utd_signaling 0.3.0

The UTD domain layer over utd_channels: presence, 1:1 call invitations, chat messaging + groups, typing, push-token registration and media-upload presign for Flutter, plus Pusher-style channels mounte [...]

0.3.0

Security hardening (from a full audit). No public symbol removed; behavior is stricter where it protects credentials and stability.

• Transport encryption is now enforced, not assumed. The socket refuses to dial a non-wss:// URL and every credential-bearing REST/mint/channel-auth call refuses a non-https:// host (loopback exempt for local dev). Opt out deliberately with UTDTransportSecurity.allowInsecure = true. Requires utd_channels 0.2.0.
• Hostile/malformed server frames can no longer crash the client. All push-frame and model-factory field casts are tolerant (a wrong wire type degrades instead of throwing a TypeError), inbound frames are size-capped, and the signal-client dispatch loop drops anything that still slips through.
• REST path ids are percent-encoded, closing a client-side path/query injection surface on call/conversation/message endpoints.
• insecureDevelopment auth strategies now refuse to run in a release build (override with UTDTransportSecurity.allowInsecure).
• Token expiry now flows through the UTDSignaling path, so the socket proactively re-mints before the session token lapses.
• Media upload PUT now validates the presigned URL scheme and no longer follows redirects.
• Dependency bumps: device_info_plus ^13.0.0, package_info_plus ^10.0.0.
• Monorepo builds now use the in-repo utd_channels via pubspec_overrides.yaml so the core and domain layer never drift.

0.2.1

Repackaging only — no code changes. The 0.2.0 archive accidentally bundled local build/ test artifacts (a .pubignore replaces .gitignore for pub's file selection, and ours omitted the build exclusions); prefer 0.2.1 and treat 0.2.0 as retracted.

0.2.0

Re-architecture: utd_signaling is now the UTD domain layer over the new utd_channels core (the generic Pusher-style realtime SDK). Byte-compatible: every 0.1.x public symbol keeps its name, kind, and signature — utd_calls_kit compiles unchanged.

• UTDSignalClient is now an adapter that owns a core UTDSocket: the connection lifecycle, request/ack correlation, and reconnection live in the core; the legacy call.*/message.*/conversation.*/typing/presence.* vocabulary, all typed streams, and every request method are unchanged. Additive: UTDSignalClient.socket exposes the underlying core socket so channels can be mounted on the SAME connection (UTDChannelsClient.overSocket(client.socket)).
• UTDConnectionState, UTDForceExitReason, UTDStreamException, UTDErrorCode, UTDBannedException, UTDRateLimitedException, and UTDTokenException moved wholesale into utd_channels and are re-exported — the same type identities flow everywhere; no duplicate definitions remain.
• New UTDApi.mintSessionV2 returns the growable UTDSessionInfo class (userToken, wsUrl, signalingEnabled, chatEnabled, channelsEnabled — the new channels_enabled mint field — and limits). mintSession and its frozen record shape are unchanged.
• UTDSignaling facade: new optional channelAuth constructor parameter and a lazily-created channels getter (UTDChannelsClient mounted over the shared socket) for Pusher-style public/private-/presence- channels.
• REST error mapping is machine-code first: when an engine error body carries a stable code string it decides the exception type (banned → UTDBannedException, rate_limited/takeover_cooldown → UTDRateLimitedException, the rest via utdErrorCodeFromMachine); the 0.1.x English-message sniffing survives verbatim as the fallback for older engines.
• The whole utd_channels surface is re-exported from the barrel, so channel types are usable without a second import.
• Drop-time connectionState parity: the core socket's richer reconnecting state is mapped back to disconnected on the legacy UTDSignalClient.connectionState / UTDSignaling.connectionState notifier, so an unexpected drop still reads connected → disconnected → connecting → connected exactly as 0.1.x did (locked by a compat test). Observe the richer states (reconnecting included) on signal.socket.states.
• isSignalingDisabled / isChatDisabled moved off the core UTDStreamException onto a compat extension in this package (UTDCapabilityGateCompat): per protocol §7 the core branches only on machine codes, while English-message capability sniffing lives solely in this compat layer. Call sites (e.isSignalingDisabled) resolve unchanged through the barrel.
• WS error frames whose data.code is the engine's NUMERIC ack-style code now map through the ack registry (pre-auth takeover/rate-limit/auth errors type as such) instead of collapsing to unknown; the data.error registry string newer engines emit alongside it is honored first.

Depends on the published utd_channels ^0.1.0 (hosted).

0.1.1

Capability surfacing on the session mint (additive, non-breaking).

• The session mint (POST /api/v1/auth/session) now parses the two independent, separately-billed capability flags and the plan limits when the engine surfaces them:
  • UTDTokenResponse.signalingEnabled / .chatEnabled — nullable bools; null when the engine omits them (older engine → "unknown, let the server decide"), distinct from an explicit false.
  • New UTDPlanLimits model (historyDays, maxGroupMembers, maxFriends, maxChatrooms) parsed defensively from the limits object; every field is nullable and tolerates missing/varying wire types. Exported via models.
• UTDApi.mintSession() now returns those flags + limits on its result record (additive named fields — the leading userToken/wsUrl are unchanged, so existing callers keep working).
• UTDSignaling exposes signalingEnabled / chatEnabled / planLimits getters (captured on every (re)connect) so app code can pre-check a capability before starting a call or enforce plan caps for UX.
• Error handling for a paid-capability gate: a non-ban 403 whose message says a capability is "not enabled/available/disabled" is mapped to the new UTDErrorCode.featureDisabled, surfaced via UTDStreamException.isFeatureDisabled (+ isSignalingDisabled / isChatDisabled). isForbidden still returns true for it, so existing "not activated" handling is unchanged — callers can now branch to show an upsell instead of a raw failure.
• New parsing helper boolOrNull (internal).

Billing model: signaling (call invitation + presence + rooms/broadcast, gated by the engine signaling_enabled) and chat (persistent messaging + history + receipts, gated by messaging_enabled) are two separate paid capabilities, each sold via a subscription plan (Free / Signaling / Pro / Enterprise) with per-plan limits. Billing is MAU-based — there is no per-message charge.

0.1.0

• Initial extraction of the shared signalling plane from the kits: REST client, signalling WebSocket, device id/facts, connection lifecycle, uploads, push-token API, and the shared wire models. No media, no UI, no local storage.