prepare for release v0.5.0 - #88
Merged
Merged
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Coverage Report for CI Build 24640564770Coverage remained the same at 36.52%Details
Uncovered ChangesNo uncovered changes found. Coverage RegressionsNo coverage regressions found. Coverage Stats
💛 - Coveralls |
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
7 tasks
aspiers
added a commit
that referenced
this pull request
Apr 19, 2026
The #84 changeset wrote the client-app-dev section as one 280-word paragraph that listed every route URL inline, and the operator section as one dense paragraph of its own. Split both into bullets and drop the route list (the /preview index is the source of truth), matching the edits that were made directly on the v0.5.0 release PR (#88). Putting the edits in the changeset file means they survive the Changesets bot's next regeneration of CHANGELOG.md — without this, any bot re-run on #88 would revert the CHANGELOG to the old paragraph form. Also corrects the workflow description: paste your metadata URL into the input field on /preview (persisted in the browser, wires every link), not by hand-constructing ?client_id= query strings. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2 tasks
hypercerts-release-bot
Bot
force-pushed
the
changeset-release/main
branch
from
April 19, 2026 18:46
ae40c29 to
1ad6710
Compare
The Changesets bot regenerated changeset-release/main from the three v0.5.0 changesets, which reverted the earlier manual merge of the client-app-developer and operator subsections in Who-Should-Read. Both subsections now list the same two entries (the feature + the fix), so the separate listing adds lines without information. Reapply the merge as "Client app developers & operators". A durable fix would live in scripts/changelog-audience-summary.mjs — that can come later. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.
Releases
ePDS@0.5.0
Who should read this release
Minor Changes
#84
fe3ec90Thanks @aspiers! - Add preview routes on auth-service and pds-core for iterating on client branding CSS.Affects: Client app developers, Operators
Client app developers:
/previewon either auth-service or pds-core for an index of every preview page. Each page renders against fixture data, so you can iterate on yourbranding.csswithout walking through a real OAuth flow.client-metadata.jsonURL into the input field on the index page. The value is persisted in your browser and wires up every preview link, subject to the samePDS_OAUTH_TRUSTED_CLIENTScheck as a real flow. Leave it blank to see the unbranded baseline.branding.css, refresh any preview page. No OTP emails, no full flow.client_idpre-selected.Operators:
AUTH_PREVIEW_ROUTES=1on auth-service,PDS_PREVIEW_ROUTES=1on pds-core. Both are independent.pr-base, dev) and on local development instances. Preview routes don't affect real auth flows — they short-circuit real state — so they can technically run in production too, but they are a developer-only surface and are best left off outside preview/dev envs./preview/cache-status, which returns the list ofclient_idURLs currently in the shared client-metadata cache — i.e. apps that have recently started an OAuth flow against this PDS. That partially leaks which third-party clients are using the instance, so keep previews disabled in production unless you're comfortable with that.packages/auth-service/.env.exampleandpackages/pds-core/.env.examplefor the full notes.Patch Changes
#83
cc722c4Thanks @aspiers! - Demo amber/ocean themes now colour the OAuth consent page correctly.Affects: End users of the trusted demo
End users: The consent screen shown after signing in via the trusted demo now uses the demo's own warm indigo / amber palette throughout — the Authorize and Deny-access buttons, the "Authorize" header strip, and the surrounding surface all match the theme instead of falling back to the default @atproto/oauth-provider dark-mode look.
The previous CSS targeted auth-service's hand-rolled login markup (
.btn-primary,.container,.field), which does not exist on the consent page — that page is built from@atproto/oauth-provider-ui, which is a Tailwind-utility bundle whose colours are driven by CSS custom properties (--branding-color-primaryand friends). The demo theme now overrides those variables at:root, so a single declaration recolours everybg-primary/text-primary/border-primaryutility on the consent page at once, and additionally paints the card surface and body background to match.#89
1942ebbThanks @aspiers! - Fix two preview-route cache bugs and remove long-stale debug endpoints.Affects: Client app developers, Operators
Client app developers:
client_idwith a valid 10-minute entry would overwrite that entry with a 60-second branding-less fallback, silently droppingbranding.csson real OAuth flows for up to a minute. The in-memory cache is now only written by real-flow resolution./preview/login,/preview/login-otp,/preview/choose-handle,/preview/choose-handle-picker,/preview/recovery,/preview/recovery-otp, and the/previewindex) now sendCache-Control: no-store. Without it, a browser refresh could serve a cached page and never ask the server for freshbranding.css, breaking the advertised "editbranding.css, refresh the preview page" workflow./preview/validatenow flagsbranding.csswhose escaped size exceeds the 32 KB injection limit as an error, instead of reportingokand letting the developer discover later that their CSS was silently dropped on real OAuth flows. Byte counts now matchgetClientCss()'s measurement (escaped UTF-8).Operators:
/_internal/debug-grantsand/_internal/debug-recent-accounts. These were added as temporary HYPER-270 debugging endpoints with a code comment marking them for removal before PR #21 shipped (v0.2.2); they survived through v0.2.2, v0.3.0, v0.4.0, and the pending v0.5.0. The matching env varEPDS_DEBUG_GRANTSis no longer read.