@droponair/sdk-js 0.9.0 → 0.10.0

package/CHANGELOG.md

@@ -6,6 +6,29 @@ This project follows [Semantic Versioning](https://semver.org/).
 
 ---
 
+## [0.10.0], 2026-05-20
+
+### Added
+
+- **Device trust.** New `client.listMyDevices()` returns the current user's registered devices; `client.revokeMyDevice(deviceId)` revokes one of them. A revoked device's live session is closed immediately and all future connections from it are denied (revoke is permanent — re-registering yields a fresh deviceId).
+- **`DEVICE_REVOKED` event.** When this device is revoked (from another of the user's devices, or by the app owner), the SDK stops its reconnect loop, closes the socket, and surfaces a `DEVICE_REVOKED` event through `onEvent` so the app can clear local key storage and show a re-register prompt.
+- New exported `DeviceInfo` type.
+
+### Notes
+
+- No wire-format change; PROTOCOL_VERSION stays at 5. The new surface is REST (`/v1/devices`) plus an additive event type.
+- Any device that completes a connection is implicitly trusted. There is no explicit pairing/attestation step in this release.
+
+---
+
+## [0.9.1], 2026-05-19
+
+### Fixed
+
+- **`registerPushToken` / `unregisterPushToken` now exposed on the public `DropOnAirClient` type.** In 0.9.0 the methods were implemented on the `MessagingClient` class but missing from the exported `DropOnAirClient` interface, so TypeScript consumers couldn't call them through the `initialize()` return value. No wire-format change; this is a pure type-surface fix.
+
+---
+
 ## [0.9.0], 2026-05-19
 
 ### Added

package/README.md

@@ -98,6 +98,23 @@ const client = await initialize(options);
 | `ack(messageId)` | `Promise<void>` | Manually acknowledge a message |
 | `registerPushToken({ platform, token, voipToken? })` | `Promise<void>` | Register this device for push notifications. `platform` is `'APNS'`, `'FCM'`, or `'WEB_PUSH'`. |
 | `unregisterPushToken({ platform })` | `Promise<void>` | Unregister this device for push notifications (e.g. on logout). |
+| `listMyDevices()` | `Promise<DeviceInfo[]>` | List the current user's registered devices. |
+| `revokeMyDevice(deviceId)` | `Promise<DeviceInfo>` | Revoke one of the current user's devices. Permanent. |
+
+### Device trust
+
+Available since SDK `0.10.0`. Any device that completes a connection is implicitly trusted. `listMyDevices()` powers a "Your devices" screen; `revokeMyDevice()` cuts a device off immediately. When the *current* device is revoked, the SDK stops reconnecting and emits a `DEVICE_REVOKED` event via `onEvent` — listen for it to clear local key storage and prompt re-registration.
+
+```typescript
+const devices = await client.listMyDevices();
+await client.revokeMyDevice('old-phone-device-id');
+
+client.onEvent(e => {
+  if (e.type === 'DEVICE_REVOKED') {
+    // This device was revoked elsewhere. Clear local keys and show a re-register screen.
+  }
+});
+```
 
 ### Push notifications
 

package/dist/core/messaging-client.d.ts

@@ -1,6 +1,6 @@
 import { CryptoService } from '../crypto/crypto-service';
 import { SessionManager } from './session-manager';
-import { BroadcastCallback, CallEventCallback, DropOnAirClient, EventCallback, GroupCallEventCallback, GroupInfo, GroupMessageCallback, InitializeOptions, MessageCallback, MessageDeleteCallback, MessageEditCallback, TurnCredentials } from './types';
+import { BroadcastCallback, CallEventCallback, DropOnAirClient, EventCallback, GroupCallEventCallback, GroupInfo, GroupMessageCallback, InitializeOptions, MessageCallback, MessageDeleteCallback, MessageEditCallback, TurnCredentials, DeviceInfo } from './types';
 import { AttachmentRef, CreateUploadSessionOptions, DownloadedAttachment, PrepareAttachmentOptions, UploadSession } from '../attachment/attachment-types';
 export declare class MessagingClient implements DropOnAirClient {
     private readonly options;
@@ -136,6 +136,27 @@ export declare class MessagingClient implements DropOnAirClient {
     unregisterPushToken(opts: {
         platform: 'APNS' | 'FCM' | 'WEB_PUSH';
     }): Promise<void>;
+    /**
+     * List the current user's registered devices. Each device is implicitly
+     * trusted once it has completed a connection. Useful for a "Your devices"
+     * settings screen.
+     */
+    listMyDevices(): Promise<DeviceInfo[]>;
+    /**
+     * Revoke one of the current user's devices. The revoked device's live
+     * WebSocket session (if any) is closed immediately and all future
+     * connection attempts from that device are denied. Revoke is permanent;
+     * the user must re-register the device (which yields a fresh deviceId).
+     */
+    revokeMyDevice(deviceId: string): Promise<DeviceInfo>;
+    /**
+     * Handles an inbound DEVICE_REVOKED event: this device has been revoked
+     * (by the user from another device, or by the app owner). Stops the
+     * reconnect loop and closes the socket. The DEVICE_REVOKED event is also
+     * surfaced through onEvent so the app can clear local key storage and
+     * show a re-register prompt.
+     */
+    private handleDeviceRevoked;
     sendCleartextMessage(toUserId: string, plaintext: string): Promise<{
         messageId: string;
     }>;

package/dist/core/messaging-client.js

@@ -577,6 +577,59 @@ class MessagingClient {
         this.ws.send(this.codec.encodePushRegistrationFrame(frame));
     }
     // ---------------------------------------------------------------------------
+    // Device trust (PROTOCOL_VERSION 5+ / Phase 2b)
+    // ---------------------------------------------------------------------------
+    /**
+     * List the current user's registered devices. Each device is implicitly
+     * trusted once it has completed a connection. Useful for a "Your devices"
+     * settings screen.
+     */
+    async listMyDevices() {
+        const jwt = await this.getValidDropOnAirJwt(false);
+        const resp = await this.fetchFn(`${this.httpUrl}/v1/devices`, {
+            headers: { Authorization: `Bearer ${jwt}` },
+        });
+        if (!resp.ok) {
+            throw new Error(`Failed to list devices: ${resp.status}`);
+        }
+        return (await resp.json());
+    }
+    /**
+     * Revoke one of the current user's devices. The revoked device's live
+     * WebSocket session (if any) is closed immediately and all future
+     * connection attempts from that device are denied. Revoke is permanent;
+     * the user must re-register the device (which yields a fresh deviceId).
+     */
+    async revokeMyDevice(deviceId) {
+        const jwt = await this.getValidDropOnAirJwt(false);
+        const resp = await this.fetchFn(`${this.httpUrl}/v1/devices/${encodeURIComponent(deviceId)}`, {
+            method: 'DELETE',
+            headers: { Authorization: `Bearer ${jwt}` },
+        });
+        if (!resp.ok) {
+            throw new Error(`Failed to revoke device: ${resp.status}`);
+        }
+        return (await resp.json());
+    }
+    /**
+     * Handles an inbound DEVICE_REVOKED event: this device has been revoked
+     * (by the user from another device, or by the app owner). Stops the
+     * reconnect loop and closes the socket. The DEVICE_REVOKED event is also
+     * surfaced through onEvent so the app can clear local key storage and
+     * show a re-register prompt.
+     */
+    handleDeviceRevoked() {
+        this.shouldReconnect = false;
+        this.rateLimited = false;
+        if (this.reconnectTimer) {
+            clearTimeout(this.reconnectTimer);
+            this.reconnectTimer = null;
+        }
+        if (this.ws && this.ws.readyState === WebSocket.OPEN) {
+            this.ws.close(4001, 'DEVICE_REVOKED');
+        }
+    }
+    // ---------------------------------------------------------------------------
     // Cleartext messaging (no E2EE key exchange required)
     // ---------------------------------------------------------------------------
     async sendCleartextMessage(toUserId, plaintext) {
@@ -1272,6 +1325,10 @@ class MessagingClient {
                     if (frame.data.type === 'LIMIT_REACHED') {
                         this.rateLimited = true;
                     }
+                    if (frame.data.type === 'DEVICE_REVOKED') {
+                        this.log('device_revoked_received', { metadata: frame.data.metadata });
+                        this.handleDeviceRevoked();
+                    }
                     if (frame.data.type === 'ERROR' && frame.data.reason === 'JWT_EXPIRED') {
                         this.dropOnAirJwt = null;
                         this.currentUserId = null;

package/dist/core/types.d.ts

@@ -132,6 +132,19 @@ export interface InitializeOptions {
      */
     autoAckIncomingMessages?: boolean;
 }
+/** A registered device as returned by {@link DropOnAirClient.listMyDevices}. */
+export interface DeviceInfo {
+    deviceId: string;
+    sdkVersion?: string;
+    protocolVersion?: string;
+    platform?: string;
+    /** ISO-8601 timestamps. */
+    firstSeenAt?: string;
+    lastSeenAt?: string;
+    /** Non-null once revoked. */
+    revokedAt?: string;
+    revokedBy?: 'END_USER' | 'APP_OWNER' | 'SYSTEM';
+}
 export interface DropOnAirClient {
     connect(): Promise<void>;
     disconnect(): void;
@@ -170,6 +183,31 @@ export interface DropOnAirClient {
     onMessageEdit(callback: MessageEditCallback): () => void;
     /** Register a listener for incoming message-delete notifications. */
     onMessageDelete(callback: MessageDeleteCallback): () => void;
+    /**
+     * Register this device's push notification token. The platform delivers a
+     * push via APNs / FCM / Web Push when a sender attaches a pushPayload to
+     * a message and the recipient has no live WebSocket session. The token is
+     * opaque to the server. For iOS PushKit/CallKit, pass {@code voipToken}
+     * alongside the regular APNs token so incoming call invites wake the app
+     * via the VoIP push channel.
+     */
+    registerPushToken(opts: {
+        platform: 'APNS' | 'FCM' | 'WEB_PUSH';
+        token: string;
+        voipToken?: string;
+    }): Promise<void>;
+    /** Unregister this device's push notification token (e.g. on logout). */
+    unregisterPushToken(opts: {
+        platform: 'APNS' | 'FCM' | 'WEB_PUSH';
+    }): Promise<void>;
+    /** List the current user's registered devices. */
+    listMyDevices(): Promise<DeviceInfo[]>;
+    /**
+     * Revoke one of the current user's devices. The revoked device's live
+     * session is closed and all future connections from it are denied.
+     * Revoke is permanent.
+     */
+    revokeMyDevice(deviceId: string): Promise<DeviceInfo>;
     /**
      * Convenience: encrypts (E2EE), uploads to the customer's bucket, finalizes,
      * and returns an AttachmentRef ready to pass into {@link sendMessage}.

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 import { InitializeOptions, DropOnAirClient } from './core/types';
 export { SDK_VERSION, PROTOCOL_VERSION, PAYLOAD_FORMAT_VERSION } from './version';
 export declare function initialize(options: InitializeOptions): Promise<DropOnAirClient>;
-export type { InitializeOptions, DropOnAirClient, DropOnAirEvent, MessageCallback, EventCallback, DecryptedMessage, KeyStorageAdapter, CallEvent, CallEventType, CallEventCallback, TurnCredentials, BroadcastMessage, BroadcastCallback, GroupInfo, GroupMemberInfo, DecryptedGroupMessage, GroupMessageCallback, GroupCallEvent, GroupCallEventType, GroupCallEventCallback, MessageEditEvent, MessageEditCallback, MessageDeleteEvent, MessageDeleteCallback, } from './core/types';
+export type { InitializeOptions, DropOnAirClient, DropOnAirEvent, MessageCallback, EventCallback, DecryptedMessage, KeyStorageAdapter, CallEvent, CallEventType, CallEventCallback, TurnCredentials, BroadcastMessage, BroadcastCallback, GroupInfo, GroupMemberInfo, DecryptedGroupMessage, GroupMessageCallback, GroupCallEvent, GroupCallEventType, GroupCallEventCallback, MessageEditEvent, MessageEditCallback, MessageDeleteEvent, MessageDeleteCallback, DeviceInfo, } from './core/types';
 export type { AttachmentEncryptionType, AttachmentConversationType, AttachmentRef, DeviceWrappedKey, CreateUploadSessionOptions, UploadSession, PrepareAttachmentOptions, DownloadedAttachment, } from './attachment/attachment-types';
 declare const _default: {
     initialize: typeof initialize;

package/dist/version.d.ts

@@ -7,7 +7,7 @@
  *   MINOR, additive feature (e.g. multi-device payloads, new call event type)
  *   PATCH, bug-fix / perf improvement with no wire or API change
  */
-export declare const SDK_VERSION = "0.9.0";
+export declare const SDK_VERSION = "0.10.0";
 /**
  * Binary encrypted-payload format version.
  * Included as the first byte of every encrypted payload so receivers can

package/dist/version.js

@@ -10,7 +10,7 @@ exports.PROTOCOL_VERSION = exports.PAYLOAD_FORMAT_VERSION = exports.SDK_VERSION
  *   MINOR, additive feature (e.g. multi-device payloads, new call event type)
  *   PATCH, bug-fix / perf improvement with no wire or API change
  */
-exports.SDK_VERSION = '0.9.0';
+exports.SDK_VERSION = '0.10.0';
 /**
  * Binary encrypted-payload format version.
  * Included as the first byte of every encrypted payload so receivers can

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@droponair/sdk-js",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "DropOnAir SDK for end-to-end encrypted messaging",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",