v0.42.1

What's Changed

Breaking Changes

• Per-resource OAuth scope guards: Narrow the 0.42.0 guard so rpc: scopes are only required for XRPC calls that set an atproto-proxy target, direct PDS traffic is authorized by repo: / blob: alone, and legacy transition:generic sessions authorize every resource except chat.bsky.* RPCs. com.atproto.repo.uploadBlob now takes SwiftAtproto.XRPCBlobUpload (payload plus MIME type) instead of Foundation.Data, so its Content-Type can be matched against the granted BlobScope.accept patterns; callers must wrap payloads at the call site. (#120)

Bug Fixes

• Lenient XRPC response decoding: Introduce LexiconDecodingMode and thread .permissive through the XRPC response path so generated Lexicon models accept payloads that exceed authoring constraints (such as maxLength, maxGraphemes, or array limits) coming back from a server. Encoding, make(...) factories, and standalone decoders continue to enforce constraints under the default .strict mode. (#121)