@agentunion/fastaun-browser 0.4.9 → 0.4.11

package/dist/bundle.js

@@ -454,7 +454,7 @@ var init_indexeddb_store = __esm({
 });
 
 // src/version.ts
-var VERSION = "0.4.9";
+var VERSION = "0.4.11";
 
 // src/types.ts
 var ConnectionState = /* @__PURE__ */ ((ConnectionState2) => {
@@ -1236,6 +1236,7 @@ var EVENT_NAME_MAP = {
   "message.ack": "message.ack",
   "group.changed": "group.changed",
   "group.message_created": "group.message_created",
+  "group.message_recalled": "group.message_recalled",
   "group.state_committed": "group.state_committed",
   "storage.object_changed": "storage.object_changed"
 };
@@ -1579,6 +1580,34 @@ var RPCTransport = class {
       this._drainRpcQueue();
     });
   }
+  /** 发送 JSON-RPC 2.0 Notification，不分配 id，也不等待响应。 */
+  async notify(method, params) {
+    if (this._closed || !this._ws) {
+      throw this._notConnectedError();
+    }
+    const normalizedMethod = String(method ?? "").trim();
+    if (!normalizedMethod.startsWith("notification/") && !normalizedMethod.startsWith("event/")) {
+      throw new ValidationError("notify method must start with notification/ or event/");
+    }
+    if (params !== void 0 && params !== null && !isJsonObject(params)) {
+      throw new ValidationError("notify params must be an object");
+    }
+    const payload = JSON.stringify({
+      jsonrpc: "2.0",
+      method: normalizedMethod,
+      params: params ?? {}
+    });
+    const payloadSize = new TextEncoder().encode(payload).length;
+    if (payloadSize > MAX_WS_PAYLOAD_SIZE) {
+      throw new ValidationError("payload is too large");
+    }
+    try {
+      this._ws.send(payload);
+      this._log.debug(`notification sent: method=${normalizedMethod}, size=${payloadSize}`);
+    } catch (err) {
+      throw new ConnectionError(`failed to send notification ${normalizedMethod}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
   /** 从 pending / queue 中移除指定 RPC */
   _removeRpc(rpcId, pending) {
     const current = this._pending.get(rpcId);
@@ -1747,6 +1776,10 @@ var RPCTransport = class {
           this._log.info(`[trace=${String(traceObj.trace_id ?? "")}] event_recv event=${sdkEvent}`);
         }
       }
+      if (sdkEvent.startsWith("app.")) {
+        this._dispatcher.publish(sdkEvent, params);
+        return;
+      }
       this._dispatcher.publish(`_raw.${sdkEvent}`, params);
       return;
     }
@@ -3676,6 +3709,7 @@ var ClientRuntime = class {
 // src/client/delivery.ts
 var PUSHED_SEQS_LIMIT = 5e4;
 var PENDING_ORDERED_LIMIT = 5e4;
+var GROUP_RECALL_SEEN_LIMIT = 1e4;
 function formatDeliveryError(error) {
   return error instanceof Error ? error : String(error);
 }
@@ -3719,8 +3753,31 @@ var MessageDeliveryEngine = class {
       for (const oldSeq of drop) queue.delete(oldSeq);
     }
   }
+  isGroupEventNamespace(ns) {
+    return ns.startsWith("group_event:");
+  }
+  async publishOrderedQueueItem(ns, event, seq, payload) {
+    const client = this.runtime.client;
+    if (event === "group.changed" && this.isGroupEventNamespace(ns)) {
+      await this.publishOrderedGroupChanged(payload);
+      return;
+    }
+    await client._publishAppEvent(event, payload);
+  }
+  async publishOrderedGroupChanged(payload) {
+    const client = this.runtime.client;
+    if (isJsonObject(payload)) {
+      const eventPayload = payload;
+      client._groupState?.handleGroupChangedV2Membership?.(eventPayload);
+      if (eventPayload.action === "dissolved") {
+        const groupId = normalizeGroupId(String(eventPayload.group_id ?? "")) || String(eventPayload.group_id ?? "").trim();
+        if (groupId) client._cleanupDissolvedGroup?.(groupId);
+      }
+    }
+    await client._publishAppEvent("group.changed", payload);
+  }
   isInstanceScopedMessageEvent(event) {
-    return event === "message.received" || event === "message.recalled" || event === "message.undecryptable" || event === "group.message_created" || event === "group.message_undecryptable";
+    return event === "message.received" || event === "message.recalled" || event === "message.undecryptable" || event === "group.message_created" || event === "group.message_recalled" || event === "group.message_undecryptable";
   }
   attachCurrentInstanceContext(payload) {
     if (!isJsonObject(payload)) return payload;
@@ -3784,6 +3841,121 @@ var MessageDeliveryEngine = class {
     if (recall) return { event: "message.recalled", payload: recall };
     return { event: "message.received", payload: message };
   }
+  recallEventFromGroupMessage(message) {
+    if (!isJsonObject(message)) return null;
+    const msg = message;
+    const rawPayload = msg.payload;
+    const payload = isJsonObject(rawPayload) ? rawPayload : {};
+    const msgType = String(msg.type ?? msg.kind ?? msg.message_type ?? "").trim();
+    const payloadType = String(payload.type ?? payload.kind ?? "").trim();
+    if (msgType !== "group.message_recalled" && payloadType !== "group.message_recalled") return null;
+    const event = { ...payload };
+    const rawIds = event.message_ids;
+    let messageIds = Array.isArray(rawIds) ? rawIds.map((item) => String(item ?? "").trim()).filter(Boolean) : [];
+    if (messageIds.length === 0) {
+      for (const key of ["recalled_message_id", "target_message_id", "original_message_id"]) {
+        const value = String(event[key] ?? "").trim();
+        if (value) {
+          messageIds = [value];
+          break;
+        }
+      }
+    }
+    event.type = "group.message_recalled";
+    event.kind = "group.message_recalled";
+    event.message_ids = messageIds;
+    if (!("group_id" in event)) event.group_id = msg.group_id ?? "";
+    if (!("timestamp" in event)) event.timestamp = msg.timestamp ?? msg.t_server ?? event.recalled_at ?? 0;
+    if ("seq" in msg) event.seq = msg.seq;
+    if ("message_id" in msg && !("tombstone_message_id" in event)) event.tombstone_message_id = msg.message_id;
+    return event;
+  }
+  groupRecallDedupKey(groupId, payload) {
+    const ids = payload.message_ids;
+    const idPart = Array.isArray(ids) ? ids.map((i) => String(i ?? "").trim()).filter(Boolean).sort().join(",") : String(ids ?? "");
+    return `${groupId}|${idPart}`;
+  }
+  async publishGroupRecallTombstone(groupId, seq, message) {
+    const client = this.runtime.client;
+    const eventPayload = this.recallEventFromGroupMessage(message);
+    if (!eventPayload) return false;
+    const dedupKey = this.groupRecallDedupKey(groupId, eventPayload);
+    let seen = client._groupRecallSeen;
+    if (!seen) {
+      seen = /* @__PURE__ */ new Map();
+      client._groupRecallSeen = seen;
+    }
+    if (seen.has(dedupKey)) {
+      client._clientLog.debug(`group.message_recalled dedup suppressed: group=${groupId} seq=${String(seq)} key=${dedupKey}`);
+      return false;
+    }
+    seen.set(dedupKey, Date.now());
+    if (seen.size > GROUP_RECALL_SEEN_LIMIT) {
+      const drop = [...seen.entries()].sort((a, b) => a[1] - b[1]).slice(0, seen.size - GROUP_RECALL_SEEN_LIMIT);
+      for (const [oldKey] of drop) seen.delete(oldKey);
+    }
+    await client._publishAppEvent("group.message_recalled", eventPayload);
+    client._clientLog.debug(`group.message_recalled published: group=${groupId} seq=${String(seq)} ids=${JSON.stringify(eventPayload.message_ids)}`);
+    return true;
+  }
+  async onRawGroupMessageRecalled(data) {
+    const client = this.runtime.client;
+    if (!isJsonObject(data)) return;
+    const src = data;
+    const groupId = String(src.group_id ?? "").trim();
+    const wrapped = { ...src };
+    if (!("type" in wrapped)) wrapped.type = "group.message_recalled";
+    if (!("payload" in wrapped)) {
+      wrapped.payload = {
+        type: "group.message_recalled",
+        message_ids: src.message_ids ?? [],
+        target_message_seqs: src.target_message_seqs ?? [],
+        sender_aid: src.sender_aid ?? "",
+        recalled_by: src.recalled_by ?? "",
+        recalled_at: src.recalled_at ?? src.timestamp ?? 0,
+        reason: src.reason ?? "",
+        group_id: groupId
+      };
+    }
+    const seq = src.seq;
+    const seqNum = Number(seq);
+    if (!groupId || seq === void 0 || seq === null || !Number.isFinite(seqNum) || !Number.isInteger(seqNum)) {
+      await this.publishGroupRecallTombstone(groupId, seq, wrapped);
+      return;
+    }
+    const ns = `group:${groupId}`;
+    if (seqNum > 0) {
+      client._seqTracker.updateMaxSeen(ns, seqNum);
+      if (client._seqTracker.getContiguousSeq(ns) === seqNum) {
+        await this.publishGroupRecallTombstone(groupId, seq, wrapped);
+        return;
+      }
+      client._repairPushContiguousBound(ns, seqNum, true, "_raw.group.message_recalled");
+    }
+    const pushed = client._pushedSeqs.get(ns);
+    const pending = client._pendingOrderedMsgs.get(ns);
+    if (pushed?.has(seqNum) || pending?.has(seqNum)) {
+      await this.publishGroupRecallTombstone(groupId, seq, wrapped);
+      return;
+    }
+    const contigBefore = client._seqTracker.getContiguousSeq(ns);
+    client._seqTracker.onMessageSeq(ns, seqNum);
+    await this.publishGroupRecallTombstone(groupId, seq, wrapped);
+    this.markPublishedSeq(ns, seqNum);
+    const contig = client._seqTracker.getContiguousSeq(ns);
+    if (contig > 0) {
+      const ackSeq = this.clampAckSeq("group.ack_messages", "msg_seq", ns, contig);
+      client._transport.call("group.ack_messages", {
+        group_id: groupId,
+        msg_seq: ackSeq,
+        device_id: client._deviceId,
+        slot_id: client._slotId
+      }).catch((e) => {
+        client._clientLog.warn("group recall auto-ack failed: group=" + groupId, e);
+      });
+    }
+    if (contig !== contigBefore) this.saveSeqTrackerState();
+  }
   async publishAppEvent(event, payload) {
     const client = this.runtime.client;
     if ((event === "message.received" || event === "group.message_created") && isJsonObject(payload)) {
@@ -3920,6 +4092,25 @@ var MessageDeliveryEngine = class {
         if (seq > 0) client._seqTracker.updateMaxSeen(ns, seq);
         const contigBefore = client._seqTracker.getContiguousSeq(ns);
         const seqNeedsPull = client._seqTracker.onMessageSeq(ns, seq);
+        if (!encryptedPush && this.recallEventFromGroupMessage(msg)) {
+          await this.publishGroupRecallTombstone(groupId, seq, msg);
+          this.markPublishedSeq(ns, Number(seq));
+          const contigAfter2 = client._seqTracker.getContiguousSeq(ns);
+          const contig2 = client._seqTracker.getContiguousSeq(ns);
+          if (contig2 > 0) {
+            const ackSeq = this.clampAckSeq("group.ack_messages", "msg_seq", ns, contig2);
+            client._transport.call("group.ack_messages", {
+              group_id: groupId,
+              msg_seq: ackSeq,
+              device_id: client._deviceId,
+              slot_id: client._slotId
+            }).catch((e) => {
+              client._clientLog.warn("group recall auto-ack failed: group=" + groupId, e);
+            });
+          }
+          if (contigAfter2 !== contigBefore) this.saveSeqTrackerState();
+          return;
+        }
         const published = encryptedPush ? await client._publishEncryptedPushMessage("group.message_created", "group.message_undecryptable", ns, seq, msg, true) : await this.publishOrderedMessage("group.message_created", ns, seq, msg);
         const contigAfter = client._seqTracker.getContiguousSeq(ns);
         const needPull = seqNeedsPull && !published;
@@ -3994,6 +4185,11 @@ var MessageDeliveryEngine = class {
               if (pushed && s !== void 0 && s !== null && pushed.has(s)) {
                 continue;
               }
+              if (s !== void 0 && s !== null && this.recallEventFromGroupMessage(msg)) {
+                await this.publishGroupRecallTombstone(groupId, s, msg);
+                this.markPublishedSeq(ns, Number(s));
+                continue;
+              }
               if (s !== void 0 && s !== null) {
                 await client._publishPulledMessage("group.message_created", ns, s, msg);
               } else {
@@ -4100,10 +4296,12 @@ var MessageDeliveryEngine = class {
           }
         }
         const eventSeqs = [];
+        let hasDissolvedEvent = false;
         for (const evt of eventObjects) {
           const eventSeq = Number(evt.event_seq ?? 0);
           if (Number.isFinite(eventSeq) && eventSeq > 0) eventSeqs.push(eventSeq);
           evt._from_gap_fill = true;
+          if (evt.action === "dissolved") hasDissolvedEvent = true;
           const et = String(evt.event_type ?? "");
           if (et === "group.message_created") continue;
           const cs = evt.client_signature;
@@ -4111,17 +4309,21 @@ var MessageDeliveryEngine = class {
             if (client._shouldSkipEventSignature(evt)) {
               delete evt.client_signature;
             } else {
-              evt._verified = await client._verifyEventSignature(evt, cs);
+              const verified = await client._verifyEventSignature(evt, cs);
+              evt._verified = client._isEventSignatureVerified(verified);
             }
           }
-          await client._dispatcher.publish("group.changed", evt);
+          if (Number.isFinite(eventSeq) && eventSeq > 0 && !client._pushedSeqs.get(ns)?.has(eventSeq)) {
+            this.enqueueOrderedMessage(ns, "group.changed", eventSeq, evt);
+          }
         }
-        const contig = client._seqTracker.getContiguousSeq(ns);
-        if (contig !== pageContigBefore) {
+        const ackContig = client._seqTracker.getContiguousSeq(ns);
+        await this.drainOrderedMessages(ns);
+        if (ackContig !== pageContigBefore && !hasDissolvedEvent) {
           this.saveSeqTrackerState();
         }
-        if (eventObjects.length > 0 && contig > 0 && contig !== pageContigBefore) {
-          const ackSeq = this.clampAckSeq("group.ack_events", "event_seq", ns, contig);
+        if (eventObjects.length > 0 && ackContig > 0 && ackContig !== pageContigBefore) {
+          const ackSeq = this.clampAckSeq("group.ack_events", "event_seq", ns, ackContig);
           client._transport.call("group.ack_events", {
             group_id: groupId,
             event_seq: ackSeq,
@@ -4145,15 +4347,36 @@ var MessageDeliveryEngine = class {
       this.runtime.delivery.setGapFillActive(false);
     }
   }
-  handleGroupChangedEventSeq(data, groupId) {
+  async handleGroupChangedEventSeq(data, groupId) {
     const client = this.runtime.client;
     let needPull = false;
     const rawEventSeq = data.event_seq;
-    if (rawEventSeq != null && groupId) {
-      const es = Number(rawEventSeq);
-      if (Number.isFinite(es) && es > 0) {
-        needPull = client._seqTracker.onMessageSeq(`group_event:${groupId}`, es);
-      }
+    const eventSeq = Number(rawEventSeq);
+    if (!groupId || !Number.isFinite(eventSeq) || !Number.isInteger(eventSeq) || eventSeq <= 0) {
+      await this.publishOrderedGroupChanged(data);
+      return;
+    }
+    const ns = `group_event:${groupId}`;
+    const contigBefore = client._seqTracker.getContiguousSeq(ns);
+    if (eventSeq <= contigBefore || client._pushedSeqs.get(ns)?.has(eventSeq)) {
+      client._clientLog.debug(`group.changed skipped duplicate/stale: group=${groupId}, event_seq=${eventSeq}, contiguous=${contigBefore}`);
+      return;
+    }
+    this.enqueueOrderedMessage(ns, "group.changed", eventSeq, data);
+    needPull = client._seqTracker.onMessageSeq(ns, eventSeq);
+    const ackContig = client._seqTracker.getContiguousSeq(ns);
+    await this.drainOrderedMessages(ns);
+    if (ackContig > 0 && ackContig !== contigBefore) {
+      if (data.action !== "dissolved") this.saveSeqTrackerState();
+      const ackSeq = this.clampAckSeq("group.ack_events", "event_seq", ns, ackContig);
+      client._transport.call("group.ack_events", {
+        group_id: groupId,
+        event_seq: ackSeq,
+        device_id: client._deviceId,
+        slot_id: client._slotId
+      }).catch((e) => {
+        client._clientLog.warn("group event push auto-ack failed: group=" + groupId, e);
+      });
     }
     if (needPull && groupId && !data._from_gap_fill) {
       client._safeAsync(this.fillGroupEventGap(groupId));
@@ -4577,7 +4800,7 @@ var MessageDeliveryEngine = class {
       const item = queue.get(seq);
       queue.delete(seq);
       if (!item || client._pushedSeqs.get(ns)?.has(seq)) continue;
-      await client._publishAppEvent(item.event, item.payload);
+      await this.publishOrderedQueueItem(ns, item.event, seq, item.payload);
       this.markPublishedSeq(ns, seq);
     }
     if (queue.size === 0) client._pendingOrderedMsgs.delete(ns);
@@ -4586,7 +4809,7 @@ var MessageDeliveryEngine = class {
     const client = this.runtime.client;
     const seqNum = Number(seq);
     if (!Number.isFinite(seqNum) || !Number.isInteger(seqNum) || seqNum <= 0) {
-      await client._publishAppEvent(event, payload);
+      await this.publishOrderedQueueItem(ns, event, seqNum, payload);
       return true;
     }
     if (client._pushedSeqs.get(ns)?.has(seqNum)) {
@@ -4605,7 +4828,7 @@ var MessageDeliveryEngine = class {
     const queue = client._pendingOrderedMsgs.get(ns);
     queue?.delete(seqNum);
     if (queue && queue.size === 0) client._pendingOrderedMsgs.delete(ns);
-    await client._publishAppEvent(event, payload);
+    await this.publishOrderedQueueItem(ns, event, seqNum, payload);
     this.markPublishedSeq(ns, seqNum);
     await this.drainOrderedMessages(ns);
     return true;
@@ -5000,12 +5223,37 @@ var SIGNED_METHODS = /* @__PURE__ */ new Set([
   "message.thought.put",
   "group.set_settings",
   "group.resources.put",
+  "group.resources.create_folder",
+  "group.resources.rename",
+  "group.resources.move",
+  "group.resources.mount_object",
   "group.resources.update",
   "group.resources.delete",
+  "group.resources.cleanup_by_storage_ref",
   "group.resources.request_add",
+  "group.resources.request_mount_object",
   "group.resources.direct_add",
   "group.resources.approve_request",
   "group.resources.reject_request",
+  "group.resources.unmount",
+  "group.resources.get_access",
+  "group.resources.resolve_access_ticket",
+  "storage.put_object",
+  "storage.delete_object",
+  "storage.get_by_share",
+  "storage.create_share_link",
+  "storage.revoke_share_link",
+  "storage.create_upload_session",
+  "storage.complete_upload",
+  "storage.create_folder",
+  "storage.rename_folder",
+  "storage.move_folder",
+  "storage.delete_folder",
+  "storage.move_object",
+  "storage.copy_object",
+  "storage.batch_delete",
+  "storage.set_object_meta",
+  "storage.append_object",
   "group.commit_state",
   "group.ban",
   "group.unban",
@@ -5028,15 +5276,44 @@ var NON_IDEMPOTENT_METHODS = /* @__PURE__ */ new Set([
   "group.update_avatar",
   "group.update_announcement",
   "group.update_settings",
-  "storage.upload",
+  "storage.put_object",
+  "storage.delete_object",
+  "storage.create_share_link",
+  "storage.revoke_share_link",
+  "storage.get_by_share",
+  "storage.create_upload_session",
   "storage.complete_upload",
-  "storage.delete",
+  "storage.create_folder",
+  "storage.rename_folder",
+  "storage.move_folder",
+  "storage.delete_folder",
+  "storage.move_object",
+  "storage.copy_object",
+  "storage.batch_delete",
+  "storage.set_object_meta",
+  "storage.append_object",
   "auth.create_aid",
   "auth.renew_cert",
   "auth.rekey",
   "message.thought.put",
   "group.thought.put",
-  "group.add_member"
+  "group.add_member",
+  "group.resources.put",
+  "group.resources.create_folder",
+  "group.resources.rename",
+  "group.resources.move",
+  "group.resources.mount_object",
+  "group.resources.update",
+  "group.resources.delete",
+  "group.resources.cleanup_by_storage_ref",
+  "group.resources.request_add",
+  "group.resources.request_mount_object",
+  "group.resources.direct_add",
+  "group.resources.approve_request",
+  "group.resources.reject_request",
+  "group.resources.unmount",
+  "group.resources.get_access",
+  "group.resources.resolve_access_ticket"
 ]);
 var RpcPipeline = class {
   constructor(runtime) {
@@ -8497,7 +8774,7 @@ function normalizeProtectedHeaders(headers, payload) {
     normalized["payload_type"] = payloadType;
   }
   normalized.sdk_lang = E2EE_SDK_LANG;
-  delete normalized.sdk_vesion;
+  delete normalized.sdk_version;
   normalized.sdk_version = VERSION;
   return normalized;
 }
@@ -9311,19 +9588,18 @@ var V2KeyStore = class _V2KeyStore {
       public_key: pubDer,
       created_at: Date.now()
     };
-    await new Promise((resolve, reject) => {
-      const req = this.store("readwrite").put(record);
-      req.onsuccess = () => resolve();
-      req.onerror = () => reject(req.error);
-    });
+    const aliasKeyId = await spkIdForPubDer(pubDer);
     const alias = {
       ...record,
-      key_id: await spkIdForPubDer(pubDer)
+      key_id: aliasKeyId
     };
     return new Promise((resolve, reject) => {
-      const req = this.store("readwrite").put(alias);
-      req.onsuccess = () => resolve();
-      req.onerror = () => reject(req.error);
+      const tx = this.db.transaction(V2_STORE_NAME, "readwrite");
+      const store = tx.objectStore(V2_STORE_NAME);
+      store.put(record);
+      store.put(alias);
+      tx.oncomplete = () => resolve();
+      tx.onerror = () => reject(tx.error);
     });
   }
   async loadIK(deviceId) {
@@ -9411,6 +9687,7 @@ var V2Session = class {
     __publicField(this, "_oldSPKMaxSeq", /* @__PURE__ */ new Map());
     __publicField(this, "_spkCache", /* @__PURE__ */ new Map());
     __publicField(this, "_nowFn", () => Date.now());
+    __publicField(this, "_registeringPromise", null);
     if (!ikPriv || !ikPubDer) {
       throw new Error("V2Session requires AID priv/pub keys (IK = AID identity)");
     }
@@ -9491,9 +9768,21 @@ var V2Session = class {
       spk_timestamp: spkTimestamp
     });
   }
-  /** 注册本设备 SPK 到服务端。IK = AID 长期密钥，无需注册。幂等。 */
+  /** 注册本设备 SPK 到服务端。IK = AID 长期密钥，无需注册。幂等，并发安全。 */
   async ensureRegistered(callFn) {
     if (this._registered) return;
+    if (this._registeringPromise) {
+      await this._registeringPromise;
+      return;
+    }
+    this._registeringPromise = this._doRegister(callFn);
+    try {
+      await this._registeringPromise;
+    } finally {
+      this._registeringPromise = null;
+    }
+  }
+  async _doRegister(callFn) {
     await this.ensureKeys();
     const uploadedSPKId = await this._store.loadLatestUploadedSPKId(this._storeDeviceId);
     if (uploadedSPKId) {
@@ -9604,8 +9893,8 @@ var V2Session = class {
       if (now - info.lastSeenAt < DESTROY_DELAY_MS) continue;
       if (recentKeep.has(spkId)) continue;
       try {
-        await this._store.deleteSPK(this._deviceId, spkId);
         await this._store.deleteSPK(this._storeDeviceId, spkId);
+        await this._store.deleteSPK(this._deviceId, spkId);
       } catch (err) {
         console.warn("[V2Session] deleteSPK failed", { spkId, err });
         continue;
@@ -9624,7 +9913,8 @@ var V2Session = class {
         try {
           await this._store.deleteSPK(this._storeDeviceId, spkId);
           await this._store.deleteSPK(this._deviceId, spkId);
-        } catch {
+        } catch (err) {
+          console.warn("[V2Session] deleteSPK (hard-limit) failed", { spkId, err });
           continue;
         }
         this._oldSPKMaxSeq.delete(spkId);
@@ -10041,7 +10331,7 @@ var V2E2EECoordinator = class {
     const gid = String(groupId ?? "").trim();
     if (!gid || !client._v2Session) return;
     const inflight = this.runtime.v2.groupSpkRegistrationInflight;
-    if (inflight.has(gid)) return;
+    if (inflight.has(gid) || this.runtime.v2.groupSpkRotationInflight.has(gid)) return;
     inflight.add(gid);
     client._safeAsync((async () => {
       try {
@@ -10059,7 +10349,7 @@ var V2E2EECoordinator = class {
     const gid = String(groupId ?? "").trim();
     if (!gid || !client._v2Session) return;
     const inflight = this.runtime.v2.groupSpkRotationInflight;
-    if (inflight.has(gid)) return;
+    if (inflight.has(gid) || this.runtime.v2.groupSpkRegistrationInflight.has(gid)) return;
     inflight.add(gid);
     client._safeAsync((async () => {
       try {
@@ -10179,6 +10469,13 @@ var V2E2EECoordinator = class {
         client._v2SenderIKPending.delete(key);
         if (plaintext === null) {
           client._clientLog.debug(`V2 sender IK pending retry failed: key=${key}`);
+          client.emit("message.undecryptable", {
+            from: entry.fromAid,
+            sender_device_id: entry.senderDeviceId,
+            group_id: entry.groupId || void 0,
+            seq: Number(entry.msg.seq ?? 0),
+            reason: "sender_ik_retry_failed"
+          });
           continue;
         }
         const seq = Number(entry.msg.seq ?? 0);
@@ -10451,6 +10748,12 @@ var V2E2EECoordinator = class {
         if (version === "v1") {
           const payload = msg.payload;
           const payloadObj = isJsonObject(payload) ? payload : null;
+          if (client._delivery.recallEventFromGroupMessage(msg)) {
+            await client._delivery.publishGroupRecallTombstone(gid, seq, msg);
+            client._markPublishedSeq(ns, seq);
+            client._clientLog.debug(`group.v2.pull recall tombstone delivered: group=${gid}, seq=${seq}`);
+            continue;
+          }
           if (payloadObj) {
             const payloadType = String(payloadObj.type ?? "").trim();
             if (payloadType !== "e2ee.encrypted" && payloadType !== "e2ee.group_encrypted") {
@@ -11608,11 +11911,11 @@ var GroupStateCoordinator = class {
           delete data.client_signature;
         } else {
           const verified = await client._verifyEventSignature(data, cs);
-          if (verified === false) {
+          if (!client._isEventSignatureVerified(verified)) {
             client._clientLog.warn(`state_committed committer signature verify failed group=%s${String(groupId)}`);
             return;
           }
-          data._verified = verified;
+          data._verified = true;
         }
       }
       const stateVersion = Number(data.state_version ?? 0);
@@ -14658,6 +14961,7 @@ var DEFAULT_SESSION_OPTIONS = {
 var RECONNECT_MIN_BASE_DELAY_SECONDS = 1;
 var RECONNECT_MAX_BASE_DELAY_SECONDS = 64;
 var TOKEN_REFRESH_CHECK_INTERVAL_MS = 3e4;
+var MAX_NOTIFY_PAYLOAD_SIZE = 64 * 1024;
 var HEARTBEAT_MIN_INTERVAL_SECONDS = 10;
 var HEARTBEAT_MAX_INTERVAL_SECONDS = 600;
 function clampHeartbeatInterval(value) {
@@ -14987,6 +15291,8 @@ var _AUNClient = class _AUNClient {
     __publicField(this, "_pendingOrderedMsgs", /* @__PURE__ */ new Map());
     /** Lazy group sync：首次发送群消息前自动拉取历史 */
     __publicField(this, "_groupSynced", /* @__PURE__ */ new Set());
+    /** 群撤回去重：group_id|sorted(message_ids)|recalled_at -> 时间戳，保证应用层只回调一次 */
+    __publicField(this, "_groupRecallSeen", /* @__PURE__ */ new Map());
     /** 在线未读 hint 队列：同一 group 只保留最后一条，延迟 drain 降低登录瞬时拉取压力。 */
     __publicField(this, "_onlineUnreadHintQueue", /* @__PURE__ */ new Map());
     __publicField(this, "_onlineUnreadHintTimer", null);
@@ -15143,6 +15449,9 @@ var _AUNClient = class _AUNClient {
     this._dispatcher.subscribe("_raw.group.message_created", (data) => {
       this._onRawGroupMessageCreated(data);
     });
+    this._dispatcher.subscribe("_raw.group.message_recalled", (data) => {
+      this._safeAsync(this._onRawGroupMessageRecalled(data));
+    });
     this._dispatcher.subscribe("_raw.group.changed", (data) => {
       this._onRawGroupChanged(data);
     });
@@ -15431,6 +15740,85 @@ var _AUNClient = class _AUNClient {
   async call(method, params) {
     return await this._rpcPipeline.call(method, params);
   }
+  static _notifyParamsSizeOk(params) {
+    return new TextEncoder().encode(JSON.stringify(params)).length <= MAX_NOTIFY_PAYLOAD_SIZE;
+  }
+  static _validateNotifyEventMethod(method) {
+    const normalized = String(method ?? "").trim();
+    if (!normalized.startsWith("event/app.") || normalized.length <= "event/app.".length) {
+      throw new ValidationError("routed notify method must be event/app.*");
+    }
+    return normalized;
+  }
+  static _normalizeNotifyTtl(value) {
+    if (value === void 0 || value === null) return void 0;
+    const ttl = Number(value);
+    if (!Number.isInteger(ttl)) {
+      throw new ValidationError("ttl_ms must be an integer");
+    }
+    if (ttl < 0 || ttl > 6e4) {
+      throw new ValidationError("ttl_ms must be between 0 and 60000");
+    }
+    return ttl;
+  }
+  /**
+   * 发送轻量在线通知，不走离线存储、seq/pull 或 ack。
+   */
+  async notify(method, params, options = {}) {
+    if (params !== void 0 && params !== null && !isJsonObject(params)) {
+      throw new ValidationError("notify params must be an object");
+    }
+    const payload = { ...params ?? {} };
+    if (!_AUNClient._notifyParamsSizeOk(payload)) {
+      throw new ValidationError("notify payload is too large");
+    }
+    const targetAid = String(options.to ?? "").trim();
+    const targetGroupId = String(options.group_id ?? options.groupId ?? "").trim();
+    const targetDeviceId = String(options.device_id ?? options.deviceId ?? "").trim();
+    const targetSlotId = String(options.slot_id ?? options.slotId ?? "").trim();
+    const ttl = _AUNClient._normalizeNotifyTtl(options.ttl_ms ?? options.ttlMs);
+    if (targetAid && targetGroupId) {
+      throw new ValidationError("notify() cannot set both to and group_id");
+    }
+    if (targetSlotId && !targetDeviceId) {
+      throw new ValidationError("slot_id requires device_id for notify target");
+    }
+    if (targetAid) {
+      const eventMethod = _AUNClient._validateNotifyEventMethod(method);
+      const target = { type: "aid", aid: targetAid };
+      if (targetDeviceId) target.device_id = targetDeviceId;
+      if (targetSlotId) target.slot_id = targetSlotId;
+      const routeParams = {
+        target,
+        deliver: { method: eventMethod, params: payload }
+      };
+      if (ttl !== void 0) routeParams.ttl_ms = ttl;
+      await this._transport.notify("notification/route", routeParams);
+      return;
+    }
+    if (targetGroupId) {
+      const eventMethod = _AUNClient._validateNotifyEventMethod(method);
+      const normalizedGroupId2 = normalizeGroupId(targetGroupId);
+      if (!normalizedGroupId2) {
+        throw new ValidationError("group_id is required for group notify");
+      }
+      const routeParams = {
+        group_id: normalizedGroupId2,
+        deliver: { method: eventMethod, params: payload }
+      };
+      if (ttl !== void 0) routeParams.ttl_ms = ttl;
+      await this._transport.notify("notification/group.route", routeParams);
+      return;
+    }
+    if (targetDeviceId || targetSlotId) {
+      throw new ValidationError("device_id and slot_id require to");
+    }
+    const directMethod = String(method ?? "").trim();
+    if (!directMethod.startsWith("notification/")) {
+      throw new ValidationError("direct notify method must start with notification/");
+    }
+    await this._transport.notify(directMethod, payload);
+  }
   async _callRawV2Rpc(method, params) {
     const p = { ...params ?? {} };
     delete p._pull_gate_locked;
@@ -15477,6 +15865,9 @@ var _AUNClient = class _AUNClient {
   _onRawGroupMessageCreated(data) {
     return this._delivery.onRawGroupMessageCreated(data);
   }
+  async _onRawGroupMessageRecalled(data) {
+    return this._delivery.onRawGroupMessageRecalled(data);
+  }
   /** 处理 V2 群消息通知：主动 pull V2 envelope，由 pullGroupV2 解密并发布。 */
   async _onRawGroupV2MessageCreated(data) {
     return this._delivery.onRawGroupV2MessageCreated(data);
@@ -15561,18 +15952,12 @@ var _AUNClient = class _AUNClient {
           if (this._shouldSkipEventSignature(d)) {
             delete d.client_signature;
           } else {
-            d._verified = await this._verifyEventSignature(d, cs);
+            const verified = await this._verifyEventSignature(d, cs);
+            d._verified = this._isEventSignatureVerified(verified);
           }
         }
-        await this._dispatcher.publish("group.changed", d);
         const groupId = d.group_id ?? "";
-        this._groupState.handleGroupChangedV2Membership(d);
-        this._delivery.handleGroupChangedEventSeq(d, groupId);
-        if (d.action === "dissolved") {
-          if (groupId) {
-            this._cleanupDissolvedGroup(groupId);
-          }
-        }
+        await this._delivery.handleGroupChangedEventSeq(d, groupId);
       } else {
         await this._dispatcher.publish("group.changed", data);
       }
@@ -15611,6 +15996,7 @@ var _AUNClient = class _AUNClient {
     this._pushedSeqs.delete(`group:${groupId}`);
     this._pushedSeqs.delete(`group_event:${groupId}`);
     this._pendingOrderedMsgs.delete(`group:${groupId}`);
+    this._pendingOrderedMsgs.delete(`group_event:${groupId}`);
     this._clientLog.info(`cleanup dissolved group ${groupId}  local state`);
   }
   async _verifyEventSignature(_event, cs) {
@@ -15659,6 +16045,9 @@ var _AUNClient = class _AUNClient {
       return false;
     }
   }
+  _isEventSignatureVerified(value) {
+    return value === true;
+  }
   _protectedHeadersFromParams(params) {
     const value = params.protected_headers ?? params.headers;
     if (value == null) return null;
@@ -16416,7 +16805,7 @@ var _AUNClient = class _AUNClient {
     );
     return repaired;
   }
-  async _ensureV2SessionReady(method, errorMessage) {
+  async _ensureV2SessionReady(method, errorMessage2) {
     if (!this._v2SessionMatchesIdentity()) {
       if (!this._v2SessionInitInFlight) {
         this._v2SessionInitInFlight = this._initV2Session().finally(() => {
@@ -16426,7 +16815,7 @@ var _AUNClient = class _AUNClient {
       await this._v2SessionInitInFlight;
     }
     if (!this._v2SessionMatchesIdentity()) {
-      throw new StateError(errorMessage ?? `V2 session not initialized; encrypted ${method} requires E2EE V2`);
+      throw new StateError(errorMessage2 ?? `V2 session not initialized; encrypted ${method} requires E2EE V2`);
     }
   }
   _v2CallFn() {
@@ -18466,6 +18855,1176 @@ var AIDStore = class {
 // src/index.ts
 init_crypto();
 
+// src/service-proxy.ts
+var PROXY_DISCOVERY_CACHE_KEY = "service_proxy_discovery";
+var PROXY_DISCOVERY_CACHE_TTL_MS = 36e5;
+var TOKEN_EXPIRY_SKEW_SECONDS = 30;
+var HOP_BY_HOP_HEADERS = /* @__PURE__ */ new Set([
+  "connection",
+  "upgrade",
+  "keep-alive",
+  "proxy-authenticate",
+  "proxy-authorization",
+  "te",
+  "trailer",
+  "transfer-encoding"
+]);
+var AUTO_RESPONSE_HEADERS = /* @__PURE__ */ new Set(["content-length", "date", "server"]);
+var ALLOWED_SCHEMES = /* @__PURE__ */ new Set(["http:", "https:", "ws:", "wss:"]);
+var RESERVED_SERVICE_NAMES = /* @__PURE__ */ new Set([
+  "api",
+  "health",
+  "metrics",
+  "status",
+  "proxy",
+  "admin",
+  "ws",
+  "wss",
+  "static",
+  "favicon.ico"
+]);
+var SENSITIVE_METADATA_KEYS = /* @__PURE__ */ new Set([
+  "endpoint",
+  "url",
+  "uri",
+  "token",
+  "access_token",
+  "authorization",
+  "cookie",
+  "secret",
+  "password",
+  "private_key",
+  "key",
+  "cert",
+  "certificate"
+]);
+var SERVICE_NAME_RE = /^[a-z0-9_-]+$/;
+var STREAMING_SERVICE_TYPES = /* @__PURE__ */ new Set(["mcp", "mcp-sse", "mcp-streamable-http", "sse", "stream", "file", "ws", "websocket"]);
+var VALID_STREAM_MODES = /* @__PURE__ */ new Set(["auto", "stream", "always", "no_stream"]);
+var FILE_CONTENT_TYPES = /* @__PURE__ */ new Set([
+  "application/octet-stream",
+  "application/pdf",
+  "application/zip",
+  "application/x-zip-compressed",
+  "application/gzip",
+  "application/x-tar"
+]);
+var ServiceRecord = class {
+  constructor(params) {
+    __publicField(this, "service_name");
+    __publicField(this, "endpoint");
+    __publicField(this, "service_type");
+    __publicField(this, "visibility");
+    __publicField(this, "metadata");
+    this.service_name = params.service_name;
+    this.endpoint = params.endpoint;
+    this.service_type = String(params.service_type ?? "http").trim() || "http";
+    this.visibility = String(params.visibility ?? "private").trim() || "private";
+    this.metadata = sanitizeMetadata(params.metadata ?? {});
+  }
+  summary() {
+    return {
+      service_name: this.service_name,
+      service_type: this.service_type,
+      visibility: this.visibility,
+      metadata: sanitizeMetadata(this.metadata)
+    };
+  }
+};
+var EndpointPolicy = class {
+  constructor(opts = {}) {
+    __publicField(this, "allowedHosts");
+    this.allowedHosts = new Set(Array.from(opts.allowedHosts ?? []).map(normalizeHost).filter(Boolean));
+  }
+  isAllowed(endpoint) {
+    let parsed;
+    try {
+      parsed = new URL(String(endpoint ?? "").trim());
+    } catch {
+      return false;
+    }
+    if (!ALLOWED_SCHEMES.has(parsed.protocol)) return false;
+    const host = normalizeHost(parsed.hostname);
+    if (!host) return false;
+    if (this.allowedHosts.has(host)) return true;
+    if (host === "localhost") return true;
+    return isIPv4LoopbackHost(host);
+  }
+};
+var EmbeddedServiceRegistry = class {
+  constructor(opts = {}) {
+    __publicField(this, "_endpointPolicy");
+    __publicField(this, "_replaceExisting");
+    __publicField(this, "_records", /* @__PURE__ */ new Map());
+    this._endpointPolicy = opts.endpointPolicy ?? new EndpointPolicy();
+    this._replaceExisting = opts.replaceExisting ?? true;
+  }
+  register(serviceName, endpoint, opts = {}) {
+    const normalizedName = normalizeServiceName(serviceName);
+    const endpointText = String(endpoint ?? "").trim();
+    if (!this._endpointPolicy.isAllowed(endpointText)) {
+      throw new ValidationError("endpoint is not allowed");
+    }
+    if (this._records.has(normalizedName) && !this._replaceExisting) {
+      throw new ValidationError(`service already registered: ${normalizedName}`);
+    }
+    const record = new ServiceRecord({
+      service_name: normalizedName,
+      endpoint: endpointText,
+      service_type: opts.serviceType,
+      visibility: opts.visibility,
+      metadata: opts.metadata
+    });
+    this._records.set(normalizedName, record);
+    return record;
+  }
+  unregister(serviceName) {
+    return this._records.delete(normalizeServiceName(serviceName));
+  }
+  get(serviceName) {
+    return this._records.get(normalizeServiceName(serviceName)) ?? null;
+  }
+  listRecords() {
+    return Array.from(this._records.values()).sort((a, b) => a.service_name.localeCompare(b.service_name));
+  }
+  listSummaries() {
+    return this.listRecords().map((record) => record.summary());
+  }
+};
+var AsyncQueue = class {
+  constructor() {
+    __publicField(this, "_items", []);
+    __publicField(this, "_waiters", []);
+    __publicField(this, "_closed", false);
+  }
+  push(value) {
+    if (this._closed) return;
+    const waiter = this._waiters.shift();
+    if (waiter) waiter(value);
+    else this._items.push(value);
+  }
+  close() {
+    this._closed = true;
+    for (const waiter of this._waiters.splice(0)) waiter(null);
+  }
+  shift(timeoutMs) {
+    if (this._items.length > 0) return Promise.resolve(this._items.shift());
+    if (this._closed) return Promise.resolve(null);
+    return new Promise((resolve) => {
+      let timer = null;
+      const done = (value) => {
+        if (timer !== null) clearTimeout(timer);
+        resolve(value);
+      };
+      this._waiters.push(done);
+      if (timeoutMs !== void 0) {
+        timer = setTimeout(() => {
+          const idx = this._waiters.indexOf(done);
+          if (idx >= 0) this._waiters.splice(idx, 1);
+          resolve(null);
+        }, Math.max(0, timeoutMs));
+      }
+    });
+  }
+};
+var TunnelSocket = class {
+  constructor(ws) {
+    __publicField(this, "_ws");
+    __publicField(this, "_queue", new AsyncQueue());
+    this._ws = ws;
+    try {
+      this._ws.binaryType = "arraybuffer";
+    } catch {
+    }
+    ws.addEventListener("message", (event) => {
+      const data = event.data;
+      if (typeof data === "string") {
+        this._queue.push(data);
+      } else if (data instanceof ArrayBuffer) {
+        this._queue.push(new TextDecoder().decode(new Uint8Array(data)));
+      } else if (ArrayBuffer.isView(data)) {
+        this._queue.push(new TextDecoder().decode(new Uint8Array(data.buffer, data.byteOffset, data.byteLength)));
+      } else {
+        this._queue.push(String(data ?? ""));
+      }
+    });
+    ws.addEventListener("close", () => this._queue.close());
+    ws.addEventListener("error", () => this._queue.close());
+  }
+  async send(message) {
+    this._ws.send(JSON.stringify(message));
+  }
+  recv(timeoutMs) {
+    return this._queue.shift(timeoutMs);
+  }
+  close() {
+    try {
+      this._ws.close();
+    } catch {
+    }
+    this._queue.close();
+  }
+};
+var ServiceProxyClient = class {
+  constructor(opts) {
+    __publicField(this, "providerAid");
+    __publicField(this, "registry");
+    __publicField(this, "maxResponseBodyBytes");
+    __publicField(this, "maxTunnelMessageBytes");
+    __publicField(this, "_logger");
+    __publicField(this, "_aunClient");
+    __publicField(this, "_webSocketFactory");
+    __publicField(this, "_running", false);
+    __publicField(this, "_activeTunnel", null);
+    this.providerAid = String(opts.providerAid ?? "").trim();
+    this.registry = opts.registry ?? new EmbeddedServiceRegistry({ endpointPolicy: opts.endpointPolicy });
+    this._logger = opts.logger ?? null;
+    this._aunClient = opts.aunClient ?? null;
+    this._webSocketFactory = opts.webSocketFactory ?? null;
+    this.maxResponseBodyBytes = Math.max(1, Math.floor(opts.maxResponseBodyBytes ?? 16 * 1024 * 1024));
+    this.maxTunnelMessageBytes = Math.max(1, Math.floor(opts.maxTunnelMessageBytes ?? 64 * 1024 * 1024));
+  }
+  get isRunning() {
+    return this._running;
+  }
+  get is_running() {
+    return this.isRunning;
+  }
+  stop() {
+    this._running = false;
+    this._activeTunnel?.close();
+  }
+  registerService(serviceName, endpoint, opts = {}) {
+    return this.registry.register(serviceName, endpoint, {
+      serviceType: opts.serviceType ?? opts.service_type,
+      visibility: opts.visibility,
+      metadata: opts.metadata
+    });
+  }
+  register_service(serviceName, endpoint, opts = {}) {
+    return this.registerService(serviceName, endpoint, opts);
+  }
+  unregisterService(serviceName) {
+    return this.registry.unregister(serviceName);
+  }
+  unregister_service(serviceName) {
+    return this.unregisterService(serviceName);
+  }
+  listServiceSummaries() {
+    return this.registry.listSummaries();
+  }
+  list_service_summaries() {
+    return this.listServiceSummaries();
+  }
+  async registerServicesWithGateway(services) {
+    const call = this._gatewayCallMethod(true);
+    const result = await call("proxy.register_services", {
+      provider_aid: this.providerAid,
+      services: services ?? this.listServiceSummaries()
+    });
+    if (!isRecord4(result)) return {};
+    if (result.ok === false) throw new ValidationError(String(result.error ?? "Gateway service registration failed"));
+    return result;
+  }
+  register_services_with_gateway(services) {
+    return this.registerServicesWithGateway(services);
+  }
+  async unregisterServicesFromGateway(serviceNames) {
+    const call = this._gatewayCallMethod(true);
+    const params = { provider_aid: this.providerAid };
+    if (typeof serviceNames === "string") params.service_names = [serviceNames];
+    else if (Array.isArray(serviceNames)) params.service_names = serviceNames.map(String);
+    const result = await call("proxy.unregister_services", params);
+    return isRecord4(result) ? result : {};
+  }
+  unregister_services_from_gateway(serviceNames) {
+    return this.unregisterServicesFromGateway(serviceNames);
+  }
+  async listGatewayServices() {
+    const call = this._gatewayCallMethod(true);
+    const result = await call("proxy.list_services", { provider_aid: this.providerAid });
+    return isRecord4(result) ? result : {};
+  }
+  list_gateway_services() {
+    return this.listGatewayServices();
+  }
+  async discoverProxyServer(opts = {}) {
+    const forceRefresh = Boolean(opts.forceRefresh ?? opts.force_refresh ?? false);
+    if (!forceRefresh) {
+      const cached = await this._loadCachedProxyDiscovery();
+      if (cached) return cached;
+    }
+    const errors = [];
+    for (const url of this._proxyWellKnownUrls()) {
+      try {
+        const discovery = await this._fetchProxyWellKnown(url, opts.timeout ?? 5);
+        await this._persistProxyDiscovery(discovery);
+        return discovery;
+      } catch (exc) {
+        errors.push(`${url}: ${formatError(exc)}`);
+        this._logWarn(`Service Proxy discovery failed: url=${url} err=${formatError(exc)}`);
+      }
+    }
+    throw new ConnectionError(`Service Proxy discovery failed: ${errors.join("; ")}`, { retryable: true });
+  }
+  discover_proxy_server(opts = {}) {
+    return this.discoverProxyServer(opts);
+  }
+  async discoverProxyWsUrl(opts = {}) {
+    const discovery = await this.discoverProxyServer(opts);
+    return String(discovery.ws_url ?? "").trim();
+  }
+  discover_proxy_ws_url(opts = {}) {
+    return this.discoverProxyWsUrl(opts);
+  }
+  async connectOnce(opts = {}) {
+    this._running = true;
+    try {
+      await this._autoRegisterServicesWithGateway();
+      const tunnel = await this._connectProxyWs();
+      this._activeTunnel = tunnel;
+      await tunnel.send({
+        type: "service_proxy_auth",
+        request_id: opts.authRequestId ?? "auth",
+        provider_aid: this.providerAid,
+        client_version: "js"
+      });
+      const authResponse = parseTunnelMessage(await tunnel.recv());
+      if (!authResponse.ok) {
+        const err = isRecord4(authResponse.error) ? authResponse.error : {};
+        throw new AuthError(String(err.message ?? "Service Proxy auth failed"));
+      }
+      const registered = await this.registerServicesWithProxyServer(tunnel, {
+        registerRequestId: opts.registerRequestId ?? "register-services"
+      });
+      let heartbeat = false;
+      if (opts.heartbeatRequestId) {
+        await tunnel.send({ type: "heartbeat", request_id: opts.heartbeatRequestId });
+        heartbeat = Boolean(parseTunnelMessage(await tunnel.recv()).ok);
+      }
+      return { registered, heartbeat };
+    } finally {
+      this._running = false;
+      this._activeTunnel?.close();
+      this._activeTunnel = null;
+    }
+  }
+  connect_once(opts = {}) {
+    return this.connectOnce({
+      authRequestId: opts.auth_request_id,
+      registerRequestId: opts.register_request_id,
+      heartbeatRequestId: opts.heartbeat_request_id
+    });
+  }
+  async serveOnce(opts = {}) {
+    this._running = true;
+    try {
+      await this._autoRegisterServicesWithGateway();
+      const tunnel = await this._connectProxyWs();
+      this._activeTunnel = tunnel;
+      return await this._serveTunnel(tunnel, {
+        authRequestId: opts.authRequestId ?? "auth",
+        registerRequestId: opts.registerRequestId ?? "register-services",
+        maxRequests: opts.maxRequests ?? 1
+      });
+    } finally {
+      this._running = false;
+      this._activeTunnel?.close();
+      this._activeTunnel = null;
+    }
+  }
+  serve_once(opts = {}) {
+    return this.serveOnce({
+      authRequestId: opts.auth_request_id,
+      registerRequestId: opts.register_request_id,
+      maxRequests: opts.max_requests
+    });
+  }
+  async serveForever(opts = {}) {
+    const mode = opts.connectionMode ?? "persistent";
+    if (mode !== "persistent" && mode !== "on_demand") {
+      throw new ValidationError("connectionMode must be persistent or on_demand");
+    }
+    this._running = true;
+    const stats = { connection_mode: mode, connections: 0, registered: 0, handled_requests: 0, wakeup_count: 0 };
+    try {
+      if (mode === "persistent") {
+        while (this._running) {
+          try {
+            await this._autoRegisterServicesWithGateway();
+            const tunnel = await this._connectProxyWs();
+            this._activeTunnel = tunnel;
+            const result = await this._serveTunnel(tunnel, {
+              authRequestId: opts.authRequestId ?? "auth",
+              registerRequestId: opts.registerRequestId ?? "register-services"
+            });
+            stats.connections = Number(stats.connections) + 1;
+            stats.registered = Number(result.registered ?? stats.registered);
+            stats.handled_requests = Number(stats.handled_requests) + Number(result.handled_requests ?? 0);
+          } catch (exc) {
+            if (!this._running) break;
+            this._logWarn(`persistent tunnel reconnect scheduled after error: ${formatError(exc)}`);
+            await sleep(Math.max(0, opts.reconnectDelaySeconds ?? 1) * 1e3);
+          } finally {
+            this._activeTunnel?.close();
+            this._activeTunnel = null;
+          }
+        }
+        return stats;
+      }
+      return await this._serveOnDemand(stats, opts);
+    } finally {
+      this._running = false;
+      this._activeTunnel?.close();
+      this._activeTunnel = null;
+    }
+  }
+  serve_forever(opts = {}) {
+    return this.serveForever({
+      connectionMode: opts.connection_mode,
+      authRequestId: opts.auth_request_id,
+      registerRequestId: opts.register_request_id,
+      idleTimeoutSeconds: opts.idle_timeout_seconds,
+      reconnectDelaySeconds: opts.reconnect_delay_seconds
+    });
+  }
+  async registerServicesWithProxyServer(tunnel, opts = {}) {
+    const services = opts.services ?? this.listServiceSummaries();
+    await tunnel.send({ type: "register_services", request_id: opts.registerRequestId ?? "register-services", services });
+    const response = parseTunnelMessage(await tunnel.recv());
+    if (!response.ok) throw new ValidationError("Service Proxy service registration failed");
+    return Number(response.count ?? services.length);
+  }
+  register_services_with_proxy_server(tunnel, opts = {}) {
+    return this.registerServicesWithProxyServer(tunnel, { registerRequestId: opts.register_request_id, services: opts.services });
+  }
+  async *iterRequestMessages(message, opts = {}) {
+    const requestId = String(message.request_id ?? "");
+    const serviceName = String(message.service_name ?? "");
+    let record = null;
+    try {
+      record = this.registry.get(serviceName);
+    } catch {
+      record = null;
+    }
+    if (!record) {
+      yield errorMessage(requestId, "service_not_registered", "service is not registered");
+      return;
+    }
+    const method = String(message.method ?? "GET").toUpperCase();
+    const path = normalizePath(String(message.path ?? "/"));
+    const targetUrl = buildTargetUrl(record.endpoint, path, String(message.query_string ?? ""));
+    const bodyStream = message.body_stream === true;
+    let body;
+    if (bodyStream) {
+      if (!opts.bodyIter) {
+        yield errorMessage(requestId, "missing_body_stream", "request body stream is missing");
+        return;
+      }
+      body = readableStreamFromAsyncIterable(opts.bodyIter);
+    } else if (message.body_base64) {
+      try {
+        body = toExactArrayBuffer(decodeBase64Strict(String(message.body_base64)));
+      } catch {
+        yield errorMessage(requestId, "invalid_body", "body_base64 is invalid");
+        return;
+      }
+    }
+    const headers = backendHeaders(isRecord4(message.headers) ? message.headers : {});
+    let response;
+    try {
+      const init = { method, headers };
+      if (method !== "GET" && method !== "HEAD") {
+        init.body = body;
+        if (bodyStream) init.duplex = "half";
+      }
+      const controller = new AbortController();
+      const timer = setTimeout(() => controller.abort(), 3e4);
+      try {
+        response = await fetch(targetUrl, { ...init, signal: controller.signal });
+      } finally {
+        clearTimeout(timer);
+      }
+    } catch (exc) {
+      this._logWarn(`backend request failed: request_id=${requestId} service_name=${serviceName} err=${formatError(exc)}`);
+      yield errorMessage(requestId, "backend_unreachable", "backend request failed");
+      return;
+    }
+    const responseHeaders = responseHeadersMap(response.headers);
+    const detection = detectRequestProtocol(message, record);
+    const shouldStream = detection.isStream || detection.streamMode !== "no_stream" && isStreamResponseHeaders(responseHeaders);
+    if (!shouldStream) {
+      try {
+        const bytes = new Uint8Array(await response.arrayBuffer());
+        if (bytes.length > this.maxResponseBodyBytes) throw new Error("too large");
+        yield {
+          type: "service_proxy_response",
+          request_id: requestId,
+          status: response.status,
+          headers: responseHeaders,
+          body_base64: encodeBase64(bytes)
+        };
+      } catch {
+        yield errorMessage(requestId, "response_body_too_large", "backend response body is too large");
+      }
+      return;
+    }
+    const streamType = streamTypeFromResponse(responseHeaders, detection.serviceType);
+    if (!responseHeaders["x-stream-type"]) responseHeaders["x-stream-type"] = streamType;
+    const chunkSize = Math.max(1, Math.floor(opts.chunkSize ?? 65536));
+    let index = 0;
+    let pending = null;
+    for await (const chunk of responseChunks(response, chunkSize)) {
+      if (pending) {
+        yield streamMessage(requestId, index, response.status, responseHeaders, pending, false);
+        index += 1;
+      }
+      pending = chunk;
+    }
+    if (pending) {
+      yield streamMessage(requestId, index, response.status, responseHeaders, pending, true);
+    } else if (index === 0) {
+      yield { type: "service_proxy_stream", request_id: requestId, index: 0, status: response.status, headers: responseHeaders, data_base64: "", done: true };
+    }
+  }
+  async handleWsConnectMessage(message, tunnel, inboundQueue) {
+    const connectionId = String(message.connection_id ?? "");
+    const serviceName = String(message.service_name ?? "");
+    let record = null;
+    try {
+      record = this.registry.get(serviceName);
+    } catch {
+      record = null;
+    }
+    if (!record) {
+      await tunnel.send(wsErrorMessage(connectionId, "service_not_registered", "service is not registered"));
+      return;
+    }
+    const protocols = Array.isArray(message.subprotocols) ? message.subprotocols.map(String).map((item) => item.trim()).filter(Boolean) : [];
+    let backend;
+    try {
+      backend = this._createWebSocket(
+        buildTargetUrl(record.endpoint, normalizePath(String(message.path ?? "/")), String(message.query_string ?? "")),
+        protocols,
+        { headers: backendHeaders(isRecord4(message.headers) ? message.headers : {}), verifySsl: this._shouldVerifySsl() },
+        false
+      );
+      await waitForWsOpen(backend);
+      await tunnel.send({ type: "ws_connected", connection_id: connectionId, subprotocol: backend.protocol || "" });
+    } catch (exc) {
+      this._logWarn(`backend websocket bridge failed: connection_id=${connectionId} err=${formatError(exc)}`);
+      await tunnel.send(wsErrorMessage(connectionId, "backend_ws_unreachable", "backend websocket request failed"));
+      return;
+    }
+    backend.binaryType = "arraybuffer";
+    const backendClosed = new Promise((resolve) => {
+      backend.addEventListener("message", (event) => {
+        const data = event.data;
+        if (typeof data === "string") {
+          tunnel.send({ type: "ws_message", connection_id: connectionId, text: data }).catch(() => {
+          });
+        } else {
+          bytesFromWsData(data).then((bytes) => {
+            tunnel.send({ type: "ws_message", connection_id: connectionId, data_base64: encodeBase64(bytes) }).catch(() => {
+            });
+          }).catch(() => {
+          });
+        }
+      });
+      backend.addEventListener("close", (event) => {
+        tunnel.send({ type: "ws_close", connection_id: connectionId, code: event.code || 1e3, reason: "" }).catch(() => {
+        });
+        resolve();
+      });
+      backend.addEventListener("error", () => resolve());
+    });
+    const tunnelToBackend = (async () => {
+      while (this._running) {
+        const item = await inboundQueue.shift();
+        if (!item) return;
+        const msgType = String(item.type ?? "");
+        if (msgType === "ws_message") {
+          if (item.text !== void 0 && item.text !== null) {
+            backend.send(String(item.text));
+          } else if (item.data_base64 !== void 0) {
+            try {
+              backend.send(decodeBase64Strict(String(item.data_base64 ?? "")));
+            } catch {
+              await tunnel.send(wsErrorMessage(connectionId, "invalid_ws_frame", "data_base64 is invalid"));
+              backend.close();
+              return;
+            }
+          }
+        } else if (msgType === "ws_close" || msgType === "ws_error") {
+          backend.close(Number(item.code ?? 1e3), String(item.reason ?? ""));
+          return;
+        }
+      }
+    })();
+    await Promise.race([backendClosed, tunnelToBackend]);
+    try {
+      backend.close();
+    } catch {
+    }
+  }
+  async _serveOnDemand(stats, opts) {
+    const client = this._aunClient;
+    if (!client || typeof client.on !== "function") throw new ValidationError("on_demand mode requires aunClient with on()");
+    await this._autoRegisterServicesWithGateway();
+    const queue = new AsyncQueue();
+    const subscription = client.on("app.service_proxy.wakeup", (payload) => {
+      if (!isRecord4(payload)) return;
+      if (String(payload.type ?? "") !== "aun.service_proxy.wakeup") return;
+      const providerAid = String(payload.provider_aid ?? "").trim();
+      if (providerAid && providerAid !== this.providerAid) return;
+      queue.push({ ...payload });
+    });
+    try {
+      while (this._running) {
+        const wakeup = await queue.shift(100);
+        if (!this._running) break;
+        if (!wakeup) continue;
+        stats.wakeup_count = Number(stats.wakeup_count) + 1;
+        try {
+          await this._autoRegisterServicesWithGateway();
+          const tunnel = await this._connectProxyWs();
+          this._activeTunnel = tunnel;
+          const result = await this._serveTunnel(tunnel, {
+            authRequestId: opts.authRequestId ?? "auth",
+            registerRequestId: opts.registerRequestId ?? "register-services",
+            idleTimeoutSeconds: opts.idleTimeoutSeconds ?? 60
+          });
+          stats.connections = Number(stats.connections) + 1;
+          stats.registered = Number(result.registered ?? stats.registered);
+          stats.handled_requests = Number(stats.handled_requests) + Number(result.handled_requests ?? 0);
+        } catch (exc) {
+          if (!this._running) break;
+          this._logWarn(`on-demand tunnel connection failed after wakeup: ${formatError(exc)}`);
+          await sleep(Math.max(0, opts.reconnectDelaySeconds ?? 1) * 1e3);
+        } finally {
+          this._activeTunnel?.close();
+          this._activeTunnel = null;
+        }
+      }
+      return stats;
+    } finally {
+      subscription?.unsubscribe?.();
+      queue.close();
+    }
+  }
+  async _serveTunnel(tunnel, opts) {
+    let handledRequests = 0;
+    const activeWsQueues = /* @__PURE__ */ new Map();
+    const registered = await this._authAndRegister(tunnel, opts.authRequestId, opts.registerRequestId);
+    try {
+      while (this._running) {
+        if (opts.maxRequests !== void 0 && handledRequests >= opts.maxRequests && activeWsQueues.size === 0) break;
+        const waitForWsTasks = opts.maxRequests !== void 0 && handledRequests >= opts.maxRequests && activeWsQueues.size > 0;
+        const timeoutMs = waitForWsTasks ? 50 : opts.idleTimeoutSeconds === void 0 ? void 0 : opts.idleTimeoutSeconds * 1e3;
+        const raw = await tunnel.recv(timeoutMs);
+        if (raw === null) {
+          if (timeoutMs !== void 0 && activeWsQueues.size > 0) continue;
+          break;
+        }
+        let message;
+        try {
+          const parsed = JSON.parse(raw);
+          if (!isRecord4(parsed)) continue;
+          message = parsed;
+        } catch {
+          continue;
+        }
+        const msgType = String(message.type ?? "");
+        if (msgType === "service_proxy_request") {
+          const requestId = String(message.request_id ?? "");
+          const bodyIter = message.body_stream === true ? this._iterRequestBodyChunks(tunnel, requestId, activeWsQueues) : void 0;
+          for await (const response of this.iterRequestMessages(message, { bodyIter })) await tunnel.send(response);
+          handledRequests += 1;
+        } else if (msgType === "ws_connect") {
+          const connectionId = String(message.connection_id ?? "");
+          if (!connectionId) {
+            await tunnel.send(wsErrorMessage("", "missing_connection_id", "connection_id is required"));
+            continue;
+          }
+          const queue = new AsyncQueue();
+          activeWsQueues.set(connectionId, queue);
+          this.handleWsConnectMessage(message, tunnel, queue).finally(() => {
+            queue.close();
+            activeWsQueues.delete(connectionId);
+          });
+          handledRequests += 1;
+        } else if (msgType === "ws_message" || msgType === "ws_close" || msgType === "ws_error") {
+          const connectionId = String(message.connection_id ?? "");
+          const queue = activeWsQueues.get(connectionId);
+          if (queue) queue.push(message);
+          else if (connectionId) await tunnel.send(wsErrorMessage(connectionId, "unknown_ws_connection", "WebSocket connection is not active"));
+        } else if (msgType !== "heartbeat_ack") {
+          await tunnel.send(errorMessage(String(message.request_id ?? ""), "unsupported_message", "unsupported Service Proxy tunnel message"));
+        }
+      }
+      return { registered, handled_requests: handledRequests };
+    } finally {
+      for (const queue of activeWsQueues.values()) queue.close();
+    }
+  }
+  async _authAndRegister(tunnel, authRequestId, registerRequestId) {
+    await tunnel.send({ type: "service_proxy_auth", request_id: authRequestId, provider_aid: this.providerAid, client_version: "js" });
+    const authResponse = parseTunnelMessage(await tunnel.recv());
+    if (!authResponse.ok) {
+      const err = isRecord4(authResponse.error) ? authResponse.error : {};
+      throw new AuthError(String(err.message ?? "Service Proxy auth failed"));
+    }
+    return this.registerServicesWithProxyServer(tunnel, { registerRequestId });
+  }
+  async *_iterRequestBodyChunks(tunnel, requestId, activeWsQueues) {
+    while (true) {
+      const message = parseTunnelMessage(await tunnel.recv());
+      const msgType = String(message.type ?? "");
+      if (msgType === "ws_message" || msgType === "ws_close" || msgType === "ws_error") {
+        const queue = activeWsQueues.get(String(message.connection_id ?? ""));
+        if (queue) {
+          queue.push(message);
+          continue;
+        }
+      }
+      if (msgType !== "service_proxy_request_body") throw new Error("invalid_body_stream");
+      if (String(message.request_id ?? "") !== requestId) throw new Error("request body stream request_id mismatch");
+      if (isRecord4(message.error)) throw new Error(String(message.error.message ?? "request body stream failed"));
+      const dataText = String(message.data_base64 ?? "");
+      if (dataText) yield decodeBase64Strict(dataText);
+      if (message.done === true) return;
+    }
+  }
+  _createWebSocket(url, protocols, options, requireHeaders) {
+    if (this._webSocketFactory) return this._webSocketFactory(url, protocols, options);
+    if (requireHeaders && options.headers && Object.keys(options.headers).length > 0) {
+      throw new AuthError("Browser WebSocket cannot set Authorization header; pass webSocketFactory to ServiceProxyClient");
+    }
+    return new WebSocket(url, protocols);
+  }
+  async _connectProxyWs() {
+    const proxyUrl = await this.discoverProxyWsUrl();
+    const token = await this._ensureAccessToken();
+    if (!token) throw new AuthError("AUN access_token is required for Service Proxy tunnel");
+    const ws = this._createWebSocket(
+      proxyUrl,
+      void 0,
+      {
+        headers: { Authorization: `Bearer ${token}` },
+        maxPayloadBytes: this.maxTunnelMessageBytes,
+        verifySsl: this._shouldVerifySsl()
+      },
+      true
+    );
+    await waitForWsOpen(ws);
+    return new TunnelSocket(ws);
+  }
+  _gatewayCallMethod(required) {
+    const call = this._aunClient?.call;
+    if (typeof call === "function") return (method, params) => Promise.resolve(call.call(this._aunClient, method, params ?? {}));
+    if (required) throw new ValidationError("Gateway service registration requires aunClient with call()");
+    return async () => ({ skipped: true });
+  }
+  async _autoRegisterServicesWithGateway() {
+    const call = this._aunClient?.call;
+    if (typeof call !== "function") return { skipped: true };
+    return this.registerServicesWithGateway();
+  }
+  _issuerDomainForAid(aid) {
+    const target = String(aid ?? "").trim().toLowerCase();
+    if (!target.includes(".")) return "";
+    return target.split(".").slice(1).join(".").replace(/^\.+|\.+$/g, "");
+  }
+  _proxyWellKnownUrls() {
+    const issuer = this._issuerDomainForAid(this.providerAid);
+    if (!this.providerAid || !issuer) throw new ValidationError("providerAid must be a full AID for Service Proxy discovery");
+    return [`https://${this.providerAid}/.well-known/aun-proxy`, `https://proxy.${issuer}/.well-known/aun-proxy`];
+  }
+  _normalizeProxyWsUrl(rawUrl) {
+    const value = String(rawUrl ?? "").trim();
+    if (!value) return "";
+    let parsed;
+    try {
+      parsed = new URL(value);
+    } catch {
+      return "";
+    }
+    if (parsed.protocol === "ws:" && this._shouldVerifySsl()) return "";
+    if (parsed.protocol !== "wss:" && parsed.protocol !== "ws:") return "";
+    if (parsed.username || parsed.password || !parsed.hostname || parsed.pathname === "/") return "";
+    parsed.hash = "";
+    return parsed.toString();
+  }
+  _selectProxyWsUrl(payload) {
+    const direct = this._normalizeProxyWsUrl(String(payload.ws_url ?? ""));
+    if (direct) return direct;
+    const servers = Array.isArray(payload.proxy_servers) ? payload.proxy_servers.filter(isRecord4) : [];
+    servers.sort((a, b) => Number(a.priority ?? 999) - Number(b.priority ?? 999));
+    for (const item of servers) {
+      const url = this._normalizeProxyWsUrl(String(item.ws_url ?? ""));
+      if (url) return url;
+    }
+    return "";
+  }
+  async _fetchProxyWellKnown(wellKnownUrl, timeoutSeconds) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), Math.max(100, timeoutSeconds * 1e3));
+    try {
+      const response = await fetch(wellKnownUrl, { signal: controller.signal });
+      if (!response.ok) throw new Error(`HTTP ${response.status}`);
+      const payload = await response.json();
+      if (!isRecord4(payload)) throw new ValidationError("Service Proxy well-known returned invalid payload");
+      const wsUrl = this._selectProxyWsUrl(payload);
+      if (!wsUrl) throw new ValidationError("Service Proxy well-known missing valid ws_url");
+      return { ...payload, ws_url: wsUrl, source_url: wellKnownUrl, discovered_at: Date.now() / 1e3 };
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  async _loadCachedProxyDiscovery() {
+    const tokenStore = this._aunClient?._tokenStore;
+    if (!tokenStore) return null;
+    try {
+      let raw = "";
+      if (typeof tokenStore.getMetadata === "function") raw = await tokenStore.getMetadata(this.providerAid, PROXY_DISCOVERY_CACHE_KEY);
+      else if (typeof tokenStore.loadMetadata === "function") raw = (await tokenStore.loadMetadata(this.providerAid))?.[PROXY_DISCOVERY_CACHE_KEY];
+      const cached = typeof raw === "string" ? JSON.parse(raw) : raw;
+      if (!isRecord4(cached)) return null;
+      const wsUrl = this._normalizeProxyWsUrl(String(cached.ws_url ?? ""));
+      if (!wsUrl) return null;
+      const discoveredAt = Number(cached.discovered_at ?? 0);
+      if (!Number.isFinite(discoveredAt) || Date.now() - discoveredAt * 1e3 >= PROXY_DISCOVERY_CACHE_TTL_MS) return null;
+      return { ...cached, ws_url: wsUrl, cached: true };
+    } catch {
+      return null;
+    }
+  }
+  async _persistProxyDiscovery(discovery) {
+    const tokenStore = this._aunClient?._tokenStore;
+    if (!tokenStore || typeof tokenStore.setMetadata !== "function" || !this.providerAid) return;
+    try {
+      await tokenStore.setMetadata(this.providerAid, PROXY_DISCOVERY_CACHE_KEY, JSON.stringify(discovery));
+    } catch (exc) {
+      this._logWarn(`Service Proxy discovery cache write failed: ${formatError(exc)}`);
+    }
+  }
+  _shouldVerifySsl() {
+    const client = this._aunClient;
+    const cfg = client?.configModel ?? client?._configModel;
+    if (cfg && (typeof cfg.verifySsl === "boolean" || typeof cfg.verify_ssl === "boolean")) return Boolean(cfg.verifySsl ?? cfg.verify_ssl);
+    const aid = client?.currentAid ?? client?._currentAid;
+    if (aid && (typeof aid.verifySsl === "boolean" || typeof aid.verify_ssl === "boolean")) return Boolean(aid.verifySsl ?? aid.verify_ssl);
+    return true;
+  }
+  _mappingAccessToken(mapping) {
+    if (!mapping) return "";
+    const token = String(mapping.access_token ?? mapping.token ?? mapping.kite_token ?? "").trim();
+    if (!token) return "";
+    const expiresAt = Number(mapping.access_token_expires_at ?? mapping.expires_at ?? 0);
+    if (Number.isFinite(expiresAt) && expiresAt > 0 && expiresAt <= Date.now() / 1e3 + TOKEN_EXPIRY_SKEW_SECONDS) return "";
+    return token;
+  }
+  async _resolveCachedAccessToken() {
+    const client = this._aunClient;
+    if (!client) return "";
+    const direct = this._mappingAccessToken(client);
+    if (direct) return direct;
+    if (isRecord4(client._identity)) {
+      const token = this._mappingAccessToken(client._identity);
+      if (token) return token;
+    }
+    const auth = client._auth;
+    if (auth && typeof auth.loadIdentityOrNone === "function") {
+      try {
+        const token = this._mappingAccessToken(await auth.loadIdentityOrNone(this.providerAid));
+        if (token) return token;
+      } catch {
+      }
+    }
+    const tokenStore = client._tokenStore;
+    if (tokenStore && typeof tokenStore.loadInstanceState === "function") {
+      try {
+        const deviceId = String(client.deviceId ?? client.device_id ?? client._deviceId ?? client._device_id ?? "");
+        const slotId = String(client.slotId ?? client.slot_id ?? client._slotId ?? client._slot_id ?? "");
+        const token = this._mappingAccessToken(await tokenStore.loadInstanceState(this.providerAid, deviceId, slotId));
+        if (token) return token;
+      } catch {
+      }
+    }
+    return "";
+  }
+  async _authenticateForAccessToken() {
+    const authenticate = this._aunClient?.authenticate;
+    if (typeof authenticate !== "function") throw new AuthError("Service Proxy tunnel requires aunClient.authenticate() for AUN token authentication");
+    let result;
+    try {
+      result = await authenticate.call(this._aunClient);
+    } catch (exc) {
+      throw new AuthError(`AUNClient authenticate failed for Service Proxy tunnel: ${formatError(exc)}`);
+    }
+    const token = this._mappingAccessToken(isRecord4(result) ? result : null);
+    if (token) return token;
+    throw new AuthError("AUNClient authenticate did not return a valid access_token");
+  }
+  async _ensureAccessToken() {
+    return await this._resolveCachedAccessToken() || await this._authenticateForAccessToken();
+  }
+  _logWarn(message) {
+    try {
+      this._logger?.warn(message);
+    } catch {
+    }
+  }
+};
+function normalizeServiceName(serviceName) {
+  const value = String(serviceName ?? "").trim();
+  if (!value) throw new ValidationError("service_name is required");
+  if (RESERVED_SERVICE_NAMES.has(value)) throw new ValidationError("service_name is reserved");
+  if (!SERVICE_NAME_RE.test(value)) throw new ValidationError("service_name must match [a-z0-9_-]+");
+  return value;
+}
+function normalizeHost(host) {
+  return String(host ?? "").trim().toLowerCase().replace(/\.+$/g, "");
+}
+function isIPv4LoopbackHost(host) {
+  const parts = host.split(".");
+  if (parts.length !== 4 || parts[0] !== "127") return false;
+  return parts.every((part) => /^\d{1,3}$/.test(part) && Number(part) >= 0 && Number(part) <= 255);
+}
+function isRecord4(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function isSensitiveMetadataKey(key) {
+  const normalized = key.trim().toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
+  return SENSITIVE_METADATA_KEYS.has(normalized) || /(_token|_secret|_password|_private_key)$/.test(normalized);
+}
+function sanitizeMetadata(metadata) {
+  const out = {};
+  for (const [key, value] of Object.entries(metadata ?? {})) {
+    if (isSensitiveMetadataKey(key)) continue;
+    if (isRecord4(value)) out[key] = sanitizeMetadata(value);
+    else if (Array.isArray(value)) out[key] = value.map((item) => isRecord4(item) ? sanitizeMetadata(item) : item);
+    else out[key] = value;
+  }
+  return out;
+}
+function headersMap(headers) {
+  const result = {};
+  if (!isRecord4(headers)) return result;
+  for (const [key, value] of Object.entries(headers)) result[key.toLowerCase()] = String(value);
+  return result;
+}
+function streamModeFrom(headers, record, message) {
+  let value = String(message.stream_mode ?? "").trim().toLowerCase();
+  if (!value) value = String(headers["x-stream-mode"] ?? "").trim().toLowerCase();
+  if (!value) value = String(record.metadata.stream_mode ?? "").trim().toLowerCase();
+  if (value === "always") return "stream";
+  return VALID_STREAM_MODES.has(value) ? value : "auto";
+}
+function detectRequestProtocol(message, record) {
+  const headers = headersMap(isRecord4(message.headers) ? message.headers : {});
+  const streamMode = streamModeFrom(headers, record, message);
+  let serviceType = String(message.service_type ?? "").trim().toLowerCase() || record.service_type.toLowerCase() || "http";
+  if (streamMode === "no_stream") {
+    serviceType = "http";
+  } else if (!message.service_type) {
+    const explicitType = String(headers["x-service-type"] ?? "").trim().toLowerCase();
+    const method = String(message.method ?? "").toUpperCase();
+    const path = String(message.path ?? "").toLowerCase();
+    const accept = String(headers.accept ?? "").toLowerCase();
+    const contentType = String(headers["content-type"] ?? "").toLowerCase();
+    if (explicitType) serviceType = explicitType;
+    else if (accept.includes("text/event-stream")) serviceType = "sse";
+    else if ("mcp-session-id" in headers) serviceType = "mcp";
+    else if (method === "POST" && bodyHasJsonRpc(message)) serviceType = "mcp";
+    else if (contentType.startsWith("application/grpc")) serviceType = "ws";
+    else if (path.includes("/mcp")) serviceType = "mcp";
+    else if (path.includes("/sse") || path.includes("/events")) serviceType = "sse";
+    else if (path.includes("/download") || path.includes("/files/")) serviceType = "file";
+  }
+  let isStream;
+  if (streamMode === "stream") isStream = true;
+  else if (streamMode === "no_stream") isStream = false;
+  else if ("is_stream" in message) isStream = Boolean(message.is_stream);
+  else if ("stream" in message) isStream = Boolean(message.stream);
+  else isStream = STREAMING_SERVICE_TYPES.has(serviceType);
+  return { serviceType, streamMode, isStream };
+}
+function bodyHasJsonRpc(message) {
+  const raw = String(message.body_base64 ?? "");
+  if (!raw) return false;
+  let text = "";
+  try {
+    text = new TextDecoder().decode(decodeBase64Strict(raw));
+  } catch {
+    return false;
+  }
+  if (text.includes('"jsonrpc"') || text.includes("'jsonrpc'")) return true;
+  try {
+    const parsed = JSON.parse(text);
+    if (isRecord4(parsed)) return String(parsed.jsonrpc ?? "") === "2.0";
+    if (Array.isArray(parsed)) return parsed.some((item) => isRecord4(item) && String(item.jsonrpc ?? "") === "2.0");
+  } catch {
+  }
+  return false;
+}
+function backendHeaders(headers) {
+  const result = {};
+  for (const [key, value] of Object.entries(headers)) {
+    const name = key.toLowerCase();
+    if (HOP_BY_HOP_HEADERS.has(name) || name === "host") continue;
+    result[name] = String(value);
+  }
+  return result;
+}
+function responseHeadersMap(headers) {
+  const result = {};
+  headers.forEach((value, key) => {
+    const name = key.toLowerCase();
+    if (HOP_BY_HOP_HEADERS.has(name) || AUTO_RESPONSE_HEADERS.has(name)) return;
+    result[name] = value;
+  });
+  return result;
+}
+function isStreamResponseHeaders(headers) {
+  const contentType = String(headers["content-type"] ?? "").split(";", 1)[0].trim().toLowerCase();
+  const contentDisposition = String(headers["content-disposition"] ?? "").toLowerCase();
+  if (String(headers["content-type"] ?? "").toLowerCase().includes("text/event-stream")) return true;
+  if (FILE_CONTENT_TYPES.has(contentType)) return true;
+  if (contentType.startsWith("image/") || contentType.startsWith("video/")) return true;
+  return contentDisposition.includes("attachment");
+}
+function streamTypeFromResponse(headers, fallback) {
+  const contentType = String(headers["content-type"] ?? "").toLowerCase();
+  if (contentType.includes("text/event-stream")) return "sse";
+  if (isStreamResponseHeaders(headers)) return "file";
+  return String(fallback || "stream").trim().toLowerCase() || "stream";
+}
+function normalizePath(path) {
+  const text = String(path || "/");
+  return text.startsWith("/") ? text : `/${text}`;
+}
+function buildTargetUrl(endpoint, path, queryString) {
+  const base = endpoint.replace(/\/+$/g, "") + "/";
+  const url = new URL(path.replace(/^\/+/g, ""), base);
+  if (queryString) url.search = queryString.startsWith("?") ? queryString : `?${queryString}`;
+  return url.toString();
+}
+function errorMessage(requestId, code, message) {
+  return { type: "service_proxy_error", request_id: requestId, error: { code, message } };
+}
+function wsErrorMessage(connectionId, code, message) {
+  return { type: "ws_error", connection_id: connectionId, error: { code, message } };
+}
+function streamMessage(requestId, index, status, headers, data, done) {
+  return { type: "service_proxy_stream", request_id: requestId, index, status: index === 0 ? status : null, headers: index === 0 ? headers : {}, data_base64: encodeBase64(data), done };
+}
+function parseTunnelMessage(raw) {
+  if (raw === null) throw new ConnectionError("Service Proxy tunnel closed");
+  const parsed = JSON.parse(raw);
+  return isRecord4(parsed) ? parsed : {};
+}
+function waitForWsOpen(ws) {
+  return new Promise((resolve, reject) => {
+    const cleanup = () => {
+      ws.removeEventListener("open", onOpen);
+      ws.removeEventListener("error", onError);
+    };
+    const onOpen = (_event) => {
+      cleanup();
+      resolve();
+    };
+    const onError = (_event) => {
+      cleanup();
+      reject(new ConnectionError("websocket connect failed"));
+    };
+    ws.addEventListener("open", onOpen);
+    ws.addEventListener("error", onError);
+  });
+}
+async function* responseChunks(response, chunkSize) {
+  if (!response.body) {
+    const bytes = new Uint8Array(await response.arrayBuffer());
+    for (let offset = 0; offset < bytes.length; offset += chunkSize) yield bytes.slice(offset, offset + chunkSize);
+    return;
+  }
+  const reader = response.body.getReader();
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) return;
+      if (!value) continue;
+      for (let offset = 0; offset < value.length; offset += chunkSize) yield value.slice(offset, offset + chunkSize);
+    }
+  } finally {
+    reader.releaseLock();
+  }
+}
+function readableStreamFromAsyncIterable(iterable) {
+  const iterator = iterable[Symbol.asyncIterator]();
+  return new ReadableStream({
+    async pull(controller) {
+      const { done, value } = await iterator.next();
+      if (done) controller.close();
+      else controller.enqueue(value);
+    },
+    async cancel() {
+      await iterator.return?.();
+    }
+  });
+}
+var B64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+function encodeBase64(bytes) {
+  let out = "";
+  let i = 0;
+  for (; i + 2 < bytes.length; i += 3) {
+    const n = bytes[i] << 16 | bytes[i + 1] << 8 | bytes[i + 2];
+    out += B64[n >> 18 & 63] + B64[n >> 12 & 63] + B64[n >> 6 & 63] + B64[n & 63];
+  }
+  if (i < bytes.length) {
+    const a = bytes[i];
+    const b = i + 1 < bytes.length ? bytes[i + 1] : 0;
+    const n = a << 16 | b << 8;
+    out += B64[n >> 18 & 63] + B64[n >> 12 & 63] + (i + 1 < bytes.length ? B64[n >> 6 & 63] : "=") + "=";
+  }
+  return out;
+}
+function decodeBase64Strict(value) {
+  const text = String(value ?? "").trim();
+  if (!text) return new Uint8Array();
+  if (text.length % 4 === 1 || !/^[A-Za-z0-9+/]*={0,2}$/.test(text)) throw new Error("invalid base64");
+  const clean2 = text.replace(/=+$/g, "");
+  const bytes = [];
+  let buffer = 0;
+  let bits = 0;
+  for (const ch of clean2) {
+    const v = B64.indexOf(ch);
+    if (v < 0) throw new Error("invalid base64");
+    buffer = buffer << 6 | v;
+    bits += 6;
+    if (bits >= 8) {
+      bits -= 8;
+      bytes.push(buffer >> bits & 255);
+    }
+  }
+  return new Uint8Array(bytes);
+}
+function toExactArrayBuffer(bytes) {
+  return bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
+}
+async function bytesFromWsData(data) {
+  if (data instanceof ArrayBuffer) return new Uint8Array(data);
+  if (ArrayBuffer.isView(data)) return new Uint8Array(data.buffer, data.byteOffset, data.byteLength);
+  if (data instanceof Blob) return new Uint8Array(await data.arrayBuffer());
+  return new TextEncoder().encode(String(data ?? ""));
+}
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function formatError(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+
 // src/secret-store/index.ts
 async function createDefaultSecretStore(encryptionSeed) {
   const { IndexedDBSecretStore: IndexedDBSecretStore2 } = await Promise.resolve().then(() => (init_indexeddb_store(), indexeddb_store_exports));
@@ -18538,6 +20097,8 @@ export {
   E2EEGroupEpochMismatchError,
   E2EEGroupNotMemberError,
   E2EEGroupSecretMissingError,
+  EmbeddedServiceRegistry,
+  EndpointPolicy,
   EventDispatcher,
   GatewayDiscovery,
   GroupError,
@@ -18557,6 +20118,8 @@ export {
   STATE_PREFIX,
   SeedMigrationError,
   SerializationError,
+  ServiceProxyClient,
+  ServiceRecord,
   SessionError,
   StateError,
   Subscription,