ecto_encrypted

# Changelog

This project follows [Semantic Versioning](https://semver.org/).

## Unreleased

## 0.1.0 - 2026-08-13

- Rename the public type to `Encrypted` and the Hex package and OTP application
  to `ecto_encrypted`.
- Rename the cryptographic domains and regenerate the pinned version 1 vector
  before the first release.
- Accept both the Ecto 3.11 and Ecto 3.12-or-later parameterized-type metadata
  shapes during rotation.
- Reject embedded-schema declarations and embedded serialization with a direct
  error.
- Authenticate decryption with the version from the decoded envelope so a
  future reader can retain support for earlier versions.
- Require raw derived keys at the internal crypto boundary.
- Document the AES-GCM random-IV invocation limit.
- Remove dead error variants, an unreachable rotation branch, and the unused
  Logger application.
- Require every encrypted field to select `redact: true` or `redact: false`.

- Add AES-256-GCM encryption through an `Ecto.ParameterizedType`.
- Add a versioned binary envelope with authenticated table and column context.
- Add runtime key rings, per-field HKDF-SHA-384 keys, and active-key rotation.
- Add optimistic, batched, keyset-paginated PostgreSQL rotation.
- Add pinned format vectors, property tests, and PostgreSQL integration tests.
- Create the library structure, quality checks, documentation, and package
  metadata.
- Add a pinned Nix development shell and direnv entry point.