@awiki/dsh-plugin 0.3.12 → 0.3.16

package/lib/index.js

@@ -1,4 +1,4 @@
-import { a as fencedMailRecoveryObservability, i as failedMailRecoveryObservability, o as successfulMailRecoveryObservability, r as downloadedAttachment, s as isMessageTarget, t as AwikiSdkError } from "./sdk-adapter-DFDY7Hih.mjs";
+import { a as fencedMailRecoveryObservability, i as failedMailRecoveryObservability, o as successfulMailRecoveryObservability, r as downloadedAttachment, s as isMessageTarget, t as AwikiSdkError } from "./sdk-adapter-DGcTiEZz.mjs";
 import "@deepseek-ai/cordis";
 import { createHash, randomUUID, timingSafeEqual } from "node:crypto";
 import { homedir } from "node:os";
@@ -3571,8 +3571,8 @@ function checkInstallation(requirements, installed) {
 //#endregion
 //#region lib/types/package-version.generated.js
 /** Generated from package.json by scripts/sync-package-versions.mjs. */
-const DSH_AWIKI_PACKAGE_VERSION = "0.3.12";
-const DSH_AWIKI_MODEL_PROXY_PACKAGE_VERSION = "0.1.7";
+const DSH_AWIKI_PACKAGE_VERSION = "0.3.16";
+const DSH_AWIKI_MODEL_PROXY_PACKAGE_VERSION = "0.1.11";
 //#endregion
 //#region lib/types/update-policy.js
 /** Tenant-scoped DSH AWiki plugin update policy and verified cache. */
@@ -3979,6 +3979,7 @@ const Config = z.object({
 	messageServiceDid: z.string().default(DEFAULT_AWIKI_MESSAGE_SERVICE_DID),
 	allowedAttachmentOrigins: z.array(z.string()).default([]),
 	allowInsecureLoopbackForTesting: z.boolean().default(false),
+	caBundle: z.string(),
 	stateRoot: z.string(),
 	attachmentMaxBytes: z.number().default(DEFAULT_ATTACHMENT_MAX_BYTES),
 	mailAttachmentMaxCount: z.number().default(10),
@@ -4198,6 +4199,7 @@ function resolveConfig(ctx, config) {
 		messageServiceDid: serviceDid(config.messageServiceDid ?? DEFAULT_AWIKI_MESSAGE_SERVICE_DID),
 		allowedAttachmentOrigins: attachmentOrigins(config.allowedAttachmentOrigins, messageServicePublicUrl, allowInsecureLoopbackForTesting),
 		allowInsecureLoopbackForTesting,
+		...config.caBundle === void 0 ? {} : { caBundle: config.caBundle },
 		stateRoot,
 		attachmentMaxBytes,
 		mailAttachmentMaxCount,
@@ -4333,12 +4335,7 @@ function normalizeRecoveryPrepareRequest(request) {
 	};
 }
 const IDENTITY_ACCESS_RESPONSE_MAX_BYTES = 65536;
-const DID_URI = /^did:[a-z0-9]+:(?:[A-Za-z0-9._-]|%[0-9A-Fa-f]{2})+(?::(?:[A-Za-z0-9._-]|%[0-9A-Fa-f]{2})+)*$/u;
-const DID_URI_MAX_CHARACTERS = 2048;
 const SERVER_INFO_RESPONSE_MAX_BYTES = 65536;
-function isBoundedDidUri(value) {
-	return typeof value === "string" && value.length <= DID_URI_MAX_CHARACTERS && DID_URI.test(value);
-}
 /** Read one untrusted discovery response without buffering beyond the fixed Host limit. */
 async function readBoundedResponseText(response, maxBytes) {
 	const declaredLength = response.headers.get("content-length");
@@ -4566,8 +4563,12 @@ let AwikiService = (() => {
 	let _getDeviceJoinStatus_decorators;
 	let _cancelDeviceJoin_decorators;
 	let _refreshDeviceManagement_decorators;
+	let _getIdentityServices_decorators;
+	let _updateIdentityServices_decorators;
+	let _resumeIdentityServicesUpdate_decorators;
 	let _startDeviceJoinVerification_decorators;
 	let _approveDeviceJoin_decorators;
+	let _retryDeviceManagement_decorators;
 	let _rejectDeviceJoin_decorators;
 	let _revokeDevice_decorators;
 	let _prepareRootTransfer_decorators;
@@ -4631,8 +4632,12 @@ let AwikiService = (() => {
 			_getDeviceJoinStatus_decorators = [Remote];
 			_cancelDeviceJoin_decorators = [Remote];
 			_refreshDeviceManagement_decorators = [Remote];
+			_getIdentityServices_decorators = [Remote];
+			_updateIdentityServices_decorators = [Remote];
+			_resumeIdentityServicesUpdate_decorators = [Remote];
 			_startDeviceJoinVerification_decorators = [Remote];
 			_approveDeviceJoin_decorators = [Remote];
+			_retryDeviceManagement_decorators = [Remote];
 			_rejectDeviceJoin_decorators = [Remote];
 			_revokeDevice_decorators = [Remote];
 			_prepareRootTransfer_decorators = [Remote];
@@ -4893,6 +4898,39 @@ let AwikiService = (() => {
 				},
 				metadata: _metadata
 			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _getIdentityServices_decorators, {
+				kind: "method",
+				name: "getIdentityServices",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "getIdentityServices" in obj,
+					get: (obj) => obj.getIdentityServices
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _updateIdentityServices_decorators, {
+				kind: "method",
+				name: "updateIdentityServices",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "updateIdentityServices" in obj,
+					get: (obj) => obj.updateIdentityServices
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _resumeIdentityServicesUpdate_decorators, {
+				kind: "method",
+				name: "resumeIdentityServicesUpdate",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "resumeIdentityServicesUpdate" in obj,
+					get: (obj) => obj.resumeIdentityServicesUpdate
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
 			__esDecorate(this, null, _startDeviceJoinVerification_decorators, {
 				kind: "method",
 				name: "startDeviceJoinVerification",
@@ -4915,6 +4953,17 @@ let AwikiService = (() => {
 				},
 				metadata: _metadata
 			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _retryDeviceManagement_decorators, {
+				kind: "method",
+				name: "retryDeviceManagement",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "retryDeviceManagement" in obj,
+					get: (obj) => obj.retryDeviceManagement
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
 			__esDecorate(this, null, _rejectDeviceJoin_decorators, {
 				kind: "method",
 				name: "rejectDeviceJoin",
@@ -5535,6 +5584,7 @@ let AwikiService = (() => {
 				allowedAttachmentOrigins: tenant.storageLayout === "legacy-base" ? this.resolved.allowedAttachmentOrigins : [messageServicePublicOrigin],
 				attachmentMaxBytes: this.resolved.attachmentMaxBytes,
 				allowInsecureLoopbackForTesting: this.resolved.allowInsecureLoopbackForTesting,
+				...this.resolved.caBundle === void 0 ? {} : { caBundle: this.resolved.caBundle },
 				stateRoot: this.ensureTenantRegistry().stateRoot(tenant)
 			};
 		}
@@ -6053,70 +6103,87 @@ let AwikiService = (() => {
 				ok: false,
 				error: failure("invalid-request")
 			};
-			const endpoint = new URL(`/.well-known/handle/${encodeURIComponent(target.localPart)}`, options.userServiceUrl);
+			if (request.inviteCode !== void 0 && (typeof request.inviteCode !== "string" || request.inviteCode.length > 512) || request.phone !== void 0 && (typeof request.phone !== "string" || request.phone.length > 64)) return {
+				ok: false,
+				error: failure("invalid-request")
+			};
+			const endpoint = new URL("/user-service/v1/handle/rpc", options.userServiceUrl);
 			const abort = new AbortController();
 			const timeout = setTimeout(() => {
 				abort.abort();
 			}, 1e4);
-			let response;
 			try {
-				response = await fetch(endpoint, {
-					method: "GET",
+				const response = await fetch(endpoint, {
+					method: "POST",
 					headers: {
 						accept: "application/json",
+						"content-type": "application/json",
 						"cache-control": "no-store"
 					},
+					body: JSON.stringify({
+						jsonrpc: "2.0",
+						id: "registration-check",
+						method: "registration_check",
+						params: {
+							handle: target.localPart,
+							domain: options.userServiceDomain,
+							check_invite: request.inviteCode !== void 0,
+							...request.inviteCode === void 0 ? {} : { invite_code: request.inviteCode },
+							...request.phone === void 0 ? {} : { phone: request.phone }
+						}
+					}),
 					cache: "no-store",
 					redirect: "error",
 					signal: abort.signal
 				});
-			} catch {
-				return {
+				if (!response.ok) return {
 					ok: false,
-					error: failure("network")
+					error: failure("remote")
 				};
-			} finally {
-				clearTimeout(timeout);
-			}
-			if (response.status === 404) return {
-				ok: true,
-				value: {
-					status: "available",
-					fullHandle: target.fullHandle
-				}
-			};
-			if (!response.ok && response.status !== 410) return {
-				ok: false,
-				error: failure("remote")
-			};
-			try {
 				const text = await readBoundedResponseText(response, IDENTITY_ACCESS_RESPONSE_MAX_BYTES);
 				if (text === void 0) return {
 					ok: false,
 					error: failure("remote")
 				};
-				const value = JSON.parse(text);
-				if (typeof value !== "object" || value === null) return {
-					ok: false,
-					error: failure("remote")
-				};
-				const binding = value;
-				if (binding.handle !== target.fullHandle || !isBoundedDidUri(binding.did) || typeof binding.status !== "string" || binding.status.length === 0 || response.status === 410 && binding.status !== "revoked") return {
+				let envelope;
+				try {
+					envelope = JSON.parse(text);
+				} catch {
+					return {
+						ok: false,
+						error: failure("remote")
+					};
+				}
+				const value = envelope?.result;
+				if (envelope?.jsonrpc !== "2.0" || envelope.id !== "registration-check" || envelope.error !== void 0 && envelope.error !== null || value?.full_handle !== target.fullHandle || ![
+					"register",
+					"existing",
+					"unavailable"
+				].includes(value.decision) || typeof value.invite_required !== "boolean" || ![
+					"not_required",
+					"required",
+					"valid",
+					"invalid"
+				].includes(value.invite_status) || value.decision === "existing" && value.invite_required || !value.invite_required && value.invite_status !== "not_required" || value.invite_required && value.invite_status === "not_required") return {
 					ok: false,
 					error: failure("remote")
 				};
 				return {
 					ok: true,
 					value: {
-						status: "existing",
-						fullHandle: target.fullHandle
+						status: value.decision === "register" ? "available" : value.decision,
+						fullHandle: target.fullHandle,
+						inviteRequired: value.invite_required,
+						inviteStatus: value.invite_status
 					}
 				};
 			} catch {
 				return {
 					ok: false,
-					error: failure("remote")
+					error: failure("network")
 				};
+			} finally {
+				clearTimeout(timeout);
 			}
 		}
 		async sendRegistrationOtp(request) {
@@ -6158,7 +6225,8 @@ let AwikiService = (() => {
 				continuationId: result.value.continuationId,
 				fullHandle: result.value.fullHandle,
 				mode: result.value.mode,
-				requiresUserPresence: result.value.requiresUserPresence
+				requiresUserPresence: result.value.requiresUserPresence,
+				...result.value.methodCapabilities === void 0 ? {} : { methodCapabilities: result.value.methodCapabilities }
 			};
 			return {
 				ok: true,
@@ -6166,7 +6234,8 @@ let AwikiService = (() => {
 					status: "join-required",
 					fullHandle: result.value.fullHandle,
 					mode: result.value.mode,
-					requiresUserPresence: result.value.requiresUserPresence
+					requiresUserPresence: result.value.requiresUserPresence,
+					...result.value.methodCapabilities === void 0 ? {} : { methodCapabilities: result.value.methodCapabilities }
 				}
 			};
 		}
@@ -6241,6 +6310,10 @@ let AwikiService = (() => {
 			return this.run(async (client) => {
 				const joining = await this.selectDeviceJoinSession(client) !== null;
 				const recoveries = await client.listPendingRecoveries();
+				const pendingRegistrations = await client.pendingIdentityRegistrations();
+				const creationMethods = await client.identityCreationMethods().catch(() => []);
+				const identity = await client.getIdentity();
+				const capabilities = identity === null ? void 0 : await client.identityMethodCapabilities(identity.did);
 				const domain = this.activeClientOptions?.userServiceDomain;
 				const choice = this.pendingDeviceJoin;
 				return {
@@ -6248,9 +6321,13 @@ let AwikiService = (() => {
 						status: "join-required",
 						fullHandle: choice.fullHandle,
 						mode: choice.mode,
-						requiresUserPresence: choice.requiresUserPresence
+						requiresUserPresence: choice.requiresUserPresence,
+						...choice.methodCapabilities === void 0 ? {} : { methodCapabilities: choice.methodCapabilities }
 					},
 					joining,
+					creationMethods,
+					pendingRegistrations,
+					...capabilities === void 0 ? {} : { methodCapabilities: capabilities },
 					recoveries: recoveries.filter((value) => domain !== void 0 && value.fullHandle.slice(value.fullHandle.indexOf(".") + 1) === domain)
 				};
 			}, { allowSignedOut: true });
@@ -6287,6 +6364,48 @@ let AwikiService = (() => {
 		refreshDeviceManagement() {
 			return this.run((client) => this.deviceManagementSnapshot(client));
 		}
+		getIdentityServices() {
+			return this.run((client) => client.getIdentityServices());
+		}
+		updateIdentityServices(request) {
+			if (request === null || !Array.isArray(request.services)) return Promise.resolve({
+				ok: false,
+				error: failure("invalid-request")
+			});
+			return this.run(async (client) => {
+				const did = await this.requireIdentityServicesManager(client);
+				if (request.did !== did) throw Object.assign(/* @__PURE__ */ new Error("identity changed"), {
+					name: "AwikiSdkError",
+					code: "conflict"
+				});
+				if ((await client.getIdentityServices()).pending) throw Object.assign(/* @__PURE__ */ new Error("pending service update"), {
+					name: "AwikiSdkError",
+					code: "conflict"
+				});
+				await client.updateIdentityServices(request);
+				return client.getIdentityServices();
+			});
+		}
+		resumeIdentityServicesUpdate(request) {
+			return this.run(async (client) => {
+				const did = await this.requireIdentityServicesManager(client);
+				if (request?.did !== did) throw Object.assign(/* @__PURE__ */ new Error("identity changed"), {
+					name: "AwikiSdkError",
+					code: "conflict"
+				});
+				await client.resumeIdentityServicesUpdate();
+				return client.getIdentityServices();
+			});
+		}
+		async requireIdentityServicesManager(client) {
+			await this.requireDeviceManager(client);
+			const identity = await client.getIdentity();
+			if (identity === null || !(await client.identityMethodCapabilities(identity.did)).servicesUpdate) throw Object.assign(/* @__PURE__ */ new Error("service update unavailable"), {
+				name: "AwikiSdkError",
+				code: "forbidden"
+			});
+			return identity.did;
+		}
 		async startDeviceJoinVerification(request) {
 			const joinSessionId = this.requestSessions.get(request?.requestRef);
 			if (joinSessionId === void 0) return {
@@ -6362,6 +6481,23 @@ let AwikiService = (() => {
 			});
 			return result.ok ? this.publicAdminJoinProgress(request.requestRef, result.value) : result;
 		}
+		async retryDeviceManagement(request) {
+			const deviceId = this.deviceIds.get(request?.deviceRef);
+			if (deviceId === void 0) return {
+				ok: false,
+				error: failure("invalid-request")
+			};
+			return this.run(async (client) => {
+				await this.requireDeviceManager(client);
+				const task = (await client.deviceJoinManagementStatus()).find((value) => value.recipientDeviceId === deviceId);
+				if (task === void 0 || task.phase !== "failed" || ["root_transfer.delivery_expired", "root_transfer.delivery_invalidated"].includes(task.failureCode ?? "")) throw Object.assign(/* @__PURE__ */ new Error("management retry unavailable"), {
+					name: "AwikiSdkError",
+					code: "forbidden"
+				});
+				await client.retryDeviceJoinManagement(task.joinSessionId);
+				return null;
+			});
+		}
 		async rejectDeviceJoin(request) {
 			const joinSessionId = this.requestSessions.get(request?.requestRef);
 			if (joinSessionId === void 0 || request.reason !== "user_rejected" && request.reason !== "sas_mismatch") return {
@@ -7207,6 +7343,10 @@ let AwikiService = (() => {
 				name: "AwikiSdkError",
 				code: "not-registered"
 			});
+			if (!(await client.identityMethodCapabilities(identity.did)).rootTransfer) throw Object.assign(/* @__PURE__ */ new Error("root transfer unavailable"), {
+				name: "AwikiSdkError",
+				code: "forbidden"
+			});
 			const target = (await client.getDeviceRegistry()).find((device) => device.deviceId === deviceId);
 			if (target === void 0 || target.isCurrent || target.status !== "active" || target.role !== "member" || target.managementReady) throw Object.assign(/* @__PURE__ */ new Error("root transfer recipient unavailable"), {
 				name: "AwikiSdkError",
@@ -7233,6 +7373,9 @@ let AwikiService = (() => {
 		async deviceManagementSnapshot(client) {
 			await client.syncDeviceManagement();
 			const current = await client.getCurrentDeviceSummary();
+			const currentIdentity = await client.getIdentity();
+			const capabilities = currentIdentity === null ? void 0 : await client.identityMethodCapabilities(currentIdentity.did);
+			const rootTransferSupported = capabilities?.rootTransfer === true && client.trustedUserPresenceSupported;
 			if (!current.canManage || current.role !== "admin" || current.readiness !== "admin_ready") {
 				this.requestRefs.clear();
 				this.requestSessions.clear();
@@ -7241,7 +7384,8 @@ let AwikiService = (() => {
 				this.rootTransfers.clear();
 				return {
 					canManage: false,
-					rootTransferSupported: client.trustedUserPresenceSupported,
+					rootTransferSupported,
+					...capabilities === void 0 ? {} : { methodCapabilities: capabilities },
 					...current.role === void 0 ? {} : { role: current.role },
 					readiness: current.readiness,
 					devices: [],
@@ -7250,6 +7394,7 @@ let AwikiService = (() => {
 			}
 			const requests = await client.listLocalDeviceJoinRequests();
 			await Promise.all(requests.filter((request) => request.claimedByCurrentDevice).map((request) => client.getLocalDeviceJoinVerificationProgress(request.joinSessionId).catch(() => void 0)));
+			const management = await client.deviceJoinManagementStatus();
 			const devices = await client.getDeviceRegistry();
 			const identity = await client.getIdentity();
 			const joinedAtByDeviceId = /* @__PURE__ */ new Map();
@@ -7260,10 +7405,22 @@ let AwikiService = (() => {
 			const initialDeviceJoinedAt = identity === null ? void 0 : new Date(identity.registeredAt).toISOString();
 			return {
 				canManage: true,
-				rootTransferSupported: client.trustedUserPresenceSupported,
+				rootTransferSupported,
+				...capabilities === void 0 ? {} : { methodCapabilities: capabilities },
 				role: "admin",
 				readiness: "admin_ready",
-				devices: devices.filter((device) => device.status === "active").map((device) => this.publicDevice(device, joinedAtByDeviceId.get(device.deviceId) ?? (device.isCurrent ? initialDeviceJoinedAt : void 0))),
+				devices: devices.filter((device) => device.status === "active").map((device) => {
+					const task = management.find((value) => value.recipientDeviceId === device.deviceId);
+					const phase = task?.phase === "failed" ? "failed" : task?.phase === "management_registered" ? "complete" : task?.phase === "waiting_for_recipient" ? "waiting" : "pending";
+					return {
+						...this.publicDevice(device, joinedAtByDeviceId.get(device.deviceId) ?? (device.isCurrent ? initialDeviceJoinedAt : void 0)),
+						...task === void 0 ? {} : { provisioning: {
+							phase,
+							attempts: task.attempts,
+							...["root_transfer.delivery_expired", "root_transfer.delivery_invalidated"].includes(task.failureCode ?? "") ? { requiresRejoin: true } : {}
+						} }
+					};
+				}),
 				requests: requests.map((request) => ({
 					requestRef: this.requestRef(request.joinSessionId),
 					candidateKeyFingerprint: request.candidateKeyFingerprint,

package/lib/provider.js

@@ -1,4 +1,4 @@
-import { n as RustSdkAdapter } from "./sdk-adapter-DFDY7Hih.mjs";
+import { n as RustSdkAdapter } from "./sdk-adapter-DGcTiEZz.mjs";
 import { setTimeout } from "node:timers/promises";
 import { openImCoreNodeClient } from "@awiki/im-core-node";
 import { AnpIdentityPluginError } from "@agent-network-protocol/dsh-anp-identity";
@@ -57,6 +57,7 @@ async function apply(ctx) {
 			const unregister = ctx.awiki.registerClientFactory((options) => {
 				const openOptions = {
 					stateRoot: options.stateRoot,
+					...options.caBundle === void 0 ? {} : { caBundle: options.caBundle },
 					serviceBaseUrl: options.userServiceUrl,
 					didDomain: options.userServiceDomain,
 					userServiceEndpoint: options.userServiceUrl,

package/lib/{sdk-adapter-DFDY7Hih.mjs → sdk-adapter-DGcTiEZz.mjs}

@@ -117,6 +117,30 @@ function fencedMailRecoveryObservability(currentPrincipalMatchesRecovery, reques
 /** Rust IM Core adapter that copies native values into Host-owned public DTOs. */
 const GROUP_LOOKUP_LIMIT = 100;
 const MAX_GROUP_LOOKUP_PAGES = 20;
+function methodCapabilities(value) {
+	return {
+		method: value.method,
+		handleRecovery: boolean(value.handleRecovery),
+		rootImport: boolean(value.rootImport),
+		rootTransfer: boolean(value.rootTransfer),
+		servicesUpdate: boolean(value.servicesUpdate)
+	};
+}
+function publicDocumentService(raw) {
+	if (typeof raw !== "object" || raw === null || Array.isArray(raw)) fail("invalid-request");
+	const value = raw;
+	if (typeof value.id !== "string" || typeof value.type !== "string" || typeof value.serviceEndpoint !== "string") fail("invalid-request");
+	if (value.serviceDid !== void 0 && typeof value.serviceDid !== "string") fail("invalid-request");
+	for (const field of ["profiles", "securityProfiles"]) if (value[field] !== void 0 && (!Array.isArray(value[field]) || !value[field].every((item) => typeof item === "string"))) fail("invalid-request");
+	return {
+		id: value.id,
+		type: value.type,
+		serviceEndpoint: value.serviceEndpoint,
+		...value.serviceDid === void 0 ? {} : { serviceDid: value.serviceDid },
+		...value.profiles === void 0 ? {} : { profiles: [...value.profiles] },
+		...value.securityProfiles === void 0 ? {} : { securityProfiles: [...value.securityProfiles] }
+	};
+}
 const RUST_FAILURE_CODES = {
 	invalid_input: "invalid-request",
 	invalid_state_root: "invalid-request",
@@ -479,6 +503,7 @@ var RustSdkAdapter = class {
 	onIdentity;
 	trustedUserPresenceSupported = process.platform === "darwin" && process.arch === "x64";
 	client;
+	approvalManagement = /* @__PURE__ */ new Map();
 	refreshingDisplayPeers = /* @__PURE__ */ new Set();
 	scheduleDisplayRefresh(client, peers) {
 		if (this.disposal !== void 0) return;
@@ -801,6 +826,48 @@ var RustSdkAdapter = class {
 			return result;
 		});
 	}
+	identityCreationMethods() {
+		return this.run(async (client) => [...await client.identityCreationMethods()]);
+	}
+	pendingIdentityRegistrations() {
+		return this.run(async (client) => (await client.pendingIdentityRegistrations()).map((value) => ({
+			did: value.did,
+			fullHandle: value.fullHandle,
+			method: value.method,
+			displayName: value.displayName,
+			verificationKind: value.verificationKind,
+			phase: value.phase
+		})));
+	}
+	identityMethodCapabilities(did) {
+		return this.run(async (client) => methodCapabilities(await client.identityMethodCapabilities(did)));
+	}
+	getIdentityServices() {
+		return this.run(async (client) => {
+			const currentIdentity = await client.getDefaultIdentity();
+			if (currentIdentity === null) fail("not-registered");
+			const capabilities = await client.identityMethodCapabilities(currentIdentity.did);
+			const current = await client.getCurrentDeviceSummary();
+			const document = await client.identityDocument();
+			if (document.id !== currentIdentity.did || !Array.isArray(document.service)) fail("remote");
+			return {
+				did: currentIdentity.did,
+				canManage: capabilities.servicesUpdate && current.canManage && current.role === "admin" && current.readiness === "admin_ready",
+				pending: await client.identityServicesUpdatePending(),
+				services: document.service.map(publicDocumentService)
+			};
+		});
+	}
+	updateIdentityServices(request) {
+		return this.run(async (client) => {
+			await client.updateIdentityServices(request.services.map(publicDocumentService));
+		});
+	}
+	resumeIdentityServicesUpdate() {
+		return this.run(async (client) => {
+			await client.resumeIdentityServicesUpdate();
+		});
+	}
 	sendRegistrationOtp(request) {
 		return this.run(async (client) => {
 			const value = await client.requestRegistrationOtp(request);
@@ -826,7 +893,8 @@ var RustSdkAdapter = class {
 				continuationId: required(value.existingHandle.continuationId),
 				fullHandle: required(value.existingHandle.fullHandle),
 				mode: value.existingHandle.mode === "handle_recovery_rebind" ? "handle-recovery-rebind" : "ordinary",
-				requiresUserPresence: boolean(value.existingHandle.requiresUserPresence)
+				requiresUserPresence: boolean(value.existingHandle.requiresUserPresence),
+				methodCapabilities: methodCapabilities(await client.identityMethodCapabilities(value.existingHandle.expectedDid))
 			};
 		});
 	}
@@ -899,17 +967,33 @@ var RustSdkAdapter = class {
 	}
 	prepareDeviceJoinApproval(joinSessionId) {
 		return this.run(async (client) => {
-			return { approvalHandle: required((await client.prepareDeviceJoinApproval({
+			const identity = await client.getDefaultIdentity();
+			if (identity === null) fail("not-registered");
+			const capabilities = await client.identityMethodCapabilities(identity.did);
+			const value = await client.prepareDeviceJoinApproval({
 				joinSessionId,
 				sasConfirmed: true
-			})).approvalHandle) };
+			});
+			this.approvalManagement.set(value.approvalHandle, capabilities.rootTransfer);
+			return { approvalHandle: required(value.approvalHandle) };
 		});
 	}
+	deviceJoinManagementStatus() {
+		return this.run((client) => client.deviceJoinManagementStatus());
+	}
+	retryDeviceJoinManagement(joinSessionId) {
+		return this.run((client) => client.retryDeviceJoinManagement({ joinSessionId }));
+	}
 	confirmDeviceJoinApproval(approvalHandle) {
-		return this.run(async (client) => adminJoinProgress(await client.confirmDeviceJoinApproval({
-			approvalHandle,
-			userPresenceConfirmed: true
-		})));
+		return this.run(async (client) => {
+			const request = {
+				approvalHandle,
+				userPresenceConfirmed: true
+			};
+			const result = this.approvalManagement.get(approvalHandle) === false ? await client.confirmDeviceJoinApproval(request) : await client.confirmDeviceJoinWithManagement(request);
+			this.approvalManagement.delete(approvalHandle);
+			return adminJoinProgress(result);
+		});
 	}
 	rejectDeviceJoin(joinSessionId, reason) {
 		return this.run(async (client) => adminJoinProgress(await client.rejectDeviceJoin({