v0.1.0-alpha

v0.1.0-alpha Release Notes

Draft status: feature-freeze materials prepared on 2026-07-06.

HonoWarden is pre-alpha and must not be used to store real secrets.

Scope

• package and runtime metadata version 0.1.0-alpha
• API-only encrypted vault sync server for Cloudflare Workers
• Hono runtime with D1 relational state and R2 object-storage binding
• restricted account bootstrap
• prelogin KDF discovery
• password and refresh token grants
• refresh-token rotation and reuse invalidation
• authenticated empty and item sync
• folder CRUD
• login and secure-note cipher create/update/lifecycle
• revision conflict protection
• device revoke
• GET /api/devices
• GET /api/devices/identifier/:identifier
• anonymous GET /api/devices/knowndevice preflight using encoded email and device headers
• revoke all other sessions with recent password authentication
• login defenses
• TOTP setup and login challenge flow
• recent password authentication for TOTP setup routes
• TOTP setup reuse guard for already-enabled accounts
• authenticated TOTP disable route with recent password authentication
• TOTP disable deletes retained setup secret and replay state
• totp.disable audit event coverage
• bounded retention cleanup for transient auth-defense rows
• explicit unsupported-feature responses for organization and public
  file-sharing surfaces
• operator backup/restore CLI wrapper
• opt-in secret-safe audit events
• compatibility fixture matrix
• user isolation regression coverage
• security review materials

Not Included

• Web Vault
• public registration
• Organizations or shared vaults
• Send
• production-ready account lifecycle admin tooling
• device metadata mutation, trust, and key update APIs
• independent security audit
• broad live client matrix promotion beyond the recorded CLI smoke

Compatibility

Compatibility remains conservative. The CLI row is promoted to live_smoke
after a synthetic login and empty-sync run. Browser, desktop, Android, and iOS
rows stay at fixture_only until live client runs are captured with
synthetic data and redacted evidence.

Operations

Read before deploying:

• Fresh Deploy Guide
• Upgrade Guide
• Rollback Guide
• Backup And Restore Runbook
• Security Review Index

Known Risks

• no independent security audit
• no production restore drill evidence committed yet
• audit logs are not persisted with retention controls
• transient auth-defense cleanup is inline on password-grant traffic, not a
  scheduled Cloudflare job
• TOTP wrapping-secret rotation lacks migration tooling
• access-token signing uses a symmetric secret without key id rotation support
• Cloudflare account-level access controls are not documented in this repository

Release Gate

Do not tag v0.1.0-alpha until:

• CI passes on the release commit
• migration freeze hashes match
• dependency audit evidence is current
• release docs are reviewed
• staging dry-run evidence is recorded
• backup fresh-target restore drill is recorded
• synthetic client login/sync evidence is recorded
• pnpm release:tag:preflight -- --strict --check-remote reports ready on
  the clean release commit
• Alpha Tagging Runbook has been followed with explicit
  operator approval for tag creation and push
• pnpm release:github:plan -- --strict --check-remote reports ready after
  the tag has been pushed and verified