Changelog

Every SDK release, newest first, with what changed and why. One version number covers the git tag, the npm package, the crates, the PyPI package, and the Swift and Android packages. The full notes, with the reasoning attached, live in the repository.

Full release notes Upgrading guide Roadmap
Current SDK v0.28.0 October 6, 2026 npm crates.io PyPI GitHub releases
  1. SDK v0.28.0

    The SDK ships outside React Native, and the phone peer stream carries traffic

    A release now publishes Python wheels to PyPI, a Swift package, and an Android library, the last two built from the same bridge sources as the React Native module. The Swift and Android packages are early: their public API is not settled yet, and the Android library is a download from the GitHub release, not Maven Central. On phones the peer stream now carries traffic: Android can form its own Wi-Fi Direct group with no system dialog, and iOS runs the slot on Network framework instead of MultipeerConnectivity.

    • pip install offline-protocol-sdk, for Python 3.10 to 3.13, with wheels for macOS arm64, Linux x86_64 and aarch64 (glibc 2.34+), and Windows x86_64.
    • A Python host can run one engine for several local applications through the local API, JSON-RPC 2.0 over a WebSocket. Built-in file stores, sealed under a store key, serve hosts with no platform keystore.
    • Custody, off by default: a device can hold a neighbour's replication frames for hours (6 by default) and hand them on when the recipient appears.
    • The leaf compiles for ESP32 RISC-V parts (C6, H2, C3, C2), Cortex-M0, and WASI, gated in CI. That is a compile result only: nothing has been linked into a firmware image or run on a board for these targets yet.
    • A send can name the application it is for, and received events carry that app id. Bluetooth LE peers find each other in crowded rooms, and links recover after an iPhone's Bluetooth power-cycle and, on Android, after a toggle or a stack crash.
    • Breaking: an iPhone on 0.28 does not see one on 0.27 or earlier over the peer stream; Python InternetManager requires app_id; SecurityWarningCode gains KEY_PACKAGE_OUTSIDE_VALIDITY_WINDOW. Deduplication now keeps 5,000 ids for 7 days.
  2. SDK v0.27.0

    Replicated documents can be removed and narrowed, and a Python host joins the mesh

    Documents can now be removed from every replica, a space can replicate only the documents an app is interested in, and attachment bytes move inside a group. The peer-stream transport is registered on every binding, so a Python host can reach another over a LAN or a routed mesh, and relay group traffic reaches phones again.

    • DataStore.setInterest narrows a space to matching documents; DataStore.fetchAttachmentFrom pulls attachment bytes from a peer.
    • The peer-stream transport is registered on iOS, Android, Python, and Rust, with a Python Bluetooth LE peripheral a phone can verify.
    • Relay group notifications reach iOS and Android members again; a broadcast through the relay reaches a Python member.
    • A message evicted from a full outbox stays failed and is settled once; a send every carrier refused as unreachable says so.
    • WIFI_DIRECT_MAX_PAYLOAD_SIZE is removed from the transport crate; the telemetry pipe caps message.failed rows per reason.
  3. SDK v0.26.0

    The SDK ships its own telemetry, and delivery state survives a restart

    Telemetry moves into the core. Enable it with a key from the developer portal and the SDK collects, folds, queues, and uploads accepted events on its own background thread, to one endpoint fixed at build time, over TLS with a bundled root set. The sink API is gone. Frames waiting on a slow handshake and the set of message ids already seen are now persisted and sealed like the outbox.

    • enableTelemetry, disableTelemetry, flushTelemetry, telemetryStats, and endTelemetrySession on every binding; installTelemetrySink and onTelemetry are removed.
    • The pending-decryption queue and the deduplicator's seen set are written to protocol-state storage and restored on launch.
    • pendingQueue.pendingTtlMs defaults to 24 hours, was 30 minutes. reliability.dedup defaults to 2,000 ids over 24 hours, was 1,000 over 1 hour.
    • A new offline-protocol-telemetry-wire crate pins the batch envelope byte for byte; twelve crates on crates.io.
    • ADR 0024 records why the SDK ships its own TLS stack for telemetry. The threat model gains a network-egress section.
  4. SDK v0.25.0

    Reticulum speaks the gateway contract, and the wire spec can be implemented from the text

    Both mobile managers now complete the gateway-contract attach handshake, sends settle on the gateway's verdict rather than on the socket write, and an unreachable recipient parks the message and offers it to the mesh. Before this release a device on Reticulum could not receive anything.

    • Reticulum attach: Identify, Challenge, DeclareAddress, AddressDeclared, Capabilities, then the carrier announced; two new security warning codes for a refused or mismatched declaration.
    • RetryConfig.edgeDrivenUnreachableDm, opt-in, bounds probing of a durably unreachable direct message to reachability edges.
    • Python internet send loop is activity-adaptive: a warm round trip drops from about 100 ms to single-digit milliseconds.
    • iOS state restoration no longer chases peripherals whose owners are gone; BLE re-discovery no longer repeats subscription and handshake work.
    • Wire specification gains a normative primitive-encoding table and seven conformance vector files generated by an independent second implementation.
  5. SDK v0.24.1

    iOS React Native bridge corrected

    Eight methods that were unreachable from the iOS bridge since 0.21 and 0.22, including wipePersistedState and the relay configuration, now reach the core; seven methods that read the wrong argument slots are fixed, so every iOS message no longer defaults to medium priority and presence no longer defaults to online.

    • Fifteen trapping conversions in the iOS bridge replaced with checked ones.
    • No wire, configuration, or Android change.
  6. SDK v0.24.0

    A constrained device as a real peer

    The leaf profile ships: a no_std Rust crate that lets a lock, a sensor, or a relay speak the protocol with RFC 9420 MLS as a never-committing member. The shared envelope codec, address derivation, and signing payloads move into a bare-metal crate both ends link.

    • offline-protocol-leaf and offline-protocol-sealed crates; offline-protocol-core compiles without std.
    • Control frames are signed under offline-ctrl-v2 with the timestamp inside the signature, a freshness window, and a downgrade ratchet.
    • Key package lifetimes are capped at 90 days on acceptance; rekeySession gives applications post-compromise security on demand.
    • npm releases published with trusted publishing and provenance.
  7. SDK v0.23.0

    Edge sync: replicated documents

    Offline-first shared state: map, list, text, and counter documents that any member of a space edits while disconnected and that merge deterministically when replicas meet, exchanged as compact deltas inside MLS-scoped spaces, on a swappable storage adapter.

    • DataStore on React Native, iOS, Android, Python, and Rust, enabled by default.
    • Attachments by reference with pairwise fetch and hash verification; group replication.
    • Gateway contract v1 specified: attach, submit, verdict, presence, capabilities.
  8. SDK v0.22.0

    Battery-aware relaying and an observed relay role

    Relay standing is now observed from traffic actually forwarded rather than predicted from thresholds, forwarding effort scales with charge, and applications can feed battery state to the core.

    • setBatteryState, RelayPriority never/auto/always, and tunable mesh relay budgets with stats.
    • Username discovery and invite blobs, both default-off.
    • Documentation restructured into a protocol specification, threat model, state machines, and architecture decision records.
  9. SDK v0.21.0

    Self-certifying addresses and multi-hop forwarding

    Identity becomes an address derived from the device's Ed25519 key, so a peer proves its address by presenting the key and there is nothing to pin or look up. Unsigned control frames are refused, and messages relay across the mesh hop by hop under a forwarding governor.

    • ProtocolConfig.userId is replaced by profile; recipients are off1 addresses.
    • Trust-on-first-use pinning removed in favour of address-from-key verification.
    • Crates published to crates.io in lockstep with the npm package.
  10. Baseline

    Current production platform

    The capabilities live in the SDK today, on a network that has reached 350,000+ devices. This entry establishes the release log; subsequent changes are recorded above it as they ship.

    • DORS multi-transport routing with automatic failover, multi-hop relay, retry, and deduplication.
    • OfflineID: Ed25519 device-owned identity, verifiable device-to-device with zero connectivity.
    • Service discovery: advertise, discover, and invoke capabilities across the mesh with no server or DNS.
    • MLS (RFC 9420) end-to-end encryption on every session by default.
    • Chunked, resumable file transfer up to 100 MB between authenticated peers.
    • Opt-in telemetry: one in-process stream of protocol events, transport transitions, routing decisions, and MLS lifecycle, emitted only after your app installs a sink, with identifiers scrubbed by default.
    • One SDK surface: a TypeScript API over a shared Rust core, identical on iOS and Android.

Build on what shipped. One install, iOS and Android.

Start building See the roadmap