@droponair/sdk-js 0.12.0 → 0.13.1

package/CHANGELOG.md

@@ -6,6 +6,29 @@ This project follows [Semantic Versioning](https://semver.org/).
 
 ---
 
+## [0.13.1], 2026-05-21
+
+### Changed
+
+- **`revokeAttachment` accepts an `AttachmentRef`.** Calling `revokeAttachment(ref)` now also revokes the linked preview thumbnail (`ref.thumbnailAttachmentId`) in the same call. `revokeAttachment(attachmentId)` with a plain id string is unchanged and revokes only that one attachment. Additive — no breaking change.
+
+---
+
+## [0.13.0], 2026-05-21
+
+### Added
+
+- **Group read receipts.** When a group has `readReceiptsVisibleToGroup` enabled, a member's `markRead(messageId, groupId)` is fanned to every other member, not just the reader's own devices. The inbound `ReadReceiptEvent` now carries `fromUserId` so you know which member read the message. New `client.updateGroup(groupId, { name?, readReceiptsVisibleToGroup? })` controls the per-group flag (it is a group-level choice; off by default). Broadcasts stay own-device only by design.
+- **Attachment revoke.** New `client.revokeAttachment(attachmentId)` — the platform stops issuing download URLs for it and recipients with a live connection get an `ATTACHMENT_REVOKED` event via `onEvent` (metadata = attachmentId). Bytes already downloaded cannot be recalled.
+- **Attachment preview thumbnails.** `prepareAttachmentAndUpload` accepts an optional `thumbnail` (and `thumbnailMimeType`). Entirely optional — if provided, the SDK uploads it as a separate attachment encrypted the same way and links it via `AttachmentRef.thumbnailAttachmentId`; download it like any attachment. If omitted, there is simply no thumbnail.
+
+### Notes
+
+- Download authorization for GROUP attachments is now checked against *current* group membership: a user removed from a group can no longer download its attachments even if they were a recipient at upload time.
+- No PROTOCOL_VERSION change — additive proto fields (`SyncFrame.fromUserId`, `AttachmentRef.thumbnailAttachmentId`) and an additive event type.
+
+---
+
 ## [0.12.0], 2026-05-20
 
 ### Added

package/README.md

@@ -121,6 +121,16 @@ client.onReadReceipt(e => {
 });
 ```
 
+**Group read receipts.** Since SDK `0.13.0`, a group can opt into sharing read receipts with every member. Call `updateGroup(groupId, { readReceiptsVisibleToGroup: true })` (owner/admin); after that, a member's `markRead()` on a group message is broadcast to every other member, and `onReadReceipt` fires with `e.fromUserId` set to the member who read it. It is **opt-in per group** — the platform never enables it for you, and it has no effect unless read receipts are also enabled for your app.
+
+```typescript
+await client.updateGroup(groupId, { readReceiptsVisibleToGroup: true });
+
+client.onReadReceipt(e => {
+  // e.fromUserId is the group member who read e.messageId
+});
+```
+
 ### Notification clear & draft sync
 
 Available since SDK `0.12.0`, both own-device only. `clearNotification()` tells your user's other devices a conversation's notifications were dismissed — always available. `syncDraft()` pushes a draft so the user can keep typing on another device — **opt-in** (the app owner enables it in the dashboard) and the draft text crosses the relay in cleartext.
@@ -231,8 +241,12 @@ client.onMessage(async (msg) => {
 | `createUploadSession(options)` | `Promise<UploadSession>` | Low-level: presigned PUT URL only |
 | `finalizeAttachment(attachmentId, sha256)` | `Promise<void>` | Low-level: commit integrity hash |
 | `downloadAttachment(ref)` | `Promise<DownloadedAttachment>` | Get presigned URL + download + decrypt |
+| `revokeAttachment(attachmentId \| ref)` | `Promise<void>` | Revoke an attachment you sent; recipients get `ATTACHMENT_REVOKED` |
 | `sendMessage(toUserId, text, { attachments })` | `Promise<{ messageId }>` | Send with attachments |
 
+- **Preview thumbnails (optional).** Pass `thumbnail` (bytes) in `prepareAttachmentAndUpload` options and the SDK uploads it as a separate encrypted attachment, linked via `AttachmentRef.thumbnailAttachmentId`. Purely the developer's choice; omit it and there is no thumbnail. Download the thumbnail like any attachment.
+- **Revoke.** `revokeAttachment()` stops the platform issuing new download URLs and notifies recipients. Bytes a recipient already downloaded cannot be recalled. For GROUP attachments, download is authorized against *current* group membership, so a removed member loses access. Pass an `AttachmentRef` instead of an id (`revokeAttachment(ref)`, since 0.13.1) to revoke the linked preview thumbnail in the same call; a thumbnail is a separate attachment, so revoking a bare id leaves its thumbnail untouched.
+
 - E2EE: a random AES-256-GCM file key encrypts the bytes; the file key is wrapped per recipient device using X25519 + HKDF (same model as message payloads). Server never sees the unwrapped file key.
 - Availability and per-file / per-month limits depend on your plan and are enforced server-side before the presigned URL is issued. See the [pricing page](https://www.droponair.com/pricing) and your dashboard Subscription page for what's enabled on your app.
 - Upload URL TTL = 15 min. Download URL TTL = 5 min. Download authorization checks that the requester is the original sender or in the captured recipient list.
@@ -255,6 +269,7 @@ client.onMessage(async (msg) => {
 | `getGroup(groupId)` | `Promise<GroupInfo>` | Get group details |
 | `addGroupMembers(groupId, userIds)` | `Promise<GroupInfo>` | Add members (owner/admin) |
 | `removeGroupMember(groupId, userId)` | `Promise<GroupInfo>` | Remove a member (owner/admin) |
+| `updateGroup(groupId, { name?, readReceiptsVisibleToGroup? })` | `Promise<GroupInfo>` | Update group settings (owner/admin) |
 | `deleteGroup(groupId)` | `Promise<void>` | Delete a group (owner only) |
 | `sendGroupMessage(groupId, plaintext, memberUserIds, options?)` | `Promise<{ messageId }>` | Send an end-to-end encrypted group message (sender-side per-recipient fan-out). `options.attachments` for E2EE group attachments. |
 | `sendCleartextGroupMessage(groupId, plaintext)` | `Promise<{ messageId }>` | Send a plaintext (non-encrypted) group message; server fans out to every other member. |

package/dist/attachment/attachment-client.d.ts

@@ -43,6 +43,13 @@ export declare class AttachmentClient {
      * finalizes, and returns a fully-formed AttachmentRef for sendMessage.
      */
     prepareAttachmentAndUpload(input: Uint8Array, opts: PrepareAttachmentOptions): Promise<AttachmentRef>;
+    /**
+     * Revoke an attachment you sent (Phase 2f). After revoke the platform
+     * refuses to issue further download URLs and recipients with a live
+     * connection get an ATTACHMENT_REVOKED event. Bytes a recipient already
+     * downloaded cannot be recalled.
+     */
+    revokeAttachment(attachmentId: string): Promise<void>;
     getDownloadUrl(attachmentId: string): Promise<{
         url: string;
         method: string;

package/dist/attachment/attachment-client.js

@@ -78,6 +78,20 @@ class AttachmentClient {
         if (!input || input.length === 0) {
             throw new Error('attachment bytes are empty');
         }
+        // Optional preview thumbnail: the developer's choice. If supplied, upload
+        // it as an independent attachment (same conversation + recipients +
+        // encryption) and link it from the main ref. The recursive call passes
+        // thumbnail: undefined so it terminates.
+        let thumbnailAttachmentId;
+        if (opts.thumbnail && opts.thumbnail.length > 0) {
+            const thumbRef = await this.prepareAttachmentAndUpload(opts.thumbnail, {
+                ...opts,
+                thumbnail: undefined,
+                mimeType: opts.thumbnailMimeType ?? 'image/jpeg',
+                onUploadProgress: undefined,
+            });
+            thumbnailAttachmentId = thumbRef.attachmentId;
+        }
         const encryptionType = opts.encryptionType ?? 'E2EE';
         const conversationType = opts.groupId ? 'GROUP' : 'ONE_TO_ONE';
         if (conversationType === 'ONE_TO_ONE' && !opts.toUserId) {
@@ -129,8 +143,23 @@ class AttachmentClient {
             sha256,
             encryptionType,
             wrappedKeys,
+            thumbnailAttachmentId,
         };
     }
+    /**
+     * Revoke an attachment you sent (Phase 2f). After revoke the platform
+     * refuses to issue further download URLs and recipients with a live
+     * connection get an ATTACHMENT_REVOKED event. Bytes a recipient already
+     * downloaded cannot be recalled.
+     */
+    async revokeAttachment(attachmentId) {
+        const jwt = await this.deps.getValidDropOnAirJwt();
+        const resp = await this.deps.fetchFn(`${this.deps.httpUrl}/v1/attachments/${encodeURIComponent(attachmentId)}/revoke`, { method: 'POST', headers: { Authorization: `Bearer ${jwt}` } });
+        if (!resp.ok) {
+            const text = await resp.text().catch(() => '');
+            throw new Error(`Failed to revoke attachment (HTTP ${resp.status}): ${text}`);
+        }
+    }
     async getDownloadUrl(attachmentId) {
         const jwt = await this.deps.getValidDropOnAirJwt();
         const resp = await this.deps.fetchFn(`${this.deps.httpUrl}/v1/attachments/${encodeURIComponent(attachmentId)}/download-url`, {
@@ -204,6 +233,7 @@ class AttachmentClient {
                 senderPublicKey: wk.senderPublicKey,
                 nonce: wk.nonce,
             })),
+            thumbnailAttachmentId: ref.thumbnailAttachmentId ?? '',
         };
     }
     /** Convert a wire AttachmentRef (from a received message) into the public type. */
@@ -214,6 +244,7 @@ class AttachmentClient {
             mimeType: wire.mimeType,
             sizeBytes: Number(wire.sizeBytes),
             sha256: wire.sha256,
+            thumbnailAttachmentId: wire.thumbnailAttachmentId ? wire.thumbnailAttachmentId : undefined,
             encryptionType: wire.encryptionType === 1 ? 'CLEARTEXT' : 'E2EE',
             wrappedKeys: (wire.wrappedKeys ?? []).map((wk) => ({
                 deviceId: wk.deviceId,

package/dist/attachment/attachment-types.d.ts

@@ -27,6 +27,12 @@ export interface AttachmentRef {
     encryptionType: AttachmentEncryptionType;
     /** Empty for CLEARTEXT. One entry per recipient device for E2EE. */
     wrappedKeys: DeviceWrappedKey[];
+    /**
+     * Optional. The attachmentId of a separate attachment holding a preview
+     * thumbnail. Present only when the sender chose to attach one. Download it
+     * like any attachment via {@link DropOnAirClient.downloadAttachment}.
+     */
+    thumbnailAttachmentId?: string;
 }
 /** Optional metadata for {@link DropOnAirClient.createUploadSession}. */
 export interface CreateUploadSessionOptions {
@@ -66,6 +72,15 @@ export interface PrepareAttachmentOptions {
     mimeType?: string;
     /** Progress callback called with bytes uploaded so far. */
     onUploadProgress?: (bytesUploaded: number, totalBytes: number) => void;
+    /**
+     * Optional preview thumbnail bytes. Entirely the developer's choice - if
+     * provided, the SDK uploads it as a separate attachment (encrypted with the
+     * same scheme as the main file) and links it via thumbnailAttachmentId. If
+     * omitted, the AttachmentRef simply has no thumbnail.
+     */
+    thumbnail?: Uint8Array;
+    /** Mime type of the thumbnail bytes (defaults to 'image/jpeg'). */
+    thumbnailMimeType?: string;
 }
 /** Bytes payload returned by downloadAttachment. */
 export interface DownloadedAttachment {

package/dist/core/messaging-client.d.ts

@@ -93,6 +93,7 @@ export declare class MessagingClient implements DropOnAirClient {
     createUploadSession(options: CreateUploadSessionOptions): Promise<UploadSession>;
     finalizeAttachment(attachmentId: string, sha256: string): Promise<void>;
     downloadAttachment(ref: AttachmentRef): Promise<DownloadedAttachment>;
+    revokeAttachment(attachment: string | AttachmentRef): Promise<void>;
     connect(): Promise<void>;
     disconnect(): void;
     sendMessage(toUserId: string, plaintextMessage: string, options?: {
@@ -213,6 +214,15 @@ export declare class MessagingClient implements DropOnAirClient {
     createGroup(name: string, memberUserIds?: string[]): Promise<GroupInfo>;
     listGroups(): Promise<GroupInfo[]>;
     getGroup(groupId: string): Promise<GroupInfo>;
+    /**
+     * Update a group. Any omitted field is left unchanged. `readReceiptsVisibleToGroup`
+     * (Phase 2e) controls whether members' group read receipts are visible to
+     * the whole group or stay own-device only.
+     */
+    updateGroup(groupId: string, update: {
+        name?: string;
+        readReceiptsVisibleToGroup?: boolean;
+    }): Promise<GroupInfo>;
     addGroupMembers(groupId: string, userIds: string[]): Promise<GroupInfo>;
     removeGroupMember(groupId: string, userId: string): Promise<GroupInfo>;
     deleteGroup(groupId: string): Promise<void>;

package/dist/core/messaging-client.js

@@ -270,6 +270,17 @@ class MessagingClient {
     async downloadAttachment(ref) {
         return this.attachmentClient.downloadAttachment(ref);
     }
+    async revokeAttachment(attachment) {
+        if (typeof attachment === 'string') {
+            return this.attachmentClient.revokeAttachment(attachment);
+        }
+        // Revoke the main attachment first so the primary intent always lands,
+        // then cascade to the linked preview thumbnail if there is one.
+        await this.attachmentClient.revokeAttachment(attachment.attachmentId);
+        if (attachment.thumbnailAttachmentId) {
+            await this.attachmentClient.revokeAttachment(attachment.thumbnailAttachmentId);
+        }
+    }
     async connect() {
         this.log('connect_start');
         this.shouldReconnect = true;
@@ -723,6 +734,7 @@ class MessagingClient {
                 messageId: frame.messageId,
                 conversationId: frame.conversationId || undefined,
                 timestamp: frame.timestamp,
+                fromUserId: frame.fromUserId || undefined,
             };
             for (const listener of this.readReceiptListeners) {
                 try {
@@ -878,6 +890,22 @@ class MessagingClient {
             throw new Error(`getGroup failed (HTTP ${res.status})`);
         return res.json();
     }
+    /**
+     * Update a group. Any omitted field is left unchanged. `readReceiptsVisibleToGroup`
+     * (Phase 2e) controls whether members' group read receipts are visible to
+     * the whole group or stay own-device only.
+     */
+    async updateGroup(groupId, update) {
+        const jwt = await this.getValidDropOnAirJwt(false);
+        const res = await this.fetchFn(`${this.httpUrl}/api/groups/${encodeURIComponent(groupId)}`, {
+            method: 'PUT',
+            headers: { Authorization: `Bearer ${jwt}`, 'Content-Type': 'application/json' },
+            body: JSON.stringify(update),
+        });
+        if (!res.ok)
+            throw new Error(`updateGroup failed (HTTP ${res.status})`);
+        return res.json();
+    }
     async addGroupMembers(groupId, userIds) {
         const jwt = await this.getValidDropOnAirJwt(false);
         const res = await this.fetchFn(`${this.httpUrl}/api/groups/${encodeURIComponent(groupId)}/members`, {

package/dist/core/types.d.ts

@@ -58,6 +58,12 @@ export interface ReadReceiptEvent {
     /** Optional peer userId / group id, echoed from markRead() for bucketing. */
     conversationId?: string;
     timestamp: number;
+    /**
+     * The user who read the message. Set when a group read receipt is fanned
+     * to other members (so you know WHICH member read it). Undefined / your own
+     * userId for plain own-device sync.
+     */
+    fromUserId?: string;
 }
 export type ReadReceiptCallback = (event: ReadReceiptEvent) => void;
 /**
@@ -110,6 +116,11 @@ export interface GroupInfo {
     createdBy: string;
     members: GroupMemberInfo[];
     createdAt: number;
+    /**
+     * Phase 2e. When true, a member's group read receipt is fanned to all other
+     * members; when false it stays own-device only. Controlled via updateGroup().
+     */
+    readReceiptsVisibleToGroup?: boolean;
 }
 export interface GroupMemberInfo {
     userId: string;
@@ -274,6 +285,16 @@ export interface DropOnAirClient {
     finalizeAttachment(attachmentId: string, sha256: string): Promise<void>;
     /** Download (and for E2EE decrypt) an attachment referenced inside a received message. */
     downloadAttachment(ref: import('../attachment/attachment-types').AttachmentRef): Promise<import('../attachment/attachment-types').DownloadedAttachment>;
+    /**
+     * Revoke an attachment you sent. The platform stops issuing download URLs
+     * for it and notifies recipients; bytes already downloaded cannot be
+     * recalled.
+     *
+     * Pass an attachment id to revoke that single attachment. Pass an
+     * `AttachmentRef` to also revoke its linked preview thumbnail
+     * (`thumbnailAttachmentId`) in the same call, if it has one.
+     */
+    revokeAttachment(attachment: string | import('../attachment/attachment-types').AttachmentRef): Promise<void>;
     /** Send a cleartext message to a user (no encryption). */
     sendCleartextMessage(toUserId: string, plaintext: string): Promise<{
         messageId: string;
@@ -324,6 +345,14 @@ export interface DropOnAirClient {
     listGroups(): Promise<GroupInfo[]>;
     /** Get details of a specific group. */
     getGroup(groupId: string): Promise<GroupInfo>;
+    /**
+     * Update a group (requires OWNER/ADMIN role). Omitted fields are unchanged.
+     * `readReceiptsVisibleToGroup` toggles group-wide read-receipt visibility.
+     */
+    updateGroup(groupId: string, update: {
+        name?: string;
+        readReceiptsVisibleToGroup?: boolean;
+    }): Promise<GroupInfo>;
     /** Add members to a group (requires OWNER/ADMIN role). */
     addGroupMembers(groupId: string, userIds: string[]): Promise<GroupInfo>;
     /** Remove a member from a group (OWNER/ADMIN can remove others; anyone can leave). */

package/dist/transport/protobuf-codec.d.ts

@@ -20,6 +20,7 @@ export interface WireAttachmentRef {
     sha256: string;
     encryptionType: number;
     wrappedKeys?: WireDeviceWrappedKey[];
+    thumbnailAttachmentId?: string;
 }
 export interface WireEnvelope {
     messageId: string;
@@ -158,6 +159,7 @@ export interface WireSyncFrame {
     conversationId?: string;
     timestamp: number;
     payload?: string;
+    fromUserId?: string;
 }
 /** Tombstone frame, scope FOR_EVERYONE or FOR_ME. */
 export interface WireMessageDeleteFrame {

package/dist/transport/protobuf-codec.js

@@ -59,7 +59,8 @@ const AttachmentRefType = new protobuf.Type('AttachmentRef')
     .add(new protobuf.Field('sizeBytes', 4, 'int64'))
     .add(new protobuf.Field('sha256', 5, 'string'))
     .add(new protobuf.Field('encryptionType', 6, 'EncryptionType'))
-    .add(new protobuf.Field('wrappedKeys', 7, 'DeviceWrappedKey', 'repeated'));
+    .add(new protobuf.Field('wrappedKeys', 7, 'DeviceWrappedKey', 'repeated'))
+    .add(new protobuf.Field('thumbnailAttachmentId', 8, 'string'));
 const EnvelopeType = new protobuf.Type('Envelope')
     .add(EncryptionTypeEnum)
     .add(DeviceEncryptedPayloadType) // nested type must be added first
@@ -225,7 +226,8 @@ const SyncFrameType = new protobuf.Type('SyncFrame')
     .add(new protobuf.Field('messageId', 2, 'string'))
     .add(new protobuf.Field('conversationId', 3, 'string'))
     .add(new protobuf.Field('timestamp', 4, 'int64'))
-    .add(new protobuf.Field('payload', 5, 'string'));
+    .add(new protobuf.Field('payload', 5, 'string'))
+    .add(new protobuf.Field('fromUserId', 6, 'string'));
 class ProtobufCodec {
     encodeEnvelope(value) {
         return EnvelopeType.encode(value).finish();

package/dist/version.d.ts

@@ -7,7 +7,7 @@
  *   MINOR, additive feature (e.g. multi-device payloads, new call event type)
  *   PATCH, bug-fix / perf improvement with no wire or API change
  */
-export declare const SDK_VERSION = "0.12.0";
+export declare const SDK_VERSION = "0.13.1";
 /**
  * Binary encrypted-payload format version.
  * Included as the first byte of every encrypted payload so receivers can

package/dist/version.js

@@ -10,7 +10,7 @@ exports.PROTOCOL_VERSION = exports.PAYLOAD_FORMAT_VERSION = exports.SDK_VERSION
  *   MINOR, additive feature (e.g. multi-device payloads, new call event type)
  *   PATCH, bug-fix / perf improvement with no wire or API change
  */
-exports.SDK_VERSION = '0.12.0';
+exports.SDK_VERSION = '0.13.1';
 /**
  * Binary encrypted-payload format version.
  * Included as the first byte of every encrypted payload so receivers can

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@droponair/sdk-js",
-  "version": "0.12.0",
+  "version": "0.13.1",
   "description": "DropOnAir SDK for end-to-end encrypted messaging",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",