feat: add authentication module

PDSharp.Core/Auth.fs

···
+namespace PDSharp.Core
+
+open System
+open System.Text
+open Org.BouncyCastle.Crypto.Digests
+open Org.BouncyCastle.Crypto.Macs
+open Org.BouncyCastle.Crypto.Parameters
+open Org.BouncyCastle.Security
+
+/// Authentication module for sessions and accounts
+/// TODO: Migrate account storage from in-memory to SQLite/Postgres for production
+module Auth =
+  /// Hash a password with a random salt using SHA-256
+  ///
+  /// Returns: base64(salt)$base64(hash)
+  let hashPassword (password : string) : string =
+    let salt = Array.zeroCreate<byte> 16
+    SecureRandom().NextBytes(salt)
+
+    let passwordBytes = Encoding.UTF8.GetBytes(password)
+    let toHash = Array.append salt passwordBytes
+
+    let digest = Sha256Digest()
+    digest.BlockUpdate(toHash, 0, toHash.Length)
+    let hash = Array.zeroCreate<byte> (digest.GetDigestSize())
+    digest.DoFinal(hash, 0) |> ignore
+
+    $"{Convert.ToBase64String(salt)}${Convert.ToBase64String(hash)}"
+
+  /// Verify a password against a stored hash
+  let verifyPassword (password : string) (storedHash : string) : bool =
+    let parts = storedHash.Split('$')
+
+    if parts.Length <> 2 then
+      false
+    else
+      try
+        let salt = Convert.FromBase64String(parts.[0])
+        let expectedHash = Convert.FromBase64String(parts.[1])
+
+        let passwordBytes = Encoding.UTF8.GetBytes(password)
+        let toHash = Array.append salt passwordBytes
+
+        let digest = Sha256Digest()
+        digest.BlockUpdate(toHash, 0, toHash.Length)
+        let actualHash = Array.zeroCreate<byte> (digest.GetDigestSize())
+        digest.DoFinal(actualHash, 0) |> ignore
+
+        actualHash = expectedHash
+      with _ ->
+        false
+
+  let private base64UrlEncode (bytes : byte[]) : string =
+    Convert.ToBase64String(bytes).Replace('+', '-').Replace('/', '_').TrimEnd('=')
+
+  let private base64UrlDecode (str : string) : byte[] =
+    let padded =
+      match str.Length % 4 with
+      | 2 -> str + "=="
+      | 3 -> str + "="
+      | _ -> str
+
+    Convert.FromBase64String(padded.Replace('-', '+').Replace('_', '/'))
+
+  let private hmacSha256 (secret : byte[]) (data : byte[]) : byte[] =
+    let hmac = HMac(Sha256Digest())
+    hmac.Init(KeyParameter(secret))
+    hmac.BlockUpdate(data, 0, data.Length)
+    let result = Array.zeroCreate<byte> (hmac.GetMacSize())
+    hmac.DoFinal(result, 0) |> ignore
+    result
+
+  /// Token type for domain separation per AT Protocol spec
+  type TokenType =
+    | Access // typ: at+jwt
+    | Refresh // typ: refresh+jwt
+
+  /// Create a JWT token
+  let createToken (secret : string) (tokenType : TokenType) (did : string) (expiresIn : TimeSpan) : string =
+    let now = DateTimeOffset.UtcNow
+    let exp = now.Add(expiresIn)
+
+    let typ =
+      match tokenType with
+      | Access -> "at+jwt"
+      | Refresh -> "refresh+jwt"
+
+    let jti = Guid.NewGuid().ToString("N")
+
+    let header = $"""{{ "alg": "HS256", "typ": "{typ}" }}"""
+    let headerB64 = base64UrlEncode (Encoding.UTF8.GetBytes(header))
+
+    let payload =
+      $"""{{ "sub": "{did}", "iat": {now.ToUnixTimeSeconds()}, "exp": {exp.ToUnixTimeSeconds()}, "jti": "{jti}" }}"""
+
+    let payloadB64 = base64UrlEncode (Encoding.UTF8.GetBytes(payload))
+
+    let signingInput = $"{headerB64}.{payloadB64}"
+    let secretBytes = Encoding.UTF8.GetBytes(secret)
+    let signature = hmacSha256 secretBytes (Encoding.UTF8.GetBytes(signingInput))
+    let signatureB64 = base64UrlEncode signature
+
+    $"{headerB64}.{payloadB64}.{signatureB64}"
+
+  /// Create an access token (short-lived)
+  let createAccessToken (secret : string) (did : string) : string =
+    createToken secret Access did (TimeSpan.FromMinutes(15.0))
+
+  /// Create a refresh token (longer-lived)
+  let createRefreshToken (secret : string) (did : string) : string =
+    createToken secret Refresh did (TimeSpan.FromDays(7.0))
+
+  /// Validation result
+  type TokenValidation =
+    | Valid of did : string * tokenType : TokenType * exp : int64
+    | Invalid of reason : string
+
+  /// Validate a JWT token and extract claims
+  let validateToken (secret : string) (token : string) : TokenValidation =
+    let parts = token.Split('.')
+
+    if parts.Length <> 3 then
+      Invalid "Invalid token format"
+    else
+      try
+        let headerB64, payloadB64, signatureB64 = parts.[0], parts.[1], parts.[2]
+
+        let signingInput = $"{headerB64}.{payloadB64}"
+        let secretBytes = Encoding.UTF8.GetBytes(secret)
+        let expectedSig = hmacSha256 secretBytes (Encoding.UTF8.GetBytes(signingInput))
+        let actualSig = base64UrlDecode signatureB64
+
+        if expectedSig <> actualSig then
+          Invalid "Invalid signature"
+        else
+          let payloadJson = Encoding.UTF8.GetString(base64UrlDecode payloadB64)
+          let headerJson = Encoding.UTF8.GetString(base64UrlDecode headerB64)
+
+          let typMatch =
+            System.Text.RegularExpressions.Regex.Match(headerJson, "\"typ\"\\s*:\\s*\"([^\"]+)\"")
+
+          let tokenType =
+            if typMatch.Success then
+              match typMatch.Groups.[1].Value with
+              | "at+jwt" -> Access
+              | "refresh+jwt" -> Refresh
+              | _ -> Access
+            else
+              Access
+
+          let subMatch =
+            System.Text.RegularExpressions.Regex.Match(payloadJson, "\"sub\"\\s*:\\s*\"([^\"]+)\"")
+
+          let expMatch =
+            System.Text.RegularExpressions.Regex.Match(payloadJson, "\"exp\"\\s*:\\s*([0-9]+)")
+
+          if not subMatch.Success || not expMatch.Success then
+            Invalid "Missing claims"
+          else
+            let did = subMatch.Groups.[1].Value
+            let exp = Int64.Parse(expMatch.Groups.[1].Value)
+            let now = DateTimeOffset.UtcNow.ToUnixTimeSeconds()
+
+            if now > exp then
+              Invalid "Token expired"
+            else
+              Valid(did, tokenType, exp)
+      with ex ->
+        Invalid $"Parse error: {ex.Message}"
+
+  /// Account record
+  type Account = {
+    Did : string
+    Handle : string
+    PasswordHash : string
+    Email : string option
+    CreatedAt : DateTimeOffset
+  }
+
+  let mutable private accounts : Map<string, Account> = Map.empty
+  let mutable private handleIndex : Map<string, string> = Map.empty
+
+  let createAccount (handle : string) (password : string) (email : string option) : Result<Account, string> =
+    if Map.containsKey handle handleIndex then
+      Error "Handle already taken"
+    else
+      let did = $"did:web:{handle}"
+
+      if Map.containsKey did accounts then
+        Error "Account already exists"
+      else
+        let account = {
+          Did = did
+          Handle = handle
+          PasswordHash = hashPassword password
+          Email = email
+          CreatedAt = DateTimeOffset.UtcNow
+        }
+
+        accounts <- Map.add did account accounts
+        handleIndex <- Map.add handle did handleIndex
+        Ok account
+
+  /// Get account by handle
+  let getAccountByHandle (handle : string) : Account option =
+    handleIndex
+    |> Map.tryFind handle
+    |> Option.bind (fun did -> Map.tryFind did accounts)
+
+  /// Get account by DID
+  let getAccountByDid (did : string) : Account option = Map.tryFind did accounts
+
+  /// Clear all accounts (for testing)
+  let resetAccounts () =
+    accounts <- Map.empty
+    handleIndex <- Map.empty

PDSharp.Core/Config.fs

···
 namespace PDSharp.Core
 
 module Config =
-  type AppConfig = { PublicUrl : string; DidHost : string }
+  type AppConfig = {
+    PublicUrl : string
+    DidHost : string
+    /// HS256 signing key for session tokens
+    JwtSecret : string
+  }

PDSharp.Core/PDSharp.Core.fsproj

···
         <Compile Include="Car.fs" />
         <Compile Include="AtUri.fs" />
         <Compile Include="Repository.fs" />
+        <Compile Include="Auth.fs" />
         <Compile Include="Firehose.fs" />
         <Compile Include="DidResolver.fs" />
         <Compile Include="Library.fs" />

PDSharp.Docs/auth.md

···
+# AT Protocol Session & Account Authentication
+
+## Session Authentication (Legacy Bearer JWT)
+
+Based on the [XRPC Spec](https://atproto.com/specs/xrpc#authentication):
+
+### Token Types
+
+| Token         | JWT `typ` Header | Lifetime                    | Purpose                        |
+| ------------- | ---------------- | --------------------------- | ------------------------------ |
+| Access Token  | `at+jwt`         | Short (~2min refresh cycle) | Authenticate most API requests |
+| Refresh Token | `refresh+jwt`    | Longer (~2 months)          | Obtain new access tokens       |
+
+### Endpoints
+
+- **`createSession`**: Login with identifier (handle/email) + password → returns `{accessJwt, refreshJwt, handle, did}`
+- **`refreshSession`**: Uses refresh JWT in Bearer header → returns new `{accessJwt, refreshJwt, handle, did}`
+- **`createAccount`**: Register new account → returns session tokens + creates DID
+
+### JWT Claims (Server-Generated)
+
+Servers should implement **domain separation** using the `typ` header field:
+
+- Access: `typ: at+jwt` (per [RFC 9068](https://www.rfc-editor.org/rfc/rfc9068.html))
+- Refresh: `typ: refresh+jwt`
+
+Standard JWT claims: `sub` (DID), `iat`, `exp`, `jti` (nonce)
+
+### Configuration Required
+
+Yes, JWT signing requires a **secret key** for HMAC-SHA256 (HS256). This should be:
+
+- Loaded from configuration/environment variable (e.g., `PDS_JWT_SECRET`)
+- At least 32 bytes of cryptographically random data
+- Never hardcoded or committed to source control
+
+## Account Storage
+
+### Reference PDS Approach
+
+The Bluesky reference PDS uses:
+
+- **SQLite database per user** (recent architecture)
+- `account.sqlite` contains: handle, email, DID, password hash
+- Accounts indexed by DID (primary) and handle (unique)
+
+## App Passwords
+
+App passwords are a security feature allowing restricted access:
+
+- Format: `xxxx-xxxx-xxxx-xxxx`
+- Created/revoked independently from main password
+- Grants limited permissions (no auth settings changes)
+
+## Inter-Service Auth (Different from Session Auth)
+
+For service-to-service requests, different mechanism:
+
+- Uses **asymmetric signing** (ES256/ES256K) with account's signing key
+- Short-lived tokens (~60sec)
+- Validated against DID document
+
+## Summary: Implementation Decisions
+
+| Aspect          | Decision                   | Rationale                            |
+| --------------- | -------------------------- | ------------------------------------ |
+| Token signing   | HS256 (symmetric)          | Simpler, standard for session tokens |
+| Secret storage  | Config/env var             | Required for security                |
+| Account storage | In-memory (initial)        | Matches existing patterns            |
+| Password hash   | SHA-256 + salt             | Uses existing Crypto.fs              |
+| Token lifetimes | Access: 15min, Refresh: 7d | Conservative defaults                |
+
+## References
+
+- [XRPC Authentication Spec](https://atproto.com/specs/xrpc#authentication)
+- [RFC 9068 - JWT Access Tokens](https://www.rfc-editor.org/rfc/rfc9068.html)
+- [Bluesky PDS GitHub](https://github.com/bluesky-social/pds)

PDSharp.Tests/Auth.Tests.fs

···
+module Auth.Tests
+
+open Xunit
+open PDSharp.Core.Auth
+
+[<Fact>]
+let ``Password hashing produces salt$hash format`` () =
+  let hash = hashPassword "mypassword"
+  Assert.Contains("$", hash)
+  let parts = hash.Split('$')
+  Assert.Equal(2, parts.Length)
+
+[<Fact>]
+let ``Password verification succeeds for correct password`` () =
+  let hash = hashPassword "mypassword"
+  Assert.True(verifyPassword "mypassword" hash)
+
+[<Fact>]
+let ``Password verification fails for wrong password`` () =
+  let hash = hashPassword "mypassword"
+  Assert.False(verifyPassword "wrongpassword" hash)
+
+[<Fact>]
+let ``Password verification fails for invalid hash format`` () =
+  Assert.False(verifyPassword "password" "invalidhash")
+  Assert.False(verifyPassword "password" "")
+
+[<Fact>]
+let ``JWT access token creation and validation`` () =
+  let secret = "test-secret-key-minimum-32-chars!"
+  let did = "did:web:test.example"
+
+  let token = createAccessToken secret did
+
+  let parts = token.Split('.')
+  Assert.Equal(3, parts.Length)
+
+  match validateToken secret token with
+  | Valid(extractedDid, tokenType, _) ->
+    Assert.Equal(did, extractedDid)
+    Assert.Equal(Access, tokenType)
+  | Invalid reason -> Assert.Fail $"Token should be valid, got: {reason}"
+
+[<Fact>]
+let ``JWT refresh token has correct type`` () =
+  let secret = "test-secret-key-minimum-32-chars!"
+  let did = "did:web:test.example"
+
+  let token = createRefreshToken secret did
+
+  match validateToken secret token with
+  | Valid(_, tokenType, _) -> Assert.Equal(Refresh, tokenType)
+  | Invalid reason -> Assert.Fail $"Token should be valid, got: {reason}"
+
+[<Fact>]
+let ``JWT validation fails with wrong secret`` () =
+  let secret = "test-secret-key-minimum-32-chars!"
+  let wrongSecret = "wrong-secret-key-minimum-32-chars!"
+  let did = "did:web:test.example"
+
+  let token = createAccessToken secret did
+
+  match validateToken wrongSecret token with
+  | Invalid _ -> Assert.True(true)
+  | Valid _ -> Assert.Fail "Token should be invalid with wrong secret"
+
+[<Fact>]
+let ``Account creation and lookup by handle`` () =
+  resetAccounts ()
+
+  match createAccount "test.user" "password123" (Some "[e-mail]") with
+  | Error msg -> Assert.Fail msg
+  | Ok account ->
+    Assert.Equal("test.user", account.Handle)
+    Assert.Equal("did:web:test.user", account.Did)
+    Assert.Equal(Some "[e-mail]", account.Email)
+
+    match getAccountByHandle "test.user" with
+    | None -> Assert.Fail "Account should be found"
+    | Some found -> Assert.Equal(account.Did, found.Did)
+
+[<Fact>]
+let ``Account creation fails for duplicate handle`` () =
+  resetAccounts ()
+
+  createAccount "duplicate.user" "password" None |> ignore
+
+  match createAccount "duplicate.user" "password2" None with
+  | Error msg -> Assert.Contains("already", msg.ToLower())
+  | Ok _ -> Assert.Fail "Should fail for duplicate handle"
+
+[<Fact>]
+let ``Account lookup by DID`` () =
+  resetAccounts ()
+
+  match createAccount "did.user" "password123" None with
+  | Error msg -> Assert.Fail msg
+  | Ok account ->
+    match getAccountByDid account.Did with
+    | None -> Assert.Fail "Account should be found by DID"
+    | Some found -> Assert.Equal(account.Handle, found.Handle)

PDSharp.Tests/PDSharp.Tests.fsproj

···
     <Compile Include="Repository.Tests.fs" />
     <Compile Include="Car.Tests.fs" />
     <Compile Include="Firehose.Tests.fs" />
+    <Compile Include="Auth.Tests.fs" />
     <Compile Include="Program.fs" />
   </ItemGroup>
 

PDSharp.Tests/Tests.fs

···
   let config = {
     PublicUrl = "https://example.com"
     DidHost = "did:web:example.com"
+    JwtSecret = "test-secret-key-for-testing-only"
   }
 
   Assert.Equal("did:web:example.com", config.DidHost)

PDSharp/Program.fs

···
 open PDSharp.Core.Mst
 open PDSharp.Core.Crypto
 open PDSharp.Core.Firehose
+open PDSharp.Core.Auth
 
 module App =
   /// Repo state per DID: MST root, collections, current rev, head commit CID
···
     let signed = signCommit key unsigned
     let commitBytes = serializeCommit signed
     let! commitCid = (blockStore :> IBlockStore).Put(commitBytes)
-    return (signed, commitCid)
+    return signed, commitCid
   }
 
   [<CLIMutable>]
···
       }
 
       json response next ctx
+
+  [<CLIMutable>]
+  type CreateAccountRequest = {
+    handle : string
+    email : string option
+    password : string
+    inviteCode : string option
+  }
+
+  [<CLIMutable>]
+  type CreateSessionRequest = {
+    /// Handle or email
+    identifier : string
+    password : string
+  }
+
+  type SessionResponse = {
+    accessJwt : string
+    refreshJwt : string
+    handle : string
+    did : string
+    email : string option
+  }
+
+  /// POST /xrpc/com.atproto.server.createAccount
+  let createAccountHandler : HttpHandler =
+    fun next ctx -> task {
+      let config = ctx.GetService<AppConfig>()
+      let! body = ctx.ReadBodyFromRequestAsync()
+
+      let request =
+        JsonSerializer.Deserialize<CreateAccountRequest>(
+          body,
+          JsonSerializerOptions(PropertyNameCaseInsensitive = true)
+        )
+
+      if
+        String.IsNullOrWhiteSpace(request.handle)
+        || String.IsNullOrWhiteSpace(request.password)
+      then
+        ctx.SetStatusCode 400
+
+        return!
+          json
+            {
+              error = "InvalidRequest"
+              message = "handle and password are required"
+            }
+            next
+            ctx
+      else
+        match createAccount request.handle request.password request.email with
+        | Error msg ->
+          ctx.SetStatusCode 400
+          return! json { error = "AccountExists"; message = msg } next ctx
+        | Ok account ->
+          let accessJwt = createAccessToken config.JwtSecret account.Did
+          let refreshJwt = createRefreshToken config.JwtSecret account.Did
+
+          ctx.SetStatusCode 200
+
+          return!
+            json
+              {
+                accessJwt = accessJwt
+                refreshJwt = refreshJwt
+                handle = account.Handle
+                did = account.Did
+                email = account.Email
+              }
+              next
+              ctx
+    }
+
+  /// POST /xrpc/com.atproto.server.createSession
+  let createSessionHandler : HttpHandler =
+    fun next ctx -> task {
+      let config = ctx.GetService<AppConfig>()
+      let! body = ctx.ReadBodyFromRequestAsync()
+
+      let request =
+        JsonSerializer.Deserialize<CreateSessionRequest>(
+          body,
+          JsonSerializerOptions(PropertyNameCaseInsensitive = true)
+        )
+
+      if
+        String.IsNullOrWhiteSpace(request.identifier)
+        || String.IsNullOrWhiteSpace(request.password)
+      then
+        ctx.SetStatusCode 400
+
+        return!
+          json
+            {
+              error = "InvalidRequest"
+              message = "identifier and password are required"
+            }
+            next
+            ctx
+      else
+        match getAccountByHandle request.identifier with
+        | None ->
+          ctx.SetStatusCode 401
+
+          return!
+            json
+              {
+                error = "AuthenticationRequired"
+                message = "Invalid identifier or password"
+              }
+              next
+              ctx
+        | Some account ->
+          if not (verifyPassword request.password account.PasswordHash) then
+            ctx.SetStatusCode 401
+
+            return!
+              json
+                {
+                  error = "AuthenticationRequired"
+                  message = "Invalid identifier or password"
+                }
+                next
+                ctx
+          else
+            let accessJwt = createAccessToken config.JwtSecret account.Did
+            let refreshJwt = createRefreshToken config.JwtSecret account.Did
+
+            ctx.SetStatusCode 200
+
+            return!
+              json
+                {
+                  accessJwt = accessJwt
+                  refreshJwt = refreshJwt
+                  handle = account.Handle
+                  did = account.Did
+                  email = account.Email
+                }
+                next
+                ctx
+    }
+
+  /// Extract Bearer token from Authorization header
+  let private extractBearerToken (ctx : HttpContext) : string option =
+    match ctx.Request.Headers.TryGetValue("Authorization") with
+    | true, values ->
+      let header = values.ToString()
+
+      if header.StartsWith("Bearer ", StringComparison.OrdinalIgnoreCase) then
+        Some(header.Substring(7))
+      else
+        None
+    | _ -> None
+
+  /// POST /xrpc/com.atproto.server.refreshSession
+  let refreshSessionHandler : HttpHandler =
+    fun next ctx -> task {
+      let config = ctx.GetService<AppConfig>()
+
+      match extractBearerToken ctx with
+      | None ->
+        ctx.SetStatusCode 401
+
+        return!
+          json
+            {
+              error = "AuthenticationRequired"
+              message = "Missing or invalid Authorization header"
+            }
+            next
+            ctx
+      | Some token ->
+        match validateToken config.JwtSecret token with
+        | Invalid reason ->
+          ctx.SetStatusCode 401
+          return! json { error = "ExpiredToken"; message = reason } next ctx
+        | Valid(did, tokenType, _) ->
+          if tokenType <> Refresh then
+            ctx.SetStatusCode 400
+
+            return!
+              json
+                {
+                  error = "InvalidRequest"
+                  message = "Refresh token required"
+                }
+                next
+                ctx
+          else
+            match getAccountByDid did with
+            | None ->
+              ctx.SetStatusCode 401
+              return! json { error = "AccountNotFound"; message = "Account not found" } next ctx
+            | Some account ->
+              let accessJwt = createAccessToken config.JwtSecret account.Did
+              let refreshJwt = createRefreshToken config.JwtSecret account.Did
+
+              ctx.SetStatusCode 200
+
+              return!
+                json
+                  {
+                    accessJwt = accessJwt
+                    refreshJwt = refreshJwt
+                    handle = account.Handle
+                    did = account.Did
+                    email = account.Email
+                  }
+                  next
+                  ctx
+    }
 
   let createRecordHandler : HttpHandler =
     fun next ctx -> task {
···
       GET
       >=> route "/xrpc/com.atproto.server.describeServer"
       >=> describeServerHandler
+      POST >=> route "/xrpc/com.atproto.server.createAccount" >=> createAccountHandler
+      POST >=> route "/xrpc/com.atproto.server.createSession" >=> createSessionHandler
+      POST
+      >=> route "/xrpc/com.atproto.server.refreshSession"
+      >=> refreshSessionHandler
       POST >=> route "/xrpc/com.atproto.repo.createRecord" >=> createRecordHandler
       GET >=> route "/xrpc/com.atproto.repo.getRecord" >=> getRecordHandler
       POST >=> route "/xrpc/com.atproto.repo.putRecord" >=> putRecordHandler

PDSharp/appsettings.json

···
 {
   "PublicUrl": "http://localhost:5000",
-  "DidHost": "did:web:localhost"
+  "DidHost": "did:web:localhost",
+  "JwtSecret": "change-this-secret-in-production-minimum-32-chars"
 }

roadmap.txt

···
 --------------------------------------------------------------------------------
 Milestone H: Account + Sessions
 --------------------------------------------------------------------------------
-- Implement: server.createAccount, server.createSession, refreshSession
-- Password/app-password hashing + JWT issuance
+- [x] Implement: server.createAccount, server.createSession, refreshSession
+- [x] Password/app-password hashing + JWT issuance
 DoD: Authenticate and write records with accessJwt
 --------------------------------------------------------------------------------
 Milestone I: Lexicon Validation + Conformance
···
 - Lexicon validation for writes (app.bsky.* records)
 - Conformance testing: diff CIDs/CARs/signatures vs reference PDS
 DoD: Same inputs → same outputs for repo/sync surfaces
+--------------------------------------------------------------------------------
+Milestone J: Persistence + Backups (Self-hosted PDS)
+--------------------------------------------------------------------------------
+Deliverables:
+  - BackupOps module in Core (scheduler unit / cron / scripts, plus Litestream config)
+Backups (SQLite)
+    [ ] Set PDS_SQLITE_DISABLE_WAL_AUTO_CHECKPOINT=true (Litestream-friendly)
+    [ ] Run a scheduled backup/replication job that:
+        - finds recently updated DBs
+        - backs up /pds/actors/* and PDS-wide DBs
+        - runs on SIGTERM during deploys (avoid missing last writes)
+Backups (Blobs)
+    [ ] Configurable Options (app settings):
+        (A) Disk blobs: include /pds/blocks in backups
+        (B) S3-compatible blobstore: rely on object-store durability
+Guardrails
+    [ ] Uptime check: https://<pds>/xrpc/_health
+    [ ] Alert if “latest backup” is older than N minutes.
+    [ ] Alert on disk pressure for /pds.
+DoD:
+  - You can restore onto a fresh host and pass the P3 verification checklist.
+  - Backups run automatically and are observable (“last successful backup”).
+  - Backup set is explicitly documented (DBs + blobs decision).
 ================================================================================
 PHASE 2: DEPLOYMENT (Self-Host)
 ================================================================================
···
 [x] putRecord + blockstore operational
 [x] CAR export + sync endpoints
 [x] subscribeRepos firehose
-[ ] Authentication (createAccount, createSession)
+[x] Authentication (createAccount, createSession)
 [ ] Lexicon validation
 [ ] Domain + TLS configured
 [ ] PDS deployed and reachable