uBix Vault v0.2.0-beta.8

Eighth beta. Transit becomes full crypto-as-a-service, plus response wrapping.

Added

• Transit crypto-as-a-service — the Transit engine now covers the full surface beyond encrypt/decrypt/rotate:
  • rewrap (/v1/transit/rewrap/{name}) re-encrypts a ciphertext under the key's latest version without exposing plaintext, so old versions can be retired after a rotation.
  • data keys (/v1/transit/datakey/{plaintext|wrapped}/{name}) generate a random 128/256/512-bit key wrapped under the named key, for envelope encryption.
  • HMAC + verify (/v1/transit/hmac/{name}, /v1/transit/verify/{name}) — keyed HMAC (sha2-256/384/512), constant-time, version-tagged so it survives rotation.
  • asymmetric signing — keys can be ecdsa-p256/384/521 or ed25519; sign (/v1/transit/sign/{name}) and verify (signature or hmac), with per-version PEM public keys returned so signatures verify without the vault.
• Response wrapping — /v1/sys/wrapping/wrap stores a JSON payload behind a single-use, TTL'd token (default 5m, max 24h); /v1/sys/wrapping/unwrap returns it exactly once. Secure-introduction: hand a consumer a short-lived token instead of the secret.

All of it stdlib-only — still essentially one dependency. Symmetric and signing key operations are mutually exclusive, and existing untyped keys keep working as AES-256.

Pre-release. Not production-hardened; no external security review. For production, use HashiCorp Vault or OpenBao.

See CHANGELOG.md.