+15

CHANGELOG.md

··· 6 7 ## [Unreleased] 8 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 9 ## [0.4.0] - 2026-01-08 10 11 ### Added

··· 6 7 ## [Unreleased] 8 9 + ## [0.5.0] - 2026-01-08 10 + 11 + ### Added 12 + 13 + - **Direct OAuth authorization** without requiring Pushed Authorization Requests (PAR) 14 + - `/oauth/authorize` now accepts direct query parameters (client_id, redirect_uri, code_challenge, etc.) 15 + - Creates authorization request record on-the-fly, same as PAR flow 16 + - DPoP binding deferred to token exchange time for direct auth flows 17 + - Matches official AT Protocol PDS behavior 18 + 19 + ### Changed 20 + 21 + - AS metadata: `require_pushed_authorization_requests` now `false` 22 + - Extracted `validateAuthorizationParameters()` helper shared between PAR and direct auth 23 + 24 ## [0.4.0] - 2026-01-08 25 26 ### Added

+1 -1

package.json

··· 1 { 2 "name": "pds.js", 3 - "version": "0.4.0", 4 "private": true, 5 "type": "module", 6 "scripts": {

··· 1 { 2 "name": "pds.js", 3 + "version": "0.5.0", 4 "private": true, 5 "type": "module", 6 "scripts": {

+1 -1

src/pds.js

··· 32 // ╚══════════════════════════════════════════════════════════════════════════════╝ 33 34 // PDS version (keep in sync with package.json) 35 - const VERSION = '0.4.0'; 36 37 // CBOR primitive markers (RFC 8949) 38 const CBOR_FALSE = 0xf4;

··· 32 // ╚══════════════════════════════════════════════════════════════════════════════╝ 33 34 // PDS version (keep in sync with package.json) 35 + const VERSION = '0.5.0'; 36 37 // CBOR primitive markers (RFC 8949) 38 const CBOR_FALSE = 0xf4;