JavaScript SDK 17.5.0

• KSM-901: Added custom server public key support for isolated deployments. Supply the key in any of three ways: the serverPublicKey / serverPublicKeyId options on SecretManagerOptions (the options object passed to getSecrets), the matching serverPublicKey / serverPublicKeyId config fields, or an extended one-time token in the 4-segment format. When a custom key is configured, server-side key rotation hints are suppressed so the SDK stays pinned to the configured key.
• KSM-880: Added automatic throttle retry with exponential backoff. HTTP 403 {"error":"throttled"} responses are retried up to 5 times (11s, 22s, 44s, 88s, 176s ±25% jitter), honoring retry_after when present. A typed KeeperThrottleError is thrown once retries are exhausted. No caller changes required.
• KSM-887: Added secureStorage(dbName) browser storage backend — generates a non-extractable AES-256-GCM CryptoKey stored natively in IndexedDB so KSM credentials are never held in extractable form in browser storage.
• KSM-1010: Added KeeperRecordLink typed accessor class and getLinks() function: exposes permission booleans (isAdminUser, allowsRotation, allowsConnections, etc. with allowedSettings fallback), data accessors (getDecodedData, getDecryptedData, getLinkData), and settings accessors (getAiSettingsData, getJitSettingsData, getMetaData, getSettingsForPath). All accessors are non-throwing. TypeScript port of Python KSM-992.
• KSM-1025: Exported KeeperError base class from keeper.ts. KeeperThrottleError now extends KeeperError (which extends Error); null/undefined config-value guards throw KeeperError instead of plain Error. Existing instanceof Error handling is unaffected. Migration of remaining throw sites to the typed hierarchy is tracked under the KSM-1024 epic.
• KSM-1029: Fixed error propagation for stale pinned server key rejections — the diagnostic message now reaches the caller instead of being swallowed by a bare catch block.
• KSM-984: Fixed webSafe64ToBytes and base64ToBytes (Node and browser) — null/undefined input now throws a typed KeeperError naming the affected field instead of a cryptic native TypeError. Parity with Python KSM-808 and Java KSM-985.
• KSM-758: Replaced deprecated rollup-plugin-sourcemaps@0.6.3 with rollup-plugin-sourcemaps2@0.5.6, resolving peer dependency warnings with Rollup 4.x and a transitive picomatch HIGH vulnerability (dev dependency only; no production impact).
• Security: Bumped rollup dev dependency to ^4.60.1 — fixes HIGH-severity arbitrary file write via path traversal affecting 4.0.0–4.58.0 (dev dependency only; no impact on SDK consumers).

Links:

• npm package
• See JavaScript/TypeScript SDK Documentation