ci: release

Author: github-actions[bot]

.changeset/getfeed-service-auth-aud.md

@@ -1,5 +1,13 @@
 # @getcirrus/pds
 
+## 0.17.2
+
+### Patch Changes
+
+- [#193](https://github.com/ascorbic/cirrus/pull/193) [`be57325`](https://github.com/ascorbic/cirrus/commit/be57325cde6cf0ccd5f6d5b900777da81e6b3c46) Thanks [@ascorbic](https://github.com/ascorbic)! - Address the service-auth JWT for `app.bsky.feed.getFeed` to the feed generator rather than the AppView. The token is now stamped with `aud` set to the generator's service DID (resolved from the feed record) and `lxm` set to `app.bsky.feed.getFeedSkeleton`, matching the reference PDS implementation. Previously the token carried `aud: did:web:api.bsky.app`, so generators that validate the audience (such as the Bluesky "For You" feed) rejected it and ran in a degraded, stateless mode — feeds appeared stuck because per-user "seen" state was never recorded. If the feed record can't be resolved, the request falls back to ordinary AppView proxying so the feed still loads.
+
+- [#193](https://github.com/ascorbic/cirrus/pull/193) [`be57325`](https://github.com/ascorbic/cirrus/commit/be57325cde6cf0ccd5f6d5b900777da81e6b3c46) Thanks [@ascorbic](https://github.com/ascorbic)! - Fix OAuth scope checking when proxying XRPC requests. Granular `rpc:` scopes are granted against the full `did#service_id` audience, but the proxy was checking them against the bare DID, so any granular (non-`aud=*`) scope was rejected. Proxied requests now check scope against the full service audience, while the outbound service-auth JWT continues to use the bare DID.
+
 ## 0.17.1
 
 ### Patch Changes

.changeset/proxy-rpc-scope-audience.md

@@ -1,6 +1,6 @@
 {
 	"name": "@getcirrus/pds",
-	"version": "0.17.1",
+	"version": "0.17.2",
 	"description": "Cirrus – A single-user AT Protocol PDS on Cloudflare Workers",
 	"type": "module",
 	"main": "dist/index.js",