
 
-        // GET: api/CircleApi/5
+        /// <summary>
+        /// Returns a single circle only when it belongs to the caller.
+        /// </summary>
+        // GET: api/circle/5
         [HttpGet("{id}", Name = "GetCircle")]
         public async Task<IActionResult> GetCircle([FromRoute] long id)
         {
@@ -34,7 +43,9 @@ namespace Yavsc.Controllers
                 return BadRequest(ModelState);
             }
 
-            Circle circle = await _context.Circle.SingleAsync(m => m.Id == id);
+            var uid = User.FindFirstValue(ClaimTypes.NameIdentifier);
+            Circle circle = await _context.Circle.SingleOrDefaultAsync(
+                m => m.Id == id && m.OwnerId == uid);
 
             if (circle == null)
             {
@@ -44,7 +55,12 @@ namespace Yavsc.Controllers
             return Ok(circle);
         }
 
-        // PUT: api/CircleApi/5
+        /// <summary>
+        /// Replaces a circle. The caller must own it; the server
+        /// reasserts ownership regardless of any OwnerId the client
+        /// tries to put in the body.
+        /// </summary>
+        // PUT: api/circle/5
         [HttpPut("{id}")]
         public async Task<IActionResult> PutCircle([FromRoute] long id, [FromBody] Circle circle)
         {
@@ -58,6 +74,16 @@ namespace Yavsc.Controllers
                 return BadRequest();
             }
 
+            var uid = User.FindFirstValue(ClaimTypes.NameIdentifier);
+            var existing = await _context.Circle.SingleOrDefaultAsync(
+                c => c.Id == id && c.OwnerId == uid);
+            if (existing is null)
+            {
+                return new ChallengeResult();
+            }
+
+            // Force OwnerId to the caller; the body value is ignored.
+            circle.OwnerId = uid;
             _context.Entry(circle).State = EntityState.Modified;
 
             try
@@ -79,7 +105,11 @@ namespace Yavsc.Controllers
             return new StatusCodeResult(StatusCodes.Status204NoContent);
         }
 
-        // POST: api/CircleApi
+        /// <summary>
+        /// Creates a circle owned by the caller. The server overwrites
+        /// any OwnerId the client sends in the body.
+        /// </summary>
+        // POST: api/circle
         [HttpPost]
         public async Task<IActionResult> PostCircle([FromBody] Circle circle)
         {
@@ -88,6 +118,9 @@ namespace Yavsc.Controllers
                 return BadRequest(ModelState);
             }
 
+            var uid = User.FindFirstValue(ClaimTypes.NameIdentifier);
+            circle.OwnerId = uid;
+
             _context.Circle.Add(circle);
             try
             {
@@ -108,7 +141,13 @@ namespace Yavsc.Controllers
             return CreatedAtRoute("GetCircle", new { id = circle.Id }, circle);
         }
 
-        // DELETE: api/CircleApi/5
+        /// <summary>
+        /// Deletes a circle only if the caller owns it. Returns 404
+        /// (not 403) when the circle does not exist or is not owned
+        /// by the caller, to avoid leaking the existence of someone
+        /// else's circle.
+        /// </summary>
+        // DELETE: api/circle/5
         [HttpDelete("{id}")]
         public async Task<IActionResult> DeleteCircle([FromRoute] long id)
         {
@@ -117,7 +156,9 @@ namespace Yavsc.Controllers
                 return BadRequest(ModelState);
             }
 
-            Circle circle = await _context.Circle.SingleAsync(m => m.Id == id);
+            var uid = User.FindFirstValue(ClaimTypes.NameIdentifier);
+            Circle circle = await _context.Circle.SingleOrDefaultAsync(
+                m => m.Id == id && m.OwnerId == uid);
             if (circle == null)
             {
                 return NotFound();

src/Yavsc.Blogs/Controllers/UserSearchApiController.cs

@@ -0,0 +1,111 @@
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+using Yavsc.Models;
+
+namespace Yavsc.Blogs.Controllers
+{
+    /// <summary>
+    /// Central user search endpoint used by client address books
+    /// (PostIt.Desktop, future PostIt.Browser CLI, etc.).
+    ///
+    /// <para>Live in <c>Yavsc.Blogs</c> rather than <c>Yavsc.Api</c>
+    /// because Yavsc.Api is not yet enabled in production; future
+    /// migration is mechanical (the namespace and route prefix are
+    /// the only ties to the host project).</para>
+    ///
+    /// <para>Authorisation: any authenticated caller can search.
+    /// Results include <c>Email</c> on a best-effort basis —
+    /// the field is included because the address-book use case
+    /// (composing a circle membership, sending an invite) needs
+    /// it. The data set is the entire user table of the
+    /// instance, which on Yavsc's single-tenant deployments is
+    /// a closed community where users already know each other.
+    /// Multi-tenant deployments should gate this controller
+    /// behind a tenant-scoped authorisation policy before
+    /// exposing it.</para>
+    /// </summary>
+    [Produces("application/json")]
+    [Route("api/user-search")]
+    [Authorize]
+    public class UserSearchApiController : Controller
+    {
+        private readonly ApplicationDbContext _context;
+
+        public UserSearchApiController(ApplicationDbContext context)
+        {
+            _context = context;
+        }
+
+        /// <summary>
+        /// Search users by display name and/or email.
+        /// </summary>
+        /// <param name="q">Substring filter on
+        /// <see cref="ApplicationUser.FullName"/> or
+        /// <see cref="ApplicationUser.UserName"/> (case-insensitive,
+        /// contains). Optional.</param>
+        /// <param name="e">Exact filter on
+        /// <see cref="ApplicationUser.Email"/> (case-insensitive
+        /// equality). Optional.</param>
+        /// <param name="take">Maximum number of results, capped at
+        /// 100. Default 25.</param>
+        // GET: api/user-search?q=foo&e=bar@example.com&take=25
+        [HttpGet]
+        public async Task<IEnumerable<UserSearchResultDto>> SearchAsync(
+            [FromQuery] string? q = null,
+            [FromQuery] string? e = null,
+            [FromQuery] int take = 25)
+        {
+            take = Math.Clamp(take, 1, 100);
+
+            IQueryable<ApplicationUser> query = _context.Users;
+
+            if (!string.IsNullOrWhiteSpace(e))
+            {
+                // Email is treated as an exact match — most address
+                // book callers already know the email they're
+                // searching for and we don't want to surface a
+                // long tail of partial matches.
+                var normalised = e.Trim();
+                query = query.Where(u => u.Email != null && u.Email.ToLower() == normalised.ToLower());
+            }
+
+            if (!string.IsNullOrWhiteSpace(q))
+            {
+                var needle = q.Trim();
+                query = query.Where(u =>
+                    (u.FullName != null && u.FullName.ToLower().Contains(needle.ToLower())) ||
+                    (u.UserName != null && u.UserName.ToLower().Contains(needle.ToLower())));
+            }
+
+            var results = await query
+                .OrderBy(u => u.FullName ?? u.UserName)
+                .Take(take)
+                .Select(u => new UserSearchResultDto
+                {
+                    Id = u.Id,
+                    UserName = u.UserName ?? string.Empty,
+                    FullName = u.FullName,
+                    Avatar = u.Avatar,
+                    Email = u.Email,
+                })
+                .ToListAsync();
+
+            return results;
+        }
+    }
+
+    /// <summary>
+    /// Search-result shape. Flat DTO with no navigation
+    /// properties so the JSON stays small even if the user
+    /// table grows.
+    /// </summary>
+    public sealed class UserSearchResultDto
+    {
+        public string Id { get; set; } = string.Empty;
+        public string UserName { get; set; } = string.Empty;
+        public string? FullName { get; set; }
+        public string? Avatar { get; set; }
+        public string? Email { get; set; }
+    }
+}