Remove atproto-oauth-aip, the XRPC example, and Walking Club

Remove atproto-oauth-aip, the XRPC example, and Walking Club

Prefill the consent form from login_hint

Resolve space declarations through the lexicon chain

Resolve lexicons from a directory on disk

Split the account portal into four navigated sections

Carry the expected audience as a parameter, not a thread-local

List every space on the browse index, not only the populated ones

Strip query and fragment from the DPoP htu claim

Implement community.lexicon.service.describe

Implement com.atproto.sync.getRecord

Link the CIDs a record references

Pass the signature to the signature verifier

Parse a JWK that carries the members a real one carries

Spend a client assertion's jti, so one capture is one redemption

Verify client assertions, so a confidential client can be one

Enforce the client authentication method a client declared

Show what a permission set actually is on the consent screen

Let an operator delay the first crawl announcement

Expand include: permission sets into the scopes they declare

Declare the authorization-response iss parameter, and test the whole document

Point the browser's breadcrumbs at paths that exist

Declare the signing algorithms the OAuth metadata was missing

Return the account fields from createSession and refreshSession

Stop putting a new app password in the URL

Scope the portal cookie to every portal route, not just /account

Require space membership on the XRPC write endpoints

State the foreign-keys pragma, and test that it holds

Test the space browser, and stop non-members using it

Add a repository browser to the account portal

Let an account change its handle from the portal

Retry the startup crawl announcement, and log why one was refused

Announce this PDS to its crawlers at startup

Collect email proof from the new address, not the old one

Mirror requested CORS headers instead of naming a fixed set

Document the SMTP port that actually works on Railway

Let the portal confirm an email address, and re-send the code

Take the operator PLC rotation key as one did:key value

Log delivered email, not only failures

Accept either form of the operator PLC rotation key

Drop the VOLUME instruction; Railway refuses to build with it

Document deploying to Railway

Let an account bring its own signing and rotation keys

Ship the PDS as a container, and honour the platform's PORT

Let identities administer the server by DID, not only by shared password

Describe the server at GET /, and advertise handle domains with their dot

Exempt space: scopes from the declared-scope check

Stop a mistyped password from destroying the OAuth request, and act on prompt

Refuse credential creation while a policy acceptance is owed

Add account creation to the portal, with invite codes and policy acceptance

Validate the handle and email at createAccount

Show when each app password was created and last used

Bundle the chat.bsky lexicons

Use base32 for mailed codes; the client cannot type anything else

Mail a code a person can retype instead of a link that does nothing

Report email-token refusals under their declared error names

feat(atproto-pds): implement the email-change flow as specified

fix(atproto-pds): make a refresh idempotent for a few seconds

fix(atproto-pds): silence a dead initialiser in the lexicon wiring

feat(atproto-pds): bundle the protocol lexicons and validate against them

fix(atproto-pds): rate-limit defaults, zero-disable, and getRepo

fix(atproto-pds): harden the OAuth consent screen

fix(atproto-pds): app passwords must not reach identity-takeover paths

fix(atproto-pds): require did and password to delete an account

fix(atproto-pds): verify the DID document before activating an account

fix(atproto-pds): mint a rotation key for accounts created by migration

fix(atproto-pds): stop requiring commit history that getRepo never exports

fix(atproto-lexicon): apply namespace authority to grants, not to documents

fix(atproto-lexicon): require a record to be an object and $type to be non-empty

fix(atproto-pds): verify space credentials from remote authorities

fix(atproto-oauth): space scopes use `authority`, defaulting to self

test(atproto-repo): assert the MST example-key heights

fix(atproto-lexicon): refuse ref, union and params as definitions

fix(atproto-lexicon): require $type on union values

fix: give $bytes one decoder across the workspace

fix(atproto-lexicon): bind include permissions to namespace authority

test(atproto-lexicon): run the interop lexicon corpus

test(atproto-identity): run the interop crypto corpus

fix(atproto-lexicon): check datetime semantics, not field ranges

fix(atproto-lexicon): refuse a DID ending in a percent sign

fix(atproto-lexicon): refuse whitespace in URIs

fix: enforce the TID first-character rule

fix(atproto-lexicon): validate language tags against the BCP 47 grammar

fix(atproto-lexicon): accept base58btc CIDs in the cid string format

fix(atproto-lexicon): allow digit-leading NSID authority segments

fix(atproto-lexicon): refuse empty and trailing AT-URI path segments

test(atproto-lexicon): run the interop syntax corpus

feat(atproto-pds): create the genesis commit at signup

docs(interop): correct the vendored corpus map

feat(atproto-pds): accept OAuth tokens where the reference does

fix(atproto-oauth): stop transition:generic granting identity and chat

fix(atproto-pds): accept the DPoP authorization scheme

fix(atproto-pds): send FutureCursor as an XRPC error frame

fix(atproto-repo): construct the Sync 1.1 covering proof

fix(atproto-pds): stream live events when no cursor is given

fix(atproto-pds): announce a new account on the firehose

fix(atproto-pds): reject a dpop_jkt that contradicts the DPoP proof

fix(atproto-pds): advertise client_id_metadata_document_supported

fix(atproto-identity): accept high-S signatures on the JWS path

fix(atproto-pds): name getRecord's missing-record error RecordNotFound