init commit: working prototype

.gitignore

···
+# Binary
+bsky-poster
+
+# Database
+*.sqlite3
+*.db
+
+# IDE/Editor
+.idea/
+.vscode/
+*.swp
+*.swo
+*~
+
+# OS
+.DS_Store
+Thumbs.db
+
+# Logs
+*.log
+
+# Environment
+.env
+.env.local
+
+# Test coverage
+coverage.out

AGENT.md

···
+# Agent Instructions
+
+This is a Go web application template for exe.dev.
+
+See README.md for details on the structure and components.

Makefile

···
+.PHONY: build clean stop start restart test
+
+build:
+	go build -o bsky-poster ./cmd/srv
+
+clean:
+	rm -f bsky-poster
+
+test:
+	go test ./...

README.md

···
+# Go Shelley Template
+
+This is a starter template for building Go web applications on exe.dev. It demonstrates end-to-end usage including HTTP handlers, authentication, database integration, and deployment.
+
+Use this as a foundation to build your own service.
+
+## Building and Running
+
+Build with `make build`, then run `./srv`. The server listens on port 8000 by default.
+
+## Running as a systemd service
+
+To run the server as a systemd service:
+
+```bash
+# Install the service file
+sudo cp srv.service /etc/systemd/system/srv.service
+
+# Reload systemd and enable the service
+sudo systemctl daemon-reload
+sudo systemctl enable srv.service
+
+# Start the service
+sudo systemctl start srv
+
+# Check status
+systemctl status srv
+
+# View logs
+journalctl -u srv -f
+```
+
+To restart after code changes:
+
+```bash
+make build
+sudo systemctl restart srv
+```
+
+## Authorization
+
+exe.dev provides authorization headers and login/logout links
+that this template uses.
+
+When proxied through exed, requests will include `X-ExeDev-UserID` and
+`X-ExeDev-Email` if the user is authenticated via exe.dev.
+
+## Database
+
+This template uses sqlite (`db.sqlite3`). SQL queries are managed with sqlc.
+
+## Code layout
+
+- `cmd/srv`: main package (binary entrypoint)
+- `srv`: HTTP server logic (handlers)
+- `srv/templates`: Go HTML templates
+- `db`: SQLite open + migrations (001-base.sql)

cmd/srv/main.go

···
+package main
+
+import (
+	"flag"
+	"fmt"
+	"os"
+
+	"srv.exe.dev/srv"
+)
+
+var flagListenAddr = flag.String("listen", ":8000", "address to listen on")
+
+func main() {
+	if err := run(); err != nil {
+		fmt.Fprintln(os.Stderr, err)
+	}
+}
+
+func run() error {
+	flag.Parse()
+	hostname, err := os.Hostname()
+	if err != nil {
+		hostname = "unknown"
+	}
+	// BaseURL for OAuth callbacks - use exe.dev proxy URL (standard HTTPS port)
+	// Bluesky OAuth requires standard ports, so we use the main exe.xyz proxy
+	baseURL := os.Getenv("BASE_URL")
+	if baseURL == "" {
+		baseURL = fmt.Sprintf("https://%s.exe.xyz", hostname)
+	}
+	server, err := srv.New("db.sqlite3", hostname, baseURL)
+	if err != nil {
+		return fmt.Errorf("create server: %w", err)
+	}
+	return server.Serve(*flagListenAddr)
+}

db/db.go

···
+package db
+
+import (
+	"database/sql"
+	"embed"
+	"errors"
+	"fmt"
+	"log/slog"
+	"regexp"
+	"sort"
+	"strconv"
+
+	_ "modernc.org/sqlite"
+)
+
+//go:generate go tool github.com/sqlc-dev/sqlc/cmd/sqlc generate
+
+//go:embed migrations/*.sql
+var migrationFS embed.FS
+
+// Open opens an sqlite database and prepares pragmas suitable for a small web app.
+func Open(path string) (*sql.DB, error) {
+	db, err := sql.Open("sqlite", path)
+	if err != nil {
+		return nil, err
+	}
+	// Light pragmas similar
+	if _, err := db.Exec("PRAGMA foreign_keys=ON;"); err != nil {
+		_ = db.Close()
+		return nil, fmt.Errorf("enable foreign keys: %w", err)
+	}
+	if _, err := db.Exec("PRAGMA journal_mode=wal;"); err != nil {
+		_ = db.Close()
+		return nil, fmt.Errorf("set WAL: %w", err)
+	}
+	if _, err := db.Exec("PRAGMA busy_timeout=1000;"); err != nil {
+		_ = db.Close()
+		return nil, fmt.Errorf("set busy_timeout: %w", err)
+	}
+	return db, nil
+}
+
+// RunMigrations executes database migrations in numeric order (NNN-*.sql),
+// similar in spirit to exed's exedb.RunMigrations.
+func RunMigrations(db *sql.DB) error {
+	entries, err := migrationFS.ReadDir("migrations")
+	if err != nil {
+		return fmt.Errorf("read migrations dir: %w", err)
+	}
+	var migrations []string
+	pat := regexp.MustCompile(`^(\d{3})-.*\.sql$`)
+	for _, e := range entries {
+		if e.IsDir() {
+			continue
+		}
+		name := e.Name()
+		if pat.MatchString(name) {
+			migrations = append(migrations, name)
+		}
+	}
+	sort.Strings(migrations)
+
+	executed := make(map[int]bool)
+	var tableName string
+	err = db.QueryRow("SELECT name FROM sqlite_master WHERE type='table' AND name='migrations'").Scan(&tableName)
+	switch {
+	case err == nil:
+		rows, err := db.Query("SELECT migration_number FROM migrations")
+		if err != nil {
+			return fmt.Errorf("query executed migrations: %w", err)
+		}
+		defer rows.Close()
+		for rows.Next() {
+			var n int
+			if err := rows.Scan(&n); err != nil {
+				return fmt.Errorf("scan migration number: %w", err)
+			}
+			executed[n] = true
+		}
+	case errors.Is(err, sql.ErrNoRows):
+		slog.Info("db: migrations table not found; running all migrations")
+	default:
+		return fmt.Errorf("check migrations table: %w", err)
+	}
+
+	for _, m := range migrations {
+		match := pat.FindStringSubmatch(m)
+		if len(match) != 2 {
+			return fmt.Errorf("invalid migration filename: %s", m)
+		}
+		n, err := strconv.Atoi(match[1])
+		if err != nil {
+			return fmt.Errorf("parse migration number %s: %w", m, err)
+		}
+		if executed[n] {
+			continue
+		}
+		if err := executeMigration(db, m); err != nil {
+			return fmt.Errorf("execute %s: %w", m, err)
+		}
+		slog.Info("db: applied migration", "file", m, "number", n)
+	}
+	return nil
+}
+
+func executeMigration(db *sql.DB, filename string) error {
+	content, err := migrationFS.ReadFile("migrations/" + filename)
+	if err != nil {
+		return fmt.Errorf("read %s: %w", filename, err)
+	}
+	if _, err := db.Exec(string(content)); err != nil {
+		return fmt.Errorf("exec %s: %w", filename, err)
+	}
+	return nil
+}

db/dbgen/bsky.sql.go

···
+// Code generated by sqlc. DO NOT EDIT.
+// versions:
+//   sqlc v1.30.0
+// source: bsky.sql
+
+package dbgen
+
+import (
+	"context"
+	"time"
+)
+
+const cleanExpiredOAuthStates = `-- name: CleanExpiredOAuthStates :exec
+DELETE FROM oauth_states WHERE created_at < datetime('now', '-1 hour')
+`
+
+func (q *Queries) CleanExpiredOAuthStates(ctx context.Context) error {
+	_, err := q.db.ExecContext(ctx, cleanExpiredOAuthStates)
+	return err
+}
+
+const createOAuthSession = `-- name: CreateOAuthSession :exec
+INSERT INTO oauth_sessions (id, did, handle, pds_url, access_token, refresh_token, token_type, expires_at, dpop_private_key, created_at, updated_at)
+VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+`
+
+type CreateOAuthSessionParams struct {
+	ID             string    `json:"id"`
+	Did            string    `json:"did"`
+	Handle         string    `json:"handle"`
+	PdsUrl         string    `json:"pds_url"`
+	AccessToken    string    `json:"access_token"`
+	RefreshToken   *string   `json:"refresh_token"`
+	TokenType      string    `json:"token_type"`
+	ExpiresAt      time.Time `json:"expires_at"`
+	DpopPrivateKey string    `json:"dpop_private_key"`
+	CreatedAt      time.Time `json:"created_at"`
+	UpdatedAt      time.Time `json:"updated_at"`
+}
+
+func (q *Queries) CreateOAuthSession(ctx context.Context, arg CreateOAuthSessionParams) error {
+	_, err := q.db.ExecContext(ctx, createOAuthSession,
+		arg.ID,
+		arg.Did,
+		arg.Handle,
+		arg.PdsUrl,
+		arg.AccessToken,
+		arg.RefreshToken,
+		arg.TokenType,
+		arg.ExpiresAt,
+		arg.DpopPrivateKey,
+		arg.CreatedAt,
+		arg.UpdatedAt,
+	)
+	return err
+}
+
+const createOAuthState = `-- name: CreateOAuthState :exec
+INSERT INTO oauth_states (state, code_verifier, did, pds_url, auth_server_url, dpop_private_key, created_at)
+VALUES (?, ?, ?, ?, ?, ?, ?)
+`
+
+type CreateOAuthStateParams struct {
+	State          string    `json:"state"`
+	CodeVerifier   string    `json:"code_verifier"`
+	Did            *string   `json:"did"`
+	PdsUrl         string    `json:"pds_url"`
+	AuthServerUrl  string    `json:"auth_server_url"`
+	DpopPrivateKey string    `json:"dpop_private_key"`
+	CreatedAt      time.Time `json:"created_at"`
+}
+
+func (q *Queries) CreateOAuthState(ctx context.Context, arg CreateOAuthStateParams) error {
+	_, err := q.db.ExecContext(ctx, createOAuthState,
+		arg.State,
+		arg.CodeVerifier,
+		arg.Did,
+		arg.PdsUrl,
+		arg.AuthServerUrl,
+		arg.DpopPrivateKey,
+		arg.CreatedAt,
+	)
+	return err
+}
+
+const createPost = `-- name: CreatePost :one
+INSERT INTO posts (session_id, did, handle, uri, cid, text, thread_root_uri, reply_parent_uri, created_at)
+VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+RETURNING id, session_id, did, handle, uri, cid, text, thread_root_uri, reply_parent_uri, created_at
+`
+
+type CreatePostParams struct {
+	SessionID      string    `json:"session_id"`
+	Did            string    `json:"did"`
+	Handle         string    `json:"handle"`
+	Uri            string    `json:"uri"`
+	Cid            string    `json:"cid"`
+	Text           string    `json:"text"`
+	ThreadRootUri  *string   `json:"thread_root_uri"`
+	ReplyParentUri *string   `json:"reply_parent_uri"`
+	CreatedAt      time.Time `json:"created_at"`
+}
+
+func (q *Queries) CreatePost(ctx context.Context, arg CreatePostParams) (Post, error) {
+	row := q.db.QueryRowContext(ctx, createPost,
+		arg.SessionID,
+		arg.Did,
+		arg.Handle,
+		arg.Uri,
+		arg.Cid,
+		arg.Text,
+		arg.ThreadRootUri,
+		arg.ReplyParentUri,
+		arg.CreatedAt,
+	)
+	var i Post
+	err := row.Scan(
+		&i.ID,
+		&i.SessionID,
+		&i.Did,
+		&i.Handle,
+		&i.Uri,
+		&i.Cid,
+		&i.Text,
+		&i.ThreadRootUri,
+		&i.ReplyParentUri,
+		&i.CreatedAt,
+	)
+	return i, err
+}
+
+const deleteOAuthSession = `-- name: DeleteOAuthSession :exec
+DELETE FROM oauth_sessions WHERE id = ?
+`
+
+func (q *Queries) DeleteOAuthSession(ctx context.Context, id string) error {
+	_, err := q.db.ExecContext(ctx, deleteOAuthSession, id)
+	return err
+}
+
+const deleteOAuthState = `-- name: DeleteOAuthState :exec
+DELETE FROM oauth_states WHERE state = ?
+`
+
+func (q *Queries) DeleteOAuthState(ctx context.Context, state string) error {
+	_, err := q.db.ExecContext(ctx, deleteOAuthState, state)
+	return err
+}
+
+const getOAuthSession = `-- name: GetOAuthSession :one
+SELECT id, did, handle, pds_url, access_token, refresh_token, token_type, expires_at, dpop_private_key, created_at, updated_at FROM oauth_sessions WHERE id = ?
+`
+
+func (q *Queries) GetOAuthSession(ctx context.Context, id string) (OauthSession, error) {
+	row := q.db.QueryRowContext(ctx, getOAuthSession, id)
+	var i OauthSession
+	err := row.Scan(
+		&i.ID,
+		&i.Did,
+		&i.Handle,
+		&i.PdsUrl,
+		&i.AccessToken,
+		&i.RefreshToken,
+		&i.TokenType,
+		&i.ExpiresAt,
+		&i.DpopPrivateKey,
+		&i.CreatedAt,
+		&i.UpdatedAt,
+	)
+	return i, err
+}
+
+const getOAuthSessionByDID = `-- name: GetOAuthSessionByDID :one
+SELECT id, did, handle, pds_url, access_token, refresh_token, token_type, expires_at, dpop_private_key, created_at, updated_at FROM oauth_sessions WHERE did = ? ORDER BY updated_at DESC LIMIT 1
+`
+
+func (q *Queries) GetOAuthSessionByDID(ctx context.Context, did string) (OauthSession, error) {
+	row := q.db.QueryRowContext(ctx, getOAuthSessionByDID, did)
+	var i OauthSession
+	err := row.Scan(
+		&i.ID,
+		&i.Did,
+		&i.Handle,
+		&i.PdsUrl,
+		&i.AccessToken,
+		&i.RefreshToken,
+		&i.TokenType,
+		&i.ExpiresAt,
+		&i.DpopPrivateKey,
+		&i.CreatedAt,
+		&i.UpdatedAt,
+	)
+	return i, err
+}
+
+const getOAuthState = `-- name: GetOAuthState :one
+SELECT state, code_verifier, did, pds_url, auth_server_url, dpop_private_key, created_at FROM oauth_states WHERE state = ?
+`
+
+func (q *Queries) GetOAuthState(ctx context.Context, state string) (OauthState, error) {
+	row := q.db.QueryRowContext(ctx, getOAuthState, state)
+	var i OauthState
+	err := row.Scan(
+		&i.State,
+		&i.CodeVerifier,
+		&i.Did,
+		&i.PdsUrl,
+		&i.AuthServerUrl,
+		&i.DpopPrivateKey,
+		&i.CreatedAt,
+	)
+	return i, err
+}
+
+const getPostsBySession = `-- name: GetPostsBySession :many
+SELECT id, session_id, did, handle, uri, cid, text, thread_root_uri, reply_parent_uri, created_at FROM posts WHERE session_id = ? ORDER BY created_at DESC LIMIT ?
+`
+
+type GetPostsBySessionParams struct {
+	SessionID string `json:"session_id"`
+	Limit     int64  `json:"limit"`
+}
+
+func (q *Queries) GetPostsBySession(ctx context.Context, arg GetPostsBySessionParams) ([]Post, error) {
+	rows, err := q.db.QueryContext(ctx, getPostsBySession, arg.SessionID, arg.Limit)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []Post{}
+	for rows.Next() {
+		var i Post
+		if err := rows.Scan(
+			&i.ID,
+			&i.SessionID,
+			&i.Did,
+			&i.Handle,
+			&i.Uri,
+			&i.Cid,
+			&i.Text,
+			&i.ThreadRootUri,
+			&i.ReplyParentUri,
+			&i.CreatedAt,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const getRecentPosts = `-- name: GetRecentPosts :many
+SELECT id, session_id, did, handle, uri, cid, text, thread_root_uri, reply_parent_uri, created_at FROM posts ORDER BY created_at DESC LIMIT ?
+`
+
+func (q *Queries) GetRecentPosts(ctx context.Context, limit int64) ([]Post, error) {
+	rows, err := q.db.QueryContext(ctx, getRecentPosts, limit)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []Post{}
+	for rows.Next() {
+		var i Post
+		if err := rows.Scan(
+			&i.ID,
+			&i.SessionID,
+			&i.Did,
+			&i.Handle,
+			&i.Uri,
+			&i.Cid,
+			&i.Text,
+			&i.ThreadRootUri,
+			&i.ReplyParentUri,
+			&i.CreatedAt,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const updateOAuthSession = `-- name: UpdateOAuthSession :exec
+UPDATE oauth_sessions 
+SET access_token = ?, refresh_token = ?, expires_at = ?, updated_at = ?
+WHERE id = ?
+`
+
+type UpdateOAuthSessionParams struct {
+	AccessToken  string    `json:"access_token"`
+	RefreshToken *string   `json:"refresh_token"`
+	ExpiresAt    time.Time `json:"expires_at"`
+	UpdatedAt    time.Time `json:"updated_at"`
+	ID           string    `json:"id"`
+}
+
+func (q *Queries) UpdateOAuthSession(ctx context.Context, arg UpdateOAuthSessionParams) error {
+	_, err := q.db.ExecContext(ctx, updateOAuthSession,
+		arg.AccessToken,
+		arg.RefreshToken,
+		arg.ExpiresAt,
+		arg.UpdatedAt,
+		arg.ID,
+	)
+	return err
+}

db/dbgen/db.go

···
+// Code generated by sqlc. DO NOT EDIT.
+// versions:
+//   sqlc v1.30.0
+
+package dbgen
+
+import (
+	"context"
+	"database/sql"
+)
+
+type DBTX interface {
+	ExecContext(context.Context, string, ...interface{}) (sql.Result, error)
+	PrepareContext(context.Context, string) (*sql.Stmt, error)
+	QueryContext(context.Context, string, ...interface{}) (*sql.Rows, error)
+	QueryRowContext(context.Context, string, ...interface{}) *sql.Row
+}
+
+func New(db DBTX) *Queries {
+	return &Queries{db: db}
+}
+
+type Queries struct {
+	db DBTX
+}
+
+func (q *Queries) WithTx(tx *sql.Tx) *Queries {
+	return &Queries{
+		db: tx,
+	}
+}

db/dbgen/models.go

···
+// Code generated by sqlc. DO NOT EDIT.
+// versions:
+//   sqlc v1.30.0
+
+package dbgen
+
+import (
+	"time"
+)
+
+type Migration struct {
+	MigrationNumber int64     `json:"migration_number"`
+	MigrationName   string    `json:"migration_name"`
+	ExecutedAt      time.Time `json:"executed_at"`
+}
+
+type OauthSession struct {
+	ID             string    `json:"id"`
+	Did            string    `json:"did"`
+	Handle         string    `json:"handle"`
+	PdsUrl         string    `json:"pds_url"`
+	AccessToken    string    `json:"access_token"`
+	RefreshToken   *string   `json:"refresh_token"`
+	TokenType      string    `json:"token_type"`
+	ExpiresAt      time.Time `json:"expires_at"`
+	DpopPrivateKey string    `json:"dpop_private_key"`
+	CreatedAt      time.Time `json:"created_at"`
+	UpdatedAt      time.Time `json:"updated_at"`
+}
+
+type OauthState struct {
+	State          string    `json:"state"`
+	CodeVerifier   string    `json:"code_verifier"`
+	Did            *string   `json:"did"`
+	PdsUrl         string    `json:"pds_url"`
+	AuthServerUrl  string    `json:"auth_server_url"`
+	DpopPrivateKey string    `json:"dpop_private_key"`
+	CreatedAt      time.Time `json:"created_at"`
+}
+
+type Post struct {
+	ID             int64     `json:"id"`
+	SessionID      string    `json:"session_id"`
+	Did            string    `json:"did"`
+	Handle         string    `json:"handle"`
+	Uri            string    `json:"uri"`
+	Cid            string    `json:"cid"`
+	Text           string    `json:"text"`
+	ThreadRootUri  *string   `json:"thread_root_uri"`
+	ReplyParentUri *string   `json:"reply_parent_uri"`
+	CreatedAt      time.Time `json:"created_at"`
+}
+
+type Visitor struct {
+	ID        string    `json:"id"`
+	ViewCount int64     `json:"view_count"`
+	CreatedAt time.Time `json:"created_at"`
+	LastSeen  time.Time `json:"last_seen"`
+}

db/dbgen/visitors.sql.go

···
+// Code generated by sqlc. DO NOT EDIT.
+// versions:
+//   sqlc v1.30.0
+// source: visitors.sql
+
+package dbgen
+
+import (
+	"context"
+	"time"
+)
+
+const upsertVisitor = `-- name: UpsertVisitor :exec
+INSERT INTO
+  visitors (id, view_count, created_at, last_seen)
+VALUES
+  (?, 1, ?, ?) ON CONFLICT (id) DO
+UPDATE
+SET
+  view_count = view_count + 1,
+  last_seen = excluded.last_seen
+`
+
+type UpsertVisitorParams struct {
+	ID        string    `json:"id"`
+	CreatedAt time.Time `json:"created_at"`
+	LastSeen  time.Time `json:"last_seen"`
+}
+
+func (q *Queries) UpsertVisitor(ctx context.Context, arg UpsertVisitorParams) error {
+	_, err := q.db.ExecContext(ctx, upsertVisitor, arg.ID, arg.CreatedAt, arg.LastSeen)
+	return err
+}
+
+const visitorWithID = `-- name: VisitorWithID :one
+SELECT
+  id, view_count, created_at, last_seen
+FROM
+  visitors
+WHERE
+  id = ?
+`
+
+func (q *Queries) VisitorWithID(ctx context.Context, id string) (Visitor, error) {
+	row := q.db.QueryRowContext(ctx, visitorWithID, id)
+	var i Visitor
+	err := row.Scan(
+		&i.ID,
+		&i.ViewCount,
+		&i.CreatedAt,
+		&i.LastSeen,
+	)
+	return i, err
+}

db/migrations/001-base.sql

···
+-- Base schema
+--
+-- Migrations tracking table
+CREATE TABLE IF NOT EXISTS migrations (
+    migration_number INTEGER PRIMARY KEY,
+    migration_name TEXT NOT NULL,
+    executed_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+
+-- Visitors table
+CREATE TABLE IF NOT EXISTS visitors (
+    id TEXT PRIMARY KEY,
+    view_count INTEGER NOT NULL,
+    created_at TIMESTAMP NOT NULL,
+    last_seen TIMESTAMP NOT NULL
+);
+
+-- Record execution of this migration
+INSERT
+OR IGNORE INTO migrations (migration_number, migration_name)
+VALUES
+    (001, '001-base');

db/migrations/002-bsky.sql

···
+-- OAuth sessions for Bluesky
+CREATE TABLE IF NOT EXISTS oauth_sessions (
+    id TEXT PRIMARY KEY,
+    did TEXT NOT NULL,
+    handle TEXT NOT NULL,
+    pds_url TEXT NOT NULL,
+    access_token TEXT NOT NULL,
+    refresh_token TEXT,
+    token_type TEXT NOT NULL DEFAULT 'DPoP',
+    expires_at TIMESTAMP NOT NULL,
+    dpop_private_key TEXT NOT NULL,
+    created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    updated_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+
+CREATE INDEX idx_oauth_sessions_did ON oauth_sessions(did);
+
+-- OAuth state for PKCE flow
+CREATE TABLE IF NOT EXISTS oauth_states (
+    state TEXT PRIMARY KEY,
+    code_verifier TEXT NOT NULL,
+    did TEXT,
+    pds_url TEXT NOT NULL,
+    auth_server_url TEXT NOT NULL,
+    dpop_private_key TEXT NOT NULL,
+    created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+
+-- Posts made through this app
+CREATE TABLE IF NOT EXISTS posts (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    session_id TEXT NOT NULL,
+    did TEXT NOT NULL,
+    handle TEXT NOT NULL,
+    uri TEXT NOT NULL,
+    cid TEXT NOT NULL,
+    text TEXT NOT NULL,
+    thread_root_uri TEXT,
+    reply_parent_uri TEXT,
+    created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    FOREIGN KEY (session_id) REFERENCES oauth_sessions(id) ON DELETE CASCADE
+);
+
+CREATE INDEX idx_posts_session ON posts(session_id);
+CREATE INDEX idx_posts_created ON posts(created_at DESC);
+
+INSERT OR IGNORE INTO migrations (migration_number, migration_name)
+VALUES (002, '002-bsky');

db/queries/bsky.sql

···
+-- name: CreateOAuthState :exec
+INSERT INTO oauth_states (state, code_verifier, did, pds_url, auth_server_url, dpop_private_key, created_at)
+VALUES (?, ?, ?, ?, ?, ?, ?);
+
+-- name: GetOAuthState :one
+SELECT * FROM oauth_states WHERE state = ?;
+
+-- name: DeleteOAuthState :exec
+DELETE FROM oauth_states WHERE state = ?;
+
+-- name: CleanExpiredOAuthStates :exec
+DELETE FROM oauth_states WHERE created_at < datetime('now', '-1 hour');
+
+-- name: CreateOAuthSession :exec
+INSERT INTO oauth_sessions (id, did, handle, pds_url, access_token, refresh_token, token_type, expires_at, dpop_private_key, created_at, updated_at)
+VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?);
+
+-- name: GetOAuthSession :one
+SELECT * FROM oauth_sessions WHERE id = ?;
+
+-- name: GetOAuthSessionByDID :one
+SELECT * FROM oauth_sessions WHERE did = ? ORDER BY updated_at DESC LIMIT 1;
+
+-- name: UpdateOAuthSession :exec
+UPDATE oauth_sessions 
+SET access_token = ?, refresh_token = ?, expires_at = ?, updated_at = ?
+WHERE id = ?;
+
+-- name: DeleteOAuthSession :exec
+DELETE FROM oauth_sessions WHERE id = ?;
+
+-- name: CreatePost :one
+INSERT INTO posts (session_id, did, handle, uri, cid, text, thread_root_uri, reply_parent_uri, created_at)
+VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+RETURNING *;
+
+-- name: GetRecentPosts :many
+SELECT * FROM posts ORDER BY created_at DESC LIMIT ?;
+
+-- name: GetPostsBySession :many
+SELECT * FROM posts WHERE session_id = ? ORDER BY created_at DESC LIMIT ?;

db/queries/visitors.sql

···
+-- name: UpsertVisitor :exec
+INSERT INTO
+  visitors (id, view_count, created_at, last_seen)
+VALUES
+  (?, 1, ?, ?) ON CONFLICT (id) DO
+UPDATE
+SET
+  view_count = view_count + 1,
+  last_seen = excluded.last_seen;
+
+-- name: VisitorWithID :one
+SELECT
+  *
+FROM
+  visitors
+WHERE
+  id = ?;

db/sqlc.yaml

···
+version: "2"
+sql:
+  - engine: "sqlite"
+    queries: "queries/"
+    schema: "migrations/"
+    gen:
+      go:
+        package: "dbgen"
+        out: "dbgen/"
+        emit_json_tags: true
+        emit_empty_slices: true
+        emit_pointers_for_null_types: true
+        json_tags_case_style: "snake"
+        sql_package: "database/sql"

go.mod

···
+module srv.exe.dev
+
+go 1.25.5
+
+require modernc.org/sqlite v1.39.0
+
+require (
+	cel.dev/expr v0.24.0 // indirect
+	filippo.io/edwards25519 v1.1.0 // indirect
+	github.com/antlr4-go/antlr/v4 v4.13.1 // indirect
+	github.com/cubicdaiya/gonp v1.0.4 // indirect
+	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/dustin/go-humanize v1.0.1 // indirect
+	github.com/fatih/structtag v1.2.0 // indirect
+	github.com/go-sql-driver/mysql v1.9.3 // indirect
+	github.com/google/cel-go v0.26.1 // indirect
+	github.com/google/uuid v1.6.0 // indirect
+	github.com/inconshreveable/mousetrap v1.1.0 // indirect
+	github.com/jackc/pgpassfile v1.0.0 // indirect
+	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
+	github.com/jackc/pgx/v5 v5.7.5 // indirect
+	github.com/jackc/puddle/v2 v2.2.2 // indirect
+	github.com/jinzhu/inflection v1.0.0 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/ncruces/go-strftime v0.1.9 // indirect
+	github.com/pganalyze/pg_query_go/v6 v6.1.0 // indirect
+	github.com/pingcap/errors v0.11.5-0.20240311024730-e056997136bb // indirect
+	github.com/pingcap/failpoint v0.0.0-20240528011301-b51a646c7c86 // indirect
+	github.com/pingcap/log v1.1.0 // indirect
+	github.com/pingcap/tidb/pkg/parser v0.0.0-20250324122243-d51e00e5bbf0 // indirect
+	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
+	github.com/riza-io/grpc-go v0.2.0 // indirect
+	github.com/spf13/cobra v1.9.1 // indirect
+	github.com/spf13/pflag v1.0.7 // indirect
+	github.com/sqlc-dev/sqlc v1.30.0 // indirect
+	github.com/stoewer/go-strcase v1.2.0 // indirect
+	github.com/tetratelabs/wazero v1.9.0 // indirect
+	github.com/wasilibs/go-pgquery v0.0.0-20250409022910-10ac41983c07 // indirect
+	github.com/wasilibs/wazero-helpers v0.0.0-20240620070341-3dff1577cd52 // indirect
+	go.uber.org/atomic v1.11.0 // indirect
+	go.uber.org/multierr v1.11.0 // indirect
+	go.uber.org/zap v1.27.0 // indirect
+	golang.org/x/crypto v0.39.0 // indirect
+	golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b // indirect
+	golang.org/x/net v0.41.0 // indirect
+	golang.org/x/sync v0.16.0 // indirect
+	golang.org/x/sys v0.34.0 // indirect
+	golang.org/x/text v0.26.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20250707201910-8d1bb00bc6a7 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250707201910-8d1bb00bc6a7 // indirect
+	google.golang.org/grpc v1.75.0 // indirect
+	google.golang.org/protobuf v1.36.8 // indirect
+	gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+	modernc.org/libc v1.66.3 // indirect
+	modernc.org/mathutil v1.7.1 // indirect
+	modernc.org/memory v1.11.0 // indirect
+)
+
+tool github.com/sqlc-dev/sqlc/cmd/sqlc

go.sum

···
+cel.dev/expr v0.24.0 h1:56OvJKSH3hDGL0ml5uSxZmz3/3Pq4tJ+fb1unVLAFcY=
+cel.dev/expr v0.24.0/go.mod h1:hLPLo1W4QUmuYdA72RBX06QTs6MXw941piREPl3Yfiw=
+filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
+filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
+github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
+github.com/antlr4-go/antlr/v4 v4.13.1 h1:SqQKkuVZ+zWkMMNkjy5FZe5mr5WURWnlpmOuzYWrPrQ=
+github.com/antlr4-go/antlr/v4 v4.13.1/go.mod h1:GKmUxMtwp6ZgGwZSva4eWPC5mS6vUAmOABFgjdkM7Nw=
+github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
+github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
+github.com/cubicdaiya/gonp v1.0.4 h1:ky2uIAJh81WiLcGKBVD5R7KsM/36W6IqqTy6Bo6rGws=
+github.com/cubicdaiya/gonp v1.0.4/go.mod h1:iWGuP/7+JVTn02OWhRemVbMmG1DOUnmrGTYYACpOI0I=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
+github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
+github.com/fatih/structtag v1.2.0 h1:/OdNE99OxoI/PqaW/SuSK9uxxT3f/tcSZgon/ssNSx4=
+github.com/fatih/structtag v1.2.0/go.mod h1:mBJUNpUnHmRKrKlQQlmCrh5PuhftFbNv8Ys4/aAZl94=
+github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
+github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
+github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
+github.com/go-sql-driver/mysql v1.9.3 h1:U/N249h2WzJ3Ukj8SowVFjdtZKfu9vlLZxjPXV1aweo=
+github.com/go-sql-driver/mysql v1.9.3/go.mod h1:qn46aNg1333BRMNU69Lq93t8du/dwxI64Gl8i5p1WMU=
+github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
+github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
+github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
+github.com/google/cel-go v0.26.1 h1:iPbVVEdkhTX++hpe3lzSk7D3G3QSYqLGoHOcEio+UXQ=
+github.com/google/cel-go v0.26.1/go.mod h1:A9O8OU9rdvrK5MQyrqfIxo1a0u4g3sF8KB6PUIaryMM=
+github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e h1:ijClszYn+mADRFY17kjQEVQ1XRhq2/JR1M3sGqeJoxs=
+github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
+github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
+github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM=
+github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
+github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo=
+github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
+github.com/jackc/pgx/v5 v5.7.5 h1:JHGfMnQY+IEtGM63d+NGMjoRpysB2JBwDr5fsngwmJs=
+github.com/jackc/pgx/v5 v5.7.5/go.mod h1:aruU7o91Tc2q2cFp5h4uP3f6ztExVpyVv88Xl/8Vl8M=
+github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo=
+github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
+github.com/jinzhu/inflection v1.0.0 h1:K317FqzuhWc8YvSVlFMCCUb36O/S9MCKRDI7QkRKD/E=
+github.com/jinzhu/inflection v1.0.0/go.mod h1:h+uFLlag+Qp1Va5pdKtLDYj+kHp5pxUVkryuEj+Srlc=
+github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
+github.com/kr/pretty v0.3.0 h1:WgNl7dwNpEZ6jJ9k1snq4pZsg7DOEN8hP9Xw0Tsjwk0=
+github.com/kr/pretty v0.3.0/go.mod h1:640gp4NfQd8pI5XOwp5fnNeVWj67G7CFk/SaSQn7NBk=
+github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/ncruces/go-strftime v0.1.9 h1:bY0MQC28UADQmHmaF5dgpLmImcShSi2kHU9XLdhx/f4=
+github.com/ncruces/go-strftime v0.1.9/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
+github.com/pganalyze/pg_query_go/v6 v6.1.0 h1:jG5ZLhcVgL1FAw4C/0VNQaVmX1SUJx71wBGdtTtBvls=
+github.com/pganalyze/pg_query_go/v6 v6.1.0/go.mod h1:nvTHIuoud6e1SfrUaFwHqT0i4b5Nr+1rPWVds3B5+50=
+github.com/pingcap/errors v0.11.0/go.mod h1:Oi8TUi2kEtXXLMJk9l1cGmz20kV3TaQ0usTwv5KuLY8=
+github.com/pingcap/errors v0.11.5-0.20240311024730-e056997136bb h1:3pSi4EDG6hg0orE1ndHkXvX6Qdq2cZn8gAPir8ymKZk=
+github.com/pingcap/errors v0.11.5-0.20240311024730-e056997136bb/go.mod h1:X2r9ueLEUZgtx2cIogM0v4Zj5uvvzhuuiu7Pn8HzMPg=
+github.com/pingcap/failpoint v0.0.0-20240528011301-b51a646c7c86 h1:tdMsjOqUR7YXHoBitzdebTvOjs/swniBTOLy5XiMtuE=
+github.com/pingcap/failpoint v0.0.0-20240528011301-b51a646c7c86/go.mod h1:exzhVYca3WRtd6gclGNErRWb1qEgff3LYta0LvRmON4=
+github.com/pingcap/log v1.1.0 h1:ELiPxACz7vdo1qAvvaWJg1NrYFoY6gqAh/+Uo6aXdD8=
+github.com/pingcap/log v1.1.0/go.mod h1:DWQW5jICDR7UJh4HtxXSM20Churx4CQL0fwL/SoOSA4=
+github.com/pingcap/tidb/pkg/parser v0.0.0-20250324122243-d51e00e5bbf0 h1:W3rpAI3bubR6VWOcwxDIG0Gz9G5rl5b3SL116T0vBt0=
+github.com/pingcap/tidb/pkg/parser v0.0.0-20250324122243-d51e00e5bbf0/go.mod h1:+8feuexTKcXHZF/dkDfvCwEyBAmgb4paFc3/WeYV2eE=
+github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
+github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
+github.com/riza-io/grpc-go v0.2.0 h1:2HxQKFVE7VuYstcJ8zqpN84VnAoJ4dCL6YFhJewNcHQ=
+github.com/riza-io/grpc-go v0.2.0/go.mod h1:2bDvR9KkKC3KhtlSHfR3dAXjUMT86kg4UfWFyVGWqi8=
+github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ=
+github.com/rogpeppe/go-internal v1.10.0/go.mod h1:UQnix2H7Ngw/k4C5ijL5+65zddjncjaFoBhdsK/akog=
+github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
+github.com/spf13/cobra v1.9.1 h1:CXSaggrXdbHK9CF+8ywj8Amf7PBRmPCOJugH954Nnlo=
+github.com/spf13/cobra v1.9.1/go.mod h1:nDyEzZ8ogv936Cinf6g1RU9MRY64Ir93oCnqb9wxYW0=
+github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.7 h1:vN6T9TfwStFPFM5XzjsvmzZkLuaLX+HS+0SeFLRgU6M=
+github.com/spf13/pflag v1.0.7/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/sqlc-dev/sqlc v1.30.0 h1:H4HrNwPc0hntxGWzAbhlfplPRN4bQpXFx+CaEMcKz6c=
+github.com/sqlc-dev/sqlc v1.30.0/go.mod h1:QnEN+npugyhUg1A+1kkYM3jc2OMOFsNlZ1eh8mdhad0=
+github.com/stoewer/go-strcase v1.2.0 h1:Z2iHWqGXH00XYgqDmNgQbIBxf3wrNq0F3feEy0ainaU=
+github.com/stoewer/go-strcase v1.2.0/go.mod h1:IBiWB2sKIp3wVVQ3Y035++gc+knqhUQag1KpM8ahLw8=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
+github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
+github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
+github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/tetratelabs/wazero v1.9.0 h1:IcZ56OuxrtaEz8UYNRHBrUa9bYeX9oVY93KspZZBf/I=
+github.com/tetratelabs/wazero v1.9.0/go.mod h1:TSbcXCfFP0L2FGkRPxHphadXPjo1T6W+CseNNY7EkjM=
+github.com/wasilibs/go-pgquery v0.0.0-20250409022910-10ac41983c07 h1:mJdDDPblDfPe7z7go8Dvv1AJQDI3eQ/5xith3q2mFlo=
+github.com/wasilibs/go-pgquery v0.0.0-20250409022910-10ac41983c07/go.mod h1:Ak17IJ037caFp4jpCw/iQQ7/W74Sqpb1YuKJU6HTKfM=
+github.com/wasilibs/wazero-helpers v0.0.0-20240620070341-3dff1577cd52 h1:OvLBa8SqJnZ6P+mjlzc2K7PM22rRUPE1x32G9DTPrC4=
+github.com/wasilibs/wazero-helpers v0.0.0-20240620070341-3dff1577cd52/go.mod h1:jMeV4Vpbi8osrE/pKUxRZkVaA0EX7NZN0A9/oRzgpgY=
+go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
+go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
+go.opentelemetry.io/otel v1.37.0 h1:9zhNfelUvx0KBfu/gb+ZgeAfAgtWrfHJZcAqFC228wQ=
+go.opentelemetry.io/otel v1.37.0/go.mod h1:ehE/umFRLnuLa/vSccNq9oS1ErUlkkK71gMcN34UG8I=
+go.opentelemetry.io/otel/metric v1.37.0 h1:mvwbQS5m0tbmqML4NqK+e3aDiO02vsf/WgbsdpcPoZE=
+go.opentelemetry.io/otel/metric v1.37.0/go.mod h1:04wGrZurHYKOc+RKeye86GwKiTb9FKm1WHtO+4EVr2E=
+go.opentelemetry.io/otel/sdk v1.37.0 h1:ItB0QUqnjesGRvNcmAcU0LyvkVyGJ2xftD29bWdDvKI=
+go.opentelemetry.io/otel/sdk v1.37.0/go.mod h1:VredYzxUvuo2q3WRcDnKDjbdvmO0sCzOvVAiY+yUkAg=
+go.opentelemetry.io/otel/sdk/metric v1.37.0 h1:90lI228XrB9jCMuSdA0673aubgRobVZFhbjxHHspCPc=
+go.opentelemetry.io/otel/sdk/metric v1.37.0/go.mod h1:cNen4ZWfiD37l5NhS+Keb5RXVWZWpRE+9WyVCpbo5ps=
+go.opentelemetry.io/otel/trace v1.37.0 h1:HLdcFNbRQBE2imdSEgm/kwqmQj1Or1l/7bW6mxVK7z4=
+go.opentelemetry.io/otel/trace v1.37.0/go.mod h1:TlgrlQ+PtQO5XFerSPUYG0JSgGyryXewPGyayAWSBS0=
+go.uber.org/atomic v1.6.0/go.mod h1:sABNBOSYdrvTF6hTgEIbc7YasKWGhgEQZyfxyTvoXHQ=
+go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
+go.uber.org/atomic v1.9.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
+go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=
+go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
+go.uber.org/goleak v1.1.10/go.mod h1:8a7PlsEVH3e/a/GLqe5IIrQx6GzcnRmZEufDUTk4A7A=
+go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
+go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
+go.uber.org/multierr v1.6.0/go.mod h1:cdWPpRnG4AhwMwsgIHip0KRBQjJy5kYEpYjJxpXp9iU=
+go.uber.org/multierr v1.7.0/go.mod h1:7EAYxJLBy9rStEaz58O2t4Uvip6FSURkq8/ppBp95ak=
+go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
+go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
+go.uber.org/zap v1.19.0/go.mod h1:xg/QME4nWcxGxrpdeYfq7UvYrLh66cuVKdrbD1XF/NI=
+go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
+go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.39.0 h1:SHs+kF4LP+f+p14esP5jAoDpHU8Gu/v9lFRK6IT5imM=
+golang.org/x/crypto v0.39.0/go.mod h1:L+Xg3Wf6HoL4Bn4238Z6ft6KfEpN0tJGo53AAPC632U=
+golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b h1:M2rDM6z3Fhozi9O7NWsxAkg/yqS/lQJ6PmkyIV3YP+o=
+golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b/go.mod h1:3//PLf8L/X+8b4vuAfHzxeRUl04Adcb341+IGKfnqS8=
+golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
+golang.org/x/mod v0.25.0 h1:n7a+ZbQKQA/Ysbyb0/6IbB1H/X41mKgbhfv7AfG/44w=
+golang.org/x/mod v0.25.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww=
+golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.41.0 h1:vBTly1HeNPEn3wtREYfy4GZ/NECgw2Cnl+nK6Nz3uvw=
+golang.org/x/net v0.41.0/go.mod h1:B/K4NNqkfmg07DQYrbwvSluqCJOOXwUjeb/5lOisjbA=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.16.0 h1:ycBJEhp9p4vXvUZNszeOq0kGTPghopOL8q0fq3vstxw=
+golang.org/x/sync v0.16.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.34.0 h1:H5Y5sJ2L2JRdyv7ROF1he/lPdvFsd0mJHFw2ThKHxLA=
+golang.org/x/sys v0.34.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.26.0 h1:P42AVeLghgTYr4+xUnTRKDMqpar+PtX7KWuNQL21L8M=
+golang.org/x/text v0.26.0/go.mod h1:QK15LZJUUQVJxhz7wXgxSy/CJaTFjd0G+YLonydOVQA=
+golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
+golang.org/x/tools v0.0.0-20191029041327-9cc4af7d6b2c/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191108193012-7d206e10da11/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.34.0 h1:qIpSLOxeCYGg9TrcJokLBG4KFA6d795g0xkBkiESGlo=
+golang.org/x/tools v0.34.0/go.mod h1:pAP9OwEaY1CAW3HOmg3hLZC5Z0CCmzjAF2UQMSqNARg=
+golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=
+gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=
+google.golang.org/genproto/googleapis/api v0.0.0-20250707201910-8d1bb00bc6a7 h1:FiusG7LWj+4byqhbvmB+Q93B/mOxJLN2DTozDuZm4EU=
+google.golang.org/genproto/googleapis/api v0.0.0-20250707201910-8d1bb00bc6a7/go.mod h1:kXqgZtrWaf6qS3jZOCnCH7WYfrvFjkC51bM8fz3RsCA=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250707201910-8d1bb00bc6a7 h1:pFyd6EwwL2TqFf8emdthzeX+gZE1ElRq3iM8pui4KBY=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250707201910-8d1bb00bc6a7/go.mod h1:qQ0YXyHHx3XkvlzUtpXDkS29lDSafHMZBAZDc03LQ3A=
+google.golang.org/grpc v1.75.0 h1:+TW+dqTd2Biwe6KKfhE5JpiYIBWq865PhKGSXiivqt4=
+google.golang.org/grpc v1.75.0/go.mod h1:JtPAzKiq4v1xcAB2hydNlWI2RnF85XXcV0mhKXr2ecQ=
+google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
+google.golang.org/protobuf v1.31.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
+google.golang.org/protobuf v1.36.8 h1:xHScyCOEuuwZEc6UtSOvPbAT4zRh0xcNRYekJwfqyMc=
+google.golang.org/protobuf v1.36.8/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/natefinch/lumberjack.v2 v2.0.0/go.mod h1:l0ndWWf7gzL7RNwBG7wST/UCcT4T24xpD6X8LsfU/+k=
+gopkg.in/natefinch/lumberjack.v2 v2.2.1 h1:bBRl1b0OH9s/DuPhuXpNl+VtCaJXFZ5/uEFST95x9zc=
+gopkg.in/natefinch/lumberjack.v2 v2.2.1/go.mod h1:YD8tP3GAjkrDg1eZH7EGmyESg/lsYskCTPBJVb9jqSc=
+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+modernc.org/cc/v4 v4.26.2 h1:991HMkLjJzYBIfha6ECZdjrIYz2/1ayr+FL8GN+CNzM=
+modernc.org/cc/v4 v4.26.2/go.mod h1:uVtb5OGqUKpoLWhqwNQo/8LwvoiEBLvZXIQ/SmO6mL0=
+modernc.org/ccgo/v4 v4.28.0 h1:rjznn6WWehKq7dG4JtLRKxb52Ecv8OUGah8+Z/SfpNU=
+modernc.org/ccgo/v4 v4.28.0/go.mod h1:JygV3+9AV6SmPhDasu4JgquwU81XAKLd3OKTUDNOiKE=
+modernc.org/fileutil v1.3.8 h1:qtzNm7ED75pd1C7WgAGcK4edm4fvhtBsEiI/0NQ54YM=
+modernc.org/fileutil v1.3.8/go.mod h1:HxmghZSZVAz/LXcMNwZPA/DRrQZEVP9VX0V4LQGQFOc=
+modernc.org/gc/v2 v2.6.5 h1:nyqdV8q46KvTpZlsw66kWqwXRHdjIlJOhG6kxiV/9xI=
+modernc.org/gc/v2 v2.6.5/go.mod h1:YgIahr1ypgfe7chRuJi2gD7DBQiKSLMPgBQe9oIiito=
+modernc.org/goabi0 v0.2.0 h1:HvEowk7LxcPd0eq6mVOAEMai46V+i7Jrj13t4AzuNks=
+modernc.org/goabi0 v0.2.0/go.mod h1:CEFRnnJhKvWT1c1JTI3Avm+tgOWbkOu5oPA8eH8LnMI=
+modernc.org/libc v1.66.3 h1:cfCbjTUcdsKyyZZfEUKfoHcP3S0Wkvz3jgSzByEWVCQ=
+modernc.org/libc v1.66.3/go.mod h1:XD9zO8kt59cANKvHPXpx7yS2ELPheAey0vjIuZOhOU8=
+modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
+modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
+modernc.org/memory v1.11.0 h1:o4QC8aMQzmcwCK3t3Ux/ZHmwFPzE6hf2Y5LbkRs+hbI=
+modernc.org/memory v1.11.0/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw=
+modernc.org/opt v0.1.4 h1:2kNGMRiUjrp4LcaPuLY2PzUfqM/w9N23quVwhKt5Qm8=
+modernc.org/opt v0.1.4/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
+modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
+modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
+modernc.org/sqlite v1.39.0 h1:6bwu9Ooim0yVYA7IZn9demiQk/Ejp0BtTjBWFLymSeY=
+modernc.org/sqlite v1.39.0/go.mod h1:cPTJYSlgg3Sfg046yBShXENNtPrWrDX8bsbAQBzgQ5E=
+modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
+modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
+modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=
+modernc.org/token v1.1.0/go.mod h1:UGzOrNV1mAFSEB63lOFHIpNRUVMvYTc6yu1SMY/XTDM=

srv.service

···
+[Unit]
+Description=Bluesky Poster Web App
+
+[Service]
+Type=simple
+User=exedev
+Group=exedev
+WorkingDirectory=/home/exedev/bsky-poster
+ExecStart=/home/exedev/bsky-poster/bsky-poster
+Restart=always
+RestartSec=5
+Environment=HOME=/home/exedev
+Environment=USER=exedev
+StandardOutput=journal
+StandardError=journal
+
+[Install]
+WantedBy=multi-user.target

srv/apppassword.go

···
+package srv
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"log/slog"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+
+	"github.com/google/uuid"
+	"srv.exe.dev/db/dbgen"
+)
+
+// HandleAppPasswordLogin handles login with app password.
+func (s *Server) HandleAppPasswordLogin(w http.ResponseWriter, r *http.Request) {
+	handle := strings.TrimSpace(r.FormValue("handle"))
+	appPassword := strings.TrimSpace(r.FormValue("app_password"))
+	
+	if handle == "" || appPassword == "" {
+		http.Redirect(w, r, "/?error="+url.QueryEscape("Handle and app password required"), http.StatusSeeOther)
+		return
+	}
+	
+	ctx := r.Context()
+	
+	// Resolve handle to DID
+	did, err := ResolveHandle(ctx, handle)
+	if err != nil {
+		slog.Error("resolve handle", "handle", handle, "error", err)
+		http.Redirect(w, r, "/?error="+url.QueryEscape("Could not resolve handle"), http.StatusSeeOther)
+		return
+	}
+	
+	// Resolve DID to get PDS
+	didDoc, err := ResolveDID(ctx, did)
+	if err != nil {
+		slog.Error("resolve DID", "did", did, "error", err)
+		http.Redirect(w, r, "/?error="+url.QueryEscape("Could not resolve DID"), http.StatusSeeOther)
+		return
+	}
+	
+	pdsURL, err := GetPDSEndpoint(didDoc)
+	if err != nil {
+		slog.Error("get PDS endpoint", "error", err)
+		http.Redirect(w, r, "/?error="+url.QueryEscape("Could not find PDS"), http.StatusSeeOther)
+		return
+	}
+	
+	// Create session with PDS
+	session, err := createAppPasswordSession(ctx, pdsURL, handle, appPassword)
+	if err != nil {
+		slog.Error("create session", "error", err)
+		http.Redirect(w, r, "/?error="+url.QueryEscape("Login failed: "+err.Error()), http.StatusSeeOther)
+		return
+	}
+	
+	// Store session
+	sessionID := uuid.New().String()
+	q := dbgen.New(s.DB)
+	
+	err = q.CreateOAuthSession(ctx, dbgen.CreateOAuthSessionParams{
+		ID:             sessionID,
+		Did:            session.DID,
+		Handle:         session.Handle,
+		PdsUrl:         pdsURL,
+		AccessToken:    session.AccessJwt,
+		RefreshToken:   &session.RefreshJwt,
+		TokenType:      "Bearer",
+		ExpiresAt:      time.Now().Add(24 * time.Hour), // App password sessions don't expire as quickly
+		DpopPrivateKey: "", // No DPoP for app passwords
+		CreatedAt:      time.Now(),
+		UpdatedAt:      time.Now(),
+	})
+	if err != nil {
+		slog.Error("store session", "error", err)
+		http.Redirect(w, r, "/?error="+url.QueryEscape("Could not create session"), http.StatusSeeOther)
+		return
+	}
+	
+	// Set session cookie
+	http.SetCookie(w, &http.Cookie{
+		Name:     SessionCookie,
+		Value:    sessionID,
+		Path:     "/",
+		HttpOnly: true,
+		Secure:   true,
+		SameSite: http.SameSiteLaxMode,
+		MaxAge:   86400 * 30,
+	})
+	
+	slog.Info("user logged in via app password", "handle", session.Handle, "did", session.DID)
+	http.Redirect(w, r, "/?success="+url.QueryEscape("Logged in as "+session.Handle), http.StatusSeeOther)
+}
+
+type appPasswordSession struct {
+	DID        string `json:"did"`
+	Handle     string `json:"handle"`
+	AccessJwt  string `json:"accessJwt"`
+	RefreshJwt string `json:"refreshJwt"`
+}
+
+func createAppPasswordSession(ctx context.Context, pdsURL, handle, appPassword string) (*appPasswordSession, error) {
+	reqBody := map[string]string{
+		"identifier": handle,
+		"password":   appPassword,
+	}
+	
+	bodyJSON, err := json.Marshal(reqBody)
+	if err != nil {
+		return nil, err
+	}
+	
+	endpoint := strings.TrimSuffix(pdsURL, "/") + "/xrpc/com.atproto.server.createSession"
+	req, err := http.NewRequestWithContext(ctx, "POST", endpoint, bytes.NewReader(bodyJSON))
+	if err != nil {
+		return nil, err
+	}
+	req.Header.Set("Content-Type", "application/json")
+	
+	client := &http.Client{Timeout: 30 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+	
+	if resp.StatusCode != http.StatusOK {
+		body, _ := io.ReadAll(resp.Body)
+		return nil, fmt.Errorf("auth failed (%d): %s", resp.StatusCode, string(body))
+	}
+	
+	var session appPasswordSession
+	if err := json.NewDecoder(resp.Body).Decode(&session); err != nil {
+		return nil, err
+	}
+	
+	return &session, nil
+}

srv/atproto.go

···
+package srv
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"strings"
+	"time"
+)
+
+const (
+	DefaultPDS      = "https://bsky.social"
+	PLCDirectory    = "https://plc.directory"
+	BskyAppViewURL  = "https://public.api.bsky.app"
+)
+
+// ResolveHandle resolves a Bluesky handle to a DID.
+// It tries DNS TXT record first, then falls back to HTTP well-known.
+func ResolveHandle(ctx context.Context, handle string) (string, error) {
+	handle = strings.TrimPrefix(handle, "@")
+	
+	// Try HTTP well-known resolution via bsky.social
+	url := fmt.Sprintf("%s/xrpc/com.atproto.identity.resolveHandle?handle=%s", DefaultPDS, handle)
+	req, err := http.NewRequestWithContext(ctx, "GET", url, nil)
+	if err != nil {
+		return "", fmt.Errorf("create request: %w", err)
+	}
+	
+	client := &http.Client{Timeout: 10 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		return "", fmt.Errorf("resolve handle: %w", err)
+	}
+	defer resp.Body.Close()
+	
+	if resp.StatusCode != http.StatusOK {
+		body, _ := io.ReadAll(resp.Body)
+		return "", fmt.Errorf("resolve handle failed (%d): %s", resp.StatusCode, string(body))
+	}
+	
+	var result struct {
+		DID string `json:"did"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
+		return "", fmt.Errorf("decode response: %w", err)
+	}
+	
+	return result.DID, nil
+}
+
+// DIDDocument represents an AT Protocol DID document.
+type DIDDocument struct {
+	ID                 string             `json:"id"`
+	AlsoKnownAs        []string           `json:"alsoKnownAs"`
+	VerificationMethod []VerificationMethod `json:"verificationMethod"`
+	Service            []Service          `json:"service"`
+}
+
+type VerificationMethod struct {
+	ID                 string `json:"id"`
+	Type               string `json:"type"`
+	Controller         string `json:"controller"`
+	PublicKeyMultibase string `json:"publicKeyMultibase"`
+}
+
+type Service struct {
+	ID              string `json:"id"`
+	Type            string `json:"type"`
+	ServiceEndpoint string `json:"serviceEndpoint"`
+}
+
+// ResolveDID resolves a DID to its DID document.
+func ResolveDID(ctx context.Context, did string) (*DIDDocument, error) {
+	var url string
+	if strings.HasPrefix(did, "did:plc:") {
+		url = fmt.Sprintf("%s/%s", PLCDirectory, did)
+	} else if strings.HasPrefix(did, "did:web:") {
+		// did:web:example.com -> https://example.com/.well-known/did.json
+		domain := strings.TrimPrefix(did, "did:web:")
+		url = fmt.Sprintf("https://%s/.well-known/did.json", domain)
+	} else {
+		return nil, fmt.Errorf("unsupported DID method: %s", did)
+	}
+	
+	req, err := http.NewRequestWithContext(ctx, "GET", url, nil)
+	if err != nil {
+		return nil, fmt.Errorf("create request: %w", err)
+	}
+	
+	client := &http.Client{Timeout: 10 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("fetch DID document: %w", err)
+	}
+	defer resp.Body.Close()
+	
+	if resp.StatusCode != http.StatusOK {
+		body, _ := io.ReadAll(resp.Body)
+		return nil, fmt.Errorf("fetch DID document failed (%d): %s", resp.StatusCode, string(body))
+	}
+	
+	var doc DIDDocument
+	if err := json.NewDecoder(resp.Body).Decode(&doc); err != nil {
+		return nil, fmt.Errorf("decode DID document: %w", err)
+	}
+	
+	return &doc, nil
+}
+
+// GetPDSEndpoint extracts the PDS endpoint from a DID document.
+func GetPDSEndpoint(doc *DIDDocument) (string, error) {
+	for _, svc := range doc.Service {
+		if svc.Type == "AtprotoPersonalDataServer" || svc.ID == "#atproto_pds" {
+			return svc.ServiceEndpoint, nil
+		}
+	}
+	return "", fmt.Errorf("no PDS service found in DID document")
+}
+
+// GetHandleFromDID extracts the handle from a DID document's alsoKnownAs.
+func GetHandleFromDID(doc *DIDDocument) string {
+	for _, aka := range doc.AlsoKnownAs {
+		if strings.HasPrefix(aka, "at://") {
+			return strings.TrimPrefix(aka, "at://")
+		}
+	}
+	return ""
+}

srv/dpop.go

···
+package srv
+
+import (
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"math/big"
+	"time"
+
+	"github.com/google/uuid"
+)
+
+// DPoPKey represents an EC key pair for DPoP.
+type DPoPKey struct {
+	Private *ecdsa.PrivateKey
+}
+
+// GenerateDPoPKey generates a new ES256 key pair for DPoP.
+func GenerateDPoPKey() (*DPoPKey, error) {
+	privateKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		return nil, fmt.Errorf("generate key: %w", err)
+	}
+	return &DPoPKey{Private: privateKey}, nil
+}
+
+// MarshalPrivateKey serializes the private key to JSON.
+func (k *DPoPKey) MarshalPrivateKey() (string, error) {
+	jwk := map[string]string{
+		"kty": "EC",
+		"crv": "P-256",
+		"x":   base64URLEncode(k.Private.PublicKey.X.Bytes()),
+		"y":   base64URLEncode(k.Private.PublicKey.Y.Bytes()),
+		"d":   base64URLEncode(k.Private.D.Bytes()),
+	}
+	data, err := json.Marshal(jwk)
+	if err != nil {
+		return "", err
+	}
+	return string(data), nil
+}
+
+// UnmarshalPrivateKey deserializes a private key from JSON.
+func UnmarshalPrivateKey(data string) (*DPoPKey, error) {
+	var jwk map[string]string
+	if err := json.Unmarshal([]byte(data), &jwk); err != nil {
+		return nil, fmt.Errorf("unmarshal JWK: %w", err)
+	}
+	
+	xBytes, err := base64URLDecode(jwk["x"])
+	if err != nil {
+		return nil, fmt.Errorf("decode x: %w", err)
+	}
+	yBytes, err := base64URLDecode(jwk["y"])
+	if err != nil {
+		return nil, fmt.Errorf("decode y: %w", err)
+	}
+	dBytes, err := base64URLDecode(jwk["d"])
+	if err != nil {
+		return nil, fmt.Errorf("decode d: %w", err)
+	}
+	
+	privateKey := &ecdsa.PrivateKey{
+		PublicKey: ecdsa.PublicKey{
+			Curve: elliptic.P256(),
+			X:     new(big.Int).SetBytes(xBytes),
+			Y:     new(big.Int).SetBytes(yBytes),
+		},
+		D: new(big.Int).SetBytes(dBytes),
+	}
+	
+	return &DPoPKey{Private: privateKey}, nil
+}
+
+// PublicJWK returns the public key as a JWK map.
+func (k *DPoPKey) PublicJWK() map[string]string {
+	return map[string]string{
+		"kty": "EC",
+		"crv": "P-256",
+		"x":   base64URLEncode(k.Private.PublicKey.X.Bytes()),
+		"y":   base64URLEncode(k.Private.PublicKey.Y.Bytes()),
+	}
+}
+
+// JWKThumbprint computes the JWK thumbprint (SHA-256) of the public key.
+func (k *DPoPKey) JWKThumbprint() string {
+	// Canonical JSON: {"crv":"P-256","kty":"EC","x":"...","y":"..."}
+	canonical := fmt.Sprintf(`{"crv":"P-256","kty":"EC","x":"%s","y":"%s"}`,
+		base64URLEncode(k.Private.PublicKey.X.Bytes()),
+		base64URLEncode(k.Private.PublicKey.Y.Bytes()))
+	hash := sha256.Sum256([]byte(canonical))
+	return base64URLEncode(hash[:])
+}
+
+// CreateDPoPProof creates a DPoP proof JWT for a request.
+func (k *DPoPKey) CreateDPoPProof(method, url string, accessToken string, nonce string) (string, error) {
+	header := map[string]interface{}{
+		"typ": "dpop+jwt",
+		"alg": "ES256",
+		"jwk": k.PublicJWK(),
+	}
+	
+	payload := map[string]interface{}{
+		"jti": uuid.New().String(),
+		"htm": method,
+		"htu": url,
+		"iat": time.Now().Unix(),
+	}
+	
+	if nonce != "" {
+		payload["nonce"] = nonce
+	}
+	
+	// If we have an access token, include its hash
+	if accessToken != "" {
+		hash := sha256.Sum256([]byte(accessToken))
+		payload["ath"] = base64URLEncode(hash[:])
+	}
+	
+	return k.signJWT(header, payload)
+}
+
+func (k *DPoPKey) signJWT(header, payload map[string]interface{}) (string, error) {
+	headerJSON, err := json.Marshal(header)
+	if err != nil {
+		return "", fmt.Errorf("marshal header: %w", err)
+	}
+	payloadJSON, err := json.Marshal(payload)
+	if err != nil {
+		return "", fmt.Errorf("marshal payload: %w", err)
+	}
+	
+	headerB64 := base64URLEncode(headerJSON)
+	payloadB64 := base64URLEncode(payloadJSON)
+	
+	signingInput := headerB64 + "." + payloadB64
+	hash := sha256.Sum256([]byte(signingInput))
+	
+	r, s, err := ecdsa.Sign(rand.Reader, k.Private, hash[:])
+	if err != nil {
+		return "", fmt.Errorf("sign: %w", err)
+	}
+	
+	// ES256 signature is r || s, each 32 bytes
+	sig := make([]byte, 64)
+	rBytes := r.Bytes()
+	sBytes := s.Bytes()
+	copy(sig[32-len(rBytes):32], rBytes)
+	copy(sig[64-len(sBytes):64], sBytes)
+	
+	return signingInput + "." + base64URLEncode(sig), nil
+}
+
+func base64URLEncode(data []byte) string {
+	return base64.RawURLEncoding.EncodeToString(data)
+}
+
+func base64URLDecode(s string) ([]byte, error) {
+	return base64.RawURLEncoding.DecodeString(s)
+}

srv/facets.go

···
+package srv
+
+import (
+	"regexp"
+	"strings"
+)
+
+var (
+	// URL regex - simplified but functional
+	urlRegex = regexp.MustCompile(`https?://[^\s<>"'\)\]]+`)
+	// Mention regex - @handle.domain.tld
+	mentionRegex = regexp.MustCompile(`@([a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?`)
+	// Hashtag regex
+	hashtagRegex = regexp.MustCompile(`#[^\s#\[\](){}]+`)
+)
+
+// extractFacets extracts links, mentions, and hashtags from post text.
+func extractFacets(text string) []Facet {
+	var facets []Facet
+	
+	// Extract URLs
+	for _, match := range urlRegex.FindAllStringIndex(text, -1) {
+		url := text[match[0]:match[1]]
+		// Clean up trailing punctuation
+		url = strings.TrimRight(url, ".,;:!?")
+		
+		facets = append(facets, Facet{
+			Index: FacetIndex{
+				ByteStart: match[0],
+				ByteEnd:   match[0] + len(url),
+			},
+			Features: []FacetFeature{{
+				Type: "app.bsky.richtext.facet#link",
+				URI:  url,
+			}},
+		})
+	}
+	
+	// Extract mentions
+	for _, match := range mentionRegex.FindAllStringIndex(text, -1) {
+		handle := text[match[0]+1 : match[1]] // Skip @
+		
+		facets = append(facets, Facet{
+			Index: FacetIndex{
+				ByteStart: match[0],
+				ByteEnd:   match[1],
+			},
+			Features: []FacetFeature{{
+				Type: "app.bsky.richtext.facet#mention",
+				DID:  "at://" + handle, // Will be resolved by server
+			}},
+		})
+	}
+	
+	// Extract hashtags
+	for _, match := range hashtagRegex.FindAllStringIndex(text, -1) {
+		tag := text[match[0]+1 : match[1]] // Skip #
+		
+		facets = append(facets, Facet{
+			Index: FacetIndex{
+				ByteStart: match[0],
+				ByteEnd:   match[1],
+			},
+			Features: []FacetFeature{{
+				Type: "app.bsky.richtext.facet#tag",
+				Tag:  tag,
+			}},
+		})
+	}
+	
+	return facets
+}

srv/oauth.go

···
+package srv
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"fmt"
+	"io"
+	"log/slog"
+	"net/http"
+	"strings"
+	"time"
+)
+
+// OAuthClient handles AT Protocol OAuth.
+type OAuthClient struct {
+	BaseURL  string
+	ClientID string
+	DB       *sql.DB
+}
+
+// AuthServerMetadata represents OAuth authorization server metadata.
+type AuthServerMetadata struct {
+	Issuer                            string   `json:"issuer"`
+	AuthorizationEndpoint             string   `json:"authorization_endpoint"`
+	TokenEndpoint                     string   `json:"token_endpoint"`
+	PushedAuthorizationRequestEndpoint string   `json:"pushed_authorization_request_endpoint"`
+	ScopesSupported                   []string `json:"scopes_supported"`
+	ResponseTypesSupported            []string `json:"response_types_supported"`
+	DPoPSigningAlgValuesSupported     []string `json:"dpop_signing_alg_values_supported"`
+}
+
+// NewOAuthClient creates a new OAuth client.
+func NewOAuthClient(baseURL string, db *sql.DB) *OAuthClient {
+	return &OAuthClient{
+		BaseURL:  baseURL,
+		ClientID: baseURL + "/oauth-client-metadata.json",
+		DB:       db,
+	}
+}
+
+// GetAuthServerMetadata fetches OAuth metadata from a PDS.
+func GetAuthServerMetadata(ctx context.Context, pdsURL string) (*AuthServerMetadata, error) {
+	// First try to get the protected resource metadata to find the auth server
+	resourceMeta, err := getProtectedResourceMetadata(ctx, pdsURL)
+	if err != nil {
+		slog.Warn("failed to get protected resource metadata, trying direct", "error", err)
+		// Fall back to trying the PDS directly as the auth server
+		return getAuthServerMetadataFromURL(ctx, pdsURL)
+	}
+	
+	if len(resourceMeta.AuthorizationServers) == 0 {
+		return nil, fmt.Errorf("no authorization servers found")
+	}
+	
+	return getAuthServerMetadataFromURL(ctx, resourceMeta.AuthorizationServers[0])
+}
+
+type protectedResourceMetadata struct {
+	Resource             string   `json:"resource"`
+	AuthorizationServers []string `json:"authorization_servers"`
+}
+
+func getProtectedResourceMetadata(ctx context.Context, pdsURL string) (*protectedResourceMetadata, error) {
+	metaURL := strings.TrimSuffix(pdsURL, "/") + "/.well-known/oauth-protected-resource"
+	
+	req, err := http.NewRequestWithContext(ctx, "GET", metaURL, nil)
+	if err != nil {
+		return nil, err
+	}
+	
+	client := &http.Client{Timeout: 10 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+	
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("status %d", resp.StatusCode)
+	}
+	
+	var meta protectedResourceMetadata
+	if err := json.NewDecoder(resp.Body).Decode(&meta); err != nil {
+		return nil, err
+	}
+	return &meta, nil
+}
+
+func getAuthServerMetadataFromURL(ctx context.Context, authServerURL string) (*AuthServerMetadata, error) {
+	metaURL := strings.TrimSuffix(authServerURL, "/") + "/.well-known/oauth-authorization-server"
+	
+	req, err := http.NewRequestWithContext(ctx, "GET", metaURL, nil)
+	if err != nil {
+		return nil, err
+	}
+	
+	client := &http.Client{Timeout: 10 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+	
+	if resp.StatusCode != http.StatusOK {
+		body, _ := io.ReadAll(resp.Body)
+		return nil, fmt.Errorf("status %d: %s", resp.StatusCode, string(body))
+	}
+	
+	var meta AuthServerMetadata
+	if err := json.NewDecoder(resp.Body).Decode(&meta); err != nil {
+		return nil, err
+	}
+	return &meta, nil
+}

srv/oauth_callback.go

···
+package srv
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"log/slog"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+
+	"github.com/google/uuid"
+	"srv.exe.dev/db/dbgen"
+)
+
+// HandleCallback handles the OAuth callback.
+func (s *Server) HandleCallback(w http.ResponseWriter, r *http.Request) {
+	ctx := r.Context()
+	
+	// Check for errors from auth server
+	if errCode := r.URL.Query().Get("error"); errCode != "" {
+		errDesc := r.URL.Query().Get("error_description")
+		slog.Error("auth callback error", "error", errCode, "description", errDesc)
+		http.Redirect(w, r, "/?error="+url.QueryEscape(fmt.Sprintf("Auth failed: %s", errDesc)), http.StatusSeeOther)
+		return
+	}
+	
+	code := r.URL.Query().Get("code")
+	state := r.URL.Query().Get("state")
+	iss := r.URL.Query().Get("iss")
+	
+	if code == "" || state == "" {
+		http.Redirect(w, r, "/?error="+url.QueryEscape("Missing code or state"), http.StatusSeeOther)
+		return
+	}
+	
+	// Look up state
+	q := dbgen.New(s.DB)
+	oauthState, err := q.GetOAuthState(ctx, state)
+	if err != nil {
+		slog.Error("get oauth state", "state", state, "error", err)
+		http.Redirect(w, r, "/?error="+url.QueryEscape("Invalid state"), http.StatusSeeOther)
+		return
+	}
+	
+	// Verify issuer matches
+	if iss != "" && iss != oauthState.AuthServerUrl {
+		slog.Error("issuer mismatch", "expected", oauthState.AuthServerUrl, "got", iss)
+		http.Redirect(w, r, "/?error="+url.QueryEscape("Issuer mismatch"), http.StatusSeeOther)
+		return
+	}
+	
+	// Delete state (one-time use)
+	q.DeleteOAuthState(ctx, state)
+	
+	// Restore DPoP key
+	dpopKey, err := UnmarshalPrivateKey(oauthState.DpopPrivateKey)
+	if err != nil {
+		slog.Error("unmarshal DPoP key", "error", err)
+		http.Redirect(w, r, "/?error="+url.QueryEscape("Internal error"), http.StatusSeeOther)
+		return
+	}
+	
+	// Get auth server metadata for token endpoint
+	authMeta, err := getAuthServerMetadataFromURL(ctx, oauthState.AuthServerUrl)
+	if err != nil {
+		slog.Error("get auth server metadata", "error", err)
+		http.Redirect(w, r, "/?error="+url.QueryEscape("Could not reach auth server"), http.StatusSeeOther)
+		return
+	}
+	
+	// Exchange code for tokens
+	tokenResp, err := s.exchangeCode(ctx, authMeta, code, oauthState.CodeVerifier, dpopKey)
+	if err != nil {
+		slog.Error("exchange code", "error", err)
+		http.Redirect(w, r, "/?error="+url.QueryEscape("Token exchange failed: "+err.Error()), http.StatusSeeOther)
+		return
+	}
+	
+	// Get the handle from DID doc
+	var handle string
+	if oauthState.Did != nil && *oauthState.Did != "" {
+		didDoc, err := ResolveDID(ctx, *oauthState.Did)
+		if err == nil {
+			handle = GetHandleFromDID(didDoc)
+		}
+	}
+	if handle == "" && tokenResp.Sub != "" {
+		// Try to get handle from sub claim
+		didDoc, err := ResolveDID(ctx, tokenResp.Sub)
+		if err == nil {
+			handle = GetHandleFromDID(didDoc)
+		}
+	}
+	if handle == "" {
+		handle = tokenResp.Sub // Fall back to DID as handle
+	}
+	
+	// Create session
+	sessionID := uuid.New().String()
+	expiresAt := time.Now().Add(time.Duration(tokenResp.ExpiresIn) * time.Second)
+	
+	var refreshToken *string
+	if tokenResp.RefreshToken != "" {
+		refreshToken = &tokenResp.RefreshToken
+	}
+	
+	err = q.CreateOAuthSession(ctx, dbgen.CreateOAuthSessionParams{
+		ID:             sessionID,
+		Did:            tokenResp.Sub,
+		Handle:         handle,
+		PdsUrl:         oauthState.PdsUrl,
+		AccessToken:    tokenResp.AccessToken,
+		RefreshToken:   refreshToken,
+		TokenType:      tokenResp.TokenType,
+		ExpiresAt:      expiresAt,
+		DpopPrivateKey: oauthState.DpopPrivateKey,
+		CreatedAt:      time.Now(),
+		UpdatedAt:      time.Now(),
+	})
+	if err != nil {
+		slog.Error("create session", "error", err)
+		http.Redirect(w, r, "/?error="+url.QueryEscape("Could not create session"), http.StatusSeeOther)
+		return
+	}
+	
+	// Set session cookie
+	http.SetCookie(w, &http.Cookie{
+		Name:     SessionCookie,
+		Value:    sessionID,
+		Path:     "/",
+		HttpOnly: true,
+		Secure:   true,
+		SameSite: http.SameSiteLaxMode,
+		MaxAge:   86400 * 30, // 30 days
+	})
+	
+	slog.Info("user logged in", "handle", handle, "did", tokenResp.Sub)
+	http.Redirect(w, r, "/?success="+url.QueryEscape("Logged in as "+handle), http.StatusSeeOther)
+}
+
+type tokenResponse struct {
+	AccessToken  string `json:"access_token"`
+	TokenType    string `json:"token_type"`
+	ExpiresIn    int    `json:"expires_in"`
+	RefreshToken string `json:"refresh_token"`
+	Scope        string `json:"scope"`
+	Sub          string `json:"sub"`
+}
+
+func (s *Server) exchangeCode(ctx context.Context, authMeta *AuthServerMetadata, code, codeVerifier string, dpopKey *DPoPKey) (*tokenResponse, error) {
+	tokenData := url.Values{}
+	tokenData.Set("grant_type", "authorization_code")
+	tokenData.Set("code", code)
+	tokenData.Set("redirect_uri", s.BaseURL+"/auth/callback")
+	tokenData.Set("client_id", s.oauth.ClientID)
+	tokenData.Set("code_verifier", codeVerifier)
+	
+	var lastErr error
+	var nonce string
+	
+	// Retry loop for DPoP nonce
+	for i := 0; i < 3; i++ {
+		dpopProof, err := dpopKey.CreateDPoPProof("POST", authMeta.TokenEndpoint, "", nonce)
+		if err != nil {
+			return nil, fmt.Errorf("create DPoP proof: %w", err)
+		}
+		
+		req, err := http.NewRequestWithContext(ctx, "POST", authMeta.TokenEndpoint, strings.NewReader(tokenData.Encode()))
+		if err != nil {
+			return nil, fmt.Errorf("create request: %w", err)
+		}
+		req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+		req.Header.Set("DPoP", dpopProof)
+		
+		client := &http.Client{Timeout: 30 * time.Second}
+		resp, err := client.Do(req)
+		if err != nil {
+			lastErr = fmt.Errorf("token request: %w", err)
+			continue
+		}
+		
+		// Check for DPoP nonce requirement
+		if newNonce := resp.Header.Get("DPoP-Nonce"); newNonce != "" {
+			nonce = newNonce
+		}
+		
+		if resp.StatusCode == http.StatusBadRequest || resp.StatusCode == http.StatusUnauthorized {
+			body, _ := io.ReadAll(resp.Body)
+			resp.Body.Close()
+			
+			if nonce != "" && i < 2 {
+				slog.Info("retrying token exchange with nonce", "nonce", nonce)
+				continue
+			}
+			return nil, fmt.Errorf("token endpoint error (%d): %s", resp.StatusCode, string(body))
+		}
+		
+		if resp.StatusCode != http.StatusOK {
+			body, _ := io.ReadAll(resp.Body)
+			resp.Body.Close()
+			return nil, fmt.Errorf("token endpoint status %d: %s", resp.StatusCode, string(body))
+		}
+		
+		var tokenResp tokenResponse
+		if err := json.NewDecoder(resp.Body).Decode(&tokenResp); err != nil {
+			resp.Body.Close()
+			return nil, fmt.Errorf("decode token response: %w", err)
+		}
+		resp.Body.Close()
+		
+		return &tokenResp, nil
+	}
+	
+	return nil, lastErr
+}
+
+// HandleLogout clears the session.
+func (s *Server) HandleLogout(w http.ResponseWriter, r *http.Request) {
+	cookie, err := r.Cookie(SessionCookie)
+	if err == nil && cookie.Value != "" {
+		q := dbgen.New(s.DB)
+		q.DeleteOAuthSession(r.Context(), cookie.Value)
+	}
+	
+	http.SetCookie(w, &http.Cookie{
+		Name:     SessionCookie,
+		Value:    "",
+		Path:     "/",
+		MaxAge:   -1,
+		HttpOnly: true,
+		Secure:   true,
+	})
+	
+	http.Redirect(w, r, "/", http.StatusSeeOther)
+}

srv/oauth_handlers.go

···
+package srv
+
+import (
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/json"
+	"io"
+	"log/slog"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+
+	"github.com/google/uuid"
+	"srv.exe.dev/db/dbgen"
+)
+
+// HandleClientMetadata serves the OAuth client metadata.
+func (s *Server) HandleClientMetadata(w http.ResponseWriter, r *http.Request) {
+	metadata := map[string]interface{}{
+		"client_id":                s.oauth.ClientID,
+		"client_name":              "Bluesky Poster",
+		"client_uri":               s.BaseURL,
+		"redirect_uris":            []string{s.BaseURL + "/auth/callback"},
+		"grant_types":              []string{"authorization_code", "refresh_token"},
+		"response_types":           []string{"code"},
+		"scope":                    "atproto",
+		"token_endpoint_auth_method": "none",
+		"application_type":         "web",
+		"dpop_bound_access_tokens": true,
+	}
+	
+	w.Header().Set("Content-Type", "application/json")
+	json.NewEncoder(w).Encode(metadata)
+}
+
+// HandleLogin initiates the OAuth flow.
+func (s *Server) HandleLogin(w http.ResponseWriter, r *http.Request) {
+	handle := strings.TrimSpace(r.FormValue("handle"))
+	if handle == "" {
+		http.Redirect(w, r, "/?error="+url.QueryEscape("Please enter a handle"), http.StatusSeeOther)
+		return
+	}
+	
+	ctx := r.Context()
+	
+	// Resolve handle to DID
+	did, err := ResolveHandle(ctx, handle)
+	if err != nil {
+		slog.Error("resolve handle", "handle", handle, "error", err)
+		http.Redirect(w, r, "/?error="+url.QueryEscape("Could not resolve handle: "+err.Error()), http.StatusSeeOther)
+		return
+	}
+	
+	slog.Info("resolved handle", "handle", handle, "did", did)
+	
+	// Resolve DID to get PDS
+	didDoc, err := ResolveDID(ctx, did)
+	if err != nil {
+		slog.Error("resolve DID", "did", did, "error", err)
+		http.Redirect(w, r, "/?error="+url.QueryEscape("Could not resolve DID: "+err.Error()), http.StatusSeeOther)
+		return
+	}
+	
+	pdsURL, err := GetPDSEndpoint(didDoc)
+	if err != nil {
+		slog.Error("get PDS endpoint", "did", did, "error", err)
+		http.Redirect(w, r, "/?error="+url.QueryEscape("Could not find PDS: "+err.Error()), http.StatusSeeOther)
+		return
+	}
+	
+	slog.Info("found PDS", "pds", pdsURL)
+	
+	// Get authorization server metadata
+	authMeta, err := GetAuthServerMetadata(ctx, pdsURL)
+	if err != nil {
+		slog.Error("get auth server metadata", "pds", pdsURL, "error", err)
+		http.Redirect(w, r, "/?error="+url.QueryEscape("Could not get auth server: "+err.Error()), http.StatusSeeOther)
+		return
+	}
+	
+	slog.Info("got auth server metadata", "issuer", authMeta.Issuer, "auth_endpoint", authMeta.AuthorizationEndpoint)
+	
+	// Generate PKCE challenge
+	codeVerifier := generateCodeVerifier()
+	codeChallenge := generateCodeChallenge(codeVerifier)
+	
+	// Generate state
+	state := uuid.New().String()
+	
+	// Generate DPoP key
+	dpopKey, err := GenerateDPoPKey()
+	if err != nil {
+		slog.Error("generate DPoP key", "error", err)
+		http.Redirect(w, r, "/?error="+url.QueryEscape("Internal error"), http.StatusSeeOther)
+		return
+	}
+	
+	dpopKeyJSON, err := dpopKey.MarshalPrivateKey()
+	if err != nil {
+		slog.Error("marshal DPoP key", "error", err)
+		http.Redirect(w, r, "/?error="+url.QueryEscape("Internal error"), http.StatusSeeOther)
+		return
+	}
+	
+	// Store state in database
+	q := dbgen.New(s.DB)
+	err = q.CreateOAuthState(ctx, dbgen.CreateOAuthStateParams{
+		State:          state,
+		CodeVerifier:   codeVerifier,
+		Did:            &did,
+		PdsUrl:         pdsURL,
+		AuthServerUrl:  authMeta.Issuer,
+		DpopPrivateKey: dpopKeyJSON,
+		CreatedAt:      time.Now(),
+	})
+	if err != nil {
+		slog.Error("create oauth state", "error", err)
+		http.Redirect(w, r, "/?error="+url.QueryEscape("Internal error"), http.StatusSeeOther)
+		return
+	}
+	
+	// Use PAR if available, otherwise direct authorization
+	if authMeta.PushedAuthorizationRequestEndpoint != "" {
+		s.handlePARLogin(w, r, authMeta, state, codeChallenge, dpopKey)
+	} else {
+		s.handleDirectLogin(w, r, authMeta, state, codeChallenge)
+	}
+}
+
+func (s *Server) handlePARLogin(w http.ResponseWriter, r *http.Request, authMeta *AuthServerMetadata, state, codeChallenge string, dpopKey *DPoPKey) {
+	// Create DPoP proof for PAR request
+	dpopProof, err := dpopKey.CreateDPoPProof("POST", authMeta.PushedAuthorizationRequestEndpoint, "", "")
+	if err != nil {
+		slog.Error("create DPoP proof", "error", err)
+		http.Redirect(w, r, "/?error="+url.QueryEscape("Internal error"), http.StatusSeeOther)
+		return
+	}
+	
+	// PAR request
+	parData := url.Values{}
+	parData.Set("client_id", s.oauth.ClientID)
+	parData.Set("redirect_uri", s.BaseURL+"/auth/callback")
+	parData.Set("response_type", "code")
+	parData.Set("scope", "atproto transition:generic")
+	parData.Set("state", state)
+	parData.Set("code_challenge", codeChallenge)
+	parData.Set("code_challenge_method", "S256")
+	
+	req, err := http.NewRequestWithContext(r.Context(), "POST", authMeta.PushedAuthorizationRequestEndpoint, strings.NewReader(parData.Encode()))
+	if err != nil {
+		slog.Error("create PAR request", "error", err)
+		http.Redirect(w, r, "/?error="+url.QueryEscape("Internal error"), http.StatusSeeOther)
+		return
+	}
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	req.Header.Set("DPoP", dpopProof)
+	
+	client := &http.Client{Timeout: 30 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		slog.Error("PAR request", "error", err)
+		http.Redirect(w, r, "/?error="+url.QueryEscape("Auth server error"), http.StatusSeeOther)
+		return
+	}
+	defer resp.Body.Close()
+	
+	// Check for DPoP nonce requirement and retry
+	if resp.StatusCode == http.StatusBadRequest {
+		nonce := resp.Header.Get("DPoP-Nonce")
+		if nonce != "" {
+			slog.Info("retrying PAR with nonce", "nonce", nonce)
+			dpopProof, _ = dpopKey.CreateDPoPProof("POST", authMeta.PushedAuthorizationRequestEndpoint, "", nonce)
+			req, _ = http.NewRequestWithContext(r.Context(), "POST", authMeta.PushedAuthorizationRequestEndpoint, strings.NewReader(parData.Encode()))
+			req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+			req.Header.Set("DPoP", dpopProof)
+			resp, err = client.Do(req)
+			if err != nil {
+				slog.Error("PAR retry request", "error", err)
+				http.Redirect(w, r, "/?error="+url.QueryEscape("Auth server error"), http.StatusSeeOther)
+				return
+			}
+			defer resp.Body.Close()
+		}
+	}
+	
+	if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusCreated {
+		body, _ := io.ReadAll(resp.Body)
+		slog.Error("PAR failed", "status", resp.StatusCode, "body", string(body))
+		http.Redirect(w, r, "/?error="+url.QueryEscape("Auth server rejected request"), http.StatusSeeOther)
+		return
+	}
+	
+	var parResp struct {
+		RequestURI string `json:"request_uri"`
+		ExpiresIn  int    `json:"expires_in"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&parResp); err != nil {
+		slog.Error("decode PAR response", "error", err)
+		http.Redirect(w, r, "/?error="+url.QueryEscape("Internal error"), http.StatusSeeOther)
+		return
+	}
+	
+	// Redirect to authorization endpoint with request_uri
+	authURL, _ := url.Parse(authMeta.AuthorizationEndpoint)
+	q := authURL.Query()
+	q.Set("client_id", s.oauth.ClientID)
+	q.Set("request_uri", parResp.RequestURI)
+	authURL.RawQuery = q.Encode()
+	
+	slog.Info("redirecting to auth", "url", authURL.String())
+	http.Redirect(w, r, authURL.String(), http.StatusSeeOther)
+}
+
+func (s *Server) handleDirectLogin(w http.ResponseWriter, r *http.Request, authMeta *AuthServerMetadata, state, codeChallenge string) {
+	authURL, _ := url.Parse(authMeta.AuthorizationEndpoint)
+	q := authURL.Query()
+	q.Set("client_id", s.oauth.ClientID)
+	q.Set("redirect_uri", s.BaseURL+"/auth/callback")
+	q.Set("response_type", "code")
+	q.Set("scope", "atproto transition:generic")
+	q.Set("state", state)
+	q.Set("code_challenge", codeChallenge)
+	q.Set("code_challenge_method", "S256")
+	authURL.RawQuery = q.Encode()
+	
+	http.Redirect(w, r, authURL.String(), http.StatusSeeOther)
+}
+
+func generateCodeVerifier() string {
+	b := make([]byte, 32)
+	rand.Read(b)
+	return base64.RawURLEncoding.EncodeToString(b)
+}
+
+func generateCodeChallenge(verifier string) string {
+	hash := sha256.Sum256([]byte(verifier))
+	return base64.RawURLEncoding.EncodeToString(hash[:])
+}

srv/posting.go

···
+package srv
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"log/slog"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+	"unicode/utf8"
+
+	"srv.exe.dev/db/dbgen"
+)
+
+// HandlePost creates a new post or thread.
+func (s *Server) HandlePost(w http.ResponseWriter, r *http.Request) {
+	ctx := r.Context()
+	
+	// Get session
+	cookie, err := r.Cookie(SessionCookie)
+	if err != nil || cookie.Value == "" {
+		http.Redirect(w, r, "/?error="+url.QueryEscape("Not logged in"), http.StatusSeeOther)
+		return
+	}
+	
+	q := dbgen.New(s.DB)
+	session, err := q.GetOAuthSession(ctx, cookie.Value)
+	if err != nil {
+		http.Redirect(w, r, "/?error="+url.QueryEscape("Session expired"), http.StatusSeeOther)
+		return
+	}
+	
+	// Check if token needs refresh
+	if time.Now().After(session.ExpiresAt) {
+		http.Redirect(w, r, "/?error="+url.QueryEscape("Session expired, please log in again"), http.StatusSeeOther)
+		return
+	}
+	
+	// Get post content - can be multiple posts for a thread
+	if err := r.ParseForm(); err != nil {
+		http.Redirect(w, r, "/?error="+url.QueryEscape("Invalid form data"), http.StatusSeeOther)
+		return
+	}
+	
+	posts := r.Form["post"]
+	if len(posts) == 0 || (len(posts) == 1 && strings.TrimSpace(posts[0]) == "") {
+		http.Redirect(w, r, "/?error="+url.QueryEscape("Post cannot be empty"), http.StatusSeeOther)
+		return
+	}
+	
+	// Validate all posts
+	for i, post := range posts {
+		post = strings.TrimSpace(post)
+		if post == "" {
+			continue
+		}
+		if utf8.RuneCountInString(post) > BskyCharLimit {
+			http.Redirect(w, r, "/?error="+url.QueryEscape(fmt.Sprintf("Post %d exceeds %d character limit", i+1, BskyCharLimit)), http.StatusSeeOther)
+			return
+		}
+	}
+	
+	// Restore DPoP key (if present)
+	var dpopKey *DPoPKey
+	if session.DpopPrivateKey != "" {
+		dpopKey, err = UnmarshalPrivateKey(session.DpopPrivateKey)
+		if err != nil {
+			slog.Error("unmarshal DPoP key", "error", err)
+			http.Redirect(w, r, "/?error="+url.QueryEscape("Internal error"), http.StatusSeeOther)
+			return
+		}
+	}
+	
+	// Create posts
+	var threadRootURI, threadRootCID string
+	var lastPostURI, lastPostCID string
+	var createdCount int
+	
+	for _, postText := range posts {
+		postText = strings.TrimSpace(postText)
+		if postText == "" {
+			continue
+		}
+		
+		var replyRef *ReplyRef
+		if lastPostURI != "" {
+			replyRef = &ReplyRef{
+				Root: PostRef{
+					URI: threadRootURI,
+					CID: threadRootCID,
+				},
+				Parent: PostRef{
+					URI: lastPostURI,
+					CID: lastPostCID,
+				},
+			}
+		}
+		
+		uri, cid, err := s.createPost(ctx, session, dpopKey, postText, replyRef)
+		if err != nil {
+			slog.Error("create post", "error", err)
+			if createdCount > 0 {
+				http.Redirect(w, r, "/?error="+url.QueryEscape(fmt.Sprintf("Created %d posts but failed on post %d: %s", createdCount, createdCount+1, err.Error())), http.StatusSeeOther)
+			} else {
+				http.Redirect(w, r, "/?error="+url.QueryEscape("Failed to create post: "+err.Error()), http.StatusSeeOther)
+			}
+			return
+		}
+		
+		// Track thread
+		if threadRootURI == "" {
+			threadRootURI = uri
+			threadRootCID = cid
+		}
+		lastPostURI = uri
+		lastPostCID = cid
+		
+		// Store in database
+		var rootPtr, parentPtr *string
+		if replyRef != nil {
+			rootPtr = &replyRef.Root.URI
+			parentPtr = &replyRef.Parent.URI
+		}
+		
+		_, err = q.CreatePost(ctx, dbgen.CreatePostParams{
+			SessionID:      session.ID,
+			Did:            session.Did,
+			Handle:         session.Handle,
+			Uri:            uri,
+			Cid:            cid,
+			Text:           postText,
+			ThreadRootUri:  rootPtr,
+			ReplyParentUri: parentPtr,
+			CreatedAt:      time.Now(),
+		})
+		if err != nil {
+			slog.Error("store post", "error", err)
+			// Don't fail the request, post was created on bsky
+		}
+		
+		createdCount++
+	}
+	
+	if createdCount == 1 {
+		http.Redirect(w, r, "/?success="+url.QueryEscape("Post created!"), http.StatusSeeOther)
+	} else {
+		http.Redirect(w, r, "/?success="+url.QueryEscape(fmt.Sprintf("Thread created with %d posts!", createdCount)), http.StatusSeeOther)
+	}
+}
+
+type PostRef struct {
+	URI string `json:"uri"`
+	CID string `json:"cid"`
+}
+
+type ReplyRef struct {
+	Root   PostRef `json:"root"`
+	Parent PostRef `json:"parent"`
+}
+
+type createRecordRequest struct {
+	Repo       string      `json:"repo"`
+	Collection string      `json:"collection"`
+	Record     interface{} `json:"record"`
+}
+
+type postRecord struct {
+	Type      string     `json:"$type"`
+	Text      string     `json:"text"`
+	CreatedAt string     `json:"createdAt"`
+	Reply     *ReplyRef  `json:"reply,omitempty"`
+	Facets    []Facet    `json:"facets,omitempty"`
+}
+
+type Facet struct {
+	Index    FacetIndex     `json:"index"`
+	Features []FacetFeature `json:"features"`
+}
+
+type FacetIndex struct {
+	ByteStart int `json:"byteStart"`
+	ByteEnd   int `json:"byteEnd"`
+}
+
+type FacetFeature struct {
+	Type string `json:"$type"`
+	URI  string `json:"uri,omitempty"`
+	DID  string `json:"did,omitempty"`
+	Tag  string `json:"tag,omitempty"`
+}
+
+func (s *Server) createPost(ctx context.Context, session dbgen.OauthSession, dpopKey *DPoPKey, text string, reply *ReplyRef) (uri, cid string, err error) {
+	// Check if we're using DPoP or Bearer auth
+	useDPoP := session.DpopPrivateKey != "" && dpopKey != nil
+	
+	record := postRecord{
+		Type:      "app.bsky.feed.post",
+		Text:      text,
+		CreatedAt: time.Now().UTC().Format(time.RFC3339),
+		Reply:     reply,
+		Facets:    extractFacets(text),
+	}
+	
+	reqBody := createRecordRequest{
+		Repo:       session.Did,
+		Collection: "app.bsky.feed.post",
+		Record:     record,
+	}
+	
+	bodyJSON, err := json.Marshal(reqBody)
+	if err != nil {
+		return "", "", fmt.Errorf("marshal request: %w", err)
+	}
+	
+	endpoint := session.PdsUrl + "/xrpc/com.atproto.repo.createRecord"
+	
+	// Try with nonce retry (for DPoP) or single attempt (for Bearer)
+	var nonce string
+	maxRetries := 1
+	if useDPoP {
+		maxRetries = 3
+	}
+	
+	for i := 0; i < maxRetries; i++ {
+		req, err := http.NewRequestWithContext(ctx, "POST", endpoint, bytes.NewReader(bodyJSON))
+		if err != nil {
+			return "", "", fmt.Errorf("create request: %w", err)
+		}
+		req.Header.Set("Content-Type", "application/json")
+		
+		if useDPoP {
+			dpopProof, err := dpopKey.CreateDPoPProof("POST", endpoint, session.AccessToken, nonce)
+			if err != nil {
+				return "", "", fmt.Errorf("create DPoP proof: %w", err)
+			}
+			req.Header.Set("Authorization", "DPoP "+session.AccessToken)
+			req.Header.Set("DPoP", dpopProof)
+		} else {
+			req.Header.Set("Authorization", "Bearer "+session.AccessToken)
+		}
+		
+		client := &http.Client{Timeout: 30 * time.Second}
+		resp, err := client.Do(req)
+		if err != nil {
+			return "", "", fmt.Errorf("request failed: %w", err)
+		}
+		
+		// Check for DPoP nonce
+		if useDPoP {
+			if newNonce := resp.Header.Get("DPoP-Nonce"); newNonce != "" {
+				nonce = newNonce
+			}
+			
+			if resp.StatusCode == http.StatusUnauthorized && nonce != "" && i < maxRetries-1 {
+				resp.Body.Close()
+				slog.Info("retrying createRecord with nonce")
+				continue
+			}
+		}
+		
+		if resp.StatusCode != http.StatusOK {
+			body, _ := io.ReadAll(resp.Body)
+			resp.Body.Close()
+			return "", "", fmt.Errorf("createRecord failed (%d): %s", resp.StatusCode, string(body))
+		}
+		
+		var result struct {
+			URI string `json:"uri"`
+			CID string `json:"cid"`
+		}
+		if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
+			resp.Body.Close()
+			return "", "", fmt.Errorf("decode response: %w", err)
+		}
+		resp.Body.Close()
+		
+		return result.URI, result.CID, nil
+	}
+	
+	return "", "", fmt.Errorf("failed after retries")
+}

srv/server.go

···
+package srv
+
+import (
+	"database/sql"
+	"fmt"
+	"html/template"
+	"log/slog"
+	"net/http"
+	"path/filepath"
+	"runtime"
+	"time"
+
+	"srv.exe.dev/db"
+	"srv.exe.dev/db/dbgen"
+)
+
+const (
+	BskyCharLimit = 300 // Bluesky post character limit (graphemes)
+	SessionCookie = "bsky_session"
+)
+
+type Server struct {
+	DB           *sql.DB
+	Hostname     string
+	BaseURL      string
+	TemplatesDir string
+	StaticDir    string
+	oauth        *OAuthClient
+}
+
+func New(dbPath, hostname, baseURL string) (*Server, error) {
+	_, thisFile, _, _ := runtime.Caller(0)
+	baseDir := filepath.Dir(thisFile)
+	srv := &Server{
+		Hostname:     hostname,
+		BaseURL:      baseURL,
+		TemplatesDir: filepath.Join(baseDir, "templates"),
+		StaticDir:    filepath.Join(baseDir, "static"),
+	}
+	if err := srv.setUpDatabase(dbPath); err != nil {
+		return nil, err
+	}
+	srv.oauth = NewOAuthClient(baseURL, srv.DB)
+	return srv, nil
+}
+
+func (s *Server) setUpDatabase(dbPath string) error {
+	wdb, err := db.Open(dbPath)
+	if err != nil {
+		return fmt.Errorf("failed to open db: %w", err)
+	}
+	s.DB = wdb
+	if err := db.RunMigrations(wdb); err != nil {
+		return fmt.Errorf("failed to run migrations: %w", err)
+	}
+	return nil
+}
+
+func (s *Server) Serve(addr string) error {
+	mux := http.NewServeMux()
+	
+	// Main pages
+	mux.HandleFunc("GET /{$}", s.HandleHome)
+	
+	// Auth endpoints
+	mux.HandleFunc("POST /auth/login", s.HandleLogin)
+	mux.HandleFunc("POST /auth/apppassword", s.HandleAppPasswordLogin)
+	mux.HandleFunc("GET /auth/callback", s.HandleCallback)
+	mux.HandleFunc("POST /auth/logout", s.HandleLogout)
+	
+	// Client metadata for OAuth
+	mux.HandleFunc("GET /oauth-client-metadata.json", s.HandleClientMetadata)
+	
+	// Posting
+	mux.HandleFunc("POST /post", s.HandlePost)
+	
+	// Static files
+	mux.Handle("/static/", http.StripPrefix("/static/", http.FileServer(http.Dir(s.StaticDir))))
+	
+	slog.Info("starting server", "addr", addr, "baseURL", s.BaseURL)
+	return http.ListenAndServe(addr, mux)
+}
+
+type homePageData struct {
+	LoggedIn    bool
+	Handle      string
+	DID         string
+	Posts       []dbgen.Post
+	CharLimit   int
+	Error       string
+	Success     string
+}
+
+func (s *Server) HandleHome(w http.ResponseWriter, r *http.Request) {
+	data := homePageData{
+		CharLimit: BskyCharLimit,
+	}
+	
+	// Check for session cookie
+	cookie, err := r.Cookie(SessionCookie)
+	if err == nil && cookie.Value != "" {
+		q := dbgen.New(s.DB)
+		session, err := q.GetOAuthSession(r.Context(), cookie.Value)
+		if err == nil {
+			// Check if session is still valid (token not expired)
+			if time.Now().Before(session.ExpiresAt) {
+				data.LoggedIn = true
+				data.Handle = session.Handle
+				data.DID = session.Did
+				
+				// Get recent posts from this session
+				posts, err := q.GetPostsBySession(r.Context(), dbgen.GetPostsBySessionParams{
+					SessionID: session.ID,
+					Limit:     50,
+				})
+				if err == nil {
+					data.Posts = posts
+				}
+			}
+		}
+	}
+	
+	// Check for flash messages in query params
+	data.Error = r.URL.Query().Get("error")
+	data.Success = r.URL.Query().Get("success")
+	
+	w.Header().Set("Content-Type", "text/html; charset=utf-8")
+	if err := s.renderTemplate(w, "home.html", data); err != nil {
+		slog.Error("render template", "error", err)
+		http.Error(w, "Internal server error", http.StatusInternalServerError)
+	}
+}
+
+func (s *Server) renderTemplate(w http.ResponseWriter, name string, data any) error {
+	path := filepath.Join(s.TemplatesDir, name)
+	tmpl, err := template.ParseFiles(path)
+	if err != nil {
+		return fmt.Errorf("parse template %q: %w", name, err)
+	}
+	if err := tmpl.Execute(w, data); err != nil {
+		return fmt.Errorf("execute template %q: %w", name, err)
+	}
+	return nil
+}

srv/server_test.go

···
+package srv
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestServerSetupAndHandlers(t *testing.T) {
+	tempDB := filepath.Join(t.TempDir(), "test_server.sqlite3")
+	t.Cleanup(func() { os.Remove(tempDB) })
+
+	server, err := New(tempDB, "test-hostname")
+	if err != nil {
+		t.Fatalf("failed to create server: %v", err)
+	}
+
+	// Test root endpoint without auth
+	t.Run("root endpoint unauthenticated", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodGet, "/", nil)
+		w := httptest.NewRecorder()
+
+		server.HandleRoot(w, req)
+
+		if w.Code != http.StatusOK {
+			t.Errorf("expected status 200, got %d", w.Code)
+		}
+
+		body := w.Body.String()
+		if !strings.Contains(body, "test-hostname") {
+			t.Errorf("expected page to show hostname, got body: %s", body)
+		}
+		if !strings.Contains(body, "Go Template Project") {
+			t.Errorf("expected page to contain headline, got body: %s", body)
+		}
+		if strings.Contains(body, "Signed in as") {
+			t.Errorf("expected page to not be logged in, got body: %s", body)
+		}
+		if !strings.Contains(body, "Not signed in") {
+			t.Errorf("expected page to show 'Not signed in', got body: %s", body)
+		}
+	})
+
+	// Test root endpoint with auth headers
+	t.Run("root endpoint authenticated", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodGet, "/", nil)
+		req.Header.Set("X-ExeDev-UserID", "user123")
+		req.Header.Set("X-ExeDev-Email", "[e-mail]")
+		w := httptest.NewRecorder()
+
+		server.HandleRoot(w, req)
+
+		if w.Code != http.StatusOK {
+			t.Errorf("expected status 200, got %d", w.Code)
+		}
+
+		body := w.Body.String()
+		if !strings.Contains(body, "Signed in as") {
+			t.Errorf("expected page to show logged in state, got body: %s", body)
+		}
+		if !strings.Contains(body, "[e-mail]") {
+			t.Error("expected page to show user email")
+		}
+	})
+
+	// Test view counter functionality
+	t.Run("view counter increments", func(t *testing.T) {
+		// Make first request
+		req1 := httptest.NewRequest(http.MethodGet, "/", nil)
+		req1.Header.Set("X-ExeDev-UserID", "counter-test")
+		req1.RemoteAddr = "192.168.1.100:12345"
+		w1 := httptest.NewRecorder()
+		server.HandleRoot(w1, req1)
+
+		// Should show "1 times" or similar
+		body1 := w1.Body.String()
+		if !strings.Contains(body1, "1</strong> times") {
+			t.Error("expected first visit to show 1 time")
+		}
+
+		// Make second request with same user
+		req2 := httptest.NewRequest(http.MethodGet, "/", nil)
+		req2.Header.Set("X-ExeDev-UserID", "counter-test")
+		req2.RemoteAddr = "192.168.1.100:12345"
+		w2 := httptest.NewRecorder()
+		server.HandleRoot(w2, req2)
+
+		// Should show "2 times" or similar
+		body2 := w2.Body.String()
+		if !strings.Contains(body2, "2</strong> times") {
+			t.Error("expected second visit to show 2 times")
+		}
+	})
+}
+
+func TestUtilityFunctions(t *testing.T) {
+	t.Run("mainDomainFromHost function", func(t *testing.T) {
+		tests := []struct {
+			input    string
+			expected string
+		}{
+			{"example.exe.cloud:8080", "exe.cloud:8080"},
+			{"example.exe.dev", "exe.dev"},
+			{"example.exe.cloud", "exe.cloud"},
+		}
+
+		for _, test := range tests {
+			result := mainDomainFromHost(test.input)
+			if result != test.expected {
+				t.Errorf("mainDomainFromHost(%q) = %q, expected %q", test.input, result, test.expected)
+			}
+		}
+	})
+}

srv/static/script.js

···
+// Tab switching for login
+document.addEventListener('DOMContentLoaded', function() {
+    const tabs = document.querySelectorAll('.login-tabs .tab');
+    tabs.forEach(function(tab) {
+        tab.addEventListener('click', function() {
+            // Update active tab
+            tabs.forEach(t => t.classList.remove('active'));
+            this.classList.add('active');
+            
+            // Update visible content
+            const targetId = this.dataset.tab + '-form';
+            document.querySelectorAll('.tab-content').forEach(function(content) {
+                content.classList.remove('active');
+            });
+            document.getElementById(targetId).classList.add('active');
+        });
+    });
+});
+
+// Character count and thread management
+document.addEventListener('DOMContentLoaded', function() {
+    const charLimit = 300;
+    const container = document.getElementById('posts-container');
+    const addButton = document.getElementById('addPost');
+    
+    if (!container) return;
+    
+    // Update character count for a textarea
+    function updateCharCount(textarea) {
+        const countSpan = textarea.parentElement.querySelector('.count');
+        if (!countSpan) return;
+        
+        const count = textarea.value.length;
+        countSpan.textContent = count;
+        
+        const countDiv = textarea.parentElement.querySelector('.char-count');
+        countDiv.classList.remove('warning', 'danger');
+        
+        if (count > charLimit * 0.9) {
+            countDiv.classList.add('danger');
+        } else if (count > charLimit * 0.75) {
+            countDiv.classList.add('warning');
+        }
+    }
+    
+    // Attach listeners to textareas
+    function attachListeners(textarea) {
+        textarea.addEventListener('input', function() {
+            updateCharCount(this);
+        });
+    }
+    
+    // Initialize existing textareas
+    document.querySelectorAll('.post-input textarea').forEach(attachListeners);
+    
+    // Add post to thread
+    let postIndex = 1;
+    if (addButton) {
+        addButton.addEventListener('click', function() {
+            const div = document.createElement('div');
+            div.className = 'post-input';
+            div.dataset.index = postIndex;
+            div.innerHTML = `
+                <button type="button" class="remove-post" title="Remove">&times;</button>
+                <textarea name="post" placeholder="Continue your thread..." maxlength="${charLimit}"></textarea>
+                <div class="char-count"><span class="count">0</span>/${charLimit}</div>
+            `;
+            
+            container.appendChild(div);
+            
+            const textarea = div.querySelector('textarea');
+            attachListeners(textarea);
+            textarea.focus();
+            
+            // Remove button handler
+            div.querySelector('.remove-post').addEventListener('click', function() {
+                div.remove();
+            });
+            
+            postIndex++;
+        });
+    }
+    
+    // Form validation
+    const form = document.getElementById('postForm');
+    if (form) {
+        form.addEventListener('submit', function(e) {
+            const textareas = form.querySelectorAll('textarea');
+            let hasContent = false;
+            
+            textareas.forEach(function(ta) {
+                if (ta.value.trim()) {
+                    hasContent = true;
+                }
+            });
+            
+            if (!hasContent) {
+                e.preventDefault();
+                alert('Please write something to post!');
+            }
+        });
+    }
+});

srv/static/style.css

···
+* {
+    margin: 0;
+    padding: 0;
+    box-sizing: border-box;
+}
+
+body {
+    font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
+    background: linear-gradient(135deg, #1a1a2e 0%, #16213e 100%);
+    color: #e8e8e8;
+    min-height: 100vh;
+    line-height: 1.6;
+}
+
+main {
+    max-width: 600px;
+    margin: 0 auto;
+    padding: 40px 20px;
+}
+
+h1 {
+    font-size: 2.5rem;
+    margin-bottom: 8px;
+    color: #fff;
+}
+
+.tagline {
+    color: #8b9dc3;
+    margin-bottom: 30px;
+}
+
+/* Messages */
+.message {
+    padding: 12px 16px;
+    border-radius: 8px;
+    margin-bottom: 20px;
+}
+
+.message.error {
+    background: rgba(220, 53, 69, 0.2);
+    border: 1px solid #dc3545;
+    color: #ff6b7a;
+}
+
+.message.success {
+    background: rgba(40, 167, 69, 0.2);
+    border: 1px solid #28a745;
+    color: #5cd87b;
+}
+
+/* User info */
+.user-info {
+    display: flex;
+    align-items: center;
+    gap: 16px;
+    margin-bottom: 24px;
+    padding: 12px 16px;
+    background: rgba(255, 255, 255, 0.05);
+    border-radius: 8px;
+}
+
+.user-info .handle {
+    font-weight: 600;
+    color: #0085ff;
+}
+
+.inline {
+    display: inline;
+}
+
+.btn-link {
+    background: none;
+    border: none;
+    color: #8b9dc3;
+    cursor: pointer;
+    font-size: 14px;
+}
+
+.btn-link:hover {
+    color: #fff;
+    text-decoration: underline;
+}
+
+/* Compose section */
+.compose {
+    margin-bottom: 40px;
+}
+
+.post-input {
+    position: relative;
+    margin-bottom: 12px;
+}
+
+.post-input textarea {
+    width: 100%;
+    min-height: 120px;
+    padding: 16px;
+    border: 2px solid rgba(255, 255, 255, 0.1);
+    border-radius: 12px;
+    background: rgba(255, 255, 255, 0.05);
+    color: #fff;
+    font-size: 16px;
+    font-family: inherit;
+    resize: vertical;
+    transition: border-color 0.2s;
+}
+
+.post-input textarea:focus {
+    outline: none;
+    border-color: #0085ff;
+}
+
+.post-input textarea::placeholder {
+    color: #6b7c93;
+}
+
+.char-count {
+    position: absolute;
+    bottom: 12px;
+    right: 12px;
+    font-size: 12px;
+    color: #6b7c93;
+}
+
+.char-count.warning {
+    color: #ffc107;
+}
+
+.char-count.danger {
+    color: #dc3545;
+}
+
+.post-input + .post-input {
+    padding-top: 12px;
+    border-top: 1px dashed rgba(255, 255, 255, 0.1);
+}
+
+.post-input .remove-post {
+    position: absolute;
+    top: 8px;
+    right: 8px;
+    background: rgba(220, 53, 69, 0.3);
+    border: none;
+    color: #ff6b7a;
+    width: 24px;
+    height: 24px;
+    border-radius: 50%;
+    cursor: pointer;
+    font-size: 14px;
+    line-height: 1;
+}
+
+.compose-actions {
+    display: flex;
+    gap: 12px;
+    justify-content: flex-end;
+}
+
+.btn-primary {
+    background: #0085ff;
+    color: #fff;
+    border: none;
+    padding: 12px 24px;
+    border-radius: 8px;
+    font-size: 16px;
+    font-weight: 600;
+    cursor: pointer;
+    transition: background 0.2s;
+}
+
+.btn-primary:hover {
+    background: #0066cc;
+}
+
+.btn-secondary {
+    background: rgba(255, 255, 255, 0.1);
+    color: #8b9dc3;
+    border: 1px solid rgba(255, 255, 255, 0.1);
+    padding: 12px 24px;
+    border-radius: 8px;
+    font-size: 14px;
+    cursor: pointer;
+    transition: all 0.2s;
+}
+
+.btn-secondary:hover {
+    background: rgba(255, 255, 255, 0.15);
+    color: #fff;
+}
+
+/* Login section */
+.login-section {
+    background: rgba(255, 255, 255, 0.05);
+    padding: 32px;
+    border-radius: 16px;
+    text-align: center;
+}
+
+.login-section h2 {
+    font-size: 1.3rem;
+    margin-bottom: 20px;
+    font-weight: 500;
+}
+
+.login-section p {
+    margin-bottom: 24px;
+}
+
+.login-tabs {
+    display: flex;
+    gap: 8px;
+    justify-content: center;
+    margin-bottom: 24px;
+}
+
+.login-tabs .tab {
+    background: rgba(255, 255, 255, 0.05);
+    border: 1px solid rgba(255, 255, 255, 0.1);
+    color: #8b9dc3;
+    padding: 10px 20px;
+    border-radius: 6px;
+    cursor: pointer;
+    font-size: 14px;
+    transition: all 0.2s;
+}
+
+.login-tabs .tab:hover {
+    background: rgba(255, 255, 255, 0.1);
+}
+
+.login-tabs .tab.active {
+    background: #0085ff;
+    border-color: #0085ff;
+    color: #fff;
+}
+
+.tab-content {
+    display: none;
+}
+
+.tab-content.active {
+    display: block;
+}
+
+.login-form {
+    max-width: 300px;
+    margin: 0 auto;
+}
+
+.input-group {
+    margin-bottom: 16px;
+    text-align: left;
+}
+
+.input-group label {
+    display: block;
+    margin-bottom: 6px;
+    color: #8b9dc3;
+    font-size: 14px;
+}
+
+.input-group input {
+    width: 100%;
+    padding: 12px 16px;
+    border: 2px solid rgba(255, 255, 255, 0.1);
+    border-radius: 8px;
+    background: rgba(255, 255, 255, 0.05);
+    color: #fff;
+    font-size: 16px;
+}
+
+.input-group input:focus {
+    outline: none;
+    border-color: #0085ff;
+}
+
+.login-form .btn-primary {
+    width: 100%;
+    margin-bottom: 16px;
+}
+
+.note {
+    font-size: 13px;
+    color: #6b7c93;
+}
+
+/* Recent posts */
+.recent-posts {
+    margin-top: 40px;
+}
+
+.recent-posts h2 {
+    font-size: 1.2rem;
+    margin-bottom: 16px;
+    color: #8b9dc3;
+}
+
+.post {
+    background: rgba(255, 255, 255, 0.05);
+    padding: 16px;
+    border-radius: 12px;
+    margin-bottom: 12px;
+}
+
+.post-header {
+    display: flex;
+    justify-content: space-between;
+    align-items: center;
+    margin-bottom: 8px;
+}
+
+.post-header .handle {
+    color: #0085ff;
+    font-weight: 600;
+}
+
+.post-header time {
+    color: #6b7c93;
+    font-size: 13px;
+}
+
+.post-text {
+    white-space: pre-wrap;
+    word-wrap: break-word;
+}
+
+.thread-indicator {
+    display: inline-block;
+    margin-top: 8px;
+    font-size: 12px;
+    color: #6b7c93;
+    background: rgba(255, 255, 255, 0.05);
+    padding: 2px 8px;
+    border-radius: 4px;
+}
+
+/* Footer */
+footer {
+    text-align: center;
+    padding: 40px 20px;
+    color: #6b7c93;
+    font-size: 14px;
+}
+
+/* Responsive */
+@media (max-width: 480px) {
+    main {
+        padding: 20px 16px;
+    }
+    
+    h1 {
+        font-size: 2rem;
+    }
+    
+    .compose-actions {
+        flex-direction: column;
+    }
+    
+    .btn-secondary {
+        order: 1;
+    }
+}

srv/templates/home.html

···
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>Bluesky Poster</title>
+    <link rel="stylesheet" href="/static/style.css">
+</head>
+<body>
+    <main>
+        <h1>🦋 Bluesky Poster</h1>
+        <p class="tagline">Post to Bluesky without the noise</p>
+        
+        {{if .Error}}
+        <div class="message error">{{.Error}}</div>
+        {{end}}
+        
+        {{if .Success}}
+        <div class="message success">{{.Success}}</div>
+        {{end}}
+        
+        {{if .LoggedIn}}
+        <div class="user-info">
+            <span class="handle">@{{.Handle}}</span>
+            <form method="POST" action="/auth/logout" class="inline">
+                <button type="submit" class="btn-link">Log out</button>
+            </form>
+        </div>
+        
+        <section class="compose">
+            <form method="POST" action="/post" id="postForm">
+                <div id="posts-container">
+                    <div class="post-input" data-index="0">
+                        <textarea name="post" placeholder="What's on your mind?" maxlength="{{.CharLimit}}" required></textarea>
+                        <div class="char-count"><span class="count">0</span>/{{.CharLimit}}</div>
+                    </div>
+                </div>
+                <div class="compose-actions">
+                    <button type="button" id="addPost" class="btn-secondary">+ Add to thread</button>
+                    <button type="submit" class="btn-primary">Post</button>
+                </div>
+            </form>
+        </section>
+        
+        {{if .Posts}}
+        <section class="recent-posts">
+            <h2>Your recent posts</h2>
+            {{range .Posts}}
+            <article class="post">
+                <div class="post-header">
+                    <span class="handle">@{{.Handle}}</span>
+                    <time>{{.CreatedAt.Format "Jan 2, 3:04 PM"}}</time>
+                </div>
+                <p class="post-text">{{.Text}}</p>
+                {{if .ThreadRootUri}}
+                <span class="thread-indicator">Part of thread</span>
+                {{end}}
+            </article>
+            {{end}}
+        </section>
+        {{end}}
+        
+        {{else}}
+        <section class="login-section">
+            <h2>Log in with Bluesky</h2>
+            
+            <div class="login-tabs">
+                <button type="button" class="tab active" data-tab="oauth">OAuth</button>
+                <button type="button" class="tab" data-tab="apppassword">App Password</button>
+            </div>
+            
+            <div id="oauth-form" class="tab-content active">
+                <form method="POST" action="/auth/login" class="login-form">
+                    <div class="input-group">
+                        <label for="handle">Handle</label>
+                        <input type="text" id="handle" name="handle" placeholder="yourname.bsky.social" required>
+                    </div>
+                    <button type="submit" class="btn-primary">Log in with OAuth</button>
+                </form>
+                <p class="note">You'll be redirected to Bluesky to authorize this app.</p>
+            </div>
+            
+            <div id="apppassword-form" class="tab-content">
+                <form method="POST" action="/auth/apppassword" class="login-form">
+                    <div class="input-group">
+                        <label for="handle2">Handle</label>
+                        <input type="text" id="handle2" name="handle" placeholder="yourname.bsky.social" required>
+                    </div>
+                    <div class="input-group">
+                        <label for="app_password">App Password</label>
+                        <input type="password" id="app_password" name="app_password" placeholder="xxxx-xxxx-xxxx-xxxx" required>
+                    </div>
+                    <button type="submit" class="btn-primary">Log in with App Password</button>
+                </form>
+                <p class="note">Create an app password in Bluesky Settings → App Passwords. Never use your main password!</p>
+            </div>
+        </section>
+        {{end}}
+    </main>
+    
+    <footer>
+        <p>This app only shows posts you create here. No feed, no distractions.</p>
+    </footer>
+    
+    <script src="/static/script.js"></script>
+</body>
+</html>

srv/templates/welcome.html

···
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>{{.Hostname}}</title>
+    <link rel="stylesheet" href="/static/style.css" />
+  </head>
+  <body>
+    <main>
+      <h1>Go Template Project</h1>
+
+      <section class="intro">
+        <p>
+          This is a starter template for building Go web applications on exe.dev. Customize this page and the code to create your own service.
+        </p>
+        <p>
+          This VM has a persistent disk, sudo, HTTPS, and SSH all wired up.
+        </p>
+      </section>
+
+      <section class="next-steps">
+        <h2>What next?</h2>
+        <div class="step-grid">
+          <article class="step-card">
+            <h3>Customize this template</h3>
+            <p>Edit the code to build your application.</p>
+            <ul>
+              <li>Source code is in <code>~/src</code></li>
+              <li>Edit via SSH or <a href="vscode://vscode-remote/ssh-remote+{{.Hostname}}@exe.dev/home/exedev/src?windowId=_blank">open in VS Code</a></li>
+              <li>Chat with our coding agent, <a href="https://{{.Hostname}}.exe.dev:9999" target="_blank">Shelley</a></li>
+              <li><code>sudo systemctl restart srv</code> to pick up changes</li>
+            </ul>
+          </article>
+          <article class="step-card">
+            <h3>What's included</h3>
+            <p>This template provides the essentials.</p>
+            <ul>
+              <li>HTTP server with routing and templates</li>
+              <li>SQLite database with migrations</li>
+              <li>Authentication via exe.dev headers</li>
+              <li>Systemd service configuration</li>
+            </ul>
+          </article>
+        </div>
+      </section>
+
+      <div class="hostname">{{.Hostname}}</div>
+
+      <ul class="actions">
+        <li>
+          <a href="#" class="ssh-copy" data-copy="ssh {{.Hostname}}@exe.dev">
+            <span class="action-icon">🔑</span>
+            <span class="action-label">SSH</span>
+            <span class="action-detail">ssh {{.Hostname}}.exe.dev</span>
+          </a>
+        </li>
+        <li>
+          <a href="https://{{.Hostname}}.xterm.exe.dev" target="_blank">
+            <span class="action-icon">💻</span>
+            <span class="action-label">Terminal</span>
+            <span class="action-detail">{{.Hostname}}.xterm.exe.dev</span>
+          </a>
+        </li>
+        <li>
+          <a href="https://{{.Hostname}}.exe.dev:9999" target="_blank">
+            <span class="action-icon">🤖</span>
+            <span class="action-label">Shelley Agent</span>
+            <span class="action-detail">{{.Hostname}}.exe.dev:9999</span>
+          </a>
+        </li>
+        <li>
+          <a href="https://exe.dev" target="_blank">
+            <span class="action-icon">🏠</span>
+            <span class="action-label">exe.dev</span>
+            <span class="action-detail">exe.dev</span>
+          </a>
+        </li>
+      </ul>
+
+      <hr />
+
+      <div class="user-info">
+        <p class="user-status">
+          {{if .UserEmail}}
+          Signed in as <strong>{{.UserEmail}}</strong>
+          {{else}}
+          Not signed in
+          {{end}}
+        </p>
+        <div class="auth-buttons">
+          {{if .UserEmail}}
+          <form method="POST" action="{{.LogoutURL}}" style="display:inline">
+            <button type="submit">logout</button>
+          </form>
+          {{else}}
+          <a href="{{.LoginURL}}">login</a>
+          {{end}}
+        </div>
+      </div>
+
+      {{if .Headers}}
+      <section class="headers">
+        <div class="headers-title">
+          <h2>HTTP headers from exe.dev</h2>
+          <div class="headers-notes">
+            <p>exe.dev adds extra headers to HTTP requests so that:</p>
+            <ul>
+              <li>you don't have to build auth</li>
+              <li>you know where the request came from</li>
+            </ul>
+            <p>These are all the HTTP headers we received from exe.dev for this request.</p>
+            <p>The <code>X-ExeDev-*</code> and <code>X-Forwarded-*</code> headers are added by exe.dev.</p>
+          </div>
+        </div>
+        <div class="headers-table">
+          <div class="headers-row headers-head">
+            <div>Header</div>
+            <div>Value</div>
+          </div>
+          {{range .Headers}}
+          <div class="headers-row{{if .AddedByExe}} exe-header{{end}}">
+            <div class="header-name"><code>{{.Name}}</code></div>
+            <div class="header-value">
+              {{if .Values}}
+                {{range $i, $value := .Values}}
+                  {{if $i}}<br />{{end}}
+                  <code>{{$value}}</code>
+                {{end}}
+              {{else}}
+                <span class="header-empty">—</span>
+              {{end}}
+            </div>
+          </div>
+          {{end}}
+        </div>
+      </section>
+      {{end}}
+
+      {{if .VisitCount}}
+      <p class="counter">You've viewed this page <strong>{{.VisitCount}}</strong> times.</p>
+      {{end}}
+    </main>
+
+    <div class="copied-feedback" id="copiedFeedback">Copied to clipboard!</div>
+
+    <script src="/static/script.js"></script>
+  </body>
+</html>