PackageTrack
Sign in Get early access

atproto_core

Core library for clients and tools. This package is mainly used by https://atprotodart.com packages.

2.4.1 5.5K downloads/mo #3708 most downloaded on pub.dev myConsciousness/atproto.dart

What this package is like to depend on

Last release 15 days ago

08 Aug 2026

Release timing varies

gaps range from 9 days to 7 months

Nearly every release is documented

notes for 86 of 86 stable releases

Nothing withdrawn

no release was ever pulled

3 years old

93 releases · first in 2023

13 releases in the last 12 months

see the full history below

Release timeline

93 releases · Mar 2023 to Aug 2026
2024 2025 2026
Release Pre-release

Releases

latest 60 of 93
  1. 2.4.1 08 Aug 2026
    Release notes
    • chore: bump atproto_oauth to ^0.8.0.
    Open source →
  2. 2.4.0 26 Jul 2026
    Release notes
    • fix: decodeCar validates the CAR header length instead of trusting it. A truncated archive whose header varint claimed more bytes than exist pushed the cursor past the end and decoded to an EMPTY map — a truncated repository export looked like an empty repository, silently losing every block. It now throws CarException, the same contract the block-length check already honored.
    • fix: a varint whose payload reaches the 64th bit no longer wraps to a negative length and escapes as a raw RangeError from deep inside the decoder; it is rejected as a CarException in the varint reader itself, so every caller of it is covered. Length checks are also written as subtractions so a near-maximum length cannot overflow the cursor past its own bounds check.
    • feat: added ServiceContext.withAdditionalHeaders, which derives a context from this one's headers plus the given ones instead of replacing them. withHeaders replaces, so every caller adding a single header spread the origin's headers back in by hand — and a spread is key-exact, which leaves a caller's Atproto-Proxy sitting next to the added atproto-proxy. Header names are case-insensitive, so this merges case-insensitively and the added header wins.
    • fix: ServiceContext.headers no longer hands out the context's live internal map. Any holder could write to it, and because a context derived via withHeaders and the clients built on it read the same field, one headers['atproto-proxy'] = ... retargeted every request every one of them made — while headers.remove(...) silently dropped a header a client needs for the rest of its life. The map is now copied at construction and exposed unmodifiable, consistently: previously the same write threw UnsupportedError when no headers had been supplied and succeeded when they had.
    • fix: a 5xx now reaches a custom RetryStrategy with its true status code. checkStatus funnels 500, 502, 503 and 504 into a single InternalServerErrorException, and the retry layer hardcoded statusCode: 500 when building the RetryContext, so a strategy branching on context.statusCode == 503 could never match.
    • fix: a Retry-After / ratelimit-reset sent with a server error is now honored. It was read only on the 429 path, so the wait a 503 asked for was silently dropped.
    • fix: a 401 provoked by an access token the session has already rotated past no longer triggers a further refresh. Single-flighting only coalesces requests that overlap an in-progress refresh; a request already on the wire with the superseded token 401s after the rotation lands, and each such response used to chain another rotation — spending an unused refresh token and emitting an onSessionUpdated the owner has to persist. The token the failed request actually carried is now compared against the current session, and a stale one is simply retried.
    • fix: the exponential backoff in RetryConfig is now capped at 60 seconds, matching the "capped exponential backoff" it documents. Uncapped, 2 ^ (attempt - 1) reaches roughly six days by attempt 20.
    • fix: a server-requested wait can no longer shorten a retry. The 60-second clamp was applied after the comparison, so a server asking for 1000s while the backoff stood at 512s collapsed the wait to 60s — a larger requested delay produced a shorter wait than plain backoff.
    • fix: a user-supplied onRefreshSession is now bounded by the context's timeout. It is awaited at the head of every request behind a single flight, so one that never completed stalled every request on the context forever; timeout previously covered only the xrpc call.
    • fix: Challenge.execute no longer exposes its recursion state (attempt, dpopNonceRetryCount, sessionRefreshed) on the public signature, where a caller passing e.g. attempt: 5 corrupted the retry accounting. Challenge is publicly exported; the loop state moved to a private _execute.
    • docs: RetryConfig documented its jitter as 0 ~ 3 while the implementation drew 0 ~ 4 inclusive.
    Open source →
  3. 2.3.0 26 Jul 2026
    Release notes
    • feat: added ServiceContext.actorDid, the DID of the authenticated actor regardless of how the context was authenticated. session is set only for the legacy (app-password) path and oAuthSessionManager only for the OAuth one, so neither answers that on its own and callers were left composing the two by hand. repo is now defined in terms of it, so the two cannot drift.
    • feat: added isAmbiguousFailure, a pure predicate reporting whether a caught error leaves it uncertain that the request reached the server. The retry engine already drew this distinction but only exposed it to a RetryStrategy; once retries were exhausted the original error was rethrown unchanged — a TimeoutException or an http.ClientException cannot carry an extra field — so a caller writing records could not tell a safe retry from one risking a duplicate. The retry layer now consumes the same predicate, so the classification callers see cannot drift from the behavior they observe.
    • feat: atproto_core.dart now re-exports TidGenerator from at_primitives, alongside the existing AtUri and NSID re-exports, so a caller allocating record keys ahead of a write does not need a direct dependency on at_primitives.
    • feat: added ServiceContext.withHeaders, deriving a context that shares this one's session while carrying its own request headers. Mutable session state now lives in a holder the derived contexts share, so a refresh — including the deduplicated in-flight one — is seen by all of them. Headers belong to the client; the session belongs to the account.
    Open source →
  4. 2.2.0 22 Jul 2026
    Release notes
    • feat: added computeRecordCid, which returns the CID a PDS will assign to a record by canonically DAG-CBOR-encoding it and hashing to a CIDv1. This lets a caller reference a record before it is written — for example to chain reply references across records submitted in one com.atproto.repo.applyWrites batch.
    • chore: widen at_primitives to ^1.2.0, multiformats to ^1.3.0, and xrpc to ^1.1.3.
    Open source →
  5. 2.1.0 21 Jul 2026
    Release notes
    • feat: added ServiceContext.onSessionUpdated, a broadcast stream that emits the refreshed Session each time an expired access token is renewed. session already reflected the new credentials, but nothing told the caller to read it back — and because refresh tokens are single-use, a caller that kept persisting the session it originally passed in stored a spent refresh token, so the next run restored a session that could no longer be refreshed. Mirrors OAuthSessionManager.onSessionUpdated for the legacy (app-password) path; it stays silent on OAuth-backed contexts. Concurrent requests that share one deduplicated refresh emit exactly one event.
    Open source →
  6. 2.0.1 16 Jul 2026
    Release notes
    • docs: rewrite the README to document the actual public API — Session/OAuthSession, JWT decoding (decodeJwt/Jwt), the pluggable retry engine (RetryStrategy, RetryConfig, RetryContext, RetryReason, RetryEvent, Jitter), BaseHttpService/ServiceContext, Blob/BlobRef, decodeCar, isValidAppPassword, and the xrpc/multiformats/cbor re-exports — and frame the package as the shared core layer atproto/bluesky build on.
    • docs: replace the placeholder example/example.md with a runnable example/example.dart covering RetryConfig/custom RetryStrategy, JWT decoding, Blob serialization, and app-password validation.
    • chore: bump xrpc to ^1.1.2, at_primitives to ^1.1.1, and atproto_oauth to ^0.5.1.
    Open source →
  7. 2.0.0 16 Jul 2026
    Release notes
    • feat!: OAuth requests are now driven by OAuthSessionManager; ServiceContext takes oAuthSessionManager instead of oAuthSession, enabling transparent OAuth token auto-refresh. OAuth tokens are never JWT-decoded. restoreOAuthSession/OauthSessionExtension removed (opaque tokens). Legacy password-auth Session is unaffected.
    • fix: OAuth requests target the session's PDS even when the OAuthSessionManager restores its session lazily — previously every request defaulted to bsky.social, causing spurious 401s.
    • fix: a caller-supplied Authorization header (e.g. a service-auth Bearer token) is preserved instead of being overwritten by the session/DPoP token, fixing service-auth flows such as video upload.
    • fix: concurrent expired requests now share a single legacy-session refresh instead of issuing a refresh stampede.
    • feat: stream() accepts a service override and a channelFactory, and honors the configured protocol; the use_dpop_nonce retry awaits the nonce write before retrying.
    • fix: a failing user-supplied DPoP nonce-cache write on the request success path is now contained instead of escaping as an uncaught asynchronous error, so a storage failure in DPoPNonceCache.set can no longer crash the app.
    • fix: the rate-limit retry wait now parses the HTTP-date form of Retry-After (previously only delta-seconds was honored; a date silently degraded to plain backoff and could retry too early).
    • perf: ServiceContext.service caches the resolved PDS endpoint per access JWT instead of base64/JSON-decoding the access token on every request when the did document has no #atproto_pds service.
    • feat: retries are now driven by a pluggable RetryStrategy (FutureOr<Duration?> nextDelay(RetryContext)). RetryContext exposes the attempt count, failure RetryReason, request kind (query vs procedure), NSID, status code, and the server-provided Retry-After. Implement RetryStrategy for full control over backoff and which failures retry; the default RetryConfig now implements it.
    • fix: by default a procedure (POST) is no longer retried after an ambiguous failure the server may already have applied (a timeout after the request was sent, a 5xx, or an inconclusive connection reset), preventing duplicate writes. Queries (GET) and subscriptions still retry as before, and 429/pre-connection network failures still retry for procedures. Set RetryConfig(retryProcedureOnAmbiguousFailure: true) to restore the previous unconditional behavior.
    Open source →
  8. 1.3.0 13 Jul 2026
    Release notes
    • feat: automatic access-token refresh — Challenge now retries once after refreshing on a genuine 401, with a pre-emptive refresh when the token is within 30s of expiry (the use_dpop_nonce path is unchanged).
    • fix: Challenge now retries 429 (respecting ratelimit-reset/Retry-After), SocketException, and ClientException, and preserves the XRPCResponse<T> type — previously only TimeoutException and 500 were retried and the type was erased.
    • fix: car_decoder handles variable-length multihash CIDs and raises a typed CarException on truncated input; tag-42 CID links are normalized to {$link: <cid>} so downstream keeps type info, and the triple jsonEncode/jsonDecode round-trip is gone.
    • fix: decodeCar now normalizes plain (non-tagged) CBOR byte strings to {$bytes: <base64>} (standard base64, RFC 4648 section 4, no padding) per the atproto data model, instead of returning raw Uint8List.
    • fix: atprotoPdsEndpoint keeps an explicit port, falls back to the JWT aud when the did document has no #atproto_pds, and guards malformed did documents.
    • fix: caller-supplied headers can no longer override Authorization/DPoP; dpop-nonce lookup is case-insensitive.
    • fix: empty $unknown maps are stripped from the wire JSON.
    • fix: unify on the validating NsidConverter; the non-validating NSIDConverter alias is deprecated.
    • chore: bump xrpc to ^1.1.0, at_primitives to ^1.1.0, multiformats to ^1.1.0, and atproto_oauth to ^0.4.0.
    Open source →
  9. 1.2.2 10 Jul 2026
    Release notes
    • fix: redact accessJwt/refreshJwt in Session.toString() so credentials are not leaked through logs or crash reporters.
    • fix: forward the headers argument in BaseHttpService.post (previously dropped).
    • fix: retry jitter is now inclusive [min, max] and no longer throws a RangeError when maxInSeconds is 0.
    • chore: bump atproto_oauth and multiformats.
    Open source →
  10. 1.2.1 20 May 2026
    Release notes
    • chore: bump atproto_oauth.
    Open source →
  11. 1.2.0 20 Feb 2026
    Release notes
    • fix: optional jwt scope and auth identity. (#2224)
    Open source →
  12. 1.1.0 20 Dec 2025
    Release notes
    • Add optional $service parameter to video service methods (getJobStatus, getUploadLimits, uploadVideo).
    • Export nanoid and @Protected annotation from atproto_core/internals.dart.
    Open source →
  13. 1.0.7 25 Sep 2025
    Release notes
    • MIGRATION: Updated to use the consolidated at_primitives package for all primitive AT Protocol types.
    • IMPROVEMENT: Simplified dependency management by adopting unified primitive types from at_primitives.
    Open source →
  14. 1.0.6 10 Aug 2025
    Release notes
    • fix: Drop universal_io for WASM compatibility.
    Open source →
  15. 1.0.5 10 Aug 2025
    Release notes
    • chore: fix WARNING: The annotation 'JsonSerializable.new' can only be used on classes..
    Open source →
  16. 1.0.4 09 Aug 2025
    Release notes
    • chore: optimized structures.
    Open source →
  17. 1.0.3 06 Aug 2025
    Release notes
    • chore: Removed outdated processes.
    Open source →
  18. 1.0.2 30 Jul 2025
    Release notes
    • Fix SDK constraint to '">=3.8.0 <4.0.0"'.
    Open source →
  19. 1.0.1 28 Jul 2025
    Release notes
    • chore: optimized docs.
    Open source →
  20. 1.0.1-legacy 28 Jul 2025 pre-release

    Nothing published for this version

  21. 1.0.0 18 Jul 2025
    Release notes
    • Jwt.aud is now nullable based on RFC 7519. (#1982)
    • Bump SDK constraint to '^3.8.0'.
    Open source →
  22. 1.0.0-preview.1 09 Jul 2024 pre-release

    Nothing published for this version

  23. 1.0.0-preview.0 04 Jul 2024 pre-release

    Nothing published for this version

  24. 1.0.0-legacy 24 Jul 2025 pre-release

    Nothing published for this version

  25. 0.11.2 07 Dec 2024
    Release notes
    • Bump xrpc.
    Open source →
  26. 0.11.1 19 Nov 2024
    Release notes
    • Retry if a DPoP nonce error occurs during the execution of OAuthClient.refresh.
    • Add restoreOAuthSession function.
    Open source →
  27. 0.11.0 16 Nov 2024
    Release notes
    • Expose atproto_oauth package.
    • Add .oAuthSession parameter on ServiceContext.
    • Rename AuthToken to Jwt.
      • Change type of scope from enum to String
      • Rename subject to sub
      • Rename expiresAt to exp
      • Rename issuedAt to iat
    • Rename extended getters on Session
      • From accessToken to accessTokenJwt
      • From refreshToken to refreshTokenJwt
    Open source →
  28. 0.10.6 04 Nov 2024
    Release notes
    • Add service parameter on ServiceContext.get and ServiceContext.post. (#1783)
    Open source →
  29. 0.10.5 02 Jul 2024
    Release notes
    • Expose NsidConverter.
    • Add client parameter for .get and .post on ServiceContext.
    Open source →
  30. 0.10.4 01 Jul 2024
    Release notes
    • Expose .atprotoPdsEndpoint from as an extension of Session. You can get specific pds endpoint based on did document.
    Open source →
  31. 0.10.3 01 Jul 2024
    Release notes
    • Change the type .collection property from String to NSID on AtUri. You need to do .collection.toString() when you want a string of collection. (#1551)
    Open source →
  32. 0.10.2 09 Jun 2024
    Release notes
    • The service is automatically resolved from the DID Document of the given Session. (#1543)
      • If no authentication is performed and no Session is passed, the default bsky.social is used.
      • If the user passes a specific service, it always respects the value of the user's service.
      • If something wrong happens for some reason, it uses bsky.social as default.
    Open source →
  33. 0.10.1 06 Jun 2024
    Release notes
    • Fixed a bug that prevented toJson on freezed objects.
    Open source →
  34. 0.10.0 03 Jun 2024
    Release notes
    • Add .active and .status properties on Session object. (#1516)
    • Move BlobConverter, Blob, BlobRef from atproto package to atproto_core.
    Open source →
  35. 0.10.0-preview.2 01 Feb 2024 pre-release

    Nothing published for this version

  36. 0.10.0-preview.1 29 Jan 2024 pre-release

    Nothing published for this version

  37. 0.10.0-preview.0 21 Jan 2024 pre-release

    Nothing published for this version

  38. 0.9.10 28 May 2024
    Release notes
    • Don't include Auth headers in .headers.
    Open source →
  39. 0.9.9 28 May 2024
    Release notes
    • Add appPassPrivileged on AuthScope. (#1501)
    • Add .headers property. Returns the merged headers with global headers and auth header.
    Open source →
  40. 0.9.8 18 Apr 2024
    Release notes
    • Add authFactorToken parameter on createSession. (#1412)
    • Add emailAuthFactor on Session. (#1412)
    Open source →
  41. 0.9.7 27 Mar 2024
    Release notes
    • Add global .headers on ServiceContext. (#1360)
    Open source →
  42. 0.9.6 25 Feb 2024
    Release notes
    • Upgrade at_uri. (#1300)
    Open source →
  43. 0.9.5 22 Feb 2024
    Release notes
    • Added .toUtcIso8601String on ServiceContext. (#1278)
    • Bump SDK constraint to '^3.3.0'.
    Open source →
  44. 0.9.4 18 Feb 2024
    Release notes
    • Improved redundant error messages. Now it shows like GET https://bsky.social/xrpc/com.atproto.identity.resolveHandle 400 Error: Params must have the property "handle". (#1253)
    • Exposed .service and .relayService properties on ServiceContext. (#1254)
    • Added parameters arg and you can pass bytes to body arg on .post method. (#1252)
    • BugFix: Made sure to check if the subscribeRepos blocks can be decoded. (#1239)
    Open source →
  45. 0.9.3 27 Jan 2024
    Release notes
    • Upgrade dependencies. (#1217)
    • Added headers parameter for .get method on ServiceContext.
    Open source →
  46. 0.9.2 30 Dec 2023
    Release notes
    • Upgrade dependencies. (#1159)
    Open source →
  47. 0.9.1 29 Dec 2023
    Release notes
    • Upgrade dependencies. (#1146)
    Open source →
  48. 0.9.0 25 Dec 2023
    Release notes
    • Removed base_xrpc_service. (#1127)
    Open source →
  49. 0.8.1 21 Dec 2023
    Release notes
    • Upgraded xrpc.
    Open source →
  50. 0.8.0 19 Dec 2023
    Release notes
    • Upgraded NSID. (#1112)
    • The following methods of BaseXRPCService now require an NSID argument. Immutable NSIDs are preferred. (#1114)
    • Removed streamService and added relayService instead. Defaults to bsky.network. (#1116)
    Open source →
  51. 0.7.0 17 Dec 2023
    Release notes
    • Removed AuthType and ClientResolver. Let the server handle whether authentication is required or not. (#1102)
    Open source →
  52. 0.6.3 24 Nov 2023
    Release notes
    • Added cardyb.bsky.app as defaultLinkPreviewService. (#1009)
    Open source →
  53. 0.6.2 24 Nov 2023
    Release notes
    • Added AuthType.authOptional. (#1012)
    Open source →
  54. 0.6.1 15 Nov 2023
    Release notes
    • Added BaseHttpService.post. (#999)
    • Fixed a bug that service names were not specified correctly when using stream endpoints.
    Open source →
  55. 0.6.0 09 Nov 2023
    Release notes
    • Added HTTP specific client. (#989)
    • Renamed from UserContext to AuthType.
    Open source →
  56. 0.5.9 01 Nov 2023
    Release notes
    • Added .deleteSession function. (#963)
    • Added didDoc field on Session object. (#968)
    Open source →
  57. 0.5.8 31 Oct 2023
    Release notes
    • Upgraded xrpc package.
    Open source →
  58. 0.5.7 28 Sep 2023
    Release notes
    • Added isEmailConfirmed field on Session. (#856)
    Open source →
  59. 0.5.6 17 Sep 2023
    Release notes
    • Upgraded xrpc package. Fixed field names for rate limit.
    Open source →
  60. 0.5.5 14 Sep 2023
    Release notes
    • Upgraded at_uri. (#797)
    Open source →

Every package, every release, already written down.

The archive is open and free. Watching your own project is what we are building next.

Browse the archive