feat(core-bindings): pick up cachekit-core 0.4.0 — bin envelopes (LAB-901)

[27Bslash6]

Closes LAB-901. Parent: LAB-764 stage 5 (protocol 1.1 rollout, TypeScript leg).

What

Bump cachekit-core 0.3.0 → 0.4.0 in both native bindings — cachekit-core-ts (NAPI) and cachekit-core-wasm — and prove the protocol 1.1 wire change through the real TS stack. Core 0.4.0 emits StorageEnvelope.compressed_data as msgpack bin (core#59, spec protocol#44); pre-0.4.0 array-of-integers envelopes remain readable forever (dual-read).

No ts-side serialization code changes — the codec is single-sourced in cachekit-core. The diff is the two Cargo pins + locks, the re-vendored spec vectors, and tests.

Byte-verification (proven, not asserted)

• Re-vendored protocol/test-vectors/wire-format.json v1.1.0 (6 legacy + 6 *_bin vectors) and now drive the full vector set through both lanes: NAPI (Node lane, test/protocol) and wasm inside real workerd (test/workers).
• bin emit: pack output equals every *_bin ground-truth envelope byte-for-byte, in both bindings — which also pins the two bindings byte-identical to each other and to every other SDK.
• Legacy read: all 6 legacy vectors plus the pre-0.4.0 canonical fixture decode through the real retrieve path (permanent dual-read proof).
• Marker assert: fresh packs of arbitrary payloads (bin8- and bin16-sized, incompressible included) carry the msgpack bin marker and round-trip identically.
• Local verification against ground truth before the fixtures were written: freshly built NAPI and wasm artifacts both reproduce simple_string_bin exactly and decode the legacy simple_string envelope.

Checks

• Node lane: 659 passed | 1 skipped. Workers lane (workerd): 97 passed. Lint, prettier, type-check green.
• wasm size budget: 54,992 B gzipped (< 100 KB), API drift check clean.
• .secrets.baseline refreshed — hex test vectors are line-pinned there (pre-existing pattern), and the vector additions moved them.

Docs gate

No README or docs.cachekit.io statement describes the compressed_data field encoding (checked SDK READMEs + docs repo envelope/compressed_data hits); container-level claims ("LZ4 + xxHash3-64", byte-compatibility across NAPI/wasm) remain true. Test-file headers updated to protocol v1.1 with the dual-read note. Nothing else needed changing.

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 53 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: e078d29e-287c-4d80-9660-dacb87e6e297

📥 Commits

Reviewing files that changed from the base of the PR and between 78e20b2 and f2aa8b5.

⛔ Files ignored due to path filters (2)

• packages/cachekit-core-ts/Cargo.lock is excluded by !**/*.lock
• packages/cachekit-core-wasm/Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (6)

• .secrets.baseline
• packages/cachekit-core-ts/Cargo.toml
• packages/cachekit-core-wasm/Cargo.toml
• packages/cachekit/test/protocol/wire-format.protocol.test.ts
• packages/cachekit/test/workers/fixtures/wire-format.json
• packages/cachekit/test/workers/wire-format.workers.test.ts

---

_{Comment @coderabbitai help to get the list of available commands.}

[kodus-27b]

Kody Review Complete

Great news! 🎉
No issues were found that match your current review configurations.

Keep up the excellent work! 🚀

Kody Guide: Usage and Configuration

Interacting with Kody

• Request a Review: Ask Kody to review your PR manually by adding a comment with the @kody start-review command at the root of your PR.

• Validate Business Logic: Ask Kody to validate your code against business rules by adding a comment with the @kody -v business-logic command.

• Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Bug	✅
Performance	✅
Security	✅
Business Logic	✅

Access your configuration settings here.

​