connectanum_client 3.0.0-beta.5

Connectanum WAMP client implementation for Dart and Flutter.

3.0.0-beta.5

• Publish native libraries through staged atomic replacement so repeated build hooks cannot invalidate an already mapped macOS library image.

3.0.0-beta.4

• Adopt the stable Dart native-hook APIs and expand the documented public MCP client surface.

3.0.0-beta.3

• Cancel pending WebSocket upgrades when a client disconnects, reject sockets that complete after cancellation, and make close-before-open safe on web.

3.0.0-beta.2

• Make isolated pub.dev installs derive the matching signed native release tag from the package version while preserving Cargo builds for source checkouts.

3.0.0-beta.1

• Run SCRAM Argon2id13 and PBKDF2 derivation asynchronously on native isolates and dedicated Web Workers, and verify the server signature before accepting authentication success.
• Complete multi-gigabit file and large-frame paths with bounded progressive delivery, native payload ownership, E2EE, JSON/MessagePack/CBOR, RawSocket, WebSocket, TLS, and backpressure coverage.
• Harden router-hosted MCP auth discovery, session isolation, direct JSON, Streamable HTTP, resource, prompt, Meta API, and pub/sub helpers.

3.0.0-beta

• Add deterministic release for native-backed lazy message payloads after consumers finish with borrowed byte views, with idempotent native-handle cleanup and finalizer detachment.
• Add bounded high-level file delivery over standard WAMP progressive call invocations, with binary argument chunks, exact-size and SHA-256 validation, sink backpressure, cancellation cleanup, and Dart IO path sources. Native cleartext RawSocket connections use Linux or macOS sendfile for MessagePack and CBOR file segments; TLS, WebSocket, JSON, E2EE, and unsupported peers retain the bounded buffered path. Native receivers hash retained binary arguments without a second Dart payload copy when the wire shape permits it.
• Fix optional large-frame RawSocket upgrade interoperability by preserving prefetched standard-peer data and encoding the extension exponent in the documented low nibble.
• Add a race-safe buffered client for the standard WAMP Session, Registration, and Subscription Meta APIs, including immutable lifecycle snapshots and atomic direct subscription-handler attachment.
• Complete router-initiated WAMP GOODBYE handshakes and reconnect after wamp.close.system_shutdown, emitting a fresh session for application registration recovery.
• Start the coordinated Connectanum 3.0 beta series.
• Add progressive call invocations, call timeout handling, the versioned payload E2EE profile, and native/Dart transport parity.
• Add typed Streamable HTTP and direct JSON helpers for router-hosted MCP, authentication, tool/meta APIs, resources, prompts, and pub/sub.
• Add typed Streamable HTTP and lifecycle-free direct JSON helpers for MCP prompt and resource-template argument completion.
• Validate RFC 9207 authorization-response issuers for MCP OAuth callbacks, including advertised-required, optional-present, exact-string, and redacted error-response handling.
• Advertise the supported OAuth refresh_token grant in public Client ID Metadata Documents by default, with an explicit authorization-code-only opt-out and no implicit scope expansion.
• Build fail-closed, resource-bound OAuth step-up authorization requests from live MCP insufficient_scope challenges while preserving active Streamable HTTP session state and leaving retries under consumer control.
• Bind initial MCP OAuth authorization requests to validated protected-resource discovery and a selected advertised authorization server, preferring live challenge scopes with redacted mismatch failures and unchanged Streamable HTTP client state.
• Bind router HTTP-auth challenges and issued bearer grants to the requested realm, authentication method, and auth ID before signing or returning credentials.
• Add grant-aware router HTTP-auth refreshes that fail closed when the replacement token scheme, identity, role, provider, or authorization details drift from the prior grant.
• Bind public router HTTP-auth grants to their exact issuing endpoint and add grant-aware access/refresh revocation so successful credential lifecycles do not transmit tokens through a different auth route.
• Require endpoint-bound router HTTP-auth grants to share the target MCP client's HTTP origin before grant-aware Streamable/stateless construction or in-place credential replacement; raw bearer-token APIs remain caller-managed.
• Add versioned router HTTP-auth grant persistence with exact issuer and MCP- origin restore pins, absolute access/refresh expiry preservation, redacted state validation, and pre-I/O rejection of known-expired grant-aware use.
• Retain known router HTTP-auth and OAuth access-token expiries in grant-aware MCP clients, reject every new HTTP request after expiry through a redacted typed exception, and preserve active Streamable session state for refresh and in-place grant replacement.
• Let typed Streamable HTTP and direct JSON WAMP API-list helpers send validated opaque cursors and reject malformed continuation cursors.
• Re-export the shared MCP resource-URI-template utility so client-only consumers can expand advertised templates without duplicating escaping.
• Add bounded MCP 2026 form-elicitation helpers for Streamable HTTP and direct JSON calls with typed request/response validation and opaque-state replay.
• Validate optional tool-result _meta objects on complete and input_required Streamable HTTP and direct JSON responses.
• Accept unrestricted JSON structuredContent values in standard Streamable HTTP and direct JSON tool results instead of requiring an object envelope.
• Bound buffered Streamable HTTP POST, GET, DELETE, and listener setup response bodies to a configurable raw-byte limit. Long-lived request-scoped listeners remain incremental while bounding each complete SSE event separately.
• Bound router HTTP-auth issue, challenge, refresh, and revoke operations with one configurable total deadline and a raw-byte response limit before UTF-8 decoding, while preserving shared transport reuse and redacting overflow.
• Add resource-bound MCP OAuth discovery, PKCE authorization-code exchange, refresh, revocation, validated Client ID Metadata Documents, and bounded RFC 7591 dynamic public-client registration for Dart IO consumers.
• Bind pre-registered and dynamically registered MCP OAuth client identities to their exact validated authorization-server issuer before code exchange, refresh, or revocation. Pre-registered public and confidential clients now construct authentication with authorization-server metadata; portable HTTPS Client ID Metadata Document identities continue to use none.
• Add an RFC 8252 native loopback callback listener with ephemeral ports, exact state and redirect validation, bounded stray-request handling, and static redacted browser responses.
• Preserve active Streamable HTTP session and resume-cursor state when a router returns an OAuth insufficient_scope HTTP 403 challenge, while still clearing stale state for HTTP 401 and terminated-session HTTP 404 responses.
• Allow consumers to replace an active MCP client's OAuth grant after a scope challenge, validating resource binding and expiry before retrying on the same Streamable HTTP session.
• Allow consumers to replace a refreshed router HTTP-auth grant in place while preserving active Streamable HTTP session and resume state.
• Use UTF-8 for CRA and SCRAM authentication strings by default while retaining an explicit UTF-16 compatibility mode for legacy peers.

2.2.6

• fixed abort reason to match a value of the listed _abortReasons in the client for local transport
• reduce meta package version meet the flutter stable channel version

2.2.5

• fixed json binary payload serialization and deserialization according to https://wamp-proto.org/wamp_latest_ietf.html#name-binary-support-in-json
• updated dependencies to latest versions
• fix some static analysis issues

2.2.4

• added LocalTransport to make unit testing easier in flutter.
  • fake authentication if no method is passed
  • fake ticket authentication
  • fake CRA authentication
  • fake SCRAM authentication
  • fake cryptosign authentication

2.2.3

• export Authentication message to be able to write custom authentication methods
• add onChallenge event in auth methods to be able to modify the secret during the challenge
• fix bug where websocket transport for web trying to complete a future twice

2.2.2

• fix web transport conditional import to make it wasm for web compatible
• added support for PKCS#8 files

2.2.1

• added ScamAuthentication#clientKey, ScamAuthentication.fromClientKey and a _reuseClientKey option to the constructors to reuse the client key for authentication to save computation time.

2.2.0

• updated min sdk version to 3.4.0
• replaced html by web package
  • support for wasm compilation
  • all features can be used in the browser now. No more Unsupported operation: Uint64 accessor not supported by dart2js.

2.1.0

• @yurii-prykhodko-solid reworked connection recovery with streams, added Client().disconnect()

2.0.5

• @yurii-prykhodko-solid enhanced external logging
• @yurii-prykhodko-solid added shorthand websocket transport factories with serializers

2.0.4

• @cydrickn fixed (#59) that error details should have a dynamic type instead of a type object
• @cydrickn added the field authextra to authentication process

2.0.3

• @KSDaemon added ppt-mode in favor of transparent payload
• prepared connectanum dart for EE2E
• new linter
• fixed unit tests in chrome

BREAKING

• Changed constants and static finals from UPPER_SNAKE_CASE to lowerCamelCase

2.0.2

• added CBOR serializer

2.0.1

• fix args and kwargs typing

2.0.0

• do not reconnect if the server will loop with the same error
• added argon2 support (#7)
• sound null safety support
• update all dependencies to their latest version
• fixes #3 fixed test vector

1.1.8

• fixed cra saltless authentication

1.1.7

• added auth role to session on create

1.1.6

• fix auth extra type
• fix fire reconnect event on unintended connection lost

1.1.5

• support dynamic realm and authextra creation

1.1.4

• changed arguments and argumentsKeyword signature to make subtype access easier.

1.1.3

• completed payload transparency
• added json binary strings format, fix #25

1.1.2

• realm may null
• channel binding is just null not 'null'

1.1.1

• fixed cryposign export
• update pinacl deps

1.1.0

• support wamp cryptosign
• support several key loading mechanism
• added support for dynamic reconnect options (!client.connect has an api change)

1.0.13

• add custom subscribe options
• fixed msgpack serialization issue
• some more docs comments

1.0.12

• fixed an issue with the msgpack serializer
• added more unit tests

1.0.11

• added msgpack serializer by @liquidiert

1.0.10

• fix socket transport close throws exception

1.0.9

• fix authenticate serialization

1.0.8

• fixed error when abort is to be sent by the authentication method
• added integration test for wamp scram
• fixed call AbstractAuthentication.hello before sending initial hello
• inline docs for the authentication methods

1.0.7

• make it possible to allow self-signed certificates with socket transport
• update pointy castle dependency to latest version

1.0.6

• #14 add support for event retention
• added some more code comments

1.0.5

• #13 changed meta dependency to match latest flutter dependencies

1.0.4

• added pedantic package
• fixed linting issues
• added public api docs

1.0.3

• #11 fixed a null pointer issue
• added example for error handling

1.0.2

• library is out of beta state
• added subscription revocation

1.0.1-beta.2

• added travis builds
• added code coverage report
• added several unit tests
• fixed scram authentication error when the nonce was null

1.0.1-beta.1

• update version to make this one the latest.

1.0.0-beta.1

• fixed on connection lost and on disconnect events
• fixed goodbye message handling in serializer

1.0.0-dev.10

• found a way to handle disconnects in regular io WebSocket transport

1.0.0-dev.9

• added reconnect and server loss behavior
• client has a close future that may be subscribed to. It's resolved when transport.close() is called
• fixed message length calculation in socket helper

Breaking changes

• client.connect() now returns a stream instead of a future to support reconnect.

1.0.0-dev.8

• added session close
• fixed serializer to handle incoming abort messages and serialize outgoing auth details
• added example code
• fixed publish
• added some missing tests

1.0.0-dev.7

• better stub import for WebSocket transport
• fixed SCRAM authentication

1.0.0-dev.6

• fixed hello.details serialization code
• added error in serializer for incoming messages
• added serializer logging for wrong incoming messages
• more cleanup code to meet pana analysis requirements

1.0.0-dev.5

• more cleanup code to meet pana analysis requirements

1.0.0-dev.4

• more cleanup code to meet pana analysis requirements
• added a working unit test for websocket transport in the vm

1.0.0-dev.3

• more cleanup code to meet pana analysis requirements

1.0.0-dev.2

• cleanup code to meet pana analysis requirements

1.0.0-dev.1

• initial deployment to https://pub.dev