Release Toolbox SDK 0.3.0

2026-09-02 00:58:50 +02:00
parent ef2dab4b46
commit bc91659a42
18 changed files with 1225 additions and 21 deletions
@@ -3,6 +3,22 @@
 All notable changes to the independently versioned Toolbox SDK packages are
 recorded here. The packages currently share one release version.

+## 0.3.0 — 2026-09-02
+
+### Added
+
+- Runtime-validated manifest I/O and progressive browser-capability profiles.
+- Bounded, same-origin, target-routed, expiring, one-time artifact handoffs
+  through IndexedDB, with versioned operation evidence and opaque tokens.
+
+### Security
+
+- Reject unsafe artifact names, malformed descriptors, oversized evidence,
+  excessive file counts and cross-origin handoff destinations before storage or
+  navigation.
+- Document the origin-wide IndexedDB trust boundary explicitly: target app ids
+  route transfers but cannot authorize mutually untrusted same-origin code.
+
 ## 0.2.3 — 2026-07-27

 ### Changed