Release v0.10.0

Adds observation.Service.FastForward, which skips an observer to the tail of its event sequence.

Added

• FastForward on the observation service and its FastForwardResult. Requires Chronicle 19.56.0 or later.

Changed

• Contracts are regenerated from Chronicle 19.56.0, and the verified decision-guard profile and the integration workflow image move from 19.32.3 to 19.56.0. The full integration suite passes against a 19.56.0 kernel.

Release v0.9.1

Security

• Upgrade golang.org/x/net to v0.60.0 to fix GO-2026-6603, GO-2026-6610, GO-2026-6611, GO-2026-6612 and GO-2026-6617 (#100)

Release v0.9.0

Several protected-data operations the SDK refused because of kernel defects now work against Chronicle 19.32.x, matching the C# client. The client checks the kernel version of the connection that actually sends each request and keeps refusing them with ErrUnsupported, without sending anything, on older kernels (including after a reconnect) or when compatibility verification is skipped: mixed all-event replay needs 19.32.1 or later, the others 19.32.2 or later.

Changed

• Sequence.Revise accepts replacements with PII or subject, namespace or global encryption instead of returning ErrUnsupported. The kernel protects the revision and its system request with the original event's subject, and erasing that subject removes the revised personal data. Revising with an unclassified generation of an event type that another generation classifies is still refused, because that plaintext could not be erased. (part of #87) (part of #40)
• Classified read models work on projection replay routes: bounded and passive GetAll, ReplayProjection, GetSnapshots, hydration sessions and immediate projections release each value with the subject it was written under, for both Id and id keys, instead of returning ErrUnsupported. (part of #87) (part of #33)
• Decision reads admit classified models, as in C#, and server agreement no longer compares server-side protection metadata. (part of #87) (part of #34)
• Projections that subscribe to all events and also map explicit event types can be read through bounded collection replay, ReplayProjection and GetSnapshots. (part of #87) (part of #33)
• Protection declared beneath an unprotected map, and on array elements that are themselves lists or maps, now registers instead of failing with declarations.DeclarationError. Beneath a map, the kernel protects each map value's classified members; a classified list- or map-valued array element is protected and erased as a whole element. (part of #87) (part of #35)

Deprecated

• readmodels.DecisionProtectedModel and readmodels.DecisionProtectionMetadata are no longer returned by decision-read admission and will be removed in a future release. (part of #34)

Release v0.8.0

Added

• Projections can build children of a derived-type family: a children collection of an interface with exactly one registered derivative uses that concrete type for its fields, key, parent key and mapping tags, and writes _derivedTypeId on every child From, so the family codec reads the child back even when the kernel adds it from a keyed update after removal or before creation; the C# client stamps only the creating event. The fluent projections.Children accepts the same family with the derivative's builder, and a derivative's key, no-auto and not-projected tags do not turn another read model that holds the family as a whole property into a projection. See project derived children. (#27)

Changed

• Compiling a projection now fails with a located declaration error when a derived children collection has no or several registered derivatives, when its discriminator cannot be written as a kernel literal, when a global mapping targets _derivedTypeId, or when a derivative declares projection mappings outside a children collection of its family, including nested interface fields. The C# client instead writes children without a discriminator or drops those declarations.

Release v0.7.0

Chronicle.Go now targets Chronicle 19.32.3, including its generated protocol contracts and the development kernel image used for real-kernel testing.

Added

• Generated contracts/alerts and contracts/eventsources packages, plus the EventSource fields on append requests and event contexts, from the Chronicle 19.32.3 protocol. The SDK does not set EventSource or expose alerts and event-source registration yet.

Changed

• Generated contracts are pinned to Chronicle 19.32.3 (contracts.ProtocolVersion), and the getting-started and contributing guides start cratis/chronicle:19.32.3-development.
• Decision guards are qualified on Chronicle 19.32.3. Upgrade the kernel to 19.32.3 before using decision reads; other kernel versions, including 19.29.4, return chronicle.ErrUnsupported. (#79)
• Webhook Bearer, Basic and OAuth authorization is persisted in the selected event store on Chronicle 19.32.3, and the documentation no longer lists the missing authorization as a kernel limitation. (#48)
• Global confidentiality (encrypted(scope=global)) and protected numeric scalars are documented as working from Chronicle 19.32.3. (part of #35)
• RemovedWithJoin removes children identified by id or Id on Chronicle 19.32.3. (part of #26)
• Projection queries without an explicit read-model target infer their schema on Chronicle 19.32.3. (part of #27)
• The reactor guide no longer requires waiting for observers before the first append on Chronicle 19.32.3; the wait remains documented for older kernels.

Release v0.6.0

Added

• Binary values: []byte fields (and named byte-slice types, with one optional pointer) are written as base64 strings that match the C# client, including + escaped as \u002B, "" for empty values and omission of nil values. Supported shapes are fields in event payloads, including fields inside nested objects, top-level read-model fields, and From AutoMap copies between binary fields (part of #64)

Changed

• Binary values are refused with ErrUnsupported before registration in every other use. That includes collections of binary values, which the pinned kernel corrupts when projecting them (Cratis/Chronicle#4595). It also includes maps, joins, variants, keys, identities, subjects, indexes, unique constraints, protection, event migrations and literals. Types that contain binary values must use simple ASCII property names that are unique regardless of case and are not reserved by the kernel (part of #64)
• Decoding a binary value accepts only canonical, padded base64. Values with whitespace or null elements, which the C# client tolerates, are rejected (part of #64)

Release v0.5.0

Added

• Configure trusted gRPC stats handlers on SDK-owned connections, including reconnects, while keeping handler lifetimes application-owned. (#53)

Release v0.4.0

Changed

• Strict read-model scenarios (ReadModelOptions.StrictEventSubscription) now decide whether a seeded event is subscribed the same way the kernel does for the projection. Children, joins, nested scopes, removal events and derived event types all count, and keys do not. Strict scenarios no longer refuse relationship, custom-key or mixed-All projections when they open. Unsubscribed seeds are still rejected in Given with ErrUnsubscribedEventSeeded before anything is appended. Reading results for those profiles still returns ErrUnsupported (part of #38)

Fixed

• A strict scenario now rejects a root-level join-removal event as unsubscribed, matching the kernel, instead of refusing the whole projection (part of #38)

Release v0.3.0

Added

• Capture webhook sources accept inbound authorization: captures.Webhook(path, captures.WithBasicAuth(...)), WithBearerToken or WithOAuth, readable through Source.Authorization() and Definition.Authorization(). Authorization never appears in the capture declaration text, and is redacted from fmt and log/slog output, including when held in private fields (part of #37)

Changed

• captures.Service.Validate and Save return ErrUnsupported for a definition that carries source authorization, before anything is sent to the kernel, so credentials are never silently dropped. The kernel's capture contract cannot carry authorization yet (Cratis/Chronicle#4591) (part of #37)
• A webhook source rejects blank credentials and more than one authorization option at Build; C# keeps only the last option (part of #37)
• json.Marshal and json.Unmarshal of capture Source, Definition, Builder and SourceAuthorization now fail with ErrUnsupported instead of producing {}, so credentials cannot be serialized or silently decoded as no authorization (part of #37)

Release v0.2.0

Added

• Connection lifecycle hooks: WithOnConnected and WithOnDisconnected register ConnectionHook callbacks that receive a ConnectionEvent (generation, connection ID, selected address and cause) on every connect, reconnect and close. Hooks run on a client-owned dispatcher in transition order, never delay reconnects, contain panics and always pair a delivered Connected with exactly one Disconnected, including on Close (part of #62)
• Custom load balancing: WithLoadBalancer accepts your own LoadBalancer that picks the endpoint for every connection attempt, including SRV-discovered candidates. A failed selection returns *LoadBalancerError and is retried with the normal reconnect backoff. The client borrows the balancer and never closes it, and rejects it when combined with a loadBalancer= connection-string option or WithGRPCConnection (part of #62)