v3.0.0

What's Changed

• fix(web-sdk): bound the space-creation dialog wait and honour autoCreateSpace (TC-362) by @samgbafa in #364
• ci: give the repo an unconditional gate and de-filter the merge gates (TC-380) by @samgbafa in #366
• feat(web-sdk): add one-shot OpenKey session support by @samgbafa in #365
• feat: support scoped owner share delegations by @samgbafa in #370
• TC-293: trim the cold sign-in critical path by @samgbafa in #363
• fix(web-sdk): allow CoordinationOS invite record by @samgbafa in #373
• fix(core): combine split ReCap actions by @samgbafa in #374
• fix(core): make loopback discovery opt-in (TC-13) by @samgbafa in #375
• test(bench): track Node request latency over time by @samgbafa in #372
• TC-373: batch the account-bootstrap seed-spaces writes by @samgbafa in #369
• TC-401: add bearer Share CLI vertical slice by @samgbafa in #371
• perf(TC-290): SDK bundle hygiene — sideEffects, production detection, ES2020, wasm-opt -Oz by @samgbafa in #377
• perf(TC-291): drop the crypto-browserify tree from the browser bundle by @samgbafa in #379
• feat: consume versioned OpenKey authorization flow by @samgbafa in #378
• TC-405: unified delegation resolver by @samgbafa in #381
• TC-393: bootstrap recovery + account-space sign-in coverage (removes the probe) by @samgbafa in #380
• TC-405: harden SDK delegation provenance by @samgbafa in #382
• TC-463: add active-session credential acquisition flow by @samgbafa in #383
• chore(release): exit pre mode — cut a stable SDK release by @samgbafa in #384
• fix(TC-469/TC-292): make the web-sdk-example e2e suite run, and prove SIWE sign-in by @samgbafa in #385
• test(node-sdk): cf-node hooks parity oracle (TC-402 Stage 1) by @samgbafa in #391
• test(node-sdk): add cf-node default (no-manifest) sign-in acceptance gate (TC-482) by @samgbafa in #392
• TC-470/471: support policy credential presentation and v3 shares by @samgbafa in #386
• chore(release): re-enter beta mode for TC-493 by @samgbafa in #394
• fix(release): block unconfirmed major betas (TC-493) by @samgbafa in #396
• feat(sdk): OAuth canonical manage-key signer by @samgbafa in #393
• fix(TC-490): add explicit major beta release path by @samgbafa in #397
• feat(TC-500): accountless share receiving by @samgbafa in #399
• fix(TC-500): restore account sessions for automatic share receive by @samgbafa in #400
• feat(TC-500): expose received share metadata by @samgbafa in #402
• fix(TC-500): verify compact UCAN roots in browsers by @samgbafa in #403
• fix(TC-500): unblock production receiver ceremony by @samgbafa in #404
• fix(cli): honor Share JSON output by @samgbafa in #405
• feat(cli): add Share-first device authorization by @samgbafa in #406
• fix(TC-13): use hosted OpenKey device API by @samgbafa in #407
• fix: target embedded Node policy runtime by @samgbafa in #410
• fix(TC-500): correct beta release plan by @samgbafa in #411
• feat: expose the complete secrets catalog by @samgbafa in #409
• chore(TC-500): record published beta versions by @samgbafa in #412
• feat: add TinyCloud-native sharing happy path by @samgbafa in #413
• fix(TC-500): seal addressed delivery metadata by @samgbafa in #414
• feat(TC-500): polished exact-email claim view with 8-digit codes by @samgbafa in #416
• feat(TC-500): receive email-domain shares with recipient-chosen mailboxes by @samgbafa in #417
• feat(sdk-core): default session lifetime to 30 days by @samgbafa in #418
• fix(cli,sdk): publish Share links from OpenKey sessions (TC-538) by @samgbafa in #421
• fix(cli,share-sdk): make CLI owner-only email links openable (TC-556) by @samgbafa in #423
• ci: disable Bun 1.2.0 concurrent JIT in the I0/I1 gates (TC-540) by @samgbafa in #424
• feat(cli): device login with an explicit manifest and Share publishing scope (TC-540) by @samgbafa in #422
• fix(cli): publish filenames with spaces and report storage-quota errors (TC-577) by @samgbafa in #427
• fix(cli): report OpenKey device sign-in rate limits as DEVICE_AUTH_RATE_LIMITED (TC-575) by @samgbafa in #428
• fix(share): refuse share filenames the viewer refuses, before upload (TC-580) by @samgbafa in #429
• fix(cli,sdk-core): refuse caveated share publishing before upload (TC-551) by @samgbafa in #430
• fix(mcp): store an approved delegation only for the account that requested it (TC-586) by @samgbafa in #431
• feat(TC-531, TC-530): durable, re-delegatable received shares; domain shares on the owner's terms by @samgbafa in #420
• fix(cli,node-sdk): scoped OpenKey login grants agent secret reads (TC-599) by @samgbafa in #432

Full Changelog: v2.10.0...v3.0.0