feat: define persistence contracts and implementations,

* split up server to handler modules

.gitignore

···
 TestResult.xml
 nunit-*.xml
 
-.fake
+.fake
+*.db
+*.db-*

PDSharp.Core/Auth.fs

···
     CreatedAt : DateTimeOffset
   }
 
-  let mutable private accounts : Map<string, Account> = Map.empty
-  let mutable private handleIndex : Map<string, string> = Map.empty
+  /// Interface for account persistence
+  type IAccountStore =
+    abstract member CreateAccount : Account -> Async<Result<unit, string>>
+    abstract member GetAccountByHandle : string -> Async<Account option>
+    abstract member GetAccountByDid : string -> Async<Account option>
 
-  let createAccount (handle : string) (password : string) (email : string option) : Result<Account, string> =
-    if Map.containsKey handle handleIndex then
-      Error "Handle already taken"
-    else
-      let did = $"did:web:{handle}"
+  /// Create a new account
+  let createAccount
+    (store : IAccountStore)
+    (handle : string)
+    (password : string)
+    (email : string option)
+    : Async<Result<Account, string>> =
+    async {
+      let! existingHandle = store.GetAccountByHandle handle
 
-      if Map.containsKey did accounts then
-        Error "Account already exists"
-      else
-        let account = {
-          Did = did
-          Handle = handle
-          PasswordHash = hashPassword password
-          Email = email
-          CreatedAt = DateTimeOffset.UtcNow
-        }
-
-        accounts <- Map.add did account accounts
-        handleIndex <- Map.add handle did handleIndex
-        Ok account
+      match existingHandle with
+      | Some _ -> return Error "Handle already taken"
+      | None ->
+        let did = $"did:web:{handle}"
+        let! existingDid = store.GetAccountByDid did
 
-  /// Get account by handle
-  let getAccountByHandle (handle : string) : Account option =
-    handleIndex
-    |> Map.tryFind handle
-    |> Option.bind (fun did -> Map.tryFind did accounts)
+        match existingDid with
+        | Some _ -> return Error "Account already exists"
+        | None ->
+          let account = {
+            Did = did
+            Handle = handle
+            PasswordHash = hashPassword password
+            Email = email
+            CreatedAt = DateTimeOffset.UtcNow
+          }
 
-  /// Get account by DID
-  let getAccountByDid (did : string) : Account option = Map.tryFind did accounts
+          let! result = store.CreateAccount account
 
-  /// Clear all accounts (for testing)
-  let resetAccounts () =
-    accounts <- Map.empty
-    handleIndex <- Map.empty
+          match result with
+          | Ok() -> return Ok account
+          | Error e -> return Error e
+    }

PDSharp.Core/BlobStore.fs

···
+namespace PDSharp.Core
+
+open System.IO
+open Amazon.S3
+open Amazon.S3.Model
+open PDSharp.Core.Config
+
+/// Interface for binary large object (blob) storage
+type IBlobStore =
+  /// Store a blob by CID
+  abstract member Put : Cid * byte[] -> Async<unit>
+  /// Retrieve a blob by CID
+  abstract member Get : Cid -> Async<byte[] option>
+  /// Check if a blob exists (optional optimization)
+  abstract member Has : Cid -> Async<bool>
+  /// Delete a blob by CID
+  abstract member Delete : Cid -> Async<unit>
+
+module BlobStore =
+
+  /// File-system based blob store
+  type DiskBlobStore(encodedRootPath : string) =
+    let rootPath =
+      if Path.IsPathRooted encodedRootPath then
+        encodedRootPath
+      else
+        Path.Combine(Directory.GetCurrentDirectory(), encodedRootPath)
+
+    do
+      if not (Directory.Exists rootPath) then
+        Directory.CreateDirectory(rootPath) |> ignore
+
+    let getPath (cid : Cid) = Path.Combine(rootPath, cid.ToString())
+
+    interface IBlobStore with
+      member _.Put(cid, data) = async {
+        let path = getPath cid
+
+        if not (File.Exists path) then
+          do! File.WriteAllBytesAsync(path, data) |> Async.AwaitTask
+      }
+
+      member _.Get(cid) = async {
+        let path = getPath cid
+
+        if File.Exists path then
+          let! data = File.ReadAllBytesAsync(path) |> Async.AwaitTask
+          return Some data
+        else
+          return None
+      }
+
+      member _.Has(cid) = async { return File.Exists(getPath cid) }
+
+      member _.Delete(cid) = async {
+        let path = getPath cid
+
+        if File.Exists path then
+          File.Delete path
+      }
+
+  /// S3-based blob store
+  type S3BlobStore(config : S3Config) =
+    let client =
+      let clientConfig =
+        AmazonS3Config(RegionEndpoint = Amazon.RegionEndpoint.GetBySystemName config.Region)
+
+      match config.ServiceUrl with
+      | Some url -> clientConfig.ServiceURL <- url
+      | None -> ()
+
+      clientConfig.ForcePathStyle <- config.ForcePathStyle
+
+      match config.AccessKey, config.SecretKey with
+      | Some access, Some secret -> new AmazonS3Client(access, secret, clientConfig)
+      | _ -> new AmazonS3Client(clientConfig)
+
+    let bucket = config.Bucket
+
+    interface IBlobStore with
+      member _.Put(cid, data) = async {
+        let request = PutObjectRequest()
+        request.BucketName <- bucket
+        request.Key <- cid.ToString()
+        use ms = new MemoryStream(data)
+        request.InputStream <- ms
+        let! _ = client.PutObjectAsync(request) |> Async.AwaitTask
+        ()
+      }
+
+      member _.Get(cid) = async {
+        try
+          let request = GetObjectRequest()
+          request.BucketName <- bucket
+          request.Key <- cid.ToString()
+
+          use! response = client.GetObjectAsync(request) |> Async.AwaitTask
+          use ms = new MemoryStream()
+          do! response.ResponseStream.CopyToAsync(ms) |> Async.AwaitTask
+          return Some(ms.ToArray())
+        with
+        | :? AmazonS3Exception as ex when ex.StatusCode = System.Net.HttpStatusCode.NotFound -> return None
+        | _ -> return None
+      }
+
+      member _.Has(cid) = async {
+        try
+          let request = GetObjectMetadataRequest()
+          request.BucketName <- bucket
+          request.Key <- cid.ToString()
+          let! _ = client.GetObjectMetadataAsync(request) |> Async.AwaitTask
+          return true
+        with
+        | :? AmazonS3Exception as ex when ex.StatusCode = System.Net.HttpStatusCode.NotFound -> return false
+        | _ -> return false
+      }
+
+      member _.Delete(cid) = async {
+        let request = DeleteObjectRequest()
+        request.BucketName <- bucket
+        request.Key <- cid.ToString()
+        let! _ = client.DeleteObjectAsync(request) |> Async.AwaitTask
+        ()
+      }

PDSharp.Core/Config.fs

···
     DidHost : string
     /// HS256 signing key for session tokens
     JwtSecret : string
+    /// Connection string for SQLite
+    SqliteConnectionString : string
+    /// Blob storage configuration
+    BlobStore : BlobStoreConfig
+  }
+
+  and BlobStoreConfig =
+    | Disk of path : string
+    | S3 of S3Config
+
+  and S3Config = {
+    Bucket : string
+    Region : string
+    AccessKey : string option
+    SecretKey : string option
+    ServiceUrl : string option
+    ForcePathStyle : bool
   }

PDSharp.Core/PDSharp.Core.fsproj

···
         <Compile Include="Crypto.fs" />
         <Compile Include="Mst.fs" />
         <Compile Include="BlockStore.fs" />
+        <Compile Include="BlobStore.fs" />
         <Compile Include="Car.fs" />
         <Compile Include="AtUri.fs" />
         <Compile Include="Repository.fs" />
         <Compile Include="Auth.fs" />
+        <Compile Include="SqliteStore.fs" />
         <Compile Include="Firehose.fs" />
         <Compile Include="DidResolver.fs" />
         <Compile Include="Lexicon.fs" />
···
     </ItemGroup>
 
     <ItemGroup>
+      <PackageReference Include="AWSSDK.S3" Version="4.0.16" />
       <PackageReference Include="BouncyCastle.Cryptography" Version="2.6.2" />
+      <PackageReference Include="Dapper" Version="2.1.66" />
+      <PackageReference Include="Microsoft.Data.Sqlite" Version="10.0.1" />
       <PackageReference Include="System.Formats.Cbor" Version="10.0.1" />
     </ItemGroup>
 </Project>

PDSharp.Core/SqliteStore.fs

···
+namespace PDSharp.Core
+
+open System
+open System.IO
+open Microsoft.Data.Sqlite
+open Dapper
+open PDSharp.Core.BlockStore
+open PDSharp.Core.Auth
+open System.Threading.Tasks
+open PDSharp.Core.Config
+
+/// SQLite persistence layer
+module SqliteStore =
+
+  /// Initialize the database schema
+  let initialize (connectionString : string) =
+    use conn = new SqliteConnection(connectionString)
+    conn.Open()
+
+    conn.Execute("PRAGMA journal_mode=WAL;") |> ignore
+    // TODO: fast, slightly less safe. Keep default (FULL) for now.
+    // conn.Execute("PRAGMA synchronous=NORMAL;") |> ignore
+
+    conn.Execute(
+      """
+      CREATE TABLE IF NOT EXISTS blocks (
+        cid TEXT PRIMARY KEY,
+        data BLOB NOT NULL
+      );
+    """
+    )
+    |> ignore
+
+
+    conn.Execute(
+      """
+      CREATE TABLE IF NOT EXISTS accounts (
+        did TEXT PRIMARY KEY,
+        handle TEXT NOT NULL UNIQUE,
+        password_hash TEXT NOT NULL,
+        email TEXT,
+        created_at TEXT NOT NULL
+      );
+    """
+    )
+    |> ignore
+
+    conn.Execute(
+      """
+      CREATE TABLE IF NOT EXISTS repos (
+        did TEXT PRIMARY KEY,
+        rev TEXT NOT NULL,
+        mst_root_cid TEXT NOT NULL,
+        head_cid TEXT,
+        collections_json TEXT -- Just store serialized collection map for now
+      );
+    """
+    )
+    |> ignore
+
+    conn.Execute(
+      """
+        CREATE TABLE IF NOT EXISTS signing_keys (
+            did TEXT PRIMARY KEY,
+            k TEXT NOT NULL -- Hex encoded private key D
+        );
+    """
+    )
+    |> ignore
+
+  /// DTOs for Sqlite Mapping
+  type RepoRow = {
+    did : string
+    rev : string
+    mst_root_cid : string
+    head_cid : string
+    collections_json : string
+  }
+
+  type BlockRow = { cid : string; data : byte[] }
+
+  type IRepoStore =
+    abstract member GetRepo : string -> Async<RepoRow option>
+    abstract member SaveRepo : RepoRow -> Async<unit>
+
+  type SqliteBlockStore(connectionString : string) =
+    interface IBlockStore with
+      member _.Put(data : byte[]) = async {
+        let hash = Crypto.sha256 data
+        let cid = Cid.FromHash hash
+        let cidStr = cid.ToString()
+
+        use conn = new SqliteConnection(connectionString)
+
+        let! _ =
+          conn.ExecuteAsync(
+            "INSERT OR IGNORE INTO blocks (cid, data) VALUES (@cid, @data)",
+            {| cid = cidStr; data = data |}
+          )
+          |> Async.AwaitTask
+
+        return cid
+      }
+
+      member _.Get(cid : Cid) = async {
+        use conn = new SqliteConnection(connectionString)
+
+        let! result =
+          conn.QuerySingleOrDefaultAsync<byte[]>("SELECT data FROM blocks WHERE cid = @cid", {| cid = cid.ToString() |})
+          |> Async.AwaitTask
+
+        if isNull result then return None else return Some result
+      }
+
+      member _.Has(cid : Cid) = async {
+        use conn = new SqliteConnection(connectionString)
+
+        let! count =
+          conn.ExecuteScalarAsync<int>("SELECT COUNT(1) FROM blocks WHERE cid = @cid", {| cid = cid.ToString() |})
+          |> Async.AwaitTask
+
+        return count > 0
+      }
+
+      member _.GetAllCidsAndData() = async {
+        use conn = new SqliteConnection(connectionString)
+        let! rows = conn.QueryAsync<BlockRow>("SELECT cid, data FROM blocks") |> Async.AwaitTask
+
+        return
+          rows
+          |> Seq.map (fun r -> (r.cid, r.data))
+          |> Seq.choose (fun (cidStr, data) ->
+            match Cid.TryParse cidStr with
+            | Some c -> Some(c, data)
+            | None -> None)
+          |> Seq.toList
+      }
+
+  type SqliteAccountStore(connectionString : string) =
+    interface IAccountStore with
+      member _.CreateAccount(account : Account) = async {
+        use conn = new SqliteConnection(connectionString)
+
+        try
+          let! _ =
+            conn.ExecuteAsync(
+              """
+                INSERT INTO accounts (did, handle, password_hash, email, created_at)
+                VALUES (@Did, @Handle, @PasswordHash, @Email, @CreatedAt)
+            """,
+              account
+            )
+            |> Async.AwaitTask
+
+          return Ok()
+        with
+        | :? SqliteException as ex when ex.SqliteErrorCode = 19 -> // Constraint violation
+          return Error "Account already exists (handle or DID taken)"
+        | ex -> return Error ex.Message
+      }
+
+      member _.GetAccountByHandle(handle : string) = async {
+        use conn = new SqliteConnection(connectionString)
+
+        let! result =
+          conn.QuerySingleOrDefaultAsync<Account>(
+            "SELECT * FROM accounts WHERE handle = @handle",
+            {| handle = handle |}
+          )
+          |> Async.AwaitTask
+
+        if isNull (box result) then
+          return None
+        else
+          return Some result
+      }
+
+      member _.GetAccountByDid(did : string) = async {
+        use conn = new SqliteConnection(connectionString)
+
+        let! result =
+          conn.QuerySingleOrDefaultAsync<Account>("SELECT * FROM accounts WHERE did = @did", {| did = did |})
+          |> Async.AwaitTask
+
+        if isNull (box result) then
+          return None
+        else
+          return Some result
+      }
+
+  type SqliteRepoStore(connectionString : string) =
+    interface IRepoStore with
+      member _.GetRepo(did : string) : Async<RepoRow option> = async {
+        use conn = new SqliteConnection(connectionString)
+
+        let! result =
+          conn.QuerySingleOrDefaultAsync<RepoRow>("SELECT * FROM repos WHERE did = @did", {| did = did |})
+          |> Async.AwaitTask
+
+        if isNull (box result) then
+          return None
+        else
+          return Some result
+      }
+
+      member _.SaveRepo(repo : RepoRow) : Async<unit> = async {
+        use conn = new SqliteConnection(connectionString)
+
+        let! _ =
+          conn.ExecuteAsync(
+            """
+                INSERT INTO repos (did, rev, mst_root_cid, head_cid, collections_json)
+                VALUES (@did, @rev, @mst_root_cid, @head_cid, @collections_json)
+                ON CONFLICT(did) DO UPDATE SET
+                    rev = @rev,
+                    mst_root_cid = @mst_root_cid,
+                    head_cid = @head_cid,
+                    collections_json = @collections_json
+            """,
+            repo
+          )
+          |> Async.AwaitTask
+
+        ()
+      }

PDSharp.Tests/Auth.Tests.fs

···
 
 open Xunit
 open PDSharp.Core.Auth
+open System
+open System.Collections.Concurrent
+
+/// Mock in-memory store for testing
+type VolatileAccountStore() =
+  let accounts = ConcurrentDictionary<string, Account>()
+  let handles = ConcurrentDictionary<string, string>()
+
+  interface IAccountStore with
+    member _.CreateAccount(account : Account) = async {
+      if handles.ContainsKey(account.Handle) then
+        return Error "Handle already taken"
+      elif accounts.ContainsKey(account.Did) then
+        return Error "Account already exists"
+      else
+        accounts.TryAdd(account.Did, account) |> ignore
+        handles.TryAdd(account.Handle, account.Did) |> ignore
+        return Ok()
+    }
+
+    member _.GetAccountByHandle(handle : string) = async {
+      match handles.TryGetValue(handle) with
+      | true, did ->
+        match accounts.TryGetValue(did) with
+        | true, acc -> return Some acc
+        | _ -> return None
+      | _ -> return None
+    }
+
+    member _.GetAccountByDid(did : string) = async {
+      match accounts.TryGetValue(did) with
+      | true, acc -> return Some acc
+      | _ -> return None
+    }
 
 [<Fact>]
 let ``Password hashing produces salt$hash format`` () =
···
 
 [<Fact>]
 let ``Account creation and lookup by handle`` () =
-  resetAccounts ()
+  let store = VolatileAccountStore()
 
-  match createAccount "test.user" "password123" (Some "[e-mail]") with
+  match
+    createAccount store "test.user" "password123" (Some "[e-mail]")
+    |> Async.RunSynchronously
+  with
   | Error msg -> Assert.Fail msg
   | Ok account ->
     Assert.Equal("test.user", account.Handle)
     Assert.Equal("did:web:test.user", account.Did)
     Assert.Equal(Some "[e-mail]", account.Email)
 
-    match getAccountByHandle "test.user" with
+    let found =
+      (store :> IAccountStore).GetAccountByHandle "test.user"
+      |> Async.RunSynchronously
+
+    match found with
     | None -> Assert.Fail "Account should be found"
-    | Some found -> Assert.Equal(account.Did, found.Did)
+    | Some foundAcc -> Assert.Equal(account.Did, foundAcc.Did)
 
 [<Fact>]
 let ``Account creation fails for duplicate handle`` () =
-  resetAccounts ()
+  let store = VolatileAccountStore()
 
-  createAccount "duplicate.user" "password" None |> ignore
+  createAccount store "duplicate.user" "password" None
+  |> Async.RunSynchronously
+  |> ignore
 
-  match createAccount "duplicate.user" "password2" None with
+  match createAccount store "duplicate.user" "password2" None |> Async.RunSynchronously with
   | Error msg -> Assert.Contains("already", msg.ToLower())
   | Ok _ -> Assert.Fail "Should fail for duplicate handle"
 
 [<Fact>]
 let ``Account lookup by DID`` () =
-  resetAccounts ()
+  let store = VolatileAccountStore()
 
-  match createAccount "did.user" "password123" None with
+  match createAccount store "did.user" "password123" None |> Async.RunSynchronously with
   | Error msg -> Assert.Fail msg
   | Ok account ->
-    match getAccountByDid account.Did with
+    let found =
+      (store :> IAccountStore).GetAccountByDid account.Did |> Async.RunSynchronously
+
+    match found with
     | None -> Assert.Fail "Account should be found by DID"
-    | Some found -> Assert.Equal(account.Handle, found.Handle)
+    | Some foundAcc -> Assert.Equal(account.Handle, foundAcc.Handle)

PDSharp.Tests/Handlers.Tests.fs

···
+module Handlers.Tests
+
+open System
+open System.IO
+open System.Text
+open System.Text.Json
+open System.Threading.Tasks
+open System.Collections.Generic
+open Xunit
+open Microsoft.AspNetCore.Http
+open Giraffe
+open PDSharp.Core.Config
+open PDSharp.Core.BlockStore
+open PDSharp.Core
+open PDSharp.Core.SqliteStore
+open PDSharp.Core.Auth
+
+type MockAccountStore() =
+  let mutable accounts = Map.empty<string, Account>
+
+  interface IAccountStore with
+    member _.CreateAccount(account) = async {
+      if accounts.ContainsKey account.Did then
+        return Error "Exists"
+      else
+        accounts <- accounts.Add(account.Did, account)
+        return Ok()
+    }
+
+    member _.GetAccountByHandle(handle) = async {
+      return accounts |> Map.tryPick (fun _ v -> if v.Handle = handle then Some v else None)
+    }
+
+    member _.GetAccountByDid did = async { return accounts.TryFind did }
+
+type MockBlockStore() =
+  let mutable blocks = Map.empty<string, byte[]>
+
+  interface IBlockStore with
+    member _.Put(data) = async {
+      let hash = Crypto.sha256 data
+      let cid = Cid.FromHash hash
+      blocks <- blocks.Add(cid.ToString(), data)
+      return cid
+    }
+
+    member _.Get cid = async { return blocks.TryFind(cid.ToString()) }
+    member _.Has cid = async { return blocks.ContainsKey(cid.ToString()) }
+
+    member _.GetAllCidsAndData() = async {
+      return
+        blocks
+        |> Map.toList
+        |> List.choose (fun (k, v) -> Cid.TryParse k |> Option.map (fun c -> (c, v)))
+    }
+
+type MockRepoStore() =
+  let mutable repos = Map.empty<string, RepoRow>
+
+  interface IRepoStore with
+    member _.GetRepo(did) = async { return repos.TryFind did }
+    member _.SaveRepo(repo) = async { repos <- repos.Add(repo.did, repo) }
+
+type MockJsonSerializer() =
+  interface Giraffe.Json.ISerializer with
+    member _.SerializeToString x = JsonSerializer.Serialize x
+    member _.SerializeToBytes x = JsonSerializer.SerializeToUtf8Bytes x
+    member _.Deserialize<'T>(json : string) = JsonSerializer.Deserialize<'T> json
+
+    member _.Deserialize<'T>(bytes : byte[]) =
+      JsonSerializer.Deserialize<'T>(ReadOnlySpan(bytes))
+
+    member _.DeserializeAsync<'T>(stream : Stream) = task { return! JsonSerializer.DeserializeAsync<'T>(stream) }
+
+    member _.SerializeToStreamAsync<'T> (x : 'T) (stream : Stream) = task {
+      do! JsonSerializer.SerializeAsync<'T>(stream, x)
+    }
+
+let mockContext (services : (Type * obj) list) (body : string) (query : Map<string, string>) =
+  let ctx = new DefaultHttpContext()
+  let serializer = MockJsonSerializer()
+  let allServices = (typeof<Giraffe.Json.ISerializer>, box serializer) :: services
+
+  let sp =
+    { new IServiceProvider with
+        member _.GetService(serviceType) =
+          allServices
+          |> List.tryPick (fun (t, s) -> if t = serviceType then Some s else None)
+          |> Option.toObj
+    }
+
+  ctx.RequestServices <- sp
+
+  if not (String.IsNullOrEmpty body) then
+    let stream = new MemoryStream(Encoding.UTF8.GetBytes(body))
+    ctx.Request.Body <- stream
+    ctx.Request.ContentLength <- stream.Length
+
+  if not query.IsEmpty then
+    let dict = Dictionary<string, Microsoft.Extensions.Primitives.StringValues>()
+
+    for kvp in query do
+      dict.Add(kvp.Key, Microsoft.Extensions.Primitives.StringValues(kvp.Value))
+
+    ctx.Request.Query <- QueryCollection dict
+
+  ctx
+
+[<Fact>]
+let ``Auth.createAccountHandler creates account successfully`` () = task {
+  let accountStore = MockAccountStore()
+
+  let config = {
+    PublicUrl = "https://pds.example.com"
+    DidHost = "did:web:pds.example.com"
+    JwtSecret = "secret"
+    SqliteConnectionString = ""
+    BlobStore = Disk "blobs"
+  }
+
+  let services = [ typeof<AppConfig>, box config; typeof<IAccountStore>, box accountStore ]
+
+  let req : PDSharp.Handlers.Auth.CreateAccountRequest = {
+    handle = "alice.test"
+    email = Some "[e-mail]"
+    password = "password123"
+    inviteCode = None
+  }
+
+  let body = JsonSerializer.Serialize req
+  let ctx = mockContext services body Map.empty
+  let next : HttpFunc = fun _ -> Task.FromResult(None)
+
+  let! result = PDSharp.Handlers.Auth.createAccountHandler next ctx
+
+  Assert.Equal(200, ctx.Response.StatusCode)
+
+  let store = accountStore :> IAccountStore
+  let! accountOpt = store.GetAccountByHandle "alice.test"
+  Assert.True accountOpt.IsSome
+}
+
+[<Fact>]
+let ``Server.indexHandler returns HTML`` () = task {
+  let ctx = new DefaultHttpContext()
+  let next : HttpFunc = fun _ -> Task.FromResult(None)
+
+  let! result = PDSharp.Handlers.Server.indexHandler next ctx
+
+  Assert.Equal(200, ctx.Response.StatusCode)
+  Assert.Equal("text/html", ctx.Response.ContentType)
+}
+
+[<Fact>]
+let ``Repo.createRecordHandler invalid collection returns error`` () = task {
+  let blockStore = MockBlockStore()
+  let repoStore = MockRepoStore()
+  let keyStore = PDSharp.Handlers.SigningKeyStore()
+  let firehose = PDSharp.Handlers.FirehoseState()
+
+  let services = [
+    typeof<IBlockStore>, box blockStore
+    typeof<IRepoStore>, box repoStore
+    typeof<PDSharp.Handlers.SigningKeyStore>, box keyStore
+    typeof<PDSharp.Handlers.FirehoseState>, box firehose
+  ]
+
+  let record = JsonSerializer.Deserialize<JsonElement> "{\"text\":\"hello\"}"
+
+  let req : PDSharp.Handlers.Repo.CreateRecordRequest = {
+    repo = "did:web:alice.test"
+    collection = "app.bsky.feed.post"
+    record = record
+    rkey = None
+  }
+
+  let body = JsonSerializer.Serialize(req)
+
+  let ctx = mockContext services body Map.empty
+  let next : HttpFunc = fun _ -> Task.FromResult(None)
+
+  let! result = PDSharp.Handlers.Repo.createRecordHandler next ctx
+
+  Assert.Equal(400, ctx.Response.StatusCode)
+}

PDSharp.Tests/PDSharp.Tests.fsproj

···
     <Compile Include="Firehose.Tests.fs" />
     <Compile Include="Auth.Tests.fs" />
     <Compile Include="Conformance.Tests.fs" />
+    <Compile Include="Handlers.Tests.fs" />
     <Compile Include="Program.fs" />
   </ItemGroup>
 

PDSharp.Tests/Tests.fs

···
     PublicUrl = "https://example.com"
     DidHost = "did:web:example.com"
     JwtSecret = "test-secret-key-for-testing-only"
+    SqliteConnectionString = "Data Source=:memory:"
+    BlobStore = Disk "blobs"
   }
 
   Assert.Equal("did:web:example.com", config.DidHost)

PDSharp/Handlers/Auth.fs

···
+namespace PDSharp.Handlers
+
+open System
+open System.Text.Json
+open Microsoft.AspNetCore.Http
+open Giraffe
+open PDSharp.Core.Config
+open PDSharp.Core.Auth
+open PDSharp.Handlers
+
+module Auth =
+  [<CLIMutable>]
+  type CreateAccountRequest = {
+    handle : string
+    email : string option
+    password : string
+    inviteCode : string option
+  }
+
+  [<CLIMutable>]
+  type CreateSessionRequest = { identifier : string; password : string }
+
+  type SessionResponse = {
+    accessJwt : string
+    refreshJwt : string
+    handle : string
+    did : string
+    email : string option
+  }
+
+  let private extractBearerToken (ctx : HttpContext) : string option =
+    match ctx.Request.Headers.TryGetValue("Authorization") with
+    | true, values ->
+      let header = values.ToString()
+
+      if header.StartsWith("Bearer ", StringComparison.OrdinalIgnoreCase) then
+        Some(header.Substring(7))
+      else
+        None
+    | _ -> None
+
+  let createAccountHandler : HttpHandler =
+    fun next ctx -> task {
+      let config = ctx.GetService<AppConfig>()
+      let accountStore = ctx.GetService<IAccountStore>()
+      let! body = ctx.ReadBodyFromRequestAsync()
+
+      let request =
+        JsonSerializer.Deserialize<CreateAccountRequest>(
+          body,
+          JsonSerializerOptions(PropertyNameCaseInsensitive = true)
+        )
+
+      if
+        String.IsNullOrWhiteSpace(request.handle)
+        || String.IsNullOrWhiteSpace(request.password)
+      then
+        ctx.SetStatusCode 400
+
+        return!
+          json
+            {
+              error = "InvalidRequest"
+              message = "handle and password are required"
+            }
+            next
+            ctx
+      else
+        match! PDSharp.Core.Auth.createAccount accountStore request.handle request.password request.email with
+        | Result.Error msg ->
+          ctx.SetStatusCode 400
+          return! json { error = "AccountExists"; message = msg } next ctx
+        | Result.Ok(account : Account) ->
+          let accessJwt = PDSharp.Core.Auth.createAccessToken config.JwtSecret account.Did
+          let refreshJwt = PDSharp.Core.Auth.createRefreshToken config.JwtSecret account.Did
+          ctx.SetStatusCode 200
+
+          return!
+            json
+              {
+                accessJwt = accessJwt
+                refreshJwt = refreshJwt
+                handle = account.Handle
+                did = account.Did
+                email = account.Email
+              }
+              next
+              ctx
+    }
+
+  let createSessionHandler : HttpHandler =
+    fun next ctx -> task {
+      let config = ctx.GetService<AppConfig>()
+      let accountStore = ctx.GetService<IAccountStore>()
+      let! body = ctx.ReadBodyFromRequestAsync()
+
+      let request =
+        JsonSerializer.Deserialize<CreateSessionRequest>(
+          body,
+          JsonSerializerOptions(PropertyNameCaseInsensitive = true)
+        )
+
+      if
+        String.IsNullOrWhiteSpace(request.identifier)
+        || String.IsNullOrWhiteSpace(request.password)
+      then
+        ctx.SetStatusCode 400
+
+        return!
+          json
+            {
+              error = "InvalidRequest"
+              message = "identifier and password are required"
+            }
+            next
+            ctx
+      else
+        let! accountOpt =
+          if request.identifier.StartsWith("did:") then
+            accountStore.GetAccountByDid request.identifier
+          else
+            accountStore.GetAccountByHandle request.identifier
+
+        match accountOpt with
+        | None ->
+          ctx.SetStatusCode 401
+
+          return!
+            json
+              {
+                error = "AuthenticationRequired"
+                message = "Invalid identifier or password"
+              }
+              next
+              ctx
+        | Some(account : Account) ->
+          if not (PDSharp.Core.Auth.verifyPassword request.password account.PasswordHash) then
+            ctx.SetStatusCode 401
+
+            return!
+              json
+                {
+                  error = "AuthenticationRequired"
+                  message = "Invalid identifier or password"
+                }
+                next
+                ctx
+          else
+            let accessJwt = PDSharp.Core.Auth.createAccessToken config.JwtSecret account.Did
+            let refreshJwt = PDSharp.Core.Auth.createRefreshToken config.JwtSecret account.Did
+            ctx.SetStatusCode 200
+
+            return!
+              json
+                {
+                  accessJwt = accessJwt
+                  refreshJwt = refreshJwt
+                  handle = account.Handle
+                  did = account.Did
+                  email = account.Email
+                }
+                next
+                ctx
+    }
+
+  let refreshSessionHandler : HttpHandler =
+    fun next ctx -> task {
+      let config = ctx.GetService<AppConfig>()
+      let accountStore = ctx.GetService<IAccountStore>()
+
+      match extractBearerToken ctx with
+      | None ->
+        ctx.SetStatusCode 401
+
+        return!
+          json
+            {
+              error = "AuthenticationRequired"
+              message = "Missing or invalid Authorization header"
+            }
+            next
+            ctx
+      | Some token ->
+        match PDSharp.Core.Auth.validateToken config.JwtSecret token with
+        | PDSharp.Core.Auth.Invalid reason ->
+          ctx.SetStatusCode 401
+          return! json { error = "ExpiredToken"; message = reason } next ctx
+        | PDSharp.Core.Auth.Valid(did, tokenType, _) ->
+          if tokenType <> PDSharp.Core.Auth.Refresh then
+            ctx.SetStatusCode 400
+
+            return!
+              json
+                {
+                  error = "InvalidRequest"
+                  message = "Refresh token required"
+                }
+                next
+                ctx
+          else
+            match! accountStore.GetAccountByDid did with
+            | None ->
+              ctx.SetStatusCode 401
+              return! json { error = "AccountNotFound"; message = "Account not found" } next ctx
+            | Some account ->
+              let accessJwt = PDSharp.Core.Auth.createAccessToken config.JwtSecret account.Did
+              let refreshJwt = PDSharp.Core.Auth.createRefreshToken config.JwtSecret account.Did
+              ctx.SetStatusCode 200
+
+              return!
+                json
+                  {
+                    accessJwt = accessJwt
+                    refreshJwt = refreshJwt
+                    handle = account.Handle
+                    did = account.Did
+                    email = account.Email
+                  }
+                  next
+                  ctx
+    }

PDSharp/Handlers/Common.fs

···
+namespace PDSharp.Handlers
+
+open System
+open System.Text.Json
+open System.Collections.Concurrent
+open System.Net.WebSockets
+open PDSharp.Core
+open PDSharp.Core.Models
+open PDSharp.Core.BlockStore
+open PDSharp.Core.Repository
+open PDSharp.Core.Mst
+open PDSharp.Core.SqliteStore
+open PDSharp.Core.Crypto
+open PDSharp.Core.Firehose
+
+/// Repo state per DID: MST root, collections, current rev, head commit CID
+type RepoData = {
+  Did : string
+  Head : Cid option
+  Mst : Mst.MstNode
+  Collections : Map<string, string>
+}
+
+/// Manages active Firehose WebSocket subscribers
+type FirehoseState() =
+  member val Subscribers = ConcurrentDictionary<string, WebSocket>() with get
+
+/// Simple in-memory key store (TODO: Persist)
+type SigningKeyStore() =
+  let mutable keys : Map<string, EcKeyPair> = Map.empty
+  let lockObj = obj ()
+
+  member _.GetOrCreateKey(did : string) =
+    lock lockObj (fun () ->
+      match Map.tryFind did keys with
+      | Some k -> k
+      | None ->
+        let k = Crypto.generateKey P256
+        keys <- Map.add did k keys
+        k)
+
+[<CLIMutable>]
+type ErrorResponse = { error : string; message : string }
+
+module Persistence =
+  let nodeLoader (blockStore : IBlockStore) (cid : Cid) = async {
+    let! data = blockStore.Get cid
+    return data |> Option.map Mst.deserialize
+  }
+
+  let nodePersister (blockStore : IBlockStore) (node : MstNode) = async {
+    let bytes = Mst.serialize node
+    return! blockStore.Put bytes
+  }
+
+  let loadRepo (repoStore : IRepoStore) (blockStore : IBlockStore) (did : string) : Async<RepoData option> = async {
+    let! rowOpt = repoStore.GetRepo did
+
+    match rowOpt with
+    | None -> return None
+    | Some row ->
+      let! mstNode = async {
+        if String.IsNullOrEmpty row.mst_root_cid then
+          return None
+        else
+          match Cid.TryParse row.mst_root_cid with
+          | None -> return None
+          | Some rootCid -> return! nodeLoader blockStore rootCid
+      }
+
+      let mst = mstNode |> Option.defaultValue { Left = None; Entries = [] }
+
+      let collections =
+        try
+          JsonSerializer.Deserialize<Map<string, string>>(row.collections_json)
+        with _ ->
+          Map.empty
+
+      let head =
+        if String.IsNullOrEmpty row.head_cid then
+          None
+        else
+          Cid.TryParse row.head_cid
+
+      return
+        Some {
+          Did = did
+          Head = head
+          Mst = mst
+          Collections = collections
+        }
+  }
+
+  let saveRepo (repoStore : IRepoStore) (blockStore : IBlockStore) (repo : RepoData) (rev : string) : Async<unit> = async {
+    let! rootCid = nodePersister blockStore repo.Mst
+
+    let row : RepoRow = {
+      did = repo.Did
+      rev = rev
+      mst_root_cid = rootCid.ToString()
+      head_cid =
+        (match repo.Head with
+         | Some c -> c.ToString()
+         | None -> "")
+      collections_json = JsonSerializer.Serialize repo.Collections
+    }
+
+    do! repoStore.SaveRepo row
+  }
+
+  let signAndStoreCommit
+    (blockStore : IBlockStore)
+    (keyStore : SigningKeyStore)
+    (did : string)
+    (mstRootCid : Cid)
+    (rev : string)
+    (prev : Cid option)
+    =
+    async {
+      let key = keyStore.GetOrCreateKey did
+
+      let unsigned : UnsignedCommit = {
+        Did = did
+        Version = 3
+        Data = mstRootCid
+        Rev = rev
+        Prev = prev
+      }
+
+      let signed = signCommit key unsigned
+      let commitBytes = serializeCommit signed
+      let! commitCid = blockStore.Put(commitBytes)
+      return signed, commitCid
+    }
+
+  let broadcastEvent (firehose : FirehoseState) (event : CommitEvent) =
+    let eventBytes = Firehose.encodeEvent event
+    let segment = ArraySegment<byte>(eventBytes)
+
+    for kvp in firehose.Subscribers do
+      let ws = kvp.Value
+
+      if ws.State = WebSocketState.Open then
+        try
+          ws.SendAsync(segment, WebSocketMessageType.Binary, true, System.Threading.CancellationToken.None)
+          |> Async.AwaitTask
+          |> Async.RunSynchronously
+        with _ ->
+          firehose.Subscribers.TryRemove(kvp.Key) |> ignore

PDSharp/Handlers/Repo.fs

···
+namespace PDSharp.Handlers
+
+open System
+open System.Text
+open System.Text.Json
+open Microsoft.AspNetCore.Http
+open Giraffe
+open PDSharp.Core
+open PDSharp.Core.Models
+open PDSharp.Core.BlockStore
+open PDSharp.Core.Repository
+open PDSharp.Core.Mst
+open PDSharp.Core.Lexicon
+open PDSharp.Core.Car
+open PDSharp.Core.Firehose
+open PDSharp.Core.SqliteStore
+open PDSharp.Handlers
+
+module Repo =
+  [<CLIMutable>]
+  type CreateRecordRequest = {
+    repo : string
+    collection : string
+    record : JsonElement
+    rkey : string option
+  }
+
+  [<CLIMutable>]
+  type CreateRecordResponse = {
+    uri : string
+    cid : string
+    commit : {| rev : string; cid : string |}
+  }
+
+  [<CLIMutable>]
+  type GetRecordResponse = { uri : string; cid : string; value : JsonElement }
+
+  let createRecordHandler : HttpHandler =
+    fun next ctx -> task {
+      let blockStore = ctx.GetService<IBlockStore>()
+      let repoStore = ctx.GetService<IRepoStore>()
+      let keyStore = ctx.GetService<SigningKeyStore>()
+      let firehose = ctx.GetService<FirehoseState>()
+
+      let! body = ctx.ReadBodyFromRequestAsync()
+
+      let request =
+        JsonSerializer.Deserialize<CreateRecordRequest>(body, JsonSerializerOptions(PropertyNameCaseInsensitive = true))
+
+      match Lexicon.validate request.collection request.record with
+      | Lexicon.Error msg ->
+        ctx.SetStatusCode 400
+        return! json { error = "InvalidRequest"; message = msg } next ctx
+      | Lexicon.Ok ->
+        let did = request.repo
+
+        let rkey =
+          match request.rkey with
+          | Some r when not (String.IsNullOrWhiteSpace r) -> r
+          | _ -> Tid.generate ()
+
+        let recordJson = request.record.GetRawText()
+        let recordBytes = Encoding.UTF8.GetBytes(recordJson)
+        let! recordCid = blockStore.Put(recordBytes)
+
+        let! existingRepoOpt = Persistence.loadRepo repoStore blockStore did
+
+        let repoData =
+          match existingRepoOpt with
+          | Some r -> r
+          | None -> {
+              Did = did
+              Head = None
+              Mst = { Left = None; Entries = [] }
+              Collections = Map.empty
+            }
+
+        let mstKey = $"{request.collection}/{rkey}"
+        let loader = Persistence.nodeLoader blockStore
+        let persister = Persistence.nodePersister blockStore
+
+        let! newMstRoot = Mst.put loader persister repoData.Mst mstKey recordCid ""
+
+        let newRev = Tid.generate ()
+        let! mstRootCid = persister newMstRoot
+
+        let! (_, commitCid) = Persistence.signAndStoreCommit blockStore keyStore did mstRootCid newRev repoData.Head
+
+        let updatedRepo = {
+          Did = did
+          Mst = newMstRoot
+          Collections = Map.empty
+          Head = Some commitCid
+        }
+
+        do! Persistence.saveRepo repoStore blockStore updatedRepo newRev
+
+        let carBytes = Car.createCar [ commitCid ] [ (recordCid, recordBytes) ]
+        let event = Firehose.createCommitEvent did newRev commitCid carBytes
+        Persistence.broadcastEvent firehose event
+
+        let uri = $"at://{did}/{request.collection}/{rkey}"
+        ctx.SetStatusCode 200
+
+        return!
+          json
+            {|
+              uri = uri
+              cid = recordCid.ToString()
+              commit = {| rev = newRev; cid = commitCid.ToString() |}
+            |}
+            next
+            ctx
+    }
+
+  let getRecordHandler : HttpHandler =
+    fun next ctx -> task {
+      let repoStore = ctx.GetService<IRepoStore>()
+      let blockStore = ctx.GetService<IBlockStore>()
+
+      let repo = ctx.Request.Query.["repo"].ToString()
+      let collection = ctx.Request.Query.["collection"].ToString()
+      let rkey = ctx.Request.Query.["rkey"].ToString()
+
+      if
+        String.IsNullOrWhiteSpace(repo)
+        || String.IsNullOrWhiteSpace(collection)
+        || String.IsNullOrWhiteSpace(rkey)
+      then
+        ctx.SetStatusCode 400
+
+        return!
+          json
+            {
+              error = "InvalidRequest"
+              message = "Missing required params"
+            }
+            next
+            ctx
+      else
+        let! repoOpt = Persistence.loadRepo repoStore blockStore repo
+
+        match repoOpt with
+        | None ->
+          ctx.SetStatusCode 404
+
+          return!
+            json
+              {
+                error = "RepoNotFound"
+                message = $"Repository not found: {repo}"
+              }
+              next
+              ctx
+        | Some repoData ->
+          let mstKey = $"{collection}/{rkey}"
+          let loader = Persistence.nodeLoader blockStore
+          let! cidOpt = Mst.get loader repoData.Mst mstKey ""
+
+          match cidOpt with
+          | None ->
+            ctx.SetStatusCode 404
+            return! json { error = "RecordNotFound"; message = "Record not found" } next ctx
+          | Some recordCid ->
+            let! recordBytesOpt = blockStore.Get(recordCid)
+
+            match recordBytesOpt with
+            | None ->
+              ctx.SetStatusCode 500
+              return! json { error = "InternalError"; message = "Block missing" } next ctx
+            | Some recordBytes ->
+              let recordJson = Encoding.UTF8.GetString(recordBytes)
+              let uri = $"at://{repo}/{collection}/{rkey}"
+              let valueElement = JsonSerializer.Deserialize<JsonElement>(recordJson)
+              ctx.SetStatusCode 200
+
+              return!
+                json
+                  {|
+                    uri = uri
+                    cid = recordCid.ToString()
+                    value = valueElement
+                  |}
+                  next
+                  ctx
+    }
+
+  let putRecordHandler : HttpHandler =
+    fun next ctx -> task {
+      let blockStore = ctx.GetService<IBlockStore>()
+      let repoStore = ctx.GetService<IRepoStore>()
+      let keyStore = ctx.GetService<SigningKeyStore>()
+      let firehose = ctx.GetService<FirehoseState>()
+
+      let! body = ctx.ReadBodyFromRequestAsync()
+
+      let request =
+        JsonSerializer.Deserialize<CreateRecordRequest>(body, JsonSerializerOptions(PropertyNameCaseInsensitive = true))
+
+      match Lexicon.validate request.collection request.record with
+      | Lexicon.Error msg ->
+        ctx.SetStatusCode 400
+        return! json { error = "InvalidRequest"; message = msg } next ctx
+      | Lexicon.Ok ->
+        match request.rkey with
+        | Some r when not (String.IsNullOrWhiteSpace r) ->
+          let did = request.repo
+          let recordJson = request.record.GetRawText()
+          let recordBytes = Encoding.UTF8.GetBytes(recordJson)
+          let! recordCid = blockStore.Put(recordBytes)
+
+          let! existingRepoOpt = Persistence.loadRepo repoStore blockStore did
+
+          let repoData =
+            match existingRepoOpt with
+            | Some r -> r
+            | None -> {
+                Did = did
+                Head = None
+                Mst = { Left = None; Entries = [] }
+                Collections = Map.empty
+              }
+
+          let mstKey = $"{request.collection}/{r}"
+          let loader = Persistence.nodeLoader blockStore
+          let persister = Persistence.nodePersister blockStore
+
+          let! newMstRoot = Mst.put loader persister repoData.Mst mstKey recordCid ""
+          let! mstRootCid = persister newMstRoot
+
+          let newRev = Tid.generate ()
+          let! (_, commitCid) = Persistence.signAndStoreCommit blockStore keyStore did mstRootCid newRev repoData.Head
+
+          let updatedRepo = {
+            Did = did
+            Mst = newMstRoot
+            Collections = Map.empty
+            Head = Some commitCid
+          }
+
+          do! Persistence.saveRepo repoStore blockStore updatedRepo newRev
+
+          let carBytes = Car.createCar [ commitCid ] [ (recordCid, recordBytes) ]
+          let event = Firehose.createCommitEvent did newRev commitCid carBytes
+          Persistence.broadcastEvent firehose event
+
+          ctx.SetStatusCode 200
+
+          return!
+            json
+              {|
+                uri = $"at://{did}/{request.collection}/{r}"
+                cid = recordCid.ToString()
+                commit = {| rev = newRev; cid = commitCid.ToString() |}
+              |}
+              next
+              ctx
+        | _ ->
+          ctx.SetStatusCode 400
+          return! json { error = "InvalidRequest"; message = "rkey is required" } next ctx
+    }

PDSharp/Handlers/Server.fs

···
+namespace PDSharp.Handlers
+
+open Microsoft.AspNetCore.Http
+open Giraffe
+open PDSharp.Core.Config
+
+// =========================================
+// Server & Meta Handlers
+// =========================================
+
+module Server =
+  [<CLIMutable>]
+  type DescribeServerResponse = {
+    availableUserDomains : string list
+    did : string
+    inviteCodeRequired : bool
+  }
+
+  let describeServerHandler : HttpHandler =
+    fun next ctx ->
+      let config = ctx.GetService<AppConfig>()
+
+      let response = {
+        availableUserDomains = []
+        did = config.DidHost
+        inviteCodeRequired = true
+      }
+
+      json response next ctx
+
+  let indexHandler : HttpHandler =
+    fun next ctx ->
+      let html =
+        """<html>
+  <head><title>PDSharp</title></head>
+  <body>
+    <pre>
+        888                             888                          8888888888   888  888
+        888                             888                          888          888  888
+        888                             888                          888        888888888888
+8888b.  888888 88888b.  888d888 .d88b.  888888 .d88b.        88      8888888      888  888
+    "88b 888    888 "88b 888P"  d88""88b 888   d88""88b    888888    888          888  888
+.d888888 888    888  888 888    888  888 888   888  888      88      888        888888888888
+888  888 Y88b.  888 d88P 888    Y88..88P Y88b. Y88..88P              888          888  888
+"Y888888  "Y888 88888P"  888     "Y88P"   "Y888 "Y88P"               888          888  888
+                888
+                888
+                888
+
+
+This is an AT Protocol Personal Data Server (aka, an atproto PDS)
+
+Most API routes are under /xrpc/
+
+         Code: https://github.com/bluesky-social/atproto
+               https://github.com/stormlightlabs/PDSharp
+               https://tangled.org/desertthunder.dev/PDSharp
+    Self-Host: https://github.com/bluesky-social/pds
+    Protocol:  https://atproto.com
+    </pre>
+  </body>
+</html>"""
+
+      ctx.SetContentType "text/html"
+      ctx.SetStatusCode 200
+      ctx.WriteStringAsync html

PDSharp/Handlers/Sync.fs

···
+namespace PDSharp.Handlers
+
+open System
+open System.Threading.Tasks
+open System.Net.WebSockets
+open Microsoft.AspNetCore.Http
+open Giraffe
+open PDSharp.Core
+open PDSharp.Core.Models
+open PDSharp.Core.BlockStore
+open PDSharp.Core.Repository
+open PDSharp.Core.Car
+open PDSharp.Core.BlobStore
+open PDSharp.Core.SqliteStore
+open PDSharp.Handlers
+
+module Sync =
+  let getRepoHandler : HttpHandler =
+    fun next ctx -> task {
+      let repoStore = ctx.GetService<IRepoStore>()
+      let blockStore = ctx.GetService<IBlockStore>()
+      let did = ctx.Request.Query.["did"].ToString()
+
+      if String.IsNullOrWhiteSpace(did) then
+        ctx.SetStatusCode 400
+        return! json { error = "InvalidRequest"; message = "Missing did" } next ctx
+      else
+        let! repoOpt = Persistence.loadRepo repoStore blockStore did
+
+        match repoOpt with
+        | None ->
+          ctx.SetStatusCode 404
+          return! json { error = "RepoNotFound"; message = "Repository not found" } next ctx
+        | Some repoData ->
+          match repoData.Head with
+          | None ->
+            ctx.SetStatusCode 404
+
+            return!
+              json
+                {
+                  error = "RepoNotFound"
+                  message = "Repository has no commits"
+                }
+                next
+                ctx
+          | Some headCid ->
+            let! allBlocks = blockStore.GetAllCidsAndData()
+            let carBytes = Car.createCar [ headCid ] allBlocks
+            ctx.SetContentType "application/vnd.ipld.car"
+            ctx.SetStatusCode 200
+            return! ctx.WriteBytesAsync carBytes
+    }
+
+  let getBlocksHandler : HttpHandler =
+    fun next ctx -> task {
+      let repoStore = ctx.GetService<IRepoStore>()
+      let blockStore = ctx.GetService<IBlockStore>()
+      let did = ctx.Request.Query.["did"].ToString()
+      let cidsParam = ctx.Request.Query.["cids"].ToString()
+
+      if String.IsNullOrWhiteSpace did || String.IsNullOrWhiteSpace cidsParam then
+        ctx.SetStatusCode 400
+        return! json { error = "InvalidRequest"; message = "Missing parameters" } next ctx
+      else
+        let! repoOpt = Persistence.loadRepo repoStore blockStore did
+
+        match repoOpt with
+        | None ->
+          ctx.SetStatusCode 404
+          return! json { error = "RepoNotFound"; message = "Repository not found" } next ctx
+        | Some _ ->
+          let cidStrs = cidsParam.Split(',') |> Array.map (fun s -> s.Trim())
+          let parsedCids = cidStrs |> Array.choose Cid.TryParse |> Array.toList
+
+          let! blocks =
+            parsedCids
+            |> List.map (fun cid -> async {
+              let! dataOpt = blockStore.Get cid
+              return dataOpt |> Option.map (fun d -> (cid, d))
+            })
+            |> Async.Sequential
+
+          let foundBlocks = blocks |> Array.choose id |> Array.toList
+          let roots = if foundBlocks.IsEmpty then [] else [ fst foundBlocks.Head ]
+          let carBytes = Car.createCar roots foundBlocks
+          ctx.SetContentType "application/vnd.ipld.car"
+          ctx.SetStatusCode 200
+          return! ctx.WriteBytesAsync carBytes
+    }
+
+  let getBlobHandler : HttpHandler =
+    fun next ctx -> task {
+      let blobStore = ctx.GetService<IBlobStore>()
+      let did = ctx.Request.Query.["did"].ToString()
+      let cidStr = ctx.Request.Query.["cid"].ToString()
+
+      if String.IsNullOrWhiteSpace(did) || String.IsNullOrWhiteSpace(cidStr) then
+        ctx.SetStatusCode 400
+        return! json { error = "InvalidRequest"; message = "Missing parameters" } next ctx
+      else
+        match Cid.TryParse cidStr with
+        | None ->
+          ctx.SetStatusCode 400
+          return! json { error = "InvalidCid"; message = "Invalid CID" } next ctx
+        | Some cid ->
+          let! blobOpt = blobStore.Get cid
+
+          match blobOpt with
+          | Some blob ->
+            ctx.SetContentType "application/octet-stream"
+            ctx.SetStatusCode 200
+            return! ctx.WriteBytesAsync blob
+          | None ->
+            ctx.SetStatusCode 404
+            return! json { error = "NotFound"; message = "Blob not found" } next ctx
+    }
+
+  let subscribeReposHandler : HttpHandler =
+    fun next ctx -> task {
+      if ctx.WebSockets.IsWebSocketRequest then
+        let firehose = ctx.GetService<FirehoseState>()
+        let! ws = ctx.WebSockets.AcceptWebSocketAsync()
+        let id = Guid.NewGuid().ToString()
+        firehose.Subscribers.TryAdd(id, ws) |> ignore
+
+        try
+          while ws.State = WebSocketState.Open do
+            do! Task.Delay 1000
+        finally
+          firehose.Subscribers.TryRemove(id) |> ignore
+
+        return Some ctx
+      else
+        ctx.SetStatusCode 400
+        return! text "WebSocket upgrade required" next ctx
+    }

PDSharp/PDSharp.fsproj

···
     </PropertyGroup>
 
     <ItemGroup>
-        <Compile Include="Program.fs" />
+        <Compile Include="Handlers/Common.fs" />
+    <Compile Include="Handlers/Server.fs" />
+    <Compile Include="Handlers/Auth.fs" />
+    <Compile Include="Handlers/Repo.fs" />
+    <Compile Include="Handlers/Sync.fs" />
+    <Compile Include="Program.fs" />
     </ItemGroup>
 
     <ItemGroup>

PDSharp/Program.fs

···
 open System
-open System.Text
-open System.Text.Json
 open Microsoft.AspNetCore.Builder
 open Microsoft.AspNetCore.Hosting
-open Microsoft.AspNetCore.Http
 open Microsoft.Extensions.Hosting
 open Microsoft.Extensions.DependencyInjection
-open Microsoft.Extensions.Configuration
 open Giraffe
 open PDSharp.Core
-open PDSharp.Core.Models
-open PDSharp.Core.Config
-open PDSharp.Core.BlockStore
-open PDSharp.Core.Repository
-open PDSharp.Core.Mst
-open PDSharp.Core.Crypto
-open PDSharp.Core.Firehose
 open PDSharp.Core.Auth
-
-module App =
-  /// Repo state per DID: MST root, collections, current rev, head commit CID
-  type RepoData = {
-    MstRoot : MstNode
-    Collections : Map<string, Map<string, Cid>>
-    Rev : string
-    Head : Cid option
-    Prev : Cid option
-  }
-
-  let emptyRepo = {
-    MstRoot = { Left = None; Entries = [] }
-    Collections = Map.empty
-    Rev = ""
-    Head = None
-    Prev = None
-  }
-
-  let mutable repos : Map<string, RepoData> = Map.empty
-  let blockStore = MemoryBlockStore()
-  let mutable signingKeys : Map<string, EcKeyPair> = Map.empty
-
-  // Firehose subscriber management
-  open System.Net.WebSockets
-  open System.Collections.Concurrent
-
-  /// Connected WebSocket subscribers
-  let subscribers = ConcurrentDictionary<Guid, WebSocket>()
-
-  /// Broadcast a commit event to all connected subscribers
-  let broadcastEvent (event : CommitEvent) =
-    let eventBytes = encodeEvent event
-    let segment = ArraySegment<byte>(eventBytes)
-
-    for kvp in subscribers do
-      let ws = kvp.Value
-
-      if ws.State = WebSocketState.Open then
-        try
-          ws.SendAsync(segment, WebSocketMessageType.Binary, true, Threading.CancellationToken.None)
-          |> Async.AwaitTask
-          |> Async.RunSynchronously
-        with _ ->
-          subscribers.TryRemove(kvp.Key) |> ignore
-
-  let getOrCreateKey (did : string) =
-    match Map.tryFind did signingKeys with
-    | Some k -> k
-    | None ->
-      let k = generateKey P256
-      signingKeys <- Map.add did k signingKeys
-      k
+open PDSharp.Core.BlockStore
+open PDSharp.Core.SqliteStore
+open PDSharp.Core.BlobStore
+open PDSharp.Core.Config
+open PDSharp.Handlers
 
-  let loader (c : Cid) = async {
-    let! bytesOpt = (blockStore :> IBlockStore).Get(c)
+let getConfig () =
+  let env (k : string) (def : string) =
+    match Environment.GetEnvironmentVariable k with
+    | null -> def
+    | v -> v
 
-    match bytesOpt with
-    | Some bytes -> return Some(Mst.deserialize bytes)
-    | None -> return None
-  }
+  let publicUrl = env "PDSHARP_PublicUrl" "http://localhost:5000"
+  let dbPath = env "PDSHARP_DbPath" "pdsharp.db"
 
-  let persister (n : MstNode) = async {
-    let bytes = Mst.serialize n
-    return! (blockStore :> IBlockStore).Put(bytes)
-  }
-
-  let signAndStoreCommit (did : string) (mstRootCid : Cid) (rev : string) (prev : Cid option) = async {
-    let key = getOrCreateKey did
-
-    let unsigned : UnsignedCommit = {
-      Did = did
-      Version = 3
-      Data = mstRootCid
-      Rev = rev
-      Prev = prev
-    }
-
-    let signed = signCommit key unsigned
-    let commitBytes = serializeCommit signed
-    let! commitCid = (blockStore :> IBlockStore).Put(commitBytes)
-    return signed, commitCid
+  {
+    PublicUrl = publicUrl
+    DidHost = env "PDSHARP_DidHost" "did:web:localhost"
+    JwtSecret = env "PDSHARP_JwtSecret" "development-secret-do-not-use-in-prod"
+    SqliteConnectionString = $"Data Source={dbPath}"
+    BlobStore = Disk "blobs" // Default to disk for now
   }
 
-  [<CLIMutable>]
-  type CreateRecordRequest = {
-    repo : string
-    collection : string
-    record : JsonElement
-    rkey : string option
-  }
-
-  [<CLIMutable>]
-  type CreateRecordResponse = {
-    uri : string
-    cid : string
-    commit : {| rev : string; cid : string |}
-  }
-
-  [<CLIMutable>]
-  type GetRecordResponse = { uri : string; cid : string; value : JsonElement }
-
-  [<CLIMutable>]
-  type ErrorResponse = { error : string; message : string }
-
-  let describeServerHandler : HttpHandler =
-    fun next ctx ->
-      let config = ctx.GetService<AppConfig>()
-
-      let response = {
-        availableUserDomains = []
-        did = config.DidHost
-        inviteCodeRequired = true
-      }
-
-      json response next ctx
-
-  [<CLIMutable>]
-  type CreateAccountRequest = {
-    handle : string
-    email : string option
-    password : string
-    inviteCode : string option
-  }
-
-  [<CLIMutable>]
-  type CreateSessionRequest = {
-    /// Handle or email
-    identifier : string
-    password : string
-  }
-
-  type SessionResponse = {
-    accessJwt : string
-    refreshJwt : string
-    handle : string
-    did : string
-    email : string option
-  }
-
-  /// POST /xrpc/com.atproto.server.createAccount
-  let createAccountHandler : HttpHandler =
-    fun next ctx -> task {
-      let config = ctx.GetService<AppConfig>()
-      let! body = ctx.ReadBodyFromRequestAsync()
-
-      let request =
-        JsonSerializer.Deserialize<CreateAccountRequest>(
-          body,
-          JsonSerializerOptions(PropertyNameCaseInsensitive = true)
-        )
-
-      if
-        String.IsNullOrWhiteSpace(request.handle)
-        || String.IsNullOrWhiteSpace(request.password)
-      then
-        ctx.SetStatusCode 400
-
-        return!
-          json
-            {
-              error = "InvalidRequest"
-              message = "handle and password are required"
-            }
-            next
-            ctx
-      else
-        match createAccount request.handle request.password request.email with
-        | Error msg ->
-          ctx.SetStatusCode 400
-          return! json { error = "AccountExists"; message = msg } next ctx
-        | Ok account ->
-          let accessJwt = createAccessToken config.JwtSecret account.Did
-          let refreshJwt = createRefreshToken config.JwtSecret account.Did
-
-          ctx.SetStatusCode 200
-
-          return!
-            json
-              {
-                accessJwt = accessJwt
-                refreshJwt = refreshJwt
-                handle = account.Handle
-                did = account.Did
-                email = account.Email
-              }
-              next
-              ctx
-    }
-
-  /// POST /xrpc/com.atproto.server.createSession
-  let createSessionHandler : HttpHandler =
-    fun next ctx -> task {
-      let config = ctx.GetService<AppConfig>()
-      let! body = ctx.ReadBodyFromRequestAsync()
-
-      let request =
-        JsonSerializer.Deserialize<CreateSessionRequest>(
-          body,
-          JsonSerializerOptions(PropertyNameCaseInsensitive = true)
-        )
-
-      if
-        String.IsNullOrWhiteSpace(request.identifier)
-        || String.IsNullOrWhiteSpace(request.password)
-      then
-        ctx.SetStatusCode 400
-
-        return!
-          json
-            {
-              error = "InvalidRequest"
-              message = "identifier and password are required"
-            }
-            next
-            ctx
-      else
-        match getAccountByHandle request.identifier with
-        | None ->
-          ctx.SetStatusCode 401
-
-          return!
-            json
-              {
-                error = "AuthenticationRequired"
-                message = "Invalid identifier or password"
-              }
-              next
-              ctx
-        | Some account ->
-          if not (verifyPassword request.password account.PasswordHash) then
-            ctx.SetStatusCode 401
-
-            return!
-              json
-                {
-                  error = "AuthenticationRequired"
-                  message = "Invalid identifier or password"
-                }
-                next
-                ctx
-          else
-            let accessJwt = createAccessToken config.JwtSecret account.Did
-            let refreshJwt = createRefreshToken config.JwtSecret account.Did
-
-            ctx.SetStatusCode 200
-
-            return!
-              json
-                {
-                  accessJwt = accessJwt
-                  refreshJwt = refreshJwt
-                  handle = account.Handle
-                  did = account.Did
-                  email = account.Email
-                }
-                next
-                ctx
-    }
-
-  /// Extract Bearer token from Authorization header
-  let private extractBearerToken (ctx : HttpContext) : string option =
-    match ctx.Request.Headers.TryGetValue("Authorization") with
-    | true, values ->
-      let header = values.ToString()
+let config = getConfig ()
 
-      if header.StartsWith("Bearer ", StringComparison.OrdinalIgnoreCase) then
-        Some(header.Substring(7))
-      else
-        None
-    | _ -> None
+SqliteStore.initialize config.SqliteConnectionString
 
-  /// POST /xrpc/com.atproto.server.refreshSession
-  let refreshSessionHandler : HttpHandler =
-    fun next ctx -> task {
-      let config = ctx.GetService<AppConfig>()
-
-      match extractBearerToken ctx with
-      | None ->
-        ctx.SetStatusCode 401
-
-        return!
-          json
-            {
-              error = "AuthenticationRequired"
-              message = "Missing or invalid Authorization header"
-            }
-            next
-            ctx
-      | Some token ->
-        match validateToken config.JwtSecret token with
-        | Invalid reason ->
-          ctx.SetStatusCode 401
-          return! json { error = "ExpiredToken"; message = reason } next ctx
-        | Valid(did, tokenType, _) ->
-          if tokenType <> Refresh then
-            ctx.SetStatusCode 400
-
-            return!
-              json
-                {
-                  error = "InvalidRequest"
-                  message = "Refresh token required"
-                }
-                next
-                ctx
-          else
-            match getAccountByDid did with
-            | None ->
-              ctx.SetStatusCode 401
-              return! json { error = "AccountNotFound"; message = "Account not found" } next ctx
-            | Some account ->
-              let accessJwt = createAccessToken config.JwtSecret account.Did
-              let refreshJwt = createRefreshToken config.JwtSecret account.Did
-
-              ctx.SetStatusCode 200
-
-              return!
-                json
-                  {
-                    accessJwt = accessJwt
-                    refreshJwt = refreshJwt
-                    handle = account.Handle
-                    did = account.Did
-                    email = account.Email
-                  }
-                  next
-                  ctx
-    }
-
-  let createRecordHandler : HttpHandler =
-    fun next ctx -> task {
-      let! body = ctx.ReadBodyFromRequestAsync()
-
-      let request =
-        JsonSerializer.Deserialize<CreateRecordRequest>(body, JsonSerializerOptions(PropertyNameCaseInsensitive = true))
-
-      match Lexicon.validate request.collection request.record with
-      | Lexicon.Error msg ->
-        ctx.SetStatusCode 400
-        return! json { error = "InvalidRequest"; message = msg } next ctx
-      | Lexicon.Ok ->
-        let did = request.repo
-
-        let rkey =
-          match request.rkey with
-          | Some r when not (String.IsNullOrWhiteSpace(r)) -> r
-          | _ -> Tid.generate ()
-
-        let recordJson = request.record.GetRawText()
-        let recordBytes = Encoding.UTF8.GetBytes(recordJson)
-        let! recordCid = (blockStore :> IBlockStore).Put(recordBytes)
-
-        let repoData = Map.tryFind did repos |> Option.defaultValue emptyRepo
-        let mstKey = $"{request.collection}/{rkey}"
-
-        let! newMstRoot = Mst.put loader persister repoData.MstRoot mstKey recordCid ""
-        let! mstRootCid = persister newMstRoot
-
-        let newRev = Tid.generate ()
-        let! (_, commitCid) = signAndStoreCommit did mstRootCid newRev repoData.Head
-
-        let collectionMap =
-          Map.tryFind request.collection repoData.Collections
-          |> Option.defaultValue Map.empty
-
-        let newCollectionMap = Map.add rkey recordCid collectionMap
-
-        let newCollections =
-          Map.add request.collection newCollectionMap repoData.Collections
-
-        let updatedRepo = {
-          MstRoot = newMstRoot
-          Collections = newCollections
-          Rev = newRev
-          Head = Some commitCid
-          Prev = repoData.Head
-        }
-
-        repos <- Map.add did updatedRepo repos
-
-        let! allBlocks = (blockStore :> IBlockStore).GetAllCidsAndData()
-        let carBytes = Car.createCar [ commitCid ] allBlocks
-        let event = createCommitEvent did newRev commitCid carBytes
-        broadcastEvent event
-
-        let uri = $"at://{did}/{request.collection}/{rkey}"
-        ctx.SetStatusCode 200
-
-        return!
-          json
-            {|
-              uri = uri
-              cid = recordCid.ToString()
-              commit = {| rev = newRev; cid = commitCid.ToString() |}
-            |}
-            next
-            ctx
-    }
-
-  let getRecordHandler : HttpHandler =
-    fun next ctx -> task {
-      let repo = ctx.Request.Query.["repo"].ToString()
-      let collection = ctx.Request.Query.["collection"].ToString()
-      let rkey = ctx.Request.Query.["rkey"].ToString()
-
-      if
-        String.IsNullOrWhiteSpace(repo)
-        || String.IsNullOrWhiteSpace(collection)
-        || String.IsNullOrWhiteSpace(rkey)
-      then
-        ctx.SetStatusCode 400
-
-        return!
-          json
-            {
-              error = "InvalidRequest"
-              message = "Missing required query parameters: repo, collection, rkey"
-            }
-            next
-            ctx
-      else
-        match Map.tryFind repo repos with
-        | None ->
-          ctx.SetStatusCode 404
-
-          return!
-            json
-              {
-                error = "RepoNotFound"
-                message = $"Repository not found: {repo}"
-              }
-              next
-              ctx
-        | Some repoData ->
-          match Map.tryFind collection repoData.Collections with
-          | None ->
-            ctx.SetStatusCode 404
-
-            return!
-              json
-                {
-                  error = "RecordNotFound"
-                  message = $"Collection not found: {collection}"
-                }
-                next
-                ctx
-          | Some collectionMap ->
-            match Map.tryFind rkey collectionMap with
-            | None ->
-              ctx.SetStatusCode 404
-
-              return!
-                json
-                  {
-                    error = "RecordNotFound"
-                    message = $"Record not found: {rkey}"
-                  }
-                  next
-                  ctx
-            | Some recordCid ->
-              let! recordBytesOpt = (blockStore :> IBlockStore).Get(recordCid)
-
-              match recordBytesOpt with
-              | None ->
-                ctx.SetStatusCode 500
-
-                return!
-                  json
-                    {
-                      error = "InternalError"
-                      message = "Block not found in store"
-                    }
-                    next
-                    ctx
-              | Some recordBytes ->
-                let recordJson = Encoding.UTF8.GetString(recordBytes)
-                let uri = $"at://{repo}/{collection}/{rkey}"
-                let valueElement = JsonSerializer.Deserialize<JsonElement>(recordJson)
-                ctx.SetStatusCode 200
-
-                return!
-                  json
-                    {|
-                      uri = uri
-                      cid = recordCid.ToString()
-                      value = valueElement
-                    |}
-                    next
-                    ctx
-    }
-
-  let putRecordHandler : HttpHandler =
-    fun next ctx -> task {
-      let! body = ctx.ReadBodyFromRequestAsync()
-
-      let request =
-        JsonSerializer.Deserialize<CreateRecordRequest>(body, JsonSerializerOptions(PropertyNameCaseInsensitive = true))
-
-      match Lexicon.validate request.collection request.record with
-      | Lexicon.Error msg ->
-        ctx.SetStatusCode 400
-        return! json { error = "InvalidRequest"; message = msg } next ctx
-      | Lexicon.Ok ->
-        match request.rkey with
-        | Some r when not (String.IsNullOrWhiteSpace r) ->
-          let did = request.repo
-          let recordJson = request.record.GetRawText()
-          let recordBytes = Encoding.UTF8.GetBytes(recordJson)
-          let! recordCid = (blockStore :> IBlockStore).Put(recordBytes)
-
-          let repoData = Map.tryFind did repos |> Option.defaultValue emptyRepo
-          let mstKey = $"{request.collection}/{r}"
-
-          let! newMstRoot = Mst.put loader persister repoData.MstRoot mstKey recordCid ""
-          let! mstRootCid = persister newMstRoot
-
-          let newRev = Tid.generate ()
-          let! (_, commitCid) = signAndStoreCommit did mstRootCid newRev repoData.Head
-
-          let collectionMap =
-            Map.tryFind request.collection repoData.Collections
-            |> Option.defaultValue Map.empty
-
-          let newCollectionMap = Map.add r recordCid collectionMap
-
-          let newCollections =
-            Map.add request.collection newCollectionMap repoData.Collections
-
-          let updatedRepo = {
-            MstRoot = newMstRoot
-            Collections = newCollections
-            Rev = newRev
-            Head = Some commitCid
-            Prev = repoData.Head
-          }
-
-          repos <- Map.add did updatedRepo repos
-
-          let! allBlocks = (blockStore :> IBlockStore).GetAllCidsAndData()
-          let carBytes = Car.createCar [ commitCid ] allBlocks
-          let event = createCommitEvent did newRev commitCid carBytes
-          broadcastEvent event
-
-          ctx.SetStatusCode 200
-
-          return!
-            json
-              {|
-                uri = $"at://{did}/{request.collection}/{r}"
-                cid = recordCid.ToString()
-                commit = {| rev = newRev; cid = commitCid.ToString() |}
-              |}
-              next
-              ctx
-        | _ ->
-          ctx.SetStatusCode 400
-
-          return!
-            json
-              {
-                error = "InvalidRequest"
-                message = "rkey is required for putRecord"
-              }
-              next
-              ctx
-    }
-
-  /// sync.getRepo: Export entire repository as CAR file
-  let getRepoHandler : HttpHandler =
-    fun next ctx -> task {
-      let did = ctx.Request.Query.["did"].ToString()
-
-      if String.IsNullOrWhiteSpace(did) then
-        ctx.SetStatusCode 400
-
-        return!
-          json
-            {
-              error = "InvalidRequest"
-              message = "Missing required query parameter: did"
-            }
-            next
-            ctx
-      else
-        match Map.tryFind did repos with
-        | None ->
-          ctx.SetStatusCode 404
-
-          return!
-            json
-              {
-                error = "RepoNotFound"
-                message = $"Repository not found: {did}"
-              }
-              next
-              ctx
-        | Some repoData ->
-          match repoData.Head with
-          | None ->
-            ctx.SetStatusCode 404
-
-            return!
-              json
-                {
-                  error = "RepoNotFound"
-                  message = "Repository has no commits"
-                }
-                next
-                ctx
-          | Some headCid ->
-            let! allBlocks = (blockStore :> IBlockStore).GetAllCidsAndData()
-            let carBytes = Car.createCar [ headCid ] allBlocks
-            ctx.SetContentType "application/vnd.ipld.car"
-            ctx.SetStatusCode 200
-            return! ctx.WriteBytesAsync carBytes
-    }
-
-  /// sync.getBlocks: Fetch specific blocks by CID
-  let getBlocksHandler : HttpHandler =
-    fun next ctx -> task {
-      let did = ctx.Request.Query.["did"].ToString()
-      let cidsParam = ctx.Request.Query.["cids"].ToString()
-
-      if String.IsNullOrWhiteSpace did || String.IsNullOrWhiteSpace cidsParam then
-        ctx.SetStatusCode 400
-
-        return!
-          json
-            {
-              error = "InvalidRequest"
-              message = "Missing required query parameters: did, cids"
-            }
-            next
-            ctx
-      else
-        match Map.tryFind did repos with
-        | None ->
-          ctx.SetStatusCode 404
-
-          return!
-            json
-              {
-                error = "RepoNotFound"
-                message = $"Repository not found: {did}"
-              }
-              next
-              ctx
-        | Some _ ->
-          let cidStrs = cidsParam.Split(',') |> Array.map (fun s -> s.Trim())
-          let parsedCids = cidStrs |> Array.choose Cid.TryParse |> Array.toList
-          let! allBlocks = (blockStore :> IBlockStore).GetAllCidsAndData()
-
-          let filteredBlocks =
-            if parsedCids.IsEmpty then
-              allBlocks
-            else
-              allBlocks
-              |> List.filter (fun (c, _) -> parsedCids |> List.exists (fun pc -> pc.Bytes = c.Bytes))
-
-          let roots =
-            if filteredBlocks.Length > 0 then
-              [ fst filteredBlocks.[0] ]
-            else
-              []
-
-          let carBytes = Car.createCar roots filteredBlocks
-          ctx.SetContentType "application/vnd.ipld.car"
-          ctx.SetStatusCode 200
-          return! ctx.WriteBytesAsync carBytes
-    }
-
-  /// sync.getBlob: Fetch a blob by CID
-  let getBlobHandler : HttpHandler =
-    fun next ctx -> task {
-      let did = ctx.Request.Query.["did"].ToString()
-      let cidStr = ctx.Request.Query.["cid"].ToString()
-
-      if String.IsNullOrWhiteSpace(did) || String.IsNullOrWhiteSpace(cidStr) then
-        ctx.SetStatusCode 400
-
-        return!
-          json
-            {
-              error = "InvalidRequest"
-              message = "Missing required query parameters: did, cid"
-            }
-            next
-            ctx
-      else
-        match Map.tryFind did repos with
-        | None ->
-          ctx.SetStatusCode 404
-
-          return!
-            json
-              {
-                error = "RepoNotFound"
-                message = $"Repository not found: {did}"
-              }
-              next
-              ctx
-        | Some _ ->
-          match Cid.TryParse cidStr with
-          | None ->
-            ctx.SetStatusCode 400
-
-            return!
-              json
-                {
-                  error = "InvalidRequest"
-                  message = $"Invalid CID format: {cidStr}"
-                }
-                next
-                ctx
-          | Some cid ->
-            let! dataOpt = (blockStore :> IBlockStore).Get(cid)
-
-            match dataOpt with
-            | None ->
-              ctx.SetStatusCode 404
-
-              return!
-                json
-                  {
-                    error = "BlobNotFound"
-                    message = $"Blob not found: {cidStr}"
-                  }
-                  next
-                  ctx
-            | Some data ->
-              ctx.SetContentType "application/octet-stream"
-              ctx.SetStatusCode 200
-              return! ctx.WriteBytesAsync data
-    }
-
-  /// subscribeRepos: WebSocket firehose endpoint
-  let subscribeReposHandler : HttpHandler =
-    fun next ctx -> task {
-      if ctx.WebSockets.IsWebSocketRequest then
-        let cursor =
-          match ctx.Request.Query.TryGetValue("cursor") with
-          | true, v when not (String.IsNullOrWhiteSpace(v.ToString())) ->
-            Int64.TryParse(v.ToString())
-            |> function
-              | true, n -> Some n
-              | _ -> None
-          | _ -> None
-
-        let! webSocket = ctx.WebSockets.AcceptWebSocketAsync()
-        let id = Guid.NewGuid()
-        subscribers.TryAdd(id, webSocket) |> ignore
-
-        let buffer = Array.zeroCreate<byte> 1024
-
-        try
-          let mutable loop = true
-
-          while loop && webSocket.State = WebSocketState.Open do
-            let! result = webSocket.ReceiveAsync(ArraySegment(buffer), Threading.CancellationToken.None)
-
-            if result.MessageType = WebSocketMessageType.Close then
-              loop <- false
-        finally
-          subscribers.TryRemove(id) |> ignore
-
-          if webSocket.State = WebSocketState.Open then
-            webSocket.CloseAsync(WebSocketCloseStatus.NormalClosure, "Closed", Threading.CancellationToken.None)
-            |> Async.AwaitTask
-            |> Async.RunSynchronously
-
-        return Some ctx
-      else
-        ctx.SetStatusCode 400
-
-        return!
-          json
-            {
-              error = "InvalidRequest"
-              message = "WebSocket upgrade required"
-            }
-            next
-            ctx
-    }
-
-  let indexHandler : HttpHandler =
-    fun next ctx ->
-      let html =
-        """<html>
-      <head><title>PDSharp</title></head>
-      <body>
-        <pre>
-         888                             888                         8888888888   888  888
-         888                             888                         888          888  888
-         888                             888                         888        888888888888
- 8888b.  888888 88888b.  888d888 .d88b.  888888 .d88b.       88      8888888      888  888
-    "88b 888    888 "88b 888P"  d88""88b 888   d88""88b    888888    888          888  888
-.d888888 888    888  888 888    888  888 888   888  888      88      888        888888888888
-888  888 Y88b.  888 d88P 888    Y88..88P Y88b. Y88..88P              888          888  888
-"Y888888  "Y888 88888P"  888     "Y88P"   "Y888 "Y88P"               888          888  888
-                888
-                888
-                888
-
-
-This is an AT Protocol Personal Data Server (aka, an atproto PDS)
-
-Most API routes are under /xrpc/
-
-      Code: https://github.com/bluesky-social/atproto
-            https://github.com/stormlightlabs/PDSharp
-            https://tangled.org/desertthunder.dev/PDSharp
- Self-Host: https://github.com/bluesky-social/pds
-  Protocol: https://atproto.com
-        </pre>
-      </body>
-    </html>"""
-
-      ctx.SetContentType "text/html"
-      ctx.SetStatusCode 200
-      ctx.WriteStringAsync html
-
+module App =
   let webApp =
     choose [
       GET
       >=> choose [
-        route "/" >=> indexHandler
-        route "/xrpc/com.atproto.server.describeServer" >=> describeServerHandler
+        route "/" >=> Server.indexHandler
+        route "/xrpc/com.atproto.server.describeServer" >=> Server.describeServerHandler
       ]
-      POST >=> route "/xrpc/com.atproto.server.createAccount" >=> createAccountHandler
-      POST >=> route "/xrpc/com.atproto.server.createSession" >=> createSessionHandler
+      POST
+      >=> route "/xrpc/com.atproto.server.createAccount"
+      >=> Auth.createAccountHandler
+      POST
+      >=> route "/xrpc/com.atproto.server.createSession"
+      >=> Auth.createSessionHandler
       POST
       >=> route "/xrpc/com.atproto.server.refreshSession"
-      >=> refreshSessionHandler
-      POST >=> route "/xrpc/com.atproto.repo.createRecord" >=> createRecordHandler
-      GET >=> route "/xrpc/com.atproto.repo.getRecord" >=> getRecordHandler
-      POST >=> route "/xrpc/com.atproto.repo.putRecord" >=> putRecordHandler
-      GET >=> route "/xrpc/com.atproto.sync.getRepo" >=> getRepoHandler
-      GET >=> route "/xrpc/com.atproto.sync.getBlocks" >=> getBlocksHandler
-      GET >=> route "/xrpc/com.atproto.sync.getBlob" >=> getBlobHandler
-      GET >=> route "/xrpc/com.atproto.sync.subscribeRepos" >=> subscribeReposHandler
+      >=> Auth.refreshSessionHandler
+      POST
+      >=> route "/xrpc/com.atproto.repo.createRecord"
+      >=> Repo.createRecordHandler
+      GET >=> route "/xrpc/com.atproto.repo.getRecord" >=> Repo.getRecordHandler
+      POST >=> route "/xrpc/com.atproto.repo.putRecord" >=> Repo.putRecordHandler
+      GET >=> route "/xrpc/com.atproto.sync.getRepo" >=> Sync.getRepoHandler
+      GET >=> route "/xrpc/com.atproto.sync.getBlocks" >=> Sync.getBlocksHandler
+      GET >=> route "/xrpc/com.atproto.sync.getBlob" >=> Sync.getBlobHandler
+      GET
+      >=> route "/xrpc/com.atproto.sync.subscribeRepos"
+      >=> Sync.subscribeReposHandler
       route "/" >=> text "PDSharp PDS is running."
       RequestErrors.NOT_FOUND "Not Found"
     ]
···
     services.AddGiraffe() |> ignore
     services.AddSingleton<AppConfig>(config) |> ignore
 
-  [<EntryPoint>]
-  let main args =
-    let configBuilder =
-      ConfigurationBuilder()
-        .SetBasePath(AppContext.BaseDirectory)
-        .AddJsonFile("appsettings.json", optional = false, reloadOnChange = true)
-        .AddEnvironmentVariables(prefix = "PDSHARP_")
-        .Build()
+    let blockStore = new SqliteBlockStore(config.SqliteConnectionString)
+    let accountStore = new SqliteAccountStore(config.SqliteConnectionString)
+    let repoStore = new SqliteRepoStore(config.SqliteConnectionString)
 
-    let appConfig = configBuilder.Get<AppConfig>()
+    services.AddSingleton<IBlockStore>(blockStore) |> ignore
+    services.AddSingleton<IAccountStore>(accountStore) |> ignore
+    services.AddSingleton<IRepoStore>(repoStore) |> ignore
 
+    let blobStore : IBlobStore =
+      match config.BlobStore with
+      | Disk path -> new DiskBlobStore(path) :> IBlobStore
+      | S3 s3Config -> new S3BlobStore(s3Config) :> IBlobStore
+
+    services.AddSingleton<IBlobStore>(blobStore) |> ignore
+    services.AddSingleton<FirehoseState>(new FirehoseState()) |> ignore
+    services.AddSingleton<SigningKeyStore>(new SigningKeyStore()) |> ignore
+
+  [<EntryPoint>]
+  let main args =
     Host
       .CreateDefaultBuilder(args)
       .ConfigureWebHostDefaults(fun webHostBuilder ->
-        webHostBuilder.Configure(configureApp).ConfigureServices(configureServices appConfig)
+        webHostBuilder.Configure(configureApp).ConfigureServices(configureServices config)
         |> ignore)
       .Build()
       .Run()