@antzsoft/chat-core 1.3.5 → 1.3.7

package/README.md

@@ -3056,6 +3056,22 @@ document.querySelectorAll('[data-conv-id]').forEach((el) => {
 
 ## Changelog
 
+### v1.3.7
+
+- **Docs only — no code changes.** Brought the docs fully up to date: added the missing
+  release notes to `docs/integration-guide.html` (its "What's New" section had stopped at
+  v1.3.4) so both the README changelog and the HTML integration guide now cover v1.3.5,
+  v1.3.6, and this v1.3.7 entry. No SDK behaviour changed in this version; upgrading from
+  1.3.6 is a no-op at runtime.
+
+### v1.3.6
+
+- **Fix: `reconnectSocket` now PRESERVES the transit session instead of recreating it** — follow-up to the 1.3.5 reconnect fix. 1.3.5 fixed `"Transit encryption required"` by disconnecting and re-running the full `connectSocket()` handshake, but that also cleared the cached transit session (the `'disconnect'` handler calls `clearTransitSession()`) and established a brand-new one with a new session key. Server-broadcast events (e.g. `user_online`) are encrypted with the session the server still holds, so a fresh client key could not decrypt them → continuous `"Transit decryption failed for event: user_online"`.
+
+  `reconnectSocket` is a token-only refresh — the transit session is still valid on the server (stored in Redis by `sessionId`, re-linked to the new socket on reconnect). So it now carries the existing `transitSessionId` forward in the handshake auth and reconnects the **same** socket **without** disconnecting, keeping the client's session key intact. The server re-links the same session (`getBySessionId` + `linkSocket`), so both sides keep the same key and decryption continues to work. Falls back to the full `connectSocket()` flow only when there is no valid cached session to preserve.
+
+  Net: keeps 1.3.5's "no more `Transit encryption required` on reconnect" while removing the `user_online` decryption-failure regression. **No integration changes required.**
+
 ### v1.3.5
 
 - **Fix: `reconnectSocket()` no longer drops the transit-encryption handshake** — when transit encryption is enabled, `reconnectSocket()` now delegates to the full `connectSocket()` flow instead of doing a bare `_socket.auth` swap. `reconnectSocket()` predates transit encryption and was never migrated: it overwrote `_socket.auth` with only `{ token, userId, tenantId }`, dropping the `transitSessionId` / `transitEphemeralPub` fields that `connectSocket()` sets during the handshake. Combined with the `'disconnect'` handler clearing the cached transit session, a reconnect after the socket had disconnected (e.g. app returning to foreground on iOS/Android, where backgrounding fully disconnects) went out with no transit auth and no cached session → the server rejected the handshake with **"Transit encryption required: missing transitEphemeralPub/transitAlgo in handshake auth"**. It was intermittent — fast devices whose cached transit session survived the reconnect were unaffected.

package/dist/index.cjs

@@ -1762,10 +1762,23 @@ function disconnectSocket() {
 }
 function reconnectSocket(token, userId, tenantId) {
   if (!_socket) return;
-  if (_config2?.transitEncryption && _getToken) {
-    if (!_socket.disconnected) _socket.disconnect();
-    void connectSocket(_config2, _getToken);
-    return;
+  if (_config2?.transitEncryption) {
+    const existing = getTransitSession();
+    if (existing?.enabled && existing.sessionId) {
+      _socket.auth = {
+        token: `Bearer ${token}`,
+        ...userId && { userId },
+        ...tenantId && { tenantId },
+        transitSessionId: existing.sessionId
+      };
+      _socket.connect();
+      return;
+    }
+    if (_getToken) {
+      if (!_socket.disconnected) _socket.disconnect();
+      void connectSocket(_config2, _getToken);
+      return;
+    }
   }
   _socket.auth = {
     token: `Bearer ${token}`,