v3.1.0

What's Changed

• fix(cli,share-sdk): sign the delivery address so share --notify sends the invite (TC-571) by @samgbafa in #434
• fix(cli): bring profile delete, local rotate and import rollback under the profile lock (TC-548) by @samgbafa in #435
• fix(sdk,server): decide session refresh and registry retry from typed 401/403 (TC-550) by @samgbafa in #436
• ci(release): require a maintainer sign-off for major bumps (TC-615) by @samgbafa in #433
• fix(sdk): reads keep working on a full space; one typed storage error (TC-619) by @samgbafa in #437
• fix(operations,cli): missing-secret setup link opens Secret Manager with the name filled in (TC-649) by @samgbafa in #438
• fix(sdk-core): stamp policy root revocations in whole seconds (TC-601) by @samgbafa in #439
• chore(tests): make @tinycloud/sdk-services-test private (TC-654) by @samgbafa in #440
• fix(cli,share-sdk): share notify refusals, window, already-delivered and domain invites (TC-635) by @samgbafa in #441
• fix(mcp): publish an Android-resolvable CNAME for mcp.tinycloud.xyz (TC-606) by @samgbafa in #442
• fix(operations,cli,node-sdk): hold replayed compact delegations to their request binding (TC-602) by @samgbafa in #443
• fix(operations,cli): profile lock safe against paused processes, older releases and missing hard links (TC-633) by @samgbafa in #445
• fix(sdk,cli,operations,mcp): decide auth errors from typed status everywhere (TC-634) by @samgbafa in #447
• fix(cli): PROFILE_NOT_FOUND for auth logout/login on a missing profile (TC-682) by @samgbafa in #448
• fix(sdk-services): apply the configured timeout to SQL, KV and DuckDB requests by @huntertinycloud in #425
• feat(cli): record and warn on a non-primary OpenKey key; --owner on plain login (TC-705) by @samgbafa in #449
• feat(cli,operations,vfs): one storage-full mapping for every command and tool (TC-625) by @samgbafa in #444
• TC-608: Accept short OpenKey delegation codes in tc login by @samgbafa in #451
• fix(cli,operations,node-sdk): expired sessions ask for sign-in; approved escalations authorize secrets get (TC-607, TC-609) by @samgbafa in #446
• feat(TC-736): KV change feed client, kv/sync registry and explicit-only wildcard guard by @samgbafa in #452
• feat(TC-18): durable read-only CLI replica (@tinycloud/replica + tc replica) by @samgbafa in #453
• test(TC-733): verify TinyCloud Secrets under a CLI local replica by @samgbafa in #454
• feat(TC-800): add the agents space to canonical account onboarding by @samgbafa in #455
• feat(TC-19): browser local replica (@tinycloud/replica/browser) by @samgbafa in #456
• fix(TC-747): owner can revoke a device grant from the CLI by @samgbafa in #457
• fix(TC-820): hooks stream recovers instead of crashing the Node process by @samgbafa in #458
• fix(TC-738): KV batchGet/batchHead return the right value for unsorted keys by @samgbafa in #459
• docs(replica): add package README for Replication RC1 by @samgbafa in #461
• fix(TC-756, TC-757): private get -o outputs; logout removes local replicas by @samgbafa in #460
• docs(TC-848): mark local replicas as beta for the stable release by @samgbafa in #462
• delegateTo: onPrepared hook to record a grant before activation (TC-839) by @samgbafa in #463

New Contributors

• @huntertinycloud made their first contribution in #425

Full Changelog: v3.0.0...v3.1.0