The PDS stores $bytes in CBOR and re-encodes to unpadded base64 on JSON read. Our decode uses STANDARD (requires padding), causing 'Invalid padding' errors on every round-trip. Affects: resolve.rs public key decode, documents/download.rs nonce decode, crypto.rs unwrap_key ciphertext decode. Fix: create a padding-indifferent base64 engine in atproto.rs and use it at every decode site. Encode can stay padded (STANDARD).
The PDS stores $bytes in CBOR and re-encodes to unpadded base64 on JSON read. Our decode uses STANDARD (requires padding), causing 'Invalid padding' errors on every round-trip. Affects: resolve.rs public key decode, documents/download.rs nonce decode, crypto.rs unwrap_key ciphertext decode. Fix: create a padding-indifferent base64 engine in atproto.rs and use it at every decode site. Encode can stay padded (STANDARD).