v0.5.1

Added

• Add an optional cmd/recorder CLI with bounded HAR/NDJSON validation,
  metadata summaries, validated format conversion, and origin-restricted
  loopback handoff to the browser Inspector.
• Add read-only body-asset and checksum verification, streaming deterministic
  fixture selection, and a loopback-only hartest fixture server to the CLI,
  with atomic output publication and an independent coverage gate.
• Add a read-only CLI doctor for runtime, recorder schema, capture, and
  FileBodyStore compatibility diagnostics.
• Add side-effect-free FileBodyStore maintenance opening and a dry-run-first
  CLI reconciliation command that requires explicit authoritative confirmation
  before deleting unreferenced committed assets.
• Add tested, staged release automation for coordinated changelog and version
  updates, complete release gates, generated GitHub release notes, signed-tag
  preconditions, Go proxy checks, nested-module dependency updates, and timely
  retirement of module-specific API compatibility exceptions.

v0.5.0

[0.5.0] - 2026-07-23

Added

• Add side-effect-free Config.Validate startup checks for contradictory TLS
  capture flags, unsupported algorithms and modes, missing protection
  providers, and malformed redaction or content-decoder registrations.
• Add opt-in, context-aware hartest timing playback with scaling, a required
  per-exchange delay bound, response-header latency, and receive latency
  distributed across body reads.
• Add bounded, all-or-nothing HAR and streaming NDJSON readers in the optional
  hario package, with structural validation and fuzz coverage.
• Add bounded pull streams for processing large HAR and NDJSON captures one
  validated entry at a time without retaining prior entries.
• Add the optional, network-free hartest fixture transport with strict
  method/URL/query/header/body/request-trailer matching, an isolated request
  normalizer for volatile values, ordered fixture consumption, embedded and
  external bodies, trailers, recorded failures, protected-value resolution,
  and secret-safe diagnostics.
• Add lazy hartest.EntrySource replay so large HAR and NDJSON fixtures are
  pulled only as matching requires and consumed entries are released.
• Add Inspector export of all, selected, or current-trace entries as HAR or
  NDJSON, preserving original protected values and reporting fixture readiness.
• Add an explicitly dangerous Inspector export mode for values already resolved
  in memory, with plaintext-free risk summaries, .resolved filenames, source
  immutability, and two required handling acknowledgements.

Changed

• Split SPDX inventories along distributable boundaries: the standalone
  Recorder module excludes documentation examples, otelrecorder has its own
  SBOM, and the Inspector remains an independent asset.

• Separate internal API-design guards from external wire-schema contracts,
  remove the redundant hand-picked config surface check, and document the
  repository's CI maintenance gates.

• Resolve sensitive-value protection keys at most once per mode and exchange,
  sharing one immutable snapshot across request and response redaction, and
  reuse exchange-scoped AES-GCM state, tokenization state, and protected-token
  encoding buffers to reduce dense-body allocation.

• Replace the pre-1.0 BodyValue.Finish() string extension contract with
  FinishTo(io.Writer) error, allowing protected body values to reach their
  destination without an intermediate immutable string allocation.

• Add allocation-free ASCII name matching with Unicode-preserving fallbacks for
  streaming XML element and form field redaction.

• Reuse multipart boundary state, scan part headers without split allocations,
  and fast-path ordinary form-data parameters while retaining standard MIME
  parsing for escaped, extended, duplicate, or ambiguous syntax.

• Compare the root, hario, hartest, and otelrecorder public APIs with the
  latest releases in CI using a pinned golang.org/x/exp/apidiff, with explicit
  temporary review of intentional pre-v1 incompatibilities and a repository-
  hosted badge linking to the complete compatibility report.

• Eliminate per-key JSON decoding for ordinary ASCII keys and per-byte
  fail-closed buffering churn while retaining escaped and Unicode matching.

• Refresh the performance snapshot and extend benchmark coverage to bounded
  HAR/NDJSON ingestion and strict fixture replay.

• Pin the golangci-lint version used by local and CI checks through one
  repository-owned version file.

• Replace external Codecov uploads with repository-native coverage reporting:
  per-component thresholds, GitHub Actions job summaries, retained GitHub
  artifacts, local HTML/LCOV reports, and a browsable dashboard and badge
  published with the Inspector on GitHub Pages.

• Expand GoDoc with executable core, capture-reader, async-sink, redaction, and
  OpenTelemetry examples, and clarify public policy/configuration semantics.

• Redesign the Inspector export and live-stream tools as responsive, consistent
  workspace panels with clearer controls, status summaries, and safety guidance.

• Test every documentation example behavior and align coverage enforcement and
  reporting with the Recorder libraries, documented code examples,
  OpenTelemetry, and Inspector component boundaries; combine examples across Go
  module boundaries into one source-level coverage report.

Fixed

• Preserve XML siblings after redacting element names whose Unicode lowercase
  form is not equivalent under simple case folding, including Turkish İ.
• Enforce hario.MaxEntryBytes while a HAR entry is being read, preventing an
  oversized JSON value from being fully accumulated before rejection.
• Stop hartest.Transport from replacing a live request's body after matching;
  it now follows the http.RoundTripper contract by reading and closing the
  original body without mutating request fields.
• Consume a matched hartest fixture that represents a recorded transport
  failure, so Verify and repeated-request behavior follow the same one-shot
  contract as successful exchanges.
• Preserve JSON string, number, boolean, null, object, and array value types
  when the Inspector renders or exports resolved protected bodies; malformed
  and base64 bodies remain protected rather than producing misleading evidence.

v0.4.2

Added

• Add exact-origin DebugStreamRecorderConfig.AllowedOrigins opt-in so a trusted hosted Inspector can read the loopback-only development stream.
• Add a bounded, single-subscriber DebugStreamRecorder SSE handler and an Inspector live mode for ephemeral local development, with loopback-only access, explicit gap reporting, tests, and a complete runnable example.
• Add synchronous NewMultiRecorder fan-out with non-short-circuiting joined errors, mixed batch-capability preservation, and explicit downstream lifecycle ownership.
• Add a protocol E2E compatibility matrix over real loopback HTTP/1.1 and HTTP/2 servers, covering SSE streams, bidirectional trailers, concurrent requests, WebSocket upgrades, deterministic DNS/connect/TLS failures, and malformed HTTP/1.1 framing.
• Run protocol, request-comment, recorder batching, managed FileBodyStore, MemoryRecorder, HARFileRecorder, TraceStore, config-surface, and wire-contract behavioral tests from the external recorder_test package.

Changed

• Split release SBOMs by artifact so the Go library inventory excludes Inspector dependencies and the published Inspector has its own SPDX file.
• Redesign the Inspector around task-oriented evidence views, with a cohesive enterprise visual system and responsive dark/light themes.
• Improve Inspector navigation with accessible keyboard and screen-reader behavior, comment-aware search, a resizable persisted exchange list, and layouts validated against large captures.
• Expand Inspector summaries so every recorded field remains discoverable while common outcomes, timings, connection evidence, and diagnostics are easier to scan.

Fixed

• Preserve a bounded live-debug backlog before Inspector subscription and retry interrupted Inspector connections indefinitely without clearing received rows.
• Add a live Inspector control that clears the current exchange and trace-chain list without disconnecting or forgetting validated protection keys.
• Automatically resolve encrypted values in newly streamed Inspector entries after their key has been explicitly validated in the current live session.
• Normalize release SBOM asset names without leaking the Git tag's v prefix.
• Preserve upgraded response streams such as WebSocket connections without wrapping them or recording post-upgrade protocol frames as HTTP body bytes.

Full changelog: v0.4.1...v0.4.2

v0.4.1

Added

• Add request-scoped standard HAR exchange comments with redirect inheritance,
  Inspector display, copy support, list indicators, and comment filtering.
• Add V8 coverage reporting and enforced CI thresholds for the Inspector's
  framework-independent src/lib logic, with text, JSON summary, and LCOV
  output.
• Add automated SPDX JSON SBOM generation and validation for all Go modules
  and Inspector dependencies, with release assets and GitHub provenance
  attestations generated from published tags.
• Add CI and release vulnerability gates using govulncheck for every Go
  module and npm audit for the Inspector's runtime and build dependencies.
• Add combined Codecov reporting for all Go modules and the Inspector, with
  separate component flags and README status, reference, and coverage badges.

v0.4.0

Added

• Add Inspector support for local and remote JSONStreamRecorder NDJSON,
  including blank-line tolerance, strict all-or-nothing entry validation,
  physical line-number errors, and an explicit source-format indicator.
• Add a bounded FIFO AsyncRecorder decorator with evidence-preserving
  AsyncBlock backpressure by default, explicit drop-newest/drop-oldest
  policies, context-aware background drain, optional downstream close
  ownership, contained sink failures, and concurrency-safe queue/block/drop
  statistics.
• Add opt-in size/interval-based AsyncRecorder batching through structurally
  discovered RecordBatch([]*Entry) error, with FIFO shutdown flush, reusable
  batch storage, built-in recorder support, and batch health metrics.
• Add opt-in bounded AsyncBlock waiting with explicit drop fallback, active
  oldest-block age, fixed timeout drop reasons, and a panic-contained drop hook
  for releasing external assets owned by discarded entries.
• Add bounded OpenTelemetry health metrics for AsyncRecorder queue depth,
  capacity, throughput, producer blocking, drops, and downstream failures via
  otelrecorder.Config.AsyncRecorder.
• Bound MemoryRecorder to the newest 1,024 entries by default, with an
  explicit custom-capacity constructor, O(1) ring-buffer eviction, atomic
  snapshots, and retention/eviction statistics.
• Add managed FileBodyStore lifecycle APIs with transactional partial-file
  commit/abort, opaque references, byte/file quotas, startup partial recovery,
  explicit release/reconciliation, lifecycle statistics, and OpenTelemetry
  metrics.
• Add separate head-sampling and finalized-entry retention policies, stable
  request/trace sampling keys, an allocation-free uninstrumented drop path,
  metadata-only capture ceilings, automatic discarded-asset cleanup, bounded
  statistics, and OpenTelemetry sampling health metrics.
• Add protected-token key-ID inspection and resolver-based decrypt/verify
  helpers so trusted archive tooling can process mixed key generations.

Changed

• Change Recorder.Record and the optional batch capability to return errors,
  so synchronous sink failures are routed through Transport's internal-error
  policy. Remove JSONStreamRecorder.Err; AsyncRecorder.Close returns worker
  and downstream failures after draining.
• Change AsyncDropHandler to return errors and remove
  FileBodyStoreDropHandler; callers can pass FileBodyStore.ReleaseEntryAssets
  through a small closure, while failures now use AsyncRecorder's internal-error
  policy, stats, OpenTelemetry metric, and Close result.
• Replace the single-method ProtectionKeyProvider/ProtectionKeyResolver
  interfaces and their Func adapters with direct function types.
• Freeze the pre-v1 public surface around explicit Config,
  AsyncRecorderConfig, FileBodyStoreConfig, and otelrecorder.Config
  values; remove functional option APIs and policy adapter/interface pairs.
• Make Transport internals private and require the recorder and complete
  configuration at construction time.
• Consolidate every recorder-specific HAR entry field under the versioned
  _recorder v1 extension and publish its JSON Schema. The Inspector consumes
  only this schema and rejects unknown versions.
• Keep batch delivery and entry-asset release as structurally discovered
  internal capabilities instead of exported maintenance contracts.
• Replace the pre-1.0 BodyWriter.Close contract with explicit Commit and
  Abort outcomes so custom stores cannot confuse retry cleanup with asset
  publication.
• Invoke OnEntryCompleted before retention and Recorder delivery, with
  borrowed asset ownership limited to the callback duration, so discard paths
  cannot invalidate body references before completion observers run.
• Centralize the OpenTelemetry adapter's setup, lifecycle, complete
  metric/unit/attribute reference, data-safety guidance, and production
  alerting scenarios in otelrecorder/README.md.
• Pass the original request context to ProtectionKeyProvider, enabling
  request-scoped key selection without mutable Transport configuration.
• Use one fail-contained internal-error policy for Transport and
  AsyncRecorder, and make both recommended default configs log evidence
  degradation while their explicit zero values remain silent.

Fixed

• Avalanche deterministic sampling hashes before threshold comparison so low
  rates remain statistically representative for common prefixed, sequential,
  and fixed-width hexadecimal keys. Existing keys may receive a different
  deterministic decision after upgrading to this fix.

v0.3.0

Added

• Add pinned Go and ESLint pipelines with automatic Go formatting, whitespace enforcement, TypeScript correctness checks, and React Hooks validation.
• Use the stable TypeScript 7 native compiler while providing ESLint with Microsoft's supported TypeScript 6 compatibility API.
• Add a complete streaming CSV redactor example and a library-owned, bounded streaming BodyValue contract so custom formats and built-ins use the same centralized redact, encrypt, tokenize, size-limit, failure, and audit path.
• Add an independently pinned, end-to-end tested example for streaming Brotli and Zstandard record-time content decoding.
• Add immutable, additive request-scoped redaction rules carried by context, with independent request/response selectors, redirect inheritance, shared client concurrency isolation, and per-request custom body redactors.
• Extend otelrecorder with bounded metrics for HTTP phase latency, captured body size and outcome, protection-mode value counts, fail-closed fallbacks, and body-redactor outcomes.

Changed

• Change the pre-1.0 BodyRedactor.Redact signature to receive a body-scoped BodyValueProtector; custom implementations must stream each selected value through NewValue, Write, and Finish instead of buffering values or constructing replacements and protected tokens themselves. Remove the redundant BodyRedactionReporter; the central value lifecycle now owns all replacement and protection counts.
• Replace the separate WithRedact* and WithBodyRedactor APIs with one RedactionConfig model shared by WithRedaction, WithRequestRedaction, and RequestWithRedaction. Common rules apply to both directions, while Request and Response add direction-specific rules.
• Rename the pre-1.0 BodyCaptureDecision.BodyRedactor field to RedactorOverride, clarifying that nil preserves RedactionConfig and a non-nil value is the final override for one runtime-selected body.

v0.2.1

Added

• Precise Inspector timing hover details and a live timeline cursor.
• Session-memory token candidate verification, resolved-value views, and a control to clear sensitive in-memory data.
• Expanded structured-redactor, protection, body-pipeline, storage, compression, chunk-size, and parallel benchmark coverage.

Fixed

• Align HAR creator metadata with the module FQDN and release version.
• Eliminate per-byte output allocations in JSON, XML, and URL-encoded form streaming redactors.

v0.2.0

Added

• Pluggable streaming BodyRedactor API with explicit custom-over-built-in precedence.
• Per-request and per-response BodyCapturePolicy decisions.
• Non-sensitive _redaction audit metadata and a detailed Inspector audit view.
• Redact, AES-256-GCM encrypt, and HMAC-SHA-256 tokenize modes with versioned tokens and key IDs.
• Inspector workflows for batch decryption, candidate verification, and explicit decrypted Replay values.

Changed

• Inspector protection operations are grouped by mode and key ID and can process an exchange or an entire HAR.
• Decrypted in-memory values are shown consistently across detail tabs and proxy-aware Replay.
• Replay now has structured options, command, and review panels.
• Built-in and custom body redactors share one single-pass lifecycle; embedded HAR bodies reuse the already-redacted BodyStore representation.

Security

• Capture-policy errors and panics fail closed to metadata-only recording without changing the live HTTP exchange.
• URL-encoded and multipart form values are redacted before reaching memory/file body stores or embedded HAR content.
• Encrypted plaintext values are bounded; tokenization streams through HMAC; protection failures fall back to [REDACTED].
• Inspector keys and plaintext remain session-only, and Replay never consumes decrypted values by default.
• Key-provider and cryptographic failures are reported once per exchange direction with aggregate counts.

See the full changelog for details.

v0.1.1

Security

• Stream JSON/XML redaction before captured bytes reach the BodyStore, with bounded parser buffers and fail-closed depth/token limits.
• Redact every NDJSON document, accept an initial JSON UTF-8 BOM, and keep XML subtree suppression active across mismatched end tags.

The root module is tagged as v0.1.1 and the OpenTelemetry module as otelrecorder/v0.1.1.

v0.1.0

Added

• HAR 1.2 recording for the complete net/http client exchange lifecycle.
• Structured network, TLS, timing, error, body, trace, and redirect metadata.
• Memory, atomic HAR file, NDJSON, and pluggable body storage backends.
• Header, cookie, query, JSON, XML, error-message, and redirect redaction.
• Optional OpenTelemetry exporter.
• Browser-based HAR inspector with trace-chain grouping, aggregate timing
  waterfalls, safe image/video previews, JSON/XML highlighting, cURL replay,
  and local or remote HAR loading through deep links.

Changed

• Production defaults avoid capturing or embedding body content and raw trace
  data unless explicitly enabled.
• JSON and XML redaction preserve all unaffected source bytes.
• The core module requires Go 1.24; the OpenTelemetry module requires Go 1.25.

Security

• Body content capture, embedding, and hashing are opt-in by default.
• Redaction covers redirect URLs, URL-bearing headers, proxy URLs, structured
  bodies, errors, and raw trace details.
• Recorder callbacks and storage failures are isolated from HTTP behavior.
• Recorder-internal failures never replace the original HTTP transport error.