Merge 2026 05 26

.changeset/calm-groups-limit.md

@@ -0,0 +1,5 @@
+---
+"@atproto/api": patch
+---
+
+update chat lexicons

.changeset/chatty-icons-agree.md

@@ -0,0 +1,5 @@
+---
+'@atproto/bsky': patch
+---
+
+Ensure `associatedProfiles` is returned for Standard Site external embed views

.changeset/crisp-bridges-dream.md

@@ -0,0 +1,5 @@
+---
+'@atproto/pds': patch
+---
+
+Fix OAuth service-proxying audience check to use combined `did#serviceId` form, matching the shape of granted `rpc:` scopes.

.changeset/plain-rivers-glow.md

@@ -0,0 +1,5 @@
+---
+'@atproto/oauth-scopes': minor
+---
+
+**BREAKING:** Remove the `AtprotoAudience` and `isAtprotoAudience` re-exports. They are superseded by `AtprotoDidRefAbsolute` and `isAtprotoDidRefAbsolute`, also re-exported from this package.

.changeset/quiet-bridges-hum.md

@@ -0,0 +1,5 @@
+---
+'@atproto/did': minor
+---
+
+**BREAKING:** Remove `AtprotoAudience` and `isAtprotoAudience`. They are superseded by `AtprotoDidRefAbsolute` and `isAtprotoDidRefAbsolute`. Adds the related `DidRefAbsolute` and `DidRefRelative` types and predicates.

.changeset/quiet-rivers-dance.md

@@ -0,0 +1,5 @@
+---
+'@atproto/pds': patch
+---
+
+`getServiceAuth` now accepts the combined `did#serviceId` form for its `aud` parameter, in addition to the bare DID form.

.eslintrc

@@ -51,6 +51,7 @@
       {
         "argsIgnorePattern": "^_",
         "varsIgnorePattern": "^_",
+        "caughtErrorsIgnorePattern": "^_|^err$|^error$",
         "ignoreRestSiblings": true
       }
     ],
@@ -62,21 +63,21 @@
   },
   "overrides": [
     {
-      "files": ["jest.config.js"],
+      "files": ["jest.config.cjs"],
       "env": { "commonjs": true }
     },
     {
       "files": ["vite.config.js", "vite.config.cjs", "vite.config.mjs"],
       "env": { "node": true }
     },
     {
-      "files": ["jest.setup.js"],
+      "files": ["test.setup.ts"],
       "env": { "jest": true }
     },
     {
-      "files": ["*.js", "*.cjs"],
+      "files": ["*.js", "*.cjs", "*.cts"],
       "rules": {
-        "@typescript-eslint/no-var-requires": "off"
+        "@typescript-eslint/no-require-imports": "off"
       }
     },
     {
@@ -85,12 +86,21 @@
         "n/no-extraneous-import": [
           "error",
           { "allowModules": ["@atproto/dev-env"] }
+        ],
+        "@typescript-eslint/no-unused-vars": [
+          "error",
+          {
+            "argsIgnorePattern": "^_",
+            "varsIgnorePattern": "^_",
+            "caughtErrorsIgnorePattern": "^_|^err$|^error$",
+            "ignoreRestSiblings": true
+          }
         ]
       }
     }
   ],
   "settings": {
-    "node": { "version": ">=18.7.0" },
+    "node": { "version": ">=22" },
     "import/internal-regex": "^@atproto(?:-labs)?/",
     "import/parsers": { "@typescript-eslint/parser": [".ts", ".tsx"] },
     "import/resolver": {

.gitattributes

@@ -1,13 +1,2 @@
-# buf
-packages/bsky/src/proto/** linguist-generated=true
-packages/bsync/src/proto/** linguist-generated=true
-
-# codegen
-packages/api/src/client/** linguist-generated=true
-packages/ozone/src/lexicon/** linguist-generated=true
-
-# @atproto/lex
-packages/lexicon-resolver/src/lexicons/** linguist-generated=true
-
 # i18n
 packages/oauth/oauth-provider-ui/src/locales/**/messages.po linguist-generated=true

.github/workflows/publish.yaml

@@ -38,7 +38,7 @@ jobs:
         uses: changesets/action@v1
         id: changesets
         with:
-          publish: pnpm release
+          publish: pnpm run publish:ci
           version: pnpm run version-packages
           commit: 'Version packages'
           title: 'Version packages'

.github/workflows/repo.yaml

@@ -2,8 +2,6 @@ name: Repository CI
 
 on:
   pull_request:
-    branches:
-      - '*'
 
 concurrency:
   group: '${{ github.workflow }}-${{ github.head_ref || github.ref }}'
@@ -24,22 +22,51 @@ jobs:
         env:
           PUPPETEER_SKIP_DOWNLOAD: true
 
+      # lex-cli code generation can be a bottleneck. The "prebuild" script in
+      # the "api" and "ozone" packages only re-runs lex-cli when needed: if the
+      # generated output is missing, or if any lexicon JSON has a newer mtime
+      # than the generated files. We cache the generated output keyed on the
+      # content of the lexicon JSONs (plus the package.json files that define
+      # the codegen command), so unchanged lexicons restore from cache.
+      #
+      # However, on a cache hit we have to fix mtimes by hand.
+      # `actions/checkout` writes every checked-out file (including
+      # lexicons/**/*.json) with mtime = checkout time, while `actions/cache`
+      # restores files with their original archived mtime (older). Without
+      # intervention, every lexicon JSON looks "newer" than the restored
+      # generated files and the prebuild script would re-run lex-cli even though
+      # nothing has changed. Touching the restored files brings their mtime to
+      # "now", so the prebuild's `find -newer` check correctly reports no newer
+      # lexicons.
+      - uses: actions/cache@v4
+        id: lex-cli-cache
+        with:
+          path: |
+            packages/api/src/client
+            packages/ozone/src/lexicon
+          key: lex-cli-${{ hashFiles('lexicons/**/*.json', 'packages/api/package.json', 'packages/ozone/package.json') }}
+      - if: steps.lex-cli-cache.outputs.cache-hit == 'true'
+        run: find packages/api/src/client packages/ozone/src/lexicon -exec touch {} +
+
       - run: pnpm build
+
       - uses: actions/upload-artifact@v4
         with:
+          # Preserve the result of codegen and build steps.
           name: dist
           retention-days: 2
           path: |
             packages/*/dist
             packages/*/*/dist
+            packages/*/src/proto
+            packages/*/src/lexicons
             packages/lex/*/src/lexicons
             packages/lex/*/tests/lexicons
-            packages/oauth/oauth-client-browser-example/src/lexicons
+            packages/oauth/*/src/lexicons
             packages/oauth/*/src/locales/*/messages.ts
+            packages/api/src/client
             packages/api/src/moderation/const/labels.ts
-            packages/bsky/src/lexicons
-            packages/pds/src/lexicons
-            packages/sync/src/lexicons
+            packages/ozone/src/lexicon
 
   changeset:
     name: Changeset

.vscode/settings.json

@@ -49,5 +49,5 @@
   "prettier.semi": false,
   "prettier.singleQuote": true,
   "prettier.trailingComma": "es5",
-  "typescript.tsdk": "node_modules/typescript/lib"
+  "js/ts.tsdk.path": "node_modules/typescript/lib"
 }

README.md

@@ -8,18 +8,19 @@ This repository contains Bluesky's reference implementation of AT Protocol, and
 
 **TypeScript Packages:**
 
-| Package                                                                       | Docs                                       | NPM                                                                                                             |
-| ----------------------------------------------------------------------------- | ------------------------------------------ | --------------------------------------------------------------------------------------------------------------- |
-| `@atproto/api`: client library                                                | [README](./packages/api/README.md)         | [![NPM](https://img.shields.io/npm/v/@atproto/api)](https://www.npmjs.com/package/@atproto/api)                 |
-| `@atproto/common-web`: shared code and helpers which can run in web browsers  | [README](./packages/common-web/README.md)  | [![NPM](https://img.shields.io/npm/v/@atproto/common-web)](https://www.npmjs.com/package/@atproto/common-web)   |
-| `@atproto/common`: shared code and helpers which doesn't work in web browsers | [README](./packages/common/README.md)      | [![NPM](https://img.shields.io/npm/v/@atproto/common)](https://www.npmjs.com/package/@atproto/common)           |
-| `@atproto/crypto`: cryptographic signing and key serialization                | [README](./packages/crypto/README.md)      | [![NPM](https://img.shields.io/npm/v/@atproto/crypto)](https://www.npmjs.com/package/@atproto/crypto)           |
-| `@atproto/identity`: DID and handle resolution                                | [README](./packages/identity/README.md)    | [![NPM](https://img.shields.io/npm/v/@atproto/identity)](https://www.npmjs.com/package/@atproto/identity)       |
-| `@atproto/lexicon`: schema definition language                                | [README](./packages/lexicon/README.md)     | [![NPM](https://img.shields.io/npm/v/@atproto/lexicon)](https://www.npmjs.com/package/@atproto/lexicon)         |
-| `@atproto/repo`: data storage structure, including MST                        | [README](./packages/repo/README.md)        | [![NPM](https://img.shields.io/npm/v/@atproto/repo)](https://www.npmjs.com/package/@atproto/repo)               |
-| `@atproto/syntax`: string parsers for identifiers                             | [README](./packages/syntax/README.md)      | [![NPM](https://img.shields.io/npm/v/@atproto/syntax)](https://www.npmjs.com/package/@atproto/syntax)           |
-| `@atproto/xrpc`: client-side HTTP API helpers                                 | [README](./packages/xrpc/README.md)        | [![NPM](https://img.shields.io/npm/v/@atproto/xrpc)](https://www.npmjs.com/package/@atproto/xrpc)               |
-| `@atproto/xrpc-server`: server-side HTTP API helpers                          | [README](./packages/xrpc-server/README.md) | [![NPM](https://img.shields.io/npm/v/@atproto/xrpc-server)](https://www.npmjs.com/package/@atproto/xrpc-server) |
+| Package                                                                       | Docs                                       | NPMX                                                                                                       |
+| ----------------------------------------------------------------------------- | ------------------------------------------ | ---------------------------------------------------------------------------------------------------------- |
+| `@atproto/api`: client library                                                | [README](./packages/api/README.md)         | [![NPM](https://img.shields.io/npm/v/@atproto/api)](https://npmx.dev/package/@atproto/api)                 |
+| `@atproto/common-web`: shared code and helpers which can run in web browsers  | [README](./packages/common-web/README.md)  | [![NPM](https://img.shields.io/npm/v/@atproto/common-web)](https://npmx.dev/package/@atproto/common-web)   |
+| `@atproto/common`: shared code and helpers which doesn't work in web browsers | [README](./packages/common/README.md)      | [![NPM](https://img.shields.io/npm/v/@atproto/common)](https://npmx.dev/package/@atproto/common)           |
+| `@atproto/crypto`: cryptographic signing and key serialization                | [README](./packages/crypto/README.md)      | [![NPM](https://img.shields.io/npm/v/@atproto/crypto)](https://npmx.dev/package/@atproto/crypto)           |
+| `@atproto/identity`: DID and handle resolution                                | [README](./packages/identity/README.md)    | [![NPM](https://img.shields.io/npm/v/@atproto/identity)](https://npmx.dev/package/@atproto/identity)       |
+| `@atproto/lex`: modern type-safe client library with codegen                  | [README](./packages/lex/lex/README.md)     | [![NPM](https://img.shields.io/npm/v/@atproto/lex)](https://npmx.dev/package/@atproto/lex)                 |
+| `@atproto/lexicon`: schema definition language                                | [README](./packages/lexicon/README.md)     | [![NPM](https://img.shields.io/npm/v/@atproto/lexicon)](https://npmx.dev/package/@atproto/lexicon)         |
+| `@atproto/repo`: data storage structure, including MST                        | [README](./packages/repo/README.md)        | [![NPM](https://img.shields.io/npm/v/@atproto/repo)](https://npmx.dev/package/@atproto/repo)               |
+| `@atproto/syntax`: string parsers for identifiers                             | [README](./packages/syntax/README.md)      | [![NPM](https://img.shields.io/npm/v/@atproto/syntax)](https://npmx.dev/package/@atproto/syntax)           |
+| `@atproto/xrpc`: client-side HTTP API helpers                                 | [README](./packages/xrpc/README.md)        | [![NPM](https://img.shields.io/npm/v/@atproto/xrpc)](https://npmx.dev/package/@atproto/xrpc)               |
+| `@atproto/xrpc-server`: server-side HTTP API helpers                          | [README](./packages/xrpc-server/README.md) | [![NPM](https://img.shields.io/npm/v/@atproto/xrpc-server)](https://npmx.dev/package/@atproto/xrpc-server) |
 
 **TypeScript Services:**
 
@@ -36,12 +37,12 @@ Go programming language source code is in [bluesky-social/indigo](https://github
 
 ## Developer Quickstart
 
-We recommend [`nvm`](https://github.com/nvm-sh/nvm) for managing Node.js installs. This project requires Node.js version 18. `pnpm` is used to manage the workspace of multiple packages. You can install it with `npm install --global pnpm`.
+We recommend [`nvm`](https://github.com/nvm-sh/nvm) for managing Node.js installs. This project requires Node.js version 22 or later. `pnpm` is used to manage the workspace of multiple packages. You can install it with `npm install --global pnpm`.
 
 There is a Makefile which can help with basic development tasks:
 
 ```shell
-# use existing nvm to install node 18 and pnpm
+# use existing nvm to install node 22 and pnpm
 make nvm-setup
 
 # pull dependencies and build all local packages

jest.config.js → jest.config.cjs

@@ -1,4 +1,4 @@
 /** @type {import('jest').Config} */
 module.exports = {
-  projects: ['<rootDir>/packages/*/jest.config.js'],
+  projects: ['<rootDir>/packages/*/jest.config.cjs'],
 }

jest.varint-shim.cjs

@@ -0,0 +1,7 @@
+// Shim for varint that works around cjs-module-lexer not detecting
+// comma-first style exports (which prevents Jest ESM interop from
+// exposing named exports in SyntheticModule).
+const _varint = require('./node_modules/.pnpm/varint@6.0.0/node_modules/varint/index.js')
+exports.encode = _varint.encode
+exports.decode = _varint.decode
+exports.encodingLength = _varint.encodingLength

lexicons/app/bsky/embed/external.json

@@ -24,6 +24,14 @@
           "type": "blob",
           "accept": ["image/*"],
           "maxSize": 1000000
+        },
+        "associatedRefs": {
+          "type": "array",
+          "items": {
+            "type": "ref",
+            "ref": "com.atproto.repo.strongRef"
+          },
+          "description": "StrongRefs (uri+cid) of the Atmosphere records that backed this view."
         }
       }
     },
@@ -44,7 +52,97 @@
         "uri": { "type": "string", "format": "uri" },
         "title": { "type": "string" },
         "description": { "type": "string" },
-        "thumb": { "type": "string", "format": "uri" }
+        "thumb": { "type": "string", "format": "uri" },
+        "createdAt": {
+          "type": "string",
+          "format": "datetime",
+          "description": "When the external content was created, if available. Example: a publication date, for an article."
+        },
+        "updatedAt": {
+          "type": "string",
+          "format": "datetime",
+          "description": "When the external content was updated, if available."
+        },
+        "readingTime": {
+          "type": "integer",
+          "description": "Estimated reading time in minutes, if applicable and available."
+        },
+        "labels": {
+          "type": "array",
+          "items": { "type": "ref", "ref": "com.atproto.label.defs#label" }
+        },
+        "source": { "type": "ref", "ref": "#viewExternalSource" },
+        "associatedRefs": {
+          "type": "array",
+          "items": {
+            "type": "ref",
+            "ref": "com.atproto.repo.strongRef"
+          },
+          "description": "StrongRefs (uri+cid) of the Atmosphere records that backed this view."
+        },
+        "associatedProfiles": {
+          "type": "array",
+          "items": {
+            "type": "ref",
+            "ref": "app.bsky.actor.defs#profileViewBasic"
+          },
+          "description": "Profiles of the owners of the Atmosphere records that backed this view."
+        }
+      }
+    },
+    "viewExternalSource": {
+      "type": "object",
+      "description": "The source of an external embed, such as a standard.site publication.",
+      "required": ["uri", "title"],
+      "properties": {
+        "uri": {
+          "type": "string",
+          "format": "uri",
+          "description": "URI of the source, if available. Example: the https:// URL of a site.standard.publication record."
+        },
+        "icon": {
+          "type": "string",
+          "format": "uri",
+          "description": "Fully-qualified URL where an icon representing the source can be fetched. For example, CDN location provided by the App View."
+        },
+        "title": { "type": "string" },
+        "description": { "type": "string" },
+        "theme": {
+          "type": "ref",
+          "ref": "#viewExternalSourceTheme"
+        }
+      }
+    },
+    "viewExternalSourceTheme": {
+      "type": "object",
+      "description": "The theme colors of an external source, such as a site.standard.publication. These colors may be used when rendering an embed from that source.",
+      "properties": {
+        "backgroundRGB": {
+          "type": "ref",
+          "ref": "#colorRGB"
+        },
+        "foregroundRGB": {
+          "type": "ref",
+          "ref": "#colorRGB"
+        },
+        "accentRGB": {
+          "type": "ref",
+          "ref": "#colorRGB"
+        },
+        "accentForegroundRGB": {
+          "type": "ref",
+          "ref": "#colorRGB"
+        }
+      }
+    },
+    "colorRGB": {
+      "type": "object",
+      "description": "RGB color definition, inspired by site.standard.theme.color#rgb",
+      "required": ["r", "g", "b"],
+      "properties": {
+        "r": { "type": "integer", "minimum": 0, "maximum": 255 },
+        "g": { "type": "integer", "minimum": 0, "maximum": 255 },
+        "b": { "type": "integer", "minimum": 0, "maximum": 255 }
       }
     }
   }