# Changelog
All notable changes to this project will be documented in this file.
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
## [0.7.2](https://github.com/cachekit-io/cachekit-core/compare/cachekit-core-v0.7.1...cachekit-core-v0.7.2) (2026-10-26)
### Performance Improvements
* **byte-storage:** borrow envelope payloads under 64 KiB on retrieve (LAB-7118) ([#132](https://github.com/cachekit-io/cachekit-core/issues/132)) ([7305b3b](https://github.com/cachekit-io/cachekit-core/commit/7305b3b6c85631fc27caa7d7d7c0cc6b8a1565c9))
* **byte-storage:** encode store envelopes under 64 KiB into a buffer sized once (LAB-7118) ([#131](https://github.com/cachekit-io/cachekit-core/issues/131)) ([ac2bfe6](https://github.com/cachekit-io/cachekit-core/commit/ac2bfe642c1140136960647b0216eac597feb584))
* **byte-storage:** lz4_flex unsafe encoder, literals-only block below 64 B (LAB-7140) ([257aa0a](https://github.com/cachekit-io/cachekit-core/commit/257aa0a5904539405e88666903d3e477d6d89981))
* **encryption:** seal wasm32 AES-GCM in one buffer (LAB-7138) ([#129](https://github.com/cachekit-io/cachekit-core/issues/129)) ([ca409f2](https://github.com/cachekit-io/cachekit-core/commit/ca409f2a9259d938d288cc69421cfe4e47b7133f))
## [0.7.1](https://github.com/cachekit-io/cachekit-core/compare/cachekit-core-v0.7.0...cachekit-core-v0.7.1) (2026-10-24)
### Bug Fixes
* **bench:** measure cachekit-core's own calls for the README performance table (LAB-10638) ([#117](https://github.com/cachekit-io/cachekit-core/issues/117)) ([c96707c](https://github.com/cachekit-io/cachekit-core/commit/c96707c83b2cdb92a756420fd264c97636cc3fcf))
### Performance Improvements
* **encryption:** seal in one buffer so encrypt allocates and copies once (LAB-10640) ([#127](https://github.com/cachekit-io/cachekit-core/issues/127)) ([58a4bcb](https://github.com/cachekit-io/cachekit-core/commit/58a4bcbce2c34fa9a44cd7a290887c99bca9928f))
* **msgpack:** report the document length from the structural walk (LAB-10538) ([#120](https://github.com/cachekit-io/cachekit-core/issues/120)) ([b695bb3](https://github.com/cachekit-io/cachekit-core/commit/b695bb3e4f75ab5a5b69cd91e7db58f23a12631e))
## [0.7.0](https://github.com/cachekit-io/cachekit-core/compare/cachekit-core-v0.6.0...cachekit-core-v0.7.0) (2026-10-08)
### ⚠ BREAKING CHANGES
* **core:** cachekit_core::metrics, cachekit_core::OperationMetrics, ByteStorage::get_last_metrics(), ZeroKnowledgeEncryptor::get_last_metrics() and the metrics cargo feature are removed.
### Features
* **msgpack:** export check_msgpack_structure as the shared structural walk (LAB-2735) ([#88](https://github.com/cachekit-io/cachekit-core/issues/88)) ([f29965d](https://github.com/cachekit-io/cachekit-core/commit/f29965def98117b9dae12a88e6243325255d666c))
### Bug Fixes
* **build:** build cbindgen only with the ffi feature (LAB-7382) ([#102](https://github.com/cachekit-io/cachekit-core/issues/102)) ([fdfba3d](https://github.com/cachekit-io/cachekit-core/commit/fdfba3da99930252fa52b7f1abeaacdc3e9903bb))
* **byte-storage:** pre-scan envelope bytes before decoding them (LAB-3479) ([a043e13](https://github.com/cachekit-io/cachekit-core/commit/a043e131c1ea7ed824325730380f3ff0cd9545f6))
* **encryption:** probe the Armv8 Crypto Extension on aarch64 instead of NEON (LAB-4650) ([#77](https://github.com/cachekit-io/cachekit-core/issues/77)) ([77b18db](https://github.com/cachekit-io/cachekit-core/commit/77b18db184c74254a52b8bed0be76e9f7a38fea5))
### Performance Improvements
* **bench:** add a fixed-iteration Ir/op gate for the hot paths (LAB-7802) ([#106](https://github.com/cachekit-io/cachekit-core/issues/106)) ([dce166b](https://github.com/cachekit-io/cachekit-core/commit/dce166bebebc335958b44fb48b47cd7e27bcc485))
* **bench:** make hot_path compile by default, representative and profile-able (LAB-7039) ([#97](https://github.com/cachekit-io/cachekit-core/issues/97)) ([11e9836](https://github.com/cachekit-io/cachekit-core/commit/11e98363f3353552549cc9432af89c592c04b767))
### Code Refactoring
* **core:** delete the OperationMetrics module and metrics feature (LAB-7325) ([3ec5456](https://github.com/cachekit-io/cachekit-core/commit/3ec54565fe16aa70012a346c35fb170887fb3246))
## [0.6.0](https://github.com/cachekit-io/cachekit-core/compare/cachekit-core-v0.5.0...cachekit-core-v0.6.0) (2026-08-08)
### Features
* cache keyring per-tenant derivation at construction via TenantKeyring (LAB-1638) ([#71](https://github.com/cachekit-io/cachekit-core/issues/71)) ([d3f0eb0](https://github.com/cachekit-io/cachekit-core/commit/d3f0eb05f6861c4c10a3f44e920f0f34c1aa1508))
* expose winning-key index via decrypt_indexed for rotation drain observability (LAB-1645) ([#73](https://github.com/cachekit-io/cachekit-core/issues/73)) ([d834f74](https://github.com/cachekit-io/cachekit-core/commit/d834f74ede16bfc9ca812f6881f341caabe6e3c4))
## [0.5.0](https://github.com/cachekit-io/cachekit-core/compare/cachekit-core-v0.4.0...cachekit-core-v0.5.0) (2026-08-07)
### ⚠ BREAKING CHANGES
* public items EncryptionHeader, KeyRotationState, RotationAwareHeader, and ZeroKnowledgeEncryptor::rotate_key() are removed (EncryptionError::NotImplemented variant included). Use Keyring for master-key rotation.
### Features
* replace dead key-rotation machinery with keyring decrypt helper (LAB-683) ([#67](https://github.com/cachekit-io/cachekit-core/issues/67)) ([327f993](https://github.com/cachekit-io/cachekit-core/commit/327f993877a3c409ba86dc0f76431ba4bb64d575))
## [0.4.0](https://github.com/cachekit-io/cachekit-core/compare/cachekit-core-v0.3.0...cachekit-core-v0.4.0) (2026-07-27)
### Features
* emit StorageEnvelope compressed_data as msgpack bin (protocol 1.1) (LAB-866) ([#59](https://github.com/cachekit-io/cachekit-core/issues/59)) ([c691087](https://github.com/cachekit-io/cachekit-core/commit/c69108763dea380f9768b23b885dca2e73bae51d))
## [0.3.0](https://github.com/cachekit-io/cachekit-core/compare/cachekit-core-v0.2.1...cachekit-core-v0.3.0) (2026-07-15)
### Features
* standalone checksum-only integrity API ([#13](https://github.com/cachekit-io/cachekit-core/issues/13)) ([#50](https://github.com/cachekit-io/cachekit-core/issues/50)) ([afced1a](https://github.com/cachekit-io/cachekit-core/commit/afced1a7e777103b95b4110c7e89e809a1d4d8de))
### Performance Improvements
* borrow input in ByteStorage write path instead of copying it ([#48](https://github.com/cachekit-io/cachekit-core/issues/48)) ([7f5ebc1](https://github.com/cachekit-io/cachekit-core/commit/7f5ebc1410ee0d16b5c31b4d19097d3d9e1d5582))
## [0.2.1](https://github.com/cachekit-io/cachekit-core/compare/cachekit-core-v0.2.0...cachekit-core-v0.2.1) (2026-05-31)
### Bug Fixes
* use local> preset ref for private renovate-config repo ([#29](https://github.com/cachekit-io/cachekit-core/issues/29)) ([80355a4](https://github.com/cachekit-io/cachekit-core/commit/80355a49806b36a2b759be9fdfd9e0536cd43476))
### Security
* seed nonce instance counter with 8 random bytes, raising cross-process collision resistance from 2^32 to 2^64 (HIGH-2/HIGH-3) ([#36](https://github.com/cachekit-io/cachekit-core/issues/36)) ([af3d5fe](https://github.com/cachekit-io/cachekit-core/commit/af3d5fec0d66a95fb2b8994bbdb761ec01cede9d))
## [0.2.0](https://github.com/cachekit-io/cachekit-core/compare/cachekit-core-v0.1.1...cachekit-core-v0.2.0) (2026-03-16)
### Features
* add wasm32-unknown-unknown platform support ([#22](https://github.com/cachekit-io/cachekit-core/issues/22)) ([911dbce](https://github.com/cachekit-io/cachekit-core/commit/911dbce82f14ee7e32926ece3a79d001300e1252))
## [0.1.1](https://github.com/cachekit-io/cachekit-core/compare/cachekit-core-v0.1.0...cachekit-core-v0.1.1) (2025-12-18)
### Bug Fixes
* downgrade to edition 2021 and MSRV 1.80 for stable Rust compatibility ([#16](https://github.com/cachekit-io/cachekit-core/issues/16)) ([da5ced5](https://github.com/cachekit-io/cachekit-core/commit/da5ced5712cc88fe4f6ab966fbc39b79fcdfa089))
## [0.1.0](https://github.com/cachekit-io/cachekit-core/compare/cachekit-core-v0.0.1...cachekit-core-v0.1.0) (2025-12-05)
### Features
* initial release ([6dbe9b1](https://github.com/cachekit-io/cachekit-core/commit/6dbe9b1e30173395fdf51bfab457898be8515291))
## [Unreleased]
### Added
- **ByteStorage**: LZ4 compression with xxHash3-64 checksums
- Automatic compression/decompression
- Integrity verification on retrieval
- Decompression bomb protection (512MB limit, 1000x ratio limit)
- **ZeroKnowledgeEncryptor**: AES-256-GCM encryption
- Counter-based nonce generation (prevents reuse)
- Hardware acceleration detection (AES-NI, ARM Crypto)
- Operation metrics for observability
- **Key Derivation**: HKDF-SHA256 (RFC 5869)
- Domain separation for multi-use keys
- Tenant isolation via salt
- Key fingerprinting for rotation support
- **C FFI Layer**: Multi-language support
- Opaque handle management
- Panic-safe error handling
- Auto-generated `cachekit.h` header
- **Security Infrastructure**
- 16 fuzz targets covering all attack surfaces
- Kani formal verification proofs
- Property-based testing with proptest
- `cargo-deny` supply chain security
### Security
- All key material zeroized on drop
- Constant-time operations for encryption via `ring`
- No panics in library code (Result-based error handling)
- FFI boundary hardened with `catch_unwind`
[Unreleased]: https://github.com/cachekit-io/cachekit-core/compare/main...HEAD