August 18, 2026
New
Feed tokens, sessions, retention, exports & SDK 1.1
- Public keys are now ingest-only: they can submit auto-capture batches and nothing else. To read activity in the browser, your server mints a short-lived, actor-scoped feed token (POST /v1/feed-tokens) and passes it to <softechlog-feed feed-token="…">.
- Sessions are real: any event with a session_id (auto-capture always sends one) creates or extends a session, browsable and replayable in the dashboard and via GET /v1/sessions.
- Retention is enforced automatically: an hourly sweep deletes events (and their sessions) older than the plan window — 30 / 90 / 365 days. Actors are kept.
- Plan caps are enforced on every ingest path, single and batch, with a clear 402; the new Plan & usage page shows a live usage meter.
- Events API: free-text search (q=), action prefix filters (member.*), tuple cursors that never skip or duplicate rows, and CSV / JSON export (GET /v1/events/export) on all plans.
- New GET /v1/stats: headline totals, per-day series, top actions and usage — the numbers behind the dashboard Overview.
- Node & Python SDKs 1.1: automatic retries with backoff (network, 429, 5xx), feedToken() / feed_token(), sessionId / session_id, end-user context (ip, user-agent) — plus a FastAPI middleware that fills it in for you.
- Auto-capture 1.1: SPA route tracking (pushState / popstate), query strings and fragments stripped from URLs by default, data-stl-ignore / data-stl-mask, session ids, and sendBeacon flushes on unload.
- Feed component: zoneless Angular Elements build with Shadow DOM, feed-token attribute, --stl-font-family, built-in expired-token state.
- The dashboard no longer holds an API key in the browser — it uses its own session, so it works from any device. Errors from the API now carry a request_id.