chore: release main

[cipherbox-release-bot]

🤖 I have created a release beep boop

cipher-box: 0.46.0

0.46.0 (2026-07-18)

Features

• add AAD-bound AES-256-GCM node-seal primitive with cross-language KAT (#576) (65237ac)
• atomic IPNS publish-gate, tombstone, and share schema cutover (#584) (a036a84)
• enforce share-invite authorization and IPNS data-integrity in the API (#599) (703bc00)
• FUSE and WinFsp Rust integration with grant-root awareness and SDK-owned read chain (#594) (4b96aa9)
• integrate web client with node/v3 read and write runtime (#588) (1fb8996)
• read-chain navigation, grants, and rotation engine in sdk-core (#579) (7216797)
• recovery tool v3, vault-load guards, web UX and CI boundary guards (#613) (cba7857)
• rewrite TEE republish as a verify-in-enclave lease renewer (#585) (ab209a9)
• rotation soundness — content-key, inner-grant, concurrent-add, crash-safe resume (#582) (4ad615a)
• rotation write-plane and re-mint durability with recipient-pubkey pinning (#615) (27c4abe)
• SDK write-chain, write-revocation, bin re-link, and invite claim (#583) (d81c1b4)
• SDK-owned read chain and resolved folder listings (#589) (6534c64)
• unified Node codec and two-key vault v3 blob in core (#578) (b2dba55)
• web rotation UX and durable anti-rollback client state (#587) (1b4f68b)

Bug Fixes

• close rust and fuse scope-exit read-revocation bypasses (#607) (2917c85)
• complete web kind discrimination and revive deferred test suites (#611) (fcf1596)
• cross-language IPNS and node-codec verification parity (#608) (77e52cb)
• fuse: resolve before per-file first-publish to avoid seq-1 equivocation (#601) (e87befa)
• harden FUSE publish and TEE write paths against partial-failure states (#610) (02efe51)
• harden rotation read-plane durability and deep crash-resume soundness (#598) (d5486e5)
• harden rotation soundness under concurrency and crash-resume (#596) (faa781e)
• harden SDK write-plane durability and correctness (#602) (c21f896)
• shared-folder write and navigation correctness on web (#603) (bd8c1e0)

@cipherbox/api: 0.45.0

0.45.0 (2026-07-18)

Features

• atomic IPNS publish-gate, tombstone, and share schema cutover (#584) (a036a84)
• enforce share-invite authorization and IPNS data-integrity in the API (#599) (703bc00)
• integrate web client with node/v3 read and write runtime (#588) (1fb8996)
• rewrite TEE republish as a verify-in-enclave lease renewer (#585) (ab209a9)
• web rotation UX and durable anti-rollback client state (#587) (1b4f68b)

Bug Fixes

• close rust and fuse scope-exit read-revocation bypasses (#607) (2917c85)
• harden FUSE publish and TEE write paths against partial-failure states (#610) (02efe51)

@cipherbox/web: 0.49.0

0.49.0 (2026-07-18)

Features

• atomic IPNS publish-gate, tombstone, and share schema cutover (#584) (a036a84)
• enforce share-invite authorization and IPNS data-integrity in the API (#599) (703bc00)
• integrate web client with node/v3 read and write runtime (#588) (1fb8996)
• recovery tool v3, vault-load guards, web UX and CI boundary guards (#613) (cba7857)
• rotation write-plane and re-mint durability with recipient-pubkey pinning (#615) (27c4abe)
• SDK write-chain, write-revocation, bin re-link, and invite claim (#583) (d81c1b4)
• SDK-owned read chain and resolved folder listings (#589) (6534c64)
• unified Node codec and two-key vault v3 blob in core (#578) (b2dba55)
• web rotation UX and durable anti-rollback client state (#587) (1b4f68b)

Bug Fixes

• complete web kind discrimination and revive deferred test suites (#611) (fcf1596)
• harden rotation read-plane durability and deep crash-resume soundness (#598) (d5486e5)
• harden rotation soundness under concurrency and crash-resume (#596) (faa781e)
• harden SDK write-plane durability and correctness (#602) (c21f896)
• shared-folder write and navigation correctness on web (#603) (bd8c1e0)

cipherbox-desktop: 0.47.0

0.47.0 (2026-07-18)

Features

• FUSE and WinFsp Rust integration with grant-root awareness and SDK-owned read chain (#594) (4b96aa9)
• rotation write-plane and re-mint durability with recipient-pubkey pinning (#615) (27c4abe)

Bug Fixes

• harden FUSE publish and TEE write paths against partial-failure states (#610) (02efe51)
• harden rotation read-plane durability and deep crash-resume soundness (#598) (d5486e5)

cipherbox-tee-worker: 0.32.0

0.32.0 (2026-07-18)

Features

• rewrite TEE republish as a verify-in-enclave lease renewer (#585) (ab209a9)

Bug Fixes

• harden FUSE publish and TEE write paths against partial-failure states (#610) (02efe51)

@cipherbox/core: 0.32.0

0.32.0 (2026-07-18)

Features

• integrate web client with node/v3 read and write runtime (#588) (1fb8996)
• rotation write-plane and re-mint durability with recipient-pubkey pinning (#615) (27c4abe)
• SDK write-chain, write-revocation, bin re-link, and invite claim (#583) (d81c1b4)
• SDK-owned read chain and resolved folder listings (#589) (6534c64)
• unified Node codec and two-key vault v3 blob in core (#578) (b2dba55)

Bug Fixes

• complete web kind discrimination and revive deferred test suites (#611) (fcf1596)
• cross-language IPNS and node-codec verification parity (#608) (77e52cb)
• harden SDK write-plane durability and correctness (#602) (c21f896)

@cipherbox/crypto: 0.34.0

0.34.0 (2026-07-18)

Features

• add AAD-bound AES-256-GCM node-seal primitive with cross-language KAT (#576) (65237ac)
• recovery tool v3, vault-load guards, web UX and CI boundary guards (#613) (cba7857)

Bug Fixes

• cross-language IPNS and node-codec verification parity (#608) (77e52cb)
• harden FUSE publish and TEE write paths against partial-failure states (#610) (02efe51)
• harden SDK write-plane durability and correctness (#602) (c21f896)

@cipherbox/api-client: 0.45.0

0.45.0 (2026-07-18)

Features

• atomic IPNS publish-gate, tombstone, and share schema cutover (#584) (a036a84)
• enforce share-invite authorization and IPNS data-integrity in the API (#599) (703bc00)
• integrate web client with node/v3 read and write runtime (#588) (1fb8996)
• web rotation UX and durable anti-rollback client state (#587) (1b4f68b)

Bug Fixes

• harden SDK write-plane durability and correctness (#602) (c21f896)

@cipherbox/sdk-core: 0.40.0

0.40.0 (2026-07-18)

Features

• atomic IPNS publish-gate, tombstone, and share schema cutover (#584) (a036a84)
• enforce share-invite authorization and IPNS data-integrity in the API (#599) (703bc00)
• FUSE and WinFsp Rust integration with grant-root awareness and SDK-owned read chain (#594) (4b96aa9)
• integrate web client with node/v3 read and write runtime (#588) (1fb8996)
• read-chain navigation, grants, and rotation engine in sdk-core (#579) (7216797)
• rewrite TEE republish as a verify-in-enclave lease renewer (#585) (ab209a9)
• rotation soundness — content-key, inner-grant, concurrent-add, crash-safe resume (#582) (4ad615a)
• rotation write-plane and re-mint durability with recipient-pubkey pinning (#615) (27c4abe)
• SDK write-chain, write-revocation, bin re-link, and invite claim (#583) (d81c1b4)
• SDK-owned read chain and resolved folder listings (#589) (6534c64)
• unified Node codec and two-key vault v3 blob in core (#578) (b2dba55)
• web rotation UX and durable anti-rollback client state (#587) (1b4f68b)

Bug Fixes

• close rust and fuse scope-exit read-revocation bypasses (#607) (2917c85)
• complete web kind discrimination and revive deferred test suites (#611) (fcf1596)
• cross-language IPNS and node-codec verification parity (#608) (77e52cb)
• harden rotation read-plane durability and deep crash-resume soundness (#598) (d5486e5)
• harden rotation soundness under concurrency and crash-resume (#596) (faa781e)
• harden SDK write-plane durability and correctness (#602) (c21f896)
• shared-folder write and navigation correctness on web (#603) (bd8c1e0)

@cipherbox/sdk: 0.38.0

0.38.0 (2026-07-18)

Features

• enforce share-invite authorization and IPNS data-integrity in the API (#599) (703bc00)
• integrate web client with node/v3 read and write runtime (#588) (1fb8996)
• read-chain navigation, grants, and rotation engine in sdk-core (#579) (7216797)
• recovery tool v3, vault-load guards, web UX and CI boundary guards (#613) (cba7857)
• rotation soundness — content-key, inner-grant, concurrent-add, crash-safe resume (#582) (4ad615a)
• rotation write-plane and re-mint durability with recipient-pubkey pinning (#615) (27c4abe)
• SDK write-chain, write-revocation, bin re-link, and invite claim (#583) (d81c1b4)
• SDK-owned read chain and resolved folder listings (#589) (6534c64)
• unified Node codec and two-key vault v3 blob in core (#578) (b2dba55)
• web rotation UX and durable anti-rollback client state (#587) (1b4f68b)

Bug Fixes

• close rust and fuse scope-exit read-revocation bypasses (#607) (2917c85)
• complete web kind discrimination and revive deferred test suites (#611) (fcf1596)
• harden rotation read-plane durability and deep crash-resume soundness (#598) (d5486e5)
• harden rotation soundness under concurrency and crash-resume (#596) (faa781e)
• harden SDK write-plane durability and correctness (#602) (c21f896)
• shared-folder write and navigation correctness on web (#603) (bd8c1e0)

cipherbox-crypto: 0.6.0

0.6.0 (2026-07-18)

Features

• add AAD-bound AES-256-GCM node-seal primitive with cross-language KAT (#576) (65237ac)

Bug Fixes

• cross-language IPNS and node-codec verification parity (#608) (77e52cb)

cipherbox-core: 0.8.0

0.8.0 (2026-07-18)

Features

• FUSE and WinFsp Rust integration with grant-root awareness and SDK-owned read chain (#594) (4b96aa9)
• rotation write-plane and re-mint durability with recipient-pubkey pinning (#615) (27c4abe)

Bug Fixes

• cross-language IPNS and node-codec verification parity (#608) (77e52cb)

cipherbox-api-client: 0.37.0

0.37.0 (2026-07-18)

Features

• enforce share-invite authorization and IPNS data-integrity in the API (#599) (703bc00)
• FUSE and WinFsp Rust integration with grant-root awareness and SDK-owned read chain (#594) (4b96aa9)

Bug Fixes

• close rust and fuse scope-exit read-revocation bypasses (#607) (2917c85)
• cross-language IPNS and node-codec verification parity (#608) (77e52cb)

cipherbox-fuse: 0.11.0

0.11.0 (2026-07-18)

Features

• enforce share-invite authorization and IPNS data-integrity in the API (#599) (703bc00)
• FUSE and WinFsp Rust integration with grant-root awareness and SDK-owned read chain (#594) (4b96aa9)
• rotation write-plane and re-mint durability with recipient-pubkey pinning (#615) (27c4abe)

Bug Fixes

• close rust and fuse scope-exit read-revocation bypasses (#607) (2917c85)
• cross-language IPNS and node-codec verification parity (#608) (77e52cb)
• fuse: resolve before per-file first-publish to avoid seq-1 equivocation (#601) (e87befa)
• harden FUSE publish and TEE write paths against partial-failure states (#610) (02efe51)
• harden rotation read-plane durability and deep crash-resume soundness (#598) (d5486e5)

cipherbox-sdk: 0.9.0

0.9.0 (2026-07-18)

Features

• enforce share-invite authorization and IPNS data-integrity in the API (#599) (703bc00)
• FUSE and WinFsp Rust integration with grant-root awareness and SDK-owned read chain (#594) (4b96aa9)
• rotation write-plane and re-mint durability with recipient-pubkey pinning (#615) (27c4abe)

Bug Fixes

• close rust and fuse scope-exit read-revocation bypasses (#607) (2917c85)
• harden rotation read-plane durability and deep crash-resume soundness (#598) (d5486e5)
• harden rotation soundness under concurrency and crash-resume (#596) (faa781e)

---

This PR was generated with Release Please. See documentation.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 78.04%. Comparing base (27c4abe) to head (264d5fe).

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #577      +/-   ##
==========================================
+ Coverage   70.15%   78.04%   +7.89%     
==========================================
  Files         160      200      +40     
  Lines       15570    34317   +18747     
  Branches     2003     2003              
==========================================
+ Hits        10923    26783   +15860     
- Misses       4392     7279    +2887     
  Partials      255      255              

Flag	Coverage Δ
api	84.35% <ø> (ø)
api-client	84.35% <ø> (ø)
core	84.35% <ø> (ø)
crypto	84.35% <ø> (ø)
desktop	26.63% <ø> (-4.99%)	⬇️
rust	80.23% <ø> (?)
sdk	84.35% <ø> (ø)
sdk-core	84.35% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.
see 97 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[FSM1]

Closing unmerged: main is frozen for the v2 rewrite (see the blueprint in FSM1/cipher-box-next). The unreleased v1.1+ work on main is superseded by the v2 spec and will never release; the last released v1 state is preserved on the v1 branch / v1-freeze tag at 07376d0. v2 release management restarts single-component per blueprint/deploy.md.