# Changelog

All notable consumer-visible changes are recorded here. The format follows
Keep a Changelog categories, and releases follow Semantic Versioning with the
additional pre-1.0 policy in `SUPPORT.md`.

## [Unreleased]

### Added

- Conditional browser, browser-worker, Cloudflare Worker, Bun, and Deno
  runtime profiles while preserving the existing 25-name public surface.
- Browser DNS support for Google, Cloudflare, and Quad9 plus browser-safe email
  intelligence with memory-only caches; complete email/DNS support for
  Cloudflare Workers, including the provider named `native` through Cloudflare
  `node:dns` compatibility.
- Additive per-call provider selection through `options.provider` on the
  options-bearing DNS helpers, while retaining the positional provider form;
  supplying both forms is rejected before resolver work.
- Configurable validator-cache persistence, absolute storage directory, entry
  ceiling, and per-file byte ceiling, including a deterministic zero-disk
  mode.
- Enterprise security, support, contribution, governance, data-flow, release,
  CI, and critical-contract controls.

### Changed

- Cloudflare Workers reach Quad9 over authenticated DNS-over-TLS on port 853;
  their `native` provider uses Cloudflare `node:dns`; browsers use RFC 8484
  Fetch GET; server runtimes use HTTP/2 DoH.
- Provider attribution, webmail metadata, disposable-domain corrections, and
  provider-specific logos were reconciled without renaming shipped providers.
- Development tooling dependencies were updated to remove known npm advisory
  findings.

### Fixed

- Quad9 requests no longer depend on HTTP/1.1, which Quad9 disabled globally
  in December 2025.
- Resolver deadline/failover, shared provider admission, provider cache
  isolation, native loader/API parity, HTTP redirect/SSRF boundaries,
  bounded persistent-cache locking and lifecycle, package artifacts, and
  numerous provider-classification regressions.

### Security

- Root publishing is blocked; release remains held for credential/session,
  license/data-rights, native provenance, hosted-control, and hosted immutable-
  candidate live runtime/browser gates documented in the active enterprise
  plan.

## [0.1.2] - 2026-06-01

Published baseline. Historical changes before the current audited workspace
were not reconstructed; do not infer undocumented guarantees from this entry.