@getcirrus/pds@0.13.0

Minor Changes

• #147 2f06391 Thanks @ascorbic! - Add app password support for AT Protocol client authentication. Implements com.atproto.server.createAppPassword, listAppPasswords, revokeAppPassword, and login via app passwords. Includes CLI commands for creating, listing, and revoking app passwords.

create-pds@0.0.12

Patch Changes

• #140 6cc3cfc Thanks @ascorbic! - Improve CLI dashboard design

@getcirrus/pds@0.12.0

Minor Changes

• #140 6cc3cfc Thanks @ascorbic! - Improve CLI dashboard design

@getcirrus/pds@0.11.0

Minor Changes

• #137 90e9771 Thanks @ascorbic! - Add option to auto-generate a password during pds init and pds secret password, with clipboard copy support

• #136 287c971 Thanks @ascorbic! - Add live terminal dashboard for PDS monitoring via pds dashboard. Shows repository stats, federation sync status, firehose subscribers with IPs, real-time event log, and notifications. Also adds a web dashboard at /status.

@getcirrus/pds@0.10.6

Patch Changes

• #134 127f3db Thanks @ascorbic! - Fix OAuth client metadata caching to avoid redundant network requests

  Client metadata was re-fetched from the network on every OAuth request instead of using the cache, adding latency to token exchanges and making auth fragile when client metadata endpoints are slow or unavailable.

• Updated dependencies [e76f1e4, 127f3db]:

  • @getcirrus/oauth-provider@0.3.2

@getcirrus/oauth-provider@0.3.2

Patch Changes

• #132 e76f1e4 Thanks @ascorbic! - Fix OAuth client authentication failures for public clients and mixed JWKS

  • Fix invalid_client error for clients that omit token_endpoint_auth_method in their metadata (Zod default of client_secret_basic was passed through unsupported)
  • Fix invalid usage "encrypt" error when client JWKS contains both signing and encryption keys by using jose's createLocalJWKSet for proper key selection

• #134 127f3db Thanks @ascorbic! - Fix OAuth authentication failure for confidential clients whose JWKS contains invalid key_ops

  Clients with ECDSA signing keys that incorrectly declare encryption operations (e.g. "encrypt", "wrapKey") in their JWKS key_ops field would fail with "invalid usage" during token exchange.

@getcirrus/pds@0.10.5

Patch Changes

• #131 ab73a2d Thanks @ascorbic! - Stream getRepo response to fix OOM on large repos

• #129 764fef3 Thanks @ascorbic! - Include "cirrus" in the version string returned from the health check endpoint.

@getcirrus/pds@0.10.4

Patch Changes

• #127 e09a661 Thanks @ascorbic! - Cache collection names in SQLite for describeRepo performance

@getcirrus/pds@0.10.3

Patch Changes

• #123 4e3d4e9 Thanks @ascorbic! - Rename getAccountStatus endpoint to checkAccountStatus to match AT Protocol lexicon

• #126 99272ea Thanks @ascorbic! - Add updateEmail endpoint and include email in session responses

  Store email in DO storage and return it from getSession, createSession, and refreshSession responses. Fixes deck.blue and official app complaints about missing email field.

@getcirrus/pds@0.10.2

Patch Changes

• #120 82301c5 Thanks @ascorbic! - Skip OAuth authorization for messaging platform link preview bots

  Messaging platforms (Telegram, Slack, Discord, Twitter/X, Facebook/iMessage) pre-fetch URLs shared in DMs and channels. When an OAuth authorization link with a one-time PAR request URI is shared, the preview bot consumes it before the user can open it. The authorize endpoint now detects these specific bots by User-Agent and returns a minimal HTML page with appropriate meta tags instead of processing the OAuth request.

  Only known messaging platform bots are matched — generic crawlers and spiders are not excluded, since an unknown bot hitting an OAuth URL should still consume the token.

• #116 a06516a Thanks @ascorbic! - Detect content type of blobs

• #119 92a2b39 Thanks @ascorbic! - Normalize JSON blob references for correct dag-cbor encoding

  Incoming API records contain blob references with nested $link objects
  (for example, { "$type": "blob", "ref": { "$link": "bafk..." } }). These
  must be converted to actual CID instances before CBOR encoding, otherwise
  the blob ref's ref field gets encoded as a map instead of a proper CID tag.
  This causes incorrect block hashes, which can lead to blob resolution failures
  on the Bluesky network.

  Uses jsonToLex from @atproto/lex-json to convert $link → CID and
  $bytes → Uint8Array on all record write paths (createRecord, putRecord,
  applyWrites).