@antzsoft/chat-core 1.3.6 → 1.3.8

package/docs/integration-guide.html

@@ -155,7 +155,7 @@ section.sec>h2:hover{color:#fff}
 
   <div class="section-label">What's New</div>
   <ul>
-    <li><a href="#whats-new">v1.3.4 Release Notes</a></li>
+    <li><a href="#whats-new">v1.3.8 Release Notes</a></li>
   </ul>
 
   <div class="section-label">Getting Started</div>
@@ -250,12 +250,116 @@ section.sec>h2:hover{color:#fff}
   <h2>What's New</h2>
   <p style="color:var(--muted);font-size:13px;margin-bottom:20px">Version history and release notes. Click a version to expand.</p>
 
-  <!-- ── v1.3.4 (current) ── -->
+  <!-- ── v1.3.8 (current) ── -->
+  <div class="wn-version open" id="wn-138">
+    <div class="wn-header" onclick="toggleVersion('wn-138')">
+      <div class="wn-title">
+        <span class="wn-ver">v1.3.8</span>
+        <span class="wn-badge current">Current</span>
+        <span class="wn-date">July 2026</span>
+      </div>
+      <span class="wn-chevron">▲</span>
+    </div>
+    <div class="wn-body">
+      <div class="wn-item" id="wn-138-externalid">
+        <div class="wn-item-header" onclick="toggleItem('wn-138-externalid')">
+          <span class="wn-tag new">New</span>
+          <span class="wn-item-title">externalId now included on every embedded user, not just the standalone profile</span>
+          <span class="wn-chevron-sm">▾</span>
+        </div>
+        <div class="wn-item-body">
+          <p>Previously <code>externalId</code> (a user's ID in your external system, non-builtin modes) was only present on the <code>User</code> returned by <code>usersApi.list/getById/updateProfile</code>. Every <em>denormalized</em> place a user appeared dropped it, forcing a separate <code>usersApi.getById()</code> call to map a chat user back to your own system. These shapes now carry it:</p>
+          <ul>
+            <li><code>Participant</code> — new top-level <code>externalId?</code>, also mirrored on <code>Participant.user.externalId</code> (conversations API + conversation socket events).</li>
+            <li><code>Message.sender</code> — the server now populates <code>externalId</code> on the sender embed.</li>
+            <li><code>ReactionUser</code> (<code>messagesApi.getReactions</code>) — new <code>externalId?</code>.</li>
+            <li><code>MessageReceiptEntry</code> (<code>messagesApi.getReceipts</code>) — new <code>externalId?</code>.</li>
+            <li><code>TypingIndicatorEvent</code> (socket) — new <code>externalId?</code>. Present in non-builtin modes; <strong>absent in builtin mode</strong>, where no external identity exists.</li>
+          </ul>
+          <p><strong>Backward compatible, additive-only.</strong> Every field is optional. An older SDK against this server ignores the extra field; this SDK against an older server sees <code>externalId</code> as <code>undefined</code>. Note <code>externalId</code> (string, the chat user's external identity) is distinct from the pre-existing <code>Participant.externalUserId</code> (number) — both are sent; do not confuse them. Requires a server with this change to be populated; safe to upgrade regardless. <strong>No integration changes required</strong> — read <code>externalId</code> where you previously had to look it up separately.</p>
+        </div>
+      </div>
+    </div>
+  </div><!-- /.wn-version -->
+
+  <!-- ── v1.3.7 ── -->
+  <div class="wn-version open" id="wn-137">
+    <div class="wn-header" onclick="toggleVersion('wn-137')">
+      <div class="wn-title">
+        <span class="wn-ver">v1.3.7</span>
+        <span class="wn-date">July 2026</span>
+      </div>
+      <span class="wn-chevron">▲</span>
+    </div>
+    <div class="wn-body">
+      <div class="wn-item" id="wn-137-docs">
+        <div class="wn-item-header" onclick="toggleItem('wn-137-docs')">
+          <span class="wn-tag fix">Docs</span>
+          <span class="wn-item-title">Documentation brought up to date (no code changes)</span>
+          <span class="wn-chevron-sm">▾</span>
+        </div>
+        <div class="wn-item-body">
+          <p>This "What's New" section had stopped at v1.3.4. It now includes the v1.3.5 and v1.3.6 reconnect/transit fixes below, and this v1.3.7 entry. <strong>No SDK behaviour changed in 1.3.7</strong> — upgrading from 1.3.6 is a runtime no-op.</p>
+        </div>
+      </div>
+    </div>
+  </div><!-- /.wn-version -->
+
+  <!-- ── v1.3.6 ── -->
+  <div class="wn-version open" id="wn-136">
+    <div class="wn-header" onclick="toggleVersion('wn-136')">
+      <div class="wn-title">
+        <span class="wn-ver">v1.3.6</span>
+        <span class="wn-date">July 2026</span>
+      </div>
+      <span class="wn-chevron">▲</span>
+    </div>
+    <div class="wn-body">
+      <div class="wn-item" id="wn-136-transit-preserve">
+        <div class="wn-item-header" onclick="toggleItem('wn-136-transit-preserve')">
+          <span class="wn-tag fix">Fix</span>
+          <span class="wn-item-title"><code>reconnectSocket</code> preserves the transit session instead of recreating it</span>
+          <span class="wn-chevron-sm">▾</span>
+        </div>
+        <div class="wn-item-body">
+          <p>Follow-up to the v1.3.5 reconnect fix. v1.3.5 fixed <code>"Transit encryption required"</code> by disconnecting and re-running the full <code>connectSocket()</code> handshake — but that also cleared the cached transit session (the <code>'disconnect'</code> handler calls <code>clearTransitSession()</code>) and established a brand-new one with a new session key. Server-broadcast events (e.g. <code>user_online</code>) are encrypted with the session the server still holds, so a fresh client key could not decrypt them, producing continuous <code>"Transit decryption failed for event: user_online"</code>.</p>
+          <p><code>reconnectSocket</code> is a token-only refresh — the transit session is still valid on the server (stored in Redis by <code>sessionId</code>, re-linked to the new socket on reconnect). It now carries the existing <code>transitSessionId</code> forward in the handshake auth and reconnects the <strong>same</strong> socket <strong>without</strong> disconnecting, keeping the client's session key intact. The server re-links the same session, so both sides keep the same key and decryption keeps working. Falls back to the full <code>connectSocket()</code> flow only when there is no valid cached session to preserve (e.g. the socket was already disconnected).</p>
+          <p><strong>No integration changes required.</strong> Keeps v1.3.5's "no more <code>Transit encryption required</code> on reconnect" while removing the <code>user_online</code> decryption-failure regression.</p>
+        </div>
+      </div>
+    </div>
+  </div><!-- /.wn-version -->
+
+  <!-- ── v1.3.5 ── -->
+  <div class="wn-version open" id="wn-135">
+    <div class="wn-header" onclick="toggleVersion('wn-135')">
+      <div class="wn-title">
+        <span class="wn-ver">v1.3.5</span>
+        <span class="wn-date">July 2026</span>
+      </div>
+      <span class="wn-chevron">▲</span>
+    </div>
+    <div class="wn-body">
+      <div class="wn-item" id="wn-135-transit-reconnect">
+        <div class="wn-item-header" onclick="toggleItem('wn-135-transit-reconnect')">
+          <span class="wn-tag fix">Fix</span>
+          <span class="wn-item-title"><code>reconnectSocket</code> no longer drops the transit-encryption handshake</span>
+          <span class="wn-chevron-sm">▾</span>
+        </div>
+        <div class="wn-item-body">
+          <p><code>reconnectSocket</code> predates transit encryption and was never migrated: it overwrote <code>_socket.auth</code> with only <code>{ token, userId, tenantId }</code>, dropping the <code>transitSessionId</code> / <code>transitEphemeralPub</code> fields that <code>connectSocket()</code> sets during the handshake. Combined with the <code>'disconnect'</code> handler clearing the cached transit session, a reconnect after the socket had disconnected (e.g. app returning to foreground on iOS/Android, where backgrounding fully disconnects) went out with no transit auth and no cached session, so the server rejected the handshake with <code>"Transit encryption required: missing transitEphemeralPub/transitAlgo in handshake auth"</code>. Intermittent — fast devices whose cached transit session survived the reconnect were unaffected.</p>
+          <p>When transit encryption is on, <code>reconnectSocket</code> now delegates to the full <code>connectSocket()</code> flow (re-establishes/reuses the transit session, rebuilds the handshake auth) instead of a bare auth-swap. It also inherits <code>connectSocket()</code>'s in-flight dedupe, so multiple rapid reconnect calls collapse into one. Non-transit deployments keep the original fast bare auth-swap path unchanged.</p>
+          <p><strong>Note:</strong> v1.3.5 introduced a follow-on regression (see v1.3.6) — prefer <strong>1.3.6+</strong>. <strong>No integration changes required</strong> — same <code>reconnectSocket(token, userId, tenantId)</code> signature.</p>
+        </div>
+      </div>
+    </div>
+  </div><!-- /.wn-version -->
+
+  <!-- ── v1.3.4 ── -->
   <div class="wn-version open" id="wn-134">
     <div class="wn-header" onclick="toggleVersion('wn-134')">
       <div class="wn-title">
         <span class="wn-ver">v1.3.4</span>
-        <span class="wn-badge current">Current</span>
         <span class="wn-date">July 2026</span>
       </div>
       <span class="wn-chevron">▲</span>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@antzsoft/chat-core",
-  "version": "1.3.6",
+  "version": "1.3.8",
   "description": "Platform-agnostic core for Antz Chat — API, socket, stores, types. Works in browser, React Native (Expo or bare), and Node.js.",
   "author": "Antz",
   "license": "MIT",