feat: implement BlockStore, AT-URI parsing, and commit signing

PDSharp.Core/AtUri.fs

···
+namespace PDSharp.Core
+
+open System
+open System.Text.RegularExpressions
+
+/// AT-URI parsing and validation
+module AtUri =
+  /// Represents an AT Protocol URI: at://did/collection/rkey
+  type AtUri = { Did : string; Collection : string; Rkey : string }
+
+  let private didPattern = @"^did:[a-z]+:[a-zA-Z0-9._:%-]+$"
+  let private nsidPattern = @"^[a-z][a-z0-9]*(\.[a-z][a-z0-9]*)+$"
+  let private rkeyPattern = @"^[a-zA-Z0-9._~-]+$"
+
+  /// Parse an AT-URI string into components
+  let parse (uri : string) : Result<AtUri, string> =
+    if not (uri.StartsWith("at://")) then
+      Error "AT-URI must start with at://"
+    else
+      let path = uri.Substring(5)
+      let parts = path.Split('/')
+
+      if parts.Length < 3 then
+        Error "AT-URI must have format at://did/collection/rkey"
+      else
+        let did = parts.[0]
+        let collection = parts.[1]
+        let rkey = parts.[2]
+
+        if not (Regex.IsMatch(did, didPattern)) then
+          Error $"Invalid DID format: {did}"
+        elif not (Regex.IsMatch(collection, nsidPattern)) then
+          Error $"Invalid collection NSID: {collection}"
+        elif not (Regex.IsMatch(rkey, rkeyPattern)) then
+          Error $"Invalid rkey format: {rkey}"
+        else
+          Ok { Did = did; Collection = collection; Rkey = rkey }
+
+  /// Convert AtUri back to string
+  let toString (uri : AtUri) : string =
+    $"at://{uri.Did}/{uri.Collection}/{uri.Rkey}"

PDSharp.Core/BlockStore.fs

···
+namespace PDSharp.Core
+
+open System.Collections.Concurrent
+
+/// Block storage interface for CID → byte[] mappings
+module BlockStore =
+
+  /// Interface for content-addressed block storage
+  type IBlockStore =
+    abstract member Get : Cid -> Async<byte[] option>
+    abstract member Put : byte[] -> Async<Cid>
+    abstract member Has : Cid -> Async<bool>
+
+  /// In-memory implementation of IBlockStore for testing
+  type MemoryBlockStore() =
+    let store = ConcurrentDictionary<string, byte[]>()
+
+    let cidKey (cid : Cid) =
+      System.Convert.ToBase64String(cid.Bytes)
+
+    interface IBlockStore with
+      member _.Get(cid : Cid) = async {
+        let key = cidKey cid
+        let success, data = store.TryGetValue(key)
+        return if success then Some data else None
+      }
+
+      member _.Put(data : byte[]) = async {
+        let hash = Crypto.sha256 data
+        let cid = Cid.FromHash hash
+        let key = cidKey cid
+        store.[key] <- data
+        return cid
+      }
+
+      member _.Has(cid : Cid) = async {
+        let key = cidKey cid
+        return store.ContainsKey(key)
+      }
+
+    /// Get the number of blocks stored (for testing)
+    member _.Count = store.Count
+
+    /// Clear all blocks (for testing)
+    member _.Clear() = store.Clear()

PDSharp.Core/PDSharp.Core.fsproj

···
         <Compile Include="DagCbor.fs" />
         <Compile Include="Crypto.fs" />
         <Compile Include="Mst.fs" />
+        <Compile Include="BlockStore.fs" />
+        <Compile Include="AtUri.fs" />
+        <Compile Include="Repository.fs" />
         <Compile Include="DidResolver.fs" />
         <Compile Include="Library.fs" />
     </ItemGroup>

PDSharp.Core/Repository.fs

···
+namespace PDSharp.Core
+
+open System
+
+/// Repository commit signing and management
+module Repository =
+  /// TID (Timestamp ID) generation for revision IDs
+  module Tid =
+    let private chars = "234567abcdefghijklmnopqrstuvwxyz"
+    let private clockIdBits = 10
+    let private timestampBits = 53
+
+    /// Generate a random clock ID component
+    let private randomClockId () =
+      let rng = Random()
+      rng.Next(1 <<< clockIdBits)
+
+    /// Encode a number to base32 sortable string
+    let private encode (value : int64) (length : int) =
+      let mutable v = value
+      let arr = Array.zeroCreate<char> length
+
+      for i in (length - 1) .. -1 .. 0 do
+        arr.[i] <- chars.[int (v &&& 0x1FL)]
+        v <- v >>> 5
+
+      String(arr)
+
+    /// Generate a new TID based on current timestamp
+    let generate () : string =
+      let timestamp = DateTimeOffset.UtcNow.ToUnixTimeMilliseconds()
+      let clockId = randomClockId ()
+      let combined = (timestamp <<< clockIdBits) ||| int64 clockId
+      encode combined 13
+
+  /// Unsigned commit record (before signing)
+  type UnsignedCommit = {
+    Did : string
+    Version : int
+    Data : Cid
+    Rev : string
+    Prev : Cid option
+  }
+
+  /// Signed commit record
+  type SignedCommit = {
+    Did : string
+    Version : int
+    Data : Cid
+    Rev : string
+    Prev : Cid option
+    Sig : byte[]
+  }
+
+  /// Convert unsigned commit to CBOR-encodable map
+  let private unsignedToCborMap (commit : UnsignedCommit) : Map<string, obj> =
+    let baseMap =
+      Map.ofList [
+        ("did", box commit.Did)
+        ("version", box commit.Version)
+        ("data", box commit.Data)
+        ("rev", box commit.Rev)
+      ]
+
+    match commit.Prev with
+    | Some prev -> baseMap |> Map.add "prev" (box prev)
+    | None -> baseMap
+
+  /// Sign an unsigned commit
+  let signCommit (key : Crypto.EcKeyPair) (commit : UnsignedCommit) : SignedCommit =
+    let cborMap = unsignedToCborMap commit
+    let cborBytes = DagCbor.encode cborMap
+    let hash = Crypto.sha256 cborBytes
+    let signature = Crypto.sign key hash
+
+    {
+      Did = commit.Did
+      Version = commit.Version
+      Data = commit.Data
+      Rev = commit.Rev
+      Prev = commit.Prev
+      Sig = signature
+    }
+
+  /// Verify a signed commit's signature
+  let verifyCommit (key : Crypto.EcKeyPair) (commit : SignedCommit) : bool =
+    let unsigned = {
+      Did = commit.Did
+      Version = commit.Version
+      Data = commit.Data
+      Rev = commit.Rev
+      Prev = commit.Prev
+    }
+
+    let cborMap = unsignedToCborMap unsigned
+    let cborBytes = DagCbor.encode cborMap
+    let hash = Crypto.sha256 cborBytes
+    Crypto.verify key hash commit.Sig
+
+  /// Convert signed commit to CBOR-encodable map
+  let signedToCborMap (commit : SignedCommit) : Map<string, obj> =
+    let baseMap =
+      Map.ofList [
+        ("did", box commit.Did)
+        ("version", box commit.Version)
+        ("data", box commit.Data)
+        ("rev", box commit.Rev)
+        ("sig", box commit.Sig)
+      ]
+
+    match commit.Prev with
+    | Some prev -> baseMap |> Map.add "prev" (box prev)
+    | None -> baseMap
+
+  /// Serialize a signed commit to DAG-CBOR bytes
+  let serializeCommit (commit : SignedCommit) : byte[] =
+    signedToCborMap commit |> DagCbor.encode
+
+  /// Get CID for a signed commit
+  let commitCid (commit : SignedCommit) : Cid =
+    let bytes = serializeCommit commit
+    let hash = Crypto.sha256 bytes
+    Cid.FromHash hash

PDSharp.Tests/AtUri.Tests.fs

···
+module AtUriTests
+
+open Xunit
+open PDSharp.Core.AtUri
+
+[<Fact>]
+let ``Parse valid AT-URI`` () =
+  let uri = "at://did:plc:abcd1234/app.bsky.feed.post/3kbq5vk4beg2f"
+  let result = parse uri
+
+  match result with
+  | Ok parsed ->
+    Assert.Equal("did:plc:abcd1234", parsed.Did)
+    Assert.Equal("app.bsky.feed.post", parsed.Collection)
+    Assert.Equal("3kbq5vk4beg2f", parsed.Rkey)
+  | Error msg -> Assert.Fail(msg)
+
+[<Fact>]
+let ``Parse did:web AT-URI`` () =
+  let uri = "at://did:web:example.com/app.bsky.actor.profile/self"
+  let result = parse uri
+
+  match result with
+  | Ok parsed ->
+    Assert.Equal("did:web:example.com", parsed.Did)
+    Assert.Equal("app.bsky.actor.profile", parsed.Collection)
+    Assert.Equal("self", parsed.Rkey)
+  | Error msg -> Assert.Fail(msg)
+
+[<Fact>]
+let ``Parse fails without at:// prefix`` () =
+  let uri = "http://did:plc:abcd/app.bsky.feed.post/123"
+  let result = parse uri
+
+  Assert.True(Result.isError result)
+
+[<Fact>]
+let ``Parse fails with invalid DID`` () =
+  let uri = "at://not-a-did/app.bsky.feed.post/123"
+  let result = parse uri
+
+  Assert.True(Result.isError result)
+
+[<Fact>]
+let ``Parse fails with invalid collection`` () =
+  let uri = "at://did:plc:abcd/NotAnNsid/123"
+  let result = parse uri
+
+  Assert.True(Result.isError result)
+
+[<Fact>]
+let ``Parse fails with missing parts`` () =
+  let uri = "at://did:plc:abcd/app.bsky.feed.post"
+  let result = parse uri
+
+  Assert.True(Result.isError result)
+
+[<Fact>]
+let ``ToString roundtrip`` () =
+  let original = {
+    Did = "did:plc:abcd"
+    Collection = "app.bsky.feed.post"
+    Rkey = "123"
+  }
+
+  let str = toString original
+  let parsed = parse str
+
+  match parsed with
+  | Ok p ->
+    Assert.Equal(original.Did, p.Did)
+    Assert.Equal(original.Collection, p.Collection)
+    Assert.Equal(original.Rkey, p.Rkey)
+  | Error msg -> Assert.Fail(msg)

PDSharp.Tests/BlockStore.Tests.fs

···
+module BlockStoreTests
+
+open Xunit
+open PDSharp.Core
+open PDSharp.Core.BlockStore
+
+[<Fact>]
+let ``MemoryBlockStore Put and Get roundtrip`` () =
+  let store = MemoryBlockStore() :> IBlockStore
+  let data = System.Text.Encoding.UTF8.GetBytes("hello world")
+
+  let cid = store.Put(data) |> Async.RunSynchronously
+  let retrieved = store.Get(cid) |> Async.RunSynchronously
+
+  Assert.True(Option.isSome retrieved)
+  Assert.Equal<byte[]>(data, Option.get retrieved)
+
+[<Fact>]
+let ``MemoryBlockStore Has returns true for existing`` () =
+  let store = MemoryBlockStore() :> IBlockStore
+  let data = System.Text.Encoding.UTF8.GetBytes("test data")
+
+  let cid = store.Put(data) |> Async.RunSynchronously
+  let exists = store.Has(cid) |> Async.RunSynchronously
+
+  Assert.True(exists)
+
+[<Fact>]
+let ``MemoryBlockStore Has returns false for missing`` () =
+  let store = MemoryBlockStore() :> IBlockStore
+  let fakeCid = Cid.FromHash(Crypto.sha256Str "nonexistent")
+
+  let exists = store.Has(fakeCid) |> Async.RunSynchronously
+
+  Assert.False(exists)
+
+[<Fact>]
+let ``MemoryBlockStore Get returns None for missing`` () =
+  let store = MemoryBlockStore() :> IBlockStore
+  let fakeCid = Cid.FromHash(Crypto.sha256Str "nonexistent")
+
+  let result = store.Get(fakeCid) |> Async.RunSynchronously
+
+  Assert.True(Option.isNone result)
+
+[<Fact>]
+let ``MemoryBlockStore CID is content-addressed`` () =
+  let store = MemoryBlockStore() :> IBlockStore
+  let data = System.Text.Encoding.UTF8.GetBytes("same content")
+  let cid1 = store.Put data |> Async.RunSynchronously
+  let cid2 = store.Put data |> Async.RunSynchronously
+  Assert.Equal<byte[]>(cid1.Bytes, cid2.Bytes)

PDSharp.Tests/PDSharp.Tests.fsproj

···
   <ItemGroup>
     <Compile Include="Tests.fs" />
     <Compile Include="Mst.Tests.fs" />
+    <Compile Include="BlockStore.Tests.fs" />
+    <Compile Include="AtUri.Tests.fs" />
+    <Compile Include="Repository.Tests.fs" />
     <Compile Include="Program.fs" />
   </ItemGroup>
 

PDSharp.Tests/Repository.Tests.fs

···
+module RepositoryTests
+
+open Xunit
+open PDSharp.Core
+open PDSharp.Core.Crypto
+open PDSharp.Core.Repository
+
+[<Fact>]
+let ``TID generation produces 13 character string`` () =
+  let tid = Tid.generate ()
+  Assert.Equal(13, tid.Length)
+
+[<Fact>]
+let ``TID generation is sortable by time`` () =
+  let tid1 = Tid.generate ()
+  System.Threading.Thread.Sleep(2)
+  let tid2 = Tid.generate ()
+  Assert.True(tid2 > tid1, $"Expected {tid2} > {tid1}")
+
+[<Fact>]
+let ``Commit signing produces valid signature`` () =
+  let keyPair = generateKey P256
+  let mstRoot = Cid.FromHash(sha256Str "mst-root")
+
+  let unsigned = {
+    Did = "did:plc:test1234"
+    Version = 3
+    Data = mstRoot
+    Rev = Tid.generate ()
+    Prev = None
+  }
+
+  let signed = signCommit keyPair unsigned
+
+  Assert.Equal(64, signed.Sig.Length)
+  Assert.Equal(unsigned.Did, signed.Did)
+  Assert.Equal(unsigned.Data, signed.Data)
+
+[<Fact>]
+let ``Commit verification succeeds for valid commit`` () =
+  let keyPair = generateKey P256
+  let mstRoot = Cid.FromHash(sha256Str "data")
+
+  let unsigned = {
+    Did = "did:plc:abc"
+    Version = 3
+    Data = mstRoot
+    Rev = Tid.generate ()
+    Prev = None
+  }
+
+  let signed = signCommit keyPair unsigned
+
+  Assert.True(verifyCommit keyPair signed)
+
+[<Fact>]
+let ``Commit verification fails for tampered data`` () =
+  let keyPair = generateKey P256
+  let mstRoot = Cid.FromHash(sha256Str "original")
+
+  let unsigned = {
+    Did = "did:plc:abc"
+    Version = 3
+    Data = mstRoot
+    Rev = Tid.generate ()
+    Prev = None
+  }
+
+  let signed = signCommit keyPair unsigned
+  let tampered = { signed with Did = "did:plc:different" }
+
+  Assert.False(verifyCommit keyPair tampered)
+
+[<Fact>]
+let ``Commit with prev CID`` () =
+  let keyPair = generateKey P256
+  let mstRoot = Cid.FromHash(sha256Str "new-data")
+  let prevCid = Cid.FromHash(sha256Str "prev-commit")
+
+  let unsigned = {
+    Did = "did:plc:abc"
+    Version = 3
+    Data = mstRoot
+    Rev = Tid.generate ()
+    Prev = Some prevCid
+  }
+
+  let signed = signCommit keyPair unsigned
+  Assert.True(verifyCommit keyPair signed)
+  Assert.True(Option.isSome signed.Prev)
+
+[<Fact>]
+let ``Commit CID is deterministic`` () =
+  let keyPair = generateKey P256
+  let mstRoot = Cid.FromHash(sha256Str "data")
+
+  let unsigned = {
+    Did = "did:plc:abc"
+    Version = 3
+    Data = mstRoot
+    Rev = "abcdefghijklm"
+    Prev = None
+  }
+
+  let signed = signCommit keyPair unsigned
+  let cid1 = commitCid signed
+  let cid2 = commitCid signed
+
+  Assert.Equal<byte[]>(cid1.Bytes, cid2.Bytes)
+
+[<Fact>]
+let ``Commit serialization produces valid DAG-CBOR`` () =
+  let keyPair = generateKey P256
+  let mstRoot = Cid.FromHash(sha256Str "test")
+
+  let unsigned = {
+    Did = "did:plc:test"
+    Version = 3
+    Data = mstRoot
+    Rev = Tid.generate ()
+    Prev = None
+  }
+
+  let signed = signCommit keyPair unsigned
+  let bytes = serializeCommit signed
+
+  Assert.True(bytes.Length > 0)
+  Assert.True(bytes.[0] >= 0xa0uy && bytes.[0] <= 0xbfuy)

PDSharp/Program.fs

···
 open System
 open System.IO
+open System.Text
+open System.Text.Json
 open Microsoft.AspNetCore.Builder
 open Microsoft.AspNetCore.Hosting
+open Microsoft.AspNetCore.Http
 open Microsoft.Extensions.Hosting
 open Microsoft.Extensions.DependencyInjection
 open Microsoft.Extensions.Configuration
 open Giraffe
+open PDSharp.Core
 open PDSharp.Core.Models
 open PDSharp.Core.Config
+open PDSharp.Core.BlockStore
+open PDSharp.Core.Repository
+open PDSharp.Core.Mst
+open PDSharp.Core.Crypto
 
 module App =
+  /// Repo state per DID: MST root, collections, current rev, head commit CID
+  type RepoData = {
+    MstRoot : MstNode
+    Collections : Map<string, Map<string, Cid>>
+    Rev : string
+    Head : Cid option
+    Prev : Cid option
+  }
+
+  let emptyRepo = {
+    MstRoot = { Left = None; Entries = [] }
+    Collections = Map.empty
+    Rev = ""
+    Head = None
+    Prev = None
+  }
+
+  let mutable repos : Map<string, RepoData> = Map.empty
+  let blockStore = MemoryBlockStore()
+  let mutable signingKeys : Map<string, EcKeyPair> = Map.empty
+
+  let getOrCreateKey (did : string) =
+    match Map.tryFind did signingKeys with
+    | Some k -> k
+    | None ->
+      let k = generateKey P256
+      signingKeys <- Map.add did k signingKeys
+      k
+
+  let loader (c : Cid) = async {
+    let! bytesOpt = (blockStore :> IBlockStore).Get(c)
+
+    match bytesOpt with
+    | Some bytes -> return Some(Mst.deserialize bytes)
+    | None -> return None
+  }
+
+  let persister (n : MstNode) = async {
+    let bytes = Mst.serialize n
+    return! (blockStore :> IBlockStore).Put(bytes)
+  }
+
+  let signAndStoreCommit (did : string) (mstRootCid : Cid) (rev : string) (prev : Cid option) = async {
+    let key = getOrCreateKey did
+
+    let unsigned : UnsignedCommit = {
+      Did = did
+      Version = 3
+      Data = mstRootCid
+      Rev = rev
+      Prev = prev
+    }
+
+    let signed = signCommit key unsigned
+    let commitBytes = serializeCommit signed
+    let! commitCid = (blockStore :> IBlockStore).Put(commitBytes)
+    return (signed, commitCid)
+  }
+
+  [<CLIMutable>]
+  type CreateRecordRequest = {
+    repo : string
+    collection : string
+    record : JsonElement
+    rkey : string option
+  }
+
+  [<CLIMutable>]
+  type CreateRecordResponse = {
+    uri : string
+    cid : string
+    commit : {| rev : string; cid : string |}
+  }
+
+  [<CLIMutable>]
+  type GetRecordResponse = { uri : string; cid : string; value : JsonElement }
+
+  [<CLIMutable>]
+  type ErrorResponse = { error : string; message : string }
 
   let describeServerHandler : HttpHandler =
     fun next ctx ->
       let config = ctx.GetService<AppConfig>()
 
-      // TODO: add to config
       let response = {
         availableUserDomains = []
         did = config.DidHost
···
 
       json response next ctx
 
+  let createRecordHandler : HttpHandler =
+    fun next ctx -> task {
+      let! body = ctx.ReadBodyFromRequestAsync()
+
+      let request =
+        JsonSerializer.Deserialize<CreateRecordRequest>(body, JsonSerializerOptions(PropertyNameCaseInsensitive = true))
+
+      let did = request.repo
+
+      let rkey =
+        match request.rkey with
+        | Some r when not (String.IsNullOrWhiteSpace(r)) -> r
+        | _ -> Tid.generate ()
+
+      let recordJson = request.record.GetRawText()
+      let recordBytes = Encoding.UTF8.GetBytes(recordJson)
+      let! recordCid = (blockStore :> IBlockStore).Put(recordBytes)
+
+      let repoData = Map.tryFind did repos |> Option.defaultValue emptyRepo
+      let mstKey = $"{request.collection}/{rkey}"
+
+      let! newMstRoot = Mst.put loader persister repoData.MstRoot mstKey recordCid ""
+      let! mstRootCid = persister newMstRoot
+
+      let newRev = Tid.generate ()
+      let! (_, commitCid) = signAndStoreCommit did mstRootCid newRev repoData.Head
+
+      let collectionMap =
+        Map.tryFind request.collection repoData.Collections
+        |> Option.defaultValue Map.empty
+
+      let newCollectionMap = Map.add rkey recordCid collectionMap
+
+      let newCollections =
+        Map.add request.collection newCollectionMap repoData.Collections
+
+      let updatedRepo = {
+        MstRoot = newMstRoot
+        Collections = newCollections
+        Rev = newRev
+        Head = Some commitCid
+        Prev = repoData.Head
+      }
+
+      repos <- Map.add did updatedRepo repos
+
+      let uri = $"at://{did}/{request.collection}/{rkey}"
+      ctx.SetStatusCode 200
+
+      return!
+        json
+          {|
+            uri = uri
+            cid = recordCid.ToString()
+            commit = {| rev = newRev; cid = commitCid.ToString() |}
+          |}
+          next
+          ctx
+    }
+
+  let getRecordHandler : HttpHandler =
+    fun next ctx -> task {
+      let repo = ctx.Request.Query.["repo"].ToString()
+      let collection = ctx.Request.Query.["collection"].ToString()
+      let rkey = ctx.Request.Query.["rkey"].ToString()
+
+      if
+        String.IsNullOrWhiteSpace(repo)
+        || String.IsNullOrWhiteSpace(collection)
+        || String.IsNullOrWhiteSpace(rkey)
+      then
+        ctx.SetStatusCode 400
+
+        return!
+          json
+            {
+              error = "InvalidRequest"
+              message = "Missing required query parameters: repo, collection, rkey"
+            }
+            next
+            ctx
+      else
+        match Map.tryFind repo repos with
+        | None ->
+          ctx.SetStatusCode 404
+
+          return!
+            json
+              {
+                error = "RepoNotFound"
+                message = $"Repository not found: {repo}"
+              }
+              next
+              ctx
+        | Some repoData ->
+          match Map.tryFind collection repoData.Collections with
+          | None ->
+            ctx.SetStatusCode 404
+
+            return!
+              json
+                {
+                  error = "RecordNotFound"
+                  message = $"Collection not found: {collection}"
+                }
+                next
+                ctx
+          | Some collectionMap ->
+            match Map.tryFind rkey collectionMap with
+            | None ->
+              ctx.SetStatusCode 404
+
+              return!
+                json
+                  {
+                    error = "RecordNotFound"
+                    message = $"Record not found: {rkey}"
+                  }
+                  next
+                  ctx
+            | Some recordCid ->
+              let! recordBytesOpt = (blockStore :> IBlockStore).Get(recordCid)
+
+              match recordBytesOpt with
+              | None ->
+                ctx.SetStatusCode 500
+
+                return!
+                  json
+                    {
+                      error = "InternalError"
+                      message = "Block not found in store"
+                    }
+                    next
+                    ctx
+              | Some recordBytes ->
+                let recordJson = Encoding.UTF8.GetString(recordBytes)
+                let uri = $"at://{repo}/{collection}/{rkey}"
+                let valueElement = JsonSerializer.Deserialize<JsonElement>(recordJson)
+                ctx.SetStatusCode 200
+
+                return!
+                  json
+                    {|
+                      uri = uri
+                      cid = recordCid.ToString()
+                      value = valueElement
+                    |}
+                    next
+                    ctx
+    }
+
+  let putRecordHandler : HttpHandler =
+    fun next ctx -> task {
+      let! body = ctx.ReadBodyFromRequestAsync()
+
+      let request =
+        JsonSerializer.Deserialize<CreateRecordRequest>(body, JsonSerializerOptions(PropertyNameCaseInsensitive = true))
+
+      match request.rkey with
+      | Some r when not (String.IsNullOrWhiteSpace r) ->
+        let did = request.repo
+        let recordJson = request.record.GetRawText()
+        let recordBytes = Encoding.UTF8.GetBytes(recordJson)
+        let! recordCid = (blockStore :> IBlockStore).Put(recordBytes)
+
+        let repoData = Map.tryFind did repos |> Option.defaultValue emptyRepo
+        let mstKey = $"{request.collection}/{r}"
+
+        let! newMstRoot = Mst.put loader persister repoData.MstRoot mstKey recordCid ""
+        let! mstRootCid = persister newMstRoot
+
+        let newRev = Tid.generate ()
+        let! (_, commitCid) = signAndStoreCommit did mstRootCid newRev repoData.Head
+
+        let collectionMap =
+          Map.tryFind request.collection repoData.Collections
+          |> Option.defaultValue Map.empty
+
+        let newCollectionMap = Map.add r recordCid collectionMap
+
+        let newCollections =
+          Map.add request.collection newCollectionMap repoData.Collections
+
+        let updatedRepo = {
+          MstRoot = newMstRoot
+          Collections = newCollections
+          Rev = newRev
+          Head = Some commitCid
+          Prev = repoData.Head
+        }
+
+        repos <- Map.add did updatedRepo repos
+
+        ctx.SetStatusCode 200
+
+        return!
+          json
+            {|
+              uri = $"at://{did}/{request.collection}/{r}"
+              cid = recordCid.ToString()
+              commit = {| rev = newRev; cid = commitCid.ToString() |}
+            |}
+            next
+            ctx
+      | _ ->
+        ctx.SetStatusCode 400
+
+        return!
+          json
+            {
+              error = "InvalidRequest"
+              message = "rkey is required for putRecord"
+            }
+            next
+            ctx
+    }
+
   let webApp =
     choose [
-      route "/xrpc/com.atproto.server.describeServer" >=> describeServerHandler
+      GET
+      >=> route "/xrpc/com.atproto.server.describeServer"
+      >=> describeServerHandler
+      POST >=> route "/xrpc/com.atproto.repo.createRecord" >=> createRecordHandler
+      GET >=> route "/xrpc/com.atproto.repo.getRecord" >=> getRecordHandler
+      POST >=> route "/xrpc/com.atproto.repo.putRecord" >=> putRecordHandler
       route "/" >=> text "PDSharp PDS is running."
       RequestErrors.NOT_FOUND "Not Found"
     ]

roadmap.txt

···
 --------------------------------------------------------------------------------
 Milestone E: Commit + BlockStore + putRecord
 --------------------------------------------------------------------------------
-- BlockStore: cid → bytes, indexed by DID/rev/head
-- Commit signing: UnsignedCommit → DAG-CBOR → sha256 → ECDSA sign
-- Implement com.atproto.repo.putRecord/createRecord
+- [x] BlockStore: cid → bytes, indexed by DID/rev/head
+- [x] Commit signing: UnsignedCommit → DAG-CBOR → sha256 → ECDSA sign
+- [x] Implement com.atproto.repo.putRecord/createRecord
 DoD: Write and read records by path/AT-URI
 --------------------------------------------------------------------------------
 Milestone F: CAR Export + Sync Endpoints
···
 ================================================================================
 QUICK CHECKLIST
 ================================================================================
-[ ] describeServer endpoint working
-[ ] Crypto primitives (sha256, ECDSA p256/k256, low-S)
-[ ] DAG-CBOR + CID generation correct
+[x] describeServer endpoint working
+[x] Crypto primitives (sha256, ECDSA p256/k256, low-S)
+[x] DAG-CBOR + CID generation correct
 [x] MST producing deterministic root CIDs
-[ ] putRecord + blockstore operational
+[x] putRecord + blockstore operational
 [ ] CAR export + sync endpoints
 [ ] subscribeRepos firehose
 [ ] Authentication (createAccount, createSession)