backend improvements

.env.example

···
-# Environment Configuration
+# Margin Server Configuration
 
 # Server
 PORT=8080
 BASE_URL=https://example.com
 
-# Database
+# Database (SQLite file path or PostgreSQL connection string)
 DATABASE_URL=margin.db
 
 # Static Files (path to built frontend)
 STATIC_DIR=../web/dist
 
-# AT Protocol OAuth
-OAUTH_CLIENT_ID=https://example.com/client-metadata.json
-OAUTH_CALLBACK_URL=https://example.com/auth/callback
+# OAuth private key for signing requests (auto-generated if missing)
 OAUTH_KEY_PATH=./oauth_private_key.pem
 
-# Production Example:
-# PORT=443
-# BASE_URL=https://margin.at
-# OAUTH_CLIENT_ID=https://margin.at/client-metadata.json
-# OAUTH_CALLBACK_URL=https://margin.at/auth/callback
+
+# Optional: Override default ATProto network URLs (you probably don't need these)
+# BSKY_PUBLIC_API=https://public.api.bsky.app
+# PLC_DIRECTORY_URL=https://plc.directory
+# BLOCK_RELAY_URL=wss://jetstream2.us-east.bsky.network/subscribe

backend/cmd/server/main.go

···
 	r.Put("/api/bookmarks", annotationSvc.UpdateBookmark)
 	r.Delete("/api/bookmarks", annotationSvc.DeleteBookmark)
 
-	r.Get("/auth/login", oauthHandler.HandleLogin)
-	r.Post("/auth/start", oauthHandler.HandleStart)
-	r.Post("/auth/signup", oauthHandler.HandleSignup)
-	r.Get("/auth/callback", oauthHandler.HandleCallback)
-	r.Post("/auth/logout", oauthHandler.HandleLogout)
-	r.Get("/auth/session", oauthHandler.HandleSession)
+	r.Route("/auth", func(r chi.Router) {
+		r.Use(middleware.Throttle(10))
+		r.Get("/login", oauthHandler.HandleLogin)
+		r.Post("/start", oauthHandler.HandleStart)
+		r.Post("/signup", oauthHandler.HandleSignup)
+		r.Get("/callback", oauthHandler.HandleCallback)
+		r.Post("/logout", oauthHandler.HandleLogout)
+		r.Get("/session", oauthHandler.HandleSession)
+	})
 	r.Get("/client-metadata.json", oauthHandler.HandleClientMetadata)
 	r.Get("/jwks.json", oauthHandler.HandleJWKS)
 

backend/internal/api/annotations.go

···
 		return
 	}
 
+	if req.SubjectURI == "" || req.SubjectCID == "" {
+		http.Error(w, "subjectUri and subjectCid are required", http.StatusBadRequest)
+		return
+	}
+
 	existingLike, _ := s.db.GetLikeByUserAndSubject(session.DID, req.SubjectURI)
 	if existingLike != nil {
 		w.Header().Set("Content-Type", "application/json")
···
 	var req CreateReplyRequest
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
 		http.Error(w, "Invalid request body", http.StatusBadRequest)
+		return
+	}
+
+	if req.ParentURI == "" || req.ParentCID == "" {
+		http.Error(w, "parentUri and parentCid are required", http.StatusBadRequest)
+		return
+	}
+	if req.RootURI == "" || req.RootCID == "" {
+		http.Error(w, "rootUri and rootCid are required", http.StatusBadRequest)
+		return
+	}
+	if req.Text == "" {
+		http.Error(w, "text is required", http.StatusBadRequest)
 		return
 	}
 

backend/internal/api/errors.go

···
+package api
+
+import (
+	"encoding/json"
+	"net/http"
+)
+
+type APIError struct {
+	Error   string `json:"error"`
+	Code    string `json:"code,omitempty"`
+	Details string `json:"details,omitempty"`
+}
+
+func WriteJSONError(w http.ResponseWriter, statusCode int, message string) {
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(statusCode)
+	json.NewEncoder(w).Encode(APIError{Error: message})
+}
+
+func WriteJSONErrorWithCode(w http.ResponseWriter, statusCode int, message, code string) {
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(statusCode)
+	json.NewEncoder(w).Encode(APIError{Error: message, Code: code})
+}
+
+func WriteJSON(w http.ResponseWriter, statusCode int, data interface{}) {
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(statusCode)
+	json.NewEncoder(w).Encode(data)
+}
+
+func WriteSuccess(w http.ResponseWriter, data interface{}) {
+	WriteJSON(w, http.StatusOK, data)
+}
+
+func WriteBadRequest(w http.ResponseWriter, message string) {
+	WriteJSONError(w, http.StatusBadRequest, message)
+}
+
+func WriteUnauthorized(w http.ResponseWriter, message string) {
+	WriteJSONError(w, http.StatusUnauthorized, message)
+}
+
+func WriteForbidden(w http.ResponseWriter, message string) {
+	WriteJSONError(w, http.StatusForbidden, message)
+}
+
+func WriteNotFound(w http.ResponseWriter, message string) {
+	WriteJSONError(w, http.StatusNotFound, message)
+}
+
+func WriteConflict(w http.ResponseWriter, message string) {
+	WriteJSONError(w, http.StatusConflict, message)
+}
+
+func WriteInternalError(w http.ResponseWriter, message string) {
+	WriteJSONError(w, http.StatusInternalServerError, message)
+}

backend/internal/api/handler.go

···
 	if tag != "" {
 		if creator != "" {
 			if motivation == "" || motivation == "commenting" {
-				annotations, _ = h.db.GetAnnotationsByTagAndAuthor(tag, creator, fetchLimit, 0)
+				switch feedType {
+				case "margin":
+					annotations, _ = h.db.GetMarginAnnotationsByTagAndAuthor(tag, creator, fetchLimit, 0)
+				case "semble":
+					annotations, _ = h.db.GetSembleAnnotationsByTagAndAuthor(tag, creator, fetchLimit, 0)
+				default:
+					annotations, _ = h.db.GetAnnotationsByTagAndAuthor(tag, creator, fetchLimit, 0)
+				}
 			}
 			if motivation == "" || motivation == "highlighting" {
-				highlights, _ = h.db.GetHighlightsByTagAndAuthor(tag, creator, fetchLimit, 0)
+				switch feedType {
+				case "margin":
+					highlights, _ = h.db.GetMarginHighlightsByTagAndAuthor(tag, creator, fetchLimit, 0)
+				case "semble":
+					highlights, _ = h.db.GetSembleHighlightsByTagAndAuthor(tag, creator, fetchLimit, 0)
+				default:
+					highlights, _ = h.db.GetHighlightsByTagAndAuthor(tag, creator, fetchLimit, 0)
+				}
 			}
 			if motivation == "" || motivation == "bookmarking" {
-				bookmarks, _ = h.db.GetBookmarksByTagAndAuthor(tag, creator, fetchLimit, 0)
+				switch feedType {
+				case "margin":
+					bookmarks, _ = h.db.GetMarginBookmarksByTagAndAuthor(tag, creator, fetchLimit, 0)
+				case "semble":
+					bookmarks, _ = h.db.GetSembleBookmarksByTagAndAuthor(tag, creator, fetchLimit, 0)
+				default:
+					bookmarks, _ = h.db.GetBookmarksByTagAndAuthor(tag, creator, fetchLimit, 0)
+				}
 			}
 			collectionItems = []db.CollectionItem{}
 		} else {
 			if motivation == "" || motivation == "commenting" {
-				annotations, _ = h.db.GetAnnotationsByTag(tag, fetchLimit, 0)
+				switch feedType {
+				case "margin":
+					annotations, _ = h.db.GetMarginAnnotationsByTag(tag, fetchLimit, 0)
+				case "semble":
+					annotations, _ = h.db.GetSembleAnnotationsByTag(tag, fetchLimit, 0)
+				default:
+					annotations, _ = h.db.GetAnnotationsByTag(tag, fetchLimit, 0)
+				}
 			}
 			if motivation == "" || motivation == "highlighting" {
-				highlights, _ = h.db.GetHighlightsByTag(tag, fetchLimit, 0)
+				switch feedType {
+				case "margin":
+					highlights, _ = h.db.GetMarginHighlightsByTag(tag, fetchLimit, 0)
+				case "semble":
+					highlights, _ = h.db.GetSembleHighlightsByTag(tag, fetchLimit, 0)
+				default:
+					highlights, _ = h.db.GetHighlightsByTag(tag, fetchLimit, 0)
+				}
 			}
 			if motivation == "" || motivation == "bookmarking" {
-				bookmarks, _ = h.db.GetBookmarksByTag(tag, fetchLimit, 0)
+				switch feedType {
+				case "margin":
+					bookmarks, _ = h.db.GetMarginBookmarksByTag(tag, fetchLimit, 0)
+				case "semble":
+					bookmarks, _ = h.db.GetSembleBookmarksByTag(tag, fetchLimit, 0)
+				default:
+					bookmarks, _ = h.db.GetBookmarksByTag(tag, fetchLimit, 0)
+				}
 			}
 			collectionItems = []db.CollectionItem{}
 		}
 	} else if creator != "" {
 		if motivation == "" || motivation == "commenting" {
-			annotations, _ = h.db.GetAnnotationsByAuthor(creator, fetchLimit, 0)
+			switch feedType {
+			case "margin":
+				annotations, _ = h.db.GetMarginAnnotationsByAuthor(creator, fetchLimit, 0)
+			case "semble":
+				annotations, _ = h.db.GetSembleAnnotationsByAuthor(creator, fetchLimit, 0)
+			default:
+				annotations, _ = h.db.GetAnnotationsByAuthor(creator, fetchLimit, 0)
+			}
 		}
 		if motivation == "" || motivation == "highlighting" {
-			highlights, _ = h.db.GetHighlightsByAuthor(creator, fetchLimit, 0)
+			switch feedType {
+			case "margin":
+				highlights, _ = h.db.GetMarginHighlightsByAuthor(creator, fetchLimit, 0)
+			case "semble":
+				highlights, _ = h.db.GetSembleHighlightsByAuthor(creator, fetchLimit, 0)
+			default:
+				highlights, _ = h.db.GetHighlightsByAuthor(creator, fetchLimit, 0)
+			}
 		}
 		if motivation == "" || motivation == "bookmarking" {
-			bookmarks, _ = h.db.GetBookmarksByAuthor(creator, fetchLimit, 0)
+			switch feedType {
+			case "margin":
+				bookmarks, _ = h.db.GetMarginBookmarksByAuthor(creator, fetchLimit, 0)
+			case "semble":
+				bookmarks, _ = h.db.GetSembleBookmarksByAuthor(creator, fetchLimit, 0)
+			default:
+				bookmarks, _ = h.db.GetBookmarksByAuthor(creator, fetchLimit, 0)
+			}
 		}
 		collectionItems = []db.CollectionItem{}
 	} else {
 		if motivation == "" || motivation == "commenting" {
-			annotations, _ = h.db.GetRecentAnnotations(fetchLimit, 0)
+			switch feedType {
+			case "margin":
+				annotations, _ = h.db.GetMarginAnnotations(fetchLimit, 0)
+			case "semble":
+				annotations, _ = h.db.GetSembleAnnotations(fetchLimit, 0)
+			default:
+				annotations, _ = h.db.GetRecentAnnotations(fetchLimit, 0)
+			}
 		}
 		if motivation == "" || motivation == "highlighting" {
-			highlights, _ = h.db.GetRecentHighlights(fetchLimit, 0)
+			switch feedType {
+			case "margin":
+				highlights, _ = h.db.GetMarginHighlights(fetchLimit, 0)
+			case "semble":
+				highlights, _ = h.db.GetSembleHighlights(fetchLimit, 0)
+			default:
+				highlights, _ = h.db.GetRecentHighlights(fetchLimit, 0)
+			}
 		}
 		if motivation == "" || motivation == "bookmarking" {
-			bookmarks, _ = h.db.GetRecentBookmarks(fetchLimit, 0)
+			switch feedType {
+			case "margin":
+				bookmarks, _ = h.db.GetMarginBookmarks(fetchLimit, 0)
+			case "semble":
+				bookmarks, _ = h.db.GetSembleBookmarks(fetchLimit, 0)
+			default:
+				bookmarks, _ = h.db.GetRecentBookmarks(fetchLimit, 0)
+			}
 		}
 		if motivation == "" {
 			collectionItems, err = h.db.GetRecentCollectionItems(fetchLimit, 0)

backend/internal/api/hydration.go

···
 	"sync"
 	"time"
 
+	"margin.at/internal/config"
 	"margin.at/internal/constellation"
 	"margin.at/internal/db"
 )
···
 		q.Add("actors", did)
 	}
 
-	resp, err := http.Get("https://public.api.bsky.app/xrpc/app.bsky.actor.getProfiles?" + q.Encode())
+	resp, err := http.Get(config.Get().BskyGetProfilesURL() + "?" + q.Encode())
 	if err != nil {
 		log.Printf("Hydration fetch error: %v\n", err)
 		return nil, err

backend/internal/config/config.go

···
+package config
+
+import (
+	"os"
+	"sync"
+)
+
+type Config struct {
+	BskyPublicAPI string
+	PLCDirectory  string
+	BaseURL       string
+}
+
+var (
+	instance *Config
+	once     sync.Once
+)
+
+func Get() *Config {
+	once.Do(func() {
+		instance = &Config{
+			BskyPublicAPI: getEnvOrDefault("BSKY_PUBLIC_API", "https://public.api.bsky.app"),
+			PLCDirectory:  getEnvOrDefault("PLC_DIRECTORY_URL", "https://plc.directory"),
+			BaseURL:       os.Getenv("BASE_URL"),
+		}
+	})
+	return instance
+}
+
+func getEnvOrDefault(key, defaultValue string) string {
+	if value := os.Getenv(key); value != "" {
+		return value
+	}
+	return defaultValue
+}
+
+func (c *Config) BskyResolveHandleURL(handle string) string {
+	return c.BskyPublicAPI + "/xrpc/com.atproto.identity.resolveHandle?handle=" + handle
+}
+
+func (c *Config) BskyGetProfilesURL() string {
+	return c.BskyPublicAPI + "/xrpc/app.bsky.actor.getProfiles"
+}
+
+func (c *Config) PLCResolveURL(did string) string {
+	return c.PLCDirectory + "/" + did
+}

backend/internal/db/db.go

···
 
 	db, err := sql.Open(driver, dsn)
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("failed to open database connection: %w", err)
 	}
 
 	if driver == "sqlite3" {
···
 	}
 
 	if err := db.Ping(); err != nil {
-		return nil, err
+		return nil, fmt.Errorf("failed to ping database: %w", err)
 	}
 
 	return &DB{DB: db, driver: driver}, nil

backend/internal/db/queries_annotations.go

···
 	return scanAnnotations(rows)
 }
 
+func (db *DB) GetMarginAnnotationsByAuthor(authorDID string, limit, offset int) ([]Annotation, error) {
+	rows, err := db.Query(db.Rebind(`
+		SELECT uri, author_did, motivation, body_value, body_format, body_uri, target_source, target_hash, target_title, selector_json, tags_json, created_at, indexed_at, cid
+		FROM annotations
+		WHERE author_did = ? AND uri NOT LIKE '%network.cosmik%'
+		ORDER BY created_at DESC
+		LIMIT ? OFFSET ?
+	`), authorDID, limit, offset)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	return scanAnnotations(rows)
+}
+
+func (db *DB) GetSembleAnnotationsByAuthor(authorDID string, limit, offset int) ([]Annotation, error) {
+	rows, err := db.Query(db.Rebind(`
+		SELECT uri, author_did, motivation, body_value, body_format, body_uri, target_source, target_hash, target_title, selector_json, tags_json, created_at, indexed_at, cid
+		FROM annotations
+		WHERE author_did = ? AND uri LIKE '%network.cosmik%'
+		ORDER BY created_at DESC
+		LIMIT ? OFFSET ?
+	`), authorDID, limit, offset)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	return scanAnnotations(rows)
+}
+
 func (db *DB) GetAnnotationsByMotivation(motivation string, limit, offset int) ([]Annotation, error) {
 	rows, err := db.Query(db.Rebind(`
 		SELECT uri, author_did, motivation, body_value, body_format, body_uri, target_source, target_hash, target_title, selector_json, tags_json, created_at, indexed_at, cid
···
 	return scanAnnotations(rows)
 }
 
+func (db *DB) GetMarginAnnotations(limit, offset int) ([]Annotation, error) {
+	rows, err := db.Query(db.Rebind(`
+		SELECT uri, author_did, motivation, body_value, body_format, body_uri, target_source, target_hash, target_title, selector_json, tags_json, created_at, indexed_at, cid
+		FROM annotations
+		WHERE uri NOT LIKE '%network.cosmik%'
+		ORDER BY created_at DESC
+		LIMIT ? OFFSET ?
+	`), limit, offset)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	return scanAnnotations(rows)
+}
+
+func (db *DB) GetSembleAnnotations(limit, offset int) ([]Annotation, error) {
+	rows, err := db.Query(db.Rebind(`
+		SELECT uri, author_did, motivation, body_value, body_format, body_uri, target_source, target_hash, target_title, selector_json, tags_json, created_at, indexed_at, cid
+		FROM annotations
+		WHERE uri LIKE '%network.cosmik%'
+		ORDER BY created_at DESC
+		LIMIT ? OFFSET ?
+	`), limit, offset)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	return scanAnnotations(rows)
+}
+
 func (db *DB) GetAnnotationsByTag(tag string, limit, offset int) ([]Annotation, error) {
 	pattern := "%\"" + tag + "\"%"
 	rows, err := db.Query(db.Rebind(`
···
 	return scanAnnotations(rows)
 }
 
+func (db *DB) GetMarginAnnotationsByTag(tag string, limit, offset int) ([]Annotation, error) {
+	pattern := "%\"" + tag + "\"%"
+	rows, err := db.Query(db.Rebind(`
+		SELECT uri, author_did, motivation, body_value, body_format, body_uri, target_source, target_hash, target_title, selector_json, tags_json, created_at, indexed_at, cid
+		FROM annotations
+		WHERE tags_json LIKE ? AND uri NOT LIKE '%network.cosmik%'
+		ORDER BY created_at DESC
+		LIMIT ? OFFSET ?
+	`), pattern, limit, offset)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	return scanAnnotations(rows)
+}
+
+func (db *DB) GetSembleAnnotationsByTag(tag string, limit, offset int) ([]Annotation, error) {
+	pattern := "%\"" + tag + "\"%"
+	rows, err := db.Query(db.Rebind(`
+		SELECT uri, author_did, motivation, body_value, body_format, body_uri, target_source, target_hash, target_title, selector_json, tags_json, created_at, indexed_at, cid
+		FROM annotations
+		WHERE tags_json LIKE ? AND uri LIKE '%network.cosmik%'
+		ORDER BY created_at DESC
+		LIMIT ? OFFSET ?
+	`), pattern, limit, offset)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	return scanAnnotations(rows)
+}
+
 func (db *DB) DeleteAnnotation(uri string) error {
 	_, err := db.Exec(db.Rebind(`DELETE FROM annotations WHERE uri = ?`), uri)
 	return err
···
 		SELECT uri, author_did, motivation, body_value, body_format, body_uri, target_source, target_hash, target_title, selector_json, tags_json, created_at, indexed_at, cid
 		FROM annotations
 		WHERE author_did = ? AND tags_json LIKE ?
+		ORDER BY created_at DESC
+		LIMIT ? OFFSET ?
+	`), authorDID, pattern, limit, offset)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	return scanAnnotations(rows)
+}
+
+func (db *DB) GetMarginAnnotationsByTagAndAuthor(tag, authorDID string, limit, offset int) ([]Annotation, error) {
+	pattern := "%\"" + tag + "\"%"
+	rows, err := db.Query(db.Rebind(`
+		SELECT uri, author_did, motivation, body_value, body_format, body_uri, target_source, target_hash, target_title, selector_json, tags_json, created_at, indexed_at, cid
+		FROM annotations
+		WHERE author_did = ? AND tags_json LIKE ? AND uri NOT LIKE '%network.cosmik%'
+		ORDER BY created_at DESC
+		LIMIT ? OFFSET ?
+	`), authorDID, pattern, limit, offset)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	return scanAnnotations(rows)
+}
+
+func (db *DB) GetSembleAnnotationsByTagAndAuthor(tag, authorDID string, limit, offset int) ([]Annotation, error) {
+	pattern := "%\"" + tag + "\"%"
+	rows, err := db.Query(db.Rebind(`
+		SELECT uri, author_did, motivation, body_value, body_format, body_uri, target_source, target_hash, target_title, selector_json, tags_json, created_at, indexed_at, cid
+		FROM annotations
+		WHERE author_did = ? AND tags_json LIKE ? AND uri LIKE '%network.cosmik%'
 		ORDER BY created_at DESC
 		LIMIT ? OFFSET ?
 	`), authorDID, pattern, limit, offset)

backend/internal/db/queries_bookmarks.go

···
 	return bookmarks, nil
 }
 
+func (db *DB) GetMarginBookmarks(limit, offset int) ([]Bookmark, error) {
+	rows, err := db.Query(db.Rebind(`
+		SELECT uri, author_did, source, source_hash, title, description, tags_json, created_at, indexed_at, cid
+		FROM bookmarks
+		WHERE uri NOT LIKE '%network.cosmik%'
+		ORDER BY created_at DESC
+		LIMIT ? OFFSET ?
+	`), limit, offset)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var bookmarks []Bookmark
+	for rows.Next() {
+		var b Bookmark
+		if err := rows.Scan(&b.URI, &b.AuthorDID, &b.Source, &b.SourceHash, &b.Title, &b.Description, &b.TagsJSON, &b.CreatedAt, &b.IndexedAt, &b.CID); err != nil {
+			return nil, err
+		}
+		bookmarks = append(bookmarks, b)
+	}
+	return bookmarks, nil
+}
+
+func (db *DB) GetSembleBookmarks(limit, offset int) ([]Bookmark, error) {
+	rows, err := db.Query(db.Rebind(`
+		SELECT uri, author_did, source, source_hash, title, description, tags_json, created_at, indexed_at, cid
+		FROM bookmarks
+		WHERE uri LIKE '%network.cosmik%'
+		ORDER BY created_at DESC
+		LIMIT ? OFFSET ?
+	`), limit, offset)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var bookmarks []Bookmark
+	for rows.Next() {
+		var b Bookmark
+		if err := rows.Scan(&b.URI, &b.AuthorDID, &b.Source, &b.SourceHash, &b.Title, &b.Description, &b.TagsJSON, &b.CreatedAt, &b.IndexedAt, &b.CID); err != nil {
+			return nil, err
+		}
+		bookmarks = append(bookmarks, b)
+	}
+	return bookmarks, nil
+}
+
 func (db *DB) GetBookmarksByTag(tag string, limit, offset int) ([]Bookmark, error) {
 	pattern := "%\"" + tag + "\"%"
 	rows, err := db.Query(db.Rebind(`
 		SELECT uri, author_did, source, source_hash, title, description, tags_json, created_at, indexed_at, cid
 		FROM bookmarks
 		WHERE tags_json LIKE ?
+		ORDER BY created_at DESC
+		LIMIT ? OFFSET ?
+	`), pattern, limit, offset)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var bookmarks []Bookmark
+	for rows.Next() {
+		var b Bookmark
+		if err := rows.Scan(&b.URI, &b.AuthorDID, &b.Source, &b.SourceHash, &b.Title, &b.Description, &b.TagsJSON, &b.CreatedAt, &b.IndexedAt, &b.CID); err != nil {
+			return nil, err
+		}
+		bookmarks = append(bookmarks, b)
+	}
+	return bookmarks, nil
+}
+
+func (db *DB) GetMarginBookmarksByTag(tag string, limit, offset int) ([]Bookmark, error) {
+	pattern := "%\"" + tag + "\"%"
+	rows, err := db.Query(db.Rebind(`
+		SELECT uri, author_did, source, source_hash, title, description, tags_json, created_at, indexed_at, cid
+		FROM bookmarks
+		WHERE tags_json LIKE ? AND uri NOT LIKE '%network.cosmik%'
+		ORDER BY created_at DESC
+		LIMIT ? OFFSET ?
+	`), pattern, limit, offset)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var bookmarks []Bookmark
+	for rows.Next() {
+		var b Bookmark
+		if err := rows.Scan(&b.URI, &b.AuthorDID, &b.Source, &b.SourceHash, &b.Title, &b.Description, &b.TagsJSON, &b.CreatedAt, &b.IndexedAt, &b.CID); err != nil {
+			return nil, err
+		}
+		bookmarks = append(bookmarks, b)
+	}
+	return bookmarks, nil
+}
+
+func (db *DB) GetSembleBookmarksByTag(tag string, limit, offset int) ([]Bookmark, error) {
+	pattern := "%\"" + tag + "\"%"
+	rows, err := db.Query(db.Rebind(`
+		SELECT uri, author_did, source, source_hash, title, description, tags_json, created_at, indexed_at, cid
+		FROM bookmarks
+		WHERE tags_json LIKE ? AND uri LIKE '%network.cosmik%'
 		ORDER BY created_at DESC
 		LIMIT ? OFFSET ?
 	`), pattern, limit, offset)
···
 	return bookmarks, nil
 }
 
+func (db *DB) GetMarginBookmarksByTagAndAuthor(tag, authorDID string, limit, offset int) ([]Bookmark, error) {
+	pattern := "%\"" + tag + "\"%"
+	rows, err := db.Query(db.Rebind(`
+		SELECT uri, author_did, source, source_hash, title, description, tags_json, created_at, indexed_at, cid
+		FROM bookmarks
+		WHERE author_did = ? AND tags_json LIKE ? AND uri NOT LIKE '%network.cosmik%'
+		ORDER BY created_at DESC
+		LIMIT ? OFFSET ?
+	`), authorDID, pattern, limit, offset)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var bookmarks []Bookmark
+	for rows.Next() {
+		var b Bookmark
+		if err := rows.Scan(&b.URI, &b.AuthorDID, &b.Source, &b.SourceHash, &b.Title, &b.Description, &b.TagsJSON, &b.CreatedAt, &b.IndexedAt, &b.CID); err != nil {
+			return nil, err
+		}
+		bookmarks = append(bookmarks, b)
+	}
+	return bookmarks, nil
+}
+
+func (db *DB) GetSembleBookmarksByTagAndAuthor(tag, authorDID string, limit, offset int) ([]Bookmark, error) {
+	pattern := "%\"" + tag + "\"%"
+	rows, err := db.Query(db.Rebind(`
+		SELECT uri, author_did, source, source_hash, title, description, tags_json, created_at, indexed_at, cid
+		FROM bookmarks
+		WHERE author_did = ? AND tags_json LIKE ? AND uri LIKE '%network.cosmik%'
+		ORDER BY created_at DESC
+		LIMIT ? OFFSET ?
+	`), authorDID, pattern, limit, offset)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var bookmarks []Bookmark
+	for rows.Next() {
+		var b Bookmark
+		if err := rows.Scan(&b.URI, &b.AuthorDID, &b.Source, &b.SourceHash, &b.Title, &b.Description, &b.TagsJSON, &b.CreatedAt, &b.IndexedAt, &b.CID); err != nil {
+			return nil, err
+		}
+		bookmarks = append(bookmarks, b)
+	}
+	return bookmarks, nil
+}
+
 func (db *DB) GetBookmarksByAuthor(authorDID string, limit, offset int) ([]Bookmark, error) {
 	rows, err := db.Query(db.Rebind(`
 		SELECT uri, author_did, source, source_hash, title, description, tags_json, created_at, indexed_at, cid
 		FROM bookmarks
 		WHERE author_did = ?
+		ORDER BY created_at DESC
+		LIMIT ? OFFSET ?
+	`), authorDID, limit, offset)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var bookmarks []Bookmark
+	for rows.Next() {
+		var b Bookmark
+		if err := rows.Scan(&b.URI, &b.AuthorDID, &b.Source, &b.SourceHash, &b.Title, &b.Description, &b.TagsJSON, &b.CreatedAt, &b.IndexedAt, &b.CID); err != nil {
+			return nil, err
+		}
+		bookmarks = append(bookmarks, b)
+	}
+	return bookmarks, nil
+}
+
+func (db *DB) GetMarginBookmarksByAuthor(authorDID string, limit, offset int) ([]Bookmark, error) {
+	rows, err := db.Query(db.Rebind(`
+		SELECT uri, author_did, source, source_hash, title, description, tags_json, created_at, indexed_at, cid
+		FROM bookmarks
+		WHERE author_did = ? AND uri NOT LIKE '%network.cosmik%'
+		ORDER BY created_at DESC
+		LIMIT ? OFFSET ?
+	`), authorDID, limit, offset)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var bookmarks []Bookmark
+	for rows.Next() {
+		var b Bookmark
+		if err := rows.Scan(&b.URI, &b.AuthorDID, &b.Source, &b.SourceHash, &b.Title, &b.Description, &b.TagsJSON, &b.CreatedAt, &b.IndexedAt, &b.CID); err != nil {
+			return nil, err
+		}
+		bookmarks = append(bookmarks, b)
+	}
+	return bookmarks, nil
+}
+
+func (db *DB) GetSembleBookmarksByAuthor(authorDID string, limit, offset int) ([]Bookmark, error) {
+	rows, err := db.Query(db.Rebind(`
+		SELECT uri, author_did, source, source_hash, title, description, tags_json, created_at, indexed_at, cid
+		FROM bookmarks
+		WHERE author_did = ? AND uri LIKE '%network.cosmik%'
 		ORDER BY created_at DESC
 		LIMIT ? OFFSET ?
 	`), authorDID, limit, offset)

backend/internal/db/queries_highlights.go

···
 	return highlights, nil
 }
 
+func (db *DB) GetMarginHighlights(limit, offset int) ([]Highlight, error) {
+	rows, err := db.Query(db.Rebind(`
+		SELECT uri, author_did, target_source, target_hash, target_title, selector_json, color, tags_json, created_at, indexed_at, cid
+		FROM highlights
+		WHERE uri NOT LIKE '%network.cosmik%'
+		ORDER BY created_at DESC
+		LIMIT ? OFFSET ?
+	`), limit, offset)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var highlights []Highlight
+	for rows.Next() {
+		var h Highlight
+		if err := rows.Scan(&h.URI, &h.AuthorDID, &h.TargetSource, &h.TargetHash, &h.TargetTitle, &h.SelectorJSON, &h.Color, &h.TagsJSON, &h.CreatedAt, &h.IndexedAt, &h.CID); err != nil {
+			return nil, err
+		}
+		highlights = append(highlights, h)
+	}
+	return highlights, nil
+}
+
+func (db *DB) GetSembleHighlights(limit, offset int) ([]Highlight, error) {
+	rows, err := db.Query(db.Rebind(`
+		SELECT uri, author_did, target_source, target_hash, target_title, selector_json, color, tags_json, created_at, indexed_at, cid
+		FROM highlights
+		WHERE uri LIKE '%network.cosmik%'
+		ORDER BY created_at DESC
+		LIMIT ? OFFSET ?
+	`), limit, offset)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var highlights []Highlight
+	for rows.Next() {
+		var h Highlight
+		if err := rows.Scan(&h.URI, &h.AuthorDID, &h.TargetSource, &h.TargetHash, &h.TargetTitle, &h.SelectorJSON, &h.Color, &h.TagsJSON, &h.CreatedAt, &h.IndexedAt, &h.CID); err != nil {
+			return nil, err
+		}
+		highlights = append(highlights, h)
+	}
+	return highlights, nil
+}
+
 func (db *DB) GetHighlightsByTag(tag string, limit, offset int) ([]Highlight, error) {
 	pattern := "%\"" + tag + "\"%"
 	rows, err := db.Query(db.Rebind(`
 		SELECT uri, author_did, target_source, target_hash, target_title, selector_json, color, tags_json, created_at, indexed_at, cid
 		FROM highlights
 		WHERE tags_json LIKE ?
+		ORDER BY created_at DESC
+		LIMIT ? OFFSET ?
+	`), pattern, limit, offset)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var highlights []Highlight
+	for rows.Next() {
+		var h Highlight
+		if err := rows.Scan(&h.URI, &h.AuthorDID, &h.TargetSource, &h.TargetHash, &h.TargetTitle, &h.SelectorJSON, &h.Color, &h.TagsJSON, &h.CreatedAt, &h.IndexedAt, &h.CID); err != nil {
+			return nil, err
+		}
+		highlights = append(highlights, h)
+	}
+	return highlights, nil
+}
+
+func (db *DB) GetMarginHighlightsByTag(tag string, limit, offset int) ([]Highlight, error) {
+	pattern := "%\"" + tag + "\"%"
+	rows, err := db.Query(db.Rebind(`
+		SELECT uri, author_did, target_source, target_hash, target_title, selector_json, color, tags_json, created_at, indexed_at, cid
+		FROM highlights
+		WHERE tags_json LIKE ? AND uri NOT LIKE '%network.cosmik%'
+		ORDER BY created_at DESC
+		LIMIT ? OFFSET ?
+	`), pattern, limit, offset)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var highlights []Highlight
+	for rows.Next() {
+		var h Highlight
+		if err := rows.Scan(&h.URI, &h.AuthorDID, &h.TargetSource, &h.TargetHash, &h.TargetTitle, &h.SelectorJSON, &h.Color, &h.TagsJSON, &h.CreatedAt, &h.IndexedAt, &h.CID); err != nil {
+			return nil, err
+		}
+		highlights = append(highlights, h)
+	}
+	return highlights, nil
+}
+
+func (db *DB) GetSembleHighlightsByTag(tag string, limit, offset int) ([]Highlight, error) {
+	pattern := "%\"" + tag + "\"%"
+	rows, err := db.Query(db.Rebind(`
+		SELECT uri, author_did, target_source, target_hash, target_title, selector_json, color, tags_json, created_at, indexed_at, cid
+		FROM highlights
+		WHERE tags_json LIKE ? AND uri LIKE '%network.cosmik%'
 		ORDER BY created_at DESC
 		LIMIT ? OFFSET ?
 	`), pattern, limit, offset)
···
 	return highlights, nil
 }
 
+func (db *DB) GetMarginHighlightsByTagAndAuthor(tag, authorDID string, limit, offset int) ([]Highlight, error) {
+	pattern := "%\"" + tag + "\"%"
+	rows, err := db.Query(db.Rebind(`
+		SELECT uri, author_did, target_source, target_hash, target_title, selector_json, color, tags_json, created_at, indexed_at, cid
+		FROM highlights
+		WHERE author_did = ? AND tags_json LIKE ? AND uri NOT LIKE '%network.cosmik%'
+		ORDER BY created_at DESC
+		LIMIT ? OFFSET ?
+	`), authorDID, pattern, limit, offset)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var highlights []Highlight
+	for rows.Next() {
+		var h Highlight
+		if err := rows.Scan(&h.URI, &h.AuthorDID, &h.TargetSource, &h.TargetHash, &h.TargetTitle, &h.SelectorJSON, &h.Color, &h.TagsJSON, &h.CreatedAt, &h.IndexedAt, &h.CID); err != nil {
+			return nil, err
+		}
+		highlights = append(highlights, h)
+	}
+	return highlights, nil
+}
+
+func (db *DB) GetSembleHighlightsByTagAndAuthor(tag, authorDID string, limit, offset int) ([]Highlight, error) {
+	pattern := "%\"" + tag + "\"%"
+	rows, err := db.Query(db.Rebind(`
+		SELECT uri, author_did, target_source, target_hash, target_title, selector_json, color, tags_json, created_at, indexed_at, cid
+		FROM highlights
+		WHERE author_did = ? AND tags_json LIKE ? AND uri LIKE '%network.cosmik%'
+		ORDER BY created_at DESC
+		LIMIT ? OFFSET ?
+	`), authorDID, pattern, limit, offset)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var highlights []Highlight
+	for rows.Next() {
+		var h Highlight
+		if err := rows.Scan(&h.URI, &h.AuthorDID, &h.TargetSource, &h.TargetHash, &h.TargetTitle, &h.SelectorJSON, &h.Color, &h.TagsJSON, &h.CreatedAt, &h.IndexedAt, &h.CID); err != nil {
+			return nil, err
+		}
+		highlights = append(highlights, h)
+	}
+	return highlights, nil
+}
+
 func (db *DB) GetHighlightsByTargetHash(targetHash string, limit, offset int) ([]Highlight, error) {
 	rows, err := db.Query(db.Rebind(`
 		SELECT uri, author_did, target_source, target_hash, target_title, selector_json, color, tags_json, created_at, indexed_at, cid
···
 		SELECT uri, author_did, target_source, target_hash, target_title, selector_json, color, tags_json, created_at, indexed_at, cid
 		FROM highlights
 		WHERE author_did = ?
+		ORDER BY created_at DESC
+		LIMIT ? OFFSET ?
+	`), authorDID, limit, offset)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var highlights []Highlight
+	for rows.Next() {
+		var h Highlight
+		if err := rows.Scan(&h.URI, &h.AuthorDID, &h.TargetSource, &h.TargetHash, &h.TargetTitle, &h.SelectorJSON, &h.Color, &h.TagsJSON, &h.CreatedAt, &h.IndexedAt, &h.CID); err != nil {
+			return nil, err
+		}
+		highlights = append(highlights, h)
+	}
+	return highlights, nil
+}
+
+func (db *DB) GetMarginHighlightsByAuthor(authorDID string, limit, offset int) ([]Highlight, error) {
+	rows, err := db.Query(db.Rebind(`
+		SELECT uri, author_did, target_source, target_hash, target_title, selector_json, color, tags_json, created_at, indexed_at, cid
+		FROM highlights
+		WHERE author_did = ? AND uri NOT LIKE '%network.cosmik%'
+		ORDER BY created_at DESC
+		LIMIT ? OFFSET ?
+	`), authorDID, limit, offset)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var highlights []Highlight
+	for rows.Next() {
+		var h Highlight
+		if err := rows.Scan(&h.URI, &h.AuthorDID, &h.TargetSource, &h.TargetHash, &h.TargetTitle, &h.SelectorJSON, &h.Color, &h.TagsJSON, &h.CreatedAt, &h.IndexedAt, &h.CID); err != nil {
+			return nil, err
+		}
+		highlights = append(highlights, h)
+	}
+	return highlights, nil
+}
+
+func (db *DB) GetSembleHighlightsByAuthor(authorDID string, limit, offset int) ([]Highlight, error) {
+	rows, err := db.Query(db.Rebind(`
+		SELECT uri, author_did, target_source, target_hash, target_title, selector_json, color, tags_json, created_at, indexed_at, cid
+		FROM highlights
+		WHERE author_did = ? AND uri LIKE '%network.cosmik%'
 		ORDER BY created_at DESC
 		LIMIT ? OFFSET ?
 	`), authorDID, limit, offset)

backend/internal/oauth/client.go

···
 
 	"github.com/go-jose/go-jose/v4"
 	"github.com/go-jose/go-jose/v4/jwt"
+	"margin.at/internal/config"
 )
 
 type Client struct {
···
 }
 
 func (c *Client) ResolveHandle(ctx context.Context, handle string) (string, error) {
-	did, err := c.resolveHandleAt(ctx, handle, "https://public.api.bsky.app")
+	did, err := c.resolveHandleAt(ctx, handle, config.Get().BskyPublicAPI)
 	if err == nil {
 		return did, nil
 	}
···
 func (c *Client) ResolveDIDToPDS(ctx context.Context, did string) (string, error) {
 	var docURL string
 	if strings.HasPrefix(did, "did:plc:") {
-		docURL = fmt.Sprintf("https://plc.directory/%s", did)
+		docURL = config.Get().PLCResolveURL(did)
 	} else if strings.HasPrefix(did, "did:web:") {
 		domain := strings.TrimPrefix(did, "did:web:")
 		docURL = fmt.Sprintf("https://%s/.well-known/did.json", domain)

backend/internal/oauth/handler.go

···
 	}
 
 	var req struct {
-		Handle     string `json:"handle"`
-		InviteCode string `json:"invite_code"`
+		Handle string `json:"handle"`
 	}
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
 		http.Error(w, "Invalid request body", http.StatusBadRequest)
···
 
 	if req.Handle == "" {
 		http.Error(w, "Handle is required", http.StatusBadRequest)
-		return
-	}
-
-	requiredCode := os.Getenv("INVITE_CODE")
-	if requiredCode != "" && req.InviteCode != requiredCode {
-		w.Header().Set("Content-Type", "application/json")
-		w.WriteHeader(http.StatusForbidden)
-		json.NewEncoder(w).Encode(map[string]string{
-			"error": "Invite code required",
-			"code":  "invite_required",
-		})
 		return
 	}
 
···
 		Path:     "/",
 		HttpOnly: true,
 		Secure:   true,
-		SameSite: http.SameSiteNoneMode,
+		SameSite: http.SameSiteLaxMode,
 		MaxAge:   86400 * 7,
 	})
 
···
 func deleteFromPDS(pds, accessToken string, dpopKey *ecdsa.PrivateKey, collection, did, rkey string) {
 
 	client := xrpc.NewClient(pds, accessToken, dpopKey)
-	err := client.DeleteRecord(context.Background(), collection, did, rkey)
+	err := client.DeleteRecord(context.Background(), did, collection, rkey)
 	if err != nil {
 		log.Printf("Failed to delete orphaned reply from PDS: %v", err)
 	} else {

backend/internal/xrpc/records.go

···
 }
 
 func (r *ReplyRecord) Validate() error {
+	if r.Parent.URI == "" || r.Parent.CID == "" {
+		return fmt.Errorf("parent uri and cid are required")
+	}
+	if r.Root.URI == "" || r.Root.CID == "" {
+		return fmt.Errorf("root uri and cid are required")
+	}
 	if r.Text == "" {
 		return fmt.Errorf("text is required")
 	}

backend/internal/xrpc/utils.go

···
 	"strings"
 	"time"
 
+	"margin.at/internal/config"
 	"margin.at/internal/slingshot"
 )
 
···
 func resolveDIDToPDSDirect(did string) (string, error) {
 	var docURL string
 	if strings.HasPrefix(did, "did:plc:") {
-		docURL = fmt.Sprintf("https://plc.directory/%s", did)
+		docURL = config.Get().PLCResolveURL(did)
 	} else if strings.HasPrefix(did, "did:web:") {
 		domain := strings.TrimPrefix(did, "did:web:")
 		docURL = fmt.Sprintf("https://%s/.well-known/did.json", domain)
···
 }
 
 func resolveHandleDirect(handle string) (string, error) {
-	url := fmt.Sprintf("https://public.api.bsky.app/xrpc/com.atproto.identity.resolveHandle?handle=%s", handle)
+	url := config.Get().BskyResolveHandleURL(handle)
 	client := &http.Client{
 		Timeout: 5 * time.Second,
 	}

web/src/api/client.js

···
   return data.did;
 }
 
-export async function startLogin(handle, inviteCode) {
+export async function startLogin(handle) {
   return request(`${AUTH_BASE}/start`, {
     method: "POST",
-    body: JSON.stringify({ handle, invite_code: inviteCode }),
+    body: JSON.stringify({ handle }),
   });
 }
 
···
   return request(`${API_BASE}/keys/${id}`, { method: "DELETE" });
 }
 
-export async function describeServer(service) {
-  const res = await fetch(`${service}/xrpc/com.atproto.server.describeServer`);
-  if (!res.ok) throw new Error("Failed to describe server");
-  return res.json();
-}
 
-export async function createAccount(
-  service,
-  { handle, email, password, inviteCode },
-) {
-  const res = await fetch(`${service}/xrpc/com.atproto.server.createAccount`, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/json",
-    },
-    body: JSON.stringify({
-      handle,
-      email,
-      password,
-      inviteCode,
-    }),
-  });
-
-  const data = await res.json();
-  if (!res.ok) {
-    throw new Error(data.message || data.error || "Failed to create account");
-  }
-  return data;
-}

web/src/pages/Login.jsx

···
   const { isAuthenticated, user, logout } = useAuth();
   const [showSignUp, setShowSignUp] = useState(false);
   const [handle, setHandle] = useState("");
-  const [inviteCode, setInviteCode] = useState("");
-  const [showInviteInput, setShowInviteInput] = useState(false);
   const [suggestions, setSuggestions] = useState([]);
   const [showSuggestions, setShowSuggestions] = useState(false);
   const [loading, setLoading] = useState(false);
   const [error, setError] = useState(null);
   const [selectedIndex, setSelectedIndex] = useState(-1);
   const inputRef = useRef(null);
-  const inviteRef = useRef(null);
   const suggestionsRef = useRef(null);
 
   const [providerIndex, setProviderIndex] = useState(0);
···
   const handleSubmit = async (e) => {
     e.preventDefault();
     if (!handle.trim()) return;
-    if (showInviteInput && !inviteCode.trim()) return;
 
     setLoading(true);
     setError(null);
 
     try {
-      const result = await startLogin(handle.trim(), inviteCode.trim());
+      const result = await startLogin(handle.trim());
       if (result.authorizationUrl) {
         window.location.href = result.authorizationUrl;
       }
     } catch (err) {
       console.error("Login error:", err);
-      if (
-        err.message &&
-        (err.message.includes("invite_required") ||
-          err.message.includes("Invite code required"))
-      ) {
-        setShowInviteInput(true);
-        setError("Please enter an invite code to continue.");
-        setTimeout(() => inviteRef.current?.focus(), 100);
-      } else {
-        setError(err.message || "Failed to start login");
-      }
+      setError(err.message || "Failed to start login");
       setLoading(false);
     }
   };
···
           )}
         </div>
 
-        {showInviteInput && (
-          <div
-            className="login-input-wrapper"
-            style={{ marginTop: "12px", animation: "fadeIn 0.3s ease" }}
-          >
-            <input
-              ref={inviteRef}
-              type="text"
-              className="login-input"
-              placeholder="Enter invite code"
-              value={inviteCode}
-              onChange={(e) => setInviteCode(e.target.value)}
-              autoComplete="off"
-              disabled={loading}
-              style={{ borderColor: "var(--accent)" }}
-            />
-          </div>
-        )}
+
 
         {error && <p className="login-error">{error}</p>}
 
···
           type="submit"
           className="btn btn-primary login-submit"
           disabled={
-            loading || !handle.trim() || (showInviteInput && !inviteCode.trim())
+            loading || !handle.trim()
           }
         >
           {loading
             ? "Connecting..."
-            : showInviteInput
-              ? "Submit Code"
-              : "Continue"}
+            : "Continue"}
         </button>
 
         <p className="login-legal">