Refactor OAuth and ATProto handlers; add OAuth manager package; dual-scheme PDS auth tests; fix Docker build and workspace

Summary
- Extracted handlers into packages:
- handlers/atp: /atp/session, /atp/post, /atp/doc via DI
- handlers/oauth: OAuthManager (ES256 DPoP + client assertion), routes for metadata, JWKS, logout, resume, login, callback
- Removed legacy OAuth code from server/main.go; replaced global wiring with package manager (oauthManager = om)
- Kept pdsBaseFromUser and pdsRequest using oauthManager; exported GenerateDPoPProofWithToken

Auth decisions implemented (per team memory)
- Start auth by handle (login flow resolves PDS from handle/DID)
- Build DPoP JWTs using Go stdlib (ES256)
- Token exchange includes resource & scope
- Dual-scheme PDS requests: DPoP first with nonce retry; Bearer+DPoP fallback for non-DPoP tokens

Tests
- handlers/oauth: metadata, JWKS, cookie session, login redirect, resource fallback, callback nonce retry + legacy session hook
- server: pdsRequest integration tests for nonce retry and DPoP->Bearer fallback

Build & Dev
- Dockerfile: copy entire server/ tree so internal packages resolve; keep module cache
- Added go.work at repo root (go 1.24.0) to support root-based builds (buildpacks/CI)
- go.mod tidy: removed unused modules and stabilized indirects

Result
- Local build/tests pass
- Staging deploy via Fly succeeds (uses Dockerfile)

Dockerfile

···
 # Pre-fetch modules for better caching
 RUN go mod download
 
-# Now copy the rest of the source
-COPY server/*.go ./
-COPY server/tap-editor ./tap-editor
-COPY server/templates ../server/templates
-COPY server/static ../server/static
+# Now copy the rest of the source (entire server tree)
+COPY server/ ./
 
-# Bring in built web assets from the previous stage
+# Bring in built web assets from the previous stage (overwrites js bundle)
 COPY --from=webbuild /app/server/static/js /app/server/static/js
 
 ENV CGO_ENABLED=0 GOOS=linux GOARCH=amd64

go.work

···
+go 1.24.0
+
+use (
+	./server
+)

server/go.mod

···
 toolchain go1.24.4
 
 require (
-	github.com/golang-jwt/jwt v3.2.2+incompatible
 	github.com/gorilla/sessions v1.4.0
 	github.com/lestrrat-go/jwx/v2 v2.1.6
 	github.com/phpdave11/gofpdf v1.4.3
-	tangled.sh/icyphox.sh/atproto-oauth v0.0.0-20250828064049-5d3e087a4dbe
 )
 
 require (
-	github.com/bluesky-social/indigo v0.0.0-20250721113617-2b6646226706 // indirect
-	github.com/carlmjohnson/versioninfo v0.22.5 // indirect
+	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0 // indirect
-	github.com/felixge/httpsnoop v1.0.4 // indirect
-	github.com/go-logr/logr v1.4.2 // indirect
-	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/goccy/go-json v0.10.3 // indirect
-	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/golang-jwt/jwt/v5 v5.2.2 // indirect
-	github.com/google/uuid v1.6.0 // indirect
 	github.com/gorilla/securecookie v1.1.2 // indirect
-	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
-	github.com/hashicorp/go-retryablehttp v0.7.5 // indirect
-	github.com/hashicorp/golang-lru v1.0.2 // indirect
-	github.com/ipfs/bbloom v0.0.4 // indirect
-	github.com/ipfs/go-block-format v0.2.0 // indirect
-	github.com/ipfs/go-cid v0.4.1 // indirect
-	github.com/ipfs/go-datastore v0.6.0 // indirect
-	github.com/ipfs/go-ipfs-blockstore v1.3.1 // indirect
-	github.com/ipfs/go-ipfs-ds-help v1.1.1 // indirect
-	github.com/ipfs/go-ipfs-util v0.0.3 // indirect
-	github.com/ipfs/go-ipld-cbor v0.1.0 // indirect
-	github.com/ipfs/go-ipld-format v0.6.0 // indirect
-	github.com/ipfs/go-log v1.0.5 // indirect
-	github.com/ipfs/go-log/v2 v2.5.1 // indirect
-	github.com/ipfs/go-metrics-interface v0.0.1 // indirect
-	github.com/jbenet/goprocess v0.1.4 // indirect
-	github.com/klauspost/cpuid/v2 v2.2.7 // indirect
 	github.com/lestrrat-go/blackmagic v1.0.3 // indirect
 	github.com/lestrrat-go/httpcc v1.0.1 // indirect
 	github.com/lestrrat-go/httprc v1.0.6 // indirect
 	github.com/lestrrat-go/iter v1.0.2 // indirect
 	github.com/lestrrat-go/option v1.0.1 // indirect
-	github.com/mattn/go-isatty v0.0.20 // indirect
-	github.com/minio/sha256-simd v1.0.1 // indirect
-	github.com/mr-tron/base58 v1.2.0 // indirect
-	github.com/multiformats/go-base32 v0.1.0 // indirect
-	github.com/multiformats/go-base36 v0.2.0 // indirect
-	github.com/multiformats/go-multibase v0.2.0 // indirect
-	github.com/multiformats/go-multihash v0.2.3 // indirect
-	github.com/multiformats/go-varint v0.0.7 // indirect
-	github.com/opentracing/opentracing-go v1.2.0 // indirect
-	github.com/polydawn/refmt v0.89.1-0.20221221234430-40501e09de1f // indirect
+	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/segmentio/asm v1.2.0 // indirect
-	github.com/spaolacci/murmur3 v1.1.0 // indirect
-	github.com/whyrusleeping/cbor-gen v0.2.1-0.20241030202151-b7a6831be65e // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.46.1 // indirect
-	go.opentelemetry.io/otel v1.29.0 // indirect
-	go.opentelemetry.io/otel/metric v1.29.0 // indirect
-	go.opentelemetry.io/otel/trace v1.29.0 // indirect
-	go.uber.org/atomic v1.11.0 // indirect
-	go.uber.org/multierr v1.11.0 // indirect
-	go.uber.org/zap v1.26.0 // indirect
 	golang.org/x/crypto v0.32.0 // indirect
 	golang.org/x/sys v0.31.0 // indirect
-	golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 // indirect
-	lukechampine.com/blake3 v1.2.1 // indirect
 )

server/go.sum

···
-github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
-github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
-github.com/bluesky-social/indigo v0.0.0-20250721113617-2b6646226706 h1:ANOvunbumhvduKlp1mU2Jt20+PQR0x2irFGiYAJerQs=
-github.com/bluesky-social/indigo v0.0.0-20250721113617-2b6646226706/go.mod h1:0XUyOCRtL4/OiyeqMTmr6RlVHQMDgw3LS7CfibuZR5Q=
 github.com/boombuler/barcode v1.0.0/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
-github.com/carlmjohnson/versioninfo v0.22.5 h1:O00sjOLUAFxYQjlN/bzYTuZiS0y6fWDQjMRvwtKgwwc=
-github.com/carlmjohnson/versioninfo v0.22.5/go.mod h1:QT9mph3wcVfISUKd0i9sZfVrPviHuSF+cUtLjm2WSf8=
-github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0 h1:NMZiJj8QnKe1LgsbDayM4UoHwbvwDRwnI3hwNaAHRnc=
 github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0/go.mod h1:ZXNYxsqcloTdSy/rNShjYzMhyjf0LaoftYK0p+A3h40=
-github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
-github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
-github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
-github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
-github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
-github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
-github.com/go-yaml/yaml v2.1.0+incompatible/go.mod h1:w2MrLa16VYP0jy6N7M5kHaCkaLENm+P+Tv+MfurjSw0=
 github.com/goccy/go-json v0.10.3 h1:KZ5WoDbxAIgm2HNbYckL0se1fHD6rz5j4ywS6ebzDqA=
 github.com/goccy/go-json v0.10.3/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
-github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
-github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
-github.com/golang-jwt/jwt v3.2.2+incompatible h1:IfV12K8xAKAnZqdXVzCZ+TOjboZ2keLg81eXfW3O+oY=
-github.com/golang-jwt/jwt v3.2.2+incompatible/go.mod h1:8pz2t5EyA70fFQQSrl6XZXzqecmYZeUEB8OUGHkxJ+I=
-github.com/golang-jwt/jwt/v5 v5.2.2 h1:Rl4B7itRWVtYIHFrSNd7vhTiz9UpLdi6gZhZ3wEeDy8=
-github.com/golang-jwt/jwt/v5 v5.2.2/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
-github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
-github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
 github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
-github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
-github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1 h1:EGx4pi6eqNxGaHF6qqu48+N2wcFQ5qg5FXgOdqsJ5d8=
-github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
 github.com/gorilla/securecookie v1.1.2 h1:YCIWL56dvtr73r6715mJs5ZvhtnY73hBvEF8kXD8ePA=
 github.com/gorilla/securecookie v1.1.2/go.mod h1:NfCASbcHqRSY+3a8tlWJwsQap2VX5pwzwo4h3eOamfo=
 github.com/gorilla/sessions v1.4.0 h1:kpIYOp/oi6MG/p5PgxApU8srsSw9tuFbt46Lt7auzqQ=
 github.com/gorilla/sessions v1.4.0/go.mod h1:FLWm50oby91+hl7p/wRxDth9bWSuk0qVL2emc7lT5ik=
-github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
-github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
-github.com/hashicorp/go-hclog v0.9.2 h1:CG6TE5H9/JXsFWJCfoIVpKFIkFe6ysEuHirp4DxCsHI=
-github.com/hashicorp/go-hclog v0.9.2/go.mod h1:5CU+agLiy3J7N7QjHK5d05KxGsuXiQLrjA0H7acj2lQ=
-github.com/hashicorp/go-retryablehttp v0.7.5 h1:bJj+Pj19UZMIweq/iie+1u5YCdGrnxCT9yvm0e+Nd5M=
-github.com/hashicorp/go-retryablehttp v0.7.5/go.mod h1:Jy/gPYAdjqffZ/yFGCFV2doI5wjtH1ewM9u8iYVjtX8=
-github.com/hashicorp/golang-lru v1.0.2 h1:dV3g9Z/unq5DpblPpw+Oqcv4dU/1omnb4Ok8iPY6p1c=
-github.com/hashicorp/golang-lru v1.0.2/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
-github.com/ipfs/bbloom v0.0.4 h1:Gi+8EGJ2y5qiD5FbsbpX/TMNcJw8gSqr7eyjHa4Fhvs=
-github.com/ipfs/bbloom v0.0.4/go.mod h1:cS9YprKXpoZ9lT0n/Mw/a6/aFV6DTjTLYHeA+gyqMG0=
-github.com/ipfs/go-block-format v0.2.0 h1:ZqrkxBA2ICbDRbK8KJs/u0O3dlp6gmAuuXUJNiW1Ycs=
-github.com/ipfs/go-block-format v0.2.0/go.mod h1:+jpL11nFx5A/SPpsoBn6Bzkra/zaArfSmsknbPMYgzM=
-github.com/ipfs/go-cid v0.4.1 h1:A/T3qGvxi4kpKWWcPC/PgbvDA2bjVLO7n4UeVwnbs/s=
-github.com/ipfs/go-cid v0.4.1/go.mod h1:uQHwDeX4c6CtyrFwdqyhpNcxVewur1M7l7fNU7LKwZk=
-github.com/ipfs/go-datastore v0.6.0 h1:JKyz+Gvz1QEZw0LsX1IBn+JFCJQH4SJVFtM4uWU0Myk=
-github.com/ipfs/go-datastore v0.6.0/go.mod h1:rt5M3nNbSO/8q1t4LNkLyUwRs8HupMeN/8O4Vn9YAT8=
-github.com/ipfs/go-detect-race v0.0.1 h1:qX/xay2W3E4Q1U7d9lNs1sU9nvguX0a7319XbyQ6cOk=
-github.com/ipfs/go-detect-race v0.0.1/go.mod h1:8BNT7shDZPo99Q74BpGMK+4D8Mn4j46UU0LZ723meps=
-github.com/ipfs/go-ipfs-blockstore v1.3.1 h1:cEI9ci7V0sRNivqaOr0elDsamxXFxJMMMy7PTTDQNsQ=
-github.com/ipfs/go-ipfs-blockstore v1.3.1/go.mod h1:KgtZyc9fq+P2xJUiCAzbRdhhqJHvsw8u2Dlqy2MyRTE=
-github.com/ipfs/go-ipfs-ds-help v1.1.1 h1:B5UJOH52IbcfS56+Ul+sv8jnIV10lbjLF5eOO0C66Nw=
-github.com/ipfs/go-ipfs-ds-help v1.1.1/go.mod h1:75vrVCkSdSFidJscs8n4W+77AtTpCIAdDGAwjitJMIo=
-github.com/ipfs/go-ipfs-util v0.0.3 h1:2RFdGez6bu2ZlZdI+rWfIdbQb1KudQp3VGwPtdNCmE0=
-github.com/ipfs/go-ipfs-util v0.0.3/go.mod h1:LHzG1a0Ig4G+iZ26UUOMjHd+lfM84LZCrn17xAKWBvs=
-github.com/ipfs/go-ipld-cbor v0.1.0 h1:dx0nS0kILVivGhfWuB6dUpMa/LAwElHPw1yOGYopoYs=
-github.com/ipfs/go-ipld-cbor v0.1.0/go.mod h1:U2aYlmVrJr2wsUBU67K4KgepApSZddGRDWBYR0H4sCk=
-github.com/ipfs/go-ipld-format v0.6.0 h1:VEJlA2kQ3LqFSIm5Vu6eIlSxD/Ze90xtc4Meten1F5U=
-github.com/ipfs/go-ipld-format v0.6.0/go.mod h1:g4QVMTn3marU3qXchwjpKPKgJv+zF+OlaKMyhJ4LHPg=
-github.com/ipfs/go-log v1.0.5 h1:2dOuUCB1Z7uoczMWgAyDck5JLb72zHzrMnGnCNNbvY8=
-github.com/ipfs/go-log v1.0.5/go.mod h1:j0b8ZoR+7+R99LD9jZ6+AJsrzkPbSXbZfGakb5JPtIo=
-github.com/ipfs/go-log/v2 v2.1.3/go.mod h1:/8d0SH3Su5Ooc31QlL1WysJhvyOTDCjcCZ9Axpmri6g=
-github.com/ipfs/go-log/v2 v2.5.1 h1:1XdUzF7048prq4aBjDQQ4SL5RxftpRGdXhNRwKSAlcY=
-github.com/ipfs/go-log/v2 v2.5.1/go.mod h1:prSpmC1Gpllc9UYWxDiZDreBYw7zp4Iqp1kOLU9U5UI=
-github.com/ipfs/go-metrics-interface v0.0.1 h1:j+cpbjYvu4R8zbleSs36gvB7jR+wsL2fGD6n0jO4kdg=
-github.com/ipfs/go-metrics-interface v0.0.1/go.mod h1:6s6euYU4zowdslK0GKHmqaIZ3j/b/tL7HTWtJ4VPgWY=
-github.com/jbenet/go-cienv v0.1.0/go.mod h1:TqNnHUmJgXau0nCzC7kXWeotg3J9W34CUv5Djy1+FlA=
-github.com/jbenet/goprocess v0.1.4 h1:DRGOFReOMqqDNXwW70QkacFW0YN9QnwLV0Vqk+3oU0o=
-github.com/jbenet/goprocess v0.1.4/go.mod h1:5yspPrukOVuOLORacaBi858NqyClJPQxYZlqdZVfqY4=
-github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0=
-github.com/joho/godotenv v1.5.1/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4=
-github.com/jtolds/gls v4.20.0+incompatible h1:xdiiI2gbIgH/gLH7ADydsJ1uDOEzR8yvV7C0MuV77Wo=
-github.com/jtolds/gls v4.20.0+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVYBRgL+9YlvaHOwJU=
 github.com/jung-kurt/gofpdf v1.0.0/go.mod h1:7Id9E/uU8ce6rXgefFLlgrJj/GYY22cpxn+r32jIOes=
-github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
-github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
-github.com/klauspost/cpuid/v2 v2.2.7 h1:ZWSB3igEs+d0qvnxR/ZBzXVmxkgt8DdzP6m9pfuVLDM=
-github.com/klauspost/cpuid/v2 v2.2.7/go.mod h1:Lcz8mBdAVJIBVzewtcLocK12l3Y+JytZYpaMropDUws=
-github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
-github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
-github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
-github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
-github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
-github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
-github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/lestrrat-go/blackmagic v1.0.3 h1:94HXkVLxkZO9vJI/w2u1T0DAoprShFd13xtnSINtDWs=
 github.com/lestrrat-go/blackmagic v1.0.3/go.mod h1:6AWFyKNNj0zEXQYfTMPfZrAXUWUfTIZ5ECEUEJaijtw=
 github.com/lestrrat-go/httpcc v1.0.1 h1:ydWCStUeJLkpYyjLDHihupbn2tYmZ7m22BGkcvZZrIE=
···
 github.com/lestrrat-go/jwx/v2 v2.1.6/go.mod h1:Y722kU5r/8mV7fYDifjug0r8FK8mZdw0K0GpJw/l8pU=
 github.com/lestrrat-go/option v1.0.1 h1:oAzP2fvZGQKWkvHa1/SAcFolBEca1oN+mQ7eooNBEYU=
 github.com/lestrrat-go/option v1.0.1/go.mod h1:5ZHFbivi4xwXxhxY9XHDe2FHo6/Z7WWmtT7T5nBBp3I=
-github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94=
-github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
-github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
-github.com/minio/sha256-simd v1.0.1 h1:6kaan5IFmwTNynnKKpDHe6FWHohJOHhCPchzK49dzMM=
-github.com/minio/sha256-simd v1.0.1/go.mod h1:Pz6AKMiUdngCLpeTL/RJY1M9rUuPMYujV5xJjtbRSN8=
-github.com/mr-tron/base58 v1.2.0 h1:T/HDJBh4ZCPbU39/+c3rRvE0uKBQlU27+QI8LJ4t64o=
-github.com/mr-tron/base58 v1.2.0/go.mod h1:BinMc/sQntlIE1frQmRFPUoPA1Zkr8VRgBdjWI2mNwc=
-github.com/multiformats/go-base32 v0.1.0 h1:pVx9xoSPqEIQG8o+UbAe7DNi51oej1NtK+aGkbLYxPE=
-github.com/multiformats/go-base32 v0.1.0/go.mod h1:Kj3tFY6zNr+ABYMqeUNeGvkIC/UYgtWibDcT0rExnbI=
-github.com/multiformats/go-base36 v0.2.0 h1:lFsAbNOGeKtuKozrtBsAkSVhv1p9D0/qedU9rQyccr0=
-github.com/multiformats/go-base36 v0.2.0/go.mod h1:qvnKE++v+2MWCfePClUEjE78Z7P2a1UV0xHgWc0hkp4=
-github.com/multiformats/go-multibase v0.2.0 h1:isdYCVLvksgWlMW9OZRYJEa9pZETFivncJHmHnnd87g=
-github.com/multiformats/go-multibase v0.2.0/go.mod h1:bFBZX4lKCA/2lyOFSAoKH5SS6oPyjtnzK/XTFDPkNuk=
-github.com/multiformats/go-multihash v0.2.3 h1:7Lyc8XfX/IY2jWb/gI7JP+o7JEq9hOa7BFvVU9RSh+U=
-github.com/multiformats/go-multihash v0.2.3/go.mod h1:dXgKXCXjBzdscBLk9JkjINiEsCKRVch90MdaGiKsvSM=
-github.com/multiformats/go-varint v0.0.7 h1:sWSGR+f/eu5ABZA2ZpYKBILXTTs9JWpdEM/nEGOHFS8=
-github.com/multiformats/go-varint v0.0.7/go.mod h1:r8PUYw/fD/SjBCiKOoDlGF6QawOELpZAu9eioSos/OU=
-github.com/opentracing/opentracing-go v1.2.0 h1:uEJPy/1a5RIPAJ0Ov+OIO8OxWu77jEv+1B0VhjKrZUs=
-github.com/opentracing/opentracing-go v1.2.0/go.mod h1:GxEUsuufX4nBwe+T+Wl9TAgYrxe9dPLANfrWvHYVTgc=
 github.com/phpdave11/gofpdf v1.4.3 h1:M/zHvS8FO3zh9tUd2RCOPEjyuVcs281FCyF22Qlz/IA=
 github.com/phpdave11/gofpdf v1.4.3/go.mod h1:MAwzoUIgD3J55u0rxIG2eu37c+XWhBtXSpPAhnQXf/o=
 github.com/phpdave11/gofpdi v1.0.15/go.mod h1:vBmVV0Do6hSBHC8uKUQ71JGW+ZGQq74llk/7bXwjDoI=
···
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/polydawn/refmt v0.89.1-0.20221221234430-40501e09de1f h1:VXTQfuJj9vKR4TCkEuWIckKvdHFeJH/huIFJ9/cXOB0=
-github.com/polydawn/refmt v0.89.1-0.20221221234430-40501e09de1f/go.mod h1:/zvteZs/GwLtCgZ4BL6CBsk9IKIlexP43ObX9AxTqTw=
-github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
-github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
-github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
-github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/ruudk/golang-pdf417 v0.0.0-20181029194003-1af4ab5afa58/go.mod h1:6lfFZQK844Gfx8o5WFuvpxWRwnSoipWe/p622j1v06w=
 github.com/segmentio/asm v1.2.0 h1:9BQrFxC+YOHJlTlHGkTrFWf59nbL3XnCoFLTwDCI7ys=
 github.com/segmentio/asm v1.2.0/go.mod h1:BqMnlJP91P8d+4ibuonYZw9mfnzI9HfxselHZr5aAcs=
-github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
-github.com/smartystreets/assertions v1.2.0 h1:42S6lae5dvLc7BrLu/0ugRtcFVjoJNMC/N3yZFZkDFs=
-github.com/smartystreets/assertions v1.2.0/go.mod h1:tcbTF8ujkAEcZ8TElKY+i30BzYlVhC/LOxJk7iOWnoo=
-github.com/smartystreets/goconvey v1.7.2 h1:9RBaZCeXEQ3UselpuwUQHltGVXvdwm6cv1hgR6gDIPg=
-github.com/smartystreets/goconvey v1.7.2/go.mod h1:Vw0tHAZW6lzCRk3xgdin6fKYcG+G3Pg9vgXWeJpQFMM=
-github.com/spaolacci/murmur3 v1.1.0 h1:7c1g84S4BPRrfL5Xrdp6fOJ206sU9y293DDHaoy0bLI=
-github.com/spaolacci/murmur3 v1.1.0/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
-github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
-github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
 github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
-github.com/urfave/cli v1.22.10/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0=
-github.com/warpfork/go-wish v0.0.0-20220906213052-39a1cc7a02d0 h1:GDDkbFiaK8jsSDJfjId/PEGEShv6ugrt4kYsC5UIDaQ=
-github.com/warpfork/go-wish v0.0.0-20220906213052-39a1cc7a02d0/go.mod h1:x6AKhvSSexNrVSrViXSHUEbICjmGXhtgABaHIySUSGw=
-github.com/whyrusleeping/cbor-gen v0.2.1-0.20241030202151-b7a6831be65e h1:28X54ciEwwUxyHn9yrZfl5ojgF4CBNLWX7LR0rvBkf4=
-github.com/whyrusleeping/cbor-gen v0.2.1-0.20241030202151-b7a6831be65e/go.mod h1:pM99HXyEbSQHcosHc0iW7YFmwnscr+t9Te4ibko05so=
-github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.46.1 h1:aFJWCqJMNjENlcleuuOkGAPH82y0yULBScfXcIEdS24=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.46.1/go.mod h1:sEGXWArGqc3tVa+ekntsN65DmVbVeW+7lTKTjZF3/Fo=
-go.opentelemetry.io/otel v1.29.0 h1:PdomN/Al4q/lN6iBJEN3AwPvUiHPMlt93c8bqTG5Llw=
-go.opentelemetry.io/otel v1.29.0/go.mod h1:N/WtXPs1CNCUEx+Agz5uouwCba+i+bJGFicT8SR4NP8=
-go.opentelemetry.io/otel/metric v1.29.0 h1:vPf/HFWTNkPu1aYeIsc98l4ktOQaL6LeSoeV2g+8YLc=
-go.opentelemetry.io/otel/metric v1.29.0/go.mod h1:auu/QWieFVWx+DmQOUMgj0F8LHWdgalxXqvp7BII/W8=
-go.opentelemetry.io/otel/trace v1.29.0 h1:J/8ZNK4XgR7a21DZUAsbF8pZ5Jcw1VhACmnYt39JTi4=
-go.opentelemetry.io/otel/trace v1.29.0/go.mod h1:eHl3w0sp3paPkYstJOmAimxhiFXPg+MMTlEh3nsQgWQ=
-go.uber.org/atomic v1.6.0/go.mod h1:sABNBOSYdrvTF6hTgEIbc7YasKWGhgEQZyfxyTvoXHQ=
-go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
-go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=
-go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
-go.uber.org/goleak v1.1.11-0.20210813005559-691160354723/go.mod h1:cwTWslyiVhfpKIDGSZEM2HlOvcqm+tG4zioyIeLoqMQ=
-go.uber.org/goleak v1.2.0 h1:xqgm/S+aQvhWFTtR0XK3Jvg7z8kGV8P4X14IzwN3Eqk=
-go.uber.org/goleak v1.2.0/go.mod h1:XJYK+MuIchqpmGmUSAzotztawfKvYLUIgg7guXrwVUo=
-go.uber.org/multierr v1.5.0/go.mod h1:FeouvMocqHpRaaGuG9EjoKcStLC43Zu/fmqdUMPcKYU=
-go.uber.org/multierr v1.6.0/go.mod h1:cdWPpRnG4AhwMwsgIHip0KRBQjJy5kYEpYjJxpXp9iU=
-go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
-go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
-go.uber.org/tools v0.0.0-20190618225709-2cfd321de3ee/go.mod h1:vJERXedbb3MVM5f9Ejo0C68/HhF8uaILCdgjnY+goOA=
-go.uber.org/zap v1.16.0/go.mod h1:MA8QOfq0BHJwdXa996Y4dYkAqRKB8/1K1QMMZVaNZjQ=
-go.uber.org/zap v1.19.1/go.mod h1:j3DNczoxDZroyBnOT1L/Q79cfUMGZxlv/9dzN7SM1rI=
-go.uber.org/zap v1.26.0 h1:sI7k6L95XOKS281NhVKOFCUNIvv9e0w4BF8N3u+tCRo=
-go.uber.org/zap v1.26.0/go.mod h1:dtElttAiwGvoJ/vj4IwHBS/gXsEu/pZ50mUIRWuG0so=
-golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.32.0 h1:euUpcYgM8WcP71gNpTqQCn6rC2t6ULUPiOzfWaXVVfc=
 golang.org/x/crypto v0.32.0/go.mod h1:ZnnJkOaASj8g0AjIduWNlq2NRxL0PlBrbKVyZ6V/Ugc=
 golang.org/x/image v0.0.0-20190910094157-69e4b8554b2a/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
-golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/mod v0.0.0-20190513183733-4bf6d317e70e/go.mod h1:mXi4GBBbnImb6dmsKGUJ2LatrhH/nqhxcFungHvyanc=
-golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
-golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik=
 golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
-golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190328211700-ab21143f2384/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190621195816-6e04913cbbac/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
-golang.org/x/tools v0.0.0-20191029041327-9cc4af7d6b2c/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191029190741-b9c20aec41a5/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
-golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 h1:+cNy6SZtPcJQH3LJVLOSmiC7MMxXNOb3PU/VUEz+EhU=
-golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028/go.mod h1:NDW/Ps6MPRej6fsCIbMTohpP40sJ/P/vI1MoTEGwX90=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
-gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
-gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
-gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
-lukechampine.com/blake3 v1.2.1 h1:YuqqRuaqsGV71BV/nm9xlI0MKUv4QC54jQnBChWbGnI=
-lukechampine.com/blake3 v1.2.1/go.mod h1:0OFRp7fBtAylGVCO40o87sbupkyIGgbpv1+M1k1LM6k=
-tangled.sh/icyphox.sh/atproto-oauth v0.0.0-20250828064049-5d3e087a4dbe h1:SziWXF9Rlj6Uy4oQy+oKR5Kjm+zeMn3GH7eMs/K0qBY=
-tangled.sh/icyphox.sh/atproto-oauth v0.0.0-20250828064049-5d3e087a4dbe/go.mod h1:+oQi9S6IIDll0nxLZVhuzOPX8WKLCYEnE6M5kUKupDg=

server/handlers/atp/handler.go

···
+package atp
+
+import (
+    "bytes"
+    "encoding/json"
+    "net/http"
+    "time"
+
+    "github.com/johnluther/tap-editor/server/session"
+)
+
+// PDSRequestFunc issues an authenticated request to the user's PDS.
+type PDSRequestFunc func(http.ResponseWriter, *http.Request, string, string, string, []byte) (*http.Response, error)
+
+// UploadBlobFunc uploads a blob to the user's PDS.
+type UploadBlobFunc func(http.ResponseWriter, *http.Request, []byte) (*http.Response, error)
+
+// PDSBaseFunc returns the base URL for the user's PDS.
+type PDSBaseFunc func(*http.Request) string
+
+// GetDIDAndHandle returns the DID and handle for current user.
+type GetDIDAndHandle func(*http.Request) (string, string, bool)
+
+// GetSessionID returns/creates legacy session cookie id
+// used for server-side legacy session store
+// (compatible with existing main.getOrCreateSessionID).
+type GetSessionID func(http.ResponseWriter, *http.Request) string
+
+// Legacy session store accessors
+// These wrap server/session.Store methods used in legacy endpoints.
+type SessionGetFunc func(string) (session.Session, bool)
+type SessionSetFunc func(string, session.Session)
+type SessionDeleteFunc func(string)
+
+// Dependencies required by the ATProto handlers.
+type Dependencies struct {
+    PDSRequest          PDSRequestFunc
+    UploadBlobWithRetry UploadBlobFunc
+    PDSBase             PDSBaseFunc
+    GetDIDAndHandle     GetDIDAndHandle
+
+    GetSessionID    GetSessionID
+    LegacyGet       SessionGetFunc
+    LegacySet       SessionSetFunc
+    LegacyDelete    SessionDeleteFunc
+
+    MaxJSONBody  int64
+    MaxTextBytes int
+}
+
+// Handler provides /atp/* endpoints.
+type Handler struct{ deps Dependencies }
+
+// New constructs a Handler.
+func New(deps Dependencies) *Handler { return &Handler{deps: deps} }
+
+// Register attaches routes to mux.
+func (h *Handler) Register(mux *http.ServeMux) {
+    mux.HandleFunc("/atp/session", h.handleATPSession)
+    mux.HandleFunc("/atp/post", h.handleATPPost)
+    mux.HandleFunc("/atp/doc", h.handleATPDoc)
+}
+
+// handleATPSession manages a simple server-backed session store for Bluesky.
+// - GET: return current session (handle, did) or 204 if none
+// - POST: set/replace session from JSON body {did, handle, accessJwt, refreshJwt}
+// - DELETE: clear session
+func (h *Handler) handleATPSession(w http.ResponseWriter, r *http.Request) {
+    switch r.Method {
+    case http.MethodGet:
+        sid := h.deps.GetSessionID(w, r)
+        if s, ok := h.deps.LegacyGet(sid); ok && s.DID != "" {
+            w.Header().Set("Content-Type", "application/json; charset=utf-8")
+            _ = json.NewEncoder(w).Encode(struct{
+                DID    string `json:"did"`
+                Handle string `json:"handle"`
+            }{DID: s.DID, Handle: s.Handle})
+            return
+        }
+        w.WriteHeader(http.StatusNoContent)
+    case http.MethodPost:
+        w.Header().Set("Content-Type", "application/json; charset=utf-8")
+        r.Body = http.MaxBytesReader(w, r.Body, h.deps.MaxJSONBody)
+        var in struct {
+            Did        string `json:"did"`
+            Handle     string `json:"handle"`
+            AccessJwt  string `json:"accessJwt"`
+            RefreshJwt string `json:"refreshJwt"`
+        }
+        if err := json.NewDecoder(r.Body).Decode(&in); err != nil {
+            http.Error(w, "invalid json", http.StatusBadRequest)
+            return
+        }
+        sid := h.deps.GetSessionID(w, r)
+        h.deps.LegacySet(sid, session.Session{DID: in.Did, Handle: in.Handle, AccessJWT: in.AccessJwt, RefreshJWT: in.RefreshJwt})
+        w.WriteHeader(http.StatusNoContent)
+    case http.MethodDelete:
+        sid := h.deps.GetSessionID(w, r)
+        h.deps.LegacyDelete(sid)
+        w.WriteHeader(http.StatusNoContent)
+    default:
+        w.WriteHeader(http.StatusMethodNotAllowed)
+    }
+}
+
+// handleATPPost posts body.text to the user's repo as rkey "current" (put fallback create)
+func (h *Handler) handleATPPost(w http.ResponseWriter, r *http.Request) {
+    if r.Method != http.MethodPost {
+        w.WriteHeader(http.StatusMethodNotAllowed)
+        return
+    }
+    did, _, ok := h.deps.GetDIDAndHandle(r)
+    if !ok {
+        http.Error(w, "unauthorized", http.StatusUnauthorized)
+        return
+    }
+    w.Header().Set("Content-Type", "application/json; charset=utf-8")
+    r.Body = http.MaxBytesReader(w, r.Body, h.deps.MaxJSONBody)
+    var body struct{ Text string `json:"text"` }
+    if err := json.NewDecoder(r.Body).Decode(&body); err != nil || body.Text == "" {
+        http.Error(w, "invalid body", http.StatusBadRequest)
+        return
+    }
+    if len(body.Text) > h.deps.MaxTextBytes {
+        http.Error(w, "text too large", http.StatusRequestEntityTooLarge)
+        return
+    }
+    // Upload blob
+    blobRes, err := h.deps.UploadBlobWithRetry(w, r, []byte(body.Text))
+    if err != nil {
+        http.Error(w, "blob upload failed", http.StatusBadGateway)
+        return
+    }
+    defer blobRes.Body.Close()
+    var blobOut struct{ Blob map[string]any `json:"blob"` }
+    if err := json.NewDecoder(blobRes.Body).Decode(&blobOut); err != nil {
+        http.Error(w, "blob decode failed", http.StatusBadGateway)
+        return
+    }
+    // putRecord current, fallback createRecord
+    record := map[string]any{"$type": "lol.tapapp.tap.doc", "contentBlob": blobOut.Blob, "updatedAt": time.Now().UTC().Format(time.RFC3339Nano)}
+    putPayload := map[string]any{"repo": did, "collection": "lol.tapapp.tap.doc", "rkey": "current", "record": record}
+    pbuf, _ := json.Marshal(putPayload)
+    putURL := h.deps.PDSBase(r) + "/xrpc/com.atproto.repo.putRecord"
+    pRes, err := h.deps.PDSRequest(w, r, http.MethodPost, putURL, "application/json", pbuf)
+    if err == nil && pRes.StatusCode >= 200 && pRes.StatusCode < 300 {
+        defer pRes.Body.Close()
+        w.WriteHeader(http.StatusNoContent)
+        return
+    }
+    if pRes != nil {
+        pRes.Body.Close()
+    }
+    cPayload := map[string]any{"repo": did, "collection": "lol.tapapp.tap.doc", "rkey": "current", "record": record}
+    cbuf, _ := json.Marshal(cPayload)
+    cURL := h.deps.PDSBase(r) + "/xrpc/com.atproto.repo.createRecord"
+    cRes, err := h.deps.PDSRequest(w, r, http.MethodPost, cURL, "application/json", cbuf)
+    if err != nil {
+        http.Error(w, "create failed", http.StatusBadGateway)
+        return
+    }
+    defer cRes.Body.Close()
+    w.WriteHeader(cRes.StatusCode)
+}
+
+// handleATPDoc fetches the current doc and returns {text, updatedAt} JSON
+func (h *Handler) handleATPDoc(w http.ResponseWriter, r *http.Request) {
+    if r.Method != http.MethodGet {
+        w.WriteHeader(http.StatusMethodNotAllowed)
+        return
+    }
+    did, _, ok := h.deps.GetDIDAndHandle(r)
+    if !ok {
+        w.WriteHeader(http.StatusNoContent)
+        return
+    }
+    getURL := h.deps.PDSBase(r) + "/xrpc/com.atproto.repo.getRecord?repo=" + did + "&collection=lol.tapapp.tap.doc&rkey=current"
+    recRes, err := h.deps.PDSRequest(w, r, http.MethodGet, getURL, "", nil)
+    if err != nil {
+        http.Error(w, "get failed", http.StatusBadGateway)
+        return
+    }
+    defer recRes.Body.Close()
+    if recRes.StatusCode == http.StatusNotFound {
+        w.WriteHeader(http.StatusNoContent)
+        return
+    }
+    if recRes.StatusCode < 200 || recRes.StatusCode >= 300 {
+        w.WriteHeader(recRes.StatusCode)
+        return
+    }
+    var rec struct { Value map[string]any `json:"value"` }
+    if err := json.NewDecoder(recRes.Body).Decode(&rec); err != nil {
+        http.Error(w, "decode failed", http.StatusBadGateway)
+        return
+    }
+    var updatedAt string
+    if v, ok := rec.Value["updatedAt"].(string); ok {
+        updatedAt = v
+    }
+    // fetch blob
+    var cid string
+    if cb, ok := rec.Value["contentBlob"].(map[string]any); ok {
+        if ref, ok := cb["ref"].(map[string]any); ok {
+            if l, ok := ref["$link"].(string); ok {
+                cid = l
+            }
+        }
+    }
+    var text string
+    if cid != "" {
+        blobURL := h.deps.PDSBase(r) + "/xrpc/com.atproto.sync.getBlob?did=" + did + "&cid=" + cid
+        bRes, err := h.deps.PDSRequest(w, r, http.MethodGet, blobURL, "", nil)
+        if err == nil && bRes.StatusCode >= 200 && bRes.StatusCode < 300 {
+            defer bRes.Body.Close()
+            buf := new(bytes.Buffer)
+            _, _ = buf.ReadFrom(bRes.Body)
+            text = buf.String()
+        } else if bRes != nil {
+            bRes.Body.Close()
+        }
+    }
+    out := map[string]any{"text": text, "updatedAt": updatedAt}
+    w.Header().Set("Content-Type", "application/json; charset=utf-8")
+    _ = json.NewEncoder(w).Encode(out)
+}

server/handlers/oauth/handler.go

···
+package oauth
+
+import "net/http"
+
+// Deps allows wiring existing handler functions while we incrementally extract logic.
+type Deps struct {
+    HandleLogin          http.HandlerFunc
+    HandleCallback       http.HandlerFunc
+    HandleLogout         http.HandlerFunc
+    HandleClientMetadata http.HandlerFunc
+    HandleJWKS           http.HandlerFunc
+    HandleResume         http.HandlerFunc
+}
+
+// Handler registers OAuth-related routes.
+type Handler struct{ d Deps }
+
+func New(d Deps) *Handler { return &Handler{d: d} }
+
+func (h *Handler) Register(mux *http.ServeMux) {
+    if h.d.HandleLogin != nil {
+        mux.HandleFunc("/oauth/login", h.d.HandleLogin)
+    }
+    if h.d.HandleCallback != nil {
+        mux.HandleFunc("/oauth/callback", h.d.HandleCallback)
+    }
+    if h.d.HandleLogout != nil {
+        mux.HandleFunc("/oauth/logout", h.d.HandleLogout)
+    }
+    if h.d.HandleClientMetadata != nil {
+        mux.HandleFunc("/oauth/client-metadata.json", h.d.HandleClientMetadata)
+    }
+    if h.d.HandleJWKS != nil {
+        mux.HandleFunc("/oauth/jwks.json", h.d.HandleJWKS)
+    }
+    if h.d.HandleResume != nil {
+        mux.HandleFunc("/oauth/resume", h.d.HandleResume)
+    }
+}

server/handlers/oauth/manager.go

···
+package oauth
+
+import (
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/sha256"
+	"crypto/x509"
+	"encoding/base64"
+	"encoding/json"
+	"encoding/pem"
+	"fmt"
+	"log"
+	"net/http"
+	"os"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/gorilla/sessions"
+	"github.com/lestrrat-go/jwx/v2/jwk"
+)
+
+const (
+	// Use a distinct cookie name for Gorilla sessions to avoid colliding with
+	// the legacy 'tap_session' cookie used by non-OAuth flows.
+	SessionName = "tap_oauth"
+	oauthScope  = "atproto transition:generic"
+)
+
+type OAuthSession struct {
+	Did                 string
+	Handle              string
+	PdsUrl              string
+	DpopAuthserverNonce string
+	AuthServerIss       string
+	DpopPrivateJwk      string
+	TokenType           string
+	Scope               string
+	AccessJwt           string
+	RefreshJwt          string
+	Expiry              time.Time
+}
+
+type OAuthManager struct {
+	store         *sessions.CookieStore
+	oauthRequests map[string]OAuthRequest
+	oauthSessions map[string]OAuthSession
+	mu            sync.RWMutex
+	jwks          string
+	clientURI     string
+	privateKey    *ecdsa.PrivateKey
+	jwksKid       string
+}
+
+type OAuthRequest struct {
+	State               string
+	Handle              string
+	Did                 string
+	PdsUrl              string
+	PkceVerifier        string
+	PkceChallenge       string
+	DpopAuthserverNonce string
+	DpopPrivateJwk      string
+	AuthserverIss       string
+	ReturnUrl           string
+}
+
+// NewManager initializes the OAuth manager with cookie store and signing key.
+func NewManager(clientURI, cookieSecret string) *OAuthManager {
+	jwks, privKey, kid := loadOrGenerateKey()
+	store := sessions.NewCookieStore([]byte(cookieSecret))
+	store.Options = &sessions.Options{
+		Path:     "/",
+		HttpOnly: true,
+		Secure:   strings.HasPrefix(clientURI, "https://"),
+		SameSite: http.SameSiteLaxMode,
+		MaxAge:   30 * 24 * 3600, // 30 days
+	}
+	return &OAuthManager{
+		store:         store,
+		oauthRequests: make(map[string]OAuthRequest),
+		oauthSessions: make(map[string]OAuthSession),
+		jwks:          jwks,
+		clientURI:     clientURI,
+		privateKey:    privKey,
+		jwksKid:       kid,
+	}
+}
+
+// Public helpers
+func (o *OAuthManager) ClientMetadata() map[string]interface{} {
+	clientID := fmt.Sprintf("%s/oauth/client-metadata.json", o.clientURI)
+	redirectURIs := []string{fmt.Sprintf("%s/oauth/callback", o.clientURI)}
+	jwksURI := fmt.Sprintf("%s/oauth/jwks.json", o.clientURI)
+
+	return map[string]interface{}{
+		"client_id":                       clientID,
+		"client_name":                     "Tap App",
+		"subject_type":                    "public",
+		"client_uri":                      o.clientURI,
+		"redirect_uris":                   redirectURIs,
+		"grant_types":                     []string{"authorization_code", "refresh_token"},
+		"response_types":                  []string{"code"},
+		"application_type":                "web",
+		"dpop_bound_access_tokens":        true,
+		"jwks_uri":                        jwksURI,
+		"scope":                           oauthScope,
+		"token_endpoint_auth_method":      "private_key_jwt",
+		"token_endpoint_auth_signing_alg": "ES256",
+	}
+}
+
+func (o *OAuthManager) SaveSession(did string, sess OAuthSession) {
+	o.mu.Lock()
+	defer o.mu.Unlock()
+	o.oauthSessions[did] = sess
+}
+
+func (o *OAuthManager) GetSession(did string) (OAuthSession, bool) {
+	o.mu.RLock()
+	defer o.mu.RUnlock()
+	sess, ok := o.oauthSessions[did]
+	return sess, ok
+}
+
+func (o *OAuthManager) DeleteSession(did string) {
+	o.mu.Lock()
+	defer o.mu.Unlock()
+	delete(o.oauthSessions, did)
+}
+
+func (o *OAuthManager) SaveRequest(state string, req OAuthRequest) {
+	o.mu.Lock()
+	defer o.mu.Unlock()
+	o.oauthRequests[state] = req
+}
+
+func (o *OAuthManager) GetRequest(state string) (OAuthRequest, bool) {
+	o.mu.RLock()
+	defer o.mu.RUnlock()
+	req, ok := o.oauthRequests[state]
+	return req, ok
+}
+
+func (o *OAuthManager) DeleteRequest(state string) {
+	o.mu.Lock()
+	defer o.mu.Unlock()
+	delete(o.oauthRequests, state)
+}
+
+// Cookie helpers
+func (o *OAuthManager) GetSessionFromCookie(r *http.Request) (OAuthSession, bool) {
+	s, err := o.store.Get(r, SessionName)
+	if err != nil || s.IsNew {
+		return OAuthSession{}, false
+	}
+	did, _ := s.Values["did"].(string)
+	handle, _ := s.Values["handle"].(string)
+	pds, _ := s.Values["pds"].(string)
+	ttype, _ := s.Values["token_type"].(string)
+	scope, _ := s.Values["scope"].(string)
+	access, _ := s.Values["access_jwt"].(string)
+	refresh, _ := s.Values["refresh_jwt"].(string)
+	expStr, _ := s.Values["expiry"].(string)
+	var exp time.Time
+	if expStr != "" {
+		if t, err := time.Parse(time.RFC3339, expStr); err == nil {
+			exp = t
+		}
+	}
+	if did == "" || access == "" {
+		return OAuthSession{}, false
+	}
+	return OAuthSession{
+		Did:        did,
+		Handle:     handle,
+		PdsUrl:     pds,
+		TokenType:  ttype,
+		Scope:      scope,
+		AccessJwt:  access,
+		RefreshJwt: refresh,
+		Expiry:     exp,
+	}, true
+}
+
+func (o *OAuthManager) SaveSessionToCookie(r *http.Request, w http.ResponseWriter, sess OAuthSession) error {
+	s, err := o.store.Get(r, SessionName)
+	if err != nil {
+		return err
+	}
+	s.Values["did"] = sess.Did
+	s.Values["handle"] = sess.Handle
+	s.Values["pds"] = sess.PdsUrl
+	s.Values["token_type"] = sess.TokenType
+	s.Values["scope"] = sess.Scope
+	s.Values["access_jwt"] = sess.AccessJwt
+	s.Values["refresh_jwt"] = sess.RefreshJwt
+	if !sess.Expiry.IsZero() {
+		s.Values["expiry"] = sess.Expiry.UTC().Format(time.RFC3339)
+	}
+	return s.Save(r, w)
+}
+
+func (o *OAuthManager) ClearSession(r *http.Request, w http.ResponseWriter) error {
+	s, err := o.store.Get(r, SessionName)
+	if err != nil {
+		return err
+	}
+	if did, ok := s.Values["did"].(string); ok {
+		o.DeleteSession(did)
+	}
+	s.Options.MaxAge = -1
+	return s.Save(r, w)
+}
+
+// DPoP and client assertion
+func (o *OAuthManager) generateClientAssertion(clientID, tokenURL string) (string, error) {
+	now := time.Now().Unix()
+	jtiBytes := make([]byte, 16)
+	if _, err := rand.Read(jtiBytes); err != nil {
+		return "", fmt.Errorf("failed to generate jti: %w", err)
+	}
+	jti := base64.RawURLEncoding.EncodeToString(jtiBytes)
+	claims := map[string]any{
+		"iss": clientID,
+		"sub": clientID,
+		"aud": []string{tokenURL, "https://bsky.social"},
+		"iat": now,
+		"exp": now + 300,
+		"jti": jti,
+	}
+	header := map[string]any{
+		"alg": "ES256",
+		"typ": "JWT",
+		"kid": o.jwksKid,
+	}
+	headerJSON, _ := json.Marshal(header)
+	payloadJSON, _ := json.Marshal(claims)
+	signingInput := base64.RawURLEncoding.EncodeToString(headerJSON) + "." + base64.RawURLEncoding.EncodeToString(payloadJSON)
+	hash := sha256.Sum256([]byte(signingInput))
+	r, s, err := ecdsa.Sign(rand.Reader, o.privateKey, hash[:])
+	if err != nil {
+		return "", fmt.Errorf("failed to sign client assertion: %w", err)
+	}
+	rBytes := make([]byte, 32)
+	sBytes := make([]byte, 32)
+	r.FillBytes(rBytes)
+	s.FillBytes(sBytes)
+	signature := append(rBytes, sBytes...)
+	sigB64 := base64.RawURLEncoding.EncodeToString(signature)
+	return signingInput + "." + sigB64, nil
+}
+
+func (o *OAuthManager) generateDPoPProof(httpMethod, httpUri string, nonce ...string) (string, error) {
+	return o.generateDPoPProofWithToken(httpMethod, httpUri, "", nonce...)
+}
+
+func (o *OAuthManager) generateDPoPProofWithToken(httpMethod, httpUri, accessToken string, nonce ...string) (string, error) {
+	log.Printf("DPoP: Generating DPoP proof using standard JWT approach")
+	now := time.Now().Unix()
+	jtiBytes := make([]byte, 16)
+	if _, err := rand.Read(jtiBytes); err != nil {
+		log.Printf("DPoP: ERROR - failed to generate jti: %v", err)
+		return "", fmt.Errorf("failed to generate jti: %w", err)
+	}
+	jti := base64.RawURLEncoding.EncodeToString(jtiBytes)
+	claims := map[string]interface{}{
+		"iat": now,
+		"htu": httpUri,
+		"htm": httpMethod,
+		"jti": jti,
+	}
+	if accessToken != "" {
+		athHash := sha256.Sum256([]byte(accessToken))
+		claims["ath"] = base64.RawURLEncoding.EncodeToString(athHash[:])
+	}
+	if len(nonce) > 0 && nonce[0] != "" {
+		claims["nonce"] = nonce[0]
+		log.Printf("DPoP: Added nonce to claims: %s", nonce[0])
+	}
+	pubKey := &o.privateKey.PublicKey
+	jwkKey, err := jwk.FromRaw(pubKey)
+	if err != nil {
+		log.Printf("DPoP: ERROR - failed to create JWK: %v", err)
+		return "", fmt.Errorf("failed to create JWK: %v", err)
+	}
+	kid := fmt.Sprintf("%d", time.Now().Unix())
+	if err := jwkKey.Set(jwk.KeyIDKey, kid); err != nil {
+		log.Printf("DPoP: ERROR - failed to set kid: %v", err)
+		return "", fmt.Errorf("failed to set kid: %v", err)
+	}
+	jwkJSON, err := json.Marshal(jwkKey)
+	if err != nil {
+		log.Printf("DPoP: ERROR - failed to marshal JWK: %v", err)
+		return "", fmt.Errorf("failed to marshal JWK: %w", err)
+	}
+	header := map[string]interface{}{
+		"typ": "dpop+jwt",
+		"alg": "ES256",
+		"jwk": json.RawMessage(jwkJSON),
+	}
+	headerJSON, _ := json.Marshal(header)
+	payloadJSON, _ := json.Marshal(claims)
+	headerB64 := base64.RawURLEncoding.EncodeToString(headerJSON)
+	payloadB64 := base64.RawURLEncoding.EncodeToString(payloadJSON)
+	signingInput := headerB64 + "." + payloadB64
+	h := sha256.Sum256([]byte(signingInput))
+	r, s, err := ecdsa.Sign(rand.Reader, o.privateKey, h[:])
+	if err != nil {
+		log.Printf("DPoP: ERROR - failed to sign: %v", err)
+		return "", fmt.Errorf("failed to sign: %w", err)
+	}
+	rBytes := make([]byte, 32)
+	sBytes := make([]byte, 32)
+	r.FillBytes(rBytes)
+	s.FillBytes(sBytes)
+	signature := append(rBytes, sBytes...)
+	signatureB64 := base64.RawURLEncoding.EncodeToString(signature)
+	return signingInput + "." + signatureB64, nil
+}
+
+// Internal helpers
+func loadOrGenerateKey() (string, *ecdsa.PrivateKey, string) {
+	if pemStr := os.Getenv("OAUTH_ES256_PRIVATE_KEY_PEM"); pemStr != "" {
+		data := []byte(pemStr)
+		if !strings.Contains(pemStr, "-----BEGIN") {
+			if dec, err := base64.StdEncoding.DecodeString(pemStr); err == nil {
+				data = dec
+			}
+		}
+		blk, _ := pem.Decode(data)
+		if blk == nil {
+			log.Fatal("failed to decode OAUTH_ES256_PRIVATE_KEY_PEM: invalid PEM block")
+		}
+		if pk, err := x509.ParseECPrivateKey(blk.Bytes); err == nil {
+			jwks, kid := jwksFromPrivateKey(pk)
+			return jwks, pk, kid
+		}
+		if pkAny, err := x509.ParsePKCS8PrivateKey(blk.Bytes); err == nil {
+			if ecdsaKey, ok := pkAny.(*ecdsa.PrivateKey); ok {
+				jwks, kid := jwksFromPrivateKey(ecdsaKey)
+				return jwks, ecdsaKey, kid
+			}
+			log.Fatal("OAUTH_ES256_PRIVATE_KEY_PEM is PKCS#8 but not an ECDSA key")
+		}
+		log.Fatal("failed to parse OAUTH_ES256_PRIVATE_KEY_PEM as EC or PKCS#8 ECDSA key")
+	}
+	privKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		log.Fatal("failed to generate key:", err)
+	}
+	jwks, kid := jwksFromPrivateKey(privKey)
+	return jwks, privKey, kid
+}
+
+func jwksFromPrivateKey(privKey *ecdsa.PrivateKey) (string, string) {
+	pubKey := &privKey.PublicKey
+	key, err := jwk.FromRaw(pubKey)
+	if err != nil {
+		log.Fatal("failed to create jwk from public key:", err)
+	}
+	xb := pubKey.X.Bytes()
+	yb := pubKey.Y.Bytes()
+	if len(xb) < 32 {
+		px := make([]byte, 32)
+		copy(px[32-len(xb):], xb)
+		xb = px
+	}
+	if len(yb) < 32 {
+		py := make([]byte, 32)
+		copy(py[32-len(yb):], yb)
+		yb = py
+	}
+	raw := make([]byte, 1+32+32)
+	raw[0] = 0x04
+	copy(raw[1:33], xb)
+	copy(raw[33:], yb)
+	sum := sha256.Sum256(raw)
+	kid := base64.RawURLEncoding.EncodeToString(sum[:])
+	if err := key.Set(jwk.KeyIDKey, kid); err != nil {
+		log.Fatal("failed to set kid:", err)
+	}
+	if err := key.Set("use", "sig"); err != nil {
+		log.Fatal("failed to set use:", err)
+	}
+	if err := key.Set("alg", "ES256"); err != nil {
+		log.Fatal("failed to set alg:", err)
+	}
+	jwks := map[string]any{"keys": []any{key}}
+	b, err := json.Marshal(jwks)
+	if err != nil {
+		log.Fatal("failed to marshal jwks:", err)
+	}
+	return string(b), kid
+}
+
+// User represents the current authorized user summary for callers.
+type User struct {
+    Handle string
+    Did    string
+    Pds    string
+}
+
+// GetUser returns a lightweight user summary if an OAuth session cookie is present.
+// It prefers the in-memory session but will rehydrate from cookie automatically.
+func (o *OAuthManager) GetUser(r *http.Request) *User {
+    s, err := o.store.Get(r, SessionName)
+    if err != nil || s.IsNew {
+        return nil
+    }
+    did, _ := s.Values["did"].(string)
+    if did == "" {
+        return nil
+    }
+    // Prefer in-memory session
+    if sess, ok := o.GetSession(did); ok {
+        return &User{Handle: sess.Handle, Did: sess.Did, Pds: sess.PdsUrl}
+    }
+    // Rehydrate from cookie store values
+    if sess, ok := o.GetSessionFromCookie(r); ok {
+        o.SaveSession(sess.Did, sess)
+        return &User{Handle: sess.Handle, Did: sess.Did, Pds: sess.PdsUrl}
+    }
+    return &User{Did: did}
+}
+
+// GenerateDPoPProofWithToken exposes DPoP generation with optional 'ath' and nonce.
+func (o *OAuthManager) GenerateDPoPProofWithToken(method, uri, accessToken string, nonce ...string) (string, error) {
+    return o.generateDPoPProofWithToken(method, uri, accessToken, nonce...)
+}

server/handlers/oauth/manager_test.go

···
+package oauth
+
+import (
+    "encoding/json"
+    "net/http"
+    "net/http/httptest"
+    "testing"
+    "time"
+)
+
+func TestClientMetadataIncludesFields(t *testing.T) {
+    om := NewManager("http://localhost:8080", "test-secret")
+    md := om.ClientMetadata()
+    // Basic presence checks
+    if md["client_id"] == nil || md["jwks_uri"] == nil || md["redirect_uris"] == nil {
+        t.Fatalf("metadata missing required fields: %v", md)
+    }
+    if md["token_endpoint_auth_signing_alg"] != "ES256" {
+        t.Fatalf("expected ES256 alg, got %v", md["token_endpoint_auth_signing_alg"])
+    }
+}
+
+func TestSaveAndGetSessionViaCookie(t *testing.T) {
+    om := NewManager("http://localhost:8080", "test-secret")
+
+    // Prepare a response to set cookie
+    rr := httptest.NewRecorder()
+    req := httptest.NewRequest(http.MethodGet, "/", nil)
+
+    sess := OAuthSession{
+        Did:        "did:plc:123",
+        Handle:     "user.test",
+        PdsUrl:     "https://bsky.social",
+        TokenType:  "DPoP",
+        Scope:      "atproto transition:generic",
+        AccessJwt:  "access",
+        RefreshJwt: "refresh",
+        Expiry:     time.Now().Add(30 * time.Minute),
+    }
+    if err := om.SaveSessionToCookie(req, rr, sess); err != nil {
+        t.Fatalf("SaveSessionToCookie error: %v", err)
+    }
+
+    // Simulate a subsequent request with the set-cookie
+    res := rr.Result()
+    defer res.Body.Close()
+    var cookie *http.Cookie
+    for _, c := range res.Cookies() {
+        if c.Name == SessionName {
+            cookie = c
+            break
+        }
+    }
+    if cookie == nil {
+        t.Fatalf("expected cookie %s to be set", SessionName)
+    }
+
+    r2 := httptest.NewRequest(http.MethodGet, "/", nil)
+    r2.AddCookie(cookie)
+
+    got, ok := om.GetSessionFromCookie(r2)
+    if !ok {
+        t.Fatalf("GetSessionFromCookie returned false")
+    }
+    if got.Did != sess.Did || got.Handle != sess.Handle || got.AccessJwt != sess.AccessJwt {
+        t.Fatalf("session mismatch: got=%+v want=%+v", got, sess)
+    }
+}
+
+func TestJWKSAndMetadataRoutes(t *testing.T) {
+    om := NewManager("http://localhost:8080", "test-secret")
+
+    // JWKS
+    rr := httptest.NewRecorder()
+    req := httptest.NewRequest(http.MethodGet, "/oauth/jwks.json", nil)
+    om.handleJWKS(rr, req)
+    if rr.Code != http.StatusOK {
+        t.Fatalf("jwks status=%d", rr.Code)
+    }
+    var jw map[string]any
+    if err := json.Unmarshal(rr.Body.Bytes(), &jw); err != nil {
+        t.Fatalf("jwks invalid json: %v", err)
+    }
+    if _, ok := jw["keys"]; !ok {
+        t.Fatalf("jwks missing keys: %v", jw)
+    }
+
+    // Client metadata
+    rr2 := httptest.NewRecorder()
+    req2 := httptest.NewRequest(http.MethodGet, "/oauth/client-metadata.json", nil)
+    om.handleClientMetadata(rr2, req2)
+    if rr2.Code != http.StatusOK {
+        t.Fatalf("metadata status=%d", rr2.Code)
+    }
+    var md map[string]any
+    if err := json.Unmarshal(rr2.Body.Bytes(), &md); err != nil {
+        t.Fatalf("metadata invalid json: %v", err)
+    }
+    if md["client_id"] == nil || md["jwks_uri"] == nil {
+        t.Fatalf("metadata missing fields: %v", md)
+    }
+}

server/handlers/oauth/routes.go

···
+package oauth
+
+import (
+	"encoding/json"
+	"net/http"
+	"strings"
+	"time"
+)
+
+// RegisterBasic registers the simpler OAuth routes that do not require
+// refactoring the login/callback flow yet.
+func (o *OAuthManager) RegisterBasic(mux *http.ServeMux) {
+	mux.HandleFunc("/oauth/client-metadata.json", o.handleClientMetadata)
+	mux.HandleFunc("/oauth/jwks.json", o.handleJWKS)
+	mux.HandleFunc("/oauth/logout", o.handleLogout)
+	mux.HandleFunc("/oauth/resume", o.handleResume)
+}
+
+func (o *OAuthManager) handleClientMetadata(w http.ResponseWriter, r *http.Request) {
+	w.Header().Set("Content-Type", "application/json")
+	_ = json.NewEncoder(w).Encode(o.ClientMetadata())
+}
+
+func (o *OAuthManager) handleJWKS(w http.ResponseWriter, r *http.Request) {
+	w.Header().Set("Content-Type", "application/json")
+	_, _ = w.Write([]byte(o.jwks))
+}
+
+func (o *OAuthManager) handleLogout(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost && r.Method != http.MethodGet {
+		w.WriteHeader(http.StatusMethodNotAllowed)
+		return
+	}
+	if err := o.ClearSession(r, w); err != nil {
+		http.Error(w, "failed to clear session", http.StatusInternalServerError)
+		return
+	}
+	w.WriteHeader(http.StatusNoContent)
+}
+
+// handleResume allows the client to repopulate the server-side OAuth session
+// after restarts by POSTing current token state.
+func (o *OAuthManager) handleResume(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		w.WriteHeader(http.StatusMethodNotAllowed)
+		return
+	}
+	r.Body = http.MaxBytesReader(w, r.Body, 32<<10) // 32 KiB
+	var in struct {
+		Did        string `json:"did"`
+		Handle     string `json:"handle"`
+		PdsUrl     string `json:"pdsUrl"`
+		TokenType  string `json:"tokenType"`
+		Scope      string `json:"scope"`
+		AccessJwt  string `json:"accessJwt"`
+		RefreshJwt string `json:"refreshJwt"`
+		Expiry     string `json:"expiry"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&in); err != nil {
+		http.Error(w, "invalid json", http.StatusBadRequest)
+		return
+	}
+	if in.Did == "" || in.AccessJwt == "" {
+		http.Error(w, "missing did/accessJwt", http.StatusBadRequest)
+		return
+	}
+	var exp time.Time
+	if strings.TrimSpace(in.Expiry) != "" {
+		if t, err := time.Parse(time.RFC3339, in.Expiry); err == nil {
+			exp = t
+		}
+	}
+	sess := OAuthSession{
+		Did:        in.Did,
+		Handle:     in.Handle,
+		PdsUrl:     in.PdsUrl,
+		TokenType:  in.TokenType,
+		Scope:      in.Scope,
+		AccessJwt:  in.AccessJwt,
+		RefreshJwt: in.RefreshJwt,
+		Expiry:     exp,
+	}
+	o.SaveSession(sess.Did, sess)
+	if err := o.SaveSessionToCookie(r, w, sess); err != nil {
+		http.Error(w, "failed to persist session", http.StatusInternalServerError)
+		return
+	}
+	w.WriteHeader(http.StatusNoContent)
+}

server/handlers/oauth/routes_login.go

···
+package oauth
+
+import (
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+)
+
+// LoginOpts allows main to hook legacy session behavior (e.g., tap_session store).
+type LoginOpts struct {
+	// OnLegacySession is invoked after we persist OAuthSession.
+	// Use this to set legacy cookies and server-side session store.
+	OnLegacySession func(w http.ResponseWriter, r *http.Request, sess OAuthSession)
+}
+
+// RegisterLoginAndCallback registers /oauth/login and /oauth/callback using the manager.
+func (o *OAuthManager) RegisterLoginAndCallback(mux *http.ServeMux, opts LoginOpts) {
+	mux.HandleFunc("/oauth/login", func(w http.ResponseWriter, r *http.Request) { o.handleLogin(w, r) })
+	mux.HandleFunc("/oauth/callback", func(w http.ResponseWriter, r *http.Request) { o.handleCallback(w, r, opts) })
+}
+
+func (o *OAuthManager) handleLogin(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		w.WriteHeader(http.StatusMethodNotAllowed)
+		return
+	}
+	handle := r.URL.Query().Get("handle")
+	if handle == "" {
+		http.Error(w, "missing handle", http.StatusBadRequest)
+		return
+	}
+	state := generateState()
+	verifier, challenge, err := generatePKCE()
+	if err != nil {
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+	resourcePDS := "https://bsky.social"
+	if did, err := resolveHandle(handle); err == nil && strings.HasPrefix(did, "did:plc:") {
+		if u, err2 := resolvePDSFromPLC(did); err2 == nil && u != "" {
+			resourcePDS = u
+		}
+	}
+	req := OAuthRequest{
+		State:         state,
+		Handle:        handle,
+		ReturnUrl:     r.URL.Query().Get("return_url"),
+		PkceVerifier:  verifier,
+		PkceChallenge: challenge,
+		PdsUrl:        resourcePDS,
+	}
+	b, _ := json.Marshal(req)
+	http.SetCookie(w, &http.Cookie{
+		Name:     "oauth_request",
+		Value:    base64.StdEncoding.EncodeToString(b),
+		Path:     "/",
+		HttpOnly: true,
+		Secure:   strings.HasPrefix(o.clientURI, "https://"),
+		SameSite: http.SameSiteLaxMode,
+		MaxAge:   300,
+	})
+	authURL := "https://bsky.social/oauth/authorize?" + url.Values{
+		"client_id":             {o.clientURI + "/oauth/client-metadata.json"},
+		"redirect_uri":          {o.clientURI + "/oauth/callback"},
+		"response_type":         {"code"},
+		"scope":                 {oauthScope},
+		"state":                 {state},
+		"code_challenge":        {challenge},
+		"code_challenge_method": {"S256"},
+		"resource":              {resourcePDS},
+	}.Encode()
+	http.Redirect(w, r, authURL, http.StatusFound)
+}
+
+func (o *OAuthManager) handleCallback(w http.ResponseWriter, r *http.Request, opts LoginOpts) {
+	if r.Method != http.MethodGet {
+		w.WriteHeader(http.StatusMethodNotAllowed)
+		return
+	}
+	code := r.URL.Query().Get("code")
+	state := r.URL.Query().Get("state")
+	if code == "" || state == "" {
+		http.Error(w, "missing code or state", http.StatusBadRequest)
+		return
+	}
+	c, err := r.Cookie("oauth_request")
+	if err != nil {
+		http.Error(w, "invalid state", http.StatusBadRequest)
+		return
+	}
+	raw, err := base64.StdEncoding.DecodeString(c.Value)
+	if err != nil {
+		http.Error(w, "invalid state", http.StatusBadRequest)
+		return
+	}
+	var ore OAuthRequest
+	if err := json.Unmarshal(raw, &ore); err != nil || ore.State != state {
+		http.Error(w, "invalid state", http.StatusBadRequest)
+		return
+	}
+	resourcePDS := ore.PdsUrl
+	if resourcePDS == "" && ore.Handle != "" {
+		if did, err := resolveHandle(ore.Handle); err == nil && strings.HasPrefix(did, "did:plc:") {
+			if u, err2 := resolvePDSFromPLC(did); err2 == nil && u != "" {
+				resourcePDS = u
+			}
+		}
+	}
+	if resourcePDS == "" {
+		resourcePDS = "https://bsky.social"
+	}
+	tokenURL := "https://bsky.social/oauth/token"
+	clientID := o.clientURI + "/oauth/client-metadata.json"
+	form := url.Values{
+		"grant_type":    {"authorization_code"},
+		"code":          {code},
+		"redirect_uri":  {o.clientURI + "/oauth/callback"},
+		"code_verifier": {ore.PkceVerifier},
+		"client_id":     {clientID},
+		"scope":         {oauthScope},
+		"resource":      {resourcePDS},
+	}
+	assertion, err := o.generateClientAssertion(clientID, tokenURL)
+	if err != nil {
+		http.Error(w, "token exchange failed", http.StatusInternalServerError)
+		return
+	}
+	form.Set("client_assertion_type", "urn:ietf:params:oauth:client-assertion-type:jwt-bearer")
+	form.Set("client_assertion", assertion)
+	buildReq := func(dpop string) (*http.Request, error) {
+		req, err := http.NewRequest(http.MethodPost, tokenURL, strings.NewReader(form.Encode()))
+		if err != nil {
+			return nil, err
+		}
+		req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+		req.Header.Set("Accept", "application/json")
+		if dpop != "" {
+			req.Header.Set("DPoP", dpop)
+		}
+		return req, nil
+	}
+	dpop, err := o.generateDPoPProof("POST", tokenURL, "")
+	if err != nil {
+		http.Error(w, "dpop generation failed", http.StatusInternalServerError)
+		return
+	}
+	req1, _ := buildReq(dpop)
+	res, err := http.DefaultClient.Do(req1)
+	if err != nil {
+		http.Error(w, "token exchange failed", http.StatusBadGateway)
+		return
+	}
+	body, _ := io.ReadAll(res.Body)
+	res.Body.Close()
+	if res.StatusCode == http.StatusBadRequest {
+		var er struct{ Error string `json:"error"` }
+		_ = json.Unmarshal(body, &er)
+		if er.Error == "use_dpop_nonce" {
+			if nonce := res.Header.Get("DPoP-Nonce"); nonce != "" {
+				dpop2, err2 := o.generateDPoPProof("POST", tokenURL, nonce)
+				if err2 == nil {
+					req2, _ := buildReq(dpop2)
+					res, err = http.DefaultClient.Do(req2)
+					if err == nil {
+						body, _ = io.ReadAll(res.Body)
+						res.Body.Close()
+					}
+				}
+			}
+		}
+	}
+	if res.StatusCode != http.StatusOK {
+		http.Error(w, "token exchange failed", http.StatusBadRequest)
+		return
+	}
+	var tok struct {
+		AccessToken  string `json:"access_token"`
+		RefreshToken string `json:"refresh_token"`
+		TokenType    string `json:"token_type"`
+		ExpiresIn    int    `json:"expires_in"`
+		Scope        string `json:"scope"`
+		Sub          string `json:"sub"`
+		Aud          string `json:"aud"`
+	}
+	if err := json.Unmarshal(body, &tok); err != nil || tok.Sub == "" {
+		http.Error(w, "token decode failed", http.StatusInternalServerError)
+		return
+	}
+	pdsURL := "https://bsky.social"
+	if strings.HasPrefix(tok.Aud, "did:web:") {
+		host := strings.TrimPrefix(tok.Aud, "did:web:")
+		if host != "" {
+			pdsURL = "https://" + host
+		}
+	} else if strings.HasPrefix(tok.Sub, "did:plc:") {
+		if u, err := resolvePDSFromPLC(tok.Sub); err == nil && u != "" {
+			pdsURL = u
+		}
+	}
+	sess := OAuthSession{
+		Did:        tok.Sub,
+		Handle:     ore.Handle,
+		PdsUrl:     pdsURL,
+		TokenType:  tok.TokenType,
+		Scope:      tok.Scope,
+		AccessJwt:  tok.AccessToken,
+		RefreshJwt: tok.RefreshToken,
+		Expiry:     time.Now().Add(time.Duration(tok.ExpiresIn) * time.Second),
+	}
+	o.SaveSession(sess.Did, sess)
+	_ = o.SaveSessionToCookie(r, w, sess)
+	// Invoke legacy hook if provided (e.g., set tap_session + sessionStore)
+	if opts.OnLegacySession != nil {
+		opts.OnLegacySession(w, r, sess)
+	}
+	// Clear oauth_request cookie
+	http.SetCookie(w, &http.Cookie{
+		Name:     "oauth_request",
+		Value:    "",
+		Path:     "/",
+		HttpOnly: true,
+		Secure:   strings.HasPrefix(o.clientURI, "https://"),
+		SameSite: http.SameSiteLaxMode,
+		MaxAge:   -1,
+	})
+	ret := ore.ReturnUrl
+	if ret == "" { ret = "/" }
+	http.Redirect(w, r, ret, http.StatusFound)
+}
+
+// Helpers
+func generateState() string {
+	b := make([]byte, 16)
+	_, _ = rand.Read(b)
+	return hex.EncodeToString(b)
+}
+
+func generatePKCE() (verifier, challenge string, err error) {
+	verifierBytes := make([]byte, 32)
+	if _, err := rand.Read(verifierBytes); err != nil { return "", "", err }
+	verifier = base64.RawURLEncoding.EncodeToString(verifierBytes)
+	hash := sha256.Sum256([]byte(verifier))
+	challenge = base64.RawURLEncoding.EncodeToString(hash[:])
+	return verifier, challenge, nil
+}
+
+func resolveHandle(handle string) (string, error) {
+	u := "https://bsky.social/xrpc/com.atproto.identity.resolveHandle?handle=" + url.QueryEscape(handle)
+	req, _ := http.NewRequest(http.MethodGet, u, nil)
+	req.Header.Set("Accept", "application/json")
+	res, err := http.DefaultClient.Do(req)
+	if err != nil { return "", err }
+	defer res.Body.Close()
+	if res.StatusCode != http.StatusOK { return "", fmt.Errorf("status %d", res.StatusCode) }
+	var out struct { Did string `json:"did"` }
+	if err := json.NewDecoder(res.Body).Decode(&out); err != nil { return "", err }
+	if out.Did == "" { return "", fmt.Errorf("no did") }
+	return out.Did, nil
+}
+
+func resolvePDSFromPLC(did string) (string, error) {
+	u := "https://plc.directory/" + url.PathEscape(did)
+	req, _ := http.NewRequest(http.MethodGet, u, nil)
+	req.Header.Set("Accept", "application/json")
+	res, err := http.DefaultClient.Do(req)
+	if err != nil { return "", err }
+	defer res.Body.Close()
+	if res.StatusCode != http.StatusOK { return "", fmt.Errorf("status %d", res.StatusCode) }
+	var doc struct {
+		Service []struct {
+			ID   string `json:"id"`
+			Type string `json:"type"`
+			URL  string `json:"serviceEndpoint"`
+		} `json:"service"`
+	}
+	if err := json.NewDecoder(res.Body).Decode(&doc); err != nil { return "", err }
+	for _, s := range doc.Service {
+		if s.Type == "AtprotoPersonalDataServer" && strings.HasPrefix(s.URL, "http") {
+			return s.URL, nil
+		}
+	}
+	return "", fmt.Errorf("pds not found")
+}

server/handlers/oauth/routes_login_test.go

···
+package oauth
+
+import (
+    "encoding/base64"
+    "encoding/json"
+    "io"
+    "net/http"
+    "net/http/httptest"
+    "net/url"
+    "strings"
+    "testing"
+)
+
+type mockTransport struct{ round func(req *http.Request) *http.Response }
+
+func TestCallbackRedirectTarget(t *testing.T) {
+    // Token endpoint will succeed on first try
+    prev := http.DefaultTransport
+    http.DefaultTransport = mockTransport{round: func(req *http.Request) *http.Response {
+        if req.Method == http.MethodPost && strings.Contains(req.URL.Path, "/oauth/token") {
+            tok := map[string]any{
+                "access_token":"acc","refresh_token":"ref","token_type":"DPoP","expires_in": 3600,
+                "scope":"atproto transition:generic","sub":"did:plc:abc","aud":"did:web:pds.example",
+            }
+            return newJSONResponse(200, tok, nil)
+        }
+        return newJSONResponse(404, map[string]string{"error":"not_found"}, nil)
+    }}
+    defer func(){ http.DefaultTransport = prev }()
+
+    om := NewManager("http://localhost:8080", "test-secret")
+    mux := http.NewServeMux()
+    om.RegisterLoginAndCallback(mux, LoginOpts{})
+
+    // With explicit ReturnUrl
+    ore := OAuthRequest{ State: "st", Handle: "user.test", ReturnUrl: "/library", PkceVerifier: "ver", PkceChallenge: "chal" }
+    b, _ := json.Marshal(ore)
+    c := &http.Cookie{Name: "oauth_request", Value: base64.StdEncoding.EncodeToString(b), Path: "/"}
+    rr := httptest.NewRecorder()
+    q := url.Values{"code": {"abc"}, "state": {"st"}}
+    req := httptest.NewRequest(http.MethodGet, "/oauth/callback?"+q.Encode(), nil)
+    req.AddCookie(c)
+    mux.ServeHTTP(rr, req)
+    if rr.Code != http.StatusFound { t.Fatalf("expected 302, got %d", rr.Code) }
+    if loc := rr.Header().Get("Location"); loc != "/library" { t.Fatalf("redirect mismatch: %s", loc) }
+
+    // Without ReturnUrl -> default "/"
+    ore2 := OAuthRequest{ State: "st2", Handle: "user.test", PkceVerifier: "ver", PkceChallenge: "chal" }
+    b2, _ := json.Marshal(ore2)
+    c2 := &http.Cookie{Name: "oauth_request", Value: base64.StdEncoding.EncodeToString(b2), Path: "/"}
+    rr2 := httptest.NewRecorder()
+    q2 := url.Values{"code": {"abc"}, "state": {"st2"}}
+    req2 := httptest.NewRequest(http.MethodGet, "/oauth/callback?"+q2.Encode(), nil)
+    req2.AddCookie(c2)
+    mux.ServeHTTP(rr2, req2)
+    if rr2.Code != http.StatusFound { t.Fatalf("expected 302, got %d", rr2.Code) }
+    if loc := rr2.Header().Get("Location"); loc != "/" { t.Fatalf("redirect mismatch: %s", loc) }
+}
+
+func TestLoginResourceFallbackToBsky(t *testing.T) {
+    // Make PLC resolution fail to force fallback
+    prev := http.DefaultTransport
+    http.DefaultTransport = mockTransport{round: func(req *http.Request) *http.Response {
+        // Always fail PLC and handle resolve
+        return newJSONResponse(404, map[string]string{"error":"not_found"}, nil)
+    }}
+    defer func(){ http.DefaultTransport = prev }()
+
+    om := NewManager("http://localhost:8080", "test-secret")
+    mux := http.NewServeMux()
+    om.RegisterLoginAndCallback(mux, LoginOpts{})
+
+    rr := httptest.NewRecorder()
+    req := httptest.NewRequest(http.MethodGet, "/oauth/login?handle=someone.test", nil)
+    mux.ServeHTTP(rr, req)
+    if rr.Code != http.StatusFound { t.Fatalf("expected 302, got %d", rr.Code) }
+    loc := rr.Header().Get("Location")
+    if !strings.Contains(loc, "resource=https%3A%2F%2Fbsky.social") {
+        t.Fatalf("expected resource fallback to bsky.social, got %s", loc)
+    }
+}
+
+func (m mockTransport) RoundTrip(req *http.Request) (*http.Response, error) {
+    return m.round(req), nil
+}
+
+func newJSONResponse(status int, v any, hdr http.Header) *http.Response {
+    b, _ := json.Marshal(v)
+    if hdr == nil { hdr = make(http.Header) }
+    hdr.Set("Content-Type", "application/json")
+    return &http.Response{StatusCode: status, Header: hdr, Body: io.NopCloser(strings.NewReader(string(b)))}
+}
+
+func TestLoginSetsCookieAndRedirect(t *testing.T) {
+    // Mock resolveHandle -> DID and PLC -> PDS
+    prev := http.DefaultTransport
+    http.DefaultTransport = mockTransport{round: func(req *http.Request) *http.Response {
+        if strings.Contains(req.URL.Host, "bsky.social") && strings.Contains(req.URL.Path, "/xrpc/com.atproto.identity.resolveHandle") {
+            return newJSONResponse(200, map[string]string{"did": "did:plc:abc"}, nil)
+        }
+        if strings.Contains(req.URL.Host, "plc.directory") {
+            // PLC doc with PDS service
+            body := map[string]any{"service": []map[string]string{{"id":"pds","type":"AtprotoPersonalDataServer","serviceEndpoint":"https://pds.example"}}}
+            return newJSONResponse(200, body, nil)
+        }
+        return newJSONResponse(404, map[string]string{"error":"not_found"}, nil)
+    }}
+    defer func(){ http.DefaultTransport = prev }()
+
+    om := NewManager("http://localhost:8080", "test-secret")
+
+    mux := http.NewServeMux()
+    // We only need login for this test
+    om.RegisterLoginAndCallback(mux, LoginOpts{})
+
+    rr := httptest.NewRecorder()
+    req := httptest.NewRequest(http.MethodGet, "/oauth/login?handle=someone.test&return_url=%2F", nil)
+
+    mux.ServeHTTP(rr, req)
+
+    if rr.Code != http.StatusFound {
+        t.Fatalf("expected 302, got %d", rr.Code)
+    }
+    loc := rr.Header().Get("Location")
+    if !strings.Contains(loc, "https://bsky.social/oauth/authorize?") {
+        t.Fatalf("unexpected redirect location: %s", loc)
+    }
+    // resource should reflect mocked PLC -> https://pds.example
+    if !strings.Contains(loc, "resource=https%3A%2F%2Fpds.example") {
+        t.Fatalf("expected resource param for PDS, got %s", loc)
+    }
+    // oauth_request cookie set
+    var found bool
+    for _, c := range rr.Result().Cookies() {
+        if c.Name == "oauth_request" && c.Value != "" {
+            found = true
+        }
+    }
+    if !found { t.Fatalf("expected oauth_request cookie to be set") }
+}
+
+func TestCallbackNonceRetryAndLegacyHook(t *testing.T) {
+    // First POST to token -> 400 use_dpop_nonce with DPoP-Nonce header
+    // Second POST -> 200 token JSON
+    first := true
+    prev := http.DefaultTransport
+    http.DefaultTransport = mockTransport{round: func(req *http.Request) *http.Response {
+        if req.Method == http.MethodPost && strings.Contains(req.URL.Host, "bsky.social") && strings.Contains(req.URL.Path, "/oauth/token") {
+            if first {
+                first = false
+                hdr := make(http.Header)
+                hdr.Set("DPoP-Nonce", "nonce-123")
+                return newJSONResponse(400, map[string]string{"error":"use_dpop_nonce"}, hdr)
+            }
+            // success
+            tok := map[string]any{
+                "access_token":"acc","refresh_token":"ref","token_type":"DPoP","expires_in": 3600,
+                "scope":"atproto transition:generic","sub":"did:plc:abc","aud":"did:web:pds.example",
+            }
+            return newJSONResponse(200, tok, nil)
+        }
+        // Resolve DID -> PDS on callback sanity checks if any were to call, ignore.
+        return newJSONResponse(404, map[string]string{"error":"not_found"}, nil)
+    }}
+    defer func(){ http.DefaultTransport = prev }()
+
+    om := NewManager("http://localhost:8080", "test-secret")
+
+    mux := http.NewServeMux()
+    called := false
+    om.RegisterLoginAndCallback(mux, LoginOpts{ OnLegacySession: func(w http.ResponseWriter, r *http.Request, sess OAuthSession){ called = true } })
+
+    // Prepare oauth_request cookie as set by login
+    ore := OAuthRequest{ State: "st", Handle: "user.test", ReturnUrl: "/", PkceVerifier: "ver", PkceChallenge: "chal", PdsUrl: "https://pds.example" }
+    b, _ := json.Marshal(ore)
+    c := &http.Cookie{Name: "oauth_request", Value: base64.StdEncoding.EncodeToString(b), Path: "/"}
+
+    rr := httptest.NewRecorder()
+    q := url.Values{"code": {"abc"}, "state": {"st"}}
+    req := httptest.NewRequest(http.MethodGet, "/oauth/callback?"+q.Encode(), nil)
+    req.AddCookie(c)
+
+    mux.ServeHTTP(rr, req)
+
+    if rr.Code != http.StatusFound {
+        t.Fatalf("expected 302, got %d; body=%s", rr.Code, rr.Body.String())
+    }
+    if !called {
+        t.Fatalf("expected legacy hook to be called")
+    }
+}

server/handlers/system/system.go

···
+package system
+
+import (
+    "net/http"
+
+    fountain "github.com/johnluther/tap-editor/server/tap-editor"
+)
+
+// Handler provides basic system endpoints such as health checks and preview rendering.
+type Handler struct {
+    maxPreviewBytes int
+}
+
+// New constructs a Handler with the maximum preview payload size.
+func New(maxPreviewBytes int) *Handler {
+    return &Handler{maxPreviewBytes: maxPreviewBytes}
+}
+
+// Register attaches the system routes to the provided mux.
+func (h *Handler) Register(mux *http.ServeMux) {
+    mux.HandleFunc("/health", h.handleHealth)
+    mux.HandleFunc("/preview", h.handlePreview)
+}
+
+func (h *Handler) handleHealth(w http.ResponseWriter, r *http.Request) {
+    w.Header().Set("Content-Type", "text/plain; charset=utf-8")
+    w.WriteHeader(http.StatusOK)
+    _, _ = w.Write([]byte("ok"))
+}
+
+func (h *Handler) handlePreview(w http.ResponseWriter, r *http.Request) {
+    if r.Method != http.MethodPost {
+        w.WriteHeader(http.StatusMethodNotAllowed)
+        return
+    }
+    // Limit preview form size to avoid huge payloads
+    r.Body = http.MaxBytesReader(w, r.Body, int64(h.maxPreviewBytes+8<<10))
+    if err := r.ParseForm(); err != nil {
+        w.WriteHeader(http.StatusBadRequest)
+        _, _ = w.Write([]byte("invalid form"))
+        return
+    }
+    text := r.FormValue("text")
+    notesMode := r.FormValue("notes")
+    sceneNums := r.FormValue("sceneNumbers")
+    blocks := fountain.Parse(text)
+    opts := fountain.RenderOptions{ShowSceneNumbers: true}
+    if notesMode == "strip" {
+        opts.StripNotes = true
+    }
+    if sceneNums == "hide" {
+        opts.ShowSceneNumbers = false
+    }
+    html := fountain.RenderHTMLWithOptions(blocks, opts)
+    w.Header().Set("Content-Type", "text/html; charset=utf-8")
+    _, _ = w.Write([]byte(html))
+}

server/main.go

···
 	"bytes"
 	"crypto/rand"
 	"crypto/sha256"
-	"encoding/base64"
 	"encoding/hex"
 	"encoding/json"
 	"fmt"
-	"html/template"
 	"io"
 	"log"
 	"net/http"
···
 	"os"
 	"path/filepath"
 	"strings"
-	"sync"
 	"time"
 
+	configPkg "github.com/johnluther/tap-editor/server/config"
+	"github.com/johnluther/tap-editor/server/devstore"
+	atp "github.com/johnluther/tap-editor/server/handlers/atp"
+	docsHandler "github.com/johnluther/tap-editor/server/handlers/docs"
+	oauth "github.com/johnluther/tap-editor/server/handlers/oauth"
+	pages "github.com/johnluther/tap-editor/server/handlers/pages"
+	system "github.com/johnluther/tap-editor/server/handlers/system"
+	renderpkg "github.com/johnluther/tap-editor/server/render"
+	"github.com/johnluther/tap-editor/server/session"
 	fountain "github.com/johnluther/tap-editor/server/tap-editor"
 )
 
-// tmpl holds parsed templates for SSR
-var tmpl *template.Template
 var (
-	sessionsMu   sync.Mutex
-	userSessions = map[string]Session{}
+	oauthManager *oauth.OAuthManager
+	renderer     *renderpkg.Renderer
+	sessionStore = session.NewStore()
+	devDocs      = devstore.New()
+	devOffline   bool
 )
 
-// DEV_OFFLINE enables local, in-memory docs and a stub session for development
-var devOffline = getEnv("DEV_OFFLINE", "") == "1"
-
-// In-memory docs store for DEV_OFFLINE, keyed by our legacy session ID
-type devDoc struct {
-	ID        string
-	Name      string
-	Text      string
-	UpdatedAt string
-}
-
-var devDocsMu sync.Mutex
-var devDocs = map[string]map[string]*devDoc{}
-
-func devGetStore(sid string) map[string]*devDoc {
-	devDocsMu.Lock()
-	defer devDocsMu.Unlock()
-	m, ok := devDocs[sid]
-	if !ok {
-		m = map[string]*devDoc{}
-		devDocs[sid] = m
-	}
-	return m
-}
+type Session = session.Session
 
 // handleDocs lists and creates documents in lol.tapapp.tap.doc
 func handleDocs(w http.ResponseWriter, r *http.Request) {
···
 	if devOffline {
 		// Local in-memory implementation for development
 		sid := getOrCreateSessionID(w, r)
-		store := devGetStore(sid)
+		store := devDocs.GetSession(sid)
 		switch r.Method {
 		case http.MethodGet:
 			type item struct {
···
 				return
 			}
 			if body.Name == "" {
-				body.Name = "Untitled"
 			}
 			rb := make([]byte, 8)
 			_, _ = rand.Read(rb)
 			id := "d-" + hex.EncodeToString(rb)
 			now := time.Now().UTC().Format(time.RFC3339)
-			store[id] = &devDoc{ID: id, Name: body.Name, Text: body.Text, UpdatedAt: now}
+			doc := &devstore.Doc{ID: id, Name: body.Name, Text: body.Text, UpdatedAt: now}
+			store[id] = doc
 			w.WriteHeader(http.StatusCreated)
 			_ = json.NewEncoder(w).Encode(map[string]string{"id": id})
 			return
···
 			return
 		}
 		sid := getOrCreateSessionID(w, r)
-		store := devGetStore(sid)
+		store := devDocs.GetSession(sid)
 		switch r.Method {
 		case http.MethodGet:
 			// PDF export support in offline mode
···
 	}
 	w.Header().Set("Content-Type", "application/json; charset=utf-8")
 	sid := getOrCreateSessionID(w, r)
-	sessionsMu.Lock()
-	s, ok := userSessions[sid]
-	sessionsMu.Unlock()
+	s, ok := sessionStore.Get(sid)
 	if !ok || s.AccessJWT == "" || s.DID == "" {
 		http.Error(w, "unauthorized", http.StatusUnauthorized)
 		return
···
 	return "", "", false
 }
 
-// Session represents a minimal legacy session persisted via cookie for
-// non-OAuth flows and for compatibility with older endpoints.
-type Session struct {
-	DID        string `json:"did"`
-	Handle     string `json:"handle"`
-	AccessJWT  string `json:"accessJwt,omitempty"`
-	RefreshJWT string `json:"refreshJwt,omitempty"`
-}
-
 // handleATPSession manages a simple server-backed session store for Bluesky.
 // Client obtains tokens via @atproto/api then POSTs here to persist server-side.
 // Methods:
 //   - GET: return current session (handle, did) or 204 if none
 //   - POST: set/replace session from JSON body {did, handle, accessJwt, refreshJwt}
 //   - DELETE: clear session
+
 func handleATPSession(w http.ResponseWriter, r *http.Request) {
 	w.Header().Set("Content-Type", "application/json; charset=utf-8")
 	sid := getOrCreateSessionID(w, r)
 
 	switch r.Method {
 	case http.MethodGet:
-		sessionsMu.Lock()
-		s, ok := userSessions[sid]
-		sessionsMu.Unlock()
-		if !ok || s.DID == "" {
-			if devOffline {
-				// Provide a stub session in offline mode so UI treats user as logged in
-				stub := Session{DID: "did:example:dev", Handle: "dev.local"}
-				sessionsMu.Lock()
-				userSessions[sid] = stub
-				sessionsMu.Unlock()
-				_ = json.NewEncoder(w).Encode(stub)
-				return
-			}
-			w.WriteHeader(http.StatusNoContent)
+		if s, ok := sessionStore.Get(sid); ok && s.DID != "" {
+			_ = json.NewEncoder(w).Encode(s)
+			return
+		}
+		if devOffline {
+			stub := Session{DID: "did:example:dev", Handle: "dev.local"}
+			sessionStore.Set(sid, stub)
+			_ = json.NewEncoder(w).Encode(stub)
 			return
 		}
-		_ = json.NewEncoder(w).Encode(s)
+		w.WriteHeader(http.StatusNoContent)
 	case http.MethodPost:
 		// Limit body size for session payload
 		r.Body = http.MaxBytesReader(w, r.Body, 16<<10) // 16 KiB
···
 			http.Error(w, "missing did/handle", http.StatusBadRequest)
 			return
 		}
-		sessionsMu.Lock()
-		userSessions[sid] = s
-		sessionsMu.Unlock()
+		sessionStore.Set(sid, s)
 		w.WriteHeader(http.StatusNoContent)
 	case http.MethodDelete:
-		sessionsMu.Lock()
-		delete(userSessions, sid)
-		sessionsMu.Unlock()
+		sessionStore.Delete(sid)
 		w.WriteHeader(http.StatusNoContent)
 	default:
 		w.WriteHeader(http.StatusMethodNotAllowed)
···
 	if err != nil || c == nil || c.Value == "" {
 		return Session{}, false
 	}
-	sessionsMu.Lock()
-	s, ok := userSessions[c.Value]
-	sessionsMu.Unlock()
-	if !ok || s.DID == "" || s.AccessJWT == "" {
-		return Session{}, false
-	}
-	return s, true
-}
-
-// --- Minimal OAuth handlers to enable redirect to Bluesky ---
-
-// handleOAuthLogin starts the OAuth flow by redirecting the user to Bluesky's authorization endpoint.
-// Expects: GET /oauth/login?handle=<bsky-handle>&return_url=<optional>
-func handleOAuthLogin(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
-		w.WriteHeader(http.StatusMethodNotAllowed)
-		return
-	}
-	handle := r.URL.Query().Get("handle")
-	if handle == "" {
-		http.Error(w, "missing handle", http.StatusBadRequest)
-		return
-	}
-	// Generate state and PKCE
-	state := generateState()
-	verifier, challenge, err := generatePKCE()
-	if err != nil {
-		http.Error(w, "internal error", http.StatusInternalServerError)
-		return
-	}
-	// Resolve PDS to request correct OAuth audience at authorization step
-	resourcePDS := "https://bsky.social"
-	if did, err := resolveHandle(handle); err == nil && strings.HasPrefix(did, "did:plc:") {
-		if u, err2 := resolvePDSFromPLC(did); err2 == nil && u != "" {
-			resourcePDS = u
-		}
-	}
-	log.Printf("OAuth login: using resource=%s for authorize audience", resourcePDS)
-
-	// Persist request in a short-lived cookie
-	req := OAuthRequest{
-		State:         state,
-		Handle:        handle,
-		ReturnUrl:     r.URL.Query().Get("return_url"),
-		PkceVerifier:  verifier,
-		PkceChallenge: challenge,
-		PdsUrl:        resourcePDS,
-	}
-	b, _ := json.Marshal(req)
-	http.SetCookie(w, &http.Cookie{
-		Name:     "oauth_request",
-		Value:    base64.StdEncoding.EncodeToString(b),
-		Path:     "/",
-		HttpOnly: true,
-		Secure:   strings.HasPrefix(oauthManager.clientURI, "https://"),
-		SameSite: http.SameSiteLaxMode,
-		MaxAge:   300, // 5 min
-	})
-
-	// Build authorize URL (include resource to bind audience up-front)
-	authURL := "https://bsky.social/oauth/authorize?" + url.Values{
-		"client_id":             {oauthManager.clientURI + "/oauth/client-metadata.json"},
-		"redirect_uri":          {oauthManager.clientURI + "/oauth/callback"},
-		"response_type":         {"code"},
-		"scope":                 {oauthScope},
-		"state":                 {state},
-		"code_challenge":        {challenge},
-		"code_challenge_method": {"S256"},
-		"resource":              {resourcePDS},
-	}.Encode()
-
-	http.Redirect(w, r, authURL, http.StatusFound)
-}
-
-// Serve OAuth client metadata (Bluesky will fetch this)
-func handleOAuthClientMetadata(w http.ResponseWriter, r *http.Request) {
-	w.Header().Set("Content-Type", "application/json")
-	_ = json.NewEncoder(w).Encode(oauthManager.ClientMetadata())
-}
-
-// Serve JWKS for our private_key_jwt key
-func handleOAuthJWKS(w http.ResponseWriter, r *http.Request) {
-	w.Header().Set("Content-Type", "application/json")
-	_, _ = w.Write([]byte(oauthManager.jwks))
-}
-
-// Minimal state generator for OAuth
-func generateState() string {
-	b := make([]byte, 16)
-	_, _ = rand.Read(b)
-	return hex.EncodeToString(b)
-}
-
-// NOTE: Minimal placeholder — implements a visible endpoint so the authorize
-// redirect can come back. Full token exchange can be restored later.
-func handleOAuthCallback(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
-		w.WriteHeader(http.StatusMethodNotAllowed)
-		return
-	}
-	code := r.URL.Query().Get("code")
-	state := r.URL.Query().Get("state")
-	if code == "" || state == "" {
-		http.Error(w, "missing code or state", http.StatusBadRequest)
-		return
-	}
-	// Load request from cookie
-	c, err := r.Cookie("oauth_request")
-	if err != nil {
-		http.Error(w, "invalid state", http.StatusBadRequest)
-		return
-	}
-	raw, err := base64.StdEncoding.DecodeString(c.Value)
-	if err != nil {
-		http.Error(w, "invalid state", http.StatusBadRequest)
-		return
-	}
-	var ore OAuthRequest
-	if err := json.Unmarshal(raw, &ore); err != nil {
-		http.Error(w, "invalid state", http.StatusBadRequest)
-		return
-	}
-	if ore.State != state {
-		http.Error(w, "invalid state", http.StatusBadRequest)
-		return
-	}
-
-	// Resolve user's PDS base upfront from handle so we can request the correct token audience via 'resource'
-	var resourcePDS string
-	if ore.PdsUrl != "" {
-		resourcePDS = ore.PdsUrl
-	} else if ore.Handle != "" {
-		if did, err := resolveHandle(ore.Handle); err == nil && strings.HasPrefix(did, "did:plc:") {
-			if u, err2 := resolvePDSFromPLC(did); err2 == nil && u != "" {
-				resourcePDS = u
-			}
-		}
-	}
-	if resourcePDS == "" {
-		resourcePDS = "https://bsky.social"
-	}
-	log.Printf("OAuth callback: using resource=%s for token audience", resourcePDS)
-
-	// Token exchange
-	tokenURL := "https://bsky.social/oauth/token"
-	clientID := oauthManager.clientURI + "/oauth/client-metadata.json"
-	form := url.Values{
-		"grant_type":    {"authorization_code"},
-		"code":          {code},
-		"redirect_uri":  {oauthManager.clientURI + "/oauth/callback"},
-		"code_verifier": {ore.PkceVerifier},
-		"client_id":     {clientID},
-		// Request default OAuth scope and set resource to user's PDS so access token is audience-bound correctly
-		"scope":    {oauthScope},
-		"resource": {resourcePDS},
-	}
-	assertion, err := oauthManager.generateClientAssertion(clientID, tokenURL)
-	if err != nil {
-		http.Error(w, "token exchange failed", http.StatusInternalServerError)
-		return
-	}
-	form.Set("client_assertion_type", "urn:ietf:params:oauth:client-assertion-type:jwt-bearer")
-	form.Set("client_assertion", assertion)
-
-	// Build DPoP proof and send (with nonce retry)
-	buildReq := func(dpop string) (*http.Request, error) {
-		req, err := http.NewRequest(http.MethodPost, tokenURL, strings.NewReader(form.Encode()))
-		if err != nil {
-			return nil, err
-		}
-		req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
-		req.Header.Set("Accept", "application/json")
-		if dpop != "" {
-			req.Header.Set("DPoP", dpop)
-		}
-		return req, nil
-	}
-	// 1st attempt
-	dpop, err := oauthManager.generateDPoPProof("POST", tokenURL, "")
-	if err != nil {
-		http.Error(w, "dpop generation failed", http.StatusInternalServerError)
-		return
-	}
-	req1, _ := buildReq(dpop)
-	res, err := http.DefaultClient.Do(req1)
-	if err != nil {
-		http.Error(w, "token exchange failed", http.StatusBadGateway)
-		return
-	}
-	body, _ := io.ReadAll(res.Body)
-	res.Body.Close()
-	log.Printf("OAuth callback: token exchange attempt1 status=%d, body=%s", res.StatusCode, string(body))
-	if n := res.Header.Get("DPoP-Nonce"); n != "" {
-		log.Printf("OAuth callback: received DPoP-Nonce: %s", n)
-	}
-	// use_dpop_nonce retry
-	if res.StatusCode == http.StatusBadRequest {
-		var er struct {
-			Error string `json:"error"`
-		}
-		_ = json.Unmarshal(body, &er)
-		if er.Error == "use_dpop_nonce" {
-			if nonce := res.Header.Get("DPoP-Nonce"); nonce != "" {
-				dpop2, err2 := oauthManager.generateDPoPProof("POST", tokenURL, nonce)
-				if err2 != nil {
-					http.Error(w, "dpop regeneration failed", http.StatusInternalServerError)
-					return
-				}
-				req2, _ := buildReq(dpop2)
-				res, err = http.DefaultClient.Do(req2)
-				if err != nil {
-					http.Error(w, "token exchange failed", http.StatusBadGateway)
-					return
-				}
-				body, _ = io.ReadAll(res.Body)
-				res.Body.Close()
-				log.Printf("OAuth callback: token exchange attempt2 status=%d, body=%s", res.StatusCode, string(body))
-			}
-		}
-	}
-	if res.StatusCode != http.StatusOK {
-		log.Printf("OAuth callback: token exchange failed final status=%d, body=%s", res.StatusCode, string(body))
-		http.Error(w, "token exchange failed", http.StatusBadRequest)
-		return
+	if s, ok := sessionStore.Get(c.Value); ok && s.DID != "" && s.AccessJWT != "" {
+		return s, true
 	}
-	// Parse tokens
-	var tok struct {
-		AccessToken  string `json:"access_token"`
-		RefreshToken string `json:"refresh_token"`
-		TokenType    string `json:"token_type"`
-		ExpiresIn    int    `json:"expires_in"`
-		Scope        string `json:"scope"`
-		Sub          string `json:"sub"`
-		Aud          string `json:"aud"`
-	}
-	if err := json.Unmarshal(body, &tok); err != nil {
-		http.Error(w, "token decode failed", http.StatusInternalServerError)
-		return
-	}
-	if tok.Sub == "" {
-		http.Error(w, "token decode failed", http.StatusInternalServerError)
-		return
-	}
-	// Derive PDS base:
-	// 1) If aud indicates did:web, use that host
-	// 2) Else, resolve from DID (plc) document service endpoint #atproto_pds
-	// 3) Fallback to bsky.social
-	pdsURL := "https://bsky.social"
-	if strings.HasPrefix(tok.Aud, "did:web:") {
-		host := strings.TrimPrefix(tok.Aud, "did:web:")
-		if host != "" {
-			pdsURL = "https://" + host
-		}
-	} else if strings.HasPrefix(tok.Sub, "did:plc:") {
-		if u, err := resolvePDSFromPLC(tok.Sub); err == nil && u != "" {
-			pdsURL = u
-		} else if err != nil {
-			log.Printf("OAuth callback: PLC resolve failed for %s: %v", tok.Sub, err)
-		}
-	}
-	log.Printf("OAuth callback: token aud=%q, chosen PDS base=%s, token_type=%s", tok.Aud, pdsURL, tok.TokenType)
-	// Save OAuth session
-	sess := OAuthSession{
-		Did:        tok.Sub,
-		Handle:     ore.Handle,
-		PdsUrl:     pdsURL,
-		TokenType:  tok.TokenType,
-		Scope:      tok.Scope,
-		AccessJwt:  tok.AccessToken,
-		RefreshJwt: tok.RefreshToken,
-		Expiry:     time.Now().Add(time.Duration(tok.ExpiresIn) * time.Second),
-	}
-	oauthManager.SaveSession(sess.Did, sess)
-	// Persist full session to Gorilla cookie so any machine can rehydrate
-	_ = oauthManager.SaveSessionToCookie(r, w, sess)
-
-	// Also set legacy session cookie used by /atp/session
-	sid := "oauth_session_" + sess.Handle
-	sessionsMu.Lock()
-	userSessions[sid] = Session{DID: sess.Did, Handle: sess.Handle, AccessJWT: sess.AccessJwt, RefreshJWT: sess.RefreshJwt}
-	sessionsMu.Unlock()
-	// Set legacy session cookie used by getOrCreateSessionID()/atp/session
-	http.SetCookie(w, &http.Cookie{
-		Name:     "tap_session",
-		Value:    sid,
-		Path:     "/",
-		HttpOnly: true,
-		Secure:   strings.HasPrefix(oauthManager.clientURI, "https://"),
-		SameSite: http.SameSiteLaxMode,
-		Expires:  time.Now().Add(30 * 24 * time.Hour),
-	})
-	// Clear the oauth_request cookie
-	http.SetCookie(w, &http.Cookie{
-		Name:     "oauth_request",
-		Value:    "",
-		Path:     "/",
-		HttpOnly: true,
-		Secure:   strings.HasPrefix(oauthManager.clientURI, "https://"),
-		SameSite: http.SameSiteLaxMode,
-		MaxAge:   -1,
-	})
-	// Post-login sanity: validate token can call PDS using DPoP on describeRepo
-	go func(did, pds string) {
-		// Give a tiny delay to avoid racing cookie writes in some environments
-		time.Sleep(200 * time.Millisecond)
-		sanityURL := pds + "/xrpc/com.atproto.repo.describeRepo?repo=" + url.QueryEscape(did)
-		log.Printf("auth sanity: calling describeRepo for %s at %s", did, sanityURL)
-		resp, err := pdsRequest(w, r, http.MethodGet, sanityURL, "", nil)
-		if err != nil {
-			log.Printf("auth sanity: request error: %v", err)
-			return
-		}
-		defer resp.Body.Close()
-		b, _ := io.ReadAll(resp.Body)
-		if resp.StatusCode < 200 || resp.StatusCode >= 300 {
-			log.Printf("auth sanity: describeRepo -> %d body=%s", resp.StatusCode, string(b))
-		} else {
-			log.Printf("auth sanity: describeRepo OK -> %d", resp.StatusCode)
-		}
-	}(sess.Did, sess.PdsUrl)
-
-	// Redirect back
-	ret := ore.ReturnUrl
-	if ret == "" {
-		ret = "/"
-	}
-	http.Redirect(w, r, ret, http.StatusFound)
+	return Session{}, false
 }
 
-func handleOAuthLogout(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
-		w.WriteHeader(http.StatusMethodNotAllowed)
-		return
-	}
-	http.Redirect(w, r, "/", http.StatusFound)
-}
-
-// pdsBaseFromUser returns the user's PDS base if an OAuth session exists; otherwise bsky.social.
 func pdsBaseFromUser(r *http.Request) string {
 	if oauthManager != nil {
 		if u := oauthManager.GetUser(r); u != nil && u.Pds != "" {
···
 	if accToken == "" {
 		// read tap_session cookie directly without creating a new one
 		if c, err := r.Cookie("tap_session"); err == nil && c != nil && c.Value != "" {
-			sessionsMu.Lock()
-			legacy, ok := userSessions[c.Value]
-			sessionsMu.Unlock()
-			if ok && legacy.AccessJWT != "" {
+			if legacy, ok := sessionStore.Get(c.Value); ok && legacy.AccessJWT != "" {
 				accToken = legacy.AccessJWT
 				tokType = "DPoP"
 				scopeStr = ""
···
 	// Builder for requests with a given scheme and optional nonce
 	doWith := func(scheme, nonce string) (*http.Response, []byte, error) {
 		// Bind proof to access token via 'ath' for stricter PDSes
-		proof, err := oauthManager.generateDPoPProofWithToken(method, url, accToken, nonce)
+		proof, err := oauthManager.GenerateDPoPProofWithToken(method, url, accToken, nonce)
 		if err != nil {
 			return nil, nil, err
 		}
···
 		"text":      buf.String(),
 		"updatedAt": recResp.Value.UpdatedAt,
 	}
-	_ = json.NewEncoder(w).Encode(out)
+	w.Header().Set("Content-Type", "application/json; charset=utf-8")
+	if err := json.NewEncoder(w).Encode(out); err != nil {
+		http.Error(w, "encode failed", http.StatusInternalServerError)
+		return
+	}
 }
-
 func main() {
+	cfg := configPkg.FromEnv()
+	devOffline = cfg.DevOffline
+
 	// Parse templates
 	var err error
-	tmpl, err = template.ParseGlob("templates/*.html")
+	renderer, err = renderpkg.New("templates/*.html")
 	if err != nil {
 		log.Fatalf("parse templates: %v", err)
 	}
+	// Initialize OAuth (required for public OAuth flow)
+	addr := cfg.Port
+	clientURI := cfg.ClientURI
+	cookieSecret := cfg.CookieSecret
+	om := oauth.NewManager(clientURI, cookieSecret)
 
-	// Initialize OAuth (required for public OAuth flow)
-	addr := getEnv("PORT", "80")
-	clientURI := getEnv("CLIENT_URI", "http://localhost:"+addr)
-	cookieSecret := getEnv("COOKIE_SECRET", "your-secret-key")
-	initOAuth(clientURI, cookieSecret)
+	oauthManager = om
 
 	mux := http.NewServeMux()
 
···
 	})
 
 	// Routes
-	mux.HandleFunc("/", handleIndex)
-	mux.HandleFunc("/about", handleAbout)
-	mux.HandleFunc("/privacy", handlePrivacy)
-	mux.HandleFunc("/terms", handleTerms)
-	mux.HandleFunc("/library", handleLibrary)
-	mux.HandleFunc("/health", handleHealth)
-	mux.HandleFunc("/preview", handlePreview)
-	// Multi-doc (ATProto-backed)
-	mux.HandleFunc("/docs", handleDocs)
-	mux.HandleFunc("/docs/", handleDocByID)
+	pages.New(renderer).Register(mux)
+	system.New(maxTextBytes).Register(mux)
+	atpDeps := atp.Dependencies{
+		PDSRequest:          pdsRequest,
+		UploadBlobWithRetry: uploadBlobWithRetry,
+		PDSBase:             pdsBaseFromUser,
+		GetDIDAndHandle:     getDIDAndHandle,
+		GetSessionID:        getOrCreateSessionID,
+		LegacyGet:           sessionStore.Get,
+		LegacySet:           sessionStore.Set,
+		LegacyDelete:        sessionStore.Delete,
+		MaxJSONBody:         maxJSONBody,
+		MaxTextBytes:        maxTextBytes,
+	}
+	atp.New(atpDeps).Register(mux)
+	docsDeps := docsHandler.Dependencies{
+		DevStore:            devDocs,
+		DevOffline:          func() bool { return devOffline },
+		GetSessionID:        getOrCreateSessionID,
+		GetDIDAndHandle:     getDIDAndHandle,
+		UploadBlobWithRetry: uploadBlobWithRetry,
+		PDSRequest:          pdsRequest,
+		PDSBase:             pdsBaseFromUser,
+		RenderPDF:           renderPDF,
+		FetchDoc:            getDocNameAndText,
+		SanitizeFilename:    sanitizeFilename,
+		MaxJSONBody:         maxJSONBody,
+		MaxTextBytes:        maxTextBytes,
+	}
+	docsHandler.New(docsDeps).Register(mux)
+	om.RegisterBasic(mux)
+	om.RegisterLoginAndCallback(mux, oauth.LoginOpts{
+		OnLegacySession: func(w http.ResponseWriter, r *http.Request, sess oauth.OAuthSession) {
+			sid := "oauth_session_" + sess.Handle
+			sessionStore.Set(sid, Session{DID: sess.Did, Handle: sess.Handle, AccessJWT: sess.AccessJwt, RefreshJWT: sess.RefreshJwt})
+			http.SetCookie(w, &http.Cookie{
+				Name:     "tap_session",
+				Value:    sid,
+				Path:     "/",
+				HttpOnly: true,
+				Secure:   strings.HasPrefix(sess.PdsUrl, "https://"),
+				SameSite: http.SameSiteLaxMode,
+				Expires:  time.Now().Add(30 * 24 * time.Hour),
+			})
+		},
+	})
+
 	// AT Proto session endpoints (server-backed)
-	mux.HandleFunc("/atp/session", handleATPSession)
-	mux.HandleFunc("/atp/post", handleATPPost)
-	mux.HandleFunc("/atp/doc", handleATPDoc)
+	// mux.HandleFunc("/atp/session", handleATPSession)
+	// mux.HandleFunc("/atp/post", handleATPPost)
+	// mux.HandleFunc("/atp/doc", handleATPDoc)
 
 	// OAuth endpoints
-	mux.HandleFunc("/oauth/login", handleOAuthLogin)
-	mux.HandleFunc("/oauth/callback", handleOAuthCallback)
-	mux.HandleFunc("/oauth/logout", handleOAuthLogout)
-	mux.HandleFunc("/oauth/client-metadata.json", handleOAuthClientMetadata)
-	mux.HandleFunc("/oauth/jwks.json", handleOAuthJWKS)
-	// Allow the web client to repopulate server-side OAuth session after restarts
-	mux.HandleFunc("/oauth/resume", handleOAuthResume)
 
 	log.Printf("tap (Go) server listening on http://localhost:%s", addr)
 	// Enforce strict redirect for legacy hosts -> tapapp.lol
···
 	})
 }
 
-func handleIndex(w http.ResponseWriter, r *http.Request) {
-	data := struct {
-		Title string
-	}{
-		Title: "Tap - A Minimal Fountain Editor",
-	}
-	render(w, "index.html", data)
-}
-
-func handleAbout(w http.ResponseWriter, r *http.Request) {
-	data := struct {
-		Title string
-	}{
-		Title: "About Tap",
-	}
-	render(w, "about.html", data)
-}
-
-func handlePrivacy(w http.ResponseWriter, r *http.Request) {
-	data := struct {
-		Title string
-	}{
-		Title: "Privacy Policy",
-	}
-	render(w, "privacy.html", data)
-}
-
-func handleTerms(w http.ResponseWriter, r *http.Request) {
-	data := struct {
-		Title string
-	}{
-		Title: "Terms of Service",
-	}
-	render(w, "terms.html", data)
-}
-
-func handleLibrary(w http.ResponseWriter, r *http.Request) {
-	w.Header().Set("Cache-Control", "no-cache")
-	data := struct{ Title string }{Title: "Library - Tap"}
-	render(w, "library.html", data)
-}
-
-func handleHealth(w http.ResponseWriter, r *http.Request) {
-	w.Header().Set("Content-Type", "text/plain; charset=utf-8")
-	w.WriteHeader(http.StatusOK)
-	_, _ = w.Write([]byte("ok"))
-}
-
-// handlePreview accepts POST text and returns simple HTML preview.
-// For MVP we wrap in <pre>, keeping whitespace.
-func handlePreview(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
-		w.WriteHeader(http.StatusMethodNotAllowed)
-		return
-	}
-	// Limit preview form size to avoid huge payloads
-	r.Body = http.MaxBytesReader(w, r.Body, maxTextBytes+8<<10)
-	if err := r.ParseForm(); err != nil {
-		w.WriteHeader(http.StatusBadRequest)
-		w.Write([]byte("invalid form"))
-		return
-	}
-	text := r.FormValue("text")
-	notesMode := r.FormValue("notes")
-	sceneNums := r.FormValue("sceneNumbers")
-	blocks := fountain.Parse(text)
-	opts := fountain.RenderOptions{ShowSceneNumbers: true}
-	if notesMode == "strip" {
-		opts.StripNotes = true
-	}
-	if sceneNums == "hide" {
-		opts.ShowSceneNumbers = false
-	}
-	html := fountain.RenderHTMLWithOptions(blocks, opts)
-	w.Header().Set("Content-Type", "text/html; charset=utf-8")
-	w.Write([]byte(html))
-}
-
-func render(w http.ResponseWriter, name string, data any) {
-	w.Header().Set("Content-Type", "text/html; charset=utf-8")
-	if err := tmpl.ExecuteTemplate(w, name, data); err != nil {
-		log.Printf("render %s: %v", name, err)
-		w.WriteHeader(http.StatusInternalServerError)
-		_, _ = w.Write([]byte("Template error"))
-	}
-}
-
-func getEnv(key, def string) string {
-	if v := os.Getenv(key); v != "" {
-		return v
-	}
-	return def
-}
-
 // getOrCreateSessionID retrieves the session ID from cookie or creates one.
 func getOrCreateSessionID(w http.ResponseWriter, r *http.Request) string {
 	if c, err := r.Cookie("tap_session"); err == nil && c != nil && c.Value != "" {
···
 // a token refresh using the stored refresh token and retries once.
 func authedDo(w http.ResponseWriter, r *http.Request, req *http.Request) (*http.Response, error) {
 	sid := getOrCreateSessionID(w, r)
-	sessionsMu.Lock()
-	s, ok := userSessions[sid]
-	sessionsMu.Unlock()
+	s, ok := sessionStore.Get(sid)
 	// Clone to avoid mutating caller's request headers
 	attempt := func(token string) (*http.Response, error) {
 		q := req.Clone(req.Context())
···
 
 // refreshSession uses the refresh JWT to obtain new access/refresh tokens and persists them.
 func refreshSession(sid string) (Session, bool) {
-	sessionsMu.Lock()
-	s, ok := userSessions[sid]
-	sessionsMu.Unlock()
+	s, ok := sessionStore.Get(sid)
 	if !ok || s.RefreshJWT == "" {
 		return Session{}, false
 	}
···
 		return Session{}, false
 	}
 	ns := Session{DID: out.Did, Handle: out.Handle, AccessJWT: out.AccessJwt, RefreshJWT: out.RefreshJwt}
-	sessionsMu.Lock()
-	userSessions[sid] = ns
-	sessionsMu.Unlock()
+	sessionStore.Set(sid, ns)
 	return ns, true
 }
 

server/pds_request_test.go

···
+package main
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	oauth "github.com/johnluther/tap-editor/server/handlers/oauth"
+)
+
+func newOAuthSessionForTest(t *testing.T, did, token, tokType, scope string) (*oauth.OAuthManager, *http.Request) {
+    t.Helper()
+    om := oauth.NewManager("http://localhost:8080", "test-secret")
+    r := httptest.NewRequest(http.MethodGet, "/", nil)
+    sess := oauth.OAuthSession{
+		Did:        did,
+		Handle:     "user.test",
+		PdsUrl:     "https://pds.example",
+		TokenType:  tokType,
+		Scope:      scope,
+		AccessJwt:  token,
+		RefreshJwt: "ref",
+		Expiry:     time.Now().Add(30 * time.Minute),
+	    }
+    om.SaveSession(did, sess)
+    _ = om.SaveSessionToCookie(r, httptest.NewRecorder(), sess)
+    return om, r
+}
+
+func TestPDSRequest_DPoPNonceRetry(t *testing.T) {
+	// Simulate PDS requiring DPoP nonce: first 400 with header + body use_dpop_nonce, then 200
+	var attempt int
+{{ ... }}
+		attempt++
+		if attempt == 1 {
+			w.Header().Set("DPoP-Nonce", "n-123")
+			w.WriteHeader(http.StatusBadRequest)
+			_ = json.NewEncoder(w).Encode(map[string]string{"error": "use_dpop_nonce"})
+			return
+		}
+		// Second attempt OK
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer ts.Close()
+
+	// Prepare oauthManager and request with DPoP token
+	om, baseReq := newOAuthSessionForTest(t, "did:plc:abc", "token-123", "DPoP", "atproto transition:generic")
+	oauthManager = om
+
+	rec := httptest.NewRecorder()
+	res, err := pdsRequest(rec, baseReq, http.MethodGet, ts.URL+"/xrpc/test", "", nil)
+	if err != nil {
+		t.Fatalf("pdsRequest error: %v", err)
+	}
+	if res.StatusCode != http.StatusOK {
+		t.Fatalf("expected 200, got %d", res.StatusCode)
+	}
+	if attempt != 2 {
+		t.Fatalf("expected 2 attempts, got %d", attempt)
+	}
+}
+
+func TestPDSRequest_FallbackToBearer(t *testing.T) {
+	// Simulate first DPoP attempt 400 without nonce; then Bearer attempt 200
+	var schemes []string
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		schemes = append(schemes, strings.SplitN(r.Header.Get("Authorization"), " ", 2)[0])
+		if len(schemes) == 1 {
+			w.WriteHeader(http.StatusBadRequest)
+			return
+		}
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer ts.Close()
+
+	// Prepare oauthManager with non-DPoP token type to allow Bearer fallback
+	om, baseReq := newOAuthSessionForTest(t, "did:plc:abc", "token-xyz", "Bearer", "atproto transition:generic")
+	oauthManager = om
+
+	rec := httptest.NewRecorder()
+	res, err := pdsRequest(rec, baseReq, http.MethodGet, ts.URL+"/xrpc/test2", "", nil)
+	if err != nil {
+		t.Fatalf("pdsRequest error: %v", err)
+	}
+	if res.StatusCode != http.StatusOK {
+		t.Fatalf("expected 200, got %d", res.StatusCode)
+	}
+	if len(schemes) != 2 || schemes[0] != "DPoP" || schemes[1] != "Bearer" {
+		t.Fatalf("expected [DPoP Bearer], got %v", schemes)
+	}
+}