Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

[Unreleased]

router-core: routes can now be registered with an optional TTL via register_route_with_ttl. resolve() returns RouteExpired once the current ledger exceeds a route's expiry, get_all_routes() excludes expired routes, and extend_route_ttl lets the admin extend a route's TTL before it expires. get_route_expiry returns a route's expiry ledger, if any. Routes registered without a TTL remain permanent.
router-access: blacklist entries can now include an optional reason and an expires_at timestamp. Expired blacklist entries are treated as not blacklisted.
router-registry: ContractEntry includes an optional deprecation_reason and the deprecate() API accepts an optional reason which is emitted in the contract_deprecated event.
router-registry: new RegistryError::InvalidHealthFn = 12 variant, returned by register_with_check when health_fn is not in the documented allow-list. Closes #828.
metrics/alerts.yml: example Prometheus alerting rules for circuit breaker opens, high failure/error rates, and high request volume.

Documentation: added a top-level CHANGELOG.md following Keep a Changelog format.

router-registry: register_with_check now restricts health_fn to a fixed allow-list of conventionally side-effect-free symbols — health or ping — and rejects any other symbol with the new InvalidHealthFn error before dispatching any cross-contract call. Previously, try_invoke_contract was invoked on the target address with an arbitrary admin-supplied symbol, allowing an admin (operator error, compromised key, or misleading naming on the target) to trigger state-mutating entry points on the registered contract during what was meant to be a passive liveness probe. The doc comment on register_with_check is updated with explicit security notes covering the invariant.

router-execution: execution pipeline with simulation, retries, and fee estimation
router-quote: read-only quote preview contract for expected output, fees, and route details
router-middleware: circuit breaker functionality with auto-recovery
router-middleware: call logging with configurable retention
router-core: route metadata support (description, tags, owner)
router-core: route aliasing system
router-core: route scoring and best route selection
metrics: Prometheus/OpenTelemetry metrics exporter

router-core: admin() now panics on uninitialized contract instead of returning Result
router-middleware: admin() now panics on uninitialized contract instead of returning Result

router-middleware: rate limit state no longer written when route is disabled before commit
router-middleware: call log retention now correctly enforces maximum entries