@droponair/sdk-js 0.13.0 → 0.13.1

package/CHANGELOG.md

@@ -6,6 +6,14 @@ This project follows [Semantic Versioning](https://semver.org/).
 
 ---
 
+## [0.13.1], 2026-05-21
+
+### Changed
+
+- **`revokeAttachment` accepts an `AttachmentRef`.** Calling `revokeAttachment(ref)` now also revokes the linked preview thumbnail (`ref.thumbnailAttachmentId`) in the same call. `revokeAttachment(attachmentId)` with a plain id string is unchanged and revokes only that one attachment. Additive — no breaking change.
+
+---
+
 ## [0.13.0], 2026-05-21
 
 ### Added

package/README.md

@@ -121,6 +121,16 @@ client.onReadReceipt(e => {
 });
 ```
 
+**Group read receipts.** Since SDK `0.13.0`, a group can opt into sharing read receipts with every member. Call `updateGroup(groupId, { readReceiptsVisibleToGroup: true })` (owner/admin); after that, a member's `markRead()` on a group message is broadcast to every other member, and `onReadReceipt` fires with `e.fromUserId` set to the member who read it. It is **opt-in per group** — the platform never enables it for you, and it has no effect unless read receipts are also enabled for your app.
+
+```typescript
+await client.updateGroup(groupId, { readReceiptsVisibleToGroup: true });
+
+client.onReadReceipt(e => {
+  // e.fromUserId is the group member who read e.messageId
+});
+```
+
 ### Notification clear & draft sync
 
 Available since SDK `0.12.0`, both own-device only. `clearNotification()` tells your user's other devices a conversation's notifications were dismissed — always available. `syncDraft()` pushes a draft so the user can keep typing on another device — **opt-in** (the app owner enables it in the dashboard) and the draft text crosses the relay in cleartext.
@@ -231,11 +241,11 @@ client.onMessage(async (msg) => {
 | `createUploadSession(options)` | `Promise<UploadSession>` | Low-level: presigned PUT URL only |
 | `finalizeAttachment(attachmentId, sha256)` | `Promise<void>` | Low-level: commit integrity hash |
 | `downloadAttachment(ref)` | `Promise<DownloadedAttachment>` | Get presigned URL + download + decrypt |
-| `revokeAttachment(attachmentId)` | `Promise<void>` | Revoke an attachment you sent; recipients get `ATTACHMENT_REVOKED` |
+| `revokeAttachment(attachmentId \| ref)` | `Promise<void>` | Revoke an attachment you sent; recipients get `ATTACHMENT_REVOKED` |
 | `sendMessage(toUserId, text, { attachments })` | `Promise<{ messageId }>` | Send with attachments |
 
 - **Preview thumbnails (optional).** Pass `thumbnail` (bytes) in `prepareAttachmentAndUpload` options and the SDK uploads it as a separate encrypted attachment, linked via `AttachmentRef.thumbnailAttachmentId`. Purely the developer's choice; omit it and there is no thumbnail. Download the thumbnail like any attachment.
-- **Revoke.** `revokeAttachment()` stops the platform issuing new download URLs and notifies recipients. Bytes a recipient already downloaded cannot be recalled. For GROUP attachments, download is authorized against *current* group membership, so a removed member loses access.
+- **Revoke.** `revokeAttachment()` stops the platform issuing new download URLs and notifies recipients. Bytes a recipient already downloaded cannot be recalled. For GROUP attachments, download is authorized against *current* group membership, so a removed member loses access. Pass an `AttachmentRef` instead of an id (`revokeAttachment(ref)`, since 0.13.1) to revoke the linked preview thumbnail in the same call; a thumbnail is a separate attachment, so revoking a bare id leaves its thumbnail untouched.
 
 - E2EE: a random AES-256-GCM file key encrypts the bytes; the file key is wrapped per recipient device using X25519 + HKDF (same model as message payloads). Server never sees the unwrapped file key.
 - Availability and per-file / per-month limits depend on your plan and are enforced server-side before the presigned URL is issued. See the [pricing page](https://www.droponair.com/pricing) and your dashboard Subscription page for what's enabled on your app.
@@ -259,6 +269,7 @@ client.onMessage(async (msg) => {
 | `getGroup(groupId)` | `Promise<GroupInfo>` | Get group details |
 | `addGroupMembers(groupId, userIds)` | `Promise<GroupInfo>` | Add members (owner/admin) |
 | `removeGroupMember(groupId, userId)` | `Promise<GroupInfo>` | Remove a member (owner/admin) |
+| `updateGroup(groupId, { name?, readReceiptsVisibleToGroup? })` | `Promise<GroupInfo>` | Update group settings (owner/admin) |
 | `deleteGroup(groupId)` | `Promise<void>` | Delete a group (owner only) |
 | `sendGroupMessage(groupId, plaintext, memberUserIds, options?)` | `Promise<{ messageId }>` | Send an end-to-end encrypted group message (sender-side per-recipient fan-out). `options.attachments` for E2EE group attachments. |
 | `sendCleartextGroupMessage(groupId, plaintext)` | `Promise<{ messageId }>` | Send a plaintext (non-encrypted) group message; server fans out to every other member. |

package/dist/core/messaging-client.d.ts

@@ -93,7 +93,7 @@ export declare class MessagingClient implements DropOnAirClient {
     createUploadSession(options: CreateUploadSessionOptions): Promise<UploadSession>;
     finalizeAttachment(attachmentId: string, sha256: string): Promise<void>;
     downloadAttachment(ref: AttachmentRef): Promise<DownloadedAttachment>;
-    revokeAttachment(attachmentId: string): Promise<void>;
+    revokeAttachment(attachment: string | AttachmentRef): Promise<void>;
     connect(): Promise<void>;
     disconnect(): void;
     sendMessage(toUserId: string, plaintextMessage: string, options?: {

package/dist/core/messaging-client.js

@@ -270,8 +270,16 @@ class MessagingClient {
     async downloadAttachment(ref) {
         return this.attachmentClient.downloadAttachment(ref);
     }
-    async revokeAttachment(attachmentId) {
-        return this.attachmentClient.revokeAttachment(attachmentId);
+    async revokeAttachment(attachment) {
+        if (typeof attachment === 'string') {
+            return this.attachmentClient.revokeAttachment(attachment);
+        }
+        // Revoke the main attachment first so the primary intent always lands,
+        // then cascade to the linked preview thumbnail if there is one.
+        await this.attachmentClient.revokeAttachment(attachment.attachmentId);
+        if (attachment.thumbnailAttachmentId) {
+            await this.attachmentClient.revokeAttachment(attachment.thumbnailAttachmentId);
+        }
     }
     async connect() {
         this.log('connect_start');

package/dist/core/types.d.ts

@@ -286,11 +286,15 @@ export interface DropOnAirClient {
     /** Download (and for E2EE decrypt) an attachment referenced inside a received message. */
     downloadAttachment(ref: import('../attachment/attachment-types').AttachmentRef): Promise<import('../attachment/attachment-types').DownloadedAttachment>;
     /**
-     * Revoke an attachment you sent (Phase 2f). The platform stops issuing
-     * download URLs for it and notifies recipients. Bytes already downloaded
-     * cannot be recalled.
+     * Revoke an attachment you sent. The platform stops issuing download URLs
+     * for it and notifies recipients; bytes already downloaded cannot be
+     * recalled.
+     *
+     * Pass an attachment id to revoke that single attachment. Pass an
+     * `AttachmentRef` to also revoke its linked preview thumbnail
+     * (`thumbnailAttachmentId`) in the same call, if it has one.
      */
-    revokeAttachment(attachmentId: string): Promise<void>;
+    revokeAttachment(attachment: string | import('../attachment/attachment-types').AttachmentRef): Promise<void>;
     /** Send a cleartext message to a user (no encryption). */
     sendCleartextMessage(toUserId: string, plaintext: string): Promise<{
         messageId: string;

package/dist/version.d.ts

@@ -7,7 +7,7 @@
  *   MINOR, additive feature (e.g. multi-device payloads, new call event type)
  *   PATCH, bug-fix / perf improvement with no wire or API change
  */
-export declare const SDK_VERSION = "0.13.0";
+export declare const SDK_VERSION = "0.13.1";
 /**
  * Binary encrypted-payload format version.
  * Included as the first byte of every encrypted payload so receivers can

package/dist/version.js

@@ -10,7 +10,7 @@ exports.PROTOCOL_VERSION = exports.PAYLOAD_FORMAT_VERSION = exports.SDK_VERSION
  *   MINOR, additive feature (e.g. multi-device payloads, new call event type)
  *   PATCH, bug-fix / perf improvement with no wire or API change
  */
-exports.SDK_VERSION = '0.13.0';
+exports.SDK_VERSION = '0.13.1';
 /**
  * Binary encrypted-payload format version.
  * Included as the first byte of every encrypted payload so receivers can

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@droponair/sdk-js",
-  "version": "0.13.0",
+  "version": "0.13.1",
   "description": "DropOnAir SDK for end-to-end encrypted messaging",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",