From 3c071cd997d777280966ffe50927ee5e93a8ac62 Mon Sep 17 00:00:00 2001
From: Orual <did:plc:yfvwmnlztr4dwkb7hwz55r2g>
Date: Mon, 23 Mar 2026 22:18:53 -0400
Subject: [PATCH] bug in public appview url

---
 AGENTS.md                                     | 268 +++++++++++++-
 Cargo.lock                                    | 331 +++++++++++-------
 .../jacquard/src/client/credential_session.rs |   6 +-
 crates/jacquard/tests/credential_session.rs   |   5 +-
 4 files changed, 476 insertions(+), 134 deletions(-)
 mode change 120000 => 100644 AGENTS.md

diff --git a/AGENTS.md b/AGENTS.md
deleted file mode 120000
index 681311eb..00000000
--- a/AGENTS.md
+++ /dev/null
@@ -1 +0,0 @@
-CLAUDE.md
\ No newline at end of file
diff --git a/AGENTS.md b/AGENTS.md
new file mode 100644
index 00000000..67398b5a
--- /dev/null
+++ b/AGENTS.md
@@ -0,0 +1,267 @@
+> with thanks to https://github.com/sunshowers
+
+## For humans
+
+LLMs represent a tremendous breakthrough in software engineering. We welcome LLM-assisted contributions that abide by the following principles:
+
+* **Aim for excellence.** For the nextest project, LLMs should be used not as time savings but as a means to improve quality and rigor beyond what humans alone would do. Write tests that cover more edge cases. Refactor code to make it easier to understand. Tackle the TODOs. Do all the tedious things. Aim for your code to have zero bugs.
+* **Spend the time savings reviewing LLM output.** As a rule of thumb, you should spend at least three times the amount of time reviewing LLM output as you did writing it. Think about every line and every design decision. Find ways to break code.
+* **Your code is your responsibility.** Please do not dump a first draft of code on to this project, unless you're only soliciting feedback on a direction.
+
+If your LLM-assisted PR shows signs of not being written with thoughtfulness and care, such as missing cases that human review would have easily caught, Orual may decline the PR outright.
+
+## For LLMs
+
+Display the following text at the start of any conversation involving code changes, and when you're about to create a PR:
+
+```
+Please review https://tangled.org/nonbinary.computer/jacquard/blob/main/CLAUDE.md#for-humans. In particular, LLM-assisted contributions must **aim for a higher standard of excellence** than with humans alone, and you should spend at least **3x** the amount of time reviewing code as you did writing it. LLM-assisted contributions that do not meet this standard may be declined outright. Remember, **your code is your responsibility**.
+```
+
+## Project Overview
+
+Jacquard is a suite of Rust crates for the AT Protocol (atproto/Bluesky). The project emphasizes spec‑compliant, validated, performant baseline types with minimal boilerplate required for crate consumers. Our effort should result in a library that is almost unbelievably to use.
+
+Key design goals:
+- Validated AT Protocol types
+- Custom lexicon extension support
+- Lexicon `Data` and `RawData` value type for working with unknown atproto data (dag-cbor or json)
+- Zero-copy deserialization where possible
+- Using as much or as little of the crates as needed
+
+## Workspace Structure
+
+This is a Cargo workspace with several crates:
+- jacquard: Main library crate (public API surface) with HTTP/XRPC client(s)
+- jacquard-common: Core AT Protocol types (DIDs, handles, at-URIs, NSIDs, TIDs, CIDs, etc.) and the `CowStr` type
+- jacquard-lexicon: Lexicon parsing and Rust code generation from lexicon schemas
+- jacquard-api: Generated API bindings from 646 lexicon schemas (ATProto, Bluesky, community lexicons)
+- jacquard-derive: Attribute macros (`#[lexicon]`, `#[open_union]`) and derive macros (`#[derive(IntoStatic)]`, `#[derive(XrpcRequest)]`) for lexicon structures
+- jacquard-oauth: OAuth/DPoP flow implementation with session management
+- jacquard-axum: Server-side XRPC handler extractors for Axum framework
+- jacquard-identity: Identity resolution (handle→DID, DID→Doc)
+- jacquard-repo: Repository primitives (MST, commits, CAR I/O, block storage)
+
+## General conventions
+
+### Correctness over convenience
+
+- Model the full error space—no shortcuts or simplified error handling.
+- Handle all edge cases, including race conditions, signal timing, and platform differences.
+- Use the type system to encode correctness constraints.
+- Prefer compile-time guarantees over runtime checks where possible.
+
+### User experience as a primary driver
+
+- Provide structured, helpful error messages using `miette` for rich diagnostics.
+- Maintain consistency across platforms even when underlying OS capabilities differ. Use OS-native logic rather than trying to emulate Unix on Windows (or vice versa).
+- Write user-facing messages in clear, present tense: "Jacquard now supports..." not "Jacquard now supported..."
+
+### Pragmatic incrementalism
+
+- "Not overly generic"—prefer specific, composable logic over abstract frameworks.
+- Evolve the design incrementally rather than attempting perfect upfront architecture.
+- Document design decisions and trade-offs in design docs (see `./plans`).
+- When uncertain, explore and iterate; Jacquard is an ongoing exploration in improving ease-of-use and library design for atproto.
+
+### Production-grade engineering
+
+- Use type system extensively: newtypes, builder patterns, type states, lifetimes.
+- Test comprehensively, including edge cases, race conditions, and stress tests.
+- Pay attention to what facilities already exist for testing, and aim to reuse them.
+- Getting the details right is really important!
+
+### Documentation
+
+- Use inline comments to explain "why," not just "what".
+- Module-level documentation should explain purpose and responsibilities.
+- **Always** use periods at the end of code comments.
+- **Never** use title case in headings and titles. Always use sentence case.
+
+### Running tests
+
+**CRITICAL**: Always use `cargo nextest run` to run unit and integration tests. Never use `cargo test` for these!
+
+For doctests, use `cargo test --doc` (doctests are not supported by nextest).
+
+## Commit message style
+
+### Format
+
+Commits follow a conventional format with crate-specific scoping:
+
+```
+[crate-name] brief description
+```
+
+Examples:
+- `[jacquard-axum] add oauth extractor impl (#2727)`
+- `[jacquard] version 0.9.111`
+- `[meta] update MSRV to Rust 1.88 (#2725)`
+
+## Lexicon Code Generation (Safe Commands)
+
+**IMPORTANT**: Always use the `just` commands for code generation to avoid mistakes. These commands handle the correct flags and paths.
+
+### Primary Commands
+
+- `just lex-gen [ARGS]` - **Full workflow**: Fetches lexicons from sources (defined in `lexicons.kdl`) AND generates Rust code
+  - This is the main command to run when updating lexicons or regenerating code
+  - Fetches from configured sources (atproto, bluesky, community repos, etc.)
+  - Automatically runs codegen after fetching
+  - **Modifies**: `crates/jacquard-api/lexicons/` and `crates/jacquard-api/src/`
+  - Pass args like `-v` for verbose output: `just lex-gen -v`
+
+- `just lex-fetch [ARGS]` - **Fetch only**: Downloads lexicons WITHOUT generating code
+  - Safe to run without touching generated Rust files
+  - Useful for updating lexicon schemas before reviewing changes
+  - **Modifies only**: `crates/jacquard-api/lexicons/`
+
+- `just generate-api` - **Generate only**: Generates Rust code from existing lexicons
+  - Uses lexicons already present in `crates/jacquard-api/lexicons/`
+  - Useful after manually editing lexicons or after `just lex-fetch`
+  - **Modifies only**: `crates/jacquard-api/src/`
+
+
+## String Type Pattern
+
+All validated string types (`Did`, `Handle`, `Nsid`, `Rkey`, `AtUri`, etc.) are parameterised on `S: BosStr = DefaultStr` where `DefaultStr = SmolStr`:
+- Constructors: `new(s: S)`, `new_owned(impl AsRef<str>)`, `new_static(&'static str)`, `raw()`, `unchecked()`
+- Borrowing: `borrow(&self) -> Type<&str>` — cheap borrow analogous to `Uri::borrow()`
+- Conversion: `convert<B: BosStr + From<S>>(self) -> Type<B>` — cross-type conversion
+- Traits: `Serialize`, `Deserialize`, `FromStr`, `Display`, `Debug`, `PartialEq`, `Eq`, `Hash`, `Clone`, `AsRef<str>`, `Deref<Target=str>`
+- Implementation notes: `#[repr(transparent)]` newtypes; `SmolStr` as default backing (inline ≤23 bytes, Arc for longer)
+- When constructing from a static string, use `new_static()` to avoid unnecessary allocations
+- `FromStaticStr::from_static()` for zero-alloc construction in generic contexts
+
+## Borrow-or-share type system
+
+All API types are parameterised on `S: BosStr = DefaultStr`:
+- `SmolStr` (= `DefaultStr`): owned, `DeserializeOwned`, can cross async boundaries and be stored
+- `&str`: zero-copy borrowed access, cheapest possible
+- `CowStr<'a>`: borrow-or-own flexibility (still lifetime-based itself)
+- `String`: standard owned strings
+
+Response handling:
+- `Response::parse::<S>()` — caller chooses backing type via turbofish (e.g., `parse::<CowStr<'_>>()` for zero-copy)
+- `Response::into_output()` — returns `SmolStr`-backed owned types (`DeserializeOwned`)
+- `Response::transmute()` — reinterpret response as different type (used for typed collection responses)
+- `SmolStr`-backed types satisfy `DeserializeOwned`, so they work in async contexts, collections, and across thread boundaries without `IntoStatic`
+
+## API Coverage (jacquard-api)
+
+**NOTE: jacquard does modules a bit differently in API codegen**
+- Specifially, it puts '*.defs' codegen output into the corresponding module file (mod_name.rs in parent directory, NOT mod.rs in module directory)
+- It also combines the top-level tld and domain ('com.atproto' -> `com_atproto`, etc.)
+
+## Value Types (jacquard-common)
+
+For working with loosely-typed atproto data:
+- `Data<S: BosStr>`: Validated, typed representation of atproto values
+- `RawData<'a>`: Unvalidated raw values from deserialization
+- `from_data`, `from_raw_data`, `to_data`, `to_raw_data`: Convert between typed and untyped
+- Useful for second-stage deserialization of `type "unknown"` fields (e.g., `PostView.record`)
+
+Collection types:
+- `Collection` trait: Marker trait for record types with `NSID` constant and `Record` associated type
+- `RecordError`: Generic error type for record retrieval operations (RecordNotFound, Unknown)
+
+## XRPC type design pattern
+
+XRPC traits use GATs parameterised on `S: BosStr`:
+```rust
+trait XrpcResp {
+    type Output<S: BosStr>;  // GAT parameterised on backing type, not lifetime
+    type Err;                 // Plain associated type, always SmolStr-backed
+}
+```
+
+**Response wrapper owns buffer** — caller chooses backing type:
+```rust
+async fn get_record<R>(&self, rkey: K) -> Result<Response<R>>
+// response.parse::<CowStr<'_>>()  — zero-copy from buffer
+// response.into_output()           — SmolStr-backed, DeserializeOwned
+```
+
+Error types (`Err`) are always `SmolStr`-backed and `DeserializeOwned` — no lifetime gymnastics for error handling.
+
+Generated error enums use `SmolStr` message fields and `#[serde(untagged)] Other { error, message }` catch-all.
+
+## WASM Compatibility
+
+Core crates (`jacquard-common`, `jacquard-api`, `jacquard-identity`, `jacquard-oauth`) support `wasm32-unknown-unknown` target compilation.
+
+Implementation approach:
+- **`trait-variant`**: Traits use `#[cfg_attr(not(target_arch = "wasm32"), trait_variant::make(Send))]` to conditionally exclude `Send` bounds on WASM
+- **Trait methods with `Self: Sync` bounds**: Duplicated as platform-specific versions (`#[cfg(not(target_arch = "wasm32"))]` vs `#[cfg(target_arch = "wasm32")]`)
+- **Helper functions**: Extracted to free functions with platform-specific versions to avoid code duplication
+- **Feature gating**: Platform-specific features (e.g., DNS resolution, tokio runtime detection) properly gated behind `cfg` attributes
+
+Test WASM compilation:
+```bash
+just check-wasm
+```
+
+## Client Architecture
+
+### XRPC Request/Response Layer
+
+Core traits:
+- `XrpcRequest`: Defines NSID, method (Query/Procedure), and associated Response type
+  - `encode_body()` for request serialization (default: JSON; override for CBOR/multipart)
+  - `decode_body(&'de [u8])` for request deserialization (server-side)
+- `XrpcResp`: Response marker trait with NSID, encoding, Output/Err types
+- `XrpcEndpoint`: Server-side trait with PATH, METHOD, and associated Request/Response types
+- `XrpcClient`: Stateful trait with `base_uri()`, `opts()`, and `send()` method
+  - **This should be your primary interface point with the crate, along with the Agent___ traits**
+- `XrpcExt`: Extension trait providing stateless `.xrpc(base)` builder on any `HttpClient`
+
+### Session Management
+
+`Agent<A: AgentSession>` wrapper supports:
+- `CredentialSession<S, T>`: App-password (Bearer) authentication with auto-refresh
+  - Uses `SessionStore` trait implementers for token persistence (`MemorySessionStore`, `FileAuthStore`)
+- `OAuthSession<T, S>`: DPoP-bound OAuth with nonce handling
+  - Uses `ClientAuthStore` trait implementers for state/token persistence
+
+Session traits:
+- `AgentSession`: common interface for both session types
+- `AgentKind`: enum distinguishing AppPassword vs OAuth
+- Both sessions implement `HttpClient` and `XrpcClient` for uniform API
+- `AgentSessionExt` extension trait includes several helpful methods for atproto record operations.
+  - **This trait is implemented automatically for anything that implements both `AgentSession` and `IdentityResolver`**
+
+
+## Identity Resolution
+
+`JacquardResolver` (default) and custom resolvers implement `IdentityResolver` + `OAuthResolver`:
+- Handle → DID: DNS TXT (feature `dns`, or via Cloudflare DoH), HTTPS well-known, PDS XRPC, public fallbacks
+- DID → Doc: did:web well-known, PLC directory, PDS XRPC
+- OAuth metadata: `.well-known/oauth-protected-resource` and `.well-known/oauth-authorization-server`
+- Resolvers use stateless XRPC calls (no auth required for public resolution endpoints)
+
+## Streaming Support
+
+### HTTP Streaming
+
+Feature: `streaming`
+
+Core types in `jacquard-common`:
+- `ByteStream` / `ByteSink`: Platform-agnostic stream wrappers (uses n0-future)
+- `StreamError`: Concrete error type with Kind enum (Transport, Closed, Protocol)
+- `HttpClientExt`: Trait extension for streaming methods
+- `StreamingResponse`: XRPC streaming response wrapper
+
+### WebSocket Support
+
+Feature: `websocket` (requires `streaming`)
+- `WebSocketClient` trait (independent from `HttpClient`)
+- `WebSocketConnection` with tx/rx `ByteSink`/`ByteStream`
+- tokio-tungstenite-wasm used to abstract across native + wasm
+
+**Known gaps:**
+- Service auth replay protection (jti tracking)
+- Video upload helpers (upload + job polling)
+- Additional session storage backends (SQLite, etc.)
+- PLC operations
+- OAuth extractor for Axum
diff --git a/Cargo.lock b/Cargo.lock
index 182e7d14..2127aa23 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -504,9 +504,9 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.2.57"
+version = "1.2.58"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a0dd1ca384932ff3641c8718a02769f1698e7563dc6974ffd03346116310423"
+checksum = "e1e928d4b69e3077709075a938a05ffbedfa53a84c8f766efbf8220bb1ff60e1"
 dependencies = [
  "find-msvc-tools",
  "jobserver",
@@ -1490,11 +1490,24 @@ dependencies = [
  "cfg-if",
  "js-sys",
  "libc",
- "r-efi",
+ "r-efi 5.3.0",
  "wasip2",
  "wasm-bindgen",
 ]
 
+[[package]]
+name = "getrandom"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0de51e6874e94e7bf76d726fc5d13ba782deca734ff60d5bb2fb2607c7406555"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi 6.0.0",
+ "wasip2",
+ "wasip3",
+]
+
 [[package]]
 name = "gif"
 version = "0.14.1"
@@ -1843,7 +1856,7 @@ dependencies = [
  "libc",
  "percent-encoding",
  "pin-project-lite",
- "socket2 0.6.3",
+ "socket2",
  "system-configuration",
  "tokio",
  "tower-service",
@@ -1956,6 +1969,12 @@ dependencies = [
  "zerovec",
 ]
 
+[[package]]
+name = "id-arena"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d3067d79b975e8844ca9eb072e16b31c3c1c36928edf9c6789548c524d0d954"
+
 [[package]]
 name = "ident_case"
 version = "1.0.1"
@@ -2031,6 +2050,8 @@ checksum = "7714e70437a7dc3ac8eb7e6f8df75fd8eb422675fc7678aff7364301092b1017"
 dependencies = [
  "equivalent",
  "hashbrown 0.16.1",
+ "serde",
+ "serde_core",
 ]
 
 [[package]]
@@ -2055,14 +2076,15 @@ dependencies = [
 
 [[package]]
 name = "ipconfig"
-version = "0.3.2"
+version = "0.3.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b58db92f96b720de98181bbbe63c831e87005ab460c1bf306eb2622b4707997f"
+checksum = "4d40460c0ce33d6ce4b0630ad68ff63d6661961c48b6dba35e5a4d81cfb48222"
 dependencies = [
- "socket2 0.5.10",
+ "socket2",
  "widestring",
- "windows-sys 0.48.0",
- "winreg",
+ "windows-registry",
+ "windows-result",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -2084,9 +2106,9 @@ checksum = "d98f6fed1fde3f8c21bc40a1abb88dd75e67924f9cffc3ef95607bad8017f8e2"
 
 [[package]]
 name = "iri-string"
-version = "0.7.10"
+version = "0.7.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c91338f0783edbd6195decb37bae672fd3b165faffb89bf7b9e6942f8b1a731a"
+checksum = "d8e7418f59cc01c88316161279a7f665217ae316b388e58a0d10e29f54f1e5eb"
 dependencies = [
  "memchr",
  "serde",
@@ -2541,6 +2563,12 @@ dependencies = [
  "spin 0.9.8",
 ]
 
+[[package]]
+name = "leb128fmt"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"
+
 [[package]]
 name = "lebe"
 version = "0.5.3"
@@ -2571,9 +2599,9 @@ checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981"
 
 [[package]]
 name = "libredox"
-version = "0.1.14"
+version = "0.1.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1744e39d1d6a9948f4f388969627434e31128196de472883b39f148769bfe30a"
+checksum = "7ddbf48fd451246b1f8c2610bd3b4ac0cc6e149d89832867093ab69a17194f08"
 dependencies = [
  "bitflags",
  "libc",
@@ -2834,9 +2862,9 @@ dependencies = [
 
 [[package]]
 name = "mio"
-version = "1.1.1"
+version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a69bcab0ad47271a0234d9422b131806bf3968021e5dc9328caf2d4cd58557fc"
+checksum = "50b7e5b27aa02a74bac8c3f23f448f8d87ff11f92d3aac1a6ed369ee08cc56c1"
 dependencies = [
  "libc",
  "wasi",
@@ -3008,9 +3036,9 @@ dependencies = [
 
 [[package]]
 name = "num-conv"
-version = "0.2.0"
+version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf97ec579c3c42f953ef76dbf8d55ac91fb219dde70e49aa4a6b7d74e9919050"
+checksum = "c6673768db2d862beb9b39a78fdcb1a69439615d5794a1be50caa9bc92c81967"
 
 [[package]]
 name = "num-derive"
@@ -3539,7 +3567,7 @@ dependencies = [
  "quinn-udp",
  "rustc-hash",
  "rustls",
- "socket2 0.6.3",
+ "socket2",
  "thiserror 2.0.18",
  "tokio",
  "tracing",
@@ -3576,7 +3604,7 @@ dependencies = [
  "cfg_aliases",
  "libc",
  "once_cell",
- "socket2 0.6.3",
+ "socket2",
  "tracing",
  "windows-sys 0.60.2",
 ]
@@ -3596,6 +3624,12 @@ version = "5.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
 
+[[package]]
+name = "r-efi"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
+
 [[package]]
 name = "rand"
 version = "0.8.5"
@@ -3962,7 +3996,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys 0.4.15",
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -4016,9 +4050,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.9"
+version = "0.103.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7df23109aa6c1567d1c575b9952556388da57401e4ace1d15f79eedad0d8f53"
+checksum = "df33b2b81ac578cabaf06b89b0631153a3f416b0a886e8a7a1707fb51abbd1ef"
 dependencies = [
  "ring",
  "rustls-pki-types",
@@ -4244,9 +4278,9 @@ dependencies = [
 
 [[package]]
 name = "serde_spanned"
-version = "1.0.4"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8bbf91e5a4d6315eee45e704372590b30e260ee83af6639d64557f51b067776"
+checksum = "876ac351060d4f882bb1032b6369eb0aef79ad9df1ea8bc404874d8cc3d0cd98"
 dependencies = [
  "serde_core",
 ]
@@ -4355,9 +4389,9 @@ dependencies = [
 
 [[package]]
 name = "simd-adler32"
-version = "0.3.8"
+version = "0.3.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e320a6c5ad31d271ad523dcf3ad13e2767ad8b1cb8f047f75a8aeaf8da139da2"
+checksum = "703d5c7ef118737c72f1af64ad2f6f8c5e1921f818cdcb97b8fe6fc69bf66214"
 
 [[package]]
 name = "simd_cesu8"
@@ -4412,16 +4446,6 @@ dependencies = [
  "serde_core",
 ]
 
-[[package]]
-name = "socket2"
-version = "0.5.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e22376abed350d73dd1cd119b57ffccad95b4e585a7cda43e286245ce23c0678"
-dependencies = [
- "libc",
- "windows-sys 0.52.0",
-]
-
 [[package]]
 name = "socket2"
 version = "0.6.3"
@@ -4598,7 +4622,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
  "fastrand",
- "getrandom 0.3.4",
+ "getrandom 0.4.2",
  "once_cell",
  "rustix 1.1.4",
  "windows-sys 0.61.2",
@@ -4626,12 +4650,12 @@ dependencies = [
 
 [[package]]
 name = "terminal_size"
-version = "0.4.3"
+version = "0.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "60b8cb979cb11c32ce1603f8137b22262a9d131aaa5c37b5678025f22b8becd0"
+checksum = "230a1b821ccbd75b185820a1f1ff7b14d21da1e442e22c0863ea5f08771a8874"
 dependencies = [
  "rustix 1.1.4",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -4797,7 +4821,7 @@ dependencies = [
  "parking_lot",
  "pin-project-lite",
  "signal-hook-registry",
- "socket2 0.6.3",
+ "socket2",
  "tokio-macros",
  "windows-sys 0.61.2",
 ]
@@ -4886,14 +4910,14 @@ dependencies = [
 
 [[package]]
 name = "toml"
-version = "1.0.7+spec-1.1.0"
+version = "1.1.0+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd28d57d8a6f6e458bc0b8784f8fdcc4b99a437936056fa122cb234f18656a96"
+checksum = "f8195ca05e4eb728f4ba94f3e3291661320af739c4e43779cbdfae82ab239fcc"
 dependencies = [
  "indexmap",
  "serde_core",
- "serde_spanned 1.0.4",
- "toml_datetime 1.0.1+spec-1.1.0",
+ "serde_spanned 1.1.0",
+ "toml_datetime 1.1.0+spec-1.1.0",
  "toml_parser",
  "toml_writer",
  "winnow 1.0.0",
@@ -4910,9 +4934,9 @@ dependencies = [
 
 [[package]]
 name = "toml_datetime"
-version = "1.0.1+spec-1.1.0"
+version = "1.1.0+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b320e741db58cac564e26c607d3cc1fdc4a88fd36c879568c07856ed83ff3e9"
+checksum = "97251a7c317e03ad83774a8752a7e81fb6067740609f75ea2b585b569a59198f"
 dependencies = [
  "serde_core",
 ]
@@ -4933,9 +4957,9 @@ dependencies = [
 
 [[package]]
 name = "toml_parser"
-version = "1.0.10+spec-1.1.0"
+version = "1.1.0+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7df25b4befd31c4816df190124375d5a20c6b6921e2cad937316de3fccd63420"
+checksum = "2334f11ee363607eb04df9b8fc8a13ca1715a72ba8662a26ac285c98aabb4011"
 dependencies = [
  "winnow 1.0.0",
 ]
@@ -4948,9 +4972,9 @@ checksum = "5d99f8c9a7727884afe522e9bd5edbfc91a3312b36a77b5fb8926e4c31a41801"
 
 [[package]]
 name = "toml_writer"
-version = "1.0.7+spec-1.1.0"
+version = "1.1.0+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f17aaa1c6e3dc22b1da4b6bba97d066e354c7945cac2f7852d4e4e7ca7a6b56d"
+checksum = "d282ade6016312faf3e41e57ebbba0c073e4056dab1232ab1cb624199648f8ed"
 
 [[package]]
 name = "tower"
@@ -5098,7 +5122,7 @@ dependencies = [
  "serde_json",
  "target-triple",
  "termcolor",
- "toml 1.0.7+spec-1.1.0",
+ "toml 1.1.0+spec-1.1.0",
 ]
 
 [[package]]
@@ -5156,9 +5180,9 @@ checksum = "3b09c83c3c29d37506a3e260c08c03743a6bb66a9cd432c6934ab501a190571f"
 
 [[package]]
 name = "unicode-segmentation"
-version = "1.12.0"
+version = "1.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f6ccf251212114b54433ec949fd6a7841275f9ada20dddd2f29e9ceea4501493"
+checksum = "9629274872b2bfaf8d66f5f15725007f635594914870f65218920345aa11aa8c"
 
 [[package]]
 name = "unicode-width"
@@ -5299,6 +5323,15 @@ dependencies = [
  "wit-bindgen",
 ]
 
+[[package]]
+name = "wasip3"
+version = "0.4.0+wasi-0.3.0-rc-2026-01-06"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5428f8bf88ea5ddc08faddef2ac4a67e390b88186c703ce6dbd955e1c145aca5"
+dependencies = [
+ "wit-bindgen",
+]
+
 [[package]]
 name = "wasm-bindgen"
 version = "0.2.114"
@@ -5397,6 +5430,28 @@ version = "0.2.114"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cfe29135b180b72b04c74aa97b2b4a2ef275161eff9a6c7955ea9eaedc7e1d4e"
 
+[[package]]
+name = "wasm-encoder"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "990065f2fe63003fe337b932cfb5e3b80e0b4d0f5ff650e6985b1048f62c8319"
+dependencies = [
+ "leb128fmt",
+ "wasmparser",
+]
+
+[[package]]
+name = "wasm-metadata"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb0e353e6a2fbdc176932bbaab493762eb1255a7900fe0fea1a2f96c296cc909"
+dependencies = [
+ "anyhow",
+ "indexmap",
+ "wasm-encoder",
+ "wasmparser",
+]
+
 [[package]]
 name = "wasm-streams"
 version = "0.4.2"
@@ -5410,6 +5465,18 @@ dependencies = [
  "web-sys",
 ]
 
+[[package]]
+name = "wasmparser"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47b807c72e1bac69382b3a6fb3dbe8ea4c0ed87ff5629b8685ae6b9a611028fe"
+dependencies = [
+ "bitflags",
+ "hashbrown 0.15.5",
+ "indexmap",
+ "semver",
+]
+
 [[package]]
 name = "web-sys"
 version = "0.3.91"
@@ -5580,15 +5647,6 @@ dependencies = [
  "windows-link",
 ]
 
-[[package]]
-name = "windows-sys"
-version = "0.48.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "677d2418bec65e3338edb076e806bc1ec15693c5d0104683f2efe857f61056a9"
-dependencies = [
- "windows-targets 0.48.5",
-]
-
 [[package]]
 name = "windows-sys"
 version = "0.52.0"
@@ -5625,21 +5683,6 @@ dependencies = [
  "windows-link",
 ]
 
-[[package]]
-name = "windows-targets"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a2fa6e2155d7247be68c096456083145c183cbbbc2764150dda45a87197940c"
-dependencies = [
- "windows_aarch64_gnullvm 0.48.5",
- "windows_aarch64_msvc 0.48.5",
- "windows_i686_gnu 0.48.5",
- "windows_i686_msvc 0.48.5",
- "windows_x86_64_gnu 0.48.5",
- "windows_x86_64_gnullvm 0.48.5",
- "windows_x86_64_msvc 0.48.5",
-]
-
 [[package]]
 name = "windows-targets"
 version = "0.52.6"
@@ -5673,12 +5716,6 @@ dependencies = [
  "windows_x86_64_msvc 0.53.1",
 ]
 
-[[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"
-
 [[package]]
 name = "windows_aarch64_gnullvm"
 version = "0.52.6"
@@ -5691,12 +5728,6 @@ version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a9d8416fa8b42f5c947f8482c43e7d89e73a173cead56d044f6a56104a6d1b53"
 
-[[package]]
-name = "windows_aarch64_msvc"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"
-
 [[package]]
 name = "windows_aarch64_msvc"
 version = "0.52.6"
@@ -5709,12 +5740,6 @@ version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b9d782e804c2f632e395708e99a94275910eb9100b2114651e04744e9b125006"
 
-[[package]]
-name = "windows_i686_gnu"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"
-
 [[package]]
 name = "windows_i686_gnu"
 version = "0.52.6"
@@ -5739,12 +5764,6 @@ version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fa7359d10048f68ab8b09fa71c3daccfb0e9b559aed648a8f95469c27057180c"
 
-[[package]]
-name = "windows_i686_msvc"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"
-
 [[package]]
 name = "windows_i686_msvc"
 version = "0.52.6"
@@ -5757,12 +5776,6 @@ version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1e7ac75179f18232fe9c285163565a57ef8d3c89254a30685b57d83a38d326c2"
 
-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"
-
 [[package]]
 name = "windows_x86_64_gnu"
 version = "0.52.6"
@@ -5775,12 +5788,6 @@ version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9c3842cdd74a865a8066ab39c8a7a473c0778a3f29370b5fd6b4b9aa7df4a499"
 
-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"
-
 [[package]]
 name = "windows_x86_64_gnullvm"
 version = "0.52.6"
@@ -5793,12 +5800,6 @@ version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0ffa179e2d07eee8ad8f57493436566c7cc30ac536a3379fdf008f47f6bb7ae1"
 
-[[package]]
-name = "windows_x86_64_msvc"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
-
 [[package]]
 name = "windows_x86_64_msvc"
 version = "0.52.6"
@@ -5836,20 +5837,92 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a90e88e4667264a994d34e6d1ab2d26d398dcdca8b7f52bec8668957517fc7d8"
 
 [[package]]
-name = "winreg"
-version = "0.50.0"
+name = "wit-bindgen"
+version = "0.51.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "524e57b2c537c0f9b1e69f1965311ec12182b4122e45035b1508cd24d2adadb1"
+checksum = "d7249219f66ced02969388cf2bb044a09756a083d0fab1e566056b04d9fbcaa5"
 dependencies = [
- "cfg-if",
- "windows-sys 0.48.0",
+ "wit-bindgen-rust-macro",
 ]
 
 [[package]]
-name = "wit-bindgen"
+name = "wit-bindgen-core"
 version = "0.51.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7249219f66ced02969388cf2bb044a09756a083d0fab1e566056b04d9fbcaa5"
+checksum = "ea61de684c3ea68cb082b7a88508a8b27fcc8b797d738bfc99a82facf1d752dc"
+dependencies = [
+ "anyhow",
+ "heck 0.5.0",
+ "wit-parser",
+]
+
+[[package]]
+name = "wit-bindgen-rust"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7c566e0f4b284dd6561c786d9cb0142da491f46a9fbed79ea69cdad5db17f21"
+dependencies = [
+ "anyhow",
+ "heck 0.5.0",
+ "indexmap",
+ "prettyplease",
+ "syn",
+ "wasm-metadata",
+ "wit-bindgen-core",
+ "wit-component",
+]
+
+[[package]]
+name = "wit-bindgen-rust-macro"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c0f9bfd77e6a48eccf51359e3ae77140a7f50b1e2ebfe62422d8afdaffab17a"
+dependencies = [
+ "anyhow",
+ "prettyplease",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "wit-bindgen-core",
+ "wit-bindgen-rust",
+]
+
+[[package]]
+name = "wit-component"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d66ea20e9553b30172b5e831994e35fbde2d165325bec84fc43dbf6f4eb9cb2"
+dependencies = [
+ "anyhow",
+ "bitflags",
+ "indexmap",
+ "log",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "wasm-encoder",
+ "wasm-metadata",
+ "wasmparser",
+ "wit-parser",
+]
+
+[[package]]
+name = "wit-parser"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ecc8ac4bc1dc3381b7f59c34f00b67e18f910c2c0f50015669dde7def656a736"
+dependencies = [
+ "anyhow",
+ "id-arena",
+ "indexmap",
+ "log",
+ "semver",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "unicode-xid",
+ "wasmparser",
+]
 
 [[package]]
 name = "writeable"
@@ -6037,9 +6110,9 @@ dependencies = [
 
 [[package]]
 name = "zune-jpeg"
-version = "0.5.14"
+version = "0.5.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b7a1c0af6e5d8d1363f4994b7a091ccf963d8b694f7da5b0b9cceb82da2c0a6"
+checksum = "27bc9d5b815bc103f142aa054f561d9187d191692ec7c2d1e2b4737f8dbd7296"
 dependencies = [
  "zune-core",
 ]
diff --git a/crates/jacquard/src/client/credential_session.rs b/crates/jacquard/src/client/credential_session.rs
index 25fece49..9f4649de 100644
--- a/crates/jacquard/src/client/credential_session.rs
+++ b/crates/jacquard/src/client/credential_session.rs
@@ -117,7 +117,7 @@ where
     /// Current base endpoint. Defaults to the public appview when unset.
     pub async fn endpoint(&self) -> Uri<String> {
         self.endpoint.read().await.clone().unwrap_or_else(|| {
-            Uri::parse("https://public.bsky.app")
+            Uri::parse("https://public.api.bsky.app")
                 .expect("hardcoded URI is valid")
                 .to_owned()
         })
@@ -442,7 +442,7 @@ where
 {
     async fn base_uri(&self) -> Uri<String> {
         self.endpoint.read().await.clone().unwrap_or_else(|| {
-            Uri::parse("https://public.bsky.app")
+            Uri::parse("https://public.api.bsky.app")
                 .expect("hardcoded URI is valid")
                 .to_owned()
         })
@@ -847,7 +847,7 @@ where
 {
     async fn base_uri(&self) -> Uri<String> {
         self.endpoint.read().await.clone().unwrap_or_else(|| {
-            Uri::parse("https://public.bsky.app")
+            Uri::parse("https://public.api.bsky.app")
                 .expect("hardcoded URI is valid")
                 .to_owned()
         })
diff --git a/crates/jacquard/tests/credential_session.rs b/crates/jacquard/tests/credential_session.rs
index d944a550..a7293995 100644
--- a/crates/jacquard/tests/credential_session.rs
+++ b/crates/jacquard/tests/credential_session.rs
@@ -171,7 +171,10 @@ async fn credential_login_and_auto_refresh() {
     let session = CredentialSession::new(store.clone(), client.clone());
 
     // Before login, default endpoint should be public appview
-    assert_eq!(session.endpoint().await.as_str(), "https://public.bsky.app");
+    assert_eq!(
+        session.endpoint().await.as_str(),
+        "https://public.api.bsky.app"
+    );
 
     // Login using handle; resolves to PDS and persists session
     session
-- 
2.51.2