Migrate to ATProto PDS storage using Standard lexicon

Documents are now stored as site.standard.document records on each
user's PDS via com.atproto.repo XRPC endpoints. Local SQLite retains
only user accounts and ATProto token sessions.

- Add atproto_sessions table to persist DPoP keys and OAuth tokens
- Build XRPC client with DPoP auth, ath claim (RFC 9449), and token refresh
- Replace repo/file model with Document/MarkdownContent (at.markpub.markdown)
- Replace all repo/file handlers and routes with document handlers
- Add site.standard.publication auto-creation on first document
- Request transition:generic scope for write access to custom collections
- Drop repos/files/versions/comments tables (migration 004)
- Remove go-diff dependency and internal/version package
- Add Cache-Control: no-store to client-metadata.json
- Configure custom domain diffdown.jluther.net

Co-Authored-By: Claude Sonnet 4.6 <[e-mail]>

cmd/server/main.go

···
 	}
 
 	pages := []string{
-		"atproto_login", "dashboard", "diff", "editor", "file_view", "history",
-		"landing", "login", "new_repo", "register", "repo",
+		"atproto_login", "documents", "document_view", "document_edit",
+		"landing", "login", "new_document", "register",
 	}
 	tmpls := make(map[string]*template.Template, len(pages))
 	for _, page := range pages {
···
 	mux := http.NewServeMux()
 
 	// Static files are handled outside the mux to avoid conflicts with
-	// wildcard patterns like /{owner}/{repo}.
+	// wildcard patterns.
 	staticHandler := http.StripPrefix("/static/", http.FileServer(http.Dir("static")))
 
 	// Auth routes
···
 	// Dashboard
 	mux.HandleFunc("GET /", h.Dashboard)
 
-	// Repo routes
-	mux.HandleFunc("GET /new", h.NewRepoPage)
-	mux.HandleFunc("POST /new", h.NewRepoSubmit)
-	mux.HandleFunc("GET /{owner}/{repo}", h.RepoView)
-	mux.HandleFunc("GET /{owner}/{repo}/{path...}", h.FileDispatch)
-
-	// Diff
-	mux.HandleFunc("GET /diff/{v1}/{v2}", h.DiffView)
+	// Document routes
+	mux.HandleFunc("GET /docs/new", h.NewDocumentPage)
+	mux.HandleFunc("POST /docs/new", h.NewDocumentSubmit)
+	mux.HandleFunc("GET /docs/{rkey}", h.DocumentView)
+	mux.HandleFunc("GET /docs/{rkey}/edit", h.DocumentEdit)
 
 	// API
 	mux.HandleFunc("POST /api/render", h.APIRender)
-	mux.HandleFunc("POST /api/files", h.APICreateFile)
-	mux.HandleFunc("POST /api/files/{fileID}/save", h.APISaveFile)
-	mux.HandleFunc("PUT /api/files/{fileID}/autosave", h.APIAutoSave)
+	mux.HandleFunc("POST /api/docs/{rkey}/save", h.APIDocumentSave)
+	mux.HandleFunc("PUT /api/docs/{rkey}/autosave", h.APIDocumentAutoSave)
+	mux.HandleFunc("DELETE /api/docs/{rkey}", h.APIDocumentDelete)
 
-	// Middleware stack — static files are intercepted before the mux.
+	// Middleware stack
 	stack := middleware.Logger(
 		middleware.InjectUser(
 			http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

fly.toml

···
 [env]
   PORT = "8080"
   DB_PATH = "/data/markdownhub.db"
-  DIFFDOWN_BASE_URL = "https://markdownhub.fly.dev"
+  DIFFDOWN_BASE_URL = "https://diffdown.jluther.net"
 
 [http_service]
   internal_port = 8080

go.mod

···
 	github.com/gorilla/sessions v1.2.2
 	github.com/mattn/go-sqlite3 v1.14.22
 	github.com/oklog/ulid/v2 v2.1.0
-	github.com/sergi/go-diff v1.3.1
 	github.com/yuin/goldmark v1.7.1
 	golang.org/x/crypto v0.22.0
 )

go.sum

···
-github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/golang-jwt/jwt/v5 v5.3.1 h1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=
 github.com/golang-jwt/jwt/v5 v5.3.1/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
 github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
···
 github.com/gorilla/securecookie v1.1.2/go.mod h1:NfCASbcHqRSY+3a8tlWJwsQap2VX5pwzwo4h3eOamfo=
 github.com/gorilla/sessions v1.2.2 h1:lqzMYz6bOfvn2WriPUjNByzeXIlVzURcPmgMczkmTjY=
 github.com/gorilla/sessions v1.2.2/go.mod h1:ePLdVu+jbEgHH+KWw8I1z2wqd0BAdAQh/8LRvBeoNcQ=
-github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
-github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
-github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/mattn/go-sqlite3 v1.14.22 h1:2gZY6PC6kBnID23Tichd1K+Z0oS6nE/XwU+Vz/5o4kU=
 github.com/mattn/go-sqlite3 v1.14.22/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
 github.com/oklog/ulid/v2 v2.1.0 h1:+9lhoxAP56we25tyYETBBY1YLA2SaoLvUFgrP2miPJU=
 github.com/oklog/ulid/v2 v2.1.0/go.mod h1:rcEKHmBBKfef9DhnvX7y1HZBYxjXb0cP5ExxNsTT1QQ=
 github.com/pborman/getopt v0.0.0-20170112200414-7148bc3a4c30/go.mod h1:85jBQOZwpVEaDAr341tbn15RS4fCAsIst0qp7i8ex1o=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/sergi/go-diff v1.3.1 h1:xkr+Oxo4BOQKmkn/B9eMK0g5Kg/983T9DqqPHwYqD+8=
-github.com/sergi/go-diff v1.3.1/go.mod h1:aMJSSKb2lpPvRNec0+w3fl7LP9IOFzdc9Pa4NFbPK1I=
-github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/testify v1.4.0 h1:2E4SXV/wtOkTonXsotYi4li6zVWxYlZuYNCXe9XRJyk=
-github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/yuin/goldmark v1.7.1 h1:3bajkSilaCbjdKVsKdZjZCLBNPL9pYzrCakKaf4U49U=
 github.com/yuin/goldmark v1.7.1/go.mod h1:uzxRWxtg69N339t3louHJ7+O03ezfj6PlliRlaOzY1E=
 golang.org/x/crypto v0.22.0 h1:g1v0xeRhjcugydODzvb3mEM9SQ0HGp9s/nh3COQ/C30=
 golang.org/x/crypto v0.22.0/go.mod h1:vr6Su+7cTlO45qkww3VDJlzDn0ctJvRgYbC2NvXHt+M=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
-gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=

internal/atproto/dpop/dpop.go

···
 	"crypto/ecdsa"
 	"crypto/elliptic"
 	"crypto/rand"
+	"crypto/sha256"
 	"encoding/base64"
 	"encoding/json"
 	"fmt"
···
 }
 
 // Proof builds a DPoP proof JWT for the given HTTP method and URL.
-// nonce is optional (include when the server has issued one).
-func (kp *KeyPair) Proof(method, htu, nonce string) (string, error) {
+// nonce is optional. accessToken, when non-empty, causes an "ath" claim to be
+// included (base64url SHA-256 of the token) as required by RFC 9449 §4.2 when
+// presenting a DPoP-bound access token.
+func (kp *KeyPair) Proof(method, htu, nonce, accessToken string) (string, error) {
 	claims := jwt.MapClaims{
 		"jti": randJTI(),
 		"htm": method,
···
 	}
 	if nonce != "" {
 		claims["nonce"] = nonce
+	}
+	if accessToken != "" {
+		h := sha256.Sum256([]byte(accessToken))
+		claims["ath"] = base64.RawURLEncoding.EncodeToString(h[:])
 	}
 
 	token := jwt.NewWithClaims(jwt.SigningMethodES256, claims)

internal/atproto/token.go

···
+package atproto
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"log"
+	"net/http"
+	"net/url"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/limeleaf/diffdown/internal/atproto/dpop"
+	"github.com/limeleaf/diffdown/internal/db"
+	"github.com/limeleaf/diffdown/internal/model"
+)
+
+// RefreshAccessToken refreshes the access token for the given ATProto session.
+func RefreshAccessToken(database *db.DB, session *model.ATProtoSession) error {
+	kp, err := dpop.UnmarshalPrivate([]byte(session.DPoPKeyJWK))
+	if err != nil {
+		return fmt.Errorf("unmarshal DPoP key: %w", err)
+	}
+
+	base := os.Getenv("DIFFDOWN_BASE_URL")
+	if base == "" {
+		base = "http://127.0.0.1:8080"
+	}
+	clientID := strings.TrimRight(base, "/") + "/client-metadata.json"
+
+	params := url.Values{
+		"grant_type":    {"refresh_token"},
+		"refresh_token": {session.RefreshToken},
+		"client_id":     {clientID},
+	}
+
+	proof, err := kp.Proof("POST", session.TokenEndpoint, session.DPoPNonce, "")
+	if err != nil {
+		return fmt.Errorf("build DPoP proof: %w", err)
+	}
+
+	req, _ := http.NewRequest("POST", session.TokenEndpoint, strings.NewReader(params.Encode()))
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	req.Header.Set("DPoP", proof)
+
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return fmt.Errorf("refresh request: %w", err)
+	}
+	defer resp.Body.Close()
+
+	// Handle nonce retry
+	newNonce := resp.Header.Get("DPoP-Nonce")
+	if resp.StatusCode == http.StatusBadRequest && newNonce != "" {
+		proof, err = kp.Proof("POST", session.TokenEndpoint, newNonce, "")
+		if err != nil {
+			return fmt.Errorf("build DPoP proof (retry): %w", err)
+		}
+		req2, _ := http.NewRequest("POST", session.TokenEndpoint, strings.NewReader(params.Encode()))
+		req2.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+		req2.Header.Set("DPoP", proof)
+		resp.Body.Close()
+		resp, err = http.DefaultClient.Do(req2)
+		if err != nil {
+			return fmt.Errorf("refresh retry: %w", err)
+		}
+		defer resp.Body.Close()
+		newNonce = resp.Header.Get("DPoP-Nonce")
+	}
+
+	if resp.StatusCode != http.StatusOK {
+		body, _ := io.ReadAll(resp.Body)
+		return fmt.Errorf("refresh failed (HTTP %d): %s", resp.StatusCode, body)
+	}
+
+	var tokenBody struct {
+		AccessToken  string `json:"access_token"`
+		RefreshToken string `json:"refresh_token"`
+		ExpiresIn    int    `json:"expires_in"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&tokenBody); err != nil {
+		return fmt.Errorf("decode refresh response: %w", err)
+	}
+
+	if newNonce == "" {
+		newNonce = session.DPoPNonce
+	}
+
+	expiresAt := time.Now().Add(time.Duration(tokenBody.ExpiresIn) * time.Second)
+	if err := database.UpdateATProtoTokens(session.UserID, tokenBody.AccessToken, tokenBody.RefreshToken, newNonce, expiresAt); err != nil {
+		return fmt.Errorf("update tokens in DB: %w", err)
+	}
+
+	// Update in-memory session
+	session.AccessToken = tokenBody.AccessToken
+	session.RefreshToken = tokenBody.RefreshToken
+	session.DPoPNonce = newNonce
+	session.ExpiresAt = expiresAt
+
+	log.Printf("ATProto: refreshed token for user %s", session.UserID)
+	return nil
+}

internal/atproto/xrpc/client.go

···
+package xrpc
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"io"
+	"log"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/limeleaf/diffdown/internal/atproto"
+	"github.com/limeleaf/diffdown/internal/atproto/dpop"
+	"github.com/limeleaf/diffdown/internal/db"
+	"github.com/limeleaf/diffdown/internal/model"
+)
+
+type Client struct {
+	db      *db.DB
+	userID  string
+	session *model.ATProtoSession
+	kp      *dpop.KeyPair
+}
+
+// NewClient creates an XRPC client for the given user.
+func NewClient(database *db.DB, userID string) (*Client, error) {
+	session, err := database.GetATProtoSession(userID)
+	if err != nil {
+		return nil, fmt.Errorf("get ATProto session: %w", err)
+	}
+
+	kp, err := dpop.UnmarshalPrivate([]byte(session.DPoPKeyJWK))
+	if err != nil {
+		return nil, fmt.Errorf("unmarshal DPoP key: %w", err)
+	}
+
+	return &Client{
+		db:      database,
+		userID:  userID,
+		session: session,
+		kp:      kp,
+	}, nil
+}
+
+// DID returns the user's DID.
+func (c *Client) DID() string {
+	return c.session.DID
+}
+
+// PDSURL returns the user's PDS URL.
+func (c *Client) PDSURL() string {
+	return c.session.PDSURL
+}
+
+// do performs an authenticated XRPC request with DPoP and auto-refresh.
+func (c *Client) do(method, url string, body io.Reader) (*http.Response, error) {
+	// Auto-refresh if token expires within 30 seconds
+	if time.Until(c.session.ExpiresAt) < 30*time.Second {
+		if err := atproto.RefreshAccessToken(c.db, c.session); err != nil {
+			return nil, fmt.Errorf("refresh token: %w", err)
+		}
+	}
+
+	proof, err := c.kp.Proof(method, url, c.session.DPoPNonce, c.session.AccessToken)
+	if err != nil {
+		return nil, fmt.Errorf("build DPoP proof: %w", err)
+	}
+
+	req, err := http.NewRequest(method, url, body)
+	if err != nil {
+		return nil, err
+	}
+	req.Header.Set("Authorization", "DPoP "+c.session.AccessToken)
+	req.Header.Set("DPoP", proof)
+	if body != nil {
+		req.Header.Set("Content-Type", "application/json")
+	}
+
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return nil, err
+	}
+
+	// Update nonce if server sends a new one
+	if newNonce := resp.Header.Get("DPoP-Nonce"); newNonce != "" && newNonce != c.session.DPoPNonce {
+		c.session.DPoPNonce = newNonce
+		c.db.UpdateATProtoTokens(c.userID, c.session.AccessToken, c.session.RefreshToken, newNonce, c.session.ExpiresAt)
+	}
+
+	// On 401, refresh token and retry once
+	if resp.StatusCode == http.StatusUnauthorized {
+		resp.Body.Close()
+		if err := atproto.RefreshAccessToken(c.db, c.session); err != nil {
+			return nil, fmt.Errorf("refresh after 401: %w", err)
+		}
+
+		// Re-read the body if it was provided — caller must handle this
+		// For our use case, body is always a bytes.Reader or nil
+		if body != nil {
+			if seeker, ok := body.(io.Seeker); ok {
+				seeker.Seek(0, io.SeekStart)
+			}
+		}
+
+		proof, err = c.kp.Proof(method, url, c.session.DPoPNonce, c.session.AccessToken)
+		if err != nil {
+			return nil, fmt.Errorf("build DPoP proof (retry): %w", err)
+		}
+
+		req2, err := http.NewRequest(method, url, body)
+		if err != nil {
+			return nil, err
+		}
+		req2.Header.Set("Authorization", "DPoP "+c.session.AccessToken)
+		req2.Header.Set("DPoP", proof)
+		if body != nil {
+			req2.Header.Set("Content-Type", "application/json")
+		}
+
+		resp, err = http.DefaultClient.Do(req2)
+		if err != nil {
+			return nil, err
+		}
+
+		if newNonce := resp.Header.Get("DPoP-Nonce"); newNonce != "" {
+			c.session.DPoPNonce = newNonce
+			c.db.UpdateATProtoTokens(c.userID, c.session.AccessToken, c.session.RefreshToken, newNonce, c.session.ExpiresAt)
+		}
+	}
+
+	return resp, nil
+}
+
+// Record represents a record returned from listRecords.
+type Record struct {
+	URI   string          `json:"uri"`
+	CID   string          `json:"cid"`
+	Value json.RawMessage `json:"value"`
+}
+
+// CreateRecord creates a new record in the given collection.
+func (c *Client) CreateRecord(collection string, record interface{}) (uri, cid string, err error) {
+	payload := map[string]interface{}{
+		"repo":       c.session.DID,
+		"collection": collection,
+		"record":     record,
+	}
+	body, err := json.Marshal(payload)
+	if err != nil {
+		return "", "", err
+	}
+
+	url := strings.TrimRight(c.session.PDSURL, "/") + "/xrpc/com.atproto.repo.createRecord"
+	resp, err := c.do("POST", url, bytes.NewReader(body))
+	if err != nil {
+		return "", "", err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		respBody, _ := io.ReadAll(resp.Body)
+		log.Printf("XRPC createRecord %s: HTTP %d: %s", collection, resp.StatusCode, respBody)
+		return "", "", fmt.Errorf("createRecord failed (HTTP %d): %s", resp.StatusCode, respBody)
+	}
+
+	var result struct {
+		URI string `json:"uri"`
+		CID string `json:"cid"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
+		return "", "", err
+	}
+	return result.URI, result.CID, nil
+}
+
+// PutRecord creates or updates a record with the given rkey.
+func (c *Client) PutRecord(collection, rkey string, record interface{}) (uri, cid string, err error) {
+	payload := map[string]interface{}{
+		"repo":       c.session.DID,
+		"collection": collection,
+		"rkey":       rkey,
+		"record":     record,
+	}
+	body, err := json.Marshal(payload)
+	if err != nil {
+		return "", "", err
+	}
+
+	url := strings.TrimRight(c.session.PDSURL, "/") + "/xrpc/com.atproto.repo.putRecord"
+	resp, err := c.do("POST", url, bytes.NewReader(body))
+	if err != nil {
+		return "", "", err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		respBody, _ := io.ReadAll(resp.Body)
+		log.Printf("XRPC putRecord %s/%s: HTTP %d: %s", collection, rkey, resp.StatusCode, respBody)
+		return "", "", fmt.Errorf("putRecord failed (HTTP %d): %s", resp.StatusCode, respBody)
+	}
+
+	var result struct {
+		URI string `json:"uri"`
+		CID string `json:"cid"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
+		return "", "", err
+	}
+	return result.URI, result.CID, nil
+}
+
+// GetRecord fetches a single record.
+func (c *Client) GetRecord(did, collection, rkey string) (json.RawMessage, string, error) {
+	url := fmt.Sprintf("%s/xrpc/com.atproto.repo.getRecord?repo=%s&collection=%s&rkey=%s",
+		strings.TrimRight(c.session.PDSURL, "/"), did, collection, rkey)
+
+	resp, err := c.do("GET", url, nil)
+	if err != nil {
+		return nil, "", err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		respBody, _ := io.ReadAll(resp.Body)
+		return nil, "", fmt.Errorf("getRecord failed (HTTP %d): %s", resp.StatusCode, respBody)
+	}
+
+	var result struct {
+		URI   string          `json:"uri"`
+		CID   string          `json:"cid"`
+		Value json.RawMessage `json:"value"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
+		return nil, "", err
+	}
+	return result.Value, result.CID, nil
+}
+
+// ListRecords lists records in a collection.
+func (c *Client) ListRecords(did, collection string, limit int, cursor string) ([]Record, string, error) {
+	url := fmt.Sprintf("%s/xrpc/com.atproto.repo.listRecords?repo=%s&collection=%s&limit=%d",
+		strings.TrimRight(c.session.PDSURL, "/"), did, collection, limit)
+	if cursor != "" {
+		url += "&cursor=" + cursor
+	}
+
+	resp, err := c.do("GET", url, nil)
+	if err != nil {
+		return nil, "", err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		respBody, _ := io.ReadAll(resp.Body)
+		return nil, "", fmt.Errorf("listRecords failed (HTTP %d): %s", resp.StatusCode, respBody)
+	}
+
+	var result struct {
+		Records []Record `json:"records"`
+		Cursor  string   `json:"cursor"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
+		return nil, "", err
+	}
+	return result.Records, result.Cursor, nil
+}
+
+// DeleteRecord deletes a record.
+func (c *Client) DeleteRecord(collection, rkey string) error {
+	payload := map[string]interface{}{
+		"repo":       c.session.DID,
+		"collection": collection,
+		"rkey":       rkey,
+	}
+	body, err := json.Marshal(payload)
+	if err != nil {
+		return err
+	}
+
+	url := strings.TrimRight(c.session.PDSURL, "/") + "/xrpc/com.atproto.repo.deleteRecord"
+	resp, err := c.do("POST", url, bytes.NewReader(body))
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		respBody, _ := io.ReadAll(resp.Body)
+		return fmt.Errorf("deleteRecord failed (HTTP %d): %s", resp.StatusCode, respBody)
+	}
+	return nil
+}

internal/db/db.go

···
 	u.ID = NewID()
 	u.CreatedAt = time.Now()
 	_, err := db.Exec(
-		`INSERT INTO users (id, name, email, password_hash, avatar_url, oauth_provider, oauth_id, did, created_at)
-		 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,
-		u.ID, u.Name, u.Email, u.PasswordHash, u.AvatarURL, u.OAuthProvider, u.OAuthID, u.DID, u.CreatedAt,
+		`INSERT INTO users (id, name, email, password_hash, avatar_url, oauth_provider, oauth_id, did, pds_url, created_at)
+		 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+		u.ID, u.Name, u.Email, u.PasswordHash, u.AvatarURL, u.OAuthProvider, u.OAuthID, u.DID, u.PDSURL, u.CreatedAt,
 	)
 	return err
 }
 
-func (db *DB) GetUserByID(id string) (*model.User, error) {
+func (db *DB) scanUser(row interface{ Scan(...interface{}) error }) (*model.User, error) {
 	u := &model.User{}
-	err := db.QueryRow(
-		`SELECT id, name, email, password_hash, avatar_url, oauth_provider, oauth_id, did, created_at
-		 FROM users WHERE id = ?`, id,
-	).Scan(&u.ID, &u.Name, &u.Email, &u.PasswordHash, &u.AvatarURL, &u.OAuthProvider, &u.OAuthID, &u.DID, &u.CreatedAt)
+	err := row.Scan(&u.ID, &u.Name, &u.Email, &u.PasswordHash, &u.AvatarURL, &u.OAuthProvider, &u.OAuthID, &u.DID, &u.PDSURL, &u.CreatedAt)
 	if err != nil {
 		return nil, err
 	}
 	return u, nil
 }
 
+const userColumns = `id, name, email, password_hash, avatar_url, oauth_provider, oauth_id, did, pds_url, created_at`
+
+func (db *DB) GetUserByID(id string) (*model.User, error) {
+	return db.scanUser(db.QueryRow(`SELECT `+userColumns+` FROM users WHERE id = ?`, id))
+}
+
 func (db *DB) GetUserByEmail(email string) (*model.User, error) {
-	u := &model.User{}
-	err := db.QueryRow(
-		`SELECT id, name, email, password_hash, avatar_url, oauth_provider, oauth_id, did, created_at
-		 FROM users WHERE email = ?`, email,
-	).Scan(&u.ID, &u.Name, &u.Email, &u.PasswordHash, &u.AvatarURL, &u.OAuthProvider, &u.OAuthID, &u.DID, &u.CreatedAt)
-	if err != nil {
-		return nil, err
-	}
-	return u, nil
+	return db.scanUser(db.QueryRow(`SELECT `+userColumns+` FROM users WHERE email = ?`, email))
 }
 
 func (db *DB) GetUserByOAuth(provider, oauthID string) (*model.User, error) {
-	u := &model.User{}
-	err := db.QueryRow(
-		`SELECT id, name, email, password_hash, avatar_url, oauth_provider, oauth_id, did, created_at
-		 FROM users WHERE oauth_provider = ? AND oauth_id = ?`, provider, oauthID,
-	).Scan(&u.ID, &u.Name, &u.Email, &u.PasswordHash, &u.AvatarURL, &u.OAuthProvider, &u.OAuthID, &u.DID, &u.CreatedAt)
-	if err != nil {
-		return nil, err
-	}
-	return u, nil
+	return db.scanUser(db.QueryRow(`SELECT `+userColumns+` FROM users WHERE oauth_provider = ? AND oauth_id = ?`, provider, oauthID))
 }
 
 func (db *DB) GetUserByDID(did string) (*model.User, error) {
-	u := &model.User{}
-	err := db.QueryRow(
-		`SELECT id, name, email, password_hash, avatar_url, oauth_provider, oauth_id, did, created_at
-		 FROM users WHERE did = ?`, did,
-	).Scan(&u.ID, &u.Name, &u.Email, &u.PasswordHash, &u.AvatarURL, &u.OAuthProvider, &u.OAuthID, &u.DID, &u.CreatedAt)
-	if err != nil {
-		return nil, err
-	}
-	return u, nil
+	return db.scanUser(db.QueryRow(`SELECT `+userColumns+` FROM users WHERE did = ?`, did))
 }
 
 func (db *DB) UpdateUserPassword(userID, hash string) error {
···
 	return err
 }
 
-// --- Repos ---
-
-func (db *DB) CreateRepo(r *model.Repo) error {
-	r.ID = NewID()
-	r.CreatedAt = time.Now()
-	r.UpdatedAt = r.CreatedAt
-	tx, err := db.Begin()
-	if err != nil {
-		return err
-	}
-	defer tx.Rollback()
-
-	_, err = tx.Exec(
-		`INSERT INTO repos (id, name, slug, description, owner_id, visibility, created_at, updated_at)
-		 VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
-		r.ID, r.Name, r.Slug, r.Description, r.OwnerID, r.Visibility, r.CreatedAt, r.UpdatedAt,
-	)
-	if err != nil {
-		return err
-	}
-
-	// Add owner as collaborator
-	_, err = tx.Exec(
-		`INSERT INTO repo_collaborators (repo_id, user_id, role) VALUES (?, ?, 'owner')`,
-		r.ID, r.OwnerID,
-	)
-	if err != nil {
-		return err
-	}
-
-	return tx.Commit()
-}
-
-func (db *DB) GetRepo(ownerID, slug string) (*model.Repo, error) {
-	r := &model.Repo{}
-	err := db.QueryRow(
-		`SELECT id, name, slug, description, owner_id, visibility, created_at, updated_at
-		 FROM repos WHERE owner_id = ? AND slug = ?`, ownerID, slug,
-	).Scan(&r.ID, &r.Name, &r.Slug, &r.Description, &r.OwnerID, &r.Visibility, &r.CreatedAt, &r.UpdatedAt)
-	if err != nil {
-		return nil, err
-	}
-	return r, nil
-}
-
-func (db *DB) GetRepoByID(id string) (*model.Repo, error) {
-	r := &model.Repo{}
-	err := db.QueryRow(
-		`SELECT id, name, slug, description, owner_id, visibility, created_at, updated_at
-		 FROM repos WHERE id = ?`, id,
-	).Scan(&r.ID, &r.Name, &r.Slug, &r.Description, &r.OwnerID, &r.Visibility, &r.CreatedAt, &r.UpdatedAt)
-	if err != nil {
-		return nil, err
-	}
-	return r, nil
-}
-
-func (db *DB) ListUserRepos(userID string) ([]*model.Repo, error) {
-	rows, err := db.Query(
-		`SELECT r.id, r.name, r.slug, r.description, r.owner_id, r.visibility, r.created_at, r.updated_at
-		 FROM repos r
-		 JOIN repo_collaborators rc ON r.id = rc.repo_id
-		 WHERE rc.user_id = ?
-		 ORDER BY r.updated_at DESC`, userID,
-	)
-	if err != nil {
-		return nil, err
-	}
-	defer rows.Close()
-
-	var repos []*model.Repo
-	for rows.Next() {
-		r := &model.Repo{}
-		if err := rows.Scan(&r.ID, &r.Name, &r.Slug, &r.Description, &r.OwnerID, &r.Visibility, &r.CreatedAt, &r.UpdatedAt); err != nil {
-			return nil, err
-		}
-		repos = append(repos, r)
-	}
-	return repos, nil
-}
+// --- ATProto Sessions ---
 
-func (db *DB) GetUserRole(repoID, userID string) (string, error) {
-	var role string
-	err := db.QueryRow(
-		`SELECT role FROM repo_collaborators WHERE repo_id = ? AND user_id = ?`,
-		repoID, userID,
-	).Scan(&role)
-	if err != nil {
-		return "", err
-	}
-	return role, nil
-}
-
-// --- Files ---
-
-func (db *DB) CreateFile(f *model.File) error {
-	f.ID = NewID()
-	f.CreatedAt = time.Now()
-	f.UpdatedAt = f.CreatedAt
+func (db *DB) UpsertATProtoSession(s *model.ATProtoSession) error {
 	_, err := db.Exec(
-		`INSERT INTO files (id, repo_id, path, content, created_at, updated_at)
-		 VALUES (?, ?, ?, ?, ?, ?)`,
-		f.ID, f.RepoID, f.Path, f.Content, f.CreatedAt, f.UpdatedAt,
+		`INSERT INTO atproto_sessions (user_id, did, pds_url, access_token, refresh_token, dpop_key_jwk, dpop_nonce, token_endpoint, expires_at, updated_at)
+		 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+		 ON CONFLICT(user_id) DO UPDATE SET
+		   did = excluded.did,
+		   pds_url = excluded.pds_url,
+		   access_token = excluded.access_token,
+		   refresh_token = excluded.refresh_token,
+		   dpop_key_jwk = excluded.dpop_key_jwk,
+		   dpop_nonce = excluded.dpop_nonce,
+		   token_endpoint = excluded.token_endpoint,
+		   expires_at = excluded.expires_at,
+		   updated_at = excluded.updated_at`,
+		s.UserID, s.DID, s.PDSURL, s.AccessToken, s.RefreshToken, s.DPoPKeyJWK, s.DPoPNonce, s.TokenEndpoint, s.ExpiresAt, time.Now(),
 	)
 	return err
 }
 
-func (db *DB) GetFile(repoID, path string) (*model.File, error) {
-	f := &model.File{}
-	err := db.QueryRow(
-		`SELECT id, repo_id, path, content, created_at, updated_at
-		 FROM files WHERE repo_id = ? AND path = ?`, repoID, path,
-	).Scan(&f.ID, &f.RepoID, &f.Path, &f.Content, &f.CreatedAt, &f.UpdatedAt)
-	if err != nil {
-		return nil, err
-	}
-	return f, nil
-}
-
-func (db *DB) GetFileByID(id string) (*model.File, error) {
-	f := &model.File{}
+func (db *DB) GetATProtoSession(userID string) (*model.ATProtoSession, error) {
+	s := &model.ATProtoSession{}
 	err := db.QueryRow(
-		`SELECT id, repo_id, path, content, created_at, updated_at
-		 FROM files WHERE id = ?`, id,
-	).Scan(&f.ID, &f.RepoID, &f.Path, &f.Content, &f.CreatedAt, &f.UpdatedAt)
+		`SELECT user_id, did, pds_url, access_token, refresh_token, dpop_key_jwk, dpop_nonce, token_endpoint, expires_at, updated_at
+		 FROM atproto_sessions WHERE user_id = ?`, userID,
+	).Scan(&s.UserID, &s.DID, &s.PDSURL, &s.AccessToken, &s.RefreshToken, &s.DPoPKeyJWK, &s.DPoPNonce, &s.TokenEndpoint, &s.ExpiresAt, &s.UpdatedAt)
 	if err != nil {
 		return nil, err
 	}
-	return f, nil
+	return s, nil
 }
 
-func (db *DB) UpdateFileContent(id, content string) error {
+func (db *DB) UpdateATProtoTokens(userID, accessToken, refreshToken, nonce string, expiresAt time.Time) error {
 	_, err := db.Exec(
-		`UPDATE files SET content = ?, updated_at = ? WHERE id = ?`,
-		content, time.Now(), id,
+		`UPDATE atproto_sessions SET access_token = ?, refresh_token = ?, dpop_nonce = ?, expires_at = ?, updated_at = ? WHERE user_id = ?`,
+		accessToken, refreshToken, nonce, expiresAt, time.Now(), userID,
 	)
 	return err
 }
 
-func (db *DB) ListFiles(repoID string) ([]*model.File, error) {
-	rows, err := db.Query(
-		`SELECT id, repo_id, path, '', created_at, updated_at
-		 FROM files WHERE repo_id = ? ORDER BY path`, repoID,
-	)
-	if err != nil {
-		return nil, err
-	}
-	defer rows.Close()
-
-	var files []*model.File
-	for rows.Next() {
-		f := &model.File{}
-		if err := rows.Scan(&f.ID, &f.RepoID, &f.Path, &f.Content, &f.CreatedAt, &f.UpdatedAt); err != nil {
-			return nil, err
-		}
-		files = append(files, f)
-	}
-	return files, nil
-}
-
-func (db *DB) DeleteFile(id string) error {
-	_, err := db.Exec(`DELETE FROM files WHERE id = ?`, id)
-	return err
-}
-
-// --- Versions ---
-
-func (db *DB) CreateVersion(v *model.Version) error {
-	v.ID = NewID()
-	v.CreatedAt = time.Now()
-	_, err := db.Exec(
-		`INSERT INTO versions (id, file_id, content, author_id, message, created_at)
-		 VALUES (?, ?, ?, ?, ?, ?)`,
-		v.ID, v.FileID, v.Content, v.AuthorID, v.Message, v.CreatedAt,
-	)
-	return err
-}
-
-func (db *DB) ListVersions(fileID string) ([]*model.Version, error) {
-	rows, err := db.Query(
-		`SELECT v.id, v.file_id, '', v.author_id, v.message, v.created_at, u.name
-		 FROM versions v
-		 JOIN users u ON v.author_id = u.id
-		 WHERE v.file_id = ?
-		 ORDER BY v.created_at DESC`, fileID,
-	)
-	if err != nil {
-		return nil, err
-	}
-	defer rows.Close()
-
-	var versions []*model.Version
-	for rows.Next() {
-		v := &model.Version{}
-		if err := rows.Scan(&v.ID, &v.FileID, &v.Content, &v.AuthorID, &v.Message, &v.CreatedAt, &v.AuthorName); err != nil {
-			return nil, err
-		}
-		versions = append(versions, v)
-	}
-	return versions, nil
-}
-
-func (db *DB) GetVersion(id string) (*model.Version, error) {
-	v := &model.Version{}
-	err := db.QueryRow(
-		`SELECT v.id, v.file_id, v.content, v.author_id, v.message, v.created_at, u.name
-		 FROM versions v
-		 JOIN users u ON v.author_id = u.id
-		 WHERE v.id = ?`, id,
-	).Scan(&v.ID, &v.FileID, &v.Content, &v.AuthorID, &v.Message, &v.CreatedAt, &v.AuthorName)
-	if err != nil {
-		return nil, err
-	}
-	return v, nil
-}

internal/handler/atproto.go

···
 	"net/url"
 	"os"
 	"strings"
+	"time"
 
 	"github.com/limeleaf/diffdown/internal/atproto"
 	"github.com/limeleaf/diffdown/internal/atproto/dpop"
···
 }
 
 // ClientMetadata serves the OAuth client metadata document.
-// The client_id in ATProto OAuth must be a URL pointing to this document.
 func (h *Handler) ClientMetadata(w http.ResponseWriter, r *http.Request) {
 	base := baseURL()
 	meta := map[string]interface{}{
···
 		"redirect_uris":              []string{base + "/auth/atproto/callback"},
 		"grant_types":                []string{"authorization_code", "refresh_token"},
 		"response_types":             []string{"code"},
-		"scope":                      "atproto",
+		"scope":                      "atproto transition:generic",
 		"token_endpoint_auth_method": "none",
 		"dpop_bound_access_tokens":   true,
 		"application_type":           "web",
 	}
 	w.Header().Set("Content-Type", "application/json")
+	w.Header().Set("Cache-Control", "no-store")
 	json.NewEncoder(w).Encode(meta)
 }
 
···
 	h.render(w, "atproto_login.html", PageData{Title: "Sign in with Bluesky"})
 }
 
-// ATProtoLoginSubmit starts the ATProto OAuth flow:
-// 1. Resolve handle → DID → PDS → auth server metadata
-// 2. Generate DPoP key + PKCE
-// 3. POST PAR request
-// 4. Store state in session, redirect user to authorization endpoint
+// ATProtoLoginSubmit starts the ATProto OAuth flow.
 func (h *Handler) ATProtoLoginSubmit(w http.ResponseWriter, r *http.Request) {
 	handle := strings.TrimSpace(r.FormValue("handle"))
 	if handle == "" {
···
 	clientID := baseURL() + "/client-metadata.json"
 
 	// 3. POST PAR request
-	parProof, err := kp.Proof("POST", meta.PushedAuthorizationRequestEndpoint, "")
+	parProof, err := kp.Proof("POST", meta.PushedAuthorizationRequestEndpoint, "", "")
 	if err != nil {
 		log.Printf("ATProto: build PAR DPoP proof: %v", err)
 		http.Error(w, "Internal error", 500)
···
 		"response_type":         {"code"},
 		"client_id":             {clientID},
 		"redirect_uri":          {redirectURI},
-		"scope":                 {"atproto"},
+		"scope":                 {"atproto transition:generic"},
 		"state":                 {state},
 		"code_challenge":        {challenge},
 		"code_challenge_method": {"S256"},
···
 	}
 	defer resp.Body.Close()
 
-	// Handle DPoP nonce requirement (server may return 400 with nonce on first try)
+	// Handle DPoP nonce requirement
 	nonce := resp.Header.Get("DPoP-Nonce")
 	if resp.StatusCode == http.StatusBadRequest && nonce != "" {
-		parProof, err = kp.Proof("POST", meta.PushedAuthorizationRequestEndpoint, nonce)
+		parProof, err = kp.Proof("POST", meta.PushedAuthorizationRequestEndpoint, nonce, "")
 		if err != nil {
 			http.Error(w, "Internal error", 500)
 			return
···
 	sess.Values["atproto_token_endpoint"] = meta.TokenEndpoint
 	sess.Values["atproto_did"] = did
 	sess.Values["atproto_handle"] = handle
+	sess.Values["atproto_pds_url"] = pds
 	sess.Save(r, w)
 
-	// Redirect user to authorization endpoint
 	authURL := meta.AuthorizationEndpoint + "?client_id=" + url.QueryEscape(clientID) + "&request_uri=" + url.QueryEscape(parResp.RequestURI)
 	http.Redirect(w, r, authURL, http.StatusFound)
 }
 
-// ATProtoCallback handles the redirect back from the PDS after user approval:
-// 1. Validate state
-// 2. Exchange code for tokens (with DPoP)
-// 3. Verify sub (DID)
-// 4. Find or create user, set session
+// ATProtoCallback handles the redirect back from the PDS after user approval.
 func (h *Handler) ATProtoCallback(w http.ResponseWriter, r *http.Request) {
 	sess := auth.GetSession(r)
 
···
 	tokenEndpoint, _ := sess.Values["atproto_token_endpoint"].(string)
 	expectedDID, _ := sess.Values["atproto_did"].(string)
 	handle, _ := sess.Values["atproto_handle"].(string)
+	pdsURL, _ := sess.Values["atproto_pds_url"].(string)
 
 	// Clean up session state
 	delete(sess.Values, "atproto_state")
···
 	delete(sess.Values, "atproto_token_endpoint")
 	delete(sess.Values, "atproto_did")
 	delete(sess.Values, "atproto_handle")
+	delete(sess.Values, "atproto_pds_url")
 
 	// 2. Exchange code for tokens
 	kp, err := dpop.UnmarshalPrivate([]byte(keyJSON))
···
 		"code_verifier": {verifier},
 	}
 
-	tokenProof, err := kp.Proof("POST", tokenEndpoint, nonce)
+	tokenProof, err := kp.Proof("POST", tokenEndpoint, nonce, "")
 	if err != nil {
 		log.Printf("ATProto callback: build token DPoP proof: %v", err)
 		http.Error(w, "Internal error", 500)
···
 	// Handle nonce refresh on token endpoint
 	newNonce := tokenResp.Header.Get("DPoP-Nonce")
 	if tokenResp.StatusCode == http.StatusBadRequest && newNonce != "" {
-		tokenProof, err = kp.Proof("POST", tokenEndpoint, newNonce)
+		tokenProof, err = kp.Proof("POST", tokenEndpoint, newNonce, "")
 		if err != nil {
 			http.Error(w, "Internal error", 500)
 			return
···
 			return
 		}
 		defer tokenResp.Body.Close()
+		newNonce = tokenResp.Header.Get("DPoP-Nonce")
 	}
 
 	if tokenResp.StatusCode != http.StatusOK {
-		log.Printf("ATProto callback: token response %d", tokenResp.StatusCode)
+		body, _ := io.ReadAll(tokenResp.Body)
+		log.Printf("ATProto callback: token response %d: %s", tokenResp.StatusCode, body)
 		h.render(w, "atproto_login.html", PageData{Title: "Sign in with Bluesky", Error: "Token exchange failed"})
 		return
 	}
 
 	var tokenBody struct {
-		Sub string `json:"sub"`
+		Sub          string `json:"sub"`
+		AccessToken  string `json:"access_token"`
+		RefreshToken string `json:"refresh_token"`
+		ExpiresIn    int    `json:"expires_in"`
 	}
 	if err := json.NewDecoder(tokenResp.Body).Decode(&tokenBody); err != nil {
 		log.Printf("ATProto callback: decode token response: %v", err)
···
 		return
 	}
 
+	// Capture final nonce from response
+	if newNonce == "" {
+		newNonce = nonce
+	}
+
 	// 3. Verify sub matches the DID we resolved at the start
 	if tokenBody.Sub == "" {
 		http.Error(w, "Token missing sub claim", http.StatusBadRequest)
···
 		}
 		did := tokenBody.Sub
 		user = &model.User{
-			Name: handle,
-			DID:  &did,
+			Name:   handle,
+			DID:    &did,
+			PDSURL: pdsURL,
 		}
 		if err := h.DB.CreateUser(user); err != nil {
 			log.Printf("ATProto callback: create user: %v", err)
···
 		}
 	} else if err != nil {
 		log.Printf("ATProto callback: get user by DID: %v", err)
+		http.Error(w, "Internal error", 500)
+		return
+	}
+
+	// 5. Store ATProto session with tokens
+	expiresAt := time.Now().Add(time.Duration(tokenBody.ExpiresIn) * time.Second)
+	atSession := &model.ATProtoSession{
+		UserID:        user.ID,
+		DID:           tokenBody.Sub,
+		PDSURL:        pdsURL,
+		AccessToken:   tokenBody.AccessToken,
+		RefreshToken:  tokenBody.RefreshToken,
+		DPoPKeyJWK:    keyJSON,
+		DPoPNonce:     newNonce,
+		TokenEndpoint: tokenEndpoint,
+		ExpiresAt:     expiresAt,
+	}
+	if err := h.DB.UpsertATProtoSession(atSession); err != nil {
+		log.Printf("ATProto callback: upsert session: %v", err)
 		http.Error(w, "Internal error", 500)
 		return
 	}

internal/handler/handler.go

···
 package handler
 
 import (
-	"database/sql"
 	"encoding/json"
 	"fmt"
 	"html/template"
···
 	"net/http"
 	"regexp"
 	"strings"
+	"time"
 
+	"github.com/limeleaf/diffdown/internal/atproto/xrpc"
 	"github.com/limeleaf/diffdown/internal/auth"
 	"github.com/limeleaf/diffdown/internal/db"
 	"github.com/limeleaf/diffdown/internal/model"
 	"github.com/limeleaf/diffdown/internal/render"
-	"github.com/limeleaf/diffdown/internal/version"
 )
 
 type Handler struct {
···
 func (h *Handler) jsonResponse(w http.ResponseWriter, data interface{}) {
 	w.Header().Set("Content-Type", "application/json")
 	json.NewEncoder(w).Encode(data)
+}
+
+func (h *Handler) xrpcClient(userID string) (*xrpc.Client, error) {
+	return xrpc.NewClient(h.DB, userID)
 }
 
 // --- Auth handlers ---
···
 		return
 	}
 
-	repos, _ := h.DB.ListUserRepos(user.ID)
-	h.render(w, "dashboard.html", PageData{
-		Title:   "Dashboard",
-		User:    user,
-		Content: repos,
-	})
-}
-
-// --- Repo handlers ---
-
-var slugRe = regexp.MustCompile(`[^a-z0-9-]+`)
-
-func slugify(s string) string {
-	s = strings.ToLower(strings.TrimSpace(s))
-	s = slugRe.ReplaceAllString(s, "-")
-	return strings.Trim(s, "-")
-}
-
-func (h *Handler) NewRepoPage(w http.ResponseWriter, r *http.Request) {
-	h.render(w, "new_repo.html", PageData{Title: "New Repository", User: h.currentUser(r)})
-}
-
-func (h *Handler) NewRepoSubmit(w http.ResponseWriter, r *http.Request) {
-	user := h.currentUser(r)
-	name := strings.TrimSpace(r.FormValue("name"))
-	desc := strings.TrimSpace(r.FormValue("description"))
-	vis := r.FormValue("visibility")
-	if vis == "" {
-		vis = "private"
-	}
-
-	if name == "" {
-		h.render(w, "new_repo.html", PageData{Title: "New Repository", User: user, Error: "Name is required"})
+	client, err := h.xrpcClient(user.ID)
+	if err != nil {
+		log.Printf("Dashboard: xrpc client: %v", err)
+		h.render(w, "documents.html", PageData{
+			Title:   "Documents",
+			User:    user,
+			Content: []*model.Document{},
+		})
 		return
 	}
 
-	repo := &model.Repo{
-		Name:        name,
-		Slug:        slugify(name),
-		Description: desc,
-		OwnerID:     user.ID,
-		Visibility:  vis,
-	}
-	if err := h.DB.CreateRepo(repo); err != nil {
-		h.render(w, "new_repo.html", PageData{Title: "New Repository", User: user, Error: "Could not create repo"})
+	records, _, err := client.ListRecords(client.DID(), "site.standard.document", 100, "")
+	if err != nil {
+		log.Printf("Dashboard: list records: %v", err)
+		h.render(w, "documents.html", PageData{
+			Title:   "Documents",
+			User:    user,
+			Content: []*model.Document{},
+		})
 		return
 	}
 
-	// Create default README.md
-	f := &model.File{
-		RepoID:  repo.ID,
-		Path:    "README.md",
-		Content: fmt.Sprintf("# %s\n\n%s\n", name, desc),
+	var docs []*model.Document
+	for _, rec := range records {
+		doc := &model.Document{}
+		if err := json.Unmarshal(rec.Value, doc); err != nil {
+			continue
+		}
+		doc.URI = rec.URI
+		doc.CID = rec.CID
+		doc.RKey = model.RKeyFromURI(rec.URI)
+		docs = append(docs, doc)
 	}
-	h.DB.CreateFile(f)
 
-	http.Redirect(w, r, fmt.Sprintf("/%s/%s", user.Name, repo.Slug), http.StatusSeeOther)
+	h.render(w, "documents.html", PageData{
+		Title:   "Documents",
+		User:    user,
+		Content: docs,
+	})
 }
 
-// --- Repo view (file browser) ---
+// --- Document handlers ---
 
-func (h *Handler) RepoView(w http.ResponseWriter, r *http.Request) {
+func (h *Handler) NewDocumentPage(w http.ResponseWriter, r *http.Request) {
 	user := h.currentUser(r)
-	ownerName := r.PathValue("owner")
-	repoSlug := r.PathValue("repo")
-
-	owner, err := h.DB.GetUserByEmail("") // We need GetUserByName
-	_ = owner
-	// For now, use a simpler approach — look up repos by iterating
-	// TODO: add GetUserByName to DB
-	_ = ownerName
-
-	// Simplified: get repo by current user for now
 	if user == nil {
-		http.Redirect(w, r, "/auth/login", http.StatusSeeOther)
-		return
-	}
-
-	repo, err := h.DB.GetRepo(user.ID, repoSlug)
-	if err != nil {
-		http.NotFound(w, r)
+		http.Redirect(w, r, "/auth/atproto", http.StatusSeeOther)
 		return
 	}
+	h.render(w, "new_document.html", PageData{Title: "New Document", User: user})
+}
 
-	files, _ := h.DB.ListFiles(repo.ID)
+// stripMarkdown removes basic markdown syntax to produce plain text for textContent.
+var mdSyntaxRe = regexp.MustCompile(`(?m)^#{1,6}\s+|[*_~` + "`" + `\[\]()>]`)
 
-	type RepoViewData struct {
-		Repo  *model.Repo
-		Files []*model.File
-	}
-	h.render(w, "repo.html", PageData{
-		Title:   repo.Name,
-		User:    user,
-		Content: RepoViewData{Repo: repo, Files: files},
-	})
+func stripMarkdown(md string) string {
+	return strings.TrimSpace(mdSyntaxRe.ReplaceAllString(md, ""))
 }
 
-// --- File dispatcher ---
+// ensurePublication creates the site.standard.publication record if it doesn't exist.
+func (h *Handler) ensurePublication(client *xrpc.Client, user *model.User) (string, error) {
+	pubURI := fmt.Sprintf("at://%s/site.standard.publication/self", client.DID())
 
-// FileDispatch routes /{owner}/{repo}/{path...} to the correct handler based
-// on whether the path ends with "/edit" or "/history".
-func (h *Handler) FileDispatch(w http.ResponseWriter, r *http.Request) {
-	path := r.PathValue("path")
-	switch {
-	case strings.HasSuffix(path, "/edit"):
-		h.editor(w, r, strings.TrimSuffix(path, "/edit"))
-	case strings.HasSuffix(path, "/history"):
-		h.versionHistory(w, r, strings.TrimSuffix(path, "/history"))
-	default:
-		h.fileView(w, r, path)
+	// Check if it exists
+	_, _, err := client.GetRecord(client.DID(), "site.standard.publication", "self")
+	if err == nil {
+		return pubURI, nil
+	}
+
+	// Create it
+	base := baseURL()
+	pub := map[string]interface{}{
+		"$type": "site.standard.publication",
+		"url":   base,
+		"name":  user.Name,
 	}
+	_, _, err = client.PutRecord("site.standard.publication", "self", pub)
+	if err != nil {
+		return "", fmt.Errorf("create publication: %w", err)
+	}
+	log.Printf("Created publication record for %s", user.Name)
+	return pubURI, nil
 }
 
-// --- File view (rendered) ---
-
-func (h *Handler) fileView(w http.ResponseWriter, r *http.Request, filePath string) {
+func (h *Handler) NewDocumentSubmit(w http.ResponseWriter, r *http.Request) {
 	user := h.currentUser(r)
-	repoSlug := r.PathValue("repo")
+	if user == nil {
+		http.Redirect(w, r, "/auth/atproto", http.StatusSeeOther)
+		return
+	}
 
-	if user == nil {
-		http.Redirect(w, r, "/auth/login", http.StatusSeeOther)
+	title := strings.TrimSpace(r.FormValue("title"))
+	if title == "" {
+		h.render(w, "new_document.html", PageData{Title: "New Document", User: user, Error: "Title is required"})
 		return
 	}
 
-	repo, err := h.DB.GetRepo(user.ID, repoSlug)
+	client, err := h.xrpcClient(user.ID)
 	if err != nil {
-		http.NotFound(w, r)
+		log.Printf("NewDocumentSubmit: xrpc client: %v", err)
+		h.render(w, "new_document.html", PageData{Title: "New Document", User: user, Error: "Could not connect to your PDS"})
 		return
 	}
 
-	file, err := h.DB.GetFile(repo.ID, filePath)
+	siteURI, err := h.ensurePublication(client, user)
 	if err != nil {
-		http.NotFound(w, r)
+		log.Printf("NewDocumentSubmit: ensure publication: %v", err)
+		h.render(w, "new_document.html", PageData{Title: "New Document", User: user, Error: "Could not set up publication"})
 		return
 	}
 
-	rendered, _ := render.Markdown([]byte(file.Content))
+	now := time.Now().UTC().Format(time.RFC3339)
+	initialMD := fmt.Sprintf("# %s\n", title)
+	doc := map[string]interface{}{
+		"$type": "site.standard.document",
+		"site":  siteURI,
+		"title": title,
+		"content": map[string]interface{}{
+			"$type":  "at.markpub.markdown",
+			"flavor": "gfm",
+			"text": map[string]interface{}{
+				"rawMarkdown": initialMD,
+			},
+		},
+		"textContent": stripMarkdown(initialMD),
+		"publishedAt": now,
+		"updatedAt":   now,
+	}
 
-	type FileViewData struct {
-		Repo     *model.Repo
-		File     *model.File
-		Rendered template.HTML
+	uri, _, err := client.CreateRecord("site.standard.document", doc)
+	if err != nil {
+		log.Printf("NewDocumentSubmit: create record: %v", err)
+		h.render(w, "new_document.html", PageData{Title: "New Document", User: user, Error: "Could not create document"})
+		return
 	}
-	h.render(w, "file_view.html", PageData{
-		Title:   file.Path + " — " + repo.Name,
-		User:    user,
-		Content: FileViewData{Repo: repo, File: file, Rendered: template.HTML(rendered)},
-	})
-}
 
-// --- Editor ---
+	rkey := model.RKeyFromURI(uri)
+	http.Redirect(w, r, fmt.Sprintf("/docs/%s/edit", rkey), http.StatusSeeOther)
+}
 
-func (h *Handler) editor(w http.ResponseWriter, r *http.Request, filePath string) {
+// DocumentView renders a document as HTML.
+func (h *Handler) DocumentView(w http.ResponseWriter, r *http.Request) {
 	user := h.currentUser(r)
-	repoSlug := r.PathValue("repo")
-
 	if user == nil {
-		http.Redirect(w, r, "/auth/login", http.StatusSeeOther)
+		http.Redirect(w, r, "/auth/atproto", http.StatusSeeOther)
 		return
 	}
 
-	repo, err := h.DB.GetRepo(user.ID, repoSlug)
+	rkey := r.PathValue("rkey")
+	client, err := h.xrpcClient(user.ID)
 	if err != nil {
-		http.NotFound(w, r)
+		http.Error(w, "Could not connect to PDS", 500)
 		return
 	}
 
-	file, err := h.DB.GetFile(repo.ID, filePath)
+	value, _, err := client.GetRecord(client.DID(), "site.standard.document", rkey)
 	if err != nil {
 		http.NotFound(w, r)
 		return
 	}
 
-	type EditorData struct {
-		Repo *model.Repo
-		File *model.File
+	doc := &model.Document{}
+	if err := json.Unmarshal(value, doc); err != nil {
+		http.Error(w, "Invalid document", 500)
+		return
+	}
+	doc.RKey = rkey
+
+	var rendered string
+	if doc.Content != nil {
+		rendered, _ = render.Markdown([]byte(doc.Content.Text.RawMarkdown))
 	}
-	h.render(w, "editor.html", PageData{
-		Title:   "Edit " + file.Path,
+
+	type DocumentViewData struct {
+		Doc      *model.Document
+		Rendered template.HTML
+	}
+	h.render(w, "document_view.html", PageData{
+		Title:   doc.Title,
 		User:    user,
-		Content: EditorData{Repo: repo, File: file},
+		Content: DocumentViewData{Doc: doc, Rendered: template.HTML(rendered)},
 	})
 }
 
-// --- API: Save file ---
-
-func (h *Handler) APISaveFile(w http.ResponseWriter, r *http.Request) {
+// DocumentEdit renders the editor for a document.
+func (h *Handler) DocumentEdit(w http.ResponseWriter, r *http.Request) {
 	user := h.currentUser(r)
 	if user == nil {
-		http.Error(w, "Unauthorized", 401)
+		http.Redirect(w, r, "/auth/atproto", http.StatusSeeOther)
 		return
 	}
 
-	var req struct {
-		Content string `json:"content"`
-		Message string `json:"message"`
-	}
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		http.Error(w, "Bad request", 400)
+	rkey := r.PathValue("rkey")
+	client, err := h.xrpcClient(user.ID)
+	if err != nil {
+		http.Error(w, "Could not connect to PDS", 500)
 		return
 	}
 
-	fileID := r.PathValue("fileID")
-	file, err := h.DB.GetFileByID(fileID)
+	value, _, err := client.GetRecord(client.DID(), "site.standard.document", rkey)
 	if err != nil {
 		http.NotFound(w, r)
 		return
 	}
 
-	// Update file content
-	h.DB.UpdateFileContent(file.ID, req.Content)
-
-	// Create version snapshot
-	v := &model.Version{
-		FileID:   file.ID,
-		Content:  req.Content,
-		AuthorID: user.ID,
-		Message:  req.Message,
+	doc := &model.Document{}
+	if err := json.Unmarshal(value, doc); err != nil {
+		http.Error(w, "Invalid document", 500)
+		return
 	}
-	h.DB.CreateVersion(v)
+	doc.RKey = rkey
 
-	h.jsonResponse(w, map[string]string{"status": "ok", "version_id": v.ID})
+	h.render(w, "document_edit.html", PageData{
+		Title:   "Edit " + doc.Title,
+		User:    user,
+		Content: doc,
+	})
 }
 
-// --- API: Auto-save (no version) ---
-
-func (h *Handler) APIAutoSave(w http.ResponseWriter, r *http.Request) {
+// APIDocumentSave saves a document to the PDS.
+func (h *Handler) APIDocumentSave(w http.ResponseWriter, r *http.Request) {
 	user := h.currentUser(r)
 	if user == nil {
 		http.Error(w, "Unauthorized", 401)
 		return
 	}
 
+	rkey := r.PathValue("rkey")
 	var req struct {
 		Content string `json:"content"`
+		Title   string `json:"title"`
 	}
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
 		http.Error(w, "Bad request", 400)
 		return
 	}
 
-	fileID := r.PathValue("fileID")
-	h.DB.UpdateFileContent(fileID, req.Content)
-	h.jsonResponse(w, map[string]string{"status": "ok"})
-}
-
-// --- API: Render markdown ---
-
-func (h *Handler) APIRender(w http.ResponseWriter, r *http.Request) {
-	var req struct {
-		Content string `json:"content"`
-	}
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		http.Error(w, "Bad request", 400)
+	client, err := h.xrpcClient(user.ID)
+	if err != nil {
+		http.Error(w, "Could not connect to PDS", 500)
 		return
 	}
 
-	rendered, err := render.Markdown([]byte(req.Content))
+	// Fetch existing record to preserve fields
+	value, _, err := client.GetRecord(client.DID(), "site.standard.document", rkey)
 	if err != nil {
-		http.Error(w, "Render error", 500)
+		http.Error(w, "Document not found", 404)
 		return
 	}
 
-	h.jsonResponse(w, map[string]string{"html": rendered})
-}
+	var existing map[string]interface{}
+	json.Unmarshal(value, &existing)
 
-// --- Version history ---
+	// Update content
+	title := req.Title
+	if title == "" {
+		if t, ok := existing["title"].(string); ok {
+			title = t
+		}
+	}
 
-func (h *Handler) versionHistory(w http.ResponseWriter, r *http.Request, filePath string) {
-	user := h.currentUser(r)
-	repoSlug := r.PathValue("repo")
-
-	repo, err := h.DB.GetRepo(user.ID, repoSlug)
-	if err != nil {
-		http.NotFound(w, r)
-		return
+	now := time.Now().UTC().Format(time.RFC3339)
+	existing["title"] = title
+	existing["content"] = map[string]interface{}{
+		"$type":  "at.markpub.markdown",
+		"flavor": "gfm",
+		"text": map[string]interface{}{
+			"rawMarkdown": req.Content,
+		},
 	}
+	existing["textContent"] = stripMarkdown(req.Content)
+	existing["updatedAt"] = now
 
-	file, err := h.DB.GetFile(repo.ID, filePath)
+	_, _, err = client.PutRecord("site.standard.document", rkey, existing)
 	if err != nil {
-		http.NotFound(w, r)
+		log.Printf("APIDocumentSave: put record: %v", err)
+		http.Error(w, "Save failed", 500)
 		return
 	}
 
-	versions, _ := h.DB.ListVersions(file.ID)
-
-	type HistoryData struct {
-		Repo     *model.Repo
-		File     *model.File
-		Versions []*model.Version
-	}
-	h.render(w, "history.html", PageData{
-		Title:   "History — " + file.Path,
-		User:    user,
-		Content: HistoryData{Repo: repo, File: file, Versions: versions},
-	})
+	h.jsonResponse(w, map[string]string{"status": "ok"})
 }
 
-// --- Diff view ---
+// APIDocumentAutoSave is the same as save, called on debounce from editor.
+func (h *Handler) APIDocumentAutoSave(w http.ResponseWriter, r *http.Request) {
+	h.APIDocumentSave(w, r)
+}
 
-func (h *Handler) DiffView(w http.ResponseWriter, r *http.Request) {
+// APIDocumentDelete deletes a document from the PDS.
+func (h *Handler) APIDocumentDelete(w http.ResponseWriter, r *http.Request) {
 	user := h.currentUser(r)
-	v1ID := r.PathValue("v1")
-	v2ID := r.PathValue("v2")
-
-	v1, err := h.DB.GetVersion(v1ID)
-	if err != nil {
-		http.NotFound(w, r)
+	if user == nil {
+		http.Error(w, "Unauthorized", 401)
 		return
 	}
-	v2, err := h.DB.GetVersion(v2ID)
+
+	rkey := r.PathValue("rkey")
+	client, err := h.xrpcClient(user.ID)
 	if err != nil {
-		http.NotFound(w, r)
+		http.Error(w, "Could not connect to PDS", 500)
 		return
 	}
 
-	file, _ := h.DB.GetFileByID(v1.FileID)
-	repo, _ := h.DB.GetRepoByID(file.RepoID)
-
-	diffLines := version.Diff(v1.Content, v2.Content)
-
-	type DiffData struct {
-		Repo  *model.Repo
-		File  *model.File
-		V1    *model.Version
-		V2    *model.Version
-		Lines []version.DiffLine
+	if err := client.DeleteRecord("site.standard.document", rkey); err != nil {
+		log.Printf("APIDocumentDelete: %v", err)
+		http.Error(w, "Delete failed", 500)
+		return
 	}
-	h.render(w, "diff.html", PageData{
-		Title:   "Diff",
-		User:    user,
-		Content: DiffData{Repo: repo, File: file, V1: v1, V2: v2, Lines: diffLines},
-	})
+
+	h.jsonResponse(w, map[string]string{"status": "ok"})
 }
 
-// --- API: Create file ---
-
-func (h *Handler) APICreateFile(w http.ResponseWriter, r *http.Request) {
-	user := h.currentUser(r)
-	if user == nil {
-		http.Error(w, "Unauthorized", 401)
-		return
-	}
+// --- API: Render markdown ---
 
+func (h *Handler) APIRender(w http.ResponseWriter, r *http.Request) {
 	var req struct {
-		RepoID string `json:"repo_id"`
-		Path   string `json:"path"`
+		Content string `json:"content"`
 	}
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
 		http.Error(w, "Bad request", 400)
 		return
 	}
 
-	// Verify user has access
-	_, err := h.DB.GetUserRole(req.RepoID, user.ID)
-	if err == sql.ErrNoRows {
-		http.Error(w, "Forbidden", 403)
-		return
-	}
-
-	f := &model.File{
-		RepoID:  req.RepoID,
-		Path:    req.Path,
-		Content: "",
-	}
-	if err := h.DB.CreateFile(f); err != nil {
-		http.Error(w, "Could not create file", 500)
+	rendered, err := render.Markdown([]byte(req.Content))
+	if err != nil {
+		http.Error(w, "Render error", 500)
 		return
 	}
 
-	h.jsonResponse(w, f)
+	h.jsonResponse(w, map[string]string{"html": rendered})
 }

internal/model/models.go

···
 package model
 
-import "time"
+import (
+	"strings"
+	"time"
+)
 
 type User struct {
 	ID            string    `json:"id"`
···
 	OAuthProvider *string   `json:"oauth_provider,omitempty"`
 	OAuthID       *string   `json:"-"`
 	DID           *string   `json:"did,omitempty"`
+	PDSURL        string    `json:"pds_url,omitempty"`
 	CreatedAt     time.Time `json:"created_at"`
 }
 
-type Repo struct {
-	ID          string    `json:"id"`
-	Name        string    `json:"name"`
-	Slug        string    `json:"slug"`
-	Description string    `json:"description"`
-	OwnerID     string    `json:"owner_id"`
-	Visibility  string    `json:"visibility"` // private, public, unlisted
-	CreatedAt   time.Time `json:"created_at"`
-	UpdatedAt   time.Time `json:"updated_at"`
+type ATProtoSession struct {
+	UserID        string    `json:"user_id"`
+	DID           string    `json:"did"`
+	PDSURL        string    `json:"pds_url"`
+	AccessToken   string    `json:"access_token"`
+	RefreshToken  string    `json:"refresh_token"`
+	DPoPKeyJWK    string    `json:"dpop_key_jwk"`
+	DPoPNonce     string    `json:"dpop_nonce"`
+	TokenEndpoint string    `json:"token_endpoint"`
+	ExpiresAt     time.Time `json:"expires_at"`
+	UpdatedAt     time.Time `json:"updated_at"`
 }
 
-type RepoCollaborator struct {
-	RepoID string `json:"repo_id"`
-	UserID string `json:"user_id"`
-	Role   string `json:"role"` // owner, editor, commenter, viewer
+// --- Document model (Standard lexicon) ---
+
+type Document struct {
+	// ATProto metadata
+	URI  string `json:"uri,omitempty"`
+	CID  string `json:"cid,omitempty"`
+	RKey string `json:"rkey,omitempty"`
+	// Standard fields
+	Title       string           `json:"title"`
+	Content     *MarkdownContent `json:"content,omitempty"`
+	TextContent string           `json:"textContent,omitempty"`
+	PublishedAt string           `json:"publishedAt"`
+	UpdatedAt   string           `json:"updatedAt,omitempty"`
+	Site        string           `json:"site"`
 }
 
-type File struct {
-	ID        string    `json:"id"`
-	RepoID    string    `json:"repo_id"`
-	Path      string    `json:"path"`
-	Content   string    `json:"content"`
-	CreatedAt time.Time `json:"created_at"`
-	UpdatedAt time.Time `json:"updated_at"`
+type MarkdownContent struct {
+	Type   string       `json:"$type"`
+	Flavor string       `json:"flavor"`
+	Text   MarkdownText `json:"text"`
 }
 
-type Version struct {
-	ID        string    `json:"id"`
-	FileID    string    `json:"file_id"`
-	Content   string    `json:"content"`
-	AuthorID  string    `json:"author_id"`
-	Message   string    `json:"message"`
-	CreatedAt time.Time `json:"created_at"`
-	// Computed fields for display
-	AuthorName string `json:"author_name,omitempty"`
-	LinesAdded   int  `json:"lines_added,omitempty"`
-	LinesRemoved int  `json:"lines_removed,omitempty"`
+type MarkdownText struct {
+	RawMarkdown string `json:"rawMarkdown"`
 }
 
-type Comment struct {
-	ID          string    `json:"id"`
-	FileID      string    `json:"file_id"`
-	VersionID   *string   `json:"version_id,omitempty"`
-	LineStart   int       `json:"line_start"`
-	LineEnd     int       `json:"line_end"`
-	ContentHash string    `json:"content_hash"`
-	Body        string    `json:"body"`
-	AuthorID    string    `json:"author_id"`
-	ParentID    *string   `json:"parent_id,omitempty"`
-	Resolved    bool      `json:"resolved"`
-	CreatedAt   time.Time `json:"created_at"`
-	// Computed
-	AuthorName string     `json:"author_name,omitempty"`
-	Replies    []*Comment `json:"replies,omitempty"`
+// RKeyFromURI extracts the rkey (last path segment) from an at:// URI.
+func RKeyFromURI(uri string) string {
+	parts := strings.Split(uri, "/")
+	if len(parts) > 0 {
+		return parts[len(parts)-1]
+	}
+	return ""
 }
+

internal/version/diff.go

···
-package version
-
-import (
-	"strings"
-
-	difflib "github.com/sergi/go-diff/diffmatchpatch"
-)
-
-type DiffLine struct {
-	Type    string `json:"type"` // equal, insert, delete
-	Content string `json:"content"`
-	OldNum  int    `json:"old_num,omitempty"`
-	NewNum  int    `json:"new_num,omitempty"`
-}
-
-func Diff(oldText, newText string) []DiffLine {
-	dmp := difflib.New()
-	diffs := dmp.DiffMain(oldText, newText, true)
-	diffs = dmp.DiffCleanupSemantic(diffs)
-
-	var lines []DiffLine
-	oldNum := 1
-	newNum := 1
-
-	for _, d := range diffs {
-		parts := strings.Split(d.Text, "\n")
-		for i, part := range parts {
-			if i == len(parts)-1 && part == "" {
-				continue
-			}
-			switch d.Type {
-			case difflib.DiffEqual:
-				lines = append(lines, DiffLine{
-					Type:    "equal",
-					Content: part,
-					OldNum:  oldNum,
-					NewNum:  newNum,
-				})
-				oldNum++
-				newNum++
-			case difflib.DiffInsert:
-				lines = append(lines, DiffLine{
-					Type:    "insert",
-					Content: part,
-					NewNum:  newNum,
-				})
-				newNum++
-			case difflib.DiffDelete:
-				lines = append(lines, DiffLine{
-					Type:    "delete",
-					Content: part,
-					OldNum:  oldNum,
-				})
-				oldNum++
-			}
-		}
-	}
-	return lines
-}
-
-func Stats(oldText, newText string) (added, removed int) {
-	dmp := difflib.New()
-	diffs := dmp.DiffMain(oldText, newText, true)
-	for _, d := range diffs {
-		lineCount := strings.Count(d.Text, "\n")
-		if d.Text != "" && !strings.HasSuffix(d.Text, "\n") {
-			lineCount++
-		}
-		switch d.Type {
-		case difflib.DiffInsert:
-			added += lineCount
-		case difflib.DiffDelete:
-			removed += lineCount
-		}
-	}
-	return
-}

migrations/003_atproto_sessions.sql

···
+CREATE TABLE IF NOT EXISTS atproto_sessions (
+    user_id TEXT PRIMARY KEY REFERENCES users(id) ON DELETE CASCADE,
+    did TEXT NOT NULL,
+    pds_url TEXT NOT NULL,
+    access_token TEXT NOT NULL,
+    refresh_token TEXT NOT NULL,
+    dpop_key_jwk TEXT NOT NULL,
+    dpop_nonce TEXT DEFAULT '',
+    token_endpoint TEXT NOT NULL,
+    expires_at DATETIME NOT NULL,
+    updated_at DATETIME DEFAULT CURRENT_TIMESTAMP
+);
+
+ALTER TABLE users ADD COLUMN pds_url TEXT DEFAULT '';

migrations/004_drop_content_tables.sql

···
+DROP TABLE IF EXISTS comments;
+DROP TABLE IF EXISTS versions;
+DROP TABLE IF EXISTS files;
+DROP TABLE IF EXISTS repo_collaborators;
+DROP TABLE IF EXISTS repos;

templates/base.html

···
         <a href="/" class="logo">Diffdown</a>
         <div class="nav-right">
             {{if .User}}
-                <a href="/new">New Repo</a>
+                <a href="/docs/new">New Document</a>
                 <span class="nav-user">{{.User.Name}}</span>
                 <form method="post" action="/auth/logout" style="display:inline">
                     <button type="submit" class="btn-link">Log out</button>

templates/dashboard.html

···
-{{template "base" .}}
-{{define "content"}}
-<div class="dashboard">
-    <div class="dashboard-header">
-        <h2>Your Repositories</h2>
-        <a href="/new" class="btn">New Repo</a>
-    </div>
-    {{$user := .User}}
-    {{with .Content}}
-    <div class="repo-list">
-        {{range .}}
-        <a href="/{{$user.Name}}/{{.Slug}}" class="repo-card">
-            <h3>{{.Name}}</h3>
-            <p>{{.Description}}</p>
-            <span class="repo-vis">{{.Visibility}}</span>
-            <time>Updated {{.UpdatedAt.Format "Jan 2, 2006"}}</time>
-        </a>
-        {{else}}
-        <div class="empty-state">
-            <p>No repositories yet.</p>
-            <a href="/new" class="btn">Create your first repo</a>
-        </div>
-        {{end}}
-    </div>
-    {{end}}
-</div>
-{{end}}

templates/diff.html

···
-{{template "base" .}}
-{{define "head"}}
-<link rel="stylesheet" href="/static/css/diff.css">
-{{end}}
-
-{{define "content"}}
-{{with .Content}}
-<div class="diff-page">
-    <div class="file-header">
-        <div class="breadcrumb">
-            <a href="/">{{.Repo.Name}}</a>
-            <span>/</span>
-            <span>{{.File.Path}}</span>
-            <span>/</span>
-            <span>Diff</span>
-        </div>
-    </div>
-    <div class="diff-meta">
-        <div class="diff-version">
-            <strong>From:</strong> {{.V1.AuthorName}} — {{.V1.CreatedAt.Format "Jan 2, 2006 3:04 PM"}}
-            {{if .V1.Message}}<em>({{.V1.Message}})</em>{{end}}
-        </div>
-        <div class="diff-version">
-            <strong>To:</strong> {{.V2.AuthorName}} — {{.V2.CreatedAt.Format "Jan 2, 2006 3:04 PM"}}
-            {{if .V2.Message}}<em>({{.V2.Message}})</em>{{end}}
-        </div>
-    </div>
-    <div class="diff-view">
-        <table class="diff-table">
-            {{range .Lines}}
-            <tr class="diff-line diff-{{.Type}}">
-                <td class="diff-num">{{if .OldNum}}{{.OldNum}}{{end}}</td>
-                <td class="diff-num">{{if .NewNum}}{{.NewNum}}{{end}}</td>
-                <td class="diff-sign">{{if eq .Type "insert"}}+{{else if eq .Type "delete"}}-{{else}} {{end}}</td>
-                <td class="diff-content"><pre>{{.Content}}</pre></td>
-            </tr>
-            {{end}}
-        </table>
-    </div>
-</div>
-{{end}}
-{{end}}

templates/document_view.html

···
+{{template "base" .}}
+{{define "head"}}
+<link rel="stylesheet" href="/static/css/markdown.css">
+{{end}}
+
+{{define "content"}}
+{{with .Content}}
+<div class="file-view">
+    <div class="file-header">
+        <h2>{{.Doc.Title}}</h2>
+        <div class="file-actions">
+            <a href="/docs/{{.Doc.RKey}}/edit" class="btn btn-sm">Edit</a>
+            <button class="btn btn-sm btn-outline" onclick="deleteDocument('{{.Doc.RKey}}')">Delete</button>
+        </div>
+    </div>
+    <div class="markdown-body">
+        {{.Rendered}}
+    </div>
+</div>
+{{end}}
+{{end}}
+
+{{define "scripts"}}
+<script>
+async function deleteDocument(rkey) {
+    if (!confirm('Delete this document? This cannot be undone.')) return;
+    try {
+        const resp = await fetch('/api/docs/' + rkey, {method: 'DELETE'});
+        if (resp.ok) {
+            window.location.href = '/';
+        } else {
+            alert('Delete failed');
+        }
+    } catch (e) {
+        alert('Delete failed: ' + e.message);
+    }
+}
+</script>
+{{end}}

templates/documents.html

···
+{{template "base" .}}
+{{define "content"}}
+<div class="dashboard">
+    <div class="dashboard-header">
+        <h2>Your Documents</h2>
+        <a href="/docs/new" class="btn">New Document</a>
+    </div>
+    {{with .Content}}
+    <div class="repo-list">
+        {{range .}}
+        <a href="/docs/{{.RKey}}" class="repo-card">
+            <h3>{{.Title}}</h3>
+            {{if .UpdatedAt}}
+            <time>Updated {{.UpdatedAt}}</time>
+            {{else}}
+            <time>Created {{.PublishedAt}}</time>
+            {{end}}
+        </a>
+        {{else}}
+        <div class="empty-state">
+            <p>No documents yet.</p>
+            <a href="/docs/new" class="btn">Create your first document</a>
+        </div>
+        {{end}}
+    </div>
+    {{end}}
+</div>
+{{end}}

templates/editor.html templates/document_edit.html

···
 <div class="editor-page">
     <div class="editor-toolbar">
         <div class="breadcrumb">
-            <a href="/{{$.User.Name}}/{{.Repo.Slug}}">{{.Repo.Name}}</a>
+            <a href="/">Documents</a>
             <span>/</span>
-            <span>{{.File.Path}}</span>
+            <span>{{.Title}}</span>
         </div>
         <div class="toolbar-actions">
             <span id="save-status"></span>
-            <button class="btn btn-sm" id="btn-save" onclick="saveFile()">Save Version</button>
-            <a href="/{{$.User.Name}}/{{.Repo.Slug}}/{{.File.Path}}" class="btn btn-sm btn-outline">View</a>
-            <a href="/{{$.User.Name}}/{{.Repo.Slug}}/{{.File.Path}}/history" class="btn btn-sm btn-outline">History</a>
+            <button class="btn btn-sm" id="btn-save" onclick="saveDocument()">Save</button>
+            <a href="/docs/{{.RKey}}" class="btn btn-sm btn-outline">View</a>
         </div>
     </div>
     <div class="editor-split">
         <div class="editor-pane">
-            <textarea id="editor-textarea" style="display:none">{{.File.Content}}</textarea>
+            <textarea id="editor-textarea" style="display:none">{{if .Content}}{{.Content.Text.RawMarkdown}}{{end}}</textarea>
             <div id="editor"></div>
         </div>
         <div class="preview-pane">
···
     const textarea = document.getElementById('editor-textarea');
     const previewEl = document.getElementById('preview');
     const saveStatus = document.getElementById('save-status');
-    const fileID = '{{.Content.File.ID}}';
+    const rkey = '{{.Content.RKey}}';
 
     let autoSaveTimer = null;
 
···
         saveStatus.className = 'status-unsaved';
         autoSaveTimer = setTimeout(async () => {
             try {
-                await fetch(`/api/files/${fileID}/autosave`, {
+                await fetch(`/api/docs/${rkey}/autosave`, {
                     method: 'PUT',
                     headers: {'Content-Type': 'application/json'},
                     body: JSON.stringify({content}),
···
         }, 2000);
     }
 
-    window.saveFile = async function() {
+    window.saveDocument = async function() {
         const content = view.state.doc.toString();
-        const message = prompt('Version message (optional):') || '';
         try {
-            const resp = await fetch(`/api/files/${fileID}/save`, {
+            const resp = await fetch(`/api/docs/${rkey}/save`, {
                 method: 'POST',
                 headers: {'Content-Type': 'application/json'},
-                body: JSON.stringify({content, message}),
+                body: JSON.stringify({content}),
             });
             if (resp.ok) {
-                saveStatus.textContent = 'Version saved!';
+                saveStatus.textContent = 'Saved!';
                 saveStatus.className = 'status-saved';
             }
         } catch (e) {

templates/file_view.html

···
-{{template "base" .}}
-{{define "head"}}
-<link rel="stylesheet" href="/static/css/markdown.css">
-{{end}}
-
-{{define "content"}}
-{{with .Content}}
-<div class="file-page">
-    <div class="file-header">
-        <div class="breadcrumb">
-            <a href="/{{$.User.Name}}/{{.Repo.Slug}}">{{.Repo.Name}}</a>
-            <span>/</span>
-            <span>{{.File.Path}}</span>
-        </div>
-        <div class="file-actions">
-            <a href="/{{$.User.Name}}/{{.Repo.Slug}}/{{.File.Path}}/edit" class="btn btn-sm">Edit</a>
-            <a href="/{{$.User.Name}}/{{.Repo.Slug}}/{{.File.Path}}/history" class="btn btn-sm btn-outline">History</a>
-        </div>
-    </div>
-    <article class="markdown-body">
-        {{.Rendered}}
-    </article>
-</div>
-{{end}}
-{{end}}

templates/history.html

···
-{{template "base" .}}
-{{define "content"}}
-{{with .Content}}
-<div class="history-page">
-    <div class="file-header">
-        <div class="breadcrumb">
-            <a href="/{{$.User.Name}}/{{.Repo.Slug}}">{{.Repo.Name}}</a>
-            <span>/</span>
-            <a href="/{{$.User.Name}}/{{.Repo.Slug}}/{{.File.Path}}">{{.File.Path}}</a>
-            <span>/</span>
-            <span>History</span>
-        </div>
-        <a href="/{{$.User.Name}}/{{.Repo.Slug}}/{{.File.Path}}/edit" class="btn btn-sm">Edit</a>
-    </div>
-
-    <div class="version-list">
-        <form id="diff-form" class="diff-controls">
-            <button type="submit" class="btn btn-sm" disabled id="diff-btn">Compare Selected</button>
-        </form>
-        <table class="version-table">
-            <thead>
-                <tr>
-                    <th></th>
-                    <th></th>
-                    <th>Author</th>
-                    <th>Message</th>
-                    <th>Date</th>
-                </tr>
-            </thead>
-            <tbody>
-                {{range .Versions}}
-                <tr>
-                    <td><input type="radio" name="v1" value="{{.ID}}" onchange="checkDiff()"></td>
-                    <td><input type="radio" name="v2" value="{{.ID}}" onchange="checkDiff()"></td>
-                    <td>{{.AuthorName}}</td>
-                    <td>{{if .Message}}{{.Message}}{{else}}<em>No message</em>{{end}}</td>
-                    <td>{{.CreatedAt.Format "Jan 2, 2006 3:04 PM"}}</td>
-                </tr>
-                {{else}}
-                <tr><td colspan="5">No versions saved yet.</td></tr>
-                {{end}}
-            </tbody>
-        </table>
-    </div>
-</div>
-{{end}}
-{{end}}
-
-{{define "scripts"}}
-<script>
-function checkDiff() {
-    const v1 = document.querySelector('input[name=v1]:checked');
-    const v2 = document.querySelector('input[name=v2]:checked');
-    const btn = document.getElementById('diff-btn');
-    btn.disabled = !(v1 && v2 && v1.value !== v2.value);
-}
-
-document.getElementById('diff-form').addEventListener('submit', function(e) {
-    e.preventDefault();
-    const v1 = document.querySelector('input[name=v1]:checked').value;
-    const v2 = document.querySelector('input[name=v2]:checked').value;
-    location.href = `/diff/${v1}/${v2}`;
-});
-</script>
-{{end}}

templates/new_document.html

···
+{{template "base" .}}
+{{define "content"}}
+<div class="form-page">
+    <h2>New Document</h2>
+    <form method="post" action="/docs/new">
+        <div class="form-group">
+            <label for="title">Title</label>
+            <input type="text" id="title" name="title" required autofocus placeholder="My Document">
+        </div>
+        <button type="submit" class="btn">Create Document</button>
+    </form>
+</div>
+{{end}}

templates/new_repo.html

···
-{{template "base" .}}
-{{define "content"}}
-<div class="auth-page">
-    <h2>New Repository</h2>
-    <form method="post" action="/new" class="auth-form">
-        <label>Name
-            <input type="text" name="name" required autofocus placeholder="my-docs">
-        </label>
-        <label>Description
-            <textarea name="description" rows="3" placeholder="What are these docs for?"></textarea>
-        </label>
-        <label>Visibility
-            <select name="visibility">
-                <option value="private">Private</option>
-                <option value="public">Public</option>
-                <option value="unlisted">Unlisted</option>
-            </select>
-        </label>
-        <button type="submit" class="btn">Create Repository</button>
-    </form>
-</div>
-{{end}}

templates/repo.html

···
-{{template "base" .}}
-{{define "content"}}
-{{with .Content}}
-<div class="repo-page">
-    <div class="repo-header">
-        <h2>{{.Repo.Name}}</h2>
-        <p>{{.Repo.Description}}</p>
-    </div>
-    <div class="file-browser">
-        <div class="file-browser-header">
-            <span>Files</span>
-            <button class="btn btn-sm" onclick="newFileDialog()">New File</button>
-        </div>
-        <ul class="file-list">
-            {{$repo := .Repo}}
-            {{range .Files}}
-            <li>
-                <a href="/{{$.User.Name}}/{{$repo.Slug}}/{{.Path}}">{{.Path}}</a>
-                <div class="file-actions">
-                    <a href="/{{$.User.Name}}/{{$repo.Slug}}/{{.Path}}/edit" class="btn btn-sm">Edit</a>
-                    <a href="/{{$.User.Name}}/{{$repo.Slug}}/{{.Path}}/history" class="btn btn-sm btn-outline">History</a>
-                </div>
-            </li>
-            {{else}}
-            <li class="empty-state">No files yet</li>
-            {{end}}
-        </ul>
-    </div>
-</div>
-
-<dialog id="new-file-dialog">
-    <form method="dialog">
-        <h3>New File</h3>
-        <label>File path
-            <input type="text" id="new-file-path" placeholder="docs/guide.md" required>
-        </label>
-        <div class="dialog-actions">
-            <button type="button" class="btn btn-outline" onclick="this.closest('dialog').close()">Cancel</button>
-            <button type="button" class="btn" onclick="createFile()">Create</button>
-        </div>
-    </form>
-</dialog>
-{{end}}
-{{end}}
-
-{{define "scripts"}}
-<script>
-function newFileDialog() {
-    document.getElementById('new-file-dialog').showModal();
-}
-
-async function createFile() {
-    const path = document.getElementById('new-file-path').value;
-    if (!path) return;
-
-    const repoID = '{{.Content.Repo.ID}}';
-    const resp = await fetch('/api/files', {
-        method: 'POST',
-        headers: {'Content-Type': 'application/json'},
-        body: JSON.stringify({repo_id: repoID, path: path})
-    });
-
-    if (resp.ok) {
-        location.reload();
-    }
-}
-</script>
-{{end}}