Fixes
- Fix multi-generation E2EE login key selection (#229): match keyId, validate pairs, preserve historical keys, and verify against the server only after authentication. Explicit mismatch does not trigger automatic key replacement.
- Apply BaseClient.config.timeout to Node RPC and HTTP/2 PUSH TCP/TLS connections (#230), preserving custom fetch and avoiding global dispatcher changes.
- Forward cancellation through encrypted LEGY requests (#231); handle PUSH connect failures without unhandled rejections (#232).
- Retrieve/cache the group shared-key generation requested by each message (#233).
- Correct isEdited for messages fetched from history (#228).
- Report failed OBS downloads as HTTP-status ObsError before decryption/JSON parsing (#234).
- Harden APK schema extraction gates and reproducible Thrift generation, including Windows newline handling (#235).
Upgrade notes
If your existing E2EE storage was written with the wrong key pair, perform a new QR/password login after upgrading to transfer the correct keychain. Do not clear all storage or manually register new E2EE keys. Auth-token-only login cannot recover missing private keys.
Low-level decryptKeyChain callers must supply keyId for multi-entry chains; ambiguous selection now fails safely. verifyStoredKeyAgainstServer returns true only for an actual match; unavailable checks are not positive verification.
#211 still needs confirmation on the affected account; #198 (1:1 call T103) is not resolved by this release.
Verification
296 Deno tests passed, 2 real Node transport regressions passed, and PR CI / JSR dry-runs passed. No affected-user credentials or real account key material were used.
