@awiki/dsh-plugin 0.3.11 → 0.3.16

package/lib/index.js

@@ -1,4 +1,4 @@
-import { a as fencedMailRecoveryObservability, i as failedMailRecoveryObservability, o as successfulMailRecoveryObservability, r as downloadedAttachment, t as AwikiSdkError } from "./sdk-adapter-DpqT2en9.mjs";
+import { a as fencedMailRecoveryObservability, i as failedMailRecoveryObservability, o as successfulMailRecoveryObservability, r as downloadedAttachment, s as isMessageTarget, t as AwikiSdkError } from "./sdk-adapter-DGcTiEZz.mjs";
 import "@deepseek-ai/cordis";
 import { createHash, randomUUID, timingSafeEqual } from "node:crypto";
 import { homedir } from "node:os";
@@ -13,14 +13,14 @@ import { installModelSelection } from "@deepseek-ai/dsh-agent";
 import { createUserMessage } from "@deepseek-ai/dsh-llm";
 import { fileURLToPath } from "node:url";
 import { copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
-import { satisfies } from "semver";
+import { satisfies, validRange } from "semver";
 //#region lib/types/builtin-tenant-config.js
 /** Build-injected two-slot tenant catalog with a source-tree default for tests. */
-function record$1(value) {
+function record$2(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function definition(value) {
-	if (!record$1(value) || !record$1(value.display_name) || typeof value.display_name["zh-CN"] !== "string" || value.display_name["zh-CN"].trim() === "" || typeof value.display_name.en !== "string" || value.display_name.en.trim() === "" || typeof value.backend_origin !== "string" || typeof value.did_host !== "string") throw new Error("awiki: invalid built-in tenant definition");
+	if (!record$2(value) || !record$2(value.display_name) || typeof value.display_name["zh-CN"] !== "string" || value.display_name["zh-CN"].trim() === "" || typeof value.display_name.en !== "string" || value.display_name.en.trim() === "" || typeof value.backend_origin !== "string" || typeof value.did_host !== "string") throw new Error("awiki: invalid built-in tenant definition");
 	const origin = new URL(value.backend_origin);
 	const loopback = origin.protocol === "http:" && [
 		"localhost",
@@ -40,7 +40,7 @@ function definition(value) {
 	};
 }
 function decodeBuiltinTenantConfig(value) {
-	if (!record$1(value) || value.schema_version !== 1 || value.default_slot !== "primary" && value.default_slot !== "secondary" || !record$1(value.tenants) || Object.keys(value.tenants).sort().join(",") !== "primary,secondary") throw new Error("awiki: invalid built-in tenant config");
+	if (!record$2(value) || value.schema_version !== 1 || value.default_slot !== "primary" && value.default_slot !== "secondary" || !record$2(value.tenants) || Object.keys(value.tenants).sort().join(",") !== "primary,secondary") throw new Error("awiki: invalid built-in tenant config");
 	const primary = definition(value.tenants.primary);
 	const secondary = definition(value.tenants.secondary);
 	if (primary.backendOrigin === secondary.backendOrigin || primary.didHost === secondary.didHost) throw new Error("awiki: built-in tenant slots must use distinct endpoints");
@@ -184,18 +184,34 @@ function compareVersions(left, right) {
 function decodeDesktopDistribution(value) {
 	if (typeof value !== "object" || value === null) return void 0;
 	const view = value;
-	if (view.schemaVersion !== 1 || view.distributionId !== "awiki-dsh-desktop" || typeof view.currentVersion !== "string" || view.channel !== "stable" && view.channel !== "prerelease" || typeof view.downloadPageUrl !== "string" || ![
+	if (view.schemaVersion !== 1 && view.schemaVersion !== 2 || view.distributionId !== "awiki-dsh-desktop" || typeof view.currentVersion !== "string" || view.channel !== "stable" && view.channel !== "prerelease" || view.downloadPageUrl !== void 0 && typeof view.downloadPageUrl !== "string" || ![
 		"unchecked",
 		"checking",
 		"ready",
-		"failed"
+		"failed",
+		"unavailable"
 	].includes(String(view.state)) || typeof view.updateAvailable !== "boolean" || typeof view.usedCache !== "boolean" || view.latestVersion !== void 0 && typeof view.latestVersion !== "string" || view.checkedAt !== void 0 && typeof view.checkedAt !== "string" || view.noRelease !== void 0 && typeof view.noRelease !== "boolean") return void 0;
 	try {
 		assertVersion(view.currentVersion);
+		if (view.schemaVersion === 1) return {
+			schemaVersion: 1,
+			distributionId: "awiki-dsh-desktop",
+			currentVersion: view.currentVersion,
+			channel: view.channel,
+			state: "unavailable",
+			updateAvailable: false,
+			usedCache: false
+		};
+		const hasTenant = view.tenantId !== void 0 || view.policyOrigin !== void 0 || view.tenantGeneration !== void 0;
+		if (hasTenant && (typeof view.tenantId !== "string" || view.tenantId.length === 0 || typeof view.policyOrigin !== "string" || new URL(view.policyOrigin).origin !== view.policyOrigin || new URL(view.policyOrigin).protocol !== "https:" || !Number.isSafeInteger(view.tenantGeneration) || view.tenantGeneration < 0)) return void 0;
+		if (!hasTenant && view.state !== "unavailable") return void 0;
+		if (view.policyRevision !== void 0 && (!Number.isSafeInteger(view.policyRevision) || view.policyRevision < 1)) return void 0;
 		if (view.latestVersion !== void 0) assertVersion(view.latestVersion);
 		if (view.checkedAt !== void 0 && !Number.isFinite(Date.parse(view.checkedAt))) return void 0;
-		const url = new URL(view.downloadPageUrl);
-		if (url.protocol !== "https:" || url.username !== "" || url.password !== "") return void 0;
+		if (typeof view.downloadPageUrl === "string") {
+			const url = new URL(view.downloadPageUrl);
+			if (url.protocol !== "https:" || url.username !== "" || url.password !== "" || url.origin !== view.policyOrigin) return void 0;
+		}
 	} catch {
 		return;
 	}
@@ -216,11 +232,17 @@ function decodeDesktopDistribution(value) {
 		};
 	}
 	return {
-		schemaVersion: 1,
+		schemaVersion: 2,
 		distributionId: "awiki-dsh-desktop",
 		currentVersion: view.currentVersion,
 		channel: view.channel,
-		downloadPageUrl: view.downloadPageUrl,
+		...typeof view.downloadPageUrl === "string" ? { downloadPageUrl: view.downloadPageUrl } : {},
+		...typeof view.tenantId === "string" ? {
+			tenantId: view.tenantId,
+			policyOrigin: view.policyOrigin,
+			tenantGeneration: view.tenantGeneration
+		} : {},
+		...typeof view.policyRevision === "number" ? { policyRevision: view.policyRevision } : {},
 		state: view.state,
 		updateAvailable: view.updateAvailable,
 		usedCache: view.usedCache,
@@ -1046,7 +1068,7 @@ const TIMEOUT_MS = 3e4;
 function invalid() {
 	throw new AwikiSdkError("remote");
 }
-function record(value) {
+function record$1(value) {
 	if (typeof value !== "object" || value === null || Array.isArray(value)) invalid();
 	return value;
 }
@@ -1189,10 +1211,10 @@ var AwikiMailAttachmentClient = class {
 				});
 			}, { allowAuthRetry });
 			if (!response.ok) serviceFailure(response.status);
-			const envelope = record(JSON.parse(await response.text()));
+			const envelope = record$1(JSON.parse(await response.text()));
 			if (envelope.jsonrpc !== "2.0" || envelope.id !== 1) invalid();
-			if (envelope.error != null) serviceFailure(integer(record(envelope.error).code));
-			return record(envelope.result);
+			if (envelope.error != null) serviceFailure(integer(record$1(envelope.error).code));
+			return record$1(envelope.result);
 		} catch (error) {
 			if (error instanceof AwikiSdkError) throw error;
 			if (error instanceof AwikiExternalHttpAuthError) {
@@ -2789,7 +2811,7 @@ var AwikiAgentListener = class {
 		for (const [index, part] of parts.entries()) await this.awiki.sendText({
 			target: {
 				kind: "direct",
-				peer: conversation.peerDid
+				conversationId: conversation.id
 			},
 			text: part,
 			idempotencyKey: replyKey(messageId, index)
@@ -3469,10 +3491,88 @@ function legacyDocument(seed, usePreRegistryDefault) {
 	});
 }
 //#endregion
+//#region lib/types/update-installation.js
+/** Host-only compatibility evidence for exact, tenant-recommended npm targets. */
+const IDENTITY_PACKAGE = "@agent-network-protocol/dsh-anp-identity";
+const record = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+function decodeInstallation(value) {
+	if (value === void 0 || value === null) return void 0;
+	if (!record(value) || !record(value.runtime_packages) || !record(value.identity) || value.identity.package_name !== "@agent-network-protocol/dsh-anp-identity" || typeof value.identity.version !== "string" || typeof value.identity.integrity !== "string" || !/^sha512-[A-Za-z0-9+/]+={0,2}$/u.test(value.identity.integrity) || typeof value.requires_identity !== "string" || value.requires_identity.length > 256 || validRange(value.requires_identity) === null) throw new Error("invalid installation requirements");
+	const optional = value.optional_runtime_packages === void 0 ? {} : value.optional_runtime_packages;
+	if (!record(optional)) throw new Error("invalid optional Host requirements");
+	const requiredEntries = Object.entries(value.runtime_packages);
+	const entries = [...requiredEntries, ...Object.entries(optional)];
+	if (requiredEntries.length === 0 || entries.length > 128) throw new Error("invalid Host requirement count");
+	if (Object.keys(optional).some((name) => Object.hasOwn(value.runtime_packages, name))) throw new Error("overlapping Host requirements");
+	for (const [name, version] of entries) {
+		if (!/^@deepseek-ai\/dsh-[a-z0-9-]+$/u.test(name) || typeof version !== "string") throw new Error("invalid Host requirement");
+		assertVersion(version);
+	}
+	assertVersion(value.identity.version);
+	if (!satisfies(value.identity.version, value.requires_identity)) throw new Error("incompatible Identity release target");
+	return {
+		runtime_packages: value.runtime_packages,
+		requires_identity: value.requires_identity,
+		...value.optional_runtime_packages === void 0 ? {} : { optional_runtime_packages: optional },
+		identity: {
+			package_name: IDENTITY_PACKAGE,
+			version: value.identity.version,
+			integrity: value.identity.integrity
+		}
+	};
+}
+/** Only package manifests are read; paths and native objects never enter the public view. */
+function installedVersion(name) {
+	try {
+		let directory = dirname(fileURLToPath(import.meta.resolve(name)));
+		for (let depth = 0; depth < 12; depth++) {
+			try {
+				const manifest = JSON.parse(readFileSync(join(directory, "package.json"), "utf8"));
+				if (record(manifest) && manifest.name === name && typeof manifest.version === "string") {
+					assertVersion(manifest.version);
+					return manifest.version;
+				}
+			} catch {}
+			const parent = dirname(directory);
+			if (parent === directory) break;
+			directory = parent;
+		}
+	} catch {}
+}
+function checkInstallation(requirements, installed) {
+	if (requirements === void 0) return { blockedReason: "installation-unverified" };
+	const versionOf = (name) => installed === void 0 ? installedVersion(name) : installed[name];
+	for (const [name, required] of Object.entries(requirements.runtime_packages)) {
+		const actual = versionOf(name);
+		try {
+			if (actual === void 0 || compareVersions(actual, required) !== 0) return { blockedReason: "host-incompatible" };
+		} catch {
+			return { blockedReason: "host-incompatible" };
+		}
+	}
+	for (const [name, required] of Object.entries(requirements.optional_runtime_packages ?? {})) {
+		const actual = versionOf(name);
+		if (actual === void 0) continue;
+		try {
+			if (compareVersions(actual, required) !== 0) return { blockedReason: "host-incompatible" };
+		} catch {
+			return { blockedReason: "host-incompatible" };
+		}
+	}
+	const identity = versionOf(IDENTITY_PACKAGE);
+	try {
+		if (identity === void 0 || compareVersions(identity, requirements.identity.version) < 0) return { identityTarget: `${IDENTITY_PACKAGE}@${requirements.identity.version}` };
+		if (!satisfies(identity, requirements.requires_identity)) return { blockedReason: "identity-incompatible" };
+	} catch {
+		return { blockedReason: "identity-incompatible" };
+	}
+	return {};
+}
+//#endregion
 //#region lib/types/package-version.generated.js
 /** Generated from package.json by scripts/sync-package-versions.mjs. */
-const DSH_AWIKI_PACKAGE_VERSION = "0.3.11";
-const DSH_AWIKI_MODEL_PROXY_PACKAGE_VERSION = "0.1.7";
+const DSH_AWIKI_PACKAGE_VERSION = "0.3.16";
+const DSH_AWIKI_MODEL_PROXY_PACKAGE_VERSION = "0.1.11";
 //#endregion
 //#region lib/types/update-policy.js
 /** Tenant-scoped DSH AWiki plugin update policy and verified cache. */
@@ -3500,7 +3600,7 @@ function readAwikiUpdatePolicyStatus(options) {
 		policyUnavailable: true,
 		restricted: false,
 		modelProxyRestricted: false
-	} : statusFromPolicy(base, cached.policy, cached.checkedAt, false, true);
+	} : statusFromPolicy(base, cached.policy, cached.checkedAt, false, true, options.installedRuntime);
 }
 async function checkAwikiUpdatePolicy(options) {
 	const origin = new URL(options.tenant.backendBaseUrl).origin;
@@ -3586,11 +3686,11 @@ async function checkAwikiUpdatePolicy(options) {
 				policy
 			});
 		} catch {}
-		return statusFromPolicy(base, policy, checkedAt, false, false);
+		return statusFromPolicy(base, policy, checkedAt, false, false, options.installedRuntime);
 	} catch (error) {
 		if (options.signal?.aborted === true) throw error;
 		if (cached !== void 0) return {
-			...statusFromPolicy(base, cached.policy, cached.checkedAt, true, true),
+			...statusFromPolicy(base, cached.policy, cached.checkedAt, true, true, options.installedRuntime),
 			checkState: "failed"
 		};
 		return {
@@ -3627,16 +3727,18 @@ async function readPolicyBody(response) {
 	}
 	return Buffer.concat(chunks, length);
 }
-function statusFromPolicy(base, policy, checkedAt, offline, usedCache) {
+function statusFromPolicy(base, policy, checkedAt, offline, usedCache, installedRuntime) {
 	const plugin = policy.packages.plugin;
 	const modelProxy = policy.packages.model_proxy;
 	const updateAvailable = compareVersions(base.currentPluginVersion, plugin.recommended_version) < 0 || modelProxy !== void 0 && base.currentModelProxyVersion !== void 0 && compareVersions(base.currentModelProxyVersion, modelProxy.recommended_version) < 0;
-	const command = upgradeCommand(base, plugin, modelProxy);
+	const installation = checkInstallation(policy.installation, installedRuntime);
+	const command = installation.blockedReason === void 0 ? upgradeCommand(base, plugin, modelProxy, installation.identityTarget) : void 0;
 	return {
 		...base,
 		checkState: "ready",
 		updateAvailable,
 		...command === void 0 ? {} : { upgradeCommand: command },
+		...!updateAvailable || installation.blockedReason === void 0 ? {} : { upgradeBlockedReason: installation.blockedReason },
 		policyRevision: policy.policy_revision,
 		recommendedPluginVersion: plugin.recommended_version,
 		minimumPluginVersion: plugin.min_supported_version,
@@ -3656,14 +3758,18 @@ function statusFromPolicy(base, policy, checkedAt, offline, usedCache) {
 	};
 }
 /** Exact published targets only; never downgrade a newer installed component. */
-function upgradeCommand(current, plugin, proxy) {
+function upgradeCommand(current, plugin, proxy, identityTarget) {
 	const pluginUpgrade = compareVersions(current.currentPluginVersion, plugin.recommended_version) < 0;
 	const proxyUpgrade = proxy !== void 0 && current.currentModelProxyVersion !== void 0 && compareVersions(current.currentModelProxyVersion, proxy.recommended_version) < 0;
 	if (!pluginUpgrade && !proxyUpgrade || plugin.installable === false || current.currentModelProxyVersion !== void 0 && proxy?.installable === false) return void 0;
 	if (current.currentModelProxyVersion !== void 0 && (proxy === void 0 || compareVersions(current.currentModelProxyVersion, proxy.recommended_version) > 0)) return void 0;
 	const pluginVersion = pluginUpgrade ? plugin.recommended_version : current.currentPluginVersion;
-	if (current.currentModelProxyVersion !== void 0 && proxy?.requires_plugin !== void 0 && !satisfies(pluginVersion, proxy.requires_plugin, { includePrerelease: true })) return void 0;
-	return `dsh plugin add ${[pluginUpgrade ? `@awiki/dsh-plugin@${pluginVersion}` : void 0, proxyUpgrade ? `@awiki/dsh-model-proxy@${proxy.recommended_version}` : void 0].filter(Boolean).join(" ")}`;
+	if (current.currentModelProxyVersion !== void 0 && proxy?.requires_plugin !== void 0 && !satisfies(pluginVersion, proxy.requires_plugin)) return void 0;
+	return `dsh plugin add ${[
+		identityTarget,
+		pluginUpgrade ? `@awiki/dsh-plugin@${pluginVersion}` : void 0,
+		proxyUpgrade ? `@awiki/dsh-model-proxy@${proxy.recommended_version}` : void 0
+	].filter(Boolean).join(" ")}`;
 }
 function publicTarget(value) {
 	return {
@@ -3680,6 +3786,7 @@ function decodePolicy(value, origin) {
 	const releaseNotes = value.release_notes_url === "" ? void 0 : new URL(value.release_notes_url);
 	if (releaseNotes !== void 0) assertPolicyOrigin(releaseNotes.origin, origin.startsWith("http://"));
 	const plugin = decodePackage(value.packages.plugin, "@awiki/dsh-plugin");
+	const installation = decodeInstallation(value.installation);
 	const modelProxy = value.packages.model_proxy === void 0 ? void 0 : decodePackage(value.packages.model_proxy, "@awiki/dsh-model-proxy");
 	if (compareVersions(plugin.min_supported_version, plugin.recommended_version) > 0 || modelProxy !== void 0 && compareVersions(modelProxy.min_supported_version, modelProxy.recommended_version) > 0) throw new Error("minimum version exceeds recommended version");
 	return {
@@ -3689,6 +3796,7 @@ function decodePolicy(value, origin) {
 		policy_revision: value.policy_revision,
 		published_at: value.published_at,
 		release_notes_url: releaseNotes?.toString() ?? "",
+		...installation === void 0 ? {} : { installation },
 		packages: {
 			plugin,
 			...modelProxy === void 0 ? {} : { model_proxy: modelProxy }
@@ -3736,6 +3844,7 @@ function decodeServerInfoPolicy(value, origin, minimumRevision = 0) {
 		policy_revision: releases.policy_revision,
 		published_at: releases.published_at,
 		release_notes_url: product.release_notes_url,
+		installation: product.installation,
 		packages: {
 			plugin,
 			...modelProxy === void 0 ? {} : { model_proxy: modelProxy }
@@ -3870,6 +3979,7 @@ const Config = z.object({
 	messageServiceDid: z.string().default(DEFAULT_AWIKI_MESSAGE_SERVICE_DID),
 	allowedAttachmentOrigins: z.array(z.string()).default([]),
 	allowInsecureLoopbackForTesting: z.boolean().default(false),
+	caBundle: z.string(),
 	stateRoot: z.string(),
 	attachmentMaxBytes: z.number().default(DEFAULT_ATTACHMENT_MAX_BYTES),
 	mailAttachmentMaxCount: z.number().default(10),
@@ -4089,6 +4199,7 @@ function resolveConfig(ctx, config) {
 		messageServiceDid: serviceDid(config.messageServiceDid ?? DEFAULT_AWIKI_MESSAGE_SERVICE_DID),
 		allowedAttachmentOrigins: attachmentOrigins(config.allowedAttachmentOrigins, messageServicePublicUrl, allowInsecureLoopbackForTesting),
 		allowInsecureLoopbackForTesting,
+		...config.caBundle === void 0 ? {} : { caBundle: config.caBundle },
 		stateRoot,
 		attachmentMaxBytes,
 		mailAttachmentMaxCount,
@@ -4224,12 +4335,7 @@ function normalizeRecoveryPrepareRequest(request) {
 	};
 }
 const IDENTITY_ACCESS_RESPONSE_MAX_BYTES = 65536;
-const DID_URI = /^did:[a-z0-9]+:(?:[A-Za-z0-9._-]|%[0-9A-Fa-f]{2})+(?::(?:[A-Za-z0-9._-]|%[0-9A-Fa-f]{2})+)*$/u;
-const DID_URI_MAX_CHARACTERS = 2048;
 const SERVER_INFO_RESPONSE_MAX_BYTES = 65536;
-function isBoundedDidUri(value) {
-	return typeof value === "string" && value.length <= DID_URI_MAX_CHARACTERS && DID_URI.test(value);
-}
 /** Read one untrusted discovery response without buffering beyond the fixed Host limit. */
 async function readBoundedResponseText(response, maxBytes) {
 	const declaredLength = response.headers.get("content-length");
@@ -4279,15 +4385,13 @@ function identityAccessTarget(request, configuredDomain) {
 	};
 }
 function normalizeSendTextRequest(request) {
-	if (typeof request?.text !== "string" || typeof request.idempotencyKey !== "string" || typeof request.target !== "object" || request.target === null) return void 0;
+	if (typeof request?.text !== "string" || typeof request.idempotencyKey !== "string" || !isMessageTarget(request.target)) return void 0;
 	const text = request.text;
 	const codePoints = Array.from(text);
 	if (text.trim().length === 0 || codePoints.length > MAX_MESSAGE_CHARACTERS || request.idempotencyKey.length === 0 || request.idempotencyKey.length > 512) return void 0;
 	if (request.target.kind === "direct") {
-		if (typeof request.target.peer !== "string" || request.mentions !== void 0) return void 0;
-	} else if (request.target.kind === "group") {
-		if (typeof request.target.group !== "string") return void 0;
-	} else return void 0;
+		if (request.mentions !== void 0) return void 0;
+	}
 	if (request.mentions === void 0) return request;
 	if (!Array.isArray(request.mentions) || request.mentions.length === 0 || request.mentions.length > 100) return void 0;
 	const ids = /* @__PURE__ */ new Set();
@@ -4459,8 +4563,12 @@ let AwikiService = (() => {
 	let _getDeviceJoinStatus_decorators;
 	let _cancelDeviceJoin_decorators;
 	let _refreshDeviceManagement_decorators;
+	let _getIdentityServices_decorators;
+	let _updateIdentityServices_decorators;
+	let _resumeIdentityServicesUpdate_decorators;
 	let _startDeviceJoinVerification_decorators;
 	let _approveDeviceJoin_decorators;
+	let _retryDeviceManagement_decorators;
 	let _rejectDeviceJoin_decorators;
 	let _revokeDevice_decorators;
 	let _prepareRootTransfer_decorators;
@@ -4524,8 +4632,12 @@ let AwikiService = (() => {
 			_getDeviceJoinStatus_decorators = [Remote];
 			_cancelDeviceJoin_decorators = [Remote];
 			_refreshDeviceManagement_decorators = [Remote];
+			_getIdentityServices_decorators = [Remote];
+			_updateIdentityServices_decorators = [Remote];
+			_resumeIdentityServicesUpdate_decorators = [Remote];
 			_startDeviceJoinVerification_decorators = [Remote];
 			_approveDeviceJoin_decorators = [Remote];
+			_retryDeviceManagement_decorators = [Remote];
 			_rejectDeviceJoin_decorators = [Remote];
 			_revokeDevice_decorators = [Remote];
 			_prepareRootTransfer_decorators = [Remote];
@@ -4786,6 +4898,39 @@ let AwikiService = (() => {
 				},
 				metadata: _metadata
 			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _getIdentityServices_decorators, {
+				kind: "method",
+				name: "getIdentityServices",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "getIdentityServices" in obj,
+					get: (obj) => obj.getIdentityServices
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _updateIdentityServices_decorators, {
+				kind: "method",
+				name: "updateIdentityServices",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "updateIdentityServices" in obj,
+					get: (obj) => obj.updateIdentityServices
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _resumeIdentityServicesUpdate_decorators, {
+				kind: "method",
+				name: "resumeIdentityServicesUpdate",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "resumeIdentityServicesUpdate" in obj,
+					get: (obj) => obj.resumeIdentityServicesUpdate
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
 			__esDecorate(this, null, _startDeviceJoinVerification_decorators, {
 				kind: "method",
 				name: "startDeviceJoinVerification",
@@ -4808,6 +4953,17 @@ let AwikiService = (() => {
 				},
 				metadata: _metadata
 			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _retryDeviceManagement_decorators, {
+				kind: "method",
+				name: "retryDeviceManagement",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "retryDeviceManagement" in obj,
+					get: (obj) => obj.retryDeviceManagement
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
 			__esDecorate(this, null, _rejectDeviceJoin_decorators, {
 				kind: "method",
 				name: "rejectDeviceJoin",
@@ -5428,6 +5584,7 @@ let AwikiService = (() => {
 				allowedAttachmentOrigins: tenant.storageLayout === "legacy-base" ? this.resolved.allowedAttachmentOrigins : [messageServicePublicOrigin],
 				attachmentMaxBytes: this.resolved.attachmentMaxBytes,
 				allowInsecureLoopbackForTesting: this.resolved.allowInsecureLoopbackForTesting,
+				...this.resolved.caBundle === void 0 ? {} : { caBundle: this.resolved.caBundle },
 				stateRoot: this.ensureTenantRegistry().stateRoot(tenant)
 			};
 		}
@@ -5477,7 +5634,10 @@ let AwikiService = (() => {
 		}
 		/** Read the Host-owned catalog for trusted loopback settings surfaces. */
 		getTenantRegistryView() {
-			return this.ensureTenantRegistry().snapshot(this.tenantSwitching);
+			return {
+				...this.ensureTenantRegistry().snapshot(this.tenantSwitching),
+				generation: this.runtimeGeneration
+			};
 		}
 		/** Browser-safe, same-process update state for Desktop and loopback settings. */
 		getUpdatePolicyStatus() {
@@ -5491,15 +5651,27 @@ let AwikiService = (() => {
 				...modelProxyVersion === void 0 ? {} : { currentModelProxyVersion: modelProxyVersion }
 			});
 		}
-		/** Only the Desktop provider owns its release source; tenants cannot override it. */
+		/** Project only the active tenant's Desktop state; retain legacy detection without its fixed source. */
 		getDesktopUpdate() {
-			return decodeDesktopDistribution(this.desktopDistribution?.getSnapshot());
+			const view = decodeDesktopDistribution(this.desktopDistribution?.getSnapshot());
+			if (view === void 0 || view.schemaVersion === 1) return view;
+			const tenant = this.activeTenant ?? this.ensureTenantRegistry().active();
+			if (this.tenantSwitching || view.tenantId !== tenant.tenantId || view.policyOrigin !== new URL(tenant.backendBaseUrl).origin || view.tenantGeneration !== this.runtimeGeneration) return {
+				schemaVersion: 2,
+				distributionId: "awiki-dsh-desktop",
+				currentVersion: view.currentVersion,
+				channel: view.channel,
+				state: "unavailable",
+				updateAvailable: false,
+				usedCache: false
+			};
+			return view;
 		}
 		async refreshDesktopUpdate() {
 			const provider = this.desktopDistribution;
 			if (provider === void 0) return void 0;
-			const value = await provider.check();
-			return provider === this.desktopDistribution ? decodeDesktopDistribution(value) : this.getDesktopUpdate();
+			await provider.check();
+			return this.getDesktopUpdate();
 		}
 		/** Refresh only the active generation; late results from old tenants are discarded. */
 		refreshUpdatePolicy() {
@@ -5931,70 +6103,87 @@ let AwikiService = (() => {
 				ok: false,
 				error: failure("invalid-request")
 			};
-			const endpoint = new URL(`/.well-known/handle/${encodeURIComponent(target.localPart)}`, options.userServiceUrl);
+			if (request.inviteCode !== void 0 && (typeof request.inviteCode !== "string" || request.inviteCode.length > 512) || request.phone !== void 0 && (typeof request.phone !== "string" || request.phone.length > 64)) return {
+				ok: false,
+				error: failure("invalid-request")
+			};
+			const endpoint = new URL("/user-service/v1/handle/rpc", options.userServiceUrl);
 			const abort = new AbortController();
 			const timeout = setTimeout(() => {
 				abort.abort();
 			}, 1e4);
-			let response;
 			try {
-				response = await fetch(endpoint, {
-					method: "GET",
+				const response = await fetch(endpoint, {
+					method: "POST",
 					headers: {
 						accept: "application/json",
+						"content-type": "application/json",
 						"cache-control": "no-store"
 					},
+					body: JSON.stringify({
+						jsonrpc: "2.0",
+						id: "registration-check",
+						method: "registration_check",
+						params: {
+							handle: target.localPart,
+							domain: options.userServiceDomain,
+							check_invite: request.inviteCode !== void 0,
+							...request.inviteCode === void 0 ? {} : { invite_code: request.inviteCode },
+							...request.phone === void 0 ? {} : { phone: request.phone }
+						}
+					}),
 					cache: "no-store",
 					redirect: "error",
 					signal: abort.signal
 				});
-			} catch {
-				return {
+				if (!response.ok) return {
 					ok: false,
-					error: failure("network")
+					error: failure("remote")
 				};
-			} finally {
-				clearTimeout(timeout);
-			}
-			if (response.status === 404) return {
-				ok: true,
-				value: {
-					status: "available",
-					fullHandle: target.fullHandle
-				}
-			};
-			if (!response.ok && response.status !== 410) return {
-				ok: false,
-				error: failure("remote")
-			};
-			try {
 				const text = await readBoundedResponseText(response, IDENTITY_ACCESS_RESPONSE_MAX_BYTES);
 				if (text === void 0) return {
 					ok: false,
 					error: failure("remote")
 				};
-				const value = JSON.parse(text);
-				if (typeof value !== "object" || value === null) return {
-					ok: false,
-					error: failure("remote")
-				};
-				const binding = value;
-				if (binding.handle !== target.fullHandle || !isBoundedDidUri(binding.did) || typeof binding.status !== "string" || binding.status.length === 0 || response.status === 410 && binding.status !== "revoked") return {
+				let envelope;
+				try {
+					envelope = JSON.parse(text);
+				} catch {
+					return {
+						ok: false,
+						error: failure("remote")
+					};
+				}
+				const value = envelope?.result;
+				if (envelope?.jsonrpc !== "2.0" || envelope.id !== "registration-check" || envelope.error !== void 0 && envelope.error !== null || value?.full_handle !== target.fullHandle || ![
+					"register",
+					"existing",
+					"unavailable"
+				].includes(value.decision) || typeof value.invite_required !== "boolean" || ![
+					"not_required",
+					"required",
+					"valid",
+					"invalid"
+				].includes(value.invite_status) || value.decision === "existing" && value.invite_required || !value.invite_required && value.invite_status !== "not_required" || value.invite_required && value.invite_status === "not_required") return {
 					ok: false,
 					error: failure("remote")
 				};
 				return {
 					ok: true,
 					value: {
-						status: "existing",
-						fullHandle: target.fullHandle
+						status: value.decision === "register" ? "available" : value.decision,
+						fullHandle: target.fullHandle,
+						inviteRequired: value.invite_required,
+						inviteStatus: value.invite_status
 					}
 				};
 			} catch {
 				return {
 					ok: false,
-					error: failure("remote")
+					error: failure("network")
 				};
+			} finally {
+				clearTimeout(timeout);
 			}
 		}
 		async sendRegistrationOtp(request) {
@@ -6036,7 +6225,8 @@ let AwikiService = (() => {
 				continuationId: result.value.continuationId,
 				fullHandle: result.value.fullHandle,
 				mode: result.value.mode,
-				requiresUserPresence: result.value.requiresUserPresence
+				requiresUserPresence: result.value.requiresUserPresence,
+				...result.value.methodCapabilities === void 0 ? {} : { methodCapabilities: result.value.methodCapabilities }
 			};
 			return {
 				ok: true,
@@ -6044,7 +6234,8 @@ let AwikiService = (() => {
 					status: "join-required",
 					fullHandle: result.value.fullHandle,
 					mode: result.value.mode,
-					requiresUserPresence: result.value.requiresUserPresence
+					requiresUserPresence: result.value.requiresUserPresence,
+					...result.value.methodCapabilities === void 0 ? {} : { methodCapabilities: result.value.methodCapabilities }
 				}
 			};
 		}
@@ -6119,6 +6310,10 @@ let AwikiService = (() => {
 			return this.run(async (client) => {
 				const joining = await this.selectDeviceJoinSession(client) !== null;
 				const recoveries = await client.listPendingRecoveries();
+				const pendingRegistrations = await client.pendingIdentityRegistrations();
+				const creationMethods = await client.identityCreationMethods().catch(() => []);
+				const identity = await client.getIdentity();
+				const capabilities = identity === null ? void 0 : await client.identityMethodCapabilities(identity.did);
 				const domain = this.activeClientOptions?.userServiceDomain;
 				const choice = this.pendingDeviceJoin;
 				return {
@@ -6126,9 +6321,13 @@ let AwikiService = (() => {
 						status: "join-required",
 						fullHandle: choice.fullHandle,
 						mode: choice.mode,
-						requiresUserPresence: choice.requiresUserPresence
+						requiresUserPresence: choice.requiresUserPresence,
+						...choice.methodCapabilities === void 0 ? {} : { methodCapabilities: choice.methodCapabilities }
 					},
 					joining,
+					creationMethods,
+					pendingRegistrations,
+					...capabilities === void 0 ? {} : { methodCapabilities: capabilities },
 					recoveries: recoveries.filter((value) => domain !== void 0 && value.fullHandle.slice(value.fullHandle.indexOf(".") + 1) === domain)
 				};
 			}, { allowSignedOut: true });
@@ -6165,6 +6364,48 @@ let AwikiService = (() => {
 		refreshDeviceManagement() {
 			return this.run((client) => this.deviceManagementSnapshot(client));
 		}
+		getIdentityServices() {
+			return this.run((client) => client.getIdentityServices());
+		}
+		updateIdentityServices(request) {
+			if (request === null || !Array.isArray(request.services)) return Promise.resolve({
+				ok: false,
+				error: failure("invalid-request")
+			});
+			return this.run(async (client) => {
+				const did = await this.requireIdentityServicesManager(client);
+				if (request.did !== did) throw Object.assign(/* @__PURE__ */ new Error("identity changed"), {
+					name: "AwikiSdkError",
+					code: "conflict"
+				});
+				if ((await client.getIdentityServices()).pending) throw Object.assign(/* @__PURE__ */ new Error("pending service update"), {
+					name: "AwikiSdkError",
+					code: "conflict"
+				});
+				await client.updateIdentityServices(request);
+				return client.getIdentityServices();
+			});
+		}
+		resumeIdentityServicesUpdate(request) {
+			return this.run(async (client) => {
+				const did = await this.requireIdentityServicesManager(client);
+				if (request?.did !== did) throw Object.assign(/* @__PURE__ */ new Error("identity changed"), {
+					name: "AwikiSdkError",
+					code: "conflict"
+				});
+				await client.resumeIdentityServicesUpdate();
+				return client.getIdentityServices();
+			});
+		}
+		async requireIdentityServicesManager(client) {
+			await this.requireDeviceManager(client);
+			const identity = await client.getIdentity();
+			if (identity === null || !(await client.identityMethodCapabilities(identity.did)).servicesUpdate) throw Object.assign(/* @__PURE__ */ new Error("service update unavailable"), {
+				name: "AwikiSdkError",
+				code: "forbidden"
+			});
+			return identity.did;
+		}
 		async startDeviceJoinVerification(request) {
 			const joinSessionId = this.requestSessions.get(request?.requestRef);
 			if (joinSessionId === void 0) return {
@@ -6240,6 +6481,23 @@ let AwikiService = (() => {
 			});
 			return result.ok ? this.publicAdminJoinProgress(request.requestRef, result.value) : result;
 		}
+		async retryDeviceManagement(request) {
+			const deviceId = this.deviceIds.get(request?.deviceRef);
+			if (deviceId === void 0) return {
+				ok: false,
+				error: failure("invalid-request")
+			};
+			return this.run(async (client) => {
+				await this.requireDeviceManager(client);
+				const task = (await client.deviceJoinManagementStatus()).find((value) => value.recipientDeviceId === deviceId);
+				if (task === void 0 || task.phase !== "failed" || ["root_transfer.delivery_expired", "root_transfer.delivery_invalidated"].includes(task.failureCode ?? "")) throw Object.assign(/* @__PURE__ */ new Error("management retry unavailable"), {
+					name: "AwikiSdkError",
+					code: "forbidden"
+				});
+				await client.retryDeviceJoinManagement(task.joinSessionId);
+				return null;
+			});
+		}
 		async rejectDeviceJoin(request) {
 			const joinSessionId = this.requestSessions.get(request?.requestRef);
 			if (joinSessionId === void 0 || request.reason !== "user_rejected" && request.reason !== "sas_mismatch") return {
@@ -6710,6 +6968,10 @@ let AwikiService = (() => {
 		* @returns The accepted attachment message or a closed failure.
 		*/
 		async sendAttachment(request) {
+			if (!isMessageTarget(request?.target)) return {
+				ok: false,
+				error: failure("invalid-request")
+			};
 			const decoded = decodeAttachment(request.bytesBase64, this.resolved.attachmentMaxBytes);
 			if (!decoded.ok) return decoded;
 			return this.run(async (client) => {
@@ -7081,6 +7343,10 @@ let AwikiService = (() => {
 				name: "AwikiSdkError",
 				code: "not-registered"
 			});
+			if (!(await client.identityMethodCapabilities(identity.did)).rootTransfer) throw Object.assign(/* @__PURE__ */ new Error("root transfer unavailable"), {
+				name: "AwikiSdkError",
+				code: "forbidden"
+			});
 			const target = (await client.getDeviceRegistry()).find((device) => device.deviceId === deviceId);
 			if (target === void 0 || target.isCurrent || target.status !== "active" || target.role !== "member" || target.managementReady) throw Object.assign(/* @__PURE__ */ new Error("root transfer recipient unavailable"), {
 				name: "AwikiSdkError",
@@ -7107,6 +7373,9 @@ let AwikiService = (() => {
 		async deviceManagementSnapshot(client) {
 			await client.syncDeviceManagement();
 			const current = await client.getCurrentDeviceSummary();
+			const currentIdentity = await client.getIdentity();
+			const capabilities = currentIdentity === null ? void 0 : await client.identityMethodCapabilities(currentIdentity.did);
+			const rootTransferSupported = capabilities?.rootTransfer === true && client.trustedUserPresenceSupported;
 			if (!current.canManage || current.role !== "admin" || current.readiness !== "admin_ready") {
 				this.requestRefs.clear();
 				this.requestSessions.clear();
@@ -7115,7 +7384,8 @@ let AwikiService = (() => {
 				this.rootTransfers.clear();
 				return {
 					canManage: false,
-					rootTransferSupported: client.trustedUserPresenceSupported,
+					rootTransferSupported,
+					...capabilities === void 0 ? {} : { methodCapabilities: capabilities },
 					...current.role === void 0 ? {} : { role: current.role },
 					readiness: current.readiness,
 					devices: [],
@@ -7124,6 +7394,7 @@ let AwikiService = (() => {
 			}
 			const requests = await client.listLocalDeviceJoinRequests();
 			await Promise.all(requests.filter((request) => request.claimedByCurrentDevice).map((request) => client.getLocalDeviceJoinVerificationProgress(request.joinSessionId).catch(() => void 0)));
+			const management = await client.deviceJoinManagementStatus();
 			const devices = await client.getDeviceRegistry();
 			const identity = await client.getIdentity();
 			const joinedAtByDeviceId = /* @__PURE__ */ new Map();
@@ -7134,10 +7405,22 @@ let AwikiService = (() => {
 			const initialDeviceJoinedAt = identity === null ? void 0 : new Date(identity.registeredAt).toISOString();
 			return {
 				canManage: true,
-				rootTransferSupported: client.trustedUserPresenceSupported,
+				rootTransferSupported,
+				...capabilities === void 0 ? {} : { methodCapabilities: capabilities },
 				role: "admin",
 				readiness: "admin_ready",
-				devices: devices.filter((device) => device.status === "active").map((device) => this.publicDevice(device, joinedAtByDeviceId.get(device.deviceId) ?? (device.isCurrent ? initialDeviceJoinedAt : void 0))),
+				devices: devices.filter((device) => device.status === "active").map((device) => {
+					const task = management.find((value) => value.recipientDeviceId === device.deviceId);
+					const phase = task?.phase === "failed" ? "failed" : task?.phase === "management_registered" ? "complete" : task?.phase === "waiting_for_recipient" ? "waiting" : "pending";
+					return {
+						...this.publicDevice(device, joinedAtByDeviceId.get(device.deviceId) ?? (device.isCurrent ? initialDeviceJoinedAt : void 0)),
+						...task === void 0 ? {} : { provisioning: {
+							phase,
+							attempts: task.attempts,
+							...["root_transfer.delivery_expired", "root_transfer.delivery_invalidated"].includes(task.failureCode ?? "") ? { requiresRejoin: true } : {}
+						} }
+					};
+				}),
 				requests: requests.map((request) => ({
 					requestRef: this.requestRef(request.joinSessionId),
 					candidateKeyFingerprint: request.candidateKeyFingerprint,