Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[1.1.0] — 2026-07-08

Added

AI Agent Attribution Taxonomy (Layer 0 Routing): Structural API key prefixing (val_human_, val_agent_, val_service_) resolving caller class in under 1µs.
Credential Handover Detection: Ingestion worker automatically overrides actor type to "agent" and flags credentialHandoverDetected = true if agent headers are passed using human credentials.
Thread-Local Async Storage: SDK-side AsyncLocalStorage-backed context store and volidator.runInAgentContext() helper to automatically propagate trace IDs and encrypted rationales across asynchronous execution boundaries.
Biometric Action Attestation (WebAuthn):
- SDK-side volidator.attestHumanAction(...) browser WebAuthn prompt integration.
- Zero-dependency canonical serializer (canonicalize) to deterministically sort JSON keys alphabetically during challenge hashing.
- Edge verification of ECDSA/RSA assertions with atomic challenge deletion (DELETE ... RETURNING) to prevent replay attacks and race conditions.
Framework auto-instrumentation updates for @volidator/node/agent-langchain.

[1.0.2] — 2026-07-07

Added

Robust SDK delivery retry strategy with exponential backoff on transient 5xx or network errors.
Added onDeliveryFailure callback config to handle terminal log send failures.
Console truncation warnings in development environment (NODE_ENV !== 'production') for depth limits and string caps.
Fluent batcher() client builder on the VolidatorClient instance for buffered log queueing and count-based auto-flushing.
Client credential overrides (projectId and clientSecret) on individual generateEmbedToken() calls.
Staging environment preview ([env.preview]) wrangler blocks for ingestion and management workers.

[1.0.0] — 2026-07-03

`@volidator/node`

Added

VolidatorClient — core client with AES-256-GCM zero-knowledge payload encryption using WebCrypto (no external crypto dependencies).
HMAC-SHA-256 blind indexes for actor, action, target, and tenant — preserves searchability without exposing plaintext to the server.
redactKeys — classic static redaction. Replaces specified field values with [REDACTED:fieldName] before encryption. Supports "actor", "target", and "metadata.fieldName" notation.
referenceKeys — JIT Hydration redaction. Stores [REF:id] instead of PII; the dashboard resolves reference IDs to display names at render time via postMessage. Blind indexes are computed from the original PII value so searchability is preserved.
Keyring support — pass a keyring object and activeEncryptionKeyId to support seamless encryption key rotation without re-encrypting historical logs. Keyring capped at 5 keys.
generateEmbedToken() — generates a signed HS256 JWT scoping the embeddable dashboard widget to a specific actor, target, tenant, or all / auditor. Signed entirely with WebCrypto (no jose dependency).
VolidatorCompliance — pre-tagged compliance logging helpers mapping actions to SOC 2 and ISO 27001 controls: accessGranted, accessRevoked, dataExported, systemConfigChanged, mfaEnabled.
Telemetry configuration — "strict" / "standard" / "full" presets with per-field overrides for IP handling (track / anonymize / skip), User-Agent handling (track / parse / skip), and location granularity.
VolidatorClient.extractContext(req) — zero-latency static header parser for Cloudflare Workers, Vercel, and Node.js IncomingMessage request formats.
Metadata safety: depth limit (5 levels), string truncation (1000 chars per value), and size guard (10 KB serialized limit).
withVolidator (@volidator/node/next) — Next.js App Router middleware wrapper. Injects a request-scoped volidator.log() and volidator.compliance.*() into the handler context, with IP/UA telemetry automatically applied to all calls including compliance events.
createClerkAudit (@volidator/node/clerk) — Clerk auth plugin. Automatically injects ctx.session.userId as the log actor.
createUniversalAudit (@volidator/node/universal) — Universal auth plugin. Compatible with Auth0, NextAuth, BetterAuth, Kinde, Supabase, and any provider via getUserId / getSession / getMetadata callbacks.

`@volidator/react`

Added

useVolidatorHydration hook — manages the full JIT Hydration postMessage lifecycle between the host application and the Volidator embed iframe. Strict origin validation, automatic deduplication, per-session caching, and graceful fallback on resolver errors.