Add authenticated protocol 2 and TypeScript WASM client

README.md

@@ -1,11 +1,10 @@
 # Kiloparsec
 
-> 0.7.0-SNAPSHOT is recommended for newer builds; due to extremely poor Kotlin time migration architecture, on Apple targets it is the only working version.
-
-
-__Recommended version is `0.6.8`: to keep the code compatible with current and further versions we
-ask to upgrade to `0.4.2` at least.__ Starting from this version some package names are changed for
-better clarity and fast UDP endpoints are added.
+The Kotlin implementation and the native [TypeScript + WASM client](typescript/README.md)
+are maintained here together. Current source version **0.8.0-SNAPSHOT** uses
+**protocol 2**, which authenticates RPC correlation metadata inside encrypted
+packets. Both peers must be upgraded together; protocol 1 peers are rejected with
+no automatic downgrade. See [the security analysis](typescript/docs/SECURITY.md).
 
 The new generation of __PARanoid SECurity__ protocol, advanced, faster, more secure. It also allows connecting any "
 block device" transport to the same local interface. Out if the box it
@@ -22,20 +21,16 @@ provides the following transports:
 
 ### Note on version compatibility
 
-We recommend using `0.6.12`
-
-Since version 0.6.9 websocket protocol supports both text and binary frames; old clients are backward compatible with
-mew servers, but new clients only can work with older servers only in default binary frame mode. Upgrade also your
-servers to get better websocket compatibility[^1].
-
-Version 0.5.1 could be backward incompatible due to the upgrade of the crypto2.
-
-Protocols >= 0.3.0 are not binary compatible with the previous version due to a more compact binary
-format. The format from 0.3.0 onwards is supposed to keep compatible.
+Version 0.8.0 introduces an intentional wire break to close the response
+correlation vulnerability. Earlier 0.3–0.7 versions share the old envelope and
+must not be assumed compatible with current source. Application command schemas
+and the Kotlin interface/session programming model remain unchanged.
 
 #### ID calculation algorithm is changed since 0.4.1
 
-We recommend to upgrade to 0.4+ ASAP as public/shared key id derivation method was changed for even higher security.
+Historical note: 0.4.1 changed public/shared key ID derivation. Current deployments
+should target protocol 2; upgrading only to an older 0.4 release does not fix the
+authenticated correlation issue.
 
 ### Supported native targets
 
@@ -350,3 +345,18 @@ output and the registry rather than assuming a target was skipped.
 `bin/pubdocs` generates Dokka and uploads it to the existing Kiloparsec documentation
 site. For development-only Maven Local publication without configuring the remote
 repository, pass `-PlocalPublishingOnly=true`.
+
+## Verify Kotlin and TypeScript together
+
+Requires JDK 21, Node.js 22+, and the Android SDK configuration used by this
+multiplatform build. Install the module's pinned npm dependencies once:
+
+```sh
+npm ci --prefix typescript --ignore-scripts
+bin/test-all.sh
+```
+
+The script runs JVM and Kotlin/JS Node tests, TypeScript unit tests, then cross-language tests against
+a disposable localhost JVM server built from this checkout. It does not publish
+or contact deployment hosts. Additional Gradle options can be passed to the script.
+For TypeScript-only commands and examples, see [the module README](typescript/README.md).