@droponair/sdk-js 0.7.0 → 0.9.0

package/CHANGELOG.md

@@ -6,6 +6,43 @@ This project follows [Semantic Versioning](https://semver.org/).
 
 ---
 
+## [0.9.0], 2026-05-19
+
+### Added
+
+- **Push notification token registration.** New `client.registerPushToken({ platform, token, voipToken? })` and `client.unregisterPushToken({ platform })` methods. The platform delivers a push via APNs (iOS), FCM v1 (Android), or VAPID/Web Push (browser) whenever a sender supplies a `pushPayload` on a message and the recipient device has no live WebSocket session. The token is opaque to the server. For iOS VoIP/CallKit pushes, pass `voipToken` alongside the regular APNs token.
+- **PROTOCOL_VERSION bumped to 5.** Additive only: new optional `pushPayload` field on `Envelope`, `GroupEnvelope`, `CallFrame`, `GroupCallFrame`; new `PushRegistrationFrame` for token registration. Existing 0.8.x clients keep working against the new server (proto3 ignores unknown fields).
+
+### Notes
+
+- E2EE invariant preserved: the push body is sender-supplied cleartext metadata only ("1 new message from Alice"), never the encrypted message contents. The recipient SDK decrypts the real message after the push wakes the device and the WebSocket reconnects.
+- Customers configure their own APNs (.p8 + Team/Key/Bundle IDs), FCM service-account JSON, and VAPID keypair via the dashboard. Per-app, not per-environment; use two apps for dev/prod separation.
+
+---
+
+## [0.8.0], 2026-05-19
+
+### BREAKING
+
+- `sendGroupMessage(groupId, plaintext)` is **renamed to `sendCleartextGroupMessage(groupId, plaintext)`**. The previous JS method was cleartext-only despite the name, while the Android and iOS SDKs reserved the same name for an end-to-end encrypted send. This release aligns all three SDKs on the same naming.
+  - **Update existing JS callers**: replace `client.sendGroupMessage(groupId, text)` with `client.sendCleartextGroupMessage(groupId, text)`.
+
+### Added
+
+- **End-to-end encrypted group send.** New `sendGroupMessage(groupId, plaintext, memberUserIds, options?)` that mirrors the Android and iOS SDKs: the SDK encrypts the plaintext per-recipient-per-device (sender-side fan-out) before sending. Pass `options.attachments` for E2EE group attachments.
+- **Group attachments.** Both `sendGroupMessage` and the wire `GroupEnvelope` now carry an optional `attachments` field; previously this was 1:1 only on JS.
+
+### Fixed
+
+- **JS `GroupEnvelope` / `GroupMessageNotification` protobuf field numbers** now match the source-of-truth `messaging.proto`. The previous JS schema had a field-number drift versus the Android/iOS generated proto bindings, which meant group sends from JS arrived at the server with values in the wrong fields (and were silently tolerated by proto3's unknown-field handling). With this release JS group send/receive is wire-correct.
+
+### Notes
+
+- Wire protocol unchanged (PROTOCOL_VERSION stays 4). The proto schema was already correct; only the JS hand-rolled codec was out of sync.
+- `protoFieldNumbers` for the group types are now documented in `droponair-sdk-shared/test-vectors/protobuf-vectors.json` for cross-platform reference.
+
+---
+
 ## [0.7.0], 2026-05-19
 
 ### Added

package/README.md

@@ -96,6 +96,31 @@ const client = await initialize(options);
 | `onMessageDelete(callback)` | `() => void` | Listen for inbound delete tombstones for 1:1 messages |
 | `onEvent(callback)` | `() => void` | Listen for system events (CONNECTED, DELIVERED, ERROR, etc.) |
 | `ack(messageId)` | `Promise<void>` | Manually acknowledge a message |
+| `registerPushToken({ platform, token, voipToken? })` | `Promise<void>` | Register this device for push notifications. `platform` is `'APNS'`, `'FCM'`, or `'WEB_PUSH'`. |
+| `unregisterPushToken({ platform })` | `Promise<void>` | Unregister this device for push notifications (e.g. on logout). |
+
+### Push notifications
+
+Available since SDK `0.9.0`. Customers configure their own APNs / FCM / VAPID credentials in the dashboard. The platform delivers a push only when the sender attaches a `pushPayload` to a message and the recipient device has no live WebSocket session. See the per-product availability and limits on your dashboard's Subscription page.
+
+```typescript
+// iOS, after didRegisterForRemoteNotificationsWithDeviceToken
+await client.registerPushToken({ platform: 'APNS', token: deviceTokenHex });
+
+// iOS + PushKit/CallKit (VoIP)
+await client.registerPushToken({ platform: 'APNS', token: deviceTokenHex, voipToken: voipTokenHex });
+
+// Android, after FirebaseMessaging.getInstance().token
+await client.registerPushToken({ platform: 'FCM', token: fcmToken });
+
+// Browser, the token is the JSON returned by PushManager.subscribe()
+await client.registerPushToken({ platform: 'WEB_PUSH', token: JSON.stringify(subscription) });
+
+// On logout
+await client.unregisterPushToken({ platform: 'APNS' });
+```
+
+E2EE invariant: the push body is sender-supplied cleartext metadata only (e.g. "1 new message from Alice"), never the encrypted message contents. The recipient SDK decrypts the real message after the push wakes the device and the WebSocket reconnects.
 
 ### Message Edit & Delete
 
@@ -182,7 +207,8 @@ client.onMessage(async (msg) => {
 | `addGroupMembers(groupId, userIds)` | `Promise<GroupInfo>` | Add members (owner/admin) |
 | `removeGroupMember(groupId, userId)` | `Promise<GroupInfo>` | Remove a member (owner/admin) |
 | `deleteGroup(groupId)` | `Promise<void>` | Delete a group (owner only) |
-| `sendGroupMessage(groupId, plaintext)` | `Promise<{ messageId }>` | Send a group message |
+| `sendGroupMessage(groupId, plaintext, memberUserIds, options?)` | `Promise<{ messageId }>` | Send an end-to-end encrypted group message (sender-side per-recipient fan-out). `options.attachments` for E2EE group attachments. |
+| `sendCleartextGroupMessage(groupId, plaintext)` | `Promise<{ messageId }>` | Send a plaintext (non-encrypted) group message; server fans out to every other member. |
 | `onGroupMessage(callback)` | `() => void` | Listen for group messages |
 
 ### 1-to-1 Calls

package/dist/core/messaging-client.d.ts

@@ -111,6 +111,31 @@ export declare class MessagingClient implements DropOnAirClient {
     deleteMessage(originalMessageId: string, toUserId: string, scope: 'FOR_EVERYONE' | 'FOR_ME'): Promise<{
         deleteId: string;
     }>;
+    /**
+     * Register this device's push notification token with the DropOnAir platform.
+     * The token is opaque to the server; the platform fans out push notifications
+     * via the customer's APNs / FCM / VAPID credentials when a sender attaches a
+     * pushPayload to a message and the recipient is offline.
+     *
+     * For iOS apps using VoIP push (PushKit), pass {@code voipToken} alongside the
+     * regular APNs token. The platform will route CALL_INVITE pushes via the VoIP
+     * token and message pushes via the regular token.
+     *
+     * Idempotent: calling twice with the same (platform, deviceId) upserts the
+     * stored token and refreshes its lastSeenAt timestamp.
+     */
+    registerPushToken(opts: {
+        platform: 'APNS' | 'FCM' | 'WEB_PUSH';
+        token: string;
+        voipToken?: string;
+    }): Promise<void>;
+    /**
+     * Unregister this device's push notification token (e.g. on logout). Future
+     * push fan-out for this (appId, userId, deviceId, platform) tuple is dropped.
+     */
+    unregisterPushToken(opts: {
+        platform: 'APNS' | 'FCM' | 'WEB_PUSH';
+    }): Promise<void>;
     sendCleartextMessage(toUserId: string, plaintext: string): Promise<{
         messageId: string;
     }>;
@@ -127,7 +152,32 @@ export declare class MessagingClient implements DropOnAirClient {
     addGroupMembers(groupId: string, userIds: string[]): Promise<GroupInfo>;
     removeGroupMember(groupId: string, userId: string): Promise<GroupInfo>;
     deleteGroup(groupId: string): Promise<void>;
-    sendGroupMessage(groupId: string, plaintext: string): Promise<{
+    /**
+     * Send an end-to-end encrypted group message. Mirrors the Android and iOS
+     * SDKs: the SDK encrypts the plaintext per recipient device (sender-side
+     * fan-out), producing one `GroupMemberPayload` per member that the server
+     * then routes to that member's devices without ever seeing the plaintext.
+     *
+     * `memberUserIds` should be the current group membership minus the sender;
+     * fetch it from your backend / `getGroup()` before calling.
+     *
+     * For unencrypted group messaging (bots, public channels), use
+     * {@link sendCleartextGroupMessage} instead.
+     */
+    sendGroupMessage(groupId: string, plaintext: string, memberUserIds: string[], options?: {
+        attachments?: AttachmentRef[];
+    }): Promise<{
+        messageId: string;
+    }>;
+    /**
+     * Send a plaintext (non-encrypted) group message. The server fans out the
+     * cleartext to every other member of the group; useful for bots and public
+     * channels where E2EE isn't required.
+     *
+     * For E2EE group messaging, use {@link sendGroupMessage} which encrypts
+     * per-recipient before sending.
+     */
+    sendCleartextGroupMessage(groupId: string, plaintext: string): Promise<{
         messageId: string;
     }>;
     onGroupMessage(callback: GroupMessageCallback): () => void;

package/dist/core/messaging-client.js

@@ -526,6 +526,57 @@ class MessagingClient {
         return { deleteId };
     }
     // ---------------------------------------------------------------------------
+    // Push notification token registration (PROTOCOL_VERSION 5+)
+    // ---------------------------------------------------------------------------
+    /**
+     * Register this device's push notification token with the DropOnAir platform.
+     * The token is opaque to the server; the platform fans out push notifications
+     * via the customer's APNs / FCM / VAPID credentials when a sender attaches a
+     * pushPayload to a message and the recipient is offline.
+     *
+     * For iOS apps using VoIP push (PushKit), pass {@code voipToken} alongside the
+     * regular APNs token. The platform will route CALL_INVITE pushes via the VoIP
+     * token and message pushes via the regular token.
+     *
+     * Idempotent: calling twice with the same (platform, deviceId) upserts the
+     * stored token and refreshes its lastSeenAt timestamp.
+     */
+    async registerPushToken(opts) {
+        if (!this.ws || this.ws.readyState !== WebSocket.OPEN) {
+            throw new Error('DropOnAir websocket is not connected');
+        }
+        if (!opts.token || opts.token.trim().length === 0) {
+            throw new Error('Push token must not be empty');
+        }
+        const deviceId = this.deviceId ?? await this.getOrCreateDeviceId();
+        const frame = {
+            type: 'PUSH_REGISTER',
+            platform: opts.platform,
+            token: opts.token,
+            voipToken: opts.voipToken ?? '',
+            deviceId,
+        };
+        this.ws.send(this.codec.encodePushRegistrationFrame(frame));
+    }
+    /**
+     * Unregister this device's push notification token (e.g. on logout). Future
+     * push fan-out for this (appId, userId, deviceId, platform) tuple is dropped.
+     */
+    async unregisterPushToken(opts) {
+        if (!this.ws || this.ws.readyState !== WebSocket.OPEN) {
+            throw new Error('DropOnAir websocket is not connected');
+        }
+        const deviceId = this.deviceId ?? await this.getOrCreateDeviceId();
+        const frame = {
+            type: 'PUSH_UNREGISTER',
+            platform: opts.platform,
+            token: '',
+            voipToken: '',
+            deviceId,
+        };
+        this.ws.send(this.codec.encodePushRegistrationFrame(frame));
+    }
+    // ---------------------------------------------------------------------------
     // Cleartext messaging (no E2EE key exchange required)
     // ---------------------------------------------------------------------------
     async sendCleartextMessage(toUserId, plaintext) {
@@ -679,7 +730,109 @@ class MessagingClient {
     // ---------------------------------------------------------------------------
     // Group messaging
     // ---------------------------------------------------------------------------
-    async sendGroupMessage(groupId, plaintext) {
+    /**
+     * Send an end-to-end encrypted group message. Mirrors the Android and iOS
+     * SDKs: the SDK encrypts the plaintext per recipient device (sender-side
+     * fan-out), producing one `GroupMemberPayload` per member that the server
+     * then routes to that member's devices without ever seeing the plaintext.
+     *
+     * `memberUserIds` should be the current group membership minus the sender;
+     * fetch it from your backend / `getGroup()` before calling.
+     *
+     * For unencrypted group messaging (bots, public channels), use
+     * {@link sendCleartextGroupMessage} instead.
+     */
+    async sendGroupMessage(groupId, plaintext, memberUserIds, options) {
+        if (!this.ws || this.ws.readyState !== WebSocket.OPEN) {
+            throw new Error('DropOnAir websocket is not connected');
+        }
+        if (!this.currentUserId) {
+            throw new Error('Missing sender identity from DropOnAir JWT subject');
+        }
+        if (this.rateLimited) {
+            throw new Error('Sending is temporarily blocked by LIMIT_REACHED');
+        }
+        if (this.dropOnAirJwt && (0, bytes_1.isJwtExpired)(this.dropOnAirJwt)) {
+            throw new Error('JWT_EXPIRED: Secure messaging session is reconnecting; please retry in a moment');
+        }
+        if (!memberUserIds || memberUserIds.length === 0) {
+            throw new Error('sendGroupMessage requires at least one recipient userId in memberUserIds');
+        }
+        const myDeviceId = this.deviceId ?? await this.getOrCreateDeviceId();
+        const messageId = crypto.randomUUID();
+        const clientMessageId = messageId;
+        const timestamp = Date.now();
+        const myIdentity = await this.cryptoService.getOrCreateIdentity();
+        const myPublicKeyBytes = (0, bytes_1.fromBase64)(myIdentity.publicKey);
+        // Per-member sender-side fan-out: one GroupMemberPayload per member, each
+        // containing one DeviceEncryptedPayload per device the member has registered.
+        const memberPayloads = [];
+        for (const memberId of memberUserIds) {
+            if (memberId === this.currentUserId)
+                continue; // skip self
+            const deviceKeys = await this.fetchDeviceKeys(memberId);
+            const devicePayloads = [];
+            if (deviceKeys.length > 0) {
+                for (const dk of deviceKeys) {
+                    const sharedKey = await this.cryptoService.deriveSharedSecret(memberId, dk.publicKey, this.currentUserId);
+                    const encrypted = await this.cryptoService.encrypt(plaintext, sharedKey, {
+                        messageId,
+                        senderId: this.currentUserId,
+                        recipientId: memberId,
+                        timestamp,
+                    });
+                    devicePayloads.push({
+                        deviceId: dk.deviceId,
+                        encryptedPayload: encrypted,
+                        senderPublicKey: myPublicKeyBytes,
+                    });
+                }
+            }
+            else {
+                // Legacy fallback: peer reports no multi-device keys. Encrypt once
+                // against the single legacy public key under deviceId="default", which
+                // matches the Android SDK convention.
+                const sharedKey = await this.getPeerSharedKey(memberId);
+                const encrypted = await this.cryptoService.encrypt(plaintext, sharedKey, {
+                    messageId,
+                    senderId: this.currentUserId,
+                    recipientId: memberId,
+                    timestamp,
+                });
+                devicePayloads.push({
+                    deviceId: 'default',
+                    encryptedPayload: encrypted,
+                    senderPublicKey: myPublicKeyBytes,
+                });
+            }
+            memberPayloads.push({ userId: memberId, devicePayloads });
+        }
+        const frame = {
+            messageId,
+            appId: this.options.appId,
+            groupId,
+            fromUserId: this.currentUserId,
+            timestamp,
+            clientMessageId,
+            senderDeviceId: myDeviceId,
+            encryptionType: 0, // E2EE
+            memberPayloads,
+        };
+        if (options?.attachments && options.attachments.length > 0) {
+            frame.attachments = options.attachments.map(a => this.attachmentClient.toWire(a));
+        }
+        this.ws.send(this.codec.encodeGroupEnvelope(frame));
+        return { messageId };
+    }
+    /**
+     * Send a plaintext (non-encrypted) group message. The server fans out the
+     * cleartext to every other member of the group; useful for bots and public
+     * channels where E2EE isn't required.
+     *
+     * For E2EE group messaging, use {@link sendGroupMessage} which encrypts
+     * per-recipient before sending.
+     */
+    async sendCleartextGroupMessage(groupId, plaintext) {
         if (!this.ws || this.ws.readyState !== WebSocket.OPEN) {
             throw new Error('DropOnAir websocket is not connected');
         }
@@ -695,17 +848,17 @@ class MessagingClient {
         const myDeviceId = this.deviceId ?? await this.getOrCreateDeviceId();
         const messageId = crypto.randomUUID();
         const timestamp = Date.now();
-        // For now, group messages use cleartext (E2EE group fanout requires
-        // fetching device keys for every member, which is a future enhancement).
         const frame = {
             messageId,
+            appId: this.options.appId,
             groupId,
             fromUserId: this.currentUserId,
+            timestamp,
+            clientMessageId: messageId,
             senderDeviceId: myDeviceId,
-            memberPayloads: [],
             encryptionType: 1, // CLEARTEXT
             plaintextPayload: plaintext,
-            timestamp,
+            memberPayloads: [],
         };
         this.ws.send(this.codec.encodeGroupEnvelope(frame));
         return { messageId };

package/dist/core/types.d.ts

@@ -238,8 +238,23 @@ export interface DropOnAirClient {
     removeGroupMember(groupId: string, userId: string): Promise<GroupInfo>;
     /** Delete a group (requires OWNER role). */
     deleteGroup(groupId: string): Promise<void>;
-    /** Send a cleartext message to a group. */
-    sendGroupMessage(groupId: string, plaintext: string): Promise<{
+    /**
+     * Send an end-to-end encrypted group message. The SDK encrypts the
+     * plaintext per recipient device (sender-side fan-out) before sending.
+     * `memberUserIds` should be the current group membership minus the sender;
+     * pass `options.attachments` for per-recipient encrypted attachment refs.
+     */
+    sendGroupMessage(groupId: string, plaintext: string, memberUserIds: string[], options?: {
+        attachments?: import('../attachment/attachment-types').AttachmentRef[];
+    }): Promise<{
+        messageId: string;
+    }>;
+    /**
+     * Send a plaintext (non-encrypted) group message. The server fans out the
+     * cleartext to every other member. Use this for bots and public channels;
+     * use {@link sendGroupMessage} for E2EE group messaging.
+     */
+    sendCleartextGroupMessage(groupId: string, plaintext: string): Promise<{
         messageId: string;
     }>;
     /** Register a listener for incoming group messages. Returns an unsubscribe function. */

package/dist/transport/protobuf-codec.d.ts

@@ -82,23 +82,27 @@ export interface WireGroupMemberPayload {
 }
 export interface WireGroupEnvelope {
     messageId: string;
+    appId?: string;
     groupId: string;
     fromUserId: string;
+    timestamp: number;
+    clientMessageId?: string;
     senderDeviceId: string;
-    memberPayloads: WireGroupMemberPayload[];
     encryptionType: number;
     plaintextPayload?: string;
-    timestamp: number;
+    memberPayloads: WireGroupMemberPayload[];
+    attachments?: WireAttachmentRef[];
 }
 export interface WireGroupMessageNotification {
     messageId: string;
     groupId: string;
     fromUserId: string;
-    senderDeviceId: string;
-    devicePayloads: WireDeviceEncryptedPayload[];
+    timestamp: number;
     encryptionType: number;
     plaintextPayload?: string;
-    timestamp: number;
+    devicePayloads: WireDeviceEncryptedPayload[];
+    senderDeviceId: string;
+    attachments?: WireAttachmentRef[];
 }
 export interface WireGroupAck {
     messageId: string;
@@ -132,6 +136,18 @@ export interface WireMessageEditFrame {
     plaintextPayload?: string;
     clientEditId?: string;
 }
+/**
+ * Push token registration / unregister. Client -> server only. The server
+ * acks with a regular Ack frame of type 'PUSH_REGISTERED' or
+ * 'PUSH_UNREGISTERED' and correlation 'PUSH:<deviceId>:<platform>'.
+ */
+export interface WirePushRegistrationFrame {
+    type: 'PUSH_REGISTER' | 'PUSH_UNREGISTER';
+    platform: 'APNS' | 'FCM' | 'WEB_PUSH';
+    token: string;
+    voipToken?: string;
+    deviceId: string;
+}
 /** Tombstone frame, scope FOR_EVERYONE or FOR_ME. */
 export interface WireMessageDeleteFrame {
     type: string;
@@ -185,6 +201,7 @@ export declare class ProtobufCodec {
     encodeGroupAck(value: WireGroupAck): Uint8Array;
     encodeMessageEditFrame(value: WireMessageEditFrame): Uint8Array;
     encodeMessageDeleteFrame(value: WireMessageDeleteFrame): Uint8Array;
+    encodePushRegistrationFrame(value: WirePushRegistrationFrame): Uint8Array;
     decodeFrame(payload: Uint8Array): InboundFrame;
     private tryDecodeEnvelope;
     private tryDecodeAck;

package/dist/transport/protobuf-codec.js

@@ -124,20 +124,22 @@ const GroupMemberPayloadType = new protobuf.Type('GroupMemberPayload')
     .add(new protobuf.Field('userId', 1, 'string'))
     .add(new protobuf.Field('devicePayloads', 2, 'DeviceEncryptedPayload', 'repeated'));
 const GroupEnvelopeEncryptionTypeEnum = new protobuf.Enum('EncryptionType', { E2EE: 0, CLEARTEXT: 1 });
-// NOTE: GroupEnvelope JS field numbers diverge from the proto contract (tracked
-// under phase 2.3 "JS encrypted group send parity"). Attachments support for
-// groups in JS will land with phase 2.3 / 2.4 once field numbers are aligned.
 const GroupEnvelopeType = new protobuf.Type('GroupEnvelope')
     .add(GroupEnvelopeEncryptionTypeEnum)
     .add(GroupMemberPayloadType)
+    .add(AttachmentRefType)
     .add(new protobuf.Field('messageId', 1, 'string'))
-    .add(new protobuf.Field('groupId', 2, 'string'))
-    .add(new protobuf.Field('fromUserId', 3, 'string'))
-    .add(new protobuf.Field('senderDeviceId', 4, 'string'))
-    .add(new protobuf.Field('memberPayloads', 5, 'GroupMemberPayload', 'repeated'))
-    .add(new protobuf.Field('encryptionType', 6, 'EncryptionType'))
-    .add(new protobuf.Field('plaintextPayload', 7, 'string'))
-    .add(new protobuf.Field('timestamp', 8, 'int64'));
+    .add(new protobuf.Field('appId', 2, 'string'))
+    .add(new protobuf.Field('groupId', 3, 'string'))
+    .add(new protobuf.Field('fromUserId', 4, 'string'))
+    .add(new protobuf.Field('timestamp', 5, 'int64'))
+    .add(new protobuf.Field('clientMessageId', 6, 'string'))
+    .add(new protobuf.Field('senderDeviceId', 7, 'string'))
+    .add(new protobuf.Field('encryptionType', 8, 'EncryptionType'))
+    .add(new protobuf.Field('plaintextPayload', 9, 'string'))
+    .add(new protobuf.Field('memberPayloads', 10, 'GroupMemberPayload', 'repeated'))
+    // field 11 reserved upstream
+    .add(new protobuf.Field('attachments', 12, 'AttachmentRef', 'repeated'));
 const GroupNotifEncryptionTypeEnum = new protobuf.Enum('EncryptionType', { E2EE: 0, CLEARTEXT: 1 });
 const GroupNotifDeviceType = new protobuf.Type('DeviceEncryptedPayload')
     .add(new protobuf.Field('deviceId', 1, 'string'))
@@ -149,11 +151,12 @@ const GroupMessageNotificationType = new protobuf.Type('GroupMessageNotification
     .add(new protobuf.Field('messageId', 1, 'string'))
     .add(new protobuf.Field('groupId', 2, 'string'))
     .add(new protobuf.Field('fromUserId', 3, 'string'))
-    .add(new protobuf.Field('senderDeviceId', 4, 'string'))
-    .add(new protobuf.Field('devicePayloads', 5, 'DeviceEncryptedPayload', 'repeated'))
-    .add(new protobuf.Field('encryptionType', 6, 'EncryptionType'))
-    .add(new protobuf.Field('plaintextPayload', 7, 'string'))
-    .add(new protobuf.Field('timestamp', 8, 'int64'));
+    .add(new protobuf.Field('timestamp', 4, 'int64'))
+    .add(new protobuf.Field('encryptionType', 5, 'EncryptionType'))
+    .add(new protobuf.Field('plaintextPayload', 6, 'string'))
+    .add(new protobuf.Field('devicePayloads', 7, 'DeviceEncryptedPayload', 'repeated'))
+    .add(new protobuf.Field('senderDeviceId', 8, 'string'))
+    .add(new protobuf.Field('attachments', 9, 'AttachmentRef', 'repeated'));
 const GroupAckType = new protobuf.Type('GroupAck')
     .add(new protobuf.Field('messageId', 1, 'string'))
     .add(new protobuf.Field('groupId', 2, 'string'))
@@ -205,6 +208,15 @@ const MessageDeleteFrameType = new protobuf.Type('MessageDeleteFrame')
     .add(new protobuf.Field('timestamp', 7, 'int64'))
     .add(new protobuf.Field('scope', 8, 'string'))
     .add(new protobuf.Field('clientDeleteId', 9, 'string'));
+// Push token registration frame (PROTOCOL_VERSION 5+). Client to server only;
+// the server emits a PUSH_REGISTERED / PUSH_UNREGISTERED Ack back. The token
+// is opaque to the server and stored against (appId, userId, deviceId, platform).
+const PushRegistrationFrameType = new protobuf.Type('PushRegistrationFrame')
+    .add(new protobuf.Field('type', 1, 'string'))
+    .add(new protobuf.Field('platform', 2, 'string'))
+    .add(new protobuf.Field('token', 3, 'string'))
+    .add(new protobuf.Field('voipToken', 4, 'string'))
+    .add(new protobuf.Field('deviceId', 5, 'string'));
 class ProtobufCodec {
     encodeEnvelope(value) {
         return EnvelopeType.encode(value).finish();
@@ -233,6 +245,9 @@ class ProtobufCodec {
     encodeMessageDeleteFrame(value) {
         return MessageDeleteFrameType.encode(value).finish();
     }
+    encodePushRegistrationFrame(value) {
+        return PushRegistrationFrameType.encode(value).finish();
+    }
     decodeFrame(payload) {
         // Edit and delete frames must be probed BEFORE Envelope, the type
         // discriminator at field 1 ("MESSAGE_EDIT" / "MESSAGE_DELETE") would

package/dist/version.d.ts

@@ -7,7 +7,7 @@
  *   MINOR, additive feature (e.g. multi-device payloads, new call event type)
  *   PATCH, bug-fix / perf improvement with no wire or API change
  */
-export declare const SDK_VERSION = "0.7.0";
+export declare const SDK_VERSION = "0.9.0";
 /**
  * Binary encrypted-payload format version.
  * Included as the first byte of every encrypted payload so receivers can
@@ -19,4 +19,4 @@ export declare const PAYLOAD_FORMAT_VERSION = 1;
  * Increment when adding required proto fields or changing frame semantics.
  * The server advertises its supported range via GET /api/info.
  */
-export declare const PROTOCOL_VERSION = 4;
+export declare const PROTOCOL_VERSION = 5;

package/dist/version.js

@@ -10,7 +10,7 @@ exports.PROTOCOL_VERSION = exports.PAYLOAD_FORMAT_VERSION = exports.SDK_VERSION
  *   MINOR, additive feature (e.g. multi-device payloads, new call event type)
  *   PATCH, bug-fix / perf improvement with no wire or API change
  */
-exports.SDK_VERSION = '0.7.0';
+exports.SDK_VERSION = '0.9.0';
 /**
  * Binary encrypted-payload format version.
  * Included as the first byte of every encrypted payload so receivers can
@@ -22,4 +22,4 @@ exports.PAYLOAD_FORMAT_VERSION = 1;
  * Increment when adding required proto fields or changing frame semantics.
  * The server advertises its supported range via GET /api/info.
  */
-exports.PROTOCOL_VERSION = 4;
+exports.PROTOCOL_VERSION = 5;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@droponair/sdk-js",
-  "version": "0.7.0",
+  "version": "0.9.0",
   "description": "DropOnAir SDK for end-to-end encrypted messaging",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",