serde bytes helpers for bytes fields in json

Cargo.lock

···
 ]
 
 [[package]]
+name = "atomic-polyfill"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8cf2bce30dfe09ef0bfaef228b9d414faaf7e563035494d7fe092dba54b300f4"
+dependencies = [
+ "critical-section",
+]
+
+[[package]]
 name = "atomic-waker"
 version = "1.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 ]
 
 [[package]]
+name = "cobs"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fa961b519f0b462e3a3b4a34b64d119eeaca1d59af726fe450bbba07a9fc0a1"
+dependencies = [
+ "thiserror 2.0.17",
+]
+
+[[package]]
 name = "color_quant"
 version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 ]
 
 [[package]]
+name = "critical-section"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "790eea4361631c5e7d22598ecd5723ff611904e3344ce8720784c93e3d83d40b"
+
+[[package]]
 name = "crossbeam-channel"
 version = "0.5.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 dependencies = [
  "serde",
 ]
+
+[[package]]
+name = "embedded-io"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef1a6892d9eef45c8fa6b9e0086428a2cca8491aca8f787c534a3d6d0bcb3ced"
+
+[[package]]
+name = "embedded-io"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "edd0f118536f44f5ccd48bcb8b111bdc3de888b58c74639dfb034a357d0f206d"
 
 [[package]]
 name = "encode_unicode"
···
 ]
 
 [[package]]
+name = "hash32"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b0c35f58762feb77d74ebe43bdbc3210f09be9fe6742234d573bacc26ed92b67"
+dependencies = [
+ "byteorder",
+]
+
+[[package]]
 name = "hashbrown"
 version = "0.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 version = "0.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5419bdc4f6a9207fbeba6d11b604d481addf78ecd10c11ad51e76c2f6482748d"
+
+[[package]]
+name = "heapless"
+version = "0.7.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cdc6457c0eb62c71aac4bc17216026d8410337c4126773b9c5daba343f17964f"
+dependencies = [
+ "atomic-polyfill",
+ "hash32",
+ "rustc_version",
+ "serde",
+ "spin 0.9.8",
+ "stable_deref_trait",
+]
 
 [[package]]
 name = "heck"
···
  "miette",
  "rustversion",
  "serde",
+ "serde_bytes",
  "serde_ipld_dagcbor",
  "thiserror 2.0.17",
  "unicode-segmentation",
···
  "n0-future",
  "ouroboros",
  "p256",
+ "postcard",
  "rand 0.9.2",
  "regex",
  "regex-lite",
  "reqwest",
  "serde",
+ "serde_bytes",
  "serde_html_form",
  "serde_ipld_dagcbor",
  "serde_json",
···
 ]
 
 [[package]]
+name = "postcard"
+version = "1.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6764c3b5dd454e283a30e6dfe78e9b31096d9e32036b5d1eaac7a6119ccb9a24"
+dependencies = [
+ "cobs",
+ "embedded-io 0.4.0",
+ "embedded-io 0.6.1",
+ "heapless",
+ "serde",
+]
+
+[[package]]
 name = "potential_utf"
 version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 version = "0.9.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67"
+dependencies = [
+ "lock_api",
+]
 
 [[package]]
 name = "spin"

crates/jacquard-api/Cargo.toml

···
 serde_ipld_dagcbor.workspace = true
 thiserror.workspace = true
 unicode-segmentation = "1.12"
+serde_bytes = "0.11"
 
 
 [lints.rust]

crates/jacquard-common/Cargo.toml

···
 thiserror.workspace = true
 url.workspace = true
 http.workspace = true
+serde_bytes = "0.11"
+
 
 reqwest = { workspace = true, optional = true, features = ["json", "charset", "gzip", "stream"] }
 serde_ipld_dagcbor.workspace = true
···
 tokio-tungstenite-wasm = { version = "0.4", features = ["rustls-tls-native-roots"], optional = true }
 ciborium = {version = "0.2.0", optional = true }
 zstd = { version = "0.13", optional = true }
+postcard = { version = "1.1.3", features = ["use-std"] }
 
 [target.'cfg(target_family = "wasm")'.dependencies]
 getrandom = { version = "0.3.4", features = ["wasm_js"] }

crates/jacquard-common/src/lib.rs

···
 /// Baseline fundamental AT Protocol data types.
 pub mod types;
 // XRPC protocol types and traits
-pub mod xrpc;
+pub mod opt_serde_bytes_helper;
+pub mod serde_bytes_helper;
 /// Stream abstractions for HTTP request/response bodies.
 #[cfg(feature = "streaming")]
 pub mod stream;
+pub mod xrpc;
 
 #[cfg(feature = "streaming")]
-pub use stream::{ByteStream, ByteSink, StreamError, StreamErrorKind};
+pub use stream::{ByteSink, ByteStream, StreamError, StreamErrorKind};
 
 #[cfg(feature = "streaming")]
 pub use xrpc::StreamingResponse;
···
 
 #[cfg(feature = "websocket")]
 pub use websocket::{
-    tungstenite_client::TungsteniteClient, CloseCode, CloseFrame, WebSocketClient,
-    WebSocketConnection, WsMessage, WsSink, WsStream, WsText,
+    CloseCode, CloseFrame, WebSocketClient, WebSocketConnection, WsMessage, WsSink, WsStream,
+    WsText, tungstenite_client::TungsteniteClient,
 };
 
 pub use types::value::*;

crates/jacquard-common/src/opt_serde_bytes_helper.rs

···
+//! Custom serde helpers for bytes::Bytes using serde_bytes
+
+use bytes::Bytes;
+use serde::{Deserializer, Serializer};
+
+/// Serialize Bytes as a CBOR byte string
+pub fn serialize<S>(bytes: &Option<Bytes>, serializer: S) -> Result<S::Ok, S::Error>
+where
+    S: Serializer,
+{
+    if let Some(bytes) = bytes {
+        serde_bytes::serialize(bytes.as_ref(), serializer)
+    } else {
+        serializer.serialize_none()
+    }
+}
+
+/// Deserialize Bytes from a CBOR byte string
+pub fn deserialize<'de, D>(deserializer: D) -> Result<Option<Bytes>, D::Error>
+where
+    D: Deserializer<'de>,
+{
+    let vec: Option<Vec<u8>> = serde_bytes::deserialize(deserializer)?;
+    Ok(vec.map(Bytes::from))
+}

crates/jacquard-common/src/serde_bytes_helper.rs

···
+//! Custom serde helpers for bytes::Bytes using serde_bytes
+
+use bytes::Bytes;
+use serde::{Deserializer, Serializer};
+
+/// Serialize Bytes as a CBOR byte string
+pub fn serialize<S>(bytes: &Bytes, serializer: S) -> Result<S::Ok, S::Error>
+where
+    S: Serializer,
+{
+    serde_bytes::serialize(bytes.as_ref(), serializer)
+}
+
+/// Deserialize Bytes from a CBOR byte string
+pub fn deserialize<'de, D>(deserializer: D) -> Result<Bytes, D::Error>
+where
+    D: Deserializer<'de>,
+{
+    let vec: Vec<u8> = serde_bytes::deserialize(deserializer)?;
+    Ok(Bytes::from(vec))
+}

crates/jacquard-common/src/types/language.rs

···
+#[allow(unused)]
 use langtag::InvalidLangTag;
 use serde::{Deserialize, Deserializer, Serialize, de::Error};
 use smol_str::{SmolStr, ToSmolStr};

crates/jacquard-common/src/types/value.rs

···
 use bytes::Bytes;
 use ipld_core::ipld::Ipld;
 use smol_str::{SmolStr, ToSmolStr};
-use std::collections::BTreeMap;
+use std::{collections::BTreeMap, convert::Infallible};
 
 /// Conversion utilities for Data types
 pub mod convert;
···
     T: serde::Deserialize<'de> + IntoStatic,
 {
     T::deserialize(json).map(IntoStatic::into_static)
+}
+
+/// Deserialize a typed value from cbor bytes
+///
+/// Returns an owned version, will allocate
+pub fn from_cbor<'de, T>(
+    cbor: &'de [u8],
+) -> Result<<T as IntoStatic>::Output, serde_ipld_dagcbor::DecodeError<Infallible>>
+where
+    T: serde::Deserialize<'de> + IntoStatic,
+{
+    serde_ipld_dagcbor::from_slice::<T>(cbor).map(|d| d.into_static())
+}
+
+/// Deserialize a typed value from postcard bytes
+///
+/// Returns an owned version, will allocate
+pub fn from_postcard<'de, T>(bytes: &'de [u8]) -> Result<<T as IntoStatic>::Output, postcard::Error>
+where
+    T: serde::Deserialize<'de> + IntoStatic,
+{
+    postcard::from_bytes::<T>(bytes).map(|d| d.into_static())
 }
 
 /// Deserialize a typed value from a `RawData` value

crates/jacquard-identity/Cargo.toml

···
 [features]
 dns = ["dep:hickory-resolver"]
 tracing = ["dep:tracing"]
-streaming = ["jacquard-common/streaming", "dep:n0-future"]
+streaming = ["jacquard-common/streaming"]
 cache = ["dep:mini-moka"]
 
 [dependencies]
···
 serde_html_form.workspace = true
 urlencoding.workspace = true
 tracing = { workspace = true, optional = true }
-n0-future = { workspace = true, optional = true }
+n0-future.workspace = true
 mini-moka = { version = "0.10", path = "../mini-moka-vendored",  optional = true }
 # mini-moka = { version = "0.10",   optional = true }
 

crates/jacquard-identity/src/lib.rs

···
         self
     }
 
+    /// Set the HTTP request timeout. Pass `None` to disable timeout.
+    pub fn with_request_timeout(mut self, timeout: Option<n0_future::time::Duration>) -> Self {
+        self.opts.request_timeout = timeout;
+        self
+    }
+
     #[cfg(feature = "cache")]
     /// Enable caching with default configuration
     pub fn with_cache(mut self) -> Self {
···
 }
 
 impl HttpClient for JacquardResolver {
+    type Error = IdentityError;
+
     async fn send_http(
         &self,
         request: http::Request<Vec<u8>>,
     ) -> core::result::Result<http::Response<Vec<u8>>, Self::Error> {
-        self.http.send_http(request).await
+        match self.opts.request_timeout {
+            Some(duration) => n0_future::time::timeout(duration, self.http.send_http(request))
+                .await
+                .map_err(|_| IdentityError::timeout())?
+                .map_err(IdentityError::transport),
+            None => self
+                .http
+                .send_http(request)
+                .await
+                .map_err(IdentityError::transport),
+        }
     }
-
-    type Error = reqwest::Error;
 }
 
 #[cfg(feature = "streaming")]
 impl jacquard_common::http_client::HttpClientExt for JacquardResolver {
     /// Send HTTP request and return streaming response
-    fn send_http_streaming(
+    async fn send_http_streaming(
         &self,
         request: http::Request<Vec<u8>>,
-    ) -> impl Future<Output = Result<http::Response<ByteStream>, Self::Error>> {
-        self.http.send_http_streaming(request)
+    ) -> Result<http::Response<ByteStream>, Self::Error> {
+        match self.opts.request_timeout {
+            Some(duration) => {
+                n0_future::time::timeout(duration, self.http.send_http_streaming(request))
+                    .await
+                    .map_err(|_| IdentityError::timeout())?
+                    .map_err(IdentityError::transport)
+            }
+            None => self
+                .http
+                .send_http_streaming(request)
+                .await
+                .map_err(IdentityError::transport),
+        }
     }
 
     /// Send HTTP request with streaming body and receive streaming response
     #[cfg(not(target_arch = "wasm32"))]
-    fn send_http_bidirectional<S>(
+    async fn send_http_bidirectional<S>(
         &self,
         parts: http::request::Parts,
         body: S,
-    ) -> impl Future<Output = Result<http::Response<ByteStream>, Self::Error>>
+    ) -> Result<http::Response<ByteStream>, Self::Error>
     where
         S: n0_future::Stream<Item = Result<bytes::Bytes, jacquard_common::StreamError>>
             + Send
             + 'static,
     {
-        self.http.send_http_bidirectional(parts, body)
+        match self.opts.request_timeout {
+            Some(duration) => {
+                n0_future::time::timeout(duration, self.http.send_http_bidirectional(parts, body))
+                    .await
+                    .map_err(|_| IdentityError::timeout())?
+                    .map_err(IdentityError::transport)
+            }
+            None => self
+                .http
+                .send_http_bidirectional(parts, body)
+                .await
+                .map_err(IdentityError::transport),
+        }
     }
 
     /// Send HTTP request with streaming body and receive streaming response (WASM)
     #[cfg(target_arch = "wasm32")]
-    fn send_http_bidirectional<S>(
+    async fn send_http_bidirectional<S>(
         &self,
         parts: http::request::Parts,
         body: S,
-    ) -> impl Future<Output = Result<http::Response<ByteStream>, Self::Error>>
+    ) -> Result<http::Response<ByteStream>, Self::Error>
     where
         S: n0_future::Stream<Item = Result<bytes::Bytes, jacquard_common::StreamError>> + 'static,
     {
-        self.http.send_http_bidirectional(parts, body)
+        match self.opts.request_timeout {
+            Some(duration) => {
+                n0_future::time::timeout(duration, self.http.send_http_bidirectional(parts, body))
+                    .await
+                    .map_err(|_| IdentityError::timeout())?
+                    .map_err(IdentityError::transport)
+            }
+            None => self
+                .http
+                .send_http_bidirectional(parts, body)
+                .await
+                .map_err(IdentityError::transport),
+        }
     }
 }
 

crates/jacquard-identity/src/resolver.rs

···
 use jacquard_common::types::uri::Uri;
 use jacquard_common::types::value::{AtDataError, Data};
 use jacquard_common::{CowStr, IntoStatic, smol_str};
+use n0_future::time::Duration;
 use smol_str::SmolStr;
 use std::collections::BTreeMap;
 use std::marker::Sync;
···
     pub validate_doc_id: bool,
     /// Allow public unauthenticated fallback for resolveHandle via public.api.bsky.app
     pub public_fallback_for_handle: bool,
+    /// HTTP request timeout. Default: 10 seconds. Set to None to disable.
+    pub request_timeout: Option<Duration>,
 }
 
 impl Default for ResolverOptions {
···
             .did_order(did_order)
             .validate_doc_id(true)
             .public_fallback_for_handle(true)
+            .request_timeout(Duration::from_secs(20))
             .build()
     }
 }
···
     )]
     Transport,
 
+    /// Request timeout
+    #[error("request timed out")]
+    #[diagnostic(
+        code(jacquard::identity::timeout),
+        help("the server took too long to respond")
+    )]
+    Timeout,
+
     /// HTTP status error
     #[error("HTTP {0}")]
     #[diagnostic(
···
     /// Create a transport error
     pub fn transport(source: impl std::error::Error + Send + Sync + 'static) -> Self {
         Self::new(IdentityErrorKind::Transport, Some(Box::new(source)))
+    }
+
+    /// Create a timeout error
+    pub fn timeout() -> Self {
+        Self::new(IdentityErrorKind::Timeout, None)
     }
 
     /// Create an HTTP status error

crates/jacquard-lexicon/src/codegen/structs.rs

···
         field_name: &str,
         field_type: &LexObjectProperty<'static>,
         is_required: bool,
-        is_builder: bool,
+        _is_builder: bool,
     ) -> Result<TokenStream> {
         if field_name.is_empty() {
             eprintln!(
···
         // Add serde(borrow) to all fields with lifetimes
         if needs_lifetime {
             attrs.push(quote! { #[serde(borrow)] });
+        }
+
+        if matches!(field_type, LexObjectProperty::Bytes(_)) {
+            if is_required {
+                attrs.push(quote! { #[serde(with = "jacquard_common::serde_bytes_helper")] });
+            } else {
+                attrs.push(quote! {#[serde(with = "jacquard_common::opt_serde_bytes_helper")] });
+            }
         }
 
         Ok(quote! {

crates/jacquard-lexicon/src/error.rs

···
     )]
     Unsupported {
         /// Description of the unsupported feature
+        #[allow(unused)]
         feature: String,
         /// NSID of lexicon containing the feature
+        #[allow(unused)]
         lexicon_nsid: String,
         /// Optional suggestion for workaround
+        #[allow(unused)]
         suggestion: Option<String>,
     },
 
···
     #[error("Name collision: {name}")]
     #[diagnostic(
         code(lexicon::name_collision),
-        help("Multiple types would generate the same Rust identifier. Module paths will disambiguate.")
+        help(
+            "Multiple types would generate the same Rust identifier. Module paths will disambiguate."
+        )
     )]
     NameCollision {
         /// The colliding name

crates/jacquard-oauth/src/atproto.rs

···
         #[derive(serde::Serialize)]
         struct Parameters<'a> {
             #[serde(skip_serializing_if = "Option::is_none")]
-            redirect_uri: Option<Vec<CowStr<'a>>>,
+            redirect_uri: Option<Vec<Url>>,
             #[serde(skip_serializing_if = "Option::is_none")]
             scope: Option<CowStr<'a>>,
         }
         let query = serde_html_form::to_string(Parameters {
-            redirect_uri: redirect_uris.as_ref().map(|u| {
-                u.iter()
-                    .map(|u| u.as_str().trim_end_matches("/").to_cowstr().into_static())
-                    .collect()
-            }),
+            redirect_uri: redirect_uris.clone(),
             scope: scopes
                 .as_ref()
                 .map(|s| Scope::serialize_multiple(s.as_slice())),
···
     keyset: &Option<Keyset>,
 ) -> Result<OAuthClientMetadata<'m>> {
     // For non-loopback clients, require a keyset/JWKs.
-    // let is_loopback =
-    //     metadata.client_id.scheme() == "http" && metadata.client_id.host_str() == Some("localhost");
+    let is_loopback =
+        metadata.client_id.scheme() == "http" && metadata.client_id.host_str() == Some("localhost");
+    let application_type = if is_loopback {
+        Some(CowStr::new_static("native"))
+    } else {
+        Some(CowStr::new_static("web"))
+    };
     // if !is_loopback && keyset.is_none() {
     //     return Err(Error::EmptyJwks);
     // }
···
         client_id: client_id.to_cowstr().into_static(),
         client_uri,
         redirect_uris,
+        application_type,
         token_endpoint_auth_method: Some(auth_method.into()),
         grant_types: if keyset.is_some() {
             Some(metadata.grant_types.into_iter().map(|v| v.into()).collect())
         } else {
             None
         },
+        response_types: vec!["code".to_cowstr()],
         scope: Some(Scope::serialize_multiple(metadata.scopes.as_slice())),
         dpop_bound_access_tokens: Some(true),
         jwks_uri,
···
                     CowStr::new_static("http://127.0.0.1"),
                     CowStr::new_static("http://[::1]"),
                 ],
+                application_type: Some(CowStr::new_static("native")),
                 scope: Some(CowStr::new_static("atproto")),
                 grant_types: None,
+                response_types: vec!["code".to_cowstr()],
                 token_endpoint_auth_method: Some(AuthMethod::None.into()),
                 dpop_bound_access_tokens: Some(true),
                 jwks_uri: None,
···
                 scope: Some(CowStr::new_static(
                     "account:email atproto transition:generic"
                 )),
+                application_type: Some(CowStr::new_static("native")),
                 grant_types: None,
+                response_types: vec!["code".to_cowstr()],
                 token_endpoint_auth_method: Some(AuthMethod::None.into()),
                 dpop_bound_access_tokens: Some(true),
                 jwks_uri: None,
···
                     client_id: CowStr::new_static(
                         "http://localhost/?redirect_uri=http%3A%2F%2F127.0.0.1"
                     ),
+                    application_type: Some(CowStr::new_static("native")),
                     client_uri: None,
                     redirect_uris: vec![CowStr::new_static("http://127.0.0.1")],
                     scope: Some(CowStr::new_static("atproto")),
                     grant_types: None,
+                    response_types: vec!["code".to_cowstr()],
                     token_endpoint_auth_method: Some(AuthMethod::None.into()),
                     dpop_bound_access_tokens: Some(true),
                     jwks_uri: None,
···
                     redirect_uris: vec![CowStr::new_static("http://127.0.0.1:8000")],
                     scope: Some(CowStr::new_static("atproto")),
                     grant_types: None,
+                    application_type: Some(CowStr::new_static("native")),
+                    response_types: vec!["code".to_cowstr()],
                     token_endpoint_auth_method: Some(AuthMethod::None.into()),
                     dpop_bound_access_tokens: Some(true),
                     jwks_uri: None,
···
                     redirect_uris: vec![CowStr::new_static("http://127.0.0.1")],
                     scope: Some(CowStr::new_static("atproto")),
                     grant_types: None,
+                    application_type: Some(CowStr::new_static("native")),
+                    response_types: vec!["code".to_cowstr()],
                     token_endpoint_auth_method: Some(AuthMethod::None.into()),
                     dpop_bound_access_tokens: Some(true),
                     jwks_uri: None,
···
                     client_id: CowStr::new_static("https://example.com/client_metadata.json"),
                     client_uri: Some(CowStr::new_static("https://example.com")),
                     redirect_uris: vec![CowStr::new_static("https://example.com/callback")],
+                    application_type: Some(CowStr::new_static("web")),
                     scope: Some(CowStr::new_static("atproto")),
                     grant_types: Some(vec![CowStr::new_static("authorization_code")]),
                     token_endpoint_auth_method: Some(AuthMethod::PrivateKeyJwt.into()),
                     dpop_bound_access_tokens: Some(true),
+                    response_types: vec!["code".to_cowstr()],
                     jwks_uri: None,
                     jwks: Some(keyset.public_jwks()),
                     token_endpoint_auth_signing_alg: Some(CowStr::new_static("ES256")),

crates/jacquard-oauth/src/loopback.rs

···
 #![cfg(feature = "loopback")]
 
 use crate::{
+    atproto::AtprotoClientMetadata,
     authstore::ClientAuthStore,
     client::OAuthClient,
     dpop::DpopExt,
···
         ))
         .unwrap();
 
-        let mut client_data = self.registry.client_data.clone();
-        // Ensure the redirect URI is set correctly for the loopback server
-        client_data.config.redirect_uris = vec![redirect];
+        let scopes = if opts.scopes.is_empty() {
+            Some(self.registry.client_data.config.scopes.clone())
+        } else {
+            Some(opts.scopes.clone().into_static())
+        };
+
+        let client_data = crate::session::ClientData {
+            keyset: self.registry.client_data.keyset.clone(),
+            config: AtprotoClientMetadata::new_localhost(Some(vec![redirect.clone()]), scopes),
+        };
         // Build client using store and resolver
         let flow_client = OAuthClient::new_with_shared(
             self.registry.store.clone(),

crates/jacquard-oauth/src/request.rs

···
     pub fn atproto(source: impl std::error::Error + Send + Sync + 'static) -> Self {
         Self::new(RequestErrorKind::Atproto, Some(Box::new(source)))
     }
+
+    /// Returns true if this error indicates permanent auth failure
+    /// (token revoked, refresh_token expired, etc.)
+    ///
+    /// When this returns true, the session should be cleared from storage
+    /// rather than retried.
+    pub fn is_permanent(&self) -> bool {
+        match &self.kind {
+            RequestErrorKind::NoRefreshToken => true,
+            RequestErrorKind::HttpStatusWithBody { body, .. } => {
+                body.get("error")
+                    .and_then(|e| e.as_str())
+                    .is_some_and(|e| matches!(e, "invalid_grant" | "access_denied"))
+            }
+            _ => false,
+        }
+    }
 }
 
 // From impls for common error types
···
                 redirect_uris: vec![CowStr::new_static("https://client/cb")],
                 scope: Some(CowStr::from("atproto")),
                 grant_types: None,
+                response_types: vec![CowStr::new_static("code")],
+                application_type: Some(CowStr::new_static("web")),
                 token_endpoint_auth_method: Some(CowStr::from("none")),
                 dpop_bound_access_tokens: None,
                 jwks_uri: None,

crates/jacquard-oauth/src/resolver.rs

···
 use http::{Request, StatusCode};
 use jacquard_common::CowStr;
 use jacquard_common::IntoStatic;
+#[allow(unused_imports)]
 use jacquard_common::cowstr::ToCowStr;
 use jacquard_common::types::did_doc::DidDocument;
 use jacquard_common::types::ident::AtIdentifier;

crates/jacquard-oauth/src/session.rs

···
 use std::sync::Arc;
 
+use chrono::TimeDelta;
+
 use crate::{
     atproto::{AtprotoClientMetadata, atproto_client_metadata},
     authstore::ClientAuthStore,
···
     #[error("session does not exist")]
     #[diagnostic(code(jacquard_oauth::session::not_found))]
     SessionNotFound,
+    #[error("session refresh failed permanently")]
+    #[diagnostic(
+        code(jacquard_oauth::session::refresh_failed),
+        help("the session has been cleared - user must re-authenticate")
+    )]
+    RefreshFailed(#[source] crate::request::RequestError),
+}
+
+impl Error {
+    /// Returns true if this error indicates a permanent auth failure
+    /// where the user needs to re-authenticate.
+    pub fn is_permanent(&self) -> bool {
+        match self {
+            Error::RefreshFailed(_) => true,
+            Error::SessionNotFound => true,
+            Error::ServerAgent(e) => e.is_permanent(),
+            Error::Store(_) => false,
+        }
+    }
 }
 
 pub struct SessionRegistry<T, S>
···
             .clone();
         let _guard = lock.lock().await;
 
-        let mut session = self
+        let session = self
             .store
             .get_session(did, session_id)
             .await?
             .ok_or(Error::SessionNotFound)?;
+
+        // Check if token is still valid with a 60-second buffer before expiry.
+        // This triggers proactive refresh before the token actually expires,
+        // avoiding the race condition where a token expires mid-request.
+        const EXPIRY_BUFFER_SECS: i64 = 60;
         if let Some(expires_at) = &session.token_set.expires_at {
-            if expires_at > &Datetime::now() {
+            let now_with_buffer = Datetime::now()
+                .as_ref()
+                .checked_add_signed(TimeDelta::seconds(EXPIRY_BUFFER_SECS))
+                .map(Datetime::new)
+                .unwrap_or_else(Datetime::now);
+            if expires_at > &now_with_buffer {
                 return Ok(session);
             }
         }
         let metadata =
             OAuthMetadata::new(self.client.as_ref(), &self.client_data, &session).await?;
-        session = refresh(self.client.as_ref(), session, &metadata).await?;
-        self.store.upsert_session(session.clone()).await?;
-
-        Ok(session)
+        match refresh(self.client.as_ref(), session, &metadata).await {
+            Ok(refreshed) => {
+                self.store.upsert_session(refreshed.clone()).await?;
+                Ok(refreshed)
+            }
+            Err(e) if e.is_permanent() => {
+                // Session is permanently dead - clean it up
+                let _ = self.store.delete_session(did, session_id).await;
+                Err(Error::RefreshFailed(e))
+            }
+            Err(e) => Err(Error::ServerAgent(e)),
+        }
     }
     pub async fn get(
         &self,

crates/jacquard-oauth/src/types.rs

···
     fn default() -> Self {
         Self {
             redirect_uri: None,
-            scopes: vec![Scope::Atproto],
+            scopes: vec![],
             prompt: None,
             state: None,
         }

crates/jacquard-oauth/src/types/client_metadata.rs

···
     #[serde(borrow)]
     pub scope: Option<CowStr<'c>>,
     #[serde(skip_serializing_if = "Option::is_none")]
+    pub application_type: Option<CowStr<'c>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
     pub grant_types: Option<Vec<CowStr<'c>>>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub token_endpoint_auth_method: Option<CowStr<'c>>,
+    pub response_types: Vec<CowStr<'c>>,
     // https://datatracker.ietf.org/doc/html/rfc9449#section-5.2
     #[serde(skip_serializing_if = "Option::is_none")]
     pub dpop_bound_access_tokens: Option<bool>,
···
             client_uri: self.client_uri.into_static(),
             redirect_uris: self.redirect_uris.into_static(),
             scope: self.scope.map(|scope| scope.into_static()),
+            application_type: self.application_type.map(|app_type| app_type.into_static()),
             grant_types: self.grant_types.map(|types| types.into_static()),
+            response_types: self.response_types.into_static(),
             token_endpoint_auth_method: self
                 .token_endpoint_auth_method
                 .map(|method| method.into_static()),

crates/jacquard/Cargo.toml

···
 license.workspace = true
 
 [features]
-default = ["api_full", "dns", "loopback", "derive"]
+default = ["api_full", "dns", "loopback", "derive", "cache"]
 derive = ["dep:jacquard-derive"]
 # Minimal API bindings
 api = ["jacquard-api/minimal"]
···
     "dep:n0-future",
     "jacquard-api/streaming",
 ]
+cache = ["jacquard-identity/cache"]
 websocket = ["jacquard-common/websocket"]
 zstd = ["jacquard-common/zstd"]