v5.2.4 — Prism polish

Fixed

• CryptoPortBase.sha256() type — index.d.ts declaration corrected from string | Promise<string> to Promise<string>, matching the async implementation since v5.2.3.
• keyLength passthrough — KeyResolver.#resolveKeyFromPassphrase and deriveKekFromKdf now forward kdf.keyLength to deriveKey(), fixing a latent bug for vaults configured with non-default key lengths.
• Deno test compatibility — createCryptoAdapter.test.js no longer crashes on Deno by guarding immutable globalThis.Deno restoration with try/catch and skipping Node-only tests on non-Node runtimes.
• README wording — "no public API changes" corrected to "no breaking API changes" in the v5.2.3 summary.
• Barrel re-export description — README and CHANGELOG now show the correct export { default as X } from '...' syntax.
• Vestigial lastchat.txt removed from jsr.json exclude list.

Changed

• keyResolver is now private — CasService.keyResolver changed to #keyResolver, preventing external access to an internal implementation detail.
• VaultPassphraseRotator.js → rotateVaultPassphrase.js — renamed to follow camelCase convention for files that export a function (PascalCase is reserved for classes).
• resolveChunker validation — chunkSize now validated as a finite positive number before constructing FixedChunker; invalid values fall through to CasService default.
• @fileoverview JSDoc added to FileIOHelper.js, createCryptoAdapter.js, and resolveChunker.js.
• KeyResolver design note — class JSDoc now documents the direct CryptoPort.deriveKey() call (bypasses CasService.deriveKey()).
• Long function signature wrapped — rotateVaultPassphrase() export signature broken across multiple lines.
• Test hardening — salt assertion in KeyResolver.resolveForStore, keyLength round-trip test, resolveChunker edge-case tests, guarded rmSync teardown in FileIOHelper.test.js.

Full Changelog: https://github.com/git-stunts/git-cas/blob/main/CHANGELOG.md

What's Changed

• chore: JSDoc total coverage + strict checkJs by @flyingrobots in #14
• chore: deterministic fuzz, DRY chunk verify, DRY KDF metadata by @flyingrobots in #15
• refactor: extract helpers from facade + cleanup by @flyingrobots in #16

Full Changelog: v5.2.1...v5.2.4

v5.2.1 — Carousel polish

[5.2.1] — Carousel polish (2026-02-28)

Added

• CLI reference in docs/API.md for git cas rotate and git cas vault rotate flags.

Changed

• Rotation helpers in CasService use native #private methods, matching the facade's style.
• VAULT_CONFLICT and VAULT_METADATA_INVALID error code docs now list rotateVaultPassphrase().

Fixed

• rotateVaultPassphrase now honours kdfOptions.algorithm instead of silently using the old algorithm.
• Rotation integration test no longer flaps under CI load (reduced test-only KDF iterations).

Full Changelog: https://github.com/git-stunts/git-cas/blob/main/CHANGELOG.md

What's Changed

• feat: M12 Carousel — key rotation without re-encrypting data (v5.2.0) by @flyingrobots in #13

Full Changelog: v5.1.0...v5.2.1

v5.1.0

What's Changed

• feat: M11 Locksmith — envelope encryption with multi-recipient DEK/KEK by @flyingrobots in #12

Full Changelog: v5.0.0...v5.1.0

v5.0.0

Full Changelog: v4.0.1...v5.0.0

v4.0.1

What's Changed

• feat!: M14 Conduit — ObservabilityPort, streaming restore, parallel I/O (v4.0.0) by @flyingrobots in #10
• feat: M8 Spit Shine + M9 Cockpit — code review polish & CLI improvements by @flyingrobots in #11

Full Changelog: v3.1.0...v4.0.1

v3.1.0

What's Changed

• feat: demo GIFs, GIT_CAS_PASSPHRASE env var, backlog by @flyingrobots in #8
• fix(cli): address M13 dashboard code review findings by @flyingrobots in #9

Full Changelog: v3.0.0...v3.1.0

v3.0.0

What's Changed

• v3.0.0 — Vault by @flyingrobots in #7

Full Changelog: v2.0.0...v3.0.0

v2.0.0

What's Changed

• release: v2.0.0 — compression, KDF, Merkle manifests by @flyingrobots in #6

Full Changelog: v1.6.2...v2.0.0

v1.6.2

Full Changelog: v1.6.1...v1.6.2