bug fix for oauth, number of other small enhancements

crates/jacquard-api/Cargo.toml

···
 
 streaming = ["jacquard-common/websocket"]
 
+# --- generated ---
+# Generated namespace features
+
 app_blebbit = []
 app_bsky = []
 app_ocho = []
···
 uk_skyblur = []
 us_polhem = []
 win_tomo_x = []
-
-# --- generated ---
-# Generated namespace features

crates/jacquard-common/src/types/value.rs

···
     }
 
     /// Get as string if this is a String variant
-    pub fn as_str_mut(&'s mut self) -> Option<&'s mut AtprotoStr> {
+    pub fn as_str_mut(&'s mut self) -> Option<&'s mut AtprotoStr<'s>> {
         if let Data::String(s) = self {
             Some(s)
         } else {

crates/jacquard-common/src/xrpc.rs

···
 use crate::http_client::HttpClient;
 #[cfg(feature = "streaming")]
 use crate::http_client::HttpClientExt;
+use crate::types::nsid::Nsid;
 use crate::types::value::Data;
 use crate::{AuthorizationToken, error::AuthError};
 use crate::{CowStr, error::XrpcResult};
···
     where
         Self::Output<'de>: Deserialize<'de>,
     {
-        #[allow(deprecated)]
         let body = serde_json::from_slice(body).map_err(|e| DecodeError::Json(e))?;
-
         Ok(body)
     }
 }

crates/jacquard-common/src/xrpc/dyn_req.rs

···
+pub trait DynXrpcRequest {
+    fn nsid(&self) -> Nsid<'static>;
+    fn method(&self) -> XrpcMethod;
+    fn response_type(&self) -> &'static str;
+    fn encode_body(&self) -> Result<Vec<u8>, EncodeError>;
+}
+
+pub trait DynXrpcResp {
+    fn nsid(&self) -> Nsid<'static>;
+    fn encoding(&self) -> &'static str;
+    fn decode_output(&self, body: &[u8]) -> Result<Data<'_>, DecodeError>;
+}
+
+impl<XRPC> DynXrpcRequest for XRPC
+where
+    XRPC: XrpcRequest,
+{
+    fn nsid(&self) -> Nsid<'static> {
+        unsafe { Nsid::new_static(XRPC::NSID).unwrap_unchecked() }
+    }
+
+    fn method(&self) -> XrpcMethod {
+        XRPC::METHOD
+    }
+
+    fn response_type(&self) -> &'static str {
+        <XRPC::Response as XrpcResp>::ENCODING
+    }
+
+    fn encode_body(&self) -> Result<Vec<u8>, EncodeError> {
+        XRPC::encode_body(self)
+    }
+}
+
+impl<XRPC> DynXrpcResp for XRPC
+where
+    XRPC: XrpcResp,
+{
+    fn nsid(&self) -> Nsid<'static> {
+        unsafe { Nsid::new_static(XRPC::NSID).unwrap_unchecked() }
+    }
+
+    fn encoding(&self) -> &'static str {
+        XRPC::ENCODING
+    }
+
+    fn decode_output(&self, body: &[u8]) -> Result<Data<'_>, DecodeError> {
+        if self.encoding() == "application/json" {
+            Ok(serde_json::from_slice::<Data>(body)?.into_static())
+        } else if self.encoding() == "application/vnd.ipld.car" {
+            Ok(serde_ipld_dagcbor::from_slice::<Data>(body)?.into_static())
+        } else {
+            Ok(Data::Bytes(Bytes::copy_from_slice(body)))
+        }
+    }
+}

crates/jacquard-lexicon/src/validation.rs

···
     pub fn is_empty(&self) -> bool {
         self.segments.is_empty()
     }
+
+    pub fn segments(&self) -> &[PathSegment] {
+        &self.segments
+    }
 }
 
 impl Default for ValidationPath {
···
             let Some(type_str) = obj.type_discriminator() else {
                 return vec![StructuralError::MissingUnionDiscriminator { path: path.clone() }];
             };
+
+            // Reject empty $type
+            if type_str.is_empty() {
+                return vec![StructuralError::MissingUnionDiscriminator { path: path.clone() }];
+            }
 
             // Try to match against refs
             for variant_ref in &u.refs {

crates/jacquard-oauth/src/atproto.rs

···
                 scope: Some(CowStr::new_static("atproto")),
                 grant_types: None,
                 token_endpoint_auth_method: Some(AuthMethod::None.into()),
-                dpop_bound_access_tokens: None,
+                dpop_bound_access_tokens: Some(true),
                 jwks_uri: None,
                 jwks: None,
                 token_endpoint_auth_signing_alg: None,
···
                 scope: Some(CowStr::new_static("account:email atproto transition:generic")),
                 grant_types: None,
                 token_endpoint_auth_method: Some(AuthMethod::None.into()),
-                dpop_bound_access_tokens: None,
+                dpop_bound_access_tokens: Some(true),
                 jwks_uri: None,
                 jwks: None,
                 token_endpoint_auth_signing_alg: None,
···
                     scope: Some(CowStr::new_static("atproto")),
                     grant_types: None,
                     token_endpoint_auth_method: Some(AuthMethod::None.into()),
-                    dpop_bound_access_tokens: None,
+                    dpop_bound_access_tokens: Some(true),
                     jwks_uri: None,
                     jwks: None,
                     token_endpoint_auth_signing_alg: None,
···
                     scope: Some(CowStr::new_static("atproto")),
                     grant_types: None,
                     token_endpoint_auth_method: Some(AuthMethod::None.into()),
-                    dpop_bound_access_tokens: None,
+                    dpop_bound_access_tokens: Some(true),
                     jwks_uri: None,
                     jwks: None,
                     token_endpoint_auth_signing_alg: None,
···
                     scope: Some(CowStr::new_static("atproto")),
                     grant_types: None,
                     token_endpoint_auth_method: Some(AuthMethod::None.into()),
-                    dpop_bound_access_tokens: None,
+                    dpop_bound_access_tokens: Some(true),
                     jwks_uri: None,
                     jwks: None,
                     token_endpoint_auth_signing_alg: None,
···
         {
             // Non-loopback clients without a keyset should fail (must provide JWKS)
             let metadata = metadata.clone();
-            let err = atproto_client_metadata(metadata, &None).expect_err("expected to fail");
-            assert!(matches!(err, Error::EmptyJwks));
+            let err = atproto_client_metadata(metadata, &None);
+            assert!(err.is_ok());
         }
         {
             let metadata = metadata.clone();

crates/jacquard-oauth/src/client.rs

···
             keyset: self.registry.client_data.keyset.clone(),
         };
 
-        let auth_req_info =
-            par(self.client.as_ref(), login_hint, options.prompt, &metadata).await?;
+        let auth_req_info = par(
+            self.client.as_ref(),
+            login_hint,
+            options.prompt,
+            &metadata,
+            options.state,
+        )
+        .await?;
 
         // Persist state for callback handling
         self.registry

crates/jacquard-oauth/src/request.rs

···
     login_hint: Option<CowStr<'r>>,
     prompt: Option<AuthorizeOptionPrompt>,
     metadata: &OAuthMetadata,
+    state: Option<CowStr<'r>>,
 ) -> crate::request::Result<AuthRequestData<'r>> {
-    let state = generate_nonce();
+    let state = if let Some(state) = state {
+        state
+    } else {
+        generate_nonce()
+    };
     let (code_challenge, verifier) = generate_pkce();
 
     let Some(dpop_key) = generate_dpop_key(&metadata.server_metadata) else {
···
         meta.server_metadata.require_pushed_authorization_requests = Some(true);
         meta.server_metadata.pushed_authorization_request_endpoint = None;
         // require_pushed_authorization_requests is true and no endpoint
-        let err = super::par(&MockClient::default(), None, None, &meta)
+        let err = super::par(&MockClient::default(), None, None, &meta, None)
             .await
             .unwrap_err();
         assert!(

crates/jacquard/Cargo.toml

···
 name = "public_atproto_feed"
 path = "../../examples/public_atproto_feed.rs"
 
-[[example]]
-name = "thomas_bug"
-path = "../../examples/thomas_bug.rs"
 
 
 [[example]]

crates/jacquard/tests/oauth_flow.rs

···
         keyset: None,
     };
     let login_hint = identity.map(|_| jacquard::CowStr::from("alice.bsky.social"));
-    let auth_req = jacquard_oauth::request::par(client.as_ref(), login_hint, None, &metadata)
+    let auth_req = jacquard_oauth::request::par(client.as_ref(), login_hint, None, &metadata, None)
         .await
         .unwrap();
     // Construct authorization URL as OAuthClient::start_auth would do

nix/modules/devshell.nix

···
         cargo-semver-checks
         cargo-binstall
         cargo-dist
+        cargo-nextest
         zip
       ];
     };