Release Bookdock v0.3.2 · BookdockDevs/bookdock

[0.3.2] - 2026-09-21

External clients can use operation-scoped access tokens with explicit permissions, lifecycle management, and safe cross-origin range access.
Reader progress, TOC boundaries, annotation identity, and font fallback are more reliable across initial saves, duplicate chapter labels, cancelled chapters, and missing glyphs.
Authentication transitions and reader loading now recover cleanly without exposing protected pages or producing duplicate redirects and error notifications.

Operation-scoped bd_ access tokens with hashed storage, expiration, enable/disable and delete operations, permission checks, token CORS, and redacted logging.
Persisted annotation chapterHref metadata with a database migration so repeated chapter titles remain distinct in notes, exports, and AI ideas.
Reader font fallback for CJK and symbol glyphs across system, CDN, and uploaded fonts.

Token authorization is limited to an explicit operation registry; range response headers are exposed for remote EPUB reads without adding credentialed cross-origin access.
Reader progress seeding now uses the complete server response, TOC selection uses active chapter boundaries, and annotation grouping/export follows stable chapter hrefs instead of display labels.
Web authentication revalidation keeps protected pages hidden, suppresses duplicate 401 redirects, and makes book action notifications identify the affected book.

Saving the first reading progress no longer leaves the cache at { data: null } when the server has already returned a complete progress record.
The active TOC now loads the actual current directory boundaries; the first real chapter remains non-cancellable while later chapters can be cancelled and submitted correctly.
Duplicate chapter labels no longer merge annotations, and missing CJK or symbol glyphs now fall back to an available font.