@awiki/dsh-plugin 0.2.5 → 0.3.0-rc.2

package/lib/index.js

@@ -1,4 +1,4 @@
-import { n as downloadedAttachment } from "./sdk-adapter-DKgkyApB.mjs";
+import { n as downloadedAttachment } from "./sdk-adapter-BIbsJmRj.mjs";
 import "@deepseek-ai/cordis";
 import { homedir } from "node:os";
 import { isAbsolute, join } from "node:path";
@@ -592,15 +592,15 @@ const AWIKI_SETTINGS_RPC_ENDPOINTS = {
 //#endregion
 //#region lib/types/settings-rpc.js
 /** Loopback-only Host transport for AWiki's durable plugin settings. */
-function isRecord$1(value) {
+function isRecord$2(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function expectedRevision(payload) {
-	if (!isRecord$1(payload) || !Number.isSafeInteger(payload.expectedRevision) || payload.expectedRevision < 0) return;
+	if (!isRecord$2(payload) || !Number.isSafeInteger(payload.expectedRevision) || payload.expectedRevision < 0) return;
 	return payload.expectedRevision;
 }
 function sanitizeLayer(value) {
-	if (!isRecord$1(value)) return void 0;
+	if (!isRecord$2(value)) return void 0;
 	if (!Object.hasOwn(value, "domain")) return {};
 	if (typeof value["domain"] !== "string") return void 0;
 	const domain = normalizeAwikiDomain(value[AWIKI_DOMAIN_FIELD]);
@@ -609,7 +609,7 @@ function sanitizeLayer(value) {
 }
 function view(provider) {
 	const descriptor = provider.describe({ redactSecrets: true }).find((candidate) => candidate.ns === AWIKI_SETTINGS_NAMESPACE);
-	if (descriptor === void 0 || !isRecord$1(descriptor.value) || typeof descriptor.value.domain !== "string") return;
+	if (descriptor === void 0 || !isRecord$2(descriptor.value) || typeof descriptor.value.domain !== "string") return;
 	const domain = normalizeAwikiDomain(descriptor.value.domain);
 	if (domain !== descriptor.value.domain) return void 0;
 	const base = descriptor.base === void 0 ? void 0 : sanitizeLayer(descriptor.base);
@@ -660,7 +660,7 @@ function createAwikiSettingsRpcHandler(getProvider) {
 		const provider = getProvider();
 		if (provider === void 0) return unavailable();
 		if (endpoint === AWIKI_SETTINGS_RPC_ENDPOINTS.describe) {
-			if (!isRecord$1(payload)) return badRequest();
+			if (!isRecord$2(payload)) return badRequest();
 			const current = view(provider);
 			return current === void 0 ? unavailable() : {
 				ok: true,
@@ -671,7 +671,7 @@ function createAwikiSettingsRpcHandler(getProvider) {
 		if (revision === void 0) return badRequest();
 		let operation;
 		if (endpoint === AWIKI_SETTINGS_RPC_ENDPOINTS.setDomain) {
-			if (!isRecord$1(payload) || typeof payload.domain !== "string") return badRequest();
+			if (!isRecord$2(payload) || typeof payload.domain !== "string") return badRequest();
 			let domain;
 			try {
 				domain = normalizeAwikiDomain(payload.domain);
@@ -740,7 +740,7 @@ var AwikiSessionStore = class {
 			if (await readFile(this.markerPath, "utf8") !== SIGNED_OUT_MARKER) throw new TypeError("awiki: local session marker is invalid");
 			return true;
 		} catch (error) {
-			if (isMissing$2(error)) return false;
+			if (isMissing$4(error)) return false;
 			throw error;
 		}
 	}
@@ -758,7 +758,7 @@ var AwikiSessionStore = class {
 				mode: 384
 			});
 		} catch (error) {
-			if (!isFileExists$1(error) || !await this.isSignedOut()) throw error;
+			if (!isFileExists$3(error) || !await this.isSignedOut()) throw error;
 		}
 		await chmod(this.markerPath, 384);
 	}
@@ -767,7 +767,7 @@ var AwikiSessionStore = class {
 		try {
 			await unlink(this.markerPath);
 		} catch (error) {
-			if (!isMissing$2(error)) throw error;
+			if (!isMissing$4(error)) throw error;
 		}
 	}
 	async hasPrivateHostDirectory() {
@@ -776,15 +776,15 @@ var AwikiSessionStore = class {
 			if (!directory.isDirectory() || directory.isSymbolicLink()) throw new TypeError("awiki: local session directory is invalid");
 			return true;
 		} catch (error) {
-			if (isMissing$2(error)) return false;
+			if (isMissing$4(error)) return false;
 			throw error;
 		}
 	}
 };
-function isMissing$2(error) {
+function isMissing$4(error) {
 	return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
 }
-function isFileExists$1(error) {
+function isFileExists$3(error) {
 	return typeof error === "object" && error !== null && "code" in error && error.code === "EEXIST";
 }
 //#endregion
@@ -877,7 +877,7 @@ var AwikiImageAttachmentCache = class {
 				force: true
 			});
 		} catch (error) {
-			if (!isMissing$1(error)) throw error;
+			if (!isMissing$3(error)) throw error;
 		}
 	}
 	decode(input, ownerDid, request) {
@@ -903,7 +903,7 @@ var AwikiImageAttachmentCache = class {
 		if (!await this.hasPrivateDirectory(this.hostDirectory)) throw new TypeError("awiki: local Host directory is invalid");
 		await chmod(this.hostDirectory, 448);
 		await mkdir(this.directory, { mode: 448 }).catch((error) => {
-			if (!isFileExists(error)) throw error;
+			if (!isFileExists$2(error)) throw error;
 		});
 		if (!await this.hasPrivateDirectory(this.directory)) throw new TypeError("awiki: local image cache directory is invalid");
 		await chmod(this.directory, 448);
@@ -941,17 +941,511 @@ var AwikiImageAttachmentCache = class {
 			if (!metadata.isDirectory() || metadata.isSymbolicLink()) throw new TypeError("awiki: local image cache path is invalid");
 			return true;
 		} catch (error) {
-			if (isMissing$1(error)) return false;
+			if (isMissing$3(error)) return false;
+			throw error;
+		}
+	}
+};
+function isMissing$3(error) {
+	return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
+}
+function isFileExists$2(error) {
+	return typeof error === "object" && error !== null && "code" in error && error.code === "EEXIST";
+}
+//#endregion
+//#region lib/types/sent-mail-store.js
+/** Private, owner-bound persistence for mail successfully sent by this installation. */
+const STORE_VERSION$1 = 1;
+const STORE_DIRECTORY$1 = "sent-mail-v1";
+const MAX_RECORDS = 200;
+const MAX_STORE_BYTES$1 = 16777216;
+const PREVIEW_CHARACTERS = 160;
+const LOCAL_SENT_MAIL_ID_PREFIX = "awiki-sent-v1:";
+function invalidState$1() {
+	throw new TypeError("awiki: local sent-mail history is invalid");
+}
+function isMissing$2(error) {
+	return typeof error === "object" && error !== null && error.code === "ENOENT";
+}
+function isFileExists$1(error) {
+	return typeof error === "object" && error !== null && error.code === "EEXIST";
+}
+function validToken(value, maxCharacters) {
+	return typeof value === "string" && value.length > 0 && value.trim() === value && Array.from(value).length <= maxCharacters && !/[\u0000-\u001f\u007f-\u009f]/u.test(value);
+}
+function validAddress(value) {
+	return typeof value === "string" && Array.from(value).length >= 3 && Array.from(value).length <= 320 && value.includes("@") && !/[\s\u0000-\u001f\u007f-\u009f]/u.test(value);
+}
+function decodeRecord(input) {
+	if (typeof input !== "object" || input === null || Array.isArray(input)) invalidState$1();
+	const value = input;
+	if (typeof value.id !== "string" || !/^awiki-sent-v1:[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/u.test(value.id) || value.serviceMessageId !== void 0 && !validToken(value.serviceMessageId, 2048) || value.from !== void 0 && !validAddress(value.from) || typeof value.sentAt !== "string" || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/u.test(value.sentAt) || !Number.isFinite(Date.parse(value.sentAt))) invalidState$1();
+	let request;
+	try {
+		request = mailSendRequest({
+			to: value.to,
+			cc: value.cc,
+			subject: value.subject,
+			bodyText: value.bodyText
+		});
+	} catch {
+		invalidState$1();
+	}
+	return {
+		id: value.id,
+		...value.serviceMessageId === void 0 ? {} : { serviceMessageId: value.serviceMessageId },
+		...value.from === void 0 ? {} : { from: value.from },
+		to: [...request.to],
+		cc: [...request.cc ?? []],
+		subject: request.subject,
+		bodyText: request.bodyText,
+		sentAt: value.sentAt
+	};
+}
+function message(record) {
+	const characters = Array.from(record.bodyText);
+	const preview = characters.slice(0, PREVIEW_CHARACTERS).join("");
+	return {
+		summary: {
+			id: record.id,
+			folder: "sent",
+			from: record.from === void 0 ? [] : [record.from],
+			to: [...record.to],
+			cc: [...record.cc],
+			subject: record.subject,
+			subjectTruncated: false,
+			preview,
+			previewTruncated: characters.length > PREVIEW_CHARACTERS,
+			sentAt: record.sentAt,
+			unread: false,
+			hasAttachments: false,
+			attachmentCount: 0
+		},
+		bodyText: record.bodyText,
+		bodyTruncated: false,
+		hasHtmlBody: false,
+		attachments: []
+	};
+}
+function isLocalSentMailId(messageId) {
+	return String(messageId).startsWith(LOCAL_SENT_MAIL_ID_PREFIX);
+}
+/** Atomic, bounded history of sends accepted by the Mail Service. */
+var AwikiSentMailStore = class {
+	hostDirectory;
+	directory;
+	mutation = Promise.resolve();
+	constructor(stateRoot) {
+		this.hostDirectory = join(stateRoot, ".host");
+		this.directory = join(this.hostDirectory, STORE_DIRECTORY$1);
+	}
+	async list(ownerDid, request) {
+		const records = request.unreadOnly === true ? [] : await this.load(ownerDid);
+		const offset = request.offset ?? 0;
+		const limit = request.limit ?? 20;
+		const page = records.slice(offset, offset + limit);
+		const nextOffset = offset + page.length;
+		const hasMore = nextOffset < records.length;
+		return {
+			items: page.map((record) => message(record).summary),
+			...hasMore ? { nextOffset } : {},
+			hasMore
+		};
+	}
+	async read(ownerDid, messageId) {
+		if (!isLocalSentMailId(messageId)) return void 0;
+		const record = (await this.load(ownerDid)).find((candidate) => candidate.id === String(messageId));
+		return record === void 0 ? void 0 : message(record);
+	}
+	append(ownerDid, request, result, account) {
+		const normalized = mailSendRequest(request);
+		const record = {
+			id: `${LOCAL_SENT_MAIL_ID_PREFIX}${randomUUID()}`,
+			...result.messageId === void 0 ? {} : { serviceMessageId: String(result.messageId) },
+			...account?.mailboxAddress === void 0 ? {} : { from: account.mailboxAddress },
+			to: [...normalized.to],
+			cc: [...normalized.cc ?? []],
+			subject: normalized.subject,
+			bodyText: normalized.bodyText,
+			sentAt: (/* @__PURE__ */ new Date()).toISOString()
+		};
+		const append = async () => {
+			const records = await this.load(ownerDid);
+			await this.write(ownerDid, [record, ...records].slice(0, MAX_RECORDS));
+		};
+		const pending = this.mutation.then(append, append);
+		this.mutation = pending.catch(() => void 0);
+		return pending;
+	}
+	async clear() {
+		await this.mutation;
+		try {
+			if (!await this.hasDirectory(this.hostDirectory)) return;
+			const metadata = await lstat(this.directory);
+			if (metadata.isSymbolicLink() || !metadata.isDirectory()) {
+				await unlink(this.directory);
+				return;
+			}
+			await rm(this.directory, {
+				recursive: true,
+				force: true
+			});
+		} catch (error) {
+			if (!isMissing$2(error)) throw error;
+		}
+	}
+	async load(ownerDid) {
+		if (!await this.hasDirectory(this.hostDirectory) || !await this.hasDirectory(this.directory)) return [];
+		const path = this.path(ownerDid);
+		let text;
+		try {
+			const metadata = await lstat(path);
+			if (!metadata.isFile() || metadata.isSymbolicLink() || metadata.size > MAX_STORE_BYTES$1) invalidState$1();
+			text = await readFile(path, "utf8");
+		} catch (error) {
+			if (isMissing$2(error)) return [];
+			throw error;
+		}
+		let parsed;
+		try {
+			parsed = JSON.parse(text);
+		} catch {
+			invalidState$1();
+		}
+		if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) invalidState$1();
+		const value = parsed;
+		if (value.version !== STORE_VERSION$1 || value.ownerDid !== String(ownerDid) || !Array.isArray(value.records) || value.records.length > MAX_RECORDS) invalidState$1();
+		return value.records.map(decodeRecord);
+	}
+	async write(ownerDid, records) {
+		await this.ensureDirectory();
+		const path = this.path(ownerDid);
+		const temporary = join(this.directory, `.${this.key(ownerDid)}.${randomUUID()}.tmp`);
+		const text = JSON.stringify({
+			version: STORE_VERSION$1,
+			ownerDid: String(ownerDid),
+			records
+		});
+		if (Buffer.byteLength(text, "utf8") > MAX_STORE_BYTES$1) invalidState$1();
+		try {
+			await writeFile(temporary, text, {
+				flag: "wx",
+				mode: 384
+			});
+			await rename(temporary, path);
+			await chmod(path, 384);
+		} finally {
+			await unlink(temporary).catch(() => void 0);
+		}
+	}
+	async ensureDirectory() {
+		await mkdir(this.hostDirectory, {
+			recursive: true,
+			mode: 448
+		});
+		if (!await this.hasDirectory(this.hostDirectory)) invalidState$1();
+		await chmod(this.hostDirectory, 448);
+		await mkdir(this.directory, { mode: 448 }).catch((error) => {
+			if (!isFileExists$1(error)) throw error;
+		});
+		if (!await this.hasDirectory(this.directory)) invalidState$1();
+		await chmod(this.directory, 448);
+	}
+	async hasDirectory(path) {
+		try {
+			const metadata = await lstat(path);
+			if (!metadata.isDirectory() || metadata.isSymbolicLink()) invalidState$1();
+			return true;
+		} catch (error) {
+			if (isMissing$2(error)) return false;
 			throw error;
 		}
 	}
+	path(ownerDid) {
+		return join(this.directory, `${this.key(ownerDid)}.json`);
+	}
+	key(ownerDid) {
+		return createHash("sha256").update(String(ownerDid)).digest("hex");
+	}
 };
+//#endregion
+//#region lib/types/conversation-preferences.js
+const STORE_VERSION = 1;
+const STORE_DIRECTORY = "conversation-preferences";
+const MAX_STORE_BYTES = 2097152;
+const MAX_HIDDEN_CONVERSATIONS = 500;
+const MAX_IDENTIFIER_CHARACTERS = 2048;
+const MAX_TITLE_CHARACTERS = 1024;
+const MAX_PREVIEW_CHARACTERS = 4096;
+const MAX_HANDLE_CHARACTERS = 512;
+const MAX_RECOVERY_SIGNATURE_CHARACTERS = 128;
+function invalidState() {
+	throw new TypeError("awiki: conversation preferences are invalid");
+}
 function isMissing$1(error) {
 	return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
 }
 function isFileExists(error) {
 	return typeof error === "object" && error !== null && "code" in error && error.code === "EEXIST";
 }
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function boundedString$1(value, maximum) {
+	if (typeof value !== "string" || value.length === 0 || value.length > maximum * 2) invalidState();
+	if (Array.from(value).length > maximum) invalidState();
+	return value;
+}
+function optionalString(value, maximum) {
+	return value === void 0 ? void 0 : boundedString$1(value, maximum);
+}
+function optionalCount(value) {
+	if (value === void 0) return void 0;
+	if (!Number.isSafeInteger(value) || value < 0 || value > 4294967295) invalidState();
+	return value;
+}
+function optionalTimestamp(value) {
+	if (value === void 0) return void 0;
+	if (!Number.isSafeInteger(value) || value < 0) invalidState();
+	return value;
+}
+/** Rebuild a bounded display-only snapshot before it reaches private persistence. */
+function conversation(value) {
+	if (!isRecord$1(value)) invalidState();
+	const kind = value.kind;
+	const id = boundedString$1(value.id, MAX_IDENTIFIER_CHARACTERS);
+	const title = boundedString$1(value.title, MAX_TITLE_CHARACTERS);
+	const unreadCount = optionalCount(value.unreadCount);
+	const lastMessageAt = optionalTimestamp(value.lastMessageAt);
+	const lastMessagePreview = optionalString(value.lastMessagePreview, MAX_PREVIEW_CHARACTERS);
+	const common = {
+		id,
+		title,
+		...unreadCount === void 0 ? {} : { unreadCount },
+		...lastMessageAt === void 0 ? {} : { lastMessageAt },
+		...lastMessagePreview === void 0 ? {} : { lastMessagePreview }
+	};
+	if (kind === "direct") {
+		const peerDid = boundedString$1(value.peerDid, MAX_IDENTIFIER_CHARACTERS);
+		if (!peerDid.startsWith("did:")) invalidState();
+		const peerHandle = optionalString(value.peerHandle, MAX_HANDLE_CHARACTERS);
+		const displayName = optionalString(value.displayName, MAX_TITLE_CHARACTERS);
+		return {
+			kind,
+			...common,
+			peerDid,
+			...peerHandle === void 0 ? {} : { peerHandle },
+			...displayName === void 0 ? {} : { displayName }
+		};
+	}
+	if (kind === "group") {
+		const groupDid = boundedString$1(value.groupDid, MAX_IDENTIFIER_CHARACTERS);
+		if (!groupDid.startsWith("did:")) invalidState();
+		return {
+			kind,
+			...common,
+			groupDid
+		};
+	}
+	invalidState();
+}
+function hiddenPreference(value) {
+	if (!isRecord$1(value) || !Number.isSafeInteger(value.hiddenAt) || value.hiddenAt < 0) invalidState();
+	return {
+		conversation: conversation(value.conversation),
+		hiddenAt: value.hiddenAt
+	};
+}
+function preferences(value, expectedOwnerDid) {
+	if (!isRecord$1(value) || value.version !== STORE_VERSION || value.ownerDid !== String(expectedOwnerDid) || !Array.isArray(value.hiddenConversations) || value.hiddenConversations.length > MAX_HIDDEN_CONVERSATIONS) invalidState();
+	const hiddenConversations = value.hiddenConversations.map(hiddenPreference);
+	const seen = /* @__PURE__ */ new Set();
+	for (const hidden of hiddenConversations) {
+		if (seen.has(hidden.conversation.id)) invalidState();
+		seen.add(hidden.conversation.id);
+	}
+	const dismissedGroupRecoverySignature = optionalString(value.dismissedGroupRecoverySignature, MAX_RECOVERY_SIGNATURE_CHARACTERS);
+	return {
+		version: STORE_VERSION,
+		ownerDid: String(expectedOwnerDid),
+		hiddenConversations,
+		...dismissedGroupRecoverySignature === void 0 ? {} : { dismissedGroupRecoverySignature }
+	};
+}
+function publicPreferences(value) {
+	return {
+		hiddenConversations: value.hiddenConversations.map((hidden) => ({
+			conversation: { ...hidden.conversation },
+			hiddenAt: hidden.hiddenAt
+		})),
+		...value.dismissedGroupRecoverySignature === void 0 ? {} : { dismissedGroupRecoverySignature: value.dismissedGroupRecoverySignature }
+	};
+}
+function emptyPreferences(ownerDid) {
+	return {
+		version: STORE_VERSION,
+		ownerDid: String(ownerDid),
+		hiddenConversations: []
+	};
+}
+/** Validate one browser mutation before entering private Host persistence. */
+function normalizeConversationPreferenceMutation(value) {
+	try {
+		if (!isRecord$1(value)) return void 0;
+		if (value.action === "hide") return {
+			action: "hide",
+			conversation: conversation(value.conversation)
+		};
+		if (value.action === "restore") return {
+			action: "restore",
+			conversationId: boundedString$1(value.conversationId, MAX_IDENTIFIER_CHARACTERS)
+		};
+		if (value.action === "dismiss-group-recovery") return {
+			action: "dismiss-group-recovery",
+			signature: boundedString$1(value.signature, MAX_RECOVERY_SIGNATURE_CHARACTERS)
+		};
+	} catch {
+		return;
+	}
+}
+/** Atomic identity-scoped product preferences, independent of Core membership and history. */
+var AwikiConversationPreferenceStore = class {
+	hostDirectory;
+	directory;
+	mutation = Promise.resolve();
+	constructor(stateRoot) {
+		this.hostDirectory = join(stateRoot, ".host");
+		this.directory = join(this.hostDirectory, STORE_DIRECTORY);
+	}
+	async get(ownerDid) {
+		await this.mutation;
+		return publicPreferences(await this.load(ownerDid));
+	}
+	update(ownerDid, request) {
+		const mutate = async () => {
+			const normalized = normalizeConversationPreferenceMutation(request);
+			if (normalized === void 0) invalidState();
+			const current = await this.load(ownerDid);
+			let next;
+			switch (normalized.action) {
+				case "hide": {
+					const snapshot = normalized.conversation;
+					const hidden = current.hiddenConversations.filter((item) => item.conversation.id !== snapshot.id);
+					hidden.unshift({
+						conversation: snapshot,
+						hiddenAt: Date.now()
+					});
+					next = {
+						...current,
+						hiddenConversations: hidden.slice(0, MAX_HIDDEN_CONVERSATIONS)
+					};
+					break;
+				}
+				case "restore": {
+					const conversationId = normalized.conversationId;
+					next = {
+						...current,
+						hiddenConversations: current.hiddenConversations.filter((item) => item.conversation.id !== conversationId)
+					};
+					break;
+				}
+				case "dismiss-group-recovery": {
+					const signature = normalized.signature;
+					next = {
+						...current,
+						dismissedGroupRecoverySignature: signature
+					};
+					break;
+				}
+				default: invalidState();
+			}
+			await this.write(ownerDid, next);
+			return publicPreferences(next);
+		};
+		const pending = this.mutation.then(mutate, mutate);
+		this.mutation = pending.then(() => void 0, () => void 0);
+		return pending;
+	}
+	async clear() {
+		await this.mutation;
+		try {
+			if (!await this.hasDirectory(this.hostDirectory)) return;
+			const metadata = await lstat(this.directory);
+			if (metadata.isSymbolicLink() || !metadata.isDirectory()) {
+				await unlink(this.directory);
+				return;
+			}
+			await rm(this.directory, {
+				recursive: true,
+				force: true
+			});
+		} catch (error) {
+			if (!isMissing$1(error)) throw error;
+		}
+	}
+	async load(ownerDid) {
+		if (!await this.hasDirectory(this.hostDirectory) || !await this.hasDirectory(this.directory)) return emptyPreferences(ownerDid);
+		const path = this.path(ownerDid);
+		try {
+			const metadata = await lstat(path);
+			if (!metadata.isFile() || metadata.isSymbolicLink() || metadata.size > MAX_STORE_BYTES) invalidState();
+			const text = await readFile(path, "utf8");
+			if (Buffer.byteLength(text, "utf8") > MAX_STORE_BYTES) invalidState();
+			return preferences(JSON.parse(text), ownerDid);
+		} catch (error) {
+			if (isMissing$1(error)) return emptyPreferences(ownerDid);
+			if (error instanceof SyntaxError) invalidState();
+			throw error;
+		}
+	}
+	async write(ownerDid, value) {
+		const snapshot = preferences(value, ownerDid);
+		const text = `${JSON.stringify(snapshot)}\n`;
+		if (Buffer.byteLength(text, "utf8") > MAX_STORE_BYTES) invalidState();
+		await this.ensureDirectory();
+		const path = this.path(ownerDid);
+		const temporary = join(this.directory, `.${this.key(ownerDid)}.${randomUUID()}.tmp`);
+		try {
+			await writeFile(temporary, text, {
+				flag: "wx",
+				mode: 384
+			});
+			await rename(temporary, path);
+			await chmod(path, 384);
+		} finally {
+			await unlink(temporary).catch(() => void 0);
+		}
+	}
+	async ensureDirectory() {
+		await mkdir(this.hostDirectory, {
+			recursive: true,
+			mode: 448
+		});
+		if (!await this.hasDirectory(this.hostDirectory)) invalidState();
+		await chmod(this.hostDirectory, 448);
+		await mkdir(this.directory, { mode: 448 }).catch((error) => {
+			if (!isFileExists(error)) throw error;
+		});
+		if (!await this.hasDirectory(this.directory)) invalidState();
+		await chmod(this.directory, 448);
+	}
+	async hasDirectory(path) {
+		try {
+			const metadata = await lstat(path);
+			if (!metadata.isDirectory() || metadata.isSymbolicLink()) invalidState();
+			return true;
+		} catch (error) {
+			if (isMissing$1(error)) return false;
+			throw error;
+		}
+	}
+	path(ownerDid) {
+		return join(this.directory, `${this.key(ownerDid)}.json`);
+	}
+	key(ownerDid) {
+		return createHash("sha256").update(String(ownerDid)).digest("hex");
+	}
+};
 //#endregion
 //#region lib/types/listener-state.js
 const STATE_VERSION = 1;
@@ -1683,8 +2177,11 @@ const FAILURE_CODES = /* @__PURE__ */ new Set([
 	"handle-unavailable",
 	"not-found",
 	"forbidden",
+	"identity-recovery-required",
 	"conflict",
 	"rate-limited",
+	"group-membership-required",
+	"group-identity-stale",
 	"attachment-too-large",
 	"summary-unavailable",
 	"summary-timeout",
@@ -1709,8 +2206,11 @@ const FAILURE_MESSAGES = {
 	"handle-unavailable": "The requested AWiki handle is unavailable.",
 	"not-found": "The requested AWiki resource was not found.",
 	"forbidden": "The AWiki operation is not permitted.",
+	"identity-recovery-required": "The local AWiki identity must be recovered before it can be used again.",
 	"conflict": "The AWiki operation conflicts with current state.",
 	"rate-limited": "The AWiki service rate-limited the request.",
+	"group-membership-required": "The active AWiki identity is not a member of this group.",
+	"group-identity-stale": "The AWiki group identity binding is still recovering.",
 	"attachment-too-large": "The attachment exceeds this deployment's size limit.",
 	"summary-unavailable": "AI summary is unavailable. Check the current default model configuration.",
 	"summary-timeout": "AI summary timed out. Try again.",
@@ -1840,11 +2340,16 @@ function normalizeFailure(error) {
 const MAX_GROUP_NAME_CHARACTERS = 100;
 const MAX_GROUP_INITIAL_MEMBERS = 50;
 const MAX_GROUP_MEMBER_CHARACTERS = 512;
+const MAX_PROFILE_DISPLAY_NAME_CHARACTERS = 50;
+const MAX_PROFILE_BIO_CHARACTERS = 100;
+const MAX_PROFILE_TAGS = 5;
+const MAX_PROFILE_TAG_CHARACTERS = 30;
+const MAX_MESSAGE_CHARACTERS = 2e4;
 function normalizeCreateGroupRequest(request) {
 	if (typeof request?.name !== "string" || !Array.isArray(request.members)) return void 0;
 	const name = request.name.trim();
 	if (name.length === 0 || Array.from(name).length > MAX_GROUP_NAME_CHARACTERS) return void 0;
-	if (request.members.length === 0 || request.members.length > MAX_GROUP_INITIAL_MEMBERS) return void 0;
+	if (request.members.length > MAX_GROUP_INITIAL_MEMBERS) return void 0;
 	const members = [];
 	const seen = /* @__PURE__ */ new Set();
 	for (const raw of request.members) {
@@ -1855,44 +2360,207 @@ function normalizeCreateGroupRequest(request) {
 		seen.add(member);
 		members.push(member);
 	}
-	return members.length === 0 ? void 0 : {
+	return {
 		name,
 		members
 	};
 }
-/** Normalize summary-provider failures without returning prompts, model output, routes, or causes. */
-function normalizeSummaryFailure(error) {
-	if (error instanceof SummaryProviderUnavailableError) return failure("summary-unavailable");
-	try {
-		if (typeof error === "object" && error !== null && Reflect.get(error, "name") === "AwikiSummaryProviderError") switch (Reflect.get(error, "code")) {
-			case "route-unavailable": return failure("summary-unavailable");
-			case "timeout": return failure("summary-timeout");
-			case "cancelled": return failure("summary-cancelled");
-			case "truncated":
-			case "tool-call":
-			case "empty-output":
-			case "invalid-output": return failure("summary-invalid-output");
-			default: return failure("summary-failed");
-		}
-	} catch {}
-	return failure("summary-failed");
+function normalizeMember(value) {
+	if (typeof value !== "string") return void 0;
+	const member = value.trim().replace(/^@+/u, "");
+	return member.length > 0 && Array.from(member).length <= MAX_GROUP_MEMBER_CHARACTERS ? member : void 0;
 }
-/** Bound one untrusted display string before it can consume the shared model budget. */
-function boundedText(value, maxCharacters, fallback = "") {
-	const text = value?.trim() ?? fallback;
-	return Array.from(text).slice(0, maxCharacters).join("");
+function normalizeGroupDid(value) {
+	if (typeof value !== "string" || !value.startsWith("did:") || value.length > 2048) return void 0;
+	return value;
 }
-/** Remove routing identifiers, attachment ids, hashes, and all binary fields from one message. */
-function minimizeSummaryMessage(message) {
-	const sender = boundedText(message.senderDisplayName ?? message.senderHandle, 50, message.outgoing ? "我" : "对方");
-	const base = {
-		id: message.id,
-		sender,
-		outgoing: message.outgoing,
-		sentAt: new Date(message.sentAt).toISOString()
+/** Rebuild the browser-safe recovery DTO instead of trusting provider object shape. */
+function publicGroupRebindRecoverySummary(value) {
+	if (typeof value !== "object" || value === null) return void 0;
+	const candidate = value;
+	if ([
+		candidate.processed,
+		candidate.completed,
+		candidate.pending,
+		candidate.blocked
+	].some((count) => !Number.isSafeInteger(count) || count < 0 || count > 4294967295)) return;
+	if (!Array.isArray(candidate.items) || candidate.items.length > 500) return void 0;
+	const seen = /* @__PURE__ */ new Set();
+	const items = [];
+	for (const value of candidate.items) {
+		if (typeof value !== "object" || value === null) return void 0;
+		const item = value;
+		const groupDid = normalizeGroupDid(item.groupDid);
+		if (groupDid === void 0 || seen.has(groupDid) || item.status !== "pending" && item.status !== "blocked") return;
+		seen.add(groupDid);
+		items.push({
+			groupDid,
+			status: item.status
+		});
+	}
+	return {
+		processed: candidate.processed,
+		completed: candidate.completed,
+		pending: candidate.pending,
+		blocked: candidate.blocked,
+		items
 	};
-	if (message.content.kind === "text") return {
-		...base,
+}
+function normalizeProfileRequest(request) {
+	if (typeof request?.displayName !== "string" || typeof request.bio !== "string" || !Array.isArray(request.tags)) return void 0;
+	const displayName = request.displayName.trim();
+	const bio = request.bio.trim();
+	if (displayName.length === 0 || Array.from(displayName).length > MAX_PROFILE_DISPLAY_NAME_CHARACTERS || Array.from(bio).length > MAX_PROFILE_BIO_CHARACTERS || request.tags.length > MAX_PROFILE_TAGS) return void 0;
+	const tags = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const raw of request.tags) {
+		if (typeof raw !== "string") return void 0;
+		const tag = raw.trim();
+		const key = tag.toLocaleLowerCase();
+		if (tag.length === 0 || Array.from(tag).length > MAX_PROFILE_TAG_CHARACTERS || seen.has(key)) return void 0;
+		seen.add(key);
+		tags.push(tag);
+	}
+	return {
+		displayName,
+		bio,
+		tags
+	};
+}
+function normalizeRecoveryOperation(request) {
+	if (typeof request?.operationId !== "string") return void 0;
+	const operationId = request.operationId.trim();
+	return operationId.length > 0 && operationId.length <= 512 ? { operationId } : void 0;
+}
+function normalizeRecoveryOtpRequest(request) {
+	if (typeof request?.fullHandle !== "string" || typeof request.phone !== "string") return void 0;
+	const fullHandle = request.fullHandle.trim().replace(/^@+/u, "");
+	const phone = request.phone.trim();
+	if (fullHandle.length === 0 || fullHandle.length > 512 || phone.length < 5 || phone.length > 32) return void 0;
+	return {
+		fullHandle,
+		phone
+	};
+}
+function normalizeRecoveryPrepareRequest(request) {
+	const operation = normalizeRecoveryOperation(request);
+	if (operation === void 0 || typeof request.phone !== "string" || typeof request.otp !== "string") return void 0;
+	const phone = request.phone.trim();
+	const otp = request.otp.trim();
+	if (phone.length < 5 || phone.length > 32 || !/^\d{4,12}$/u.test(otp)) return void 0;
+	return {
+		...operation,
+		phone,
+		otp
+	};
+}
+const IDENTITY_ACCESS_RESPONSE_MAX_BYTES = 65536;
+/** Read one untrusted discovery response without buffering beyond the fixed Host limit. */
+async function readBoundedResponseText(response, maxBytes) {
+	const declaredLength = response.headers.get("content-length");
+	if (declaredLength !== null && /^\d+$/u.test(declaredLength) && Number(declaredLength) > maxBytes) return void 0;
+	if (response.body === null) return "";
+	const reader = response.body.getReader();
+	const chunks = [];
+	let length = 0;
+	try {
+		while (true) {
+			const result = await reader.read();
+			if (result.done) break;
+			length += result.value.byteLength;
+			if (length > maxBytes) {
+				await reader.cancel();
+				return;
+			}
+			chunks.push(Uint8Array.from(result.value));
+		}
+	} catch {
+		return;
+	} finally {
+		reader.releaseLock();
+	}
+	const bytes = new Uint8Array(length);
+	let offset = 0;
+	for (const chunk of chunks) {
+		bytes.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	return Buffer.from(bytes).toString("utf8");
+}
+/** Resolve one configured-domain Handle without widening registration authority. */
+function identityAccessTarget(request, configuredDomain) {
+	if (typeof request?.handle !== "string") return void 0;
+	const raw = request.handle.trim();
+	if (raw.length === 0 || raw.length > 255 || /[\u0000-\u001f\u007f]/u.test(raw)) return void 0;
+	const lowered = raw.replace(/[A-Z]/gu, (character) => character.toLowerCase());
+	const handle = lowered.startsWith("wba://") ? lowered.slice(6) : lowered;
+	const dot = handle.indexOf(".");
+	const localPart = (dot < 0 ? handle : handle.slice(0, dot)).trim();
+	const domain = (dot < 0 ? configuredDomain : handle.slice(dot + 1)).trim().replace(/\.$/u, "");
+	if (localPart.length === 0 || domain !== configuredDomain) return void 0;
+	return {
+		localPart,
+		fullHandle: `${localPart}.${configuredDomain}`
+	};
+}
+function normalizeSendTextRequest(request) {
+	if (typeof request?.text !== "string" || typeof request.idempotencyKey !== "string" || typeof request.target !== "object" || request.target === null) return void 0;
+	const text = request.text;
+	const codePoints = Array.from(text);
+	if (text.trim().length === 0 || codePoints.length > MAX_MESSAGE_CHARACTERS || request.idempotencyKey.length === 0 || request.idempotencyKey.length > 512) return void 0;
+	if (request.target.kind === "direct") {
+		if (typeof request.target.peer !== "string" || request.mentions !== void 0) return void 0;
+	} else if (request.target.kind === "group") {
+		if (typeof request.target.group !== "string") return void 0;
+	} else return void 0;
+	if (request.mentions === void 0) return request;
+	if (!Array.isArray(request.mentions) || request.mentions.length === 0 || request.mentions.length > 100) return void 0;
+	const ids = /* @__PURE__ */ new Set();
+	let previousEnd = 0;
+	const mentions = [...request.mentions].sort((left, right) => left.start - right.start || left.end - right.end);
+	for (const mention of mentions) {
+		if (typeof mention !== "object" || mention === null || typeof mention.id !== "string" || mention.id.trim() === "" || ids.has(mention.id) || !Number.isSafeInteger(mention.start) || !Number.isSafeInteger(mention.end) || mention.start < previousEnd || mention.start < 0 || mention.end <= mention.start || mention.end > codePoints.length || typeof mention.did !== "string" || !mention.did.startsWith("did:") || mention.displayName !== void 0 && typeof mention.displayName !== "string") return void 0;
+		ids.add(mention.id);
+		previousEnd = mention.end;
+	}
+	return {
+		...request,
+		mentions
+	};
+}
+/** Normalize summary-provider failures without returning prompts, model output, routes, or causes. */
+function normalizeSummaryFailure(error) {
+	if (error instanceof SummaryProviderUnavailableError) return failure("summary-unavailable");
+	try {
+		if (typeof error === "object" && error !== null && Reflect.get(error, "name") === "AwikiSummaryProviderError") switch (Reflect.get(error, "code")) {
+			case "route-unavailable": return failure("summary-unavailable");
+			case "timeout": return failure("summary-timeout");
+			case "cancelled": return failure("summary-cancelled");
+			case "truncated":
+			case "tool-call":
+			case "empty-output":
+			case "invalid-output": return failure("summary-invalid-output");
+			default: return failure("summary-failed");
+		}
+	} catch {}
+	return failure("summary-failed");
+}
+/** Bound one untrusted display string before it can consume the shared model budget. */
+function boundedText(value, maxCharacters, fallback = "") {
+	const text = value?.trim() ?? fallback;
+	return Array.from(text).slice(0, maxCharacters).join("");
+}
+/** Remove routing identifiers, attachment ids, hashes, and all binary fields from one message. */
+function minimizeSummaryMessage(message) {
+	const sender = boundedText(message.senderDisplayName ?? message.senderHandle, 50, message.outgoing ? "我" : "对方");
+	const base = {
+		id: message.id,
+		sender,
+		outgoing: message.outgoing,
+		sentAt: new Date(message.sentAt).toISOString()
+	};
+	if (message.content.kind === "text") return {
+		...base,
 		content: {
 			kind: "text",
 			text: boundedText(message.content.text, 4e3)
@@ -2001,11 +2669,29 @@ let AwikiService = (() => {
 	let _getSession_decorators;
 	let _logout_decorators;
 	let _login_decorators;
+	let _inspectIdentityAccess_decorators;
 	let _sendRegistrationOtp_decorators;
 	let _registerIdentity_decorators;
 	let _updateDisplayName_decorators;
+	let _getProfile_decorators;
+	let _updateProfile_decorators;
+	let _sendRecoveryOtp_decorators;
+	let _prepareRecovery_decorators;
+	let _activateRecovery_decorators;
+	let _getRecoveryStatus_decorators;
+	let _resumeRecovery_decorators;
+	let _discardRecovery_decorators;
 	let _resolvePeer_decorators;
 	let _createGroup_decorators;
+	let _getGroup_decorators;
+	let _joinGroup_decorators;
+	let _leaveGroup_decorators;
+	let _listGroupMembers_decorators;
+	let _addGroupMember_decorators;
+	let _removeGroupMember_decorators;
+	let _resumeGroupRebindRecovery_decorators;
+	let _getConversationPreferences_decorators;
+	let _updateConversationPreference_decorators;
 	let _listConversations_decorators;
 	let _getHistory_decorators;
 	let _getLocalHistory_decorators;
@@ -2028,11 +2714,29 @@ let AwikiService = (() => {
 			_getSession_decorators = [Remote];
 			_logout_decorators = [Remote];
 			_login_decorators = [Remote];
+			_inspectIdentityAccess_decorators = [Remote];
 			_sendRegistrationOtp_decorators = [Remote];
 			_registerIdentity_decorators = [Remote];
 			_updateDisplayName_decorators = [Remote];
+			_getProfile_decorators = [Remote];
+			_updateProfile_decorators = [Remote];
+			_sendRecoveryOtp_decorators = [Remote];
+			_prepareRecovery_decorators = [Remote];
+			_activateRecovery_decorators = [Remote];
+			_getRecoveryStatus_decorators = [Remote];
+			_resumeRecovery_decorators = [Remote];
+			_discardRecovery_decorators = [Remote];
 			_resolvePeer_decorators = [Remote];
 			_createGroup_decorators = [Remote];
+			_getGroup_decorators = [Remote];
+			_joinGroup_decorators = [Remote];
+			_leaveGroup_decorators = [Remote];
+			_listGroupMembers_decorators = [Remote];
+			_addGroupMember_decorators = [Remote];
+			_removeGroupMember_decorators = [Remote];
+			_resumeGroupRebindRecovery_decorators = [Remote];
+			_getConversationPreferences_decorators = [Remote];
+			_updateConversationPreference_decorators = [Remote];
 			_listConversations_decorators = [Remote];
 			_getHistory_decorators = [Remote];
 			_getLocalHistory_decorators = [Remote];
@@ -2102,6 +2806,17 @@ let AwikiService = (() => {
 				},
 				metadata: _metadata
 			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _inspectIdentityAccess_decorators, {
+				kind: "method",
+				name: "inspectIdentityAccess",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "inspectIdentityAccess" in obj,
+					get: (obj) => obj.inspectIdentityAccess
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
 			__esDecorate(this, null, _sendRegistrationOtp_decorators, {
 				kind: "method",
 				name: "sendRegistrationOtp",
@@ -2135,6 +2850,94 @@ let AwikiService = (() => {
 				},
 				metadata: _metadata
 			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _getProfile_decorators, {
+				kind: "method",
+				name: "getProfile",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "getProfile" in obj,
+					get: (obj) => obj.getProfile
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _updateProfile_decorators, {
+				kind: "method",
+				name: "updateProfile",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "updateProfile" in obj,
+					get: (obj) => obj.updateProfile
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _sendRecoveryOtp_decorators, {
+				kind: "method",
+				name: "sendRecoveryOtp",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "sendRecoveryOtp" in obj,
+					get: (obj) => obj.sendRecoveryOtp
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _prepareRecovery_decorators, {
+				kind: "method",
+				name: "prepareRecovery",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "prepareRecovery" in obj,
+					get: (obj) => obj.prepareRecovery
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _activateRecovery_decorators, {
+				kind: "method",
+				name: "activateRecovery",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "activateRecovery" in obj,
+					get: (obj) => obj.activateRecovery
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _getRecoveryStatus_decorators, {
+				kind: "method",
+				name: "getRecoveryStatus",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "getRecoveryStatus" in obj,
+					get: (obj) => obj.getRecoveryStatus
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _resumeRecovery_decorators, {
+				kind: "method",
+				name: "resumeRecovery",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "resumeRecovery" in obj,
+					get: (obj) => obj.resumeRecovery
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _discardRecovery_decorators, {
+				kind: "method",
+				name: "discardRecovery",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "discardRecovery" in obj,
+					get: (obj) => obj.discardRecovery
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
 			__esDecorate(this, null, _resolvePeer_decorators, {
 				kind: "method",
 				name: "resolvePeer",
@@ -2157,6 +2960,105 @@ let AwikiService = (() => {
 				},
 				metadata: _metadata
 			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _getGroup_decorators, {
+				kind: "method",
+				name: "getGroup",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "getGroup" in obj,
+					get: (obj) => obj.getGroup
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _joinGroup_decorators, {
+				kind: "method",
+				name: "joinGroup",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "joinGroup" in obj,
+					get: (obj) => obj.joinGroup
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _leaveGroup_decorators, {
+				kind: "method",
+				name: "leaveGroup",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "leaveGroup" in obj,
+					get: (obj) => obj.leaveGroup
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _listGroupMembers_decorators, {
+				kind: "method",
+				name: "listGroupMembers",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "listGroupMembers" in obj,
+					get: (obj) => obj.listGroupMembers
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _addGroupMember_decorators, {
+				kind: "method",
+				name: "addGroupMember",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "addGroupMember" in obj,
+					get: (obj) => obj.addGroupMember
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _removeGroupMember_decorators, {
+				kind: "method",
+				name: "removeGroupMember",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "removeGroupMember" in obj,
+					get: (obj) => obj.removeGroupMember
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _resumeGroupRebindRecovery_decorators, {
+				kind: "method",
+				name: "resumeGroupRebindRecovery",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "resumeGroupRebindRecovery" in obj,
+					get: (obj) => obj.resumeGroupRebindRecovery
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _getConversationPreferences_decorators, {
+				kind: "method",
+				name: "getConversationPreferences",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "getConversationPreferences" in obj,
+					get: (obj) => obj.getConversationPreferences
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _updateConversationPreference_decorators, {
+				kind: "method",
+				name: "updateConversationPreference",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "updateConversationPreference" in obj,
+					get: (obj) => obj.updateConversationPreference
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
 			__esDecorate(this, null, _listConversations_decorators, {
 				kind: "method",
 				name: "listConversations",
@@ -2323,6 +3225,8 @@ let AwikiService = (() => {
 		resolved = __runInitializers(this, _instanceExtraInitializers);
 		sessionStore;
 		imageAttachmentCache;
+		sentMailStore;
+		conversationPreferenceStore;
 		startupUserServiceDomain;
 		settingsProvider;
 		provider;
@@ -2347,6 +3251,8 @@ let AwikiService = (() => {
 			this.externalHttpAuth = createAwikiExternalHttpAuth(() => this.acquireExternalHttpAuthSession());
 			this.sessionStore = new AwikiSessionStore(this.resolved.stateRoot);
 			this.imageAttachmentCache = new AwikiImageAttachmentCache(this.resolved.stateRoot, this.resolved.attachmentMaxBytes, this.resolved.imageAttachmentCacheMaxBytes);
+			this.sentMailStore = new AwikiSentMailStore(this.resolved.stateRoot);
+			this.conversationPreferenceStore = new AwikiConversationPreferenceStore(this.resolved.stateRoot);
 			this.startupUserServiceDomain = this.resolved.userServiceDomain;
 			ctx.inject(["settings"], (settingsCtx) => {
 				const provider = settingsCtx.settings;
@@ -2544,11 +3450,79 @@ let AwikiService = (() => {
 				}
 			});
 		}
-		/**
-		* Send one Legacy registration verification code.
-		* @param request - Handle and phone used for the registration challenge.
-		* @returns Public retry timing or a closed failure.
-		*/
+		/** Classify one configured-domain Handle before selecting the registration or recovery OTP purpose. */
+		async inspectIdentityAccess(request) {
+			const target = identityAccessTarget(request, this.startupUserServiceDomain);
+			if (target === void 0) return {
+				ok: false,
+				error: failure("invalid-request")
+			};
+			const endpoint = new URL(`/.well-known/handle/${encodeURIComponent(target.localPart)}`, this.resolved.userServiceUrl);
+			const abort = new AbortController();
+			const timeout = setTimeout(() => {
+				abort.abort();
+			}, 1e4);
+			let response;
+			try {
+				response = await fetch(endpoint, {
+					method: "GET",
+					headers: {
+						accept: "application/json",
+						"cache-control": "no-store"
+					},
+					cache: "no-store",
+					redirect: "error",
+					signal: abort.signal
+				});
+			} catch {
+				return {
+					ok: false,
+					error: failure("network")
+				};
+			} finally {
+				clearTimeout(timeout);
+			}
+			if (response.status === 404) return {
+				ok: true,
+				value: {
+					status: "available",
+					fullHandle: target.fullHandle
+				}
+			};
+			if (!response.ok) return {
+				ok: false,
+				error: failure("remote")
+			};
+			try {
+				const text = await readBoundedResponseText(response, IDENTITY_ACCESS_RESPONSE_MAX_BYTES);
+				if (text === void 0) return {
+					ok: false,
+					error: failure("remote")
+				};
+				const value = JSON.parse(text);
+				if (typeof value !== "object" || value === null) return {
+					ok: false,
+					error: failure("remote")
+				};
+				const binding = value;
+				if (binding.handle !== target.fullHandle || typeof binding.did !== "string" || !binding.did.startsWith("did:") || typeof binding.status !== "string" || binding.status.length === 0) return {
+					ok: false,
+					error: failure("remote")
+				};
+				return {
+					ok: true,
+					value: {
+						status: "existing",
+						fullHandle: target.fullHandle
+					}
+				};
+			} catch {
+				return {
+					ok: false,
+					error: failure("remote")
+				};
+			}
+		}
 		sendRegistrationOtp(request) {
 			return this.run((client) => client.sendRegistrationOtp(request));
 		}
@@ -2559,18 +3533,7 @@ let AwikiService = (() => {
 		*/
 		async registerIdentity(request) {
 			const result = await this.run((client) => client.registerIdentity(request));
-			if (result.ok) {
-				this.activeIdentityDid = result.value.did;
-				this.publishSession({
-					status: "active",
-					identity: result.value
-				});
-				const provider = this.provider;
-				if (provider !== void 0) {
-					await provider.listenerStartup;
-					await this.startListener(provider);
-				}
-			}
+			if (result.ok) await this.activateRegisteredIdentity(result.value);
 			return result;
 		}
 		/**
@@ -2583,6 +3546,92 @@ let AwikiService = (() => {
 			if (result.ok) this.activeIdentityDid = result.value.did;
 			return result;
 		}
+		/** Return the public editable profile for the active identity. */
+		getProfile() {
+			return this.run((client) => client.getProfile());
+		}
+		/** Update Display Name, bio, and tags after applying product limits in the Host. */
+		updateProfile(request) {
+			const normalized = normalizeProfileRequest(request);
+			if (normalized === void 0) return Promise.resolve({
+				ok: false,
+				error: failure("invalid-request")
+			});
+			return this.run((client) => client.updateProfile(normalized));
+		}
+		/** Start durable phone recovery for one existing full Handle. */
+		sendRecoveryOtp(request) {
+			const normalized = normalizeRecoveryOtpRequest(request);
+			if (normalized === void 0) return Promise.resolve({
+				ok: false,
+				error: failure("invalid-request")
+			});
+			return this.run((client) => client.sendRecoveryOtp(normalized), { allowSignedOut: true });
+		}
+		/** Verify a recovery OTP and freeze its exact intent before the remote commit. */
+		prepareRecovery(request) {
+			const normalized = normalizeRecoveryPrepareRequest(request);
+			if (normalized === void 0) return Promise.resolve({
+				ok: false,
+				error: failure("invalid-request")
+			});
+			return this.run((client) => client.prepareRecovery(normalized), { allowSignedOut: true });
+		}
+		/** Attempt one prepared recovery commit; uncertain outcomes remain durable in Core. */
+		async activateRecovery(request) {
+			const normalized = normalizeRecoveryOperation(request);
+			if (normalized === void 0) return {
+				ok: false,
+				error: failure("invalid-request")
+			};
+			const result = await this.run((client) => client.activateRecovery(normalized), { allowSignedOut: true });
+			if (result.ok && !await this.applyRecoveredSession(result.value)) return {
+				ok: false,
+				error: failure("remote")
+			};
+			return result;
+		}
+		/** Read durable recovery state before deciding whether a retry is valid. */
+		async getRecoveryStatus(request) {
+			const normalized = normalizeRecoveryOperation(request);
+			if (normalized === void 0) return {
+				ok: false,
+				error: failure("invalid-request")
+			};
+			const result = await this.run((client) => client.getRecoveryStatus(normalized), { allowSignedOut: true });
+			if (result.ok && !await this.applyRecoveredSession(result.value)) return {
+				ok: false,
+				error: failure("remote")
+			};
+			return result;
+		}
+		/** Resume only the exact Core-owned operation selected by the browser. */
+		async resumeRecovery(request) {
+			const normalized = normalizeRecoveryOperation(request);
+			if (normalized === void 0) return {
+				ok: false,
+				error: failure("invalid-request")
+			};
+			const result = await this.run((client) => client.resumeRecovery(normalized), { allowSignedOut: true });
+			if (result.ok && !await this.applyRecoveredSession(result.value)) return {
+				ok: false,
+				error: failure("remote")
+			};
+			return result;
+		}
+		/** Discard only a pre-attempt operation; Core rejects post-attempt deletion. */
+		async discardRecovery(request) {
+			const normalized = normalizeRecoveryOperation(request);
+			if (normalized === void 0) return {
+				ok: false,
+				error: failure("invalid-request")
+			};
+			const result = await this.run((client) => client.discardRecovery(normalized), { allowSignedOut: true });
+			return result.ok ? {
+				ok: true,
+				value: { completed: true }
+			} : result;
+		}
 		/**
 		* Resolve one Handle or DID before the browser opens a direct chat.
 		* @param request - typed Handle or DID.
@@ -2623,6 +3672,96 @@ let AwikiService = (() => {
 				}
 			};
 		}
+		/** Return one authoritative group snapshot for permission-aware UI. */
+		getGroup(request) {
+			const groupDid = normalizeGroupDid(request?.groupDid);
+			if (groupDid === void 0) return Promise.resolve({
+				ok: false,
+				error: failure("invalid-request")
+			});
+			return this.run((client) => client.getGroup(groupDid));
+		}
+		/** Join one open group and return its authoritative membership state. */
+		joinGroup(request) {
+			const groupDid = normalizeGroupDid(request?.groupDid);
+			if (groupDid === void 0) return Promise.resolve({
+				ok: false,
+				error: failure("invalid-request")
+			});
+			return this.run((client) => client.joinGroup(groupDid));
+		}
+		/** Leave one group. Core rejects owner leave and unsupported security profiles. */
+		async leaveGroup(request) {
+			const groupDid = normalizeGroupDid(request?.groupDid);
+			if (groupDid === void 0) return Promise.resolve({
+				ok: false,
+				error: failure("invalid-request")
+			});
+			const result = await this.run((client) => client.leaveGroup(groupDid));
+			return result.ok ? {
+				ok: true,
+				value: { completed: true }
+			} : result;
+		}
+		/** Read one authoritative versioned member page. */
+		listGroupMembers(request) {
+			const groupDid = normalizeGroupDid(request?.groupDid);
+			if (groupDid === void 0 || request.cursor !== void 0 && (typeof request.cursor !== "string" || request.cursor.length > 4096) || request.limit !== void 0 && (!Number.isSafeInteger(request.limit) || request.limit < 1 || request.limit > 100)) return Promise.resolve({
+				ok: false,
+				error: failure("invalid-request")
+			});
+			return this.run((client) => client.listGroupMembers({
+				groupDid,
+				...request.cursor === void 0 ? {} : { cursor: request.cursor },
+				...request.limit === void 0 ? {} : { limit: request.limit }
+			}));
+		}
+		/** Invite one ordinary member after group creation. */
+		addGroupMember(request) {
+			const groupDid = normalizeGroupDid(request?.groupDid);
+			const member = normalizeMember(request?.member);
+			if (groupDid === void 0 || member === void 0 || request.role !== void 0 && request.role !== "member") return Promise.resolve({
+				ok: false,
+				error: failure("invalid-request")
+			});
+			return this.run((client) => client.addGroupMember(groupDid, member));
+		}
+		/** Remove one member. The authoritative Core role check remains decisive. */
+		removeGroupMember(request) {
+			const groupDid = normalizeGroupDid(request?.groupDid);
+			const member = normalizeMember(request?.member);
+			if (groupDid === void 0 || member === void 0) return Promise.resolve({
+				ok: false,
+				error: failure("invalid-request")
+			});
+			return this.run((client) => client.removeGroupMember(groupDid, member));
+		}
+		/** Resume durable group membership convergence after account sync restores old groups. */
+		async resumeGroupRebindRecovery() {
+			const result = await this.run((client) => client.resumeGroupRebindRecovery());
+			if (!result.ok) return result;
+			const summary = publicGroupRebindRecoverySummary(result.value);
+			return summary === void 0 ? {
+				ok: false,
+				error: failure("remote")
+			} : {
+				ok: true,
+				value: summary
+			};
+		}
+		/** Read presentation-only roster preferences for the active identity. */
+		getConversationPreferences() {
+			return this.run(async (client) => this.conversationPreferenceStore.get(await this.ownerDid(client)));
+		}
+		/** Persist one bounded local roster preference without changing Core or remote membership. */
+		updateConversationPreference(request) {
+			const normalized = normalizeConversationPreferenceMutation(request);
+			if (normalized === void 0) return Promise.resolve({
+				ok: false,
+				error: failure("invalid-request")
+			});
+			return this.run(async (client) => this.conversationPreferenceStore.update(await this.ownerDid(client), normalized));
+		}
 		/**
 		* List direct and existing group conversations.
 		* @param request - Optional opaque cursor and page limit.
@@ -2762,7 +3901,12 @@ let AwikiService = (() => {
 		* @returns The accepted public message or a closed failure.
 		*/
 		sendText(request) {
-			return this.run((client) => client.sendText(request));
+			const normalized = normalizeSendTextRequest(request);
+			if (normalized === void 0) return Promise.resolve({
+				ok: false,
+				error: failure("invalid-request")
+			});
+			return this.run((client) => client.sendText(normalized));
 		}
 		/**
 		* Upload and send one attachment after Host validation.
@@ -2854,20 +3998,72 @@ let AwikiService = (() => {
 			return this.run((client) => client.getMailAccount());
 		}
 		/** List one bounded mailbox page on explicit browser/tool demand. */
-		listMailInbox(request) {
-			return this.runValidatedMail(() => mailInboxRequest(request ?? {}), (client, normalized) => client.listMailInbox(normalized));
+		async listMailInbox(request) {
+			let normalized;
+			try {
+				normalized = mailInboxRequest(request ?? {});
+			} catch {
+				return {
+					ok: false,
+					error: failure("invalid-request")
+				};
+			}
+			return this.run(async (client) => {
+				if (normalized.folder !== "sent") return client.listMailInbox(normalized);
+				return this.sentMailStore.list(await this.ownerDid(client), normalized);
+			});
 		}
 		/** Read one bounded plain-text mail message. */
-		readMail(request) {
-			return this.runValidatedMail(() => mailReadRequest(request), (client, normalized) => client.readMail(normalized));
+		async readMail(request) {
+			let normalized;
+			try {
+				normalized = mailReadRequest(request);
+			} catch {
+				return {
+					ok: false,
+					error: failure("invalid-request")
+				};
+			}
+			return this.run(async (client) => {
+				if (!isLocalSentMailId(normalized.messageId)) return client.readMail(normalized);
+				const local = await this.sentMailStore.read(await this.ownerDid(client), normalized.messageId);
+				if (local === void 0) throw Object.assign(/* @__PURE__ */ new Error("sent mail not found"), {
+					name: "AwikiSdkError",
+					code: "not-found"
+				});
+				return local;
+			});
 		}
 		/** Mark explicitly selected mail messages read. Browser callers require an explicit click. */
 		markMailRead(request) {
 			return this.runValidatedMail(() => mailMarkReadRequest(request), (client, normalized) => client.markMailRead(normalized));
 		}
 		/** Send one plain-text mail once. Browser callers require an explicit confirmation. */
-		sendMail(request) {
-			return this.runValidatedMail(() => mailSendRequest(request), (client, normalized) => client.sendMail(normalized));
+		async sendMail(request) {
+			let normalized;
+			try {
+				normalized = mailSendRequest(request);
+			} catch {
+				return {
+					ok: false,
+					error: failure("invalid-request")
+				};
+			}
+			return this.run(async (client) => {
+				const result = await client.sendMail(normalized);
+				if (!result.accepted) return result;
+				try {
+					const ownerDid = await this.ownerDid(client);
+					const account = await client.getMailAccount().catch(() => void 0);
+					await this.sentMailStore.append(ownerDid, normalized, result, account);
+					return result;
+				} catch {
+					return result.warnings.length >= 100 ? result : {
+						...result,
+						warnings: [...result.warnings, "Sent history could not be saved locally."]
+					};
+				}
+			});
 		}
 		/**
 		* Permanently remove the exact SDK-owned local state after an explicit browser acknowledgement.
@@ -2890,6 +4086,8 @@ let AwikiService = (() => {
 				}
 				try {
 					await this.imageAttachmentCache.clear();
+					await this.sentMailStore.clear();
+					await this.conversationPreferenceStore.clear();
 					await this.sessionStore.signIn();
 					this.signedOut = false;
 					this.activeIdentityDid = void 0;
@@ -2905,6 +4103,46 @@ let AwikiService = (() => {
 				}
 			});
 		}
+		/** Re-enter only after Core confirms that the exact recovered identity is applied locally. */
+		async applyRecoveredSession(progress) {
+			if (progress.phase !== "applied") return true;
+			return this.mutateSession(async () => {
+				const provider = this.provider;
+				if (provider === void 0) return false;
+				try {
+					const identity = await provider.client.getIdentity();
+					if (identity === null || identity.did !== progress.currentDid) return false;
+					if (this.signedOut === false && this.activeIdentityDid === identity.did) return true;
+					await this.sessionStore.signIn();
+					this.signedOut = false;
+					this.activeIdentityDid = identity.did;
+					this.invalidateSummaries();
+					const session = {
+						status: "active",
+						identity
+					};
+					this.publishSession(session);
+					await provider.listenerStartup;
+					await this.startListener(provider);
+					return true;
+				} catch {
+					return false;
+				}
+			});
+		}
+		/** Publish one newly registered identity and start its listener through the existing session path. */
+		async activateRegisteredIdentity(identity) {
+			this.activeIdentityDid = identity.did;
+			this.publishSession({
+				status: "active",
+				identity
+			});
+			const provider = this.provider;
+			if (provider !== void 0) {
+				await provider.listenerStartup;
+				await this.startListener(provider);
+			}
+		}
 		/** Invalidate cached session work and cancel every model request still owned by the old session. */
 		invalidateSummaries() {
 			this.sessionRevision += 1;
@@ -2915,6 +4153,17 @@ let AwikiService = (() => {
 		publishSession(session) {
 			this.hostContext.emit("awiki/session", session);
 		}
+		/** Resolve and cache the owner binding required by private Host-side projections. */
+		async ownerDid(client) {
+			const identity = this.activeIdentityDid === void 0 ? await client.getIdentity() : void 0;
+			const ownerDid = this.activeIdentityDid ?? identity?.did;
+			if (ownerDid === void 0) throw Object.assign(/* @__PURE__ */ new Error("not registered"), {
+				name: "AwikiSdkError",
+				code: "not-registered"
+			});
+			this.activeIdentityDid = ownerDid;
+			return ownerDid;
+		}
 		/** Invoke the current client and normalize every rejection to a public result. */
 		async run(operation, options = {}) {
 			try {