# Changelog

All notable changes to this project will be documented in this file.

The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).


### Features

- add AutoStrategyBuilder, Option<T> KeyProvider, and SecretKey::from_hex
- ✨ add SecretKey::from_env for loading client key from environment
- 🔊 add tracing::debug to key provider resolution paths

### Fixes

- ✏️ fix error message to match JWT claim name (`services` not `service`)
- 🐛 resolve ZeroKMS base URL when using caller-provided service tokens
- 🔒️ take owned String in SecretKey::from_hex to zeroize key material
- 🩹 remove unnecessary bytes.clone() and improve MissingWorkspaceCrn message
- 🚨 remove unused mut on bytes after clone removal
- 🩹 address PR review feedback

### Refactoring

- change index_key field to private in Encryption struct



### Fixes

- update vitaminc imports for 0.1.0-pre4.2 module restructure




### Features

- add multi-workspace profile support (CIP-2942)
- require workspace to exist before switching

### Miscellaneous

- release


### Miscellaneous

- updated the following local packages: cipherstash-config, cipherstash-core, cts-common, cts-common, stack-profile, zerokms-protocol, stack-auth, stack-auth


### Miscellaneous

- release
- use explicit versions for cipherstash-client and stack-auth


### Fixes

- address PR feedback for canonical encryption config

### Miscellaneous

- release v0.34.1-alpha.2
- fmt

### Refactoring

- rename ColumnType::Utf8Str to Text with serde alias for backwards compat
- rename ColumnType::JsonB to Json with serde alias for backwards compat


### Documentation

- correct scheme name from CLLW to CLWW
- docs(eql)+test(cipherstash-config): 📝 address PR review feedback

### Features

- add OR-style decryption policies for lock context
- ✨ add OPE indexer alongside ORE

### Fixes

- fix(cipherstash-client)\!: 🔒 derive a domain-separated OPE key from `IndexKey`
- 🔒 widen ORE plaintexts to 8-byte block to preserve wire format

### Refactoring

- ♻️ adopt orderable-bytes for fixed-length encoders
- 👔 dispatch ORE indexing through native ore-rs impls
- 🔥 replace `IntoOrePlaintext` with `orderable_to_u64` helper

### Testing

- 🧪 pin ORE wire format with golden-vector tests

### Style

- early return in retrieve_key_payload


### Documentation

- 📝 address Copilot review feedback on Layer 2 PR
- 📝 add rustdoc to json_indexer module
- 📝 drop "Task 10" planning artefact from OrderableTerm doc

### Features

- ✨ add mode field to IndexType::SteVec
- ✨ thread SteVecMode through JsonIndexerOptions
- ✨ add HmacSha256PrefixMac
- ✨ add NewPrefixMac construction trait
- ✨ add OpeTerm mirror of OreTerm
- ✨ dispatch JsonIndexer on SteVecMode

### Fixes

- 🐛 restore b3 wire key for Compat::Mac
- 🐛 align Compat::Mac wire-format with HMAC primitive
- 🐛 map SteVec MAC to hmac_256 and Standard variants in EQL
- 🐛 derive STE-vec term MAC width from N

### Miscellaneous

- remove unused dependencies from cipherstash-client
- 🧹 align TODO marker on HmacSha256 type alias
- 🧹 keep JsonIndexer::generate_term private
- 🧹 deny clippy::unimplemented at crate root

### Refactoring

- remove legacy credentials infrastructure
- drop unused workspace deps
- wasm32 support — cfg-gate filesystem and Send
- 🚨 address review feedback on Layer 3 PR
- ♻️ split EncryptedSteVecTerm into Compat and Standard variants
- ♻️ split StePlaintextTerm::Ore into Orderable+OrderableTerm
- ♻️ wire TermBuilder via PrefixMac associated type
- ♻️ split Standard::Ope into OpeFixed + OpeVariable
- ♻️ extract MacBuild to mirror orderable_term
- ♻️ make selectors Blake3 and term MACs HMAC in both modes
- ♻️ collapse OPE STE-vec terms into single Op variant
- ♻️ flip STE-vec mode mapping — Compat=OPE, Standard=ORE
- ♻️ rename Compat::Op variant to Compat::Ope
- ♻️ collapse ORE STE-vec terms into single Ore variant
- ♻️ plaintext-side domain separation for orderable terms

### Testing

- ✅ lock JsonIndexer Compat term invariant
- ✅ add OpeTerm Json(None) parity test
- ✅ pin SteVecMode determinism and disjointness
- ✅ pin OreTerm/OpeTerm validation parity
- ✅ mirror query-side json_indexer tests in Standard mode
- ✅ property-test Standard OPE numeric ordering
- ✅ expect OPE in stevec e2e after Compat flip
- ✅ pin Compat::Op number/string domain separation

### Style

- 🎨 fix import ordering for rustfmt
- 🎨 rustfmt CompatTermBuilder::orderable_term


### Features

- add Supabase as an OIDC vendor


### Features

- 🚩 default SteVecMode to Standard (ORE)


### Documentation

- show CallbackAuthStrategy composing with ZeroKMSBuilder::new

### Miscellaneous

- target-split tokio so wasm32 + feature=tokio compiles

### Refactoring

- rename callback helpers to *Fn, split into auth/store modules


### Refactoring

- align EQL types with v2.3 schema
- rename SteVecElement -> SteVecEntry and fix oc doc


### Features

- derive Serialize/Deserialize on EqlOutput

### Testing

- add full-shape JSON tests for EqlOutput


### Features

- add opt-in http2 feature

### Fixes

- accept either hex or base64 for CS_CLIENT_KEY
- zeroize decoded key bytes in EnvKeyProvider::parse
- zeroize CS_CLIENT_KEY env string after parsing
- clippy unnecessary clones + cipherstash-client test prelude
- address PR review + CI failures
- update README doctest to use Crn instead of Region

### Miscellaneous

- apply cargo fmt


### Features

- filter list-clients by optional keyset_id

### Fixes

- tolerate missing/empty list-clients body; address review

### Refactoring

- rename OAuthStrategy to DeviceSessionStrategy





### Miscellaneous

- update Cargo.toml dependencies

## [0.34.0] - 2026-03-04

### Changed
- Consolidated all publishable crate versions to 0.34.0; version is now centralized via `workspace.package.version`

### Removed
- `ScopedCipher::with_index_key` synchronous constructor (unused in production)

## [0.33.2] - 2026-02-12

### Fixed
- Serialize token refresh in service credentials
- Serialize background refresh with foreground `get_token`
- Serialize refresh-token exchange in `UserCredentials`
- Eliminate lock contention in credential acquisition

### Changed
- Replace `Mutex<ChaChaRng>` with `thread_rng` for better performance

## [0.33.1] - 2026-02-10

### Added
- Tracing spans for HTTP requests via `reqwest-tracing` middleware
- Tracing for `AutoRefresh` credential provider loop (attempt counter, elapsed time, refresh interval)
- Warn-level logging when token refresh or persistence fails in `AutoRefreshable` implementations

### Changed
- Replaced `log` crate usage with `tracing` in credential providers
- Updated `zerokms-protocol` dependency to 0.11.0

## [0.33.0] - 2026-02-04

### Added
- **ZeroKMSBuilder**: New builder pattern for ergonomic ZeroKMS client construction
  - `with_request_timeout()` - Configure request timeouts (defaults to 10s)
  - `with_max_keys_per_req()` - Configure maximum keys per request (defaults to 100)
  - `with_max_concurrent_reqs()` - Configure maximum concurrent requests (defaults to 10)
  - `with_client_key()` - Add client key for encryption/decryption capabilities
  - Type-safe API that tracks whether a client key has been added
- 10-second timeout to HttpConnection for ZeroKMS requests

### Changed
- `ZeroKMS::connect()` and `ZeroKMS::connect_with_client_key()` now accept `ZeroKMSClientOpts` instead of individual parameters
- Configuration now uses workspace CRN instead of workspace ID for better region handling
- Removed retry logic from zerokms client (now handled by underlying reqwest)
- Upgraded reqwest to 0.12.24
- Upgraded reqwest-retry to 0.7
- Updated `cllw-ore` dependency to 0.3.0
- Updated `cipherstash-config` dependency to 0.2.6

### Fixed
- Improved error handling in connection initialization
- Enhanced documentation for ZeroKMSBuilder with updated examples
- Removed automatic logging of decryptions in ZeroKMSWithClientKey; decrypt operations are no longer logged by default

### Deprecated
- `ZeroKMS::new()` - Use `ZeroKMS::connect()` instead
- `ZeroKMS::new_with_client_key()` - Use `ZeroKMS::connect_with_client_key()` instead
- `ZeroKMSWithClientKey::log_decryptions()` - Deprecated; automatic decrypt logging has been removed and callers should implement their own logging if needed

## [0.32.2] - Previous release

Previous versions were not tracked in this CHANGELOG.
