v1.1.0

ThruBox Client 1.1 adds mailbox cursors. Your app can now fetch only the messages it hasn't handled yet, instead of downloading the whole mailbox on every poll. It pairs with ThruBox Server 1.0, which gives every message a sequence number.

The new features are opt-in, and existing code keeps working unless it calls relay.delete(), which is removed in this release (see below).

npm install @aossie-org/thrubox-client@1.1.0

📦 npm: @aossie-org/thrubox-client@1.1.0, published from this release's tag by GitHub Actions with provenance, so you can check which commit and workflow built it.

Highlights

• Cursor reads with receive(address, { after, limit }). Every message now has a seq: its position in the recipient's mailbox (1, 2, 3, …). Pass the highest seq you have handled as after to get only newer messages, and limit to page through large mailboxes. Sequence numbers never go backwards and are never reused, so a cursor can't skip a message. (#63, #64)
• Polling with a cursor via poll(address, callback, { after }). Each poll fetches only new messages. The cursor moves forward only after your callback succeeds. If the callback throws, or its promise rejects, the same messages are delivered again on the next poll, so a failed save is retried instead of lost. Without after, poll() behaves exactly as before. (#63, #64)
• Polls no longer overlap, and polling no longer stops on a callback error. poll() now waits for the callback (including the promise it returns) before scheduling the next poll. A callback that throws is reported to onError, and polling continues. Previously, a synchronous throw silently ended the polling loop. (#63)
• Safe retries. On ThruBox Server 1.0, sending an identical message twice stores it once and returns the existing message. Message IDs are now content hashes instead of UUIDs; treat them as opaque strings. (#63)
• Fixed the build toolchain. npm ci was failing on main after recent dev-dependency bumps. TypeScript is pinned to 5.9 (TypeScript 7 isn't supported by typescript-eslint yet), and vitest is aligned with its coverage plugin at 5.0.5. (#63)
• Removed relay.delete(). It called an endpoint that ThruBox Server 1.0 no longer has, because it let anyone delete anyone's messages. See below. (#65)

How cursor polling works

Example

import { RelayClient } from '@aossie-org/thrubox-client';

const relay = new RelayClient('https://relay.example.com');

// Resume from where this device left off (persist the cursor yourself).
const stop = relay.poll(myAddress, async (messages) => {
  for (const m of messages) await saveLocally(m); // throw to retry
  if (messages.length) saveCursor(messages[messages.length - 1].seq);
}, { after: loadCursor() ?? 0, intervalMs: 10_000 });

Compatibility

	ThruBox Server 1.0+	Older servers
Existing code (no after)	✅ unchanged	✅ unchanged
receive(..., { after, limit })	✅	⚠️ parameters ignored; whole mailbox returned
poll(..., { after })	✅ only new messages	⚠️ seq is missing, so the cursor never advances; every poll returns the whole mailbox, as before

Typing changes: Message.seq?: number and a new exported ReceiveOptions type are added, and delete() is removed from RelayClient.

⚠️ Removed: relay.delete()

ThruBox Server 1.0 has no delete endpoint. It was removed because it did not check who was asking, so anyone could delete anyone's messages. Messages now leave the relay only by expiring, so RelayClient.delete() is gone (#65). If you called it, remove the call. No known app uses it; Chainvoice never has.

Resources

• README: API reference
• ThruBox Server 1.0 release
• Questions: the Discord, #thrubox channel

What's Changed

• ci: migrate npm publish to Trusted Publishing (OIDC) by @Atharva0506 in #28
• docs: fix package name in README by @Atharva0506 in #30
• docs: add repository guidelines and documentation by @Atharva0506 in #31
• feat: add unit tests for RelayClient by @Atharva0506 in #8
• chore(deps)(deps): bump actions/upload-artifact from 4.6.2 to 7.0.1 by @dependabot[bot] in #35
• chore(deps)(deps): bump actions/stale from 10 to 11 by @dependabot[bot] in #34
• chore(deps)(deps): bump actions/setup-node from 4.4.0 to 7.0.0 by @dependabot[bot] in #33
• chore(deps)(deps): bump actions/download-artifact from 4.3.0 to 8.0.1 by @dependabot[bot] in #32
• chore(deps)(deps): bump actions/setup-java from 5 to 6 by @dependabot[bot] in #36
• chore(deps)(deps-dev): bump @vitest/coverage-v8 from 3.2.7 to 5.0.0 by @dependabot[bot] in #38
• chore(deps)(deps): bump step-security/harden-runner from 2.20.0 to 2.21.1 by @dependabot[bot] in #39
• chore(deps)(deps-dev): bump eslint from 10.7.0 to 10.9.1 by @dependabot[bot] in #40
• chore(deps)(deps-dev): bump typescript-eslint from 8.64.0 to 8.69.0 by @dependabot[bot] in #42
• chore(deps)(deps-dev): bump typescript from 5.9.3 to 7.0.2 by @dependabot[bot] in #43
• chore(deps)(deps-dev): bump prettier from 3.9.5 to 3.9.9 by @dependabot[bot] in #45
• chore(deps)(deps-dev): bump eslint from 10.9.1 to 10.11.0 by @dependabot[bot] in #46
• chore(deps)(deps-dev): bump typescript-eslint from 8.69.0 to 8.71.0 by @dependabot[bot] in #49
• Add security-review and security-remediation skills by @Atharva0506 in #44
• chore(deps)(deps): bump actions/upload-artifact from 7.0.1 to 7.0.2 by @dependabot[bot] in #52
• chore(deps)(deps): bump actions/download-artifact from 8.0.1 to 8.0.2 by @dependabot[bot] in #53
• chore(deps)(deps): bump actions/setup-node from 7.0.0 to 7.1.0 by @dependabot[bot] in #54
• chore(deps)(deps): bump step-security/harden-runner from 2.21.1 to 2.22.1 by @dependabot[bot] in #55
• chore(deps)(deps): bump ossf/scorecard-action from 2.4.3 to 2.5.0 by @dependabot[bot] in #62
• Support mailbox cursors and fix the release pipeline by @Atharva0506 in #63
• Remove RelayClient.delete() and release 1.1.0 by @Atharva0506 in #65

Full Changelog: v1.0.2...v1.1.0

v1.0.2

Release v1.0.2

This release was automatically created when the VERSION file was updated.

v1.0.0

What's Changed

🔧 Configuration

• chore: remove coderabbit approval workflow @Atharva0506 (#18)
• chore: commit package-lock.json to fix CI @Atharva0506 (#17)

🚀 CI/CD

• chore: remove coderabbit approval workflow @Atharva0506 (#18)

👥 Contributors

• chore: remove coderabbit approval workflow @Atharva0506 (#18)
• chore: commit package-lock.json to fix CI @Atharva0506 (#17)

Contributors

@Atharva0506

Full Changelog: v1.0.0...v1.0.1