cachekit 0.17.0__tar.gz → 0.18.0__tar.gz

{cachekit-0.17.0 → cachekit-0.18.0}/Cargo.lock

@@ -245,9 +245,9 @@ checksum = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201501e6497c8417a4fc33"
 
 [[package]]
 name = "cachekit-core"
-version = "0.4.0"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6aba1513135a7b92a124ad6983f7e80e5f5c78c4f9c74384079efa3fbf491eab"
+checksum = "12089baacc5ff661a62d2071588c895973bc48e42ed359178afaee22decb5559"
 dependencies = [
  "aes",
  "aes-gcm",
@@ -271,7 +271,7 @@ dependencies = [
 
 [[package]]
 name = "cachekit-rs"
-version = "0.17.0"
+version = "0.18.0"
 dependencies = [
  "cachekit-core",
  "criterion",
@@ -282,6 +282,7 @@ dependencies = [
  "pprof",
  "proptest",
  "pyo3",
+ "zeroize",
 ]
 
 [[package]]

{cachekit-0.17.0 → cachekit-0.18.0}/PKG-INFO

@@ -1,7 +1,7 @@
 Metadata-Version: 2.4
 Name: cachekit
-Version: 0.17.0
-Classifier: Development Status :: 3 - Alpha
+Version: 0.18.0
+Classifier: Development Status :: 4 - Beta
 Classifier: Intended Audience :: Developers
 Classifier: License :: OSI Approved :: MIT License
 Classifier: Operating System :: OS Independent
@@ -21,7 +21,7 @@ Classifier: Framework :: AsyncIO
 Classifier: Typing :: Typed
 Requires-Dist: redis[hiredis]>=4.0.0
 Requires-Dist: pydantic>=2.0.0
-Requires-Dist: pydantic-settings>=2.0.0
+Requires-Dist: pydantic-settings>=2.7.0
 Requires-Dist: prometheus-client>=0.22.1
 Requires-Dist: psutil>=7.0.0
 Requires-Dist: blake3>=1.0.5
@@ -37,7 +37,7 @@ Provides-Extra: data
 Provides-Extra: json
 Provides-Extra: memcached
 License-File: LICENSE
-Summary: Production-ready Redis caching for Python with intelligent reliability features and Rust-powered performance
+Summary: Backend-agnostic caching for Python — intent-based decorators with circuit breaker, distributed locking, Prometheus metrics, and optional zero-knowledge AES-256-GCM encryption, on a Rust-powered core. Zero-config L1 in-memory; scales to Redis, Memcached, File, or CachekitIO.
 Keywords: redis,cache,caching,decorator,rust,performance,reliability,production,encryption,security,circuit-breaker,prometheus,messagepack,distributed-locking
 Home-Page: https://github.com/cachekit-io/cachekit-py
 Author-email: cachekit Contributors <noreply@cachekit.io>
@@ -57,7 +57,7 @@ Project-URL: Repository, https://github.com/cachekit-io/cachekit-py.git
 
 > **Python caching, batteries included**
 
-Production-ready caching for Python with intelligent reliability features and Rust-powered performance.
+Backend-agnostic caching with intent-based decorators — circuit breaker, distributed locking, Prometheus metrics, and optional zero-knowledge encryption on a Rust-powered core. Zero config to start, any backend when you scale.
 
 [![PyPI Version][pypi-badge]][pypi-url]
 [![Python Versions][python-badge]][pypi-url]
@@ -68,20 +68,16 @@ Production-ready caching for Python with intelligent reliability features and Ru
 
 ---
 
-> [!WARNING]
-> **Alpha Software** — cachekit is under active development. While we've been building and testing for ~6 months, the API is not yet stable and **breaking changes may occur** between releases. We're committed to making this library rock-solid, but we need your help!
->
-> 🐛 **Found a bug?** Please [open an issue][issues-url] — even small ones help us improve.
->
-> 💡 **Something feel off?** We want to hear about rough edges, confusing APIs, or missing features.
+> [!NOTE]
+> **Status: beta** — CacheKit is in closed beta ahead of 1.0. APIs are stabilising; minor breaking changes may still occur between 0.x releases.
 >
-> Your feedback directly shapes the path to 1.0. Cheers!
+> 🐛 **Found a bug or a rough edge?** Please [open an issue][issues-url] — your feedback directly shapes the path to 1.0.
 
 ---
 
 ## Why cachekit?
 
-**Simple to use, production-ready out of the box.**
+**Simple to use, works out of the box.**
 
 ```python
 from cachekit import cache
@@ -125,7 +121,7 @@ backend that fits your infrastructure — they're peers behind the same `@cache`
 | Backend | Best for | Select with |
 |---------|----------|-------------|
 | Redis | Self-hosted, full control | `REDIS_URL` / `CACHEKIT_REDIS_URL` |
-| CachekitIO | Managed, zero-ops (alpha) | `CACHEKIT_API_KEY` |
+| CachekitIO | Managed, zero-ops (beta) | `CACHEKIT_API_KEY` |
 | Memcached | High-throughput, existing infra | `CACHEKIT_MEMCACHED_SERVERS` |
 | File / L1-only | Local dev, tests, no external deps | `CACHEKIT_FILE_CACHE_DIR` / `backend=None` |
 
@@ -148,7 +144,7 @@ def expensive_api_call(user_id: int):
 ### More Backends
 
 <details>
-<summary><strong>CachekitIO — Managed SaaS (Alpha)</strong></summary>
+<summary><strong>CachekitIO — Managed SaaS (Beta)</strong></summary>
 
 ```python notest
 import os
@@ -162,7 +158,7 @@ def expensive_api_call(user_id: int):
     return fetch_user_data(user_id)
 ```
 
-*cachekit.io is in closed alpha — [request access](https://cachekit.io) to get started.*
+*cachekit.io is in closed beta — [request access](https://cachekit.io) to get started.*
 
 </details>
 
@@ -188,9 +184,9 @@ def expensive_api_call(user_id: int):
 
 ---
 
-> **CachekitIO Cloud (Alpha)**
+> **CachekitIO Cloud (Beta)**
 > Managed caching with zero infrastructure. L1+L2 caching, circuit breaker, and automatic failover — no Redis to manage.
-> *cachekit.io is in closed alpha — [request access](https://cachekit.io) to get started.*
+> *cachekit.io is in closed beta — [request access](https://cachekit.io) to get started.*
 
 ---
 
@@ -221,9 +217,8 @@ def get_user_profile(user_id: int):
 | Backpressure | ✅ | ✅ | - | ✅ | ✅ |
 | Integrity Checking | - | ✅ | - | ✅ | ✅ 🔒 |
 | Encryption | - | - | - | - | ✅ Required |
-| L1 SWR | - | ✅ | - | ✅ | ✅ |
+| L1 SWR (L1-only mode) | - | ✅ | - | ✅ | ✅ |
 | L1 Invalidation | - | - | - | ✅ | ✅ |
-| L1 Namespace Index | - | - | - | ✅ | ✅ |
 | Prometheus Metrics | - | - | - | ✅ | ✅ |
 | Tracing | - | ✅ | - | ✅ | ✅ |
 | Structured Logging | - | ✅ | - | ✅ | ✅ |
@@ -231,6 +226,8 @@ def get_user_profile(user_id: int):
 
 > 🔒 `@cache.secure` forces `integrity_checking=True` — it cannot be overridden.
 >
+> **L1 SWR** (within-TTL background refresh) runs only in L1-only mode (`backend=None`) — with a backend configured it has no effect. `@cache.io` additionally ships past-TTL SWR via `stale_ttl` ([docs](docs/configuration.md#stale-while-revalidate-stale_ttl)).
+>
 > **`@cache.io()`** mirrors `@cache.production` (full reliability + observability) but routes to the managed CachekitIO SaaS backend instead of Redis. **`@cache.local()`** is a separate in-process path backed by `ObjectCache` (raw object references, entry-count LRU, no serialization) — the reliability and encryption features listed above do not apply to it.
 
 <details>
@@ -346,6 +343,12 @@ def get_patient_data(hospital_id: int):
 > [!CAUTION]
 > When handling PII, medical, or financial data, always use `@cache.secure` to enforce encryption.
 
+**Zero-downtime key rotation**: promote a new `CACHEKIT_MASTER_KEY` and keep the
+retiring key readable via `CACHEKIT_PREVIOUS_MASTER_KEYS` (comma-separated hex,
+max 3 decrypt-only keys). Entries are selected by exact key fingerprint — never
+trial decryption — and old entries age out via TTL, no cache flush required. See
+[Zero-Knowledge Encryption](docs/features/zero-knowledge-encryption.md#key-rotation-pattern).
+
 cachekit employs comprehensive security tooling:
 
 - **Supply Chain Security**: cargo-deny for license compliance + RustSec scanning
@@ -443,6 +446,7 @@ info = expensive_func.cache_info()
 | [Comparison Guide][comparison-url] | How cachekit compares to lru_cache, aiocache, cachetools |
 | [Getting Started][getting-started-url] | Progressive tutorial from basics to advanced |
 | [API Reference][api-reference-url] | Complete API documentation |
+| [Skyline (live example)][skyline-url] | Canonical example project: this SDK ingests the Bluesky firehose and writes the analytics entries a TypeScript edge Worker serves live, on one shared interop namespace |
 
 ### Feature Deep Dives
 
@@ -453,6 +457,11 @@ info = expensive_func.cache_info()
 | [Distributed Locking][distributed-locking-url] | Cache stampede prevention |
 | [Prometheus Metrics][prometheus-url] | Built-in observability |
 | [Zero-Knowledge Encryption][encryption-url] | Client-side security |
+| [Interop Mode][interop-url] | Cross-SDK cache sharing with cachekit-ts/rs |
+| [L1 Invalidation & SWR][l1-invalidation-url] | Process-local invalidation, stale-while-revalidate |
+| [Reference Caching][reference-caching-url] | `@cache.local()` for non-serializable objects |
+| [Rust Serialization][rust-serialization-url] | ByteStorage layer: LZ4, xxHash3, AES-256-GCM |
+| [SSRF Protection][ssrf-url] | URL allowlisting for the CachekitIO backend |
 
 ---
 
@@ -465,7 +474,7 @@ info = expensive_func.cache_info()
 CACHEKIT_REDIS_URL="redis://localhost:6379"  # Primary (preferred)
 REDIS_URL="redis://localhost:6379"           # Fallback
 
-# CachekitIO SaaS Backend (closed alpha — request access at cachekit.io)
+# CachekitIO SaaS Backend (closed beta — request access at cachekit.io)
 CACHEKIT_API_KEY="your-api-key"             # Required for @cache.io()  # pragma: allowlist secret
 CACHEKIT_API_URL="https://api.cachekit.io"  # Default SaaS endpoint
 
@@ -528,6 +537,7 @@ MIT License - see [LICENSE][license-file-url] for details.
 [uv-url]: https://github.com/astral-sh/uv
 [security-url]: SECURITY.md
 [comparison-url]: docs/comparison.md
+[skyline-url]: https://github.com/cachekit-io/bluesky-thinking
 [getting-started-url]: docs/getting-started.md
 [api-reference-url]: docs/api-reference.md
 [serializer-guide-url]: docs/serializers/index.md
@@ -535,6 +545,11 @@ MIT License - see [LICENSE][license-file-url] for details.
 [distributed-locking-url]: docs/features/distributed-locking.md
 [prometheus-url]: docs/features/prometheus-metrics.md
 [encryption-url]: docs/features/zero-knowledge-encryption.md
+[interop-url]: docs/features/interop-mode.md
+[l1-invalidation-url]: docs/features/l1-invalidation.md
+[reference-caching-url]: docs/features/reference-caching.md
+[rust-serialization-url]: docs/features/rust-serialization.md
+[ssrf-url]: docs/features/ssrf-protection.md
 [contributing-url]: CONTRIBUTING.md
 [license-file-url]: LICENSE
 [github-url]: https://github.com/cachekit-io/cachekit-py

{cachekit-0.17.0 → cachekit-0.18.0}/README.md

@@ -4,7 +4,7 @@
 
 > **Python caching, batteries included**
 
-Production-ready caching for Python with intelligent reliability features and Rust-powered performance.
+Backend-agnostic caching with intent-based decorators — circuit breaker, distributed locking, Prometheus metrics, and optional zero-knowledge encryption on a Rust-powered core. Zero config to start, any backend when you scale.
 
 [![PyPI Version][pypi-badge]][pypi-url]
 [![Python Versions][python-badge]][pypi-url]
@@ -15,20 +15,16 @@ Production-ready caching for Python with intelligent reliability features and Ru
 
 ---
 
-> [!WARNING]
-> **Alpha Software** — cachekit is under active development. While we've been building and testing for ~6 months, the API is not yet stable and **breaking changes may occur** between releases. We're committed to making this library rock-solid, but we need your help!
->
-> 🐛 **Found a bug?** Please [open an issue][issues-url] — even small ones help us improve.
->
-> 💡 **Something feel off?** We want to hear about rough edges, confusing APIs, or missing features.
+> [!NOTE]
+> **Status: beta** — CacheKit is in closed beta ahead of 1.0. APIs are stabilising; minor breaking changes may still occur between 0.x releases.
 >
-> Your feedback directly shapes the path to 1.0. Cheers!
+> 🐛 **Found a bug or a rough edge?** Please [open an issue][issues-url] — your feedback directly shapes the path to 1.0.
 
 ---
 
 ## Why cachekit?
 
-**Simple to use, production-ready out of the box.**
+**Simple to use, works out of the box.**
 
 ```python
 from cachekit import cache
@@ -72,7 +68,7 @@ backend that fits your infrastructure — they're peers behind the same `@cache`
 | Backend | Best for | Select with |
 |---------|----------|-------------|
 | Redis | Self-hosted, full control | `REDIS_URL` / `CACHEKIT_REDIS_URL` |
-| CachekitIO | Managed, zero-ops (alpha) | `CACHEKIT_API_KEY` |
+| CachekitIO | Managed, zero-ops (beta) | `CACHEKIT_API_KEY` |
 | Memcached | High-throughput, existing infra | `CACHEKIT_MEMCACHED_SERVERS` |
 | File / L1-only | Local dev, tests, no external deps | `CACHEKIT_FILE_CACHE_DIR` / `backend=None` |
 
@@ -95,7 +91,7 @@ def expensive_api_call(user_id: int):
 ### More Backends
 
 <details>
-<summary><strong>CachekitIO — Managed SaaS (Alpha)</strong></summary>
+<summary><strong>CachekitIO — Managed SaaS (Beta)</strong></summary>
 
 ```python notest
 import os
@@ -109,7 +105,7 @@ def expensive_api_call(user_id: int):
     return fetch_user_data(user_id)
 ```
 
-*cachekit.io is in closed alpha — [request access](https://cachekit.io) to get started.*
+*cachekit.io is in closed beta — [request access](https://cachekit.io) to get started.*
 
 </details>
 
@@ -135,9 +131,9 @@ def expensive_api_call(user_id: int):
 
 ---
 
-> **CachekitIO Cloud (Alpha)**
+> **CachekitIO Cloud (Beta)**
 > Managed caching with zero infrastructure. L1+L2 caching, circuit breaker, and automatic failover — no Redis to manage.
-> *cachekit.io is in closed alpha — [request access](https://cachekit.io) to get started.*
+> *cachekit.io is in closed beta — [request access](https://cachekit.io) to get started.*
 
 ---
 
@@ -168,9 +164,8 @@ def get_user_profile(user_id: int):
 | Backpressure | ✅ | ✅ | - | ✅ | ✅ |
 | Integrity Checking | - | ✅ | - | ✅ | ✅ 🔒 |
 | Encryption | - | - | - | - | ✅ Required |
-| L1 SWR | - | ✅ | - | ✅ | ✅ |
+| L1 SWR (L1-only mode) | - | ✅ | - | ✅ | ✅ |
 | L1 Invalidation | - | - | - | ✅ | ✅ |
-| L1 Namespace Index | - | - | - | ✅ | ✅ |
 | Prometheus Metrics | - | - | - | ✅ | ✅ |
 | Tracing | - | ✅ | - | ✅ | ✅ |
 | Structured Logging | - | ✅ | - | ✅ | ✅ |
@@ -178,6 +173,8 @@ def get_user_profile(user_id: int):
 
 > 🔒 `@cache.secure` forces `integrity_checking=True` — it cannot be overridden.
 >
+> **L1 SWR** (within-TTL background refresh) runs only in L1-only mode (`backend=None`) — with a backend configured it has no effect. `@cache.io` additionally ships past-TTL SWR via `stale_ttl` ([docs](docs/configuration.md#stale-while-revalidate-stale_ttl)).
+>
 > **`@cache.io()`** mirrors `@cache.production` (full reliability + observability) but routes to the managed CachekitIO SaaS backend instead of Redis. **`@cache.local()`** is a separate in-process path backed by `ObjectCache` (raw object references, entry-count LRU, no serialization) — the reliability and encryption features listed above do not apply to it.
 
 <details>
@@ -293,6 +290,12 @@ def get_patient_data(hospital_id: int):
 > [!CAUTION]
 > When handling PII, medical, or financial data, always use `@cache.secure` to enforce encryption.
 
+**Zero-downtime key rotation**: promote a new `CACHEKIT_MASTER_KEY` and keep the
+retiring key readable via `CACHEKIT_PREVIOUS_MASTER_KEYS` (comma-separated hex,
+max 3 decrypt-only keys). Entries are selected by exact key fingerprint — never
+trial decryption — and old entries age out via TTL, no cache flush required. See
+[Zero-Knowledge Encryption](docs/features/zero-knowledge-encryption.md#key-rotation-pattern).
+
 cachekit employs comprehensive security tooling:
 
 - **Supply Chain Security**: cargo-deny for license compliance + RustSec scanning
@@ -390,6 +393,7 @@ info = expensive_func.cache_info()
 | [Comparison Guide][comparison-url] | How cachekit compares to lru_cache, aiocache, cachetools |
 | [Getting Started][getting-started-url] | Progressive tutorial from basics to advanced |
 | [API Reference][api-reference-url] | Complete API documentation |
+| [Skyline (live example)][skyline-url] | Canonical example project: this SDK ingests the Bluesky firehose and writes the analytics entries a TypeScript edge Worker serves live, on one shared interop namespace |
 
 ### Feature Deep Dives
 
@@ -400,6 +404,11 @@ info = expensive_func.cache_info()
 | [Distributed Locking][distributed-locking-url] | Cache stampede prevention |
 | [Prometheus Metrics][prometheus-url] | Built-in observability |
 | [Zero-Knowledge Encryption][encryption-url] | Client-side security |
+| [Interop Mode][interop-url] | Cross-SDK cache sharing with cachekit-ts/rs |
+| [L1 Invalidation & SWR][l1-invalidation-url] | Process-local invalidation, stale-while-revalidate |
+| [Reference Caching][reference-caching-url] | `@cache.local()` for non-serializable objects |
+| [Rust Serialization][rust-serialization-url] | ByteStorage layer: LZ4, xxHash3, AES-256-GCM |
+| [SSRF Protection][ssrf-url] | URL allowlisting for the CachekitIO backend |
 
 ---
 
@@ -412,7 +421,7 @@ info = expensive_func.cache_info()
 CACHEKIT_REDIS_URL="redis://localhost:6379"  # Primary (preferred)
 REDIS_URL="redis://localhost:6379"           # Fallback
 
-# CachekitIO SaaS Backend (closed alpha — request access at cachekit.io)
+# CachekitIO SaaS Backend (closed beta — request access at cachekit.io)
 CACHEKIT_API_KEY="your-api-key"             # Required for @cache.io()  # pragma: allowlist secret
 CACHEKIT_API_URL="https://api.cachekit.io"  # Default SaaS endpoint
 
@@ -475,6 +484,7 @@ MIT License - see [LICENSE][license-file-url] for details.
 [uv-url]: https://github.com/astral-sh/uv
 [security-url]: SECURITY.md
 [comparison-url]: docs/comparison.md
+[skyline-url]: https://github.com/cachekit-io/bluesky-thinking
 [getting-started-url]: docs/getting-started.md
 [api-reference-url]: docs/api-reference.md
 [serializer-guide-url]: docs/serializers/index.md
@@ -482,6 +492,11 @@ MIT License - see [LICENSE][license-file-url] for details.
 [distributed-locking-url]: docs/features/distributed-locking.md
 [prometheus-url]: docs/features/prometheus-metrics.md
 [encryption-url]: docs/features/zero-knowledge-encryption.md
+[interop-url]: docs/features/interop-mode.md
+[l1-invalidation-url]: docs/features/l1-invalidation.md
+[reference-caching-url]: docs/features/reference-caching.md
+[rust-serialization-url]: docs/features/rust-serialization.md
+[ssrf-url]: docs/features/ssrf-protection.md
 [contributing-url]: CONTRIBUTING.md
 [license-file-url]: LICENSE
 [github-url]: https://github.com/cachekit-io/cachekit-py

{cachekit-0.17.0 → cachekit-0.18.0}/pyproject.toml

@@ -4,8 +4,8 @@ build-backend = "maturin"
 
 [project]
 name = "cachekit"
-version = "0.17.0"
-description = "Production-ready Redis caching for Python with intelligent reliability features and Rust-powered performance"
+version = "0.18.0"
+description = "Backend-agnostic caching for Python — intent-based decorators with circuit breaker, distributed locking, Prometheus metrics, and optional zero-knowledge AES-256-GCM encryption, on a Rust-powered core. Zero-config L1 in-memory; scales to Redis, Memcached, File, or CachekitIO."
 readme = "README.md"
 license = {text = "MIT"}
 authors = [
@@ -31,7 +31,7 @@ keywords = [
     "distributed-locking",
 ]
 classifiers = [
-    "Development Status :: 3 - Alpha",
+    "Development Status :: 4 - Beta",
     "Intended Audience :: Developers",
     "License :: OSI Approved :: MIT License",
     "Operating System :: OS Independent",
@@ -56,7 +56,7 @@ dependencies = [
     "redis[hiredis]>=4.0.0",
     # Configuration and validation
     "pydantic>=2.0.0",
-    "pydantic-settings>=2.0.0",
+    "pydantic-settings>=2.7.0",  # NoDecode (previous_master_keys env parsing) first shipped in 2.7.0
     # Monitoring and observability
     "prometheus-client>=0.22.1",
     "psutil>=7.0.0",
@@ -251,4 +251,8 @@ constraint-dependencies = [
     # PYSEC-2026-196 (entry-point path traversal), GHSA-58qw-9mgm-455v (tar/zip
     # confusion) and GHSA-jp4c-xjxw-mgf9 (self-update import ordering).
     "pip>=26.1.2",
+    # h2 is a transitive dep (httpx[http2] -> h2). 4.4.1 fixes
+    # GHSA-6hr6-w5qg-qmwg (duplicate Host headers forwarded on HTTP/2 ->
+    # HTTP/1.1 downgrade — request smuggling primitive).
+    "h2>=4.4.1",
 ]

{cachekit-0.17.0 → cachekit-0.18.0}/rust/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "cachekit-rs"
-version = "0.17.0"
+version = "0.18.0"
 edition = "2021"
 authors = ["cachekit Contributors"]
 description = "High-performance storage engine for caching with compression and encryption"
@@ -20,11 +20,15 @@ crate-type = ["cdylib", "rlib"]
 
 [dependencies]
 # Compression, checksums, encryption (https://crates.io/crates/cachekit-core)
-cachekit-core = { version = "0.4.0", features = ["compression", "checksum", "messagepack", "encryption"] }
+cachekit-core = { version = "0.5.0", features = ["compression", "checksum", "messagepack", "encryption"] }
 
 # Python integration - optional for Rust-only builds
 pyo3 = { workspace = true, optional = true }
 
+# Wipe the PyO3-side copies of master key material on drop. Only used behind
+# the encryption feature, so gated the same way pyo3 is.
+zeroize = { version = "1", optional = true }
+
 # Feature flags
 [features]
 default = ["python", "compression", "checksum", "messagepack", "encryption"]
@@ -36,7 +40,7 @@ python = ["dep:pyo3"]
 compression = []
 checksum = []
 messagepack = []
-encryption = []
+encryption = ["dep:zeroize"]
 
 [dev-dependencies]
 criterion = { version = "0.5", features = ["html_reports"] }

{cachekit-0.17.0 → cachekit-0.18.0}/rust/README.md

@@ -4,7 +4,7 @@
 
 > **Python caching, batteries included**
 
-Production-ready caching for Python with intelligent reliability features and Rust-powered performance.
+Backend-agnostic caching with intent-based decorators — circuit breaker, distributed locking, Prometheus metrics, and optional zero-knowledge encryption on a Rust-powered core. Zero config to start, any backend when you scale.
 
 [![PyPI Version][pypi-badge]][pypi-url]
 [![Python Versions][python-badge]][pypi-url]
@@ -15,20 +15,16 @@ Production-ready caching for Python with intelligent reliability features and Ru
 
 ---
 
-> [!WARNING]
-> **Alpha Software** — cachekit is under active development. While we've been building and testing for ~6 months, the API is not yet stable and **breaking changes may occur** between releases. We're committed to making this library rock-solid, but we need your help!
->
-> 🐛 **Found a bug?** Please [open an issue][issues-url] — even small ones help us improve.
->
-> 💡 **Something feel off?** We want to hear about rough edges, confusing APIs, or missing features.
+> [!NOTE]
+> **Status: beta** — CacheKit is in closed beta ahead of 1.0. APIs are stabilising; minor breaking changes may still occur between 0.x releases.
 >
-> Your feedback directly shapes the path to 1.0. Cheers!
+> 🐛 **Found a bug or a rough edge?** Please [open an issue][issues-url] — your feedback directly shapes the path to 1.0.
 
 ---
 
 ## Why cachekit?
 
-**Simple to use, production-ready out of the box.**
+**Simple to use, works out of the box.**
 
 ```python
 from cachekit import cache
@@ -72,7 +68,7 @@ backend that fits your infrastructure — they're peers behind the same `@cache`
 | Backend | Best for | Select with |
 |---------|----------|-------------|
 | Redis | Self-hosted, full control | `REDIS_URL` / `CACHEKIT_REDIS_URL` |
-| CachekitIO | Managed, zero-ops (alpha) | `CACHEKIT_API_KEY` |
+| CachekitIO | Managed, zero-ops (beta) | `CACHEKIT_API_KEY` |
 | Memcached | High-throughput, existing infra | `CACHEKIT_MEMCACHED_SERVERS` |
 | File / L1-only | Local dev, tests, no external deps | `CACHEKIT_FILE_CACHE_DIR` / `backend=None` |
 
@@ -95,7 +91,7 @@ def expensive_api_call(user_id: int):
 ### More Backends
 
 <details>
-<summary><strong>CachekitIO — Managed SaaS (Alpha)</strong></summary>
+<summary><strong>CachekitIO — Managed SaaS (Beta)</strong></summary>
 
 ```python notest
 import os
@@ -109,7 +105,7 @@ def expensive_api_call(user_id: int):
     return fetch_user_data(user_id)
 ```
 
-*cachekit.io is in closed alpha — [request access](https://cachekit.io) to get started.*
+*cachekit.io is in closed beta — [request access](https://cachekit.io) to get started.*
 
 </details>
 
@@ -135,9 +131,9 @@ def expensive_api_call(user_id: int):
 
 ---
 
-> **CachekitIO Cloud (Alpha)**
+> **CachekitIO Cloud (Beta)**
 > Managed caching with zero infrastructure. L1+L2 caching, circuit breaker, and automatic failover — no Redis to manage.
-> *cachekit.io is in closed alpha — [request access](https://cachekit.io) to get started.*
+> *cachekit.io is in closed beta — [request access](https://cachekit.io) to get started.*
 
 ---
 
@@ -168,9 +164,8 @@ def get_user_profile(user_id: int):
 | Backpressure | ✅ | ✅ | - | ✅ | ✅ |
 | Integrity Checking | - | ✅ | - | ✅ | ✅ 🔒 |
 | Encryption | - | - | - | - | ✅ Required |
-| L1 SWR | - | ✅ | - | ✅ | ✅ |
+| L1 SWR (L1-only mode) | - | ✅ | - | ✅ | ✅ |
 | L1 Invalidation | - | - | - | ✅ | ✅ |
-| L1 Namespace Index | - | - | - | ✅ | ✅ |
 | Prometheus Metrics | - | - | - | ✅ | ✅ |
 | Tracing | - | ✅ | - | ✅ | ✅ |
 | Structured Logging | - | ✅ | - | ✅ | ✅ |
@@ -178,6 +173,8 @@ def get_user_profile(user_id: int):
 
 > 🔒 `@cache.secure` forces `integrity_checking=True` — it cannot be overridden.
 >
+> **L1 SWR** (within-TTL background refresh) runs only in L1-only mode (`backend=None`) — with a backend configured it has no effect. `@cache.io` additionally ships past-TTL SWR via `stale_ttl` ([docs](docs/configuration.md#stale-while-revalidate-stale_ttl)).
+>
 > **`@cache.io()`** mirrors `@cache.production` (full reliability + observability) but routes to the managed CachekitIO SaaS backend instead of Redis. **`@cache.local()`** is a separate in-process path backed by `ObjectCache` (raw object references, entry-count LRU, no serialization) — the reliability and encryption features listed above do not apply to it.
 
 <details>
@@ -293,6 +290,12 @@ def get_patient_data(hospital_id: int):
 > [!CAUTION]
 > When handling PII, medical, or financial data, always use `@cache.secure` to enforce encryption.
 
+**Zero-downtime key rotation**: promote a new `CACHEKIT_MASTER_KEY` and keep the
+retiring key readable via `CACHEKIT_PREVIOUS_MASTER_KEYS` (comma-separated hex,
+max 3 decrypt-only keys). Entries are selected by exact key fingerprint — never
+trial decryption — and old entries age out via TTL, no cache flush required. See
+[Zero-Knowledge Encryption](docs/features/zero-knowledge-encryption.md#key-rotation-pattern).
+
 cachekit employs comprehensive security tooling:
 
 - **Supply Chain Security**: cargo-deny for license compliance + RustSec scanning
@@ -390,6 +393,7 @@ info = expensive_func.cache_info()
 | [Comparison Guide][comparison-url] | How cachekit compares to lru_cache, aiocache, cachetools |
 | [Getting Started][getting-started-url] | Progressive tutorial from basics to advanced |
 | [API Reference][api-reference-url] | Complete API documentation |
+| [Skyline (live example)][skyline-url] | Canonical example project: this SDK ingests the Bluesky firehose and writes the analytics entries a TypeScript edge Worker serves live, on one shared interop namespace |
 
 ### Feature Deep Dives
 
@@ -400,6 +404,11 @@ info = expensive_func.cache_info()
 | [Distributed Locking][distributed-locking-url] | Cache stampede prevention |
 | [Prometheus Metrics][prometheus-url] | Built-in observability |
 | [Zero-Knowledge Encryption][encryption-url] | Client-side security |
+| [Interop Mode][interop-url] | Cross-SDK cache sharing with cachekit-ts/rs |
+| [L1 Invalidation & SWR][l1-invalidation-url] | Process-local invalidation, stale-while-revalidate |
+| [Reference Caching][reference-caching-url] | `@cache.local()` for non-serializable objects |
+| [Rust Serialization][rust-serialization-url] | ByteStorage layer: LZ4, xxHash3, AES-256-GCM |
+| [SSRF Protection][ssrf-url] | URL allowlisting for the CachekitIO backend |
 
 ---
 
@@ -412,7 +421,7 @@ info = expensive_func.cache_info()
 CACHEKIT_REDIS_URL="redis://localhost:6379"  # Primary (preferred)
 REDIS_URL="redis://localhost:6379"           # Fallback
 
-# CachekitIO SaaS Backend (closed alpha — request access at cachekit.io)
+# CachekitIO SaaS Backend (closed beta — request access at cachekit.io)
 CACHEKIT_API_KEY="your-api-key"             # Required for @cache.io()  # pragma: allowlist secret
 CACHEKIT_API_URL="https://api.cachekit.io"  # Default SaaS endpoint
 
@@ -475,6 +484,7 @@ MIT License - see [LICENSE][license-file-url] for details.
 [uv-url]: https://github.com/astral-sh/uv
 [security-url]: SECURITY.md
 [comparison-url]: docs/comparison.md
+[skyline-url]: https://github.com/cachekit-io/bluesky-thinking
 [getting-started-url]: docs/getting-started.md
 [api-reference-url]: docs/api-reference.md
 [serializer-guide-url]: docs/serializers/index.md
@@ -482,6 +492,11 @@ MIT License - see [LICENSE][license-file-url] for details.
 [distributed-locking-url]: docs/features/distributed-locking.md
 [prometheus-url]: docs/features/prometheus-metrics.md
 [encryption-url]: docs/features/zero-knowledge-encryption.md
+[interop-url]: docs/features/interop-mode.md
+[l1-invalidation-url]: docs/features/l1-invalidation.md
+[reference-caching-url]: docs/features/reference-caching.md
+[rust-serialization-url]: docs/features/rust-serialization.md
+[ssrf-url]: docs/features/ssrf-protection.md
 [contributing-url]: CONTRIBUTING.md
 [license-file-url]: LICENSE
 [github-url]: https://github.com/cachekit-io/cachekit-py

{cachekit-0.17.0 → cachekit-0.18.0}/rust/src/lib.rs

@@ -9,11 +9,8 @@ pub use cachekit_core::{ByteStorage, OperationMetrics, StorageEnvelope};
 #[cfg(feature = "encryption")]
 pub use cachekit_core::{
     derive_domain_key,
-    encryption::{
-        key_derivation::{derive_tenant_keys, key_fingerprint, TenantKeys},
-        key_rotation::KeyRotationState,
-    },
-    EncryptionError, ZeroKnowledgeEncryptor,
+    encryption::key_derivation::{derive_tenant_keys, key_fingerprint, TenantKeys},
+    EncryptionError, Keyring, ZeroKnowledgeEncryptor,
 };
 
 // Python bindings (gated behind python feature)