feat: auto-delete orphaned posts during publish

When a file is removed from the content directory, its ATProto records
(document, remanso note, and bsky post) are now automatically deleted
from the PDS during publish. Supports --dry-run to preview deletions.

packages/cli/src/commands/publish.ts

···
 	resolveImagePath,
 	createBlueskyPost,
 	addBskyPostRefToDocument,
+	deleteRecord,
 } from "../lib/atproto";
 import {
 	scanContentDirectory,
···
 } from "../lib/markdown";
 import type { BlogPost, BlobObject, StrongRef } from "../lib/types";
 import { exitOnCancel } from "../lib/prompts";
-import { createNote, updateNote, findPostsWithStaleLinks, type NoteOptions } from "../extensions/remanso"
+import { createNote, updateNote, deleteNote, findPostsWithStaleLinks, type NoteOptions } from "../extensions/remanso"
 
 export const publishCommand = command({
 	name: "publish",
···
 		// Load state
 		const state = await loadState(configDir);
 
+		let agent: Awaited<ReturnType<typeof createAgent>> | undefined;
+
 		// Scan for posts
 		const s = spinner();
 		s.start("Scanning for posts...");
···
 		});
 		s.stop(`Found ${posts.length} posts`);
 
+		// Detect orphaned posts (in state but file no longer exists)
+		const currentFilePaths = new Set(
+			posts.map((p) => path.relative(configDir, p.filePath)),
+		);
+		const orphanedKeys = Object.keys(state.posts).filter(
+			(key) => !currentFilePaths.has(key),
+		);
+
+		if (orphanedKeys.length > 0) {
+			log.info(
+				`\n${orphanedKeys.length} orphaned post${orphanedKeys.length === 1 ? "" : "s"} to delete:\n`,
+			);
+			for (const key of orphanedKeys) {
+				log.message(`  - ${key}`);
+			}
+
+			if (!dryRun) {
+				const connectingTo =
+					credentials.type === "oauth"
+						? credentials.handle
+						: credentials.pdsUrl;
+				s.start(`Connecting as ${connectingTo}...`);
+				try {
+					if (!agent) {
+						agent = await createAgent(credentials);
+					}
+					s.stop(`Logged in as ${agent.did}`);
+				} catch (error) {
+					s.stop("Failed to login");
+					log.error(`Failed to login: ${error}`);
+					process.exit(1);
+				}
+
+				let deletedCount = 0;
+				for (const key of orphanedKeys) {
+					const postState = state.posts[key]!;
+					try {
+						if (postState.atUri) {
+							// Delete site.standard.document
+							s.start(`Deleting: ${key}`);
+							await deleteRecord(agent, postState.atUri);
+
+							// Delete associated remanso note
+							try {
+								await deleteNote(agent, postState.atUri);
+							} catch {
+								// Note may not exist, ignore
+							}
+
+							// Delete app.bsky.feed.post if it exists
+							if (postState.bskyPostRef) {
+								try {
+									await deleteRecord(agent, postState.bskyPostRef.uri);
+								} catch {
+									// Post may already be deleted, ignore
+								}
+							}
+
+							s.stop(`Deleted: ${key}`);
+						}
+						delete state.posts[key];
+						deletedCount++;
+					} catch (error) {
+						s.stop(`Failed to delete: ${key}`);
+						log.warn(
+							`  ${error instanceof Error ? error.message : String(error)}`,
+						);
+					}
+				}
+
+				await saveState(configDir, state);
+				log.info(`Deleted ${deletedCount} orphaned post${deletedCount === 1 ? "" : "s"}`);
+			} else {
+				log.info("\nDry run: no deletions performed.");
+			}
+		}
+
 		// Determine which posts need publishing
 		const postsToPublish: Array<{
 			post: BlogPost;
···
 			return;
 		}
 
-		// Create agent
-		const connectingTo =
-			credentials.type === "oauth" ? credentials.handle : credentials.pdsUrl;
-		s.start(`Connecting as ${connectingTo}...`);
-		let agent: Awaited<ReturnType<typeof createAgent>> | undefined;
-		try {
-			agent = await createAgent(credentials);
-			s.stop(`Logged in as ${agent.did}`);
-		} catch (error) {
-			s.stop("Failed to login");
-			log.error(`Failed to login: ${error}`);
-			process.exit(1);
+		// Create agent (if not already created during orphan cleanup)
+		if (!agent) {
+			const connectingTo =
+				credentials.type === "oauth"
+					? credentials.handle
+					: credentials.pdsUrl;
+			s.start(`Connecting as ${connectingTo}...`);
+			try {
+				agent = await createAgent(credentials);
+				s.stop(`Logged in as ${agent.did}`);
+			} catch (error) {
+				s.stop("Failed to login");
+				log.error(`Failed to login: ${error}`);
+				process.exit(1);
+			}
 		}
 
 		// Publish posts

packages/cli/src/extensions/remanso.ts

···
   return uriMatch[3]!
 }
 
+export async function deleteNote(
+  agent: Agent,
+  documentAtUri: string,
+): Promise<void> {
+  const uriMatch = documentAtUri.match(/^at:\/\/([^/]+)\/([^/]+)\/(.+)$/)
+  if (!uriMatch) return
+  const [, did, , rkey] = uriMatch
+  await agent.com.atproto.repo.deleteRecord({
+    repo: did!,
+    collection: LEXICON,
+    rkey: rkey!,
+  })
+}
+
 export async function createNote(
   agent: Agent,
   post: BlogPost,

packages/cli/src/lib/atproto.ts

···
 	};
 }
 
+export async function deleteRecord(
+	agent: Agent,
+	atUri: string,
+): Promise<void> {
+	const parsed = parseAtUri(atUri);
+	if (!parsed) {
+		throw new Error(`Invalid AT URI: ${atUri}`);
+	}
+	await agent.com.atproto.repo.deleteRecord({
+		repo: parsed.did,
+		collection: parsed.collection,
+		rkey: parsed.rkey,
+	});
+}
+
 export interface DocumentRecord {
 	$type: "site.standard.document";
 	title: string;