@droponair/sdk-js 0.24.2 → 0.25.0

package/CHANGELOG.md

@@ -1,5 +1,46 @@
 # Changelog
 
+## 0.25.0
+
+### Added
+
+- **`keyCustody` on the client**, reporting how the identity private key is held:
+  `'non-extractable'` when the key exists only inside the platform's crypto agent and cannot
+  be read by script, `'software'` when it is bytes the process can read. Every release before
+  this one behaved as `'software'`, and still does unless the new option below is used. Read it
+  rather than assuming: a consumer that believes it has the stronger custody and does not is
+  worse off than one that knows.
+- **`createSecureIdentity()`** and **`InitializeOptions.identity`**, an opt-in identity whose
+  private key script cannot read. The key is generated non-extractable and used through the
+  agent for the key agreement, so an attacker who runs script on the origin can ask it to
+  derive while the page is open, and cannot steal the key for later or elsewhere.
+- **`WebCryptoIdentityProvider`**, **`IndexedDbIdentityRecordStore`**,
+  **`MemoryIdentityRecordStore`** and the **`IdentityRecordStore`** interface are exported, so
+  custody can be implemented against something else entirely.
+
+### Notes
+
+- **Opt-in, and unchanged by default.** Passing no `identity` keeps exactly the previous
+  behaviour. The stronger path is offered, not imposed.
+- **`createSecureIdentity()` returns `null` where the platform cannot deliver it**, rather than
+  throwing or quietly substituting something weaker. Two conditions are checked: whether the
+  primitive exists, and whether a key survives being stored and read back.
+- **Availability differs by engine.** The protected path requires an X25519 key that persists.
+  Chromium provides that. WebKit generates and derives correctly and then loses the key when it
+  is stored, reporting the write as successful, so `createSecureIdentity()` returns `null`
+  there and the ordinary path is used. This is checked at runtime rather than assumed from a
+  user agent.
+- **Existing identities can be carried over** with `migrateFromKeyStorage()`, which imports the
+  stored key, verifies it, and only then removes the readable copy. The public key is unchanged,
+  so peers still address the same identity and existing conversations keep decrypting. Nothing
+  is re-keyed and no history is lost.
+- The wire format is untouched. Both paths perform the same X25519 agreement and derive the
+  same message key, which is covered by tests in both directions.
+
+## 0.24.3
+
+- Fix: broadcasts (and events/acks) misrouted. Inbound Ack/GroupAck discriminators now require a real SCREAMING_SNAKE ack token, so a BroadcastNotification (publisherId in the type slot) is no longer decoded as a GroupAck before reaching the broadcast branch. Completes the frame-classifier fix.
+
 ## 0.24.2
 
 - Fix: E2EE group message decryption failed because the decrypt AAD bound `recipientId` to the group id instead of the receiving user's own id (which is what the sender encrypts against). Now matches the sender and the other SDKs. Requires sdk-be that preserves the sender timestamp on group notifications.

package/README.md

@@ -107,6 +107,51 @@ const client = await initialize(options);
 | `syncDraft(conversationId, draftText)` | `void` | Push a conversation draft to the user's other devices (opt-in, cleartext). |
 | `onDraftSync(callback)` | `() => void` | Listen for draft syncs from the user's other devices. |
 
+### Key custody
+
+Every client reports how it is holding the identity private key:
+
+```ts
+const client = await initialize({ /* ... */ });
+console.log(client.keyCustody); // 'software' | 'non-extractable'
+```
+
+`'software'` means the key is bytes the process can read. That is what every release before
+0.25.0 did, and what this one still does unless you opt in below.
+
+`'non-extractable'` means the key exists only inside the browser's crypto agent: your code can
+ask it to derive a shared secret, and cannot read the key itself. Script that runs on your
+origin can therefore use the identity while the page is open, and cannot copy it and decrypt
+elsewhere or later.
+
+Opt in by supplying an identity:
+
+```ts
+import { initialize, createSecureIdentity } from '@droponair/sdk-js';
+
+const identity = await createSecureIdentity();
+if (identity) {
+  // Optional, once: carry an existing key over so the identity and its history survive.
+  await identity.migrateFromKeyStorage(myStorage);
+}
+
+const client = await initialize({
+  appId, publicApiKey, getUserJwt,
+  identity: identity ?? undefined,   // null means this browser cannot provide it
+});
+```
+
+`createSecureIdentity()` returns `null` where the platform cannot deliver the guarantee, rather
+than throwing or quietly giving you something weaker. It checks two things: whether the
+primitive exists, and whether a key survives being stored and read back. That second check
+matters, because one major engine generates and derives with the key correctly and then loses
+it on write while reporting success. Read `client.keyCustody` afterwards to see what you
+actually got.
+
+Migration is yours to trigger, not automatic, because it removes the readable copy of the key.
+It imports the existing key, verifies it, and only then deletes the original. The public key is
+unchanged, so peers still address the same identity and existing conversations keep decrypting.
+
 ### Cross-device read receipts
 
 Available since SDK `0.11.0`. **Your app decides when a message is read** — the platform never infers it. Call `markRead()` at that moment; the receipt syncs to the user's *other* devices so they can clear their unread UI. It is not sent to the message's sender. The app owner can switch read receipts off entirely from the dashboard.

package/dist/core/messaging-client.d.ts

@@ -1,6 +1,6 @@
 import { CryptoService } from '../crypto/crypto-service';
 import { SessionManager } from './session-manager';
-import { BroadcastCallback, CallEventCallback, DropOnAirClient, EventCallback, CreateRoomOptions, GroupCallEventCallback, GroupInfo, GroupMessageCallback, Room, UpdateRoomOptions, SfuToken, SfuRecording, InitializeOptions, MessageCallback, MessageDeleteCallback, MessageEditCallback, TurnCredentials, DeviceInfo, ReadReceiptCallback, NotificationClearCallback, DraftSyncCallback } from './types';
+import { BroadcastCallback, CallEventCallback, DropOnAirClient, EventCallback, CreateRoomOptions, GroupCallEventCallback, GroupInfo, GroupMessageCallback, Room, UpdateRoomOptions, SfuToken, SfuRecording, InitializeOptions, MessageCallback, MessageDeleteCallback, MessageEditCallback, TurnCredentials, DeviceInfo, ReadReceiptCallback, NotificationClearCallback, DraftSyncCallback, KeyCustody } from './types';
 import { AttachmentRef, CreateUploadSessionOptions, DownloadedAttachment, PrepareAttachmentOptions, UploadSession } from '../attachment/attachment-types';
 export declare class MessagingClient implements DropOnAirClient {
     private readonly options;
@@ -100,6 +100,13 @@ export declare class MessagingClient implements DropOnAirClient {
     finalizeAttachment(attachmentId: string, sha256: string): Promise<void>;
     downloadAttachment(ref: AttachmentRef): Promise<DownloadedAttachment>;
     revokeAttachment(attachment: string | AttachmentRef): Promise<void>;
+    /**
+     * How the identity private key is held. See {@link KeyCustody}.
+     *
+     * Read from the crypto service rather than remembered at construction, so it
+     * reflects what is actually in use rather than what was requested.
+     */
+    get keyCustody(): KeyCustody;
     connect(): Promise<void>;
     disconnect(): void;
     sendMessage(toUserId: string, plaintextMessage: string, options?: {

package/dist/core/messaging-client.js

@@ -313,6 +313,15 @@ class MessagingClient {
             await this.attachmentClient.revokeAttachment(attachment.thumbnailAttachmentId);
         }
     }
+    /**
+     * How the identity private key is held. See {@link KeyCustody}.
+     *
+     * Read from the crypto service rather than remembered at construction, so it
+     * reflects what is actually in use rather than what was requested.
+     */
+    get keyCustody() {
+        return this.cryptoService.keyCustody;
+    }
     async connect() {
         this.log('connect_start');
         this.shouldReconnect = true;

package/dist/core/types.d.ts

@@ -251,6 +251,57 @@ export interface KeyStorageAdapter {
     set(key: string, value: string): Promise<void>;
     remove(key: string): Promise<void>;
 }
+/**
+ * How the identity private key is held.
+ *
+ * - `non-extractable`: the key lives in the agent as a CryptoKey that script
+ *   cannot export. An attacker running script on the origin can still use it
+ *   while the page is open, which is unavoidable, but cannot copy it out and use
+ *   it later or elsewhere.
+ * - `software`: the key exists as bytes reachable from script, so anything that
+ *   can run script on the origin can read it once and decrypt that user's
+ *   conversations from anywhere, indefinitely.
+ *
+ * Exposed so an application can tell its users the truth rather than assume.
+ */
+export type KeyCustody = 'non-extractable' | 'software';
+/**
+ * Owns the identity keypair and the key agreement that uses it.
+ *
+ * This exists because a storage interface alone cannot make key material
+ * XSS-resistant. The strongest browsers offer is a non-extractable CryptoKey,
+ * and by definition its bytes cannot be handed back to a caller, so any design
+ * shaped as "give me the private key and I will do the maths" forces the key to
+ * be extractable. The agreement has to happen behind the same boundary that
+ * holds the key, which is what this interface is.
+ *
+ * Implement it to hold keys somewhere the SDK cannot reach, for example an OS
+ * keychain or a hardware token. The SDK ships two implementations and picks the
+ * conservative one unless asked otherwise; it never silently upgrades you.
+ */
+export interface SecureIdentityProvider {
+    /** Base64 X25519 public key for this device, created on first use. */
+    getPublicKey(): Promise<string>;
+    /**
+     * Perform X25519 with the peer's public key, then HKDF-SHA256 to an AES-GCM
+     * key, and return it.
+     *
+     * Returns the derived key rather than the shared secret so the secret need
+     * never exist outside the implementation. The returned key must be
+     * non-extractable: it is used for encrypt and decrypt and nothing else.
+     *
+     * `salt` and `info` are supplied by the SDK and are part of the wire format.
+     * An implementation that changes them will produce keys that no other
+     * participant can reproduce.
+     */
+    deriveMessageKey(params: {
+        peerPublicKey: string;
+        salt: Uint8Array;
+        info: Uint8Array;
+    }): Promise<CryptoKey>;
+    /** Whether the private key can be read by script. See {@link KeyCustody}. */
+    readonly keyCustody: KeyCustody;
+}
 export interface InitializeOptions {
     appId: string;
     publicApiKey: string;
@@ -262,6 +313,22 @@ export interface InitializeOptions {
     keyDirectoryEndpoint?: string;
     fetchFn?: typeof fetch;
     storage?: KeyStorageAdapter;
+    /**
+     * Owns the identity keypair instead of {@link storage}, when the consumer wants
+     * a private key that script cannot read.
+     *
+     * Optional and off by default, deliberately. Passing nothing keeps exactly the
+     * behaviour every existing release has: the identity is a raw key held through
+     * {@link storage}. Switching that silently would change key custody under
+     * applications that never asked for it, and on engines where the stronger path
+     * cannot persist it would do so without delivering anything.
+     *
+     * Build one with `createSecureIdentity()`, which returns `null` where the
+     * platform cannot support it so the choice is explicit rather than accidental.
+     * Read {@link DropOnAirClient.keyCustody} afterwards to see what was actually
+     * obtained.
+     */
+    identity?: SecureIdentityProvider;
     /** When true, verbose diagnostic logs are emitted to console for all SDK operations. */
     debug?: boolean;
     /**
@@ -299,6 +366,20 @@ export interface DeviceInfo {
     revokedBy?: 'END_USER' | 'APP_OWNER' | 'SYSTEM';
 }
 export interface DropOnAirClient {
+    /**
+     * How this client is holding the identity private key.
+     *
+     * `'non-extractable'` means the key exists only inside the platform's crypto
+     * agent: script may ask it to derive, and cannot read it, so storage taken from
+     * the device yields nothing usable. `'software'` means the key is bytes the
+     * process can read, which is what every release before this one did and what
+     * this one still does unless {@link InitializeOptions.identity} is supplied.
+     *
+     * Exposed because a consumer that believes it has the stronger custody and does
+     * not is worse off than one that knows. Log it, show it, or gate a feature on
+     * it, but do not assume it.
+     */
+    readonly keyCustody: KeyCustody;
     connect(): Promise<void>;
     disconnect(): void;
     /**

package/dist/crypto/crypto-service.d.ts

@@ -1,9 +1,16 @@
 import { SessionManager } from '../core/session-manager';
-import { KeyStorageAdapter } from '../core/types';
+import { KeyCustody, KeyStorageAdapter, SecureIdentityProvider } from '../core/types';
 export declare class CryptoService {
-    private readonly storage;
     private readonly sessionManager;
-    constructor(storage: KeyStorageAdapter, sessionManager: SessionManager);
+    private readonly identity;
+    /**
+     * Accepts either an identity provider or, for compatibility, the storage
+     * adapter it used to take. Passing storage keeps the previous behaviour
+     * exactly, by wrapping it in the tweetnacl provider.
+     */
+    constructor(storageOrIdentity: KeyStorageAdapter | SecureIdentityProvider, sessionManager: SessionManager);
+    /** How the identity private key is held. See {@link KeyCustody}. */
+    get keyCustody(): KeyCustody;
     generateIdentity(): Promise<{
         publicKey: string;
     }>;
@@ -23,6 +30,5 @@ export declare class CryptoService {
         recipientId: string;
         timestamp: number;
     }): Promise<string>;
-    private deriveAesKey;
     private buildAad;
 }

package/dist/crypto/crypto-service.js

@@ -1,35 +1,50 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CryptoService = void 0;
-const tweetnacl_1 = __importDefault(require("tweetnacl"));
 const bytes_1 = require("../core/bytes");
+const nacl_identity_provider_1 = require("./nacl-identity-provider");
 const payload_format_1 = require("./payload-format");
-const STORAGE_PRIVATE = 'droponair.identity.privateKey.v1';
-const STORAGE_PUBLIC = 'droponair.identity.publicKey.v1';
 function asBufferSource(data) {
     return new Uint8Array(data);
 }
+/**
+ * HKDF inputs, unchanged from the original implementation and deliberately
+ * defined once. Both are part of the wire format: two participants must derive
+ * the same key from the same shared secret, so these strings and the user-id
+ * ordering cannot vary by provider, platform or SDK version without breaking
+ * every conversation that spans the change.
+ */
+function hkdfSalt() {
+    return (0, bytes_1.utf8Encode)('droponair-e2ee-hkdf-salt-v1');
+}
+function hkdfInfo(localUserId, peerUserId) {
+    const ordering = [localUserId, peerUserId].sort().join(':');
+    return (0, bytes_1.utf8Encode)(`droponair-e2ee-v1:${ordering}`);
+}
+function isIdentityProvider(value) {
+    return typeof value.deriveMessageKey === 'function';
+}
 class CryptoService {
-    constructor(storage, sessionManager) {
-        this.storage = storage;
+    /**
+     * Accepts either an identity provider or, for compatibility, the storage
+     * adapter it used to take. Passing storage keeps the previous behaviour
+     * exactly, by wrapping it in the tweetnacl provider.
+     */
+    constructor(storageOrIdentity, sessionManager) {
         this.sessionManager = sessionManager;
+        this.identity = isIdentityProvider(storageOrIdentity)
+            ? storageOrIdentity
+            : new nacl_identity_provider_1.NaclIdentityProvider(storageOrIdentity);
+    }
+    /** How the identity private key is held. See {@link KeyCustody}. */
+    get keyCustody() {
+        return this.identity.keyCustody;
     }
     async generateIdentity() {
-        const keyPair = tweetnacl_1.default.box.keyPair();
-        await this.storage.set(STORAGE_PRIVATE, (0, bytes_1.toBase64)(keyPair.secretKey));
-        await this.storage.set(STORAGE_PUBLIC, (0, bytes_1.toBase64)(keyPair.publicKey));
-        return { publicKey: (0, bytes_1.toBase64)(keyPair.publicKey) };
+        return { publicKey: await this.identity.getPublicKey() };
     }
     async getOrCreateIdentity() {
-        const existingPublic = await this.storage.get(STORAGE_PUBLIC);
-        const existingPrivate = await this.storage.get(STORAGE_PRIVATE);
-        if (existingPublic && existingPrivate) {
-            return { publicKey: existingPublic };
-        }
-        return this.generateIdentity();
+        return { publicKey: await this.identity.getPublicKey() };
     }
     async deriveSharedSecret(peerUserId, peerPublicKeyBase64, localUserId) {
         // Cache by public key (not userId) to support multi-device, same user may have
@@ -39,17 +54,14 @@ class CryptoService {
         if (cached) {
             return cached;
         }
-        const privateBase64 = await this.storage.get(STORAGE_PRIVATE);
-        if (!privateBase64) {
-            throw new Error('Local identity keypair is missing');
-        }
-        const privateKey = (0, bytes_1.fromBase64)(privateBase64);
-        const peerPublicKey = (0, bytes_1.fromBase64)(peerPublicKeyBase64);
-        if (peerPublicKey.length !== 32 || privateKey.length !== 32) {
-            throw new Error('Invalid X25519 key length');
-        }
-        const sharedSecret = tweetnacl_1.default.scalarMult(privateKey, peerPublicKey);
-        const symmetricKey = await this.deriveAesKey(sharedSecret, localUserId, peerUserId);
+        // salt and info are part of the wire format, so they are computed here and
+        // handed to the provider rather than left to it. A provider that invented
+        // its own would derive keys nobody else could reproduce.
+        const symmetricKey = await this.identity.deriveMessageKey({
+            peerPublicKey: peerPublicKeyBase64,
+            salt: hkdfSalt(),
+            info: hkdfInfo(localUserId, peerUserId)
+        });
         this.sessionManager.set(cacheKey, symmetricKey);
         return symmetricKey;
     }
@@ -78,21 +90,6 @@ class CryptoService {
         }, symmetricKey, asBufferSource(unpacked.ciphertext));
         return (0, bytes_1.utf8Decode)(new Uint8Array(plainBuffer));
     }
-    async deriveAesKey(sharedSecret, localUserId, peerUserId) {
-        const ordering = [localUserId, peerUserId].sort().join(':');
-        const info = (0, bytes_1.utf8Encode)(`droponair-e2ee-v1:${ordering}`);
-        const salt = (0, bytes_1.utf8Encode)('droponair-e2ee-hkdf-salt-v1');
-        const ikm = await crypto.subtle.importKey('raw', asBufferSource(sharedSecret), 'HKDF', false, ['deriveKey']);
-        return crypto.subtle.deriveKey({
-            name: 'HKDF',
-            hash: 'SHA-256',
-            salt: asBufferSource(salt),
-            info: asBufferSource(info)
-        }, ikm, {
-            name: 'AES-GCM',
-            length: 256
-        }, false, ['encrypt', 'decrypt']);
-    }
     buildAad(context) {
         return (0, bytes_1.utf8Encode)(`${context.messageId}|${context.senderId}|${context.recipientId}|${context.timestamp}`);
     }

package/dist/crypto/nacl-identity-provider.d.ts

@@ -0,0 +1,25 @@
+import { KeyCustody, KeyStorageAdapter, SecureIdentityProvider } from '../core/types';
+/**
+ * The original identity path, unchanged in behaviour and kept as the default.
+ *
+ * tweetnacl needs the private key as bytes, so this reports `software` custody:
+ * whatever the configured {@link KeyStorageAdapter} does, the key is reachable
+ * from script at derive time. That is not a flaw in this class, it is what using
+ * tweetnacl means, and saying so plainly is the point of `keyCustody`.
+ *
+ * It stays the default because every existing consumer already has keys in this
+ * format, and silently moving them would change which messages they can read.
+ * Opting into {@link WebCryptoIdentityProvider} is a decision an application
+ * makes, not one the SDK makes for it.
+ */
+export declare class NaclIdentityProvider implements SecureIdentityProvider {
+    private readonly storage;
+    readonly keyCustody: KeyCustody;
+    constructor(storage: KeyStorageAdapter);
+    getPublicKey(): Promise<string>;
+    deriveMessageKey(params: {
+        peerPublicKey: string;
+        salt: Uint8Array;
+        info: Uint8Array;
+    }): Promise<CryptoKey>;
+}

package/dist/crypto/nacl-identity-provider.js

@@ -0,0 +1,60 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NaclIdentityProvider = void 0;
+const tweetnacl_1 = __importDefault(require("tweetnacl"));
+const bytes_1 = require("../core/bytes");
+const STORAGE_PRIVATE = 'droponair.identity.privateKey.v1';
+const STORAGE_PUBLIC = 'droponair.identity.publicKey.v1';
+/**
+ * The original identity path, unchanged in behaviour and kept as the default.
+ *
+ * tweetnacl needs the private key as bytes, so this reports `software` custody:
+ * whatever the configured {@link KeyStorageAdapter} does, the key is reachable
+ * from script at derive time. That is not a flaw in this class, it is what using
+ * tweetnacl means, and saying so plainly is the point of `keyCustody`.
+ *
+ * It stays the default because every existing consumer already has keys in this
+ * format, and silently moving them would change which messages they can read.
+ * Opting into {@link WebCryptoIdentityProvider} is a decision an application
+ * makes, not one the SDK makes for it.
+ */
+class NaclIdentityProvider {
+    constructor(storage) {
+        this.storage = storage;
+        this.keyCustody = 'software';
+    }
+    async getPublicKey() {
+        const existingPublic = await this.storage.get(STORAGE_PUBLIC);
+        const existingPrivate = await this.storage.get(STORAGE_PRIVATE);
+        if (existingPublic && existingPrivate) {
+            return existingPublic;
+        }
+        const keyPair = tweetnacl_1.default.box.keyPair();
+        await this.storage.set(STORAGE_PRIVATE, (0, bytes_1.toBase64)(keyPair.secretKey));
+        await this.storage.set(STORAGE_PUBLIC, (0, bytes_1.toBase64)(keyPair.publicKey));
+        return (0, bytes_1.toBase64)(keyPair.publicKey);
+    }
+    async deriveMessageKey(params) {
+        const privateBase64 = await this.storage.get(STORAGE_PRIVATE);
+        if (!privateBase64) {
+            throw new Error('Local identity keypair is missing');
+        }
+        const privateKey = (0, bytes_1.fromBase64)(privateBase64);
+        const peerPublicKey = (0, bytes_1.fromBase64)(params.peerPublicKey);
+        if (peerPublicKey.length !== 32 || privateKey.length !== 32) {
+            throw new Error('Invalid X25519 key length');
+        }
+        const sharedSecret = tweetnacl_1.default.scalarMult(privateKey, peerPublicKey);
+        const ikm = await crypto.subtle.importKey('raw', new Uint8Array(sharedSecret), 'HKDF', false, ['deriveKey']);
+        return crypto.subtle.deriveKey({
+            name: 'HKDF',
+            hash: 'SHA-256',
+            salt: params.salt,
+            info: params.info
+        }, ikm, { name: 'AES-GCM', length: 256 }, false, ['encrypt', 'decrypt']);
+    }
+}
+exports.NaclIdentityProvider = NaclIdentityProvider;

package/dist/crypto/webcrypto-identity-provider.d.ts

@@ -0,0 +1,116 @@
+import { KeyCustody, KeyStorageAdapter, SecureIdentityProvider } from '../core/types';
+interface StoredIdentity {
+    privateKey: CryptoKey;
+    publicKeyBase64: string;
+}
+/**
+ * Identity provider backed by a non-extractable WebCrypto X25519 key.
+ *
+ * The private key is generated with `extractable: false` and stored in IndexedDB
+ * as a CryptoKey rather than as bytes. CryptoKey is structured-cloneable, so it
+ * survives the round trip, and `crypto.subtle.exportKey` refuses on the way out.
+ * Script on the origin can therefore ask this key to derive, but cannot copy it.
+ *
+ * This is the same curve tweetnacl's `box` uses, and `deriveBits` computes the
+ * same X25519 shared secret, so a message encrypted through this provider is
+ * indistinguishable on the wire from one encrypted through the legacy path. That
+ * property is what makes adoption safe, and it is asserted by tests rather than
+ * assumed.
+ *
+ * Availability is not universal. Call {@link isSupported} before choosing this;
+ * the SDK does, and falls back rather than throwing at send time.
+ */
+/**
+ * Where the identity record is kept between sessions.
+ *
+ * Extracted so persistence is not welded to IndexedDB. It lets the equivalence
+ * tests run somewhere without IndexedDB, which is the only way to verify wire
+ * compatibility outside a browser, and it lets a consumer persist the record
+ * somewhere of their own choosing.
+ *
+ * Whatever implements it must preserve the CryptoKey as an object. Serialising
+ * the record to JSON destroys the key silently and leaves a record that looks
+ * present and is unusable.
+ */
+export interface IdentityRecordStore {
+    read(): Promise<StoredIdentity | null>;
+    write(record: StoredIdentity): Promise<void>;
+}
+/** Keeps the identity for the lifetime of the process only. Used by tests. */
+export declare class MemoryIdentityRecordStore implements IdentityRecordStore {
+    private record;
+    read(): Promise<StoredIdentity | null>;
+    write(record: StoredIdentity): Promise<void>;
+}
+/**
+ * Wrap a raw 32 byte X25519 scalar so WebCrypto will import it.
+ *
+ * This is what makes migration possible at all: an existing tweetnacl identity is
+ * 32 raw bytes, and without this there is no way to hand it to WebCrypto, which
+ * would mean every existing user had to be re-keyed and would lose the ability to
+ * read their own history.
+ */
+export declare function rawX25519ToPkcs8(raw: Uint8Array): Uint8Array;
+export declare class WebCryptoIdentityProvider implements SecureIdentityProvider {
+    readonly keyCustody: KeyCustody;
+    private cached;
+    private readonly store;
+    constructor(store?: IdentityRecordStore);
+    /**
+     * Whether this environment can actually do non-extractable X25519.
+     *
+     * Probes by generating a throwaway key rather than sniffing user agents,
+     * because support has arrived at different times in different engines and a
+     * feature test is the only answer that stays true.
+     */
+    static isSupported(): Promise<boolean>;
+    /**
+     * Whether an X25519 key actually survives being stored and read back here.
+     *
+     * Separate from {@link isSupported} because the two are genuinely different
+     * questions and one engine answers them differently. **WebKit can generate and
+     * derive with a non-extractable X25519 key, and then loses it through
+     * structured clone**: the IndexedDB write reports success, and after a reload
+     * the record is simply absent. Measured 2026-08-15; AES-GCM, ECDH P-256 and
+     * ECDSA P-256 all survive there, X25519 alone does not.
+     *
+     * That failure is silent, which is what makes it dangerous. An identity that
+     * regenerates every load means every previous conversation becomes
+     * undecryptable, with no error raised anywhere to explain it, so this must be
+     * checked rather than assumed.
+     *
+     * Costs one write and one read of a throwaway key, so call it once at startup
+     * rather than per message.
+     */
+    static canPersist(store: IdentityRecordStore): Promise<boolean>;
+    /**
+     * Adopt an existing tweetnacl identity, so a user keeps their conversations.
+     *
+     * The scalar is imported as a non-extractable key and the raw copy is then
+     * removed from the {@link KeyStorageAdapter}, which is the whole point: after
+     * this, the same identity exists but script can no longer read it.
+     *
+     * Ordering matters and is deliberate. The import and the write happen first,
+     * and only a successful write is followed by deleting the raw copy. Interrupted
+     * at any point, the user still has a usable identity somewhere: either the old
+     * raw key, or the new protected one, never neither.
+     *
+     * Returns false when there is nothing to migrate, so a caller can run it
+     * unconditionally on startup.
+     */
+    migrateFromKeyStorage(storage: KeyStorageAdapter): Promise<boolean>;
+    getPublicKey(): Promise<string>;
+    deriveMessageKey(params: {
+        peerPublicKey: string;
+        salt: Uint8Array;
+        info: Uint8Array;
+    }): Promise<CryptoKey>;
+    private getOrCreate;
+}
+/** The default: an IndexedDB object store, which preserves CryptoKey objects. */
+export declare class IndexedDbIdentityRecordStore implements IdentityRecordStore {
+    private openDb;
+    read(): Promise<StoredIdentity | null>;
+    write(record: StoredIdentity): Promise<void>;
+}
+export {};

package/dist/crypto/webcrypto-identity-provider.js

@@ -0,0 +1,265 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IndexedDbIdentityRecordStore = exports.WebCryptoIdentityProvider = exports.MemoryIdentityRecordStore = void 0;
+exports.rawX25519ToPkcs8 = rawX25519ToPkcs8;
+const bytes_1 = require("../core/bytes");
+/**
+ * A database of its own, not a second store inside `droponair_sdk`.
+ *
+ * IndexedDbKeyStorage already owns `droponair_sdk` at version 1 with a
+ * `secure_keys` store. Adding another store to the same name and version means
+ * whichever opens second finds no upgrade needed, its store is never created,
+ * and every read fails. Both are used together in a real application, so this
+ * was not hypothetical: it made the identity vanish across a reload under WebKit
+ * while appearing to work in Chromium, purely on open ordering.
+ *
+ * Coordinating versions between two independent components is the other way to
+ * solve it and a worse one, because it couples their release cycles forever.
+ */
+const DB_NAME = 'droponair_identity';
+const STORE_NAME = 'identity_v2';
+const DB_VERSION = 1;
+const RECORD_KEY = 'x25519';
+/** Where the tweetnacl path keeps its identity. Must match NaclIdentityProvider. */
+const LEGACY_STORAGE_PRIVATE = 'droponair.identity.privateKey.v1';
+const LEGACY_STORAGE_PUBLIC = 'droponair.identity.publicKey.v1';
+/** Keeps the identity for the lifetime of the process only. Used by tests. */
+class MemoryIdentityRecordStore {
+    constructor() {
+        this.record = null;
+    }
+    async read() {
+        return this.record;
+    }
+    async write(record) {
+        this.record = record;
+    }
+}
+exports.MemoryIdentityRecordStore = MemoryIdentityRecordStore;
+/**
+ * DER prefix for a PKCS#8 X25519 private key, per RFC 8410.
+ *
+ * WebCrypto will not import a bare 32 byte scalar, but it will import PKCS#8,
+ * and for X25519 the encoding is fixed: everything before the key is constant,
+ * so the wrapper is a concatenation rather than a DER encoder.
+ *
+ *   30 2e             SEQUENCE, 46 bytes
+ *   02 01 00          INTEGER 0, the version
+ *   30 05             SEQUENCE, 5 bytes
+ *   06 03 2b 65 6e    OID 1.3.101.110, X25519
+ *   04 22             OCTET STRING, 34 bytes
+ *   04 20             OCTET STRING, 32 bytes, the scalar follows
+ */
+const PKCS8_X25519_PREFIX = new Uint8Array([
+    0x30, 0x2e, 0x02, 0x01, 0x00, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65, 0x6e, 0x04, 0x22, 0x04, 0x20
+]);
+/**
+ * Wrap a raw 32 byte X25519 scalar so WebCrypto will import it.
+ *
+ * This is what makes migration possible at all: an existing tweetnacl identity is
+ * 32 raw bytes, and without this there is no way to hand it to WebCrypto, which
+ * would mean every existing user had to be re-keyed and would lose the ability to
+ * read their own history.
+ */
+function rawX25519ToPkcs8(raw) {
+    if (raw.length !== 32) {
+        throw new Error('Invalid X25519 key length');
+    }
+    const out = new Uint8Array(PKCS8_X25519_PREFIX.length + 32);
+    out.set(PKCS8_X25519_PREFIX, 0);
+    out.set(raw, PKCS8_X25519_PREFIX.length);
+    return out;
+}
+class WebCryptoIdentityProvider {
+    constructor(store) {
+        this.keyCustody = 'non-extractable';
+        this.cached = null;
+        this.store = store ?? new IndexedDbIdentityRecordStore();
+    }
+    /**
+     * Whether this environment can actually do non-extractable X25519.
+     *
+     * Probes by generating a throwaway key rather than sniffing user agents,
+     * because support has arrived at different times in different engines and a
+     * feature test is the only answer that stays true.
+     */
+    static async isSupported() {
+        try {
+            // Deliberately does not require IndexedDB. Persistence is pluggable, and
+            // conflating the two meant this reported "unsupported" in any environment
+            // without IndexedDB even where X25519 worked perfectly, which is exactly
+            // what hid the equivalence test from ever running.
+            if (typeof crypto === 'undefined' || !crypto.subtle)
+                return false;
+            const pair = (await crypto.subtle.generateKey({ name: 'X25519' }, false, [
+                'deriveBits'
+            ]));
+            await crypto.subtle.deriveBits({ name: 'X25519', public: pair.publicKey }, pair.privateKey, 256);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    /**
+     * Whether an X25519 key actually survives being stored and read back here.
+     *
+     * Separate from {@link isSupported} because the two are genuinely different
+     * questions and one engine answers them differently. **WebKit can generate and
+     * derive with a non-extractable X25519 key, and then loses it through
+     * structured clone**: the IndexedDB write reports success, and after a reload
+     * the record is simply absent. Measured 2026-08-15; AES-GCM, ECDH P-256 and
+     * ECDSA P-256 all survive there, X25519 alone does not.
+     *
+     * That failure is silent, which is what makes it dangerous. An identity that
+     * regenerates every load means every previous conversation becomes
+     * undecryptable, with no error raised anywhere to explain it, so this must be
+     * checked rather than assumed.
+     *
+     * Costs one write and one read of a throwaway key, so call it once at startup
+     * rather than per message.
+     */
+    static async canPersist(store) {
+        try {
+            const pair = (await crypto.subtle.generateKey({ name: 'X25519' }, false, [
+                'deriveBits'
+            ]));
+            const rawPublic = await crypto.subtle.exportKey('raw', pair.publicKey);
+            const probe = {
+                privateKey: pair.privateKey,
+                publicKeyBase64: (0, bytes_1.toBase64)(new Uint8Array(rawPublic))
+            };
+            await store.write(probe);
+            const back = await store.read();
+            // The write above will have overwritten any real identity, so a caller must
+            // only use a store dedicated to probing. The SDK does exactly that.
+            return !!back?.privateKey;
+        }
+        catch {
+            return false;
+        }
+    }
+    /**
+     * Adopt an existing tweetnacl identity, so a user keeps their conversations.
+     *
+     * The scalar is imported as a non-extractable key and the raw copy is then
+     * removed from the {@link KeyStorageAdapter}, which is the whole point: after
+     * this, the same identity exists but script can no longer read it.
+     *
+     * Ordering matters and is deliberate. The import and the write happen first,
+     * and only a successful write is followed by deleting the raw copy. Interrupted
+     * at any point, the user still has a usable identity somewhere: either the old
+     * raw key, or the new protected one, never neither.
+     *
+     * Returns false when there is nothing to migrate, so a caller can run it
+     * unconditionally on startup.
+     */
+    async migrateFromKeyStorage(storage) {
+        const privateBase64 = await storage.get(LEGACY_STORAGE_PRIVATE);
+        const publicBase64 = await storage.get(LEGACY_STORAGE_PUBLIC);
+        if (!privateBase64 || !publicBase64) {
+            return false;
+        }
+        const raw = (0, bytes_1.fromBase64)(privateBase64);
+        const privateKey = await crypto.subtle.importKey('pkcs8', rawX25519ToPkcs8(raw), { name: 'X25519' }, 
+        // Non-extractable from this moment on. The bytes still exist in the
+        // adapter until the delete below, which is why that delete is not optional.
+        false, ['deriveBits']);
+        const record = { privateKey, publicKeyBase64: publicBase64 };
+        await this.store.write(record);
+        this.cached = record;
+        await storage.remove(LEGACY_STORAGE_PRIVATE);
+        return true;
+    }
+    async getPublicKey() {
+        const identity = await this.getOrCreate();
+        return identity.publicKeyBase64;
+    }
+    async deriveMessageKey(params) {
+        const identity = await this.getOrCreate();
+        const peerRaw = (0, bytes_1.fromBase64)(params.peerPublicKey);
+        if (peerRaw.length !== 32) {
+            throw new Error('Invalid X25519 key length');
+        }
+        const peerKey = await crypto.subtle.importKey('raw', peerRaw, { name: 'X25519' }, false, []);
+        // deriveBits, not deriveKey: HKDF needs the shared secret as key material,
+        // and this is the only point where it exists. It is never returned to a
+        // caller and never stored.
+        const sharedSecret = await crypto.subtle.deriveBits({ name: 'X25519', public: peerKey }, identity.privateKey, 256);
+        const ikm = await crypto.subtle.importKey('raw', sharedSecret, 'HKDF', false, ['deriveKey']);
+        return crypto.subtle.deriveKey({
+            name: 'HKDF',
+            hash: 'SHA-256',
+            salt: params.salt,
+            info: params.info
+        }, ikm, { name: 'AES-GCM', length: 256 }, false, ['encrypt', 'decrypt']);
+    }
+    async getOrCreate() {
+        if (this.cached)
+            return this.cached;
+        const existing = await this.store.read();
+        if (existing) {
+            this.cached = existing;
+            return existing;
+        }
+        const pair = (await crypto.subtle.generateKey({ name: 'X25519' }, false, [
+            'deriveBits'
+        ]));
+        // The public half is exported once and kept as base64, because it is
+        // published to peers anyway. Only the private half is protected.
+        const rawPublic = await crypto.subtle.exportKey('raw', pair.publicKey);
+        const record = {
+            privateKey: pair.privateKey,
+            publicKeyBase64: (0, bytes_1.toBase64)(new Uint8Array(rawPublic))
+        };
+        await this.store.write(record);
+        this.cached = record;
+        return record;
+    }
+}
+exports.WebCryptoIdentityProvider = WebCryptoIdentityProvider;
+/** The default: an IndexedDB object store, which preserves CryptoKey objects. */
+class IndexedDbIdentityRecordStore {
+    async openDb() {
+        return new Promise((resolve, reject) => {
+            const request = indexedDB.open(DB_NAME, DB_VERSION);
+            request.onupgradeneeded = () => {
+                const db = request.result;
+                if (!db.objectStoreNames.contains(STORE_NAME)) {
+                    db.createObjectStore(STORE_NAME);
+                }
+            };
+            request.onsuccess = () => resolve(request.result);
+            request.onerror = () => reject(request.error);
+        });
+    }
+    async read() {
+        const db = await this.openDb();
+        return new Promise((resolve, reject) => {
+            const tx = db.transaction(STORE_NAME, 'readonly');
+            const request = tx.objectStore(STORE_NAME).get(RECORD_KEY);
+            request.onsuccess = () => {
+                const value = request.result;
+                // A record written by an older or broken build could be missing the
+                // CryptoKey. Treating that as absent regenerates rather than throwing on
+                // every send.
+                if (!value || !value.privateKey || !value.publicKeyBase64) {
+                    resolve(null);
+                    return;
+                }
+                resolve(value);
+            };
+            request.onerror = () => reject(request.error);
+        });
+    }
+    async write(record) {
+        const db = await this.openDb();
+        await new Promise((resolve, reject) => {
+            const tx = db.transaction(STORE_NAME, 'readwrite');
+            tx.objectStore(STORE_NAME).put(record, RECORD_KEY);
+            tx.oncomplete = () => resolve();
+            tx.onerror = () => reject(tx.error);
+        });
+    }
+}
+exports.IndexedDbIdentityRecordStore = IndexedDbIdentityRecordStore;

package/dist/index.d.ts

@@ -1,11 +1,40 @@
+import { IdentityRecordStore, WebCryptoIdentityProvider } from './crypto/webcrypto-identity-provider';
 import { InitializeOptions, DropOnAirClient } from './core/types';
 export { SDK_VERSION, PROTOCOL_VERSION, PAYLOAD_FORMAT_VERSION } from './version';
+/**
+ * An identity whose private key script cannot read, or `null` where the platform
+ * cannot provide one.
+ *
+ * Returns `null` rather than throwing, and rather than quietly handing back a
+ * weaker implementation, because those are the two ways a caller ends up
+ * believing it has a guarantee it does not have. A `null` here means: this engine
+ * cannot do it, carry on with the ordinary path and know that you did.
+ *
+ * Two separate conditions are checked, and both matter. `isSupported` asks
+ * whether the primitive exists. `canPersist` asks whether a key survives being
+ * stored and read back, which WebKit fails for X25519 while reporting the write
+ * as successful. An identity that silently regenerates every load makes every
+ * previous conversation undecryptable, with nothing raised to explain it, so the
+ * check is worth its round trip.
+ *
+ * Migration is the caller's to trigger, via `migrateFromKeyStorage`, because it
+ * removes the raw key and that is not a decision to take on someone's behalf.
+ */
+export declare function createSecureIdentity(store?: IdentityRecordStore): Promise<WebCryptoIdentityProvider | null>;
 export declare function initialize(options: InitializeOptions): Promise<DropOnAirClient>;
 export type { InitializeOptions, DropOnAirClient, DropOnAirEvent, MessageCallback, EventCallback, DecryptedMessage, KeyStorageAdapter, CallEvent, CallEventType, CallEventCallback, TurnCredentials, BroadcastMessage, BroadcastCallback, GroupInfo, GroupMemberInfo, DecryptedGroupMessage, GroupMessageCallback, GroupCallEvent, GroupCallEventType, GroupCallEventCallback, Room, RoomPolicy, CreateRoomOptions, UpdateRoomOptions, SfuToken, SfuRecording, MessageEditEvent, MessageEditCallback, MessageDeleteEvent, MessageDeleteCallback, DeviceInfo, ReadReceiptEvent, ReadReceiptCallback, NotificationClearEvent, NotificationClearCallback, DraftSyncEvent, DraftSyncCallback, } from './core/types';
 export type { AttachmentEncryptionType, AttachmentConversationType, AttachmentRef, DeviceWrappedKey, CreateUploadSessionOptions, UploadSession, PrepareAttachmentOptions, DownloadedAttachment, } from './attachment/attachment-types';
 export { SseTransport, type SseTransportOptions, type SseFrameHandler, type SseStateHandler, } from './transport/sse-transport';
 export { WebTransportTransport, type WebTransportTransportOptions, type WTFrameHandler, type WTStateHandler, } from './transport/webtransport-transport';
 export { selectTransport, type TransportLane, type SelectTransportOptions, } from './transport/auto-select';
+/**
+ * Identity providers, for a private key that script cannot read.
+ *
+ * Exported so a consumer can construct one deliberately, supply its own record
+ * store, or implement {@link SecureIdentityProvider} against custody of its own.
+ * The platform offers the capability; it does not impose an implementation.
+ */
+export { WebCryptoIdentityProvider, IndexedDbIdentityRecordStore, MemoryIdentityRecordStore, type IdentityRecordStore, } from './crypto/webcrypto-identity-provider';
 declare const _default: {
     initialize: typeof initialize;
 };

package/dist/index.js

@@ -1,11 +1,13 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.selectTransport = exports.WebTransportTransport = exports.SseTransport = exports.PAYLOAD_FORMAT_VERSION = exports.PROTOCOL_VERSION = exports.SDK_VERSION = void 0;
+exports.MemoryIdentityRecordStore = exports.IndexedDbIdentityRecordStore = exports.WebCryptoIdentityProvider = exports.selectTransport = exports.WebTransportTransport = exports.SseTransport = exports.PAYLOAD_FORMAT_VERSION = exports.PROTOCOL_VERSION = exports.SDK_VERSION = void 0;
+exports.createSecureIdentity = createSecureIdentity;
 exports.initialize = initialize;
 const messaging_client_1 = require("./core/messaging-client");
 const session_manager_1 = require("./core/session-manager");
 const crypto_service_1 = require("./crypto/crypto-service");
 const indexeddb_key_storage_1 = require("./storage/indexeddb-key-storage");
+const webcrypto_identity_provider_1 = require("./crypto/webcrypto-identity-provider");
 var version_1 = require("./version");
 Object.defineProperty(exports, "SDK_VERSION", { enumerable: true, get: function () { return version_1.SDK_VERSION; } });
 Object.defineProperty(exports, "PROTOCOL_VERSION", { enumerable: true, get: function () { return version_1.PROTOCOL_VERSION; } });
@@ -16,10 +18,41 @@ function resolveStorage(adapter) {
     }
     return new indexeddb_key_storage_1.IndexedDbKeyStorage();
 }
+/**
+ * An identity whose private key script cannot read, or `null` where the platform
+ * cannot provide one.
+ *
+ * Returns `null` rather than throwing, and rather than quietly handing back a
+ * weaker implementation, because those are the two ways a caller ends up
+ * believing it has a guarantee it does not have. A `null` here means: this engine
+ * cannot do it, carry on with the ordinary path and know that you did.
+ *
+ * Two separate conditions are checked, and both matter. `isSupported` asks
+ * whether the primitive exists. `canPersist` asks whether a key survives being
+ * stored and read back, which WebKit fails for X25519 while reporting the write
+ * as successful. An identity that silently regenerates every load makes every
+ * previous conversation undecryptable, with nothing raised to explain it, so the
+ * check is worth its round trip.
+ *
+ * Migration is the caller's to trigger, via `migrateFromKeyStorage`, because it
+ * removes the raw key and that is not a decision to take on someone's behalf.
+ */
+async function createSecureIdentity(store) {
+    if (!(await webcrypto_identity_provider_1.WebCryptoIdentityProvider.isSupported())) {
+        return null;
+    }
+    const recordStore = store ?? new webcrypto_identity_provider_1.IndexedDbIdentityRecordStore();
+    if (!(await webcrypto_identity_provider_1.WebCryptoIdentityProvider.canPersist(recordStore))) {
+        return null;
+    }
+    return new webcrypto_identity_provider_1.WebCryptoIdentityProvider(recordStore);
+}
 async function initialize(options) {
     const storage = resolveStorage(options.storage);
     const sessionManager = new session_manager_1.SessionManager();
-    const cryptoService = new crypto_service_1.CryptoService(storage, sessionManager);
+    // An explicitly supplied identity provider owns the key agreement; otherwise
+    // the storage adapter does, exactly as in every previous release.
+    const cryptoService = new crypto_service_1.CryptoService(options.identity ?? storage, sessionManager);
     const client = new messaging_client_1.MessagingClient(options, cryptoService, sessionManager, storage);
     if (options.autoConnect !== false) {
         await client.connect();
@@ -35,4 +68,15 @@ Object.defineProperty(exports, "WebTransportTransport", { enumerable: true, get:
 // Phase 4.6: transport auto-select - intersects runtime + platform support.
 var auto_select_1 = require("./transport/auto-select");
 Object.defineProperty(exports, "selectTransport", { enumerable: true, get: function () { return auto_select_1.selectTransport; } });
+/**
+ * Identity providers, for a private key that script cannot read.
+ *
+ * Exported so a consumer can construct one deliberately, supply its own record
+ * store, or implement {@link SecureIdentityProvider} against custody of its own.
+ * The platform offers the capability; it does not impose an implementation.
+ */
+var webcrypto_identity_provider_2 = require("./crypto/webcrypto-identity-provider");
+Object.defineProperty(exports, "WebCryptoIdentityProvider", { enumerable: true, get: function () { return webcrypto_identity_provider_2.WebCryptoIdentityProvider; } });
+Object.defineProperty(exports, "IndexedDbIdentityRecordStore", { enumerable: true, get: function () { return webcrypto_identity_provider_2.IndexedDbIdentityRecordStore; } });
+Object.defineProperty(exports, "MemoryIdentityRecordStore", { enumerable: true, get: function () { return webcrypto_identity_provider_2.MemoryIdentityRecordStore; } });
 exports.default = { initialize };

package/dist/transport/protobuf-codec.js

@@ -387,7 +387,9 @@ class ProtobufCodec {
     tryDecodeAck(payload) {
         try {
             const decoded = AckType.decode(payload);
-            if (!decoded.messageId || !decoded.type) {
+            // type must be a real ack type (SCREAMING_SNAKE); otherwise a broadcast /
+            // notification with a UUID or userId in field 2 would false-match as an Ack.
+            if (!decoded.messageId || !decoded.type || !/^[A-Z][A-Z0-9_]*$/.test(decoded.type)) {
                 return null;
             }
             return decoded;
@@ -475,10 +477,11 @@ class ProtobufCodec {
     tryDecodeGroupAck(payload) {
         try {
             const decoded = GroupAckType.decode(payload);
-            // Require type (field 3): an Ack {messageId(1), type(2)} otherwise decodes
-            // as a GroupAck (its type lands in groupId, field 3 stays empty). Real
-            // GroupAcks always carry a type.
-            if (!decoded.messageId || !decoded.groupId || !decoded.type) {
+            // Require type (field 3) to be a real ack type (SCREAMING_SNAKE). Without the
+            // shape check a BroadcastNotification {broadcastId(1), channelId(2),
+            // publisherId(3)} satisfies messageId+groupId+type (publisherId lands in type)
+            // and is misrouted here instead of to the broadcast handler.
+            if (!decoded.messageId || !decoded.groupId || !decoded.type || !/^[A-Z][A-Z0-9_]*$/.test(decoded.type)) {
                 return null;
             }
             return decoded;

package/dist/version.d.ts

@@ -7,7 +7,7 @@
  *   MINOR, additive feature (e.g. multi-device payloads, new call event type)
  *   PATCH, bug-fix / perf improvement with no wire or API change
  */
-export declare const SDK_VERSION = "0.24.2";
+export declare const SDK_VERSION = "0.25.0";
 /**
  * Binary encrypted-payload format version.
  * Included as the first byte of every encrypted payload so receivers can

package/dist/version.js

@@ -10,7 +10,7 @@ exports.PROTOCOL_VERSION = exports.PAYLOAD_FORMAT_VERSION = exports.SDK_VERSION
  *   MINOR, additive feature (e.g. multi-device payloads, new call event type)
  *   PATCH, bug-fix / perf improvement with no wire or API change
  */
-exports.SDK_VERSION = '0.24.2';
+exports.SDK_VERSION = '0.25.0';
 /**
  * Binary encrypted-payload format version.
  * Included as the first byte of every encrypted payload so receivers can

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@droponair/sdk-js",
-  "version": "0.24.2",
-  "description": "DropOnAir SDK for end-to-end encrypted messaging",
+  "version": "0.25.0",
+  "description": "End-to-end encrypted messaging, voice and video calling SDK. The relay never sees your keys or message content.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "files": [
@@ -18,19 +18,30 @@
     "prepublishOnly": "npm run build"
   },
   "keywords": [
-    "droponair",
-    "messaging",
     "e2ee",
-    "encryption",
-    "end-to-end",
-    "sdk"
+    "end-to-end-encryption",
+    "encrypted-chat",
+    "chat-api",
+    "chat-sdk",
+    "messaging",
+    "messaging-sdk",
+    "realtime",
+    "websocket",
+    "webrtc",
+    "voice-calls",
+    "video-calls",
+    "video-calling",
+    "group-chat",
+    "push-notifications",
+    "sdk",
+    "droponair"
   ],
   "author": "DropOnAir",
   "license": "MIT",
   "publishConfig": {
     "access": "public"
   },
-  "homepage": "https://droponair.com",
+  "homepage": "https://www.droponair.com/",
   "engines": {
     "node": ">=18.0.0"
   },
@@ -40,10 +51,18 @@
     "tweetnacl-util": "^0.15.1"
   },
   "devDependencies": {
+    "@playwright/test": "^1.62.1",
+    "@types/jest": "^30.0.0",
     "@types/node": "^20.0.0",
+    "esbuild": "^0.28.2",
     "eslint": "^8.0.0",
     "jest": "^29.0.0",
+    "ts-jest": "^29.4.12",
     "ts-node": "^10.9.2",
     "typescript": "^5.0.0"
+  },
+  "bugs": {
+    "url": "https://www.droponair.com/contact/",
+    "email": "info@droponair.com"
   }
 }