lower cached plc hits to 8 hours

go.mod

···
 	github.com/bluesky-social/indigo v0.0.0-20251021193747-543ab1124beb
 	github.com/distribution/distribution/v3 v3.0.0
 	github.com/distribution/reference v0.6.0
+	github.com/earthboundkid/versioninfo/v2 v2.24.1
 	github.com/go-chi/chi/v5 v5.2.3
 	github.com/golang-jwt/jwt/v5 v5.2.2
 	github.com/google/uuid v1.6.0
···
 	github.com/docker/docker-credential-helpers v0.8.2 // indirect
 	github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c // indirect
 	github.com/docker/go-metrics v0.0.1 // indirect
-	github.com/earthboundkid/versioninfo/v2 v2.24.1 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/go-jose/go-jose/v4 v4.1.2 // indirect
 	github.com/go-logr/logr v1.4.2 // indirect

pkg/appview/jetstream/processor.go

···
 func NewProcessor(database *sql.DB, useCache bool) *Processor {
 	p := &Processor{
 		db:        database,
-		directory: identity.DefaultDirectory(),
+		directory: atproto.GetDirectory(),
 		useCache:  useCache,
 	}
 

pkg/appview/middleware/registry.go

···
 
 // initATProtoResolver initializes the name resolution middleware
 func initATProtoResolver(ctx context.Context, ns distribution.Namespace, _ driver.StorageDriver, options map[string]any) (distribution.Namespace, error) {
-	// Use indigo's default directory (includes caching)
-	directory := identity.DefaultDirectory()
+	// Use shared directory with 8h cache TTL
+	directory := atproto.GetDirectory()
 
 	// Get default hold DID from config (required)
 	// Expected format: "did:web:hold01.atcr.io"

pkg/appview/ui.go

···
 }
 
 // StaticSubdir returns an fs.FS for a subdirectory within static/
-func StaticSubdir(name string) http.Handler  {
+func StaticSubdir(name string) http.Handler {
 	sub, err := fs.Sub(staticFS, "static/"+name)
 	if err != nil {
 		panic(err)

pkg/auth/oauth/client.go

···
 	return &App{
 		clientApp: clientApp,
 		baseURL:   baseURL,
-		directory: identity.DefaultDirectory(),
+		directory: atproto.GetDirectory(),
 	}, nil
 }
 
···
 
 	return true
 }
+
+// ResolveDIDToPDS resolves a DID to its PDS endpoint (for reference)
+// This is an alternative approach if we don't trust the token's issuer claim
+func ResolveDIDToPDS(ctx context.Context, did string) (string, error) {
+	directory := atproto.GetDirectory()
+	didParsed, err := syntax.ParseDID(did)
+	if err != nil {
+		return "", fmt.Errorf("invalid DID: %w", err)
+	}
+
+	ident, err := directory.LookupDID(ctx, didParsed)
+	if err != nil {
+		return "", fmt.Errorf("failed to resolve DID: %w", err)
+	}
+
+	pdsEndpoint := ident.PDSEndpoint()
+	if pdsEndpoint == "" {
+		return "", fmt.Errorf("no PDS endpoint found for DID")
+	}
+
+	return pdsEndpoint, nil
+}

pkg/auth/session.go

···
 // NewSessionValidator creates a new ATProto session validator
 func NewSessionValidator() *SessionValidator {
 	return &SessionValidator{
-		directory:  identity.DefaultDirectory(),
+		directory:  atproto.GetDirectory(),
 		httpClient: &http.Client{},
 		cache:      make(map[string]*CachedSession),
 	}

pkg/auth/token/handler.go

···
 	"strings"
 	"time"
 
-	"github.com/bluesky-social/indigo/atproto/identity"
 	"github.com/bluesky-social/indigo/atproto/syntax"
 
 	"atcr.io/pkg/appview/db"
+	"atcr.io/pkg/atproto"
 	"atcr.io/pkg/auth"
 )
 
···
 		// Call post-auth callback for AppView business logic (profile management, etc.)
 		if h.postAuthCallback != nil {
 			// Resolve PDS endpoint for callback
-			directory := identity.DefaultDirectory()
+			directory := atproto.GetDirectory()
 			atID, err := syntax.ParseAtIdentifier(username)
 			if err == nil {
 				ident, err := directory.Lookup(r.Context(), *atID)

pkg/hold/pds/auth.go

···
 
 	"atcr.io/pkg/atproto"
 	"github.com/bluesky-social/indigo/atproto/atcrypto"
-	"github.com/bluesky-social/indigo/atproto/identity"
 	"github.com/bluesky-social/indigo/atproto/syntax"
 	"github.com/golang-jwt/jwt/v5"
 )
···
 	}
 
 	return &session, nil
-}
-
-// ResolveDIDToPDS resolves a DID to its PDS endpoint (for reference)
-// This is an alternative approach if we don't trust the token's issuer claim
-func ResolveDIDToPDS(ctx context.Context, did string) (string, error) {
-	directory := identity.DefaultDirectory()
-	didParsed, err := syntax.ParseDID(did)
-	if err != nil {
-		return "", fmt.Errorf("invalid DID: %w", err)
-	}
-
-	ident, err := directory.LookupDID(ctx, didParsed)
-	if err != nil {
-		return "", fmt.Errorf("failed to resolve DID: %w", err)
-	}
-
-	pdsEndpoint := ident.PDSEndpoint()
-	if pdsEndpoint == "" {
-		return "", fmt.Errorf("no PDS endpoint found for DID")
-	}
-
-	return pdsEndpoint, nil
 }
 
 // ValidateOwnerOrCrewAdmin validates that the request has valid authentication
···
 // Returns the atcrypto.PublicKey for signature verification
 func fetchPublicKeyFromDID(ctx context.Context, did string) (atcrypto.PublicKey, error) {
 	// Use indigo's identity resolution
-	directory := identity.DefaultDirectory()
+	directory := atproto.GetDirectory()
 	atID, err := syntax.ParseAtIdentifier(did)
 	if err != nil {
 		return nil, fmt.Errorf("invalid DID format: %w", err)