mdbase connect v0.1.0-beta.148

Files containing UNSIGNED are preview builds, not trusted platform releases. Those Windows files may show Unknown Publisher or SmartScreen warnings; those macOS files require a manual Privacy & Security override and have not been notarized. Checksums and GitHub OIDC-backed Sigstore bundles establish build provenance but do not replace platform signing.

What's Changed

• Tighten CORS origin allowlist by @callumalpass in #952
• Retire legacy TaskNotes reminders on native reconciliation by @callumalpass in #959
• Rebind a computer's device when it signs in again by @callumalpass in #973
• Unblock rollback of fenced migrations with outstanding gen0 tickets by @callumalpass in #987
• Defer #952, #959 and #973 until after the bulk migration by @callumalpass in #988
• Prepare v0.1.0-beta.144 by @callumalpass in #989
• Route back a stopped run with a legacy read outstanding at Created by @callumalpass in #990
• Prepare v0.1.0-beta.145 by @callumalpass in #991
• Support declared native loopback applications by @callumalpass in #992
• Align scoped-hosted archive fence counters with provider settlement semantics (in_flight only) by @callumalpass in #993
• i18n: shared @mdbase-dev/i18n kit by @callumalpass in #961
• Prepare v0.1.0-beta.146 by @callumalpass in #994
• i18n: multilingual mdbase Connect portal and desktop (9 locales) by @callumalpass in #962
• i18n: multilingual mdbase editor (Connect apps/editor) (9 locales) by @callumalpass in #963
• i18n: Italian (Connect + kit) by @callumalpass in #972
• docs: correct Editor and portal account authority boundary by @callumalpass in #999
• fix: keep migration-pending timers from blocking due batches by @callumalpass in #1000
• fix(sdk): avoid bound receivers in timer fetch calls by @callumalpass in #1001
• fix(sdk): skip unused SQLite async OPFS probes by @callumalpass in #1002
• fix(server): deliver installation revocations to the log immediately by @callumalpass in #1004
• Supersede a rolled-back hosted migration run for a newer start by @callumalpass in #1006
• Add operator re-arm for routed-back managed accounts by @callumalpass in #1008
• fix(hosted-worker): build hosted.wasm from the runtime workspace by @callumalpass in #1010
• Re-arm: test the fresh attempt end to end; refuse a supersede past the base by @callumalpass in #1011
• Prepare v0.1.0-beta.147 by @callumalpass in #1009
• Restore feedback configuration in native Editor builds by @callumalpass in #1012
• Load the shared Editor feedback stylesheet by @callumalpass in #1015
• Let the MCP gateway connect to collections on the updated mdbase by @callumalpass in #1020
• Retry migration cutover delivery and classify log failures by @callumalpass in #1023
• Preserve legacy KMS unwrap in the integrated hosted Worker by @callumalpass in #1024
• Re-land CORS credential origin restrictions by @callumalpass in #1025
• Re-land account-scoped TaskNotes reminder retirement by @callumalpass in #1027
• Re-land device rebind after computer sign-in by @callumalpass in #1026
• Carry a rebound computer's collections to its new connector by @callumalpass in #977
• Bound policy outbox verification and wake account-key revocations by @callumalpass in #1028
• fix(bases): tolerate body tags and group whole project lists by @callumalpass in #1030
• Add durable owner collection mode requests and status by @callumalpass in #1029
• Add switch-set trust and native Private-mode recovery by @callumalpass in #1031
• Give each account its own device on a computer by @callumalpass in #980
• Report collection join throttling as retryable rate limits by @callumalpass in #1035
• Fix signup onboarding when starter collections are unavailable by @callumalpass in #1038
• Clarify collection enrollment refusals and add CLI delete by @callumalpass in #1039
• Fix portal collection counts, app discovery and accessibility by @callumalpass in #1043
• Stop the desktop app leaking daemon connections, and share one status build across subscribers by @callumalpass in #1021
• docs: reconcile runtime import and legacy architecture status by @callumalpass in #950
• Prepare runtime npm metadata and manual trusted publication workflow by @callumalpass in #951
• [hold: after bulk] Keep the legacy binding on carried-over grants for local rollback by @callumalpass in #978
• feat(ui): controlled open state and trigger-less CollectionSwitcher by @callumalpass in #1018
• [hold: after bulk] Dismiss a hold's conflicts on resolve; name keep-both copies after the computer by @callumalpass in #979
• fix(editor): retain retyped values and correct accessibility labels by @callumalpass in #1045
• Select ci:local gates with Server CI's pull-request path plan by @callumalpass in #1049
• Port wildcard log CORS; ignore LOGSVC_CORS_ORIGINS by @callumalpass in #1037
• Fix daemon sync names and immediate joins after share acceptance by @callumalpass in #1040
• Bump fast-uri from 3.1.8 to 3.1.9 in /runtime/packages/mdbase by @dependabot[bot] in #975
• Bump vite from 7.3.6 to 7.3.7 in /runtime/packages/obsidian-runtime by @dependabot[bot] in #924
• Bump moment and obsidian in /runtime/packages/obsidian-runtime by @dependabot[bot] in #689
• Fix large Bases reads and diagnose readiness fences by @callumalpass in #1048
• Fix RPM build-ID conflicts with Filen and other Electron apps by @callumalpass in #1051
• Roadmap 2.2: require real log backend conformance in CI by @callumalpass in #1054
• Report skipped files and sync refusal reasons in status by @callumalpass in #1044
• Qualify runtime builds and restore managed packaging intake by @callumalpass in #1047
• fix: enforce next-runtime collection limits by @callumalpass in #1036
• Build managed Worker publications from the Connect runtime by @callumalpass in #1053
• Fix daemon sync progress and connection status by @callumalpass in #1042
• Prepare collection mode controller and service readiness by @callumalpass in #1033
• fix: propagate deleted collections to joined computers by @callumalpass in #1041
• Roadmap 0.3: retry transport failures and unpark policy queues by @callumalpass in #1052
• Enforce Viewer access and protect local text edits by @callumalpass in #1046
• Roadmap 1.1: stall build-dependent replay checks by @callumalpass in #1057
• Bump sharp and wrangler in /tools/editor-native-publisher by @dependabot[bot] in #965
• chore(deps): bump the workflow-actions group across 1 directory with 7 updates by @dependabot[bot] in #1005
• Fix installation revocation after collection member removal by @callumalpass in #1059
• Report the synced-collection quota instead of rate limited by @callumalpass in #1060
• Neutral copy for the Link Obsidian prompt and the pairing page by @callumalpass in #983
• build(deps-dev): bump happy-dom from 20.14.5 to 21.0.4 in /runtime/packages/obsidian-runtime by @dependabot[bot] in #974
• build(deps): bump tinypool and vitest in /runtime/packages/mdbase by @dependabot[bot] in #725
• Repin pnpm/action-setup 6.0.9 in desktop release for Intel macOS by @callumalpass in #1063
• Never leave collection setup at a screen with no way forward by @callumalpass in #1022
• Roadmap 1.3: replay earlier-SEM native entries structurally by @callumalpass in #1062
• Stop revoked collection devices with explicit recovery guidance by @callumalpass in #1064
• Name a joined collection as the account does; unknown collection is not_found by @callumalpass in #984
• Refresh SDK native pin from Connect runtime sources by @callumalpass in #1067
• Fix native Editor publication with an integrity-pinned npm UI by @callumalpass in #1068
• Scope join not-found errors and preserve membership locking (#984 review follow-up) by @callumalpass in #1069
• Fix daemon and CLI papercuts from Obsidian testing by @callumalpass in #976
• Expect sync disable to parse now that it is implemented by @callumalpass in #1070
• Dismiss conflicts from the CLI by @callumalpass in #986
• Bump rustls-webpki to 0.103.16 (RUSTSEC-2026-0382) by @callumalpass in #1074
• Prepare v0.1.0-beta.148 by @callumalpass in #1073

Full Changelog: v0.1.0-beta.143...v0.1.0-beta.148