clean up duplicate functions

pkg/appview/handlers/api.go

···
 package handlers
 
 import (
-	"context"
 	"database/sql"
 	"encoding/json"
 	"errors"
···
 	repository := chi.URLParam(r, "repository")
 
 	// Resolve owner's handle to DID
-	ownerDID, err := resolveIdentityToDID(r.Context(), h.Directory, handle)
+	ownerDID, err := atproto.ResolveHandleToDID(r.Context(), handle)
 	if err != nil {
 		slog.Warn("Failed to resolve handle for star", "handle", handle, "error", err)
 		http.Error(w, fmt.Sprintf("Failed to resolve handle: %v", err), http.StatusBadRequest)
···
 	repository := chi.URLParam(r, "repository")
 
 	// Resolve owner's handle to DID
-	ownerDID, err := resolveIdentityToDID(r.Context(), h.Directory, handle)
+	ownerDID, err := atproto.ResolveHandleToDID(r.Context(), handle)
 	if err != nil {
 		slog.Warn("Failed to resolve handle for unstar", "handle", handle, "error", err)
 		http.Error(w, fmt.Sprintf("Failed to resolve handle: %v", err), http.StatusBadRequest)
···
 	repository := chi.URLParam(r, "repository")
 
 	// Resolve owner's handle to DID
-	ownerDID, err := resolveIdentityToDID(r.Context(), h.Directory, handle)
+	ownerDID, err := atproto.ResolveHandleToDID(r.Context(), handle)
 	if err != nil {
 		slog.Warn("Failed to resolve handle for check star", "handle", handle, "error", err)
 		http.Error(w, fmt.Sprintf("Failed to resolve handle: %v", err), http.StatusBadRequest)
···
 	repository := chi.URLParam(r, "repository")
 
 	// Resolve owner's handle to DID
-	ownerDID, err := resolveIdentityToDID(r.Context(), h.Directory, handle)
+	ownerDID, err := atproto.ResolveHandleToDID(r.Context(), handle)
 	if err != nil {
 		http.Error(w, "Failed to resolve handle", http.StatusBadRequest)
 		return
···
 	digest := chi.URLParam(r, "digest")
 
 	// Resolve owner's handle to DID
-	ownerDID, err := resolveIdentityToDID(r.Context(), h.Directory, handle)
+	ownerDID, err := atproto.ResolveHandleToDID(r.Context(), handle)
 	if err != nil {
 		http.Error(w, "Failed to resolve handle", http.StatusBadRequest)
 		return
···
 	w.Header().Set("Content-Type", "application/json")
 	json.NewEncoder(w).Encode(manifest)
 }
-
-// resolveIdentityToDID is a helper function that resolves a handle or DID to a DID
-func resolveIdentityToDID(ctx context.Context, directory identity.Directory, identityStr string) (string, error) {
-	// Resolve to DID via directory (handles both handles and DIDs)
-	return atproto.ResolveHandleToDID(ctx, identityStr)
-}

pkg/appview/holdhealth/checker_test.go

···
 	"net/http/httptest"
 	"testing"
 	"time"
+
+	"atcr.io/pkg/atproto"
 )
 
 func TestNewChecker(t *testing.T) {
···
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			result := normalizeHoldEndpoint(tt.input)
+			result := atproto.ResolveHoldDIDFromURL(tt.input)
 			if result != tt.expected {
 				t.Errorf("normalizeHoldEndpoint(%q) = %q, want %q", tt.input, result, tt.expected)
 			}

pkg/appview/holdhealth/worker.go

···
 	"database/sql"
 	"fmt"
 	"log/slog"
-	"strings"
 	"sync"
 	"time"
+
+	"atcr.io/pkg/atproto"
 )
 
 // DBQuerier interface for database queries (allows mocking in tests)
···
 
 	for _, endpoint := range endpoints {
 		// Normalize to canonical DID format
-		normalizedDID := normalizeHoldEndpoint(endpoint)
+		normalizedDID := atproto.ResolveHoldDIDFromURL(endpoint)
 
 		// Skip if we've already seen this normalized DID
 		if seen[normalizedDID] {
···
 
 	return endpoints, nil
 }
-
-// normalizeHoldEndpoint converts a hold endpoint (URL or DID) to canonical DID format
-// This ensures that different representations of the same hold are deduplicated:
-// - http://172.28.0.3:8080 → did:web:172.28.0.3:8080
-// - http://hold01.atcr.io → did:web:hold01.atcr.io
-// - https://hold01.atcr.io → did:web:hold01.atcr.io
-// - did:web:hold01.atcr.io → did:web:hold01.atcr.io (passthrough)
-func normalizeHoldEndpoint(endpoint string) string {
-	// Strip protocol and trailing slashes
-	normalized := endpoint
-	normalized = strings.TrimPrefix(normalized, "http://")
-	normalized = strings.TrimPrefix(normalized, "https://")
-	normalized = strings.TrimSuffix(normalized, "/")
-
-	// If already a DID, return as-is
-	if strings.HasPrefix(endpoint, "did:") {
-		return endpoint
-	}
-
-	// Extract hostname (remove path if present)
-	parts := strings.Split(normalized, "/")
-	hostname := parts[0]
-
-	// Convert to did:web
-	return "did:web:" + hostname
-}

pkg/appview/jetstream/processor.go

···
 // useCache: true for Worker (live streaming), false for Backfill (batch processing)
 func NewProcessor(database *sql.DB, useCache bool) *Processor {
 	p := &Processor{
-		db:        database,
-		useCache:  useCache,
+		db:       database,
+		useCache: useCache,
 	}
 
 	if useCache {

pkg/appview/ui_test.go

···
 
 	// Test that all expected templates are loaded
 	expectedTemplates := []string{
-		"base.html",
 		"nav",
 		"repo-card",
 		"repository",

pkg/atproto/lexicon.go

···
 }
 
 // ResolveHoldDIDFromURL converts a hold endpoint URL to a did:web DID
-// For did:web holds: https://hold01.atcr.io → did:web:hold01.atcr.io
-// If input is already a DID, returns it as-is
+// This ensures that different representations of the same hold are deduplicated:
+// - http://172.28.0.3:8080 → did:web:172.28.0.3:8080
+// - http://hold01.atcr.io → did:web:hold01.atcr.io
+// - https://hold01.atcr.io → did:web:hold01.atcr.io
+// - did:web:hold01.atcr.io → did:web:hold01.atcr.io (passthrough)
 func ResolveHoldDIDFromURL(holdURL string) string {
 	// Handle empty URLs
 	if holdURL == "" {
···
 	}
 
 	// If already a DID, return as-is
-	if strings.HasPrefix(holdURL, "did:") {
+	if IsDID(holdURL) {
 		return holdURL
 	}
 

pkg/auth/oauth/client.go

···
 type App struct {
 	clientApp *oauth.ClientApp
 	baseURL   string
-	directory identity.Directory
 }
 
 // NewApp creates a new OAuth app for ATCR with default scopes
···
 func NewAppWithScopes(baseURL string, store oauth.ClientAuthStore, scopes []string) (*App, error) {
 	config := NewClientConfigWithScopes(baseURL, scopes)
 	clientApp := oauth.NewClientApp(&config, store)
+	clientApp.Dir = atproto.GetDirectory()
 
 	return &App{
 		clientApp: clientApp,
 		baseURL:   baseURL,
-		directory: atproto.GetDirectory(),
 	}, nil
 }
 
···
 
 // Directory returns the identity directory used by the OAuth app
 func (a *App) Directory() identity.Directory {
-	return a.directory
+	return a.clientApp.Dir
 }
 
 // ClientIDWithScopes generates a client ID with custom scopes

pkg/hold/pds/xrpc.go

···
 
 	// Normalize actor to DID
 	actorDID := actor
-	if !strings.HasPrefix(actor, "did:") {
+	if !atproto.IsDID(actor) {
 		// It's a handle, resolve to DID
 		expectedHandle := strings.TrimPrefix(h.pds.DID(), "did:web:")
 		if actor == expectedHandle {
···
 	for _, actor := range actors {
 		// Normalize actor to DID
 		actorDID := actor
-		if !strings.HasPrefix(actor, "did:") {
+		if !atproto.IsDID(actor) {
 			// It's a handle, check if it matches
 			if actor == expectedHandle {
 				actorDID = h.pds.DID()