At this level
ai.newnal.pdn.server ยท 4- ai.newnal.pdn.server.createAppPassword procedure not from the namespace authority Create an App Password bound to an OAuth scope. Sessions created from it through com.atproto.server.createSession carry exactly the permissions of that scope, as an OAuth session would. Requires a full-access session.
- ai.newnal.pdn.server.createAttestedAccount procedure not from the namespace authority Create an account on behalf of a client attested by a trusted issuer. Authenticated with a service-auth JWT (iss = trusted issuer DID, aud = this PDN, lxm = this method, exp - iat <= 60 s, unique jti). No invite code, no captcha. Without handle the server generates a memorable one; without email the server stores the placeholder <label>@newnal.id. Returns a full session, like createAccount; clients that need a scoped session create a scoped app password with it.
- ai.newnal.pdn.server.listAppPasswords query not from the namespace authority List all App Passwords with their OAuth scope. An entry without scope is an unscoped app password created through com.atproto.server.createAppPassword.
- ai.newnal.pdn.server.suggestHandle query not from the namespace authority Suggest free, memorable English two-word handles under this PDN's service domain. A suggestion is not a reservation. Fewer handles than count may be returned; HandleGenerationFailed when none could be found.