v0.49.0

Changelog

• 0ecf00b feat: add AdminRevokeAPIKey to serverdb (td-787c8f)
• b13a2c2 feat: add EmailSender interface + memory/log providers (td-b74d04)
• f38cb43 feat: add PKCE helper for CLI device login (td-011205)
• 36db2cb feat: add POST /v1/auth/device/start with PKCE challenge (td-7501b9)
• 2bbc350 feat: add POST /v1/auth/web/exchange (30-day web key) (td-1205ff)
• 8c9c67e feat: add POST /v1/auth/web/start email login endpoint (td-c40207)
• b499610 feat: add admin key revocation endpoint (td-d606a9)
• a7f9f03 feat: add admin revoke-key CLI subcommand (td-db323f)
• 197c0d9 feat: add auth email challenge store methods (td-054083)
• 6743b7a feat: add auth_email_challenges migration v4 (td-5531d1)
• b64eb0b feat: add device approval page + poll endpoint with PKCE (td-765a96)
• ac3bc12 feat: add email provider config + startup validation (td-43904b)
• ef54ad8 feat: add syncclient DeviceStart/DevicePoll PKCE methods (td-df552e)
• ed892be feat: dev-only GET /internal/dev/last-email to read last magic link (td-d55391)
• 217a97f feat: gate legacy device-auth endpoints behind SYNC_LEGACY_DEVICE_AUTH (td-8cade5)
• c33160e feat: implement Cloudflare email REST sender (td-d36311)
• 7b4f766 feat: run CleanupExpiredChallenges in background cleanup loop (td-b7849f)
• a461dec feat: td auth login uses PKCE email-approval device flow (td-1d9cfc)
• 0a1ff8a feat: wire EmailSender into server + add auth event constants (td-14455a)
• 325274e fix(deploy): don't mount S3 litestream config in prod (backups off) — was crash-looping
• e44bf9f fix(deploy): fail secure auth cutover if legacy login remains live
• 2cca421 fix(deploy): harden prod deploy.sh — optional backups, fail-closed auth validation, health gate
• 5921557 fix(deploy): pass email + secure-auth env vars to prod td-sync container (td-d255db)
• 5d9b50f fix: send Cloudflare reply_to as a string, not an object (td-ed1ade)
• 304738d fix: stop mapping SYNC_EMAIL_BASE_URL into the Cloudflare API base URL (td-d5f5ef)
• 5f8018c ops(deploy): prune docker images + build cache after remote deploy
• 42961b0 perf(serve): slim board/list payload — omit description/acceptance
• b9b861f refactor: drop misleading no-op BEGIN IMMEDIATE in ConsumeChallenge (td-054083)