use chi/render to simplify returned json

.golangci.yml

···
           - errcheck
 
       # TODO: fix issues and remove these paths one by one
-      - path: pkg/auth
-        linters:
-          - errcheck
-      - path: pkg/appview
-        linters:
-          - errcheck
       - path: cmd/credential-helper
         linters:
           - errcheck

.tangled/workflows/lint.yaml

···
       CGO_ENABLED: 1
     command: |
       go mod download
+      go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.7.2
       go generate ./...
 
   - name: Run Linter
     environment:
       CGO_ENABLED: 1
     command: |
-      curl -sSfL https://golangci-lint.run/install.sh | sh -s -- -b $(go env GOPATH)/bin v2.7.2
       golangci-lint run ./...

go.mod

···
 	github.com/distribution/reference v0.6.0
 	github.com/earthboundkid/versioninfo/v2 v2.24.1
 	github.com/go-chi/chi/v5 v5.2.3
+	github.com/go-chi/render v1.0.3
 	github.com/goki/freetype v1.0.5
 	github.com/golang-jwt/jwt/v5 v5.2.2
 	github.com/google/uuid v1.6.0
···
 
 require (
 	github.com/RussellLuo/slidingwindow v0.0.0-20200528002341-535bb99d338b // indirect
+	github.com/ajg/form v1.5.1 // indirect
 	github.com/aymerick/douceur v0.2.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/bshuster-repo/logrus-logstash-hook v1.0.0 // indirect

go.sum

···
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/RussellLuo/slidingwindow v0.0.0-20200528002341-535bb99d338b h1:5/++qT1/z812ZqBvqQt6ToRswSuPZ/B33m6xVHRzADU=
 github.com/RussellLuo/slidingwindow v0.0.0-20200528002341-535bb99d338b/go.mod h1:4+EPqMRApwwE/6yo6CxiHoSnBzjRr3jsqer7frxP8y4=
+github.com/ajg/form v1.5.1 h1:t9c7v8JUKu/XxOGBU0yjNpaMloxGEJhUkqFRq0ibGeU=
+github.com/ajg/form v1.5.1/go.mod h1:uL1WgH+h2mgNtvBq0339dVnzXdBETtL2LeUXaIv25UY=
 github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
 github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
 github.com/alexbrainman/goissue34681 v0.0.0-20191006012335-3fc7a47baff5 h1:iW0a5ljuFxkLGPNem5Ui+KBjFJzKg4Fv2fnxe4dvzpM=
···
 github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
 github.com/go-chi/chi/v5 v5.2.3 h1:WQIt9uxdsAbgIYgid+BpYc+liqQZGMHRaUwp0JUcvdE=
 github.com/go-chi/chi/v5 v5.2.3/go.mod h1:L2yAIGWB3H+phAw1NxKwWM+7eUH/lU8pOMm5hHcoops=
+github.com/go-chi/render v1.0.3 h1:AsXqd2a1/INaIfUSKq3G5uA8weYx20FOsM7uSoCyyt4=
+github.com/go-chi/render v1.0.3/go.mod h1:/gr3hVkmYR0YlEy3LxCuVRFzEu9Ruok+gFqbIofjao0=
 github.com/go-jose/go-jose/v4 v4.1.2 h1:TK/7NqRQZfgAh+Td8AlsrvtPoUyiHh0LqVvokh+1vHI=
 github.com/go-jose/go-jose/v4 v4.1.2/go.mod h1:22cg9HWM1pOlnRiY+9cQYJ9XHmya1bYW8OeDM6Ku6Oo=
 github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=

pkg/appview/handlers/api.go

···
 
 import (
 	"database/sql"
-	"encoding/json"
 	"errors"
 	"fmt"
 	"log/slog"
···
 	"atcr.io/pkg/auth/oauth"
 	"github.com/bluesky-social/indigo/atproto/identity"
 	"github.com/go-chi/chi/v5"
+	"github.com/go-chi/render"
 )
 
 // StarRepositoryHandler handles starring a repository
···
 	}
 
 	// Return success
-	w.Header().Set("Content-Type", "application/json")
 	w.WriteHeader(http.StatusCreated)
-	json.NewEncoder(w).Encode(map[string]bool{"starred": true})
+	render.JSON(w, r, map[string]bool{"starred": true})
 }
 
 // UnstarRepositoryHandler handles unstarring a repository
···
 	}
 
 	// Return success
-	w.Header().Set("Content-Type", "application/json")
-	json.NewEncoder(w).Encode(map[string]bool{"starred": false})
+	render.JSON(w, r, map[string]bool{"starred": false})
 }
 
 // CheckStarHandler checks if current user has starred a repository
···
 	user := middleware.GetUser(r)
 	if user == nil {
 		// Not authenticated - return not starred
-		w.Header().Set("Content-Type", "application/json")
-		json.NewEncoder(w).Encode(map[string]bool{"starred": false})
+		render.JSON(w, r, map[string]bool{"starred": false})
 		return
 	}
 
···
 	// Check if OAuth error - if so, invalidate sessions
 	if err != nil && handleOAuthError(r.Context(), h.Refresher, user.DID, err) {
 		// For a read operation, just return not starred instead of error
-		w.Header().Set("Content-Type", "application/json")
-		json.NewEncoder(w).Encode(map[string]bool{"starred": false})
+		render.JSON(w, r, map[string]bool{"starred": false})
 		return
 	}
 
 	starred := err == nil
 
 	// Return result
-	w.Header().Set("Content-Type", "application/json")
-	json.NewEncoder(w).Encode(map[string]bool{"starred": starred})
+	render.JSON(w, r, map[string]bool{"starred": starred})
 }
 
 // GetStatsHandler returns repository statistics
···
 	}
 
 	// Return stats as JSON
-	w.Header().Set("Content-Type", "application/json")
-	json.NewEncoder(w).Encode(stats)
+	render.JSON(w, r, stats)
 }
 
 // ManifestDetailHandler returns detailed manifest information including platforms
···
 	}
 
 	// Return manifest as JSON
-	w.Header().Set("Content-Type", "application/json")
-	json.NewEncoder(w).Encode(manifest)
+	render.JSON(w, r, manifest)
 }
 
 // CredentialHelperVersionResponse is the response for the credential helper version API
···
 		Checksums:    h.Checksums,
 	}
 
-	w.Header().Set("Content-Type", "application/json")
+	render.SetContentType(render.ContentTypeJSON)
 	w.Header().Set("Cache-Control", "public, max-age=300") // Cache for 5 minutes
-	json.NewEncoder(w).Encode(response)
+	render.JSON(w, r, response)
 }

pkg/appview/handlers/device.go

···
 package handlers
 
 import (
-	"encoding/json"
 	"fmt"
 	"html/template"
 	"log/slog"
···
 	"net/url"
 	"strings"
 
+	"atcr.io/pkg/appview/db"
 	"github.com/go-chi/chi/v5"
-
-	"atcr.io/pkg/appview/db"
+	"github.com/go-chi/render"
 )
 
 // DeviceCodeRequest is the request to start device authorization
···
 	}
 
 	var req DeviceCodeRequest
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+	if err := render.Decode(r, &req); err != nil {
 		http.Error(w, "invalid request", http.StatusBadRequest)
 		return
 	}
···
 		Interval:        5,   // Poll every 5 seconds
 	}
 
-	w.Header().Set("Content-Type", "application/json")
-	json.NewEncoder(w).Encode(resp)
+	render.JSON(w, r, resp)
 }
 
 // DeviceTokenRequest is the request to poll for device authorization
···
 	}
 
 	var req DeviceTokenRequest
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+	if err := render.Decode(r, &req); err != nil {
 		http.Error(w, "invalid request", http.StatusBadRequest)
 		return
 	}
···
 		resp := DeviceTokenResponse{
 			Error: "expired_token",
 		}
-		w.Header().Set("Content-Type", "application/json")
-		json.NewEncoder(w).Encode(resp)
+		render.JSON(w, r, resp)
 		return
 	}
 
···
 		resp := DeviceTokenResponse{
 			Error: "authorization_pending",
 		}
-		w.Header().Set("Content-Type", "application/json")
-		json.NewEncoder(w).Encode(resp)
+		render.JSON(w, r, resp)
 		return
 	}
 
···
 		DID:          *pending.ApprovedDID,
 	}
 
-	w.Header().Set("Content-Type", "application/json")
-	json.NewEncoder(w).Encode(resp)
+	render.JSON(w, r, resp)
 }
 
 // DeviceApprovalPageHandler handles GET /device
···
 	}
 
 	var req DeviceApproveRequest
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+	if err := render.Decode(r, &req); err != nil {
 		http.Error(w, "invalid request", http.StatusBadRequest)
 		return
 	}
 
 	if !req.Approve {
 		// User denied
-		w.Header().Set("Content-Type", "application/json")
-		json.NewEncoder(w).Encode(map[string]string{"status": "denied"})
+		render.JSON(w, r, map[string]string{"status": "denied"})
 		return
 	}
 
···
 		http.Error(w, fmt.Sprintf("failed to approve: %v", err), http.StatusInternalServerError)
 		return
 	}
-	w.Header().Set("Content-Type", "application/json")
-	json.NewEncoder(w).Encode(map[string]string{"status": "approved"})
+	render.JSON(w, r, map[string]string{"status": "approved"})
 }
 
 // ListDevicesHandler handles GET /api/devices
···
 	// Get devices for this user
 	devices := h.Store.ListDevices(sess.DID)
 
-	w.Header().Set("Content-Type", "application/json")
-	json.NewEncoder(w).Encode(devices)
+	render.JSON(w, r, devices)
 }
 
 // RevokeDeviceHandler handles DELETE /api/devices/{id}

pkg/appview/handlers/images.go

···
 	"atcr.io/pkg/atproto"
 	"atcr.io/pkg/auth/oauth"
 	"github.com/go-chi/chi/v5"
+	"github.com/go-chi/render"
 )
 
 // DeleteTagHandler handles deleting a tag
···
 			return
 		}
 
-		w.Header().Set("Content-Type", "application/json")
-		w.WriteHeader(http.StatusConflict)
-		json.NewEncoder(w).Encode(map[string]any{
+		render.Status(r, http.StatusConflict)
+		render.JSON(w, r, map[string]any{
 			"error":   "confirmation_required",
 			"message": "This manifest has associated tags that will also be deleted",
 			"tags":    tags,
···
 
 	// Return new avatar URL
 	avatarURL := atproto.BlobCDNURL(user.DID, blobRef.Ref.Link)
-	w.Header().Set("Content-Type", "application/json")
-	json.NewEncoder(w).Encode(map[string]string{"avatarURL": avatarURL})
+	render.JSON(w, r, map[string]string{"avatarURL": avatarURL})
 }

pkg/auth/token/handler.go

···
 
 import (
 	"context"
-	"encoding/json"
 	"errors"
 	"fmt"
 	"log/slog"
···
 	"atcr.io/pkg/appview/db"
 	"atcr.io/pkg/atproto"
 	"atcr.io/pkg/auth"
+	"github.com/go-chi/render"
 )
 
 // PostAuthCallback is called after successful Basic Auth authentication.
···
 		Message:  "OAuth session expired or invalidated. Please re-authenticate in your browser.",
 		LoginURL: loginURL,
 	}
-	json.NewEncoder(w).Encode(resp)
+	render.JSON(w, r, resp)
 }
 
 // ServeHTTP handles the token request
···
 		IssuedAt:    now.Format(time.RFC3339),
 	}
 
-	w.Header().Set("Content-Type", "application/json")
-	if err := json.NewEncoder(w).Encode(resp); err != nil {
-		http.Error(w, fmt.Sprintf("failed to encode response: %v", err), http.StatusInternalServerError)
-		return
-	}
+	render.JSON(w, r, resp)
 }

pkg/hold/admin/handlers.go

···
 package admin
 
 import (
-	"encoding/json"
 	"log/slog"
 	"net/http"
 	"sort"
 	"strconv"
 
 	"atcr.io/pkg/atproto"
+	"github.com/go-chi/render"
 )
 
 // DashboardStats contains dashboard statistics
···
 	}
 
 	// Otherwise return JSON
-	w.Header().Set("Content-Type", "application/json")
-	if err := json.NewEncoder(w).Encode(stats); err != nil {
-		slog.Error("failed to encode json to http response", "error", err, "path", r.URL.Path)
-		w.WriteHeader(http.StatusInternalServerError)
-	}
+	render.JSON(w, r, stats)
 }
 
 // UserUsage represents storage usage for a user
···
 	}
 
 	// Otherwise return JSON
-	w.Header().Set("Content-Type", "application/json")
-	if err := json.NewEncoder(w).Encode(users); err != nil {
-		slog.Error("failed to encode json to http response", "error", err, "path", r.URL.Path)
-		w.WriteHeader(http.StatusInternalServerError)
-	}
+	render.JSON(w, r, users)
 }

pkg/hold/admin/handlers_auth.go

···
 	token, err := ui.createSession(did, handle)
 	if err != nil {
 		slog.Error("failed to create session token", "error", err, "path", r.URL.Path)
-		w.WriteHeader(http.StatusInternalServerError)
+		http.Error(w, "Failed to create session", http.StatusInternalServerError)
 		return
 	}
 	ui.setSessionCookie(w, r, token)

pkg/hold/admin/handlers_crew.go

···
 		if tier != "" {
 			if err := ui.pds.UpdateCrewMemberTier(ctx, current.Member, tier); err != nil {
 				slog.Error("failed to update crew member tier", "error", err, "path", r.URL.Path)
-				w.WriteHeader(http.StatusInternalServerError)
+				http.Error(w, "Failed to update tier", http.StatusInternalServerError)
 				return
 			}
 		}

pkg/hold/oci/helpers_test.go

···
-package oci
-
-import (
-	"testing"
-)
-
-// Tests for helper functions
-func TestNormalizeETag(t *testing.T) {
-	tests := []struct {
-		name     string
-		etag     string
-		expected string
-	}{
-		{
-			name:     "etag without quotes",
-			etag:     "abc123",
-			expected: "\"abc123\"",
-		},
-		{
-			name:     "etag already has quotes",
-			etag:     "\"abc123\"",
-			expected: "\"abc123\"",
-		},
-		{
-			name:     "empty etag",
-			etag:     "",
-			expected: "\"\"",
-		},
-		{
-			name:     "etag with special characters",
-			etag:     "abc-123_def",
-			expected: "\"abc-123_def\"",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := normalizeETag(tt.etag)
-			if result != tt.expected {
-				t.Errorf("Expected %s, got %s", tt.expected, result)
-			}
-		})
-	}
-}

pkg/hold/oci/http_helpers.go

···
-// Package oci provides HTTP helpers for OCI registry endpoints in the hold service.
-// It includes utilities for JSON encoding/decoding of request/response bodies
-// and standardized error responses for XRPC endpoints.
-package oci
-
-import (
-	"encoding/json"
-	"fmt"
-	"log/slog"
-	"net/http"
-)
-
-// DecodeJSON decodes JSON request body into the provided value
-// Returns an error if decoding fails
-func DecodeJSON(r *http.Request, v any) error {
-	if err := json.NewDecoder(r.Body).Decode(v); err != nil {
-		return fmt.Errorf("invalid JSON body: %w", err)
-	}
-	return nil
-}
-
-// RespondJSON writes a JSON response with the given status code
-func RespondJSON(w http.ResponseWriter, status int, v any) {
-	w.Header().Set("Content-Type", "application/json")
-	w.WriteHeader(status)
-	if err := json.NewEncoder(w).Encode(v); err != nil {
-		// If encoding fails, we can't do much since headers are already sent
-		// Log the error but don't try to send another response
-		slog.Error("Failed to encode JSON response", "error", err)
-	}
-}
-
-// RespondError writes a JSON error response with the given status code and message
-func RespondError(w http.ResponseWriter, status int, message string) {
-	RespondJSON(w, status, map[string]string{
-		"error": message,
-	})
-}

pkg/hold/oci/multipart_test.go

···
 		t.Error("Recent session should still exist")
 	}
 }
+
+// Tests for helper functions
+func TestNormalizeETag(t *testing.T) {
+	tests := []struct {
+		name     string
+		etag     string
+		expected string
+	}{
+		{
+			name:     "etag without quotes",
+			etag:     "abc123",
+			expected: "\"abc123\"",
+		},
+		{
+			name:     "etag already has quotes",
+			etag:     "\"abc123\"",
+			expected: "\"abc123\"",
+		},
+		{
+			name:     "empty etag",
+			etag:     "",
+			expected: "\"\"",
+		},
+		{
+			name:     "etag with special characters",
+			etag:     "abc-123_def",
+			expected: "\"abc-123_def\"",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := normalizeETag(tt.etag)
+			if result != tt.expected {
+				t.Errorf("Expected %s, got %s", tt.expected, result)
+			}
+		})
+	}
+}

pkg/hold/oci/xrpc.go

···
+// Package oci provides OCI registry endpoints for the hold service.
 package oci
 
 import (
···
 	"atcr.io/pkg/s3"
 	storagedriver "github.com/distribution/distribution/v3/registry/storage/driver"
 	"github.com/go-chi/chi/v5"
+	"github.com/go-chi/render"
 )
 
 // XRPCHandler handles OCI-specific XRPC endpoints for multipart uploads
···
 		Digest string `json:"digest"`
 	}
 
-	if err := DecodeJSON(r, &req); err != nil {
-		RespondError(w, http.StatusBadRequest, err.Error())
+	if err := render.Decode(r, &req); err != nil {
+		render.Status(r, http.StatusBadRequest)
+		render.JSON(w, r, map[string]string{"error": err.Error()})
 		return
 	}
 
 	if req.Digest == "" {
-		RespondError(w, http.StatusBadRequest, "digest is required")
+		render.Status(r, http.StatusBadRequest)
+		render.JSON(w, r, map[string]string{"error": "digest is required"})
 		return
 	}
 
 	uploadID, _, err := h.StartMultipartUploadWithManager(r.Context(), req.Digest)
 	if err != nil {
-		RespondError(w, http.StatusInternalServerError, fmt.Sprintf("failed to initiate upload: %v", err))
+		render.Status(r, http.StatusInternalServerError)
+		render.JSON(w, r, map[string]string{"error": fmt.Sprintf("failed to initiate upload: %v", err)})
 		return
 	}
 
-	RespondJSON(w, http.StatusOK, map[string]any{
+	render.JSON(w, r, map[string]any{
 		"uploadId": uploadID,
 	})
 }
···
 		PartNumber int    `json:"partNumber"`
 	}
 
-	if err := DecodeJSON(r, &req); err != nil {
-		RespondError(w, http.StatusBadRequest, err.Error())
+	if err := render.Decode(r, &req); err != nil {
+		render.Status(r, http.StatusBadRequest)
+		render.JSON(w, r, map[string]string{"error": err.Error()})
 		return
 	}
 
 	if req.UploadID == "" || req.PartNumber == 0 {
-		RespondError(w, http.StatusBadRequest, "uploadId and partNumber are required")
+		render.Status(r, http.StatusBadRequest)
+		render.JSON(w, r, map[string]string{"error": "uploadId and partNumber are required"})
 		return
 	}
 
 	uploadInfo, err := h.GetPartUploadURL(r.Context(), req.UploadID, req.PartNumber)
 	if err != nil {
-		RespondError(w, http.StatusInternalServerError, fmt.Sprintf("failed to get part upload URL: %v", err))
+		render.Status(r, http.StatusInternalServerError)
+		render.JSON(w, r, map[string]string{"error": fmt.Sprintf("failed to get part upload URL: %v", err)})
 		return
 	}
 
-	RespondJSON(w, http.StatusOK, uploadInfo)
+	render.JSON(w, r, uploadInfo)
 }
 
 // HandleUploadPart handles direct buffered part uploads
···
 	partNumberStr := r.Header.Get("X-Part-Number")
 
 	if uploadID == "" || partNumberStr == "" {
-		RespondError(w, http.StatusBadRequest, "X-Upload-Id and X-Part-Number headers are required")
+		render.Status(r, http.StatusBadRequest)
+		render.JSON(w, r, map[string]string{"error": "X-Upload-Id and X-Part-Number headers are required"})
 		return
 	}
 
 	partNumber, err := strconv.Atoi(partNumberStr)
 	if err != nil {
-		RespondError(w, http.StatusBadRequest, fmt.Sprintf("invalid part number: %v", err))
+		render.Status(r, http.StatusBadRequest)
+		render.JSON(w, r, map[string]string{"error": fmt.Sprintf("invalid part number: %v", err)})
 		return
 	}
 
 	data, err := io.ReadAll(r.Body)
 	if err != nil {
-		RespondError(w, http.StatusInternalServerError, fmt.Sprintf("failed to read part data: %v", err))
+		render.Status(r, http.StatusInternalServerError)
+		render.JSON(w, r, map[string]string{"error": fmt.Sprintf("failed to read part data: %v", err)})
 		return
 	}
 
 	etag, err := h.HandleBufferedPartUpload(r.Context(), uploadID, partNumber, data)
 	if err != nil {
-		RespondError(w, http.StatusInternalServerError, fmt.Sprintf("failed to upload part: %v", err))
+		render.Status(r, http.StatusInternalServerError)
+		render.JSON(w, r, map[string]string{"error": fmt.Sprintf("failed to upload part: %v", err)})
 		return
 	}
 
-	RespondJSON(w, http.StatusOK, map[string]any{
+	render.JSON(w, r, map[string]any{
 		"etag": etag,
 	})
 }
···
 		Parts    []PartInfo `json:"parts"`
 	}
 
-	if err := DecodeJSON(r, &req); err != nil {
-		RespondError(w, http.StatusBadRequest, err.Error())
+	if err := render.Decode(r, &req); err != nil {
+		render.Status(r, http.StatusBadRequest)
+		render.JSON(w, r, map[string]string{"error": err.Error()})
 		return
 	}
 
 	if req.UploadID == "" || req.Digest == "" || len(req.Parts) == 0 {
-		RespondError(w, http.StatusBadRequest, "uploadId, digest, and parts are required")
+		render.Status(r, http.StatusBadRequest)
+		render.JSON(w, r, map[string]string{"error": "uploadId, digest, and parts are required"})
 		return
 	}
 
 	err := h.CompleteMultipartUploadWithManager(r.Context(), req.UploadID, req.Digest, req.Parts)
 	if err != nil {
-		RespondError(w, http.StatusInternalServerError, fmt.Sprintf("failed to complete upload: %v", err))
+		render.Status(r, http.StatusInternalServerError)
+		render.JSON(w, r, map[string]string{"error": fmt.Sprintf("failed to complete upload: %v", err)})
 		return
 	}
 
-	RespondJSON(w, http.StatusOK, map[string]any{
+	render.JSON(w, r, map[string]any{
 		"status": "completed",
 		"digest": req.Digest,
 	})
···
 		UploadID string `json:"uploadId"`
 	}
 
-	if err := DecodeJSON(r, &req); err != nil {
-		RespondError(w, http.StatusBadRequest, err.Error())
+	if err := render.Decode(r, &req); err != nil {
+		render.Status(r, http.StatusBadRequest)
+		render.JSON(w, r, map[string]string{"error": err.Error()})
 		return
 	}
 
 	if req.UploadID == "" {
-		RespondError(w, http.StatusBadRequest, "uploadId is required")
+		render.Status(r, http.StatusBadRequest)
+		render.JSON(w, r, map[string]string{"error": "uploadId is required"})
 		return
 	}
 
 	err := h.AbortMultipartUploadWithManager(r.Context(), req.UploadID)
 	if err != nil {
-		RespondError(w, http.StatusInternalServerError, fmt.Sprintf("failed to abort upload: %v", err))
+		render.Status(r, http.StatusInternalServerError)
+		render.JSON(w, r, map[string]string{"error": fmt.Sprintf("failed to abort upload: %v", err)})
 		return
 	}
 
-	RespondJSON(w, http.StatusOK, map[string]any{
+	render.JSON(w, r, map[string]any{
 		"status": "aborted",
 	})
 }
···
 	// Validate service token (same auth as blob:write endpoints)
 	validatedUser, err := pds.ValidateBlobWriteAccess(r, h.pds, h.httpClient)
 	if err != nil {
-		RespondError(w, http.StatusForbidden, fmt.Sprintf("authorization failed: %v", err))
+		render.Status(r, http.StatusForbidden)
+		render.JSON(w, r, map[string]string{"error": fmt.Sprintf("authorization failed: %v", err)})
 		return
 	}
 
···
 		} `json:"manifest"`
 	}
 
-	if err := DecodeJSON(r, &req); err != nil {
-		RespondError(w, http.StatusBadRequest, err.Error())
+	if err := render.Decode(r, &req); err != nil {
+		render.Status(r, http.StatusBadRequest)
+		render.JSON(w, r, map[string]string{"error": err.Error()})
 		return
 	}
 
···
 
 	// Validate operation
 	if operation != "push" && operation != "pull" {
-		RespondError(w, http.StatusBadRequest, fmt.Sprintf("invalid operation: %s (must be 'push' or 'pull')", operation))
+		render.Status(r, http.StatusBadRequest)
+		render.JSON(w, r, map[string]string{"error": fmt.Sprintf("invalid operation: %s (must be 'push' or 'pull')", operation)})
 		return
 	}
 
···
 	// For pulls: userDID is the repo owner (for stats), but the token belongs to the puller
 	// This allows anyone to pull from a public repo and have stats tracked under the owner
 	if operation == "push" && req.UserDID != validatedUser.DID {
-		RespondError(w, http.StatusForbidden, "user DID mismatch")
+		render.Status(r, http.StatusForbidden)
+		render.JSON(w, r, map[string]string{"error": "user DID mismatch"})
 		return
 	}
 
···
 				"repository", req.Repository,
 				"tag", req.Tag,
 			)
-			RespondError(w, http.StatusForbidden, fmt.Sprintf(
+			render.Status(r, http.StatusForbidden)
+			render.JSON(w, r, map[string]string{"error": fmt.Sprintf(
 				"quota exceeded: current=%d bytes, limit=%d bytes. Delete images to free space.",
 				stats.TotalSize, *stats.Limit,
-			))
+			)})
 			return
 		}
 
···
 		}
 	}
 
-	RespondJSON(w, http.StatusOK, resp)
+	render.JSON(w, r, resp)
 }
 
 // requireBlobWriteAccess middleware - validates DPoP + OAuth and checks for blob:write permission

pkg/hold/pds/records.go

···
 CREATE INDEX IF NOT EXISTS idx_records_collection_did ON records(collection, did);
 `
 
-// Schema version for migration detection
-const recordsSchemaVersion = 2
-
 // NewRecordsIndex creates or opens a records index
 // If the schema is outdated (missing did column), drops and rebuilds the table
 func NewRecordsIndex(dbPath string) (*RecordsIndex, error) {

pkg/hold/pds/xrpc.go

···
 	"github.com/bluesky-social/indigo/repo"
 	"github.com/distribution/distribution/v3/registry/storage/driver"
 	"github.com/go-chi/chi/v5"
+	"github.com/go-chi/render"
 	"github.com/gorilla/websocket"
 	"github.com/ipfs/go-cid"
 	"github.com/ipld/go-car"
···
 
 // HandleHealth returns health check information
 func (h *XRPCHandler) HandleHealth(w http.ResponseWriter, r *http.Request) {
-	response := map[string]any{
+	render.JSON(w, r, map[string]any{
 		"version": "0.4.999",
-	}
-
-	w.Header().Set("Content-Type", "application/json")
-	if err := json.NewEncoder(w).Encode(response); err != nil {
-		slog.Error("failed to encode json to http response", "error", err, "path", r.URL.Path)
-		w.WriteHeader(http.StatusInternalServerError)
-	}
+	})
 }
 
 // HandleDescribeServer returns server metadata
···
 	hostname, _, _ = strings.Cut(hostname, "/") // Remove path
 	hostname, _, _ = strings.Cut(hostname, ":") // Remove port
 
-	response := map[string]any{
+	render.JSON(w, r, map[string]any{
 		"did":                  h.pds.DID(),
 		"availableUserDomains": []string{"." + hostname},
 		"inviteCodeRequired":   true, // Single-user PDS, no account creation
-	}
-
-	w.Header().Set("Content-Type", "application/json")
-	if err := json.NewEncoder(w).Encode(response); err != nil {
-		slog.Error("failed to encode json to http response", "error", err, "path", r.URL.Path)
-		w.WriteHeader(http.StatusInternalServerError)
-	}
+	})
 }
 
 // HandleResolveHandle resolves a handle to a DID
···
 	}
 
 	// Return the DID
-	response := map[string]string{
+	render.JSON(w, r, map[string]string{
 		"did": h.pds.DID(),
-	}
-
-	w.Header().Set("Content-Type", "application/json")
-	if err := json.NewEncoder(w).Encode(response); err != nil {
-		slog.Error("failed to encode json to http response", "error", err, "path", r.URL.Path)
-		w.WriteHeader(http.StatusInternalServerError)
-	}
+	})
 }
 
 // HandleGetProfile returns aggregated profile information
···
 	}
 
 	// Build profile response using shared function
-	response := h.buildProfileResponse(r.Context())
-
-	w.Header().Set("Content-Type", "application/json")
-	if err := json.NewEncoder(w).Encode(response); err != nil {
-		slog.Error("failed to encode json to http response", "error", err, "path", r.URL.Path)
-		w.WriteHeader(http.StatusInternalServerError)
-	}
+	render.JSON(w, r, h.buildProfileResponse(r.Context()))
 }
 
 // HandleGetProfiles returns aggregated profile information for multiple actors
···
 	}
 
 	// Return profiles array
-	response := map[string]any{
+	render.JSON(w, r, map[string]any{
 		"profiles": profiles,
-	}
-
-	w.Header().Set("Content-Type", "application/json")
-	if err := json.NewEncoder(w).Encode(response); err != nil {
-		slog.Error("failed to encode json to http response", "error", err, "path", r.URL.Path)
-		w.WriteHeader(http.StatusInternalServerError)
-	}
+	})
 }
 
 // buildProfileResponse builds a profile response map (shared by GetProfile and GetProfiles)
···
 	}
 
 	// Note: For did:web, the handle IS the DID (not just hostname)
-	response := map[string]any{
+	render.JSON(w, r, map[string]any{
 		"did":             h.pds.DID(),
 		"handle":          h.pds.DID(),
 		"didDoc":          didDoc,
 		"collections":     collections,
 		"handleIsCorrect": true,
-	}
-
-	w.Header().Set("Content-Type", "application/json")
-	if err := json.NewEncoder(w).Encode(response); err != nil {
-		slog.Error("failed to encode json to http response", "error", err, "path", r.URL.Path)
-		w.WriteHeader(http.StatusInternalServerError)
-	}
+	})
 }
 
 // HandleGetRecord retrieves a record from the repository
···
 		return
 	}
 
-	response := map[string]any{
+	render.JSON(w, r, map[string]any{
 		"uri":   fmt.Sprintf("at://%s/%s/%s", h.pds.DID(), collection, rkey),
 		"cid":   recordCID.String(),
 		"value": recordValue,
-	}
-
-	w.Header().Set("Content-Type", "application/json")
-	if err := json.NewEncoder(w).Encode(response); err != nil {
-		slog.Error("failed to encode json to http response", "error", err, "path", r.URL.Path)
-		w.WriteHeader(http.StatusInternalServerError)
-	}
+	})
 }
 
 // HandleListRecords lists records in a collection
···
 
 	if !head.Defined() {
 		// Empty repo, return empty list
-		response := map[string]any{"records": []any{}}
-		w.Header().Set("Content-Type", "application/json")
-		if err := json.NewEncoder(w).Encode(response); err != nil {
-			slog.Error("failed to encode json to http response", "error", err, "path", r.URL.Path)
-			w.WriteHeader(http.StatusInternalServerError)
-		}
+		render.JSON(w, r, map[string]any{"records": []any{}})
 		return
 	}
 
···
 		response["cursor"] = nextCursor
 	}
 
-	w.Header().Set("Content-Type", "application/json")
-	if err := json.NewEncoder(w).Encode(response); err != nil {
-		slog.Error("failed to encode json to http response", "error", err, "path", r.URL.Path)
-		w.WriteHeader(http.StatusInternalServerError)
-	}
+	render.JSON(w, r, response)
 }
 
 // handleListRecordsMST uses the legacy MST-based listing (fallback for tests)
···
 
 	if !head.Defined() {
 		// Empty repo, return empty list
-		response := map[string]any{"records": []any{}}
-		w.Header().Set("Content-Type", "application/json")
-		if err := json.NewEncoder(w).Encode(response); err != nil {
-			slog.Error("failed to encode json to http response", "error", err, "path", r.URL.Path)
-			w.WriteHeader(http.StatusInternalServerError)
-		}
+		render.JSON(w, r, map[string]any{"records": []any{}})
 		return
 	}
 
···
 		response["cursor"] = nextCursor
 	}
 
-	w.Header().Set("Content-Type", "application/json")
-	if err := json.NewEncoder(w).Encode(response); err != nil {
-		slog.Error("failed to encode json to http response", "error", err, "path", r.URL.Path)
-		w.WriteHeader(http.StatusInternalServerError)
-	}
+	render.JSON(w, r, response)
 }
 
 // HandleDeleteRecord deletes a record from the repository
···
 
 			if !currentCID.Equals(swapRecordCID) {
 				// Swap failed - record CID doesn't match
-				w.WriteHeader(http.StatusBadRequest)
-				response := map[string]any{
+				render.Status(r, http.StatusBadRequest)
+				render.JSON(w, r, map[string]any{
 					"error":   "InvalidSwap",
 					"message": "record CID does not match swapRecord",
-				}
-				if err := json.NewEncoder(w).Encode(response); err != nil {
-					slog.Error("failed to encode json to http response", "error", err, "path", r.URL.Path)
-					w.WriteHeader(http.StatusInternalServerError)
-				}
+				})
 				return
 			}
 		}
···
 	}
 
 	// Return commit response (per spec)
-	response := map[string]any{
+	render.JSON(w, r, map[string]any{
 		"commit": map[string]any{
 			"cid": head.String(),
 			"rev": rev,
 		},
-	}
-
-	w.Header().Set("Content-Type", "application/json")
-	if err := json.NewEncoder(w).Encode(response); err != nil {
-		slog.Error("failed to encode json to http response", "error", err, "path", r.URL.Path)
-		w.WriteHeader(http.StatusInternalServerError)
-	}
+	})
 }
 
 // HandleSyncGetRecord returns a single record as a CAR file for sync
···
 
 	// Write the CAR data to the response
 	if _, err := w.Write(buf.Bytes()); err != nil {
-		slog.Error("failed to write car to http response", "error", err, "path", r.URL.Path)
-		w.WriteHeader(http.StatusInternalServerError)
+		slog.Error("failed to write CAR to http response", "error", err, "path", r.URL.Path)
 	}
 }
 
···
 	}
 
 	// Return ATProto-compliant blob response
-	response := map[string]any{
+	render.JSON(w, r, map[string]any{
 		"blob": map[string]any{
 			"$type": "blob",
 			"ref": map[string]any{
···
 			"mimeType": "application/octet-stream",
 			"size":     size,
 		},
-	}
-
-	w.Header().Set("Content-Type", "application/json")
-	if err := json.NewEncoder(w).Encode(response); err != nil {
-		slog.Error("failed to encode json to http response", "error", err, "path", r.URL.Path)
-		w.WriteHeader(http.StatusInternalServerError)
-	}
+	})
 }
 
 // HandleGetBlob routes blob requests to appropriate handlers based on blob type
···
 		"url", presignedURL)
 
 	// Return JSON response with presigned URL (AppView expects this format)
-	response := map[string]string{
+	render.JSON(w, r, map[string]string{
 		"url": presignedURL,
-	}
-	w.Header().Set("Content-Type", "application/json")
-	if err := json.NewEncoder(w).Encode(response); err != nil {
-		slog.Error("failed to encode json to http response", "error", err, "path", r.URL.Path)
-		w.WriteHeader(http.StatusInternalServerError)
-	}
+	})
 }
 
 // handleGetATProtoBlob handles standard ATProto blob requests
···
 	head, err := h.pds.repomgr.GetRepoRoot(r.Context(), h.pds.uid)
 	if err != nil {
 		// If no repo exists yet, return empty list
-		response := map[string]any{
-			"repos": []any{},
-		}
-		w.Header().Set("Content-Type", "application/json")
-		if err := json.NewEncoder(w).Encode(response); err != nil {
-			slog.Error("failed to encode json to http response", "error", err, "path", r.URL.Path)
-			w.WriteHeader(http.StatusInternalServerError)
-		}
+		render.JSON(w, r, map[string]any{"repos": []any{}})
 		return
 	}
 
···
 	if err != nil || rev == "" {
 		// No commits yet, return empty list
 		// Don't expose repos with no revision (empty/uninitialized)
-		response := map[string]any{
-			"repos": []any{},
-		}
-		w.Header().Set("Content-Type", "application/json")
-		if err := json.NewEncoder(w).Encode(response); err != nil {
-			slog.Error("failed to encode json to http response", "error", err, "path", r.URL.Path)
-			w.WriteHeader(http.StatusInternalServerError)
-		}
+		render.JSON(w, r, map[string]any{"repos": []any{}})
 		return
 	}
 
···
 		},
 	}
 
-	response := map[string]any{
+	render.JSON(w, r, map[string]any{
 		"repos": repos,
-	}
-
-	w.Header().Set("Content-Type", "application/json")
-	if err := json.NewEncoder(w).Encode(response); err != nil {
-		slog.Error("failed to encode json to http response", "error", err, "path", r.URL.Path)
-		w.WriteHeader(http.StatusInternalServerError)
-	}
+	})
 }
 
 // HandleGetRepoStatus returns the hosting status for a repository
···
 	if err != nil || rev == "" {
 		// Repo exists (DID matches) but no commits yet
 		// Per ATProto spec, return active=true even if empty
-		response := map[string]any{
+		render.JSON(w, r, map[string]any{
 			"did":    did,
 			"active": true,
-		}
-		w.Header().Set("Content-Type", "application/json")
-		if err := json.NewEncoder(w).Encode(response); err != nil {
-			slog.Error("failed to encode json to http response", "error", err, "path", r.URL.Path)
-			w.WriteHeader(http.StatusInternalServerError)
-		}
+		})
 		return
 	}
 
 	// Return status with revision
-	response := map[string]any{
+	render.JSON(w, r, map[string]any{
 		"did":    did,
 		"active": true,
 		"rev":    rev,
-	}
-
-	w.Header().Set("Content-Type", "application/json")
-	if err := json.NewEncoder(w).Encode(response); err != nil {
-		slog.Error("failed to encode json to http response", "error", err, "path", r.URL.Path)
-		w.WriteHeader(http.StatusInternalServerError)
-	}
+	})
 }
 
 // HandleDIDDocument returns the DID document
···
 		return
 	}
 
-	w.Header().Set("Content-Type", "application/json")
-	if err := json.NewEncoder(w).Encode(doc); err != nil {
-		slog.Error("failed to encode json to http response", "error", err, "path", r.URL.Path)
-		w.WriteHeader(http.StatusInternalServerError)
-	}
+	render.JSON(w, r, doc)
 }
 
 // HandleAtprotoDID returns the DID for handle resolution
···
 			slog.Debug("User is already a crew member",
 				"did", user.DID,
 				"rkey", member.Rkey)
-			response := map[string]any{
+			render.JSON(w, r, map[string]any{
 				"uri":     fmt.Sprintf("at://%s/%s/%s", h.pds.DID(), atproto.CrewCollection, member.Rkey),
 				"cid":     member.Cid.String(),
 				"status":  "already_member",
 				"message": "User is already a crew member",
-			}
-			w.Header().Set("Content-Type", "application/json")
-			w.WriteHeader(http.StatusOK)
-			if err := json.NewEncoder(w).Encode(response); err != nil {
-				slog.Error("failed to encode json to http response", "error", err, "path", r.URL.Path)
-				w.WriteHeader(http.StatusInternalServerError)
-			}
+			})
 			return
 		}
 	}
···
 	// Return success response
 	// Note: rkey is generated by AddCrewMember (TID), we don't have direct access to it
 	// For now, return just the CID. In production, AddCrewMember should return both CID and rkey
-	response := map[string]any{
+	render.Status(r, http.StatusCreated)
+	render.JSON(w, r, map[string]any{
 		"cid":     recordCID.String(),
 		"status":  "created",
 		"message": "Successfully added to crew",
-	}
-
-	w.Header().Set("Content-Type", "application/json")
-	w.WriteHeader(http.StatusCreated)
-	if err := json.NewEncoder(w).Encode(response); err != nil {
-		slog.Error("failed to encode json to http response", "error", err, "path", r.URL.Path)
-		w.WriteHeader(http.StatusInternalServerError)
-	}
+	})
 }
 
 // GetPresignedURL generates a presigned URL for GET, HEAD, or PUT operations
···
 		return
 	}
 
-	w.Header().Set("Content-Type", "application/json")
-	if err := json.NewEncoder(w).Encode(stats); err != nil {
-		slog.Error("failed to encode json to http response", "error", err, "path", r.URL.Path)
-		w.WriteHeader(http.StatusInternalServerError)
-	}
+	render.JSON(w, r, stats)
 }