@awiki/dsh-plugin 0.3.16 → 0.3.18

package/lib/types/client/controller.js

@@ -1,3 +1,4 @@
+import { avatarCache } from "./avatar-cache.js";
 import { AwikiDraftStore } from "./drafts.js";
 import { SHORT_HANDLE_INVITE_MESSAGE } from "../registration-policy.js";
 import { IndexedDbAwikiBrowserImageCache, } from "./image-cache.js";
@@ -12,6 +13,8 @@ function genericFailureMessage(failure) {
             return '无法连接 AWiki 服务，请检查网络后重试。';
         case 'rate-limited':
             return 'AWiki 请求过于频繁，请稍后重试。';
+        case 'group-member-encryption-not-ready':
+            return '尚未加入：对方尚未完成加密准备，请对方打开客户端后重试。';
         case 'not-registered':
             return '请先注册 AWiki 身份后重试。';
         case 'signed-out':
@@ -337,13 +340,17 @@ function canonicalMessagePage(incoming) {
 }
 /** Replace the newest loaded window while preserving older messages before it. */
 function mergeLatestMessages(current, incoming) {
-    const page = canonicalMessagePage(incoming);
+    const previous = new Map(current.map(message => [message.id, message]));
+    const page = canonicalMessagePage(incoming).map(message => previous.get(message.id)?.encryptionRequired === true
+        ? { ...message, encryptionRequired: true } : message);
     const incomingIds = new Set(page.map(message => message.id));
     return [...current.filter(message => !incomingIds.has(message.id)), ...page];
 }
 /** Prepend one chronological continuation page while exact-updating any overlap. */
 function mergeOlderMessages(current, incoming) {
-    const page = canonicalMessagePage(incoming);
+    const previous = new Map(current.map(message => [message.id, message]));
+    const page = canonicalMessagePage(incoming).map(message => previous.get(message.id)?.encryptionRequired === true
+        ? { ...message, encryptionRequired: true } : message);
     const incomingIds = new Set(page.map(message => message.id));
     return [...page, ...current.filter(message => !incomingIds.has(message.id))];
 }
@@ -352,7 +359,7 @@ function appendMessageById(current, incoming) {
     const index = current.findIndex(message => message.id === incoming.id);
     if (index < 0)
         return [...current, incoming];
-    return current.map((message, currentIndex) => currentIndex === index ? incoming : message);
+    return current.map((message, currentIndex) => currentIndex === index ? { ...incoming, ...(message.encryptionRequired === true ? { encryptionRequired: true } : {}) } : message);
 }
 /** Explain a background failure without implying that visible local messages were lost. */
 function refreshFailureMessage(messages, error) {
@@ -524,6 +531,7 @@ export class AwikiController {
     remote;
     persistentImageCache;
     drafts = new AwikiDraftStore();
+    retiredMessageIds = new Set();
     view = INITIAL_VIEW;
     listeners = new Set();
     /** Runtime-only selected operations survive tenant round trips without reopening stale browser hints after reload. */
@@ -539,8 +547,12 @@ export class AwikiController {
     tenantTransition;
     generation = 0;
     selectionRevision = 0;
+    groupReadRevision = 0;
     disposed = false;
     polling = false;
+    lastAvatarProfileCheck = 0;
+    avatarProfileRefreshGeneration = -1;
+    avatarProfileRefresh;
     markReadInFlight = new Map();
     unreadAtOpen = new Map();
     summaryBaselines = new Map();
@@ -583,7 +595,7 @@ export class AwikiController {
         if (!preserveView)
             this.summaryBaselines.clear();
         const previous = this.view;
-        const previousTenant = this.config?.tenantId;
+        const previousTenant = (this.config?.tenantStorageScopeId ?? this.config?.tenantId);
         const generation = this.generation;
         if (!preserveView)
             this.publish({ ...INITIAL_VIEW, status: 'loading' });
@@ -606,13 +618,14 @@ export class AwikiController {
         if (!session.ok)
             return failed(session.error);
         const identity = session.value.status === 'active' ? session.value.identity : null;
-        const sameOwner = preserveView && previousTenant === config.value.tenantId
+        const sameOwner = preserveView && previousTenant === (config.value.tenantStorageScopeId ?? config.value.tenantId)
             && previous.sessionStatus === session.value.status && previous.identity?.did === identity?.did;
-        this.drafts.setScope(config.value.tenantId ?? 'default', identity?.did ?? session.value.status);
+        this.drafts.setScope((config.value.tenantStorageScopeId ?? config.value.tenantId) ?? 'default', identity?.did ?? session.value.status);
+        this.restoreGroupCreationDraft();
         this.activatePresentationCache(identity);
-        const selectedRecovery = previousTenant === config.value.tenantId
+        const selectedRecovery = previousTenant === (config.value.tenantStorageScopeId ?? config.value.tenantId)
             ? previous.recoveryOperationId
-            : this.recoveryOperationsByTenant.get(recoveryTenantKey(config.value.tenantId)) ?? null;
+            : this.recoveryOperationsByTenant.get(recoveryTenantKey((config.value.tenantStorageScopeId ?? config.value.tenantId))) ?? null;
         this.publish({
             ...(sameOwner ? this.view : INITIAL_VIEW),
             status: 'ready',
@@ -622,7 +635,7 @@ export class AwikiController {
             attachmentMaxBytes: config.value.attachmentMaxBytes,
             handleRecoveryPhoneEnabled: config.value.handleRecoveryPhoneEnabled,
             recoveryOperationId: selectedRecovery,
-            recoveryOtpRetryAt: storedRecoveryOtpRetryAt(selectedRecovery, config.value.tenantId),
+            recoveryOtpRetryAt: storedRecoveryOtpRetryAt(selectedRecovery, (config.value.tenantStorageScopeId ?? config.value.tenantId)),
         });
         await this.refreshIdentityAccess();
         if (!this.current(generation))
@@ -634,7 +647,7 @@ export class AwikiController {
             await this.loadConversationPreferences(generation);
             const profile = await call(() => this.remote.getProfile());
             if (this.current(generation) && profile.ok)
-                this.publish({ ...this.view, profile: profile.value });
+                this.applyProfile(profile.value);
         }
         return { ok: true, value: undefined };
     }
@@ -808,15 +821,15 @@ export class AwikiController {
         const selected = this.view.recoveryOperationId;
         this.publish({ ...this.view, identityAccess: result.value, recoveryOperationId: selected,
             recoveryProgress: selected === this.view.recoveryOperationId ? this.view.recoveryProgress : null,
-            recoveryOtpRetryAt: storedRecoveryOtpRetryAt(selected, this.config?.tenantId) });
+            recoveryOtpRetryAt: storedRecoveryOtpRetryAt(selected, (this.config?.tenantStorageScopeId ?? this.config?.tenantId)) });
         if (selected !== null) {
             const status = await callWithFailureCode(() => this.remote.getRecoveryStatus({ operationId: selected }));
             if (!this.recoveryCurrent(generation, revision))
                 return this.recoveryLeft();
             if (!status.ok) {
                 if (status.failureCode === 'not-found' && candidates.length === 0) {
-                    clearRecoveryOtpRetryAt(selected, this.config?.tenantId);
-                    this.rememberRecoveryOperation(null, this.config?.tenantId);
+                    clearRecoveryOtpRetryAt(selected, (this.config?.tenantStorageScopeId ?? this.config?.tenantId));
+                    this.rememberRecoveryOperation(null, (this.config?.tenantStorageScopeId ?? this.config?.tenantId));
                     this.publish({ ...this.view, recoveryOperationId: null, recoveryProgress: null, recoveryOtpRetryAt: null });
                 }
                 else {
@@ -827,9 +840,9 @@ export class AwikiController {
             else {
                 const complete = status.value.phase === 'applied';
                 if (complete)
-                    clearRecoveryOtpRetryAt(selected, this.config?.tenantId);
+                    clearRecoveryOtpRetryAt(selected, (this.config?.tenantStorageScopeId ?? this.config?.tenantId));
                 this.publish({ ...this.view, recoveryProgress: status.value,
-                    recoveryOtpRetryAt: complete ? null : storedRecoveryOtpRetryAt(selected, this.config?.tenantId),
+                    recoveryOtpRetryAt: complete ? null : storedRecoveryOtpRetryAt(selected, (this.config?.tenantStorageScopeId ?? this.config?.tenantId)),
                     identityAccess: result.value });
             }
         }
@@ -844,9 +857,9 @@ export class AwikiController {
             this.leaveRecovery();
         else
             this.recoveryRevision++;
-        this.rememberRecoveryOperation(operationId, this.config?.tenantId);
+        this.rememberRecoveryOperation(operationId, (this.config?.tenantStorageScopeId ?? this.config?.tenantId));
         this.publish({ ...this.view, recoveryOperationId: operationId, recoveryProgress: null,
-            recoveryOtpRetryAt: storedRecoveryOtpRetryAt(operationId, this.config?.tenantId) });
+            recoveryOtpRetryAt: storedRecoveryOtpRetryAt(operationId, (this.config?.tenantStorageScopeId ?? this.config?.tenantId)) });
         const result = await this.refreshRecoveryStatus();
         return result.ok ? { ok: true, value: undefined } : result;
     }
@@ -877,7 +890,7 @@ export class AwikiController {
             this.pendingRequest = undefined;
         this.pendingRecovery = false;
         this.drafts.clearFlow();
-        this.rememberRecoveryOperation(null, this.config?.tenantId);
+        this.rememberRecoveryOperation(null, (this.config?.tenantStorageScopeId ?? this.config?.tenantId));
         this.publish({ ...this.view, recoveryOperationId: null, recoveryProgress: null, accessError: null,
             accessLoading: false, pending: wasPending ? null : this.view.pending, error: null });
     }
@@ -927,9 +940,12 @@ export class AwikiController {
         }
         if (result.value.status === 'registered') {
             this.drafts.clearScope();
-            this.drafts.setScope(this.config?.tenantId ?? 'default', result.value.identity.did);
+            this.drafts.setScope((this.config?.tenantStorageScopeId ?? this.config?.tenantId) ?? 'default', result.value.identity.did);
             this.activatePresentationCache(result.value.identity);
             this.publish({ ...this.view, sessionStatus: 'active', identity: result.value.identity, error: null });
+            await this.loadConversationPreferences(generation);
+            if (!this.current(generation))
+                return result;
             await this.refreshConversations(generation);
         }
         return result;
@@ -970,7 +986,7 @@ export class AwikiController {
     /** Cancel one exact Join choice and send Recovery OTP only while its original browser scope remains current. */
     async beginRecoveryFromDeviceJoin(request) {
         const generation = this.generation;
-        const tenantId = this.config?.tenantId;
+        const tenantId = (this.config?.tenantStorageScopeId ?? this.config?.tenantId);
         const flowScope = this.drafts.getScope('recovery:retryDeadline');
         const flowEpoch = this.drafts.epoch(flowScope);
         const changed = () => ({
@@ -978,7 +994,7 @@ export class AwikiController {
             error: '恢复能力或身份环境已改变，请重新检查后再选择。',
         });
         const scopeCurrent = () => this.current(generation)
-            && this.config?.tenantId === tenantId
+            && (this.config?.tenantStorageScopeId ?? this.config?.tenantId) === tenantId
             && this.drafts.getScope('recovery:retryDeadline') === flowScope
             && this.drafts.epoch(flowScope) === flowEpoch;
         if (!scopeCurrent())
@@ -988,7 +1004,7 @@ export class AwikiController {
             return changed();
         if (!latest.ok)
             return { ok: false, error: '暂时无法确认服务器的恢复能力，请稍后重试。' };
-        if (latest.value.tenantId !== tenantId)
+        if ((latest.value.tenantStorageScopeId ?? latest.value.tenantId) !== tenantId)
             return changed();
         this.config = latest.value;
         this.publish({ ...this.view, handleRecoveryPhoneEnabled: latest.value.handleRecoveryPhoneEnabled });
@@ -1018,7 +1034,7 @@ export class AwikiController {
         if (result.value === null)
             return result;
         this.recordRecoveryOtp(result.value, tenantId);
-        const sameFlow = this.config?.tenantId === tenantId
+        const sameFlow = (this.config?.tenantStorageScopeId ?? this.config?.tenantId) === tenantId
             && this.drafts.getScope('recovery:retryDeadline') === flowScope
             && this.drafts.epoch(flowScope) === flowEpoch;
         if (!sameFlow)
@@ -1090,6 +1106,65 @@ export class AwikiController {
         this.publish({ ...this.view, identity: result.value, error: null });
         return result;
     }
+    applyProfile(profile, updateIdentity = false) {
+        if (profile.did !== this.view.identity?.did)
+            return;
+        const current = this.view.profile?.profileVersion;
+        const incoming = profile.profileVersion;
+        if (current !== undefined && incoming !== undefined && /^(0|[1-9][0-9]*)$/u.test(current) && /^(0|[1-9][0-9]*)$/u.test(incoming) && BigInt(incoming) < BigInt(current))
+            return;
+        const identity = updateIdentity ? { ...this.view.identity, displayName: profile.displayName } : this.view.identity;
+        this.publish({ ...this.view, identity, profile, error: null });
+    }
+    refreshAvatarProfile() {
+        if (this.avatarProfileRefresh !== undefined && this.avatarProfileRefreshGeneration === this.generation)
+            return this.avatarProfileRefresh;
+        const generation = this.generation;
+        this.lastAvatarProfileCheck = Date.now();
+        const operation = (async () => {
+            const result = await call(() => this.remote.getProfile());
+            if (!this.current(generation))
+                return { ok: false, error: '账号已切换，请重新打开头像设置' };
+            if (!result.ok)
+                return { ok: false, error: result.error };
+            this.applyProfile(result.value);
+            return { ok: true, value: this.view.profile ?? result.value };
+        })();
+        this.avatarProfileRefresh = operation;
+        this.avatarProfileRefreshGeneration = generation;
+        void operation.finally(() => { if (this.avatarProfileRefresh === operation)
+            this.avatarProfileRefresh = undefined; });
+        return operation;
+    }
+    async setAvatar(request) {
+        return this.mutateAvatar(() => this.remote.setAvatar(request));
+    }
+    async clearAvatar(request) {
+        return this.mutateAvatar(() => this.remote.clearAvatar(request));
+    }
+    async mutateAvatar(operation) {
+        if (this.view.profile?.avatarUploadEnabled !== true)
+            return { ok: false, error: '当前账号或服务暂不支持修改头像' };
+        const generation = this.generation;
+        const result = await this.withPending('保存头像', () => call(operation), { publishFailure: false });
+        if (!this.current(generation))
+            return { ok: false, error: '账号已切换，请重新打开头像设置' };
+        if (result.ok)
+            this.applyProfile(result.value);
+        else
+            await this.refreshAvatarProfile();
+        return result;
+    }
+    async avatarDisplayProfiles(peers) {
+        const generation = this.generation;
+        const result = await call(() => this.remote.getDisplayProfiles(peers.slice(0, 100), true));
+        return this.current(generation) && result.ok ? result.value : [];
+    }
+    async avatarGroup(groupDid) {
+        const generation = this.generation;
+        const result = await call(() => this.remote.getGroup({ groupDid }));
+        return this.current(generation) && result.ok ? result.value : null;
+    }
     /** Save all supported public profile fields and keep identity/profile projections aligned. */
     async updateProfile(request) {
         const displayName = request.displayName.trim();
@@ -1106,15 +1181,14 @@ export class AwikiController {
         const result = await this.withPending('保存资料', () => call(() => this.remote.updateProfile({ displayName, bio, tags })));
         if (!result.ok || !this.current(generation))
             return result;
-        const identity = this.view.identity === null ? null : { ...this.view.identity, displayName: result.value.displayName };
-        this.publish({ ...this.view, identity, profile: result.value, error: null });
+        this.applyProfile(result.value, true);
         return result;
     }
     /** Request a dedicated OTP only within the selected account flow. */
     async sendRecoveryOtp(request) {
         const generation = this.generation;
         const revision = this.recoveryRevision;
-        const tenantId = this.config?.tenantId;
+        const tenantId = (this.config?.tenantStorageScopeId ?? this.config?.tenantId);
         const flowScope = this.drafts.getScope('recovery:retryDeadline');
         const result = await this.withPending('发送恢复验证码', () => call(() => this.remote.sendRecoveryOtp(request), registrationOtpFailureMessage), { publishFailure: false, recovery: true });
         if (!result.ok) {
@@ -1125,7 +1199,7 @@ export class AwikiController {
         }
         this.recordRecoveryOtp(result.value, tenantId);
         if (!this.recoveryCurrent(generation, revision)
-            || this.config?.tenantId !== tenantId
+            || (this.config?.tenantStorageScopeId ?? this.config?.tenantId) !== tenantId
             || this.drafts.getScope('recovery:retryDeadline') !== flowScope)
             return result;
         this.publish({ ...this.view, recoveryOperationId: result.value.operationId, recoveryProgress: null,
@@ -1138,7 +1212,7 @@ export class AwikiController {
         storeRecoveryOtpRetryAt(result.operationId, recoveryOtpRetryAt(result), tenantId);
     }
     /** Publish results only into the exact selected flow; Core work survives navigation. */
-    async runRecovery(label, operation, enterWhenApplied = false) {
+    async runRecovery(label, operation) {
         const generation = this.generation;
         const revision = this.recoveryRevision;
         const operationId = this.view.recoveryOperationId;
@@ -1158,9 +1232,7 @@ export class AwikiController {
         }
         this.publish({ ...this.view, recoveryProgress: result.value, accessError: null });
         if (result.value.phase === 'applied')
-            clearRecoveryOtpRetryAt(operationId, this.config?.tenantId);
-        if (enterWhenApplied && result.value.phase === 'applied')
-            return this.enterRecoveredSession();
+            clearRecoveryOtpRetryAt(operationId, (this.config?.tenantStorageScopeId ?? this.config?.tenantId));
         return result;
     }
     async prepareRecovery(request) {
@@ -1172,7 +1244,7 @@ export class AwikiController {
         const progress = this.view.recoveryProgress;
         if (!progress?.allowedActions?.includes('activate'))
             return { ok: false, error: '请先完成恢复信息验证' };
-        return this.runRecovery('恢复身份', operationId => call(() => this.remote.activateRecovery({ operationId }), failure => recoveryContinuationFailureMessage(failure, progress.phase), recoveryCarrierFailureMessage), true);
+        return this.runRecovery('恢复身份', operationId => call(() => this.remote.activateRecovery({ operationId }), failure => recoveryContinuationFailureMessage(failure, progress.phase), recoveryCarrierFailureMessage));
     }
     /** Read-only even for applied operations. Entering the identity is a separate action. */
     async refreshRecoveryStatus() {
@@ -1193,14 +1265,14 @@ export class AwikiController {
         }
         this.publish({ ...this.view, recoveryProgress: result.value, accessError: null });
         if (result.value.phase === 'applied')
-            clearRecoveryOtpRetryAt(operationId, this.config?.tenantId);
+            clearRecoveryOtpRetryAt(operationId, (this.config?.tenantStorageScopeId ?? this.config?.tenantId));
         return result;
     }
     async resumeRecovery() {
         const progress = this.view.recoveryProgress;
         if (!progress?.allowedActions?.includes('resume'))
             return { ok: false, error: '当前恢复状态不能重试' };
-        return this.runRecovery('继续恢复身份', operationId => call(() => this.remote.resumeRecovery({ operationId }), failure => recoveryContinuationFailureMessage(failure, progress.phase), recoveryCarrierFailureMessage), true);
+        return this.runRecovery('继续恢复身份', operationId => call(() => this.remote.resumeRecovery({ operationId }), failure => recoveryContinuationFailureMessage(failure, progress.phase), recoveryCarrierFailureMessage));
     }
     async enterRecoveredSession() {
         const generation = this.generation;
@@ -1214,7 +1286,7 @@ export class AwikiController {
             return this.recoveryLeft();
         if (!result.ok)
             return result;
-        clearRecoveryOtpRetryAt(progress.operationId, this.config?.tenantId);
+        clearRecoveryOtpRetryAt(progress.operationId, (this.config?.tenantStorageScopeId ?? this.config?.tenantId));
         this.leaveRecovery();
         const opened = await this.open();
         return opened.ok ? result : opened;
@@ -1234,7 +1306,7 @@ export class AwikiController {
             return this.recoveryLeft();
         if (!result.ok)
             return result;
-        clearRecoveryOtpRetryAt(operationId, this.config?.tenantId);
+        clearRecoveryOtpRetryAt(operationId, (this.config?.tenantStorageScopeId ?? this.config?.tenantId));
         this.leaveRecovery();
         void this.refreshIdentityAccess();
         return { ok: true, value: undefined };
@@ -1434,7 +1506,7 @@ export class AwikiController {
      * @param members - Handle or DID values entered by the user.
      * @returns the created group and settled invitation outcomes.
      */
-    async createGroup(name, members) {
+    async createGroup(name, members, encrypted = false, draftOperationId) {
         if (this.disposed)
             return { ok: false, error: 'AWiki 插件已卸载' };
         const normalizedName = name.trim();
@@ -1452,29 +1524,80 @@ export class AwikiController {
             return this.fail('群成员列表不需要包含自己');
         }
         const generation = this.generation;
+        const resumeKey = this.groupCreationStorageKey();
+        const operationId = draftOperationId ?? `group-${crypto.randomUUID()}`;
+        const operationKey = `${resumeKey}:${operationId}`;
+        try {
+            const storage = globalThis.localStorage;
+            storage?.setItem(operationKey, JSON.stringify({ name: normalizedName, members: normalizedMembers, encrypted, operationId }));
+            const keys = JSON.parse(storage?.getItem(`${resumeKey}:index`) ?? '[]');
+            storage?.setItem(`${resumeKey}:index`, JSON.stringify([...new Set([...keys, operationKey])]));
+        }
+        catch {
+            return this.fail('无法保存建群恢复标识，请检查本机存储后重试');
+        }
         const result = await this.withPending('创建群聊', () => call(() => this.remote.createGroup({
             name: normalizedName,
             members: normalizedMembers,
+            encrypted,
+            operationId,
         }), groupCreateFailureMessage));
         if (!result.ok || !this.current(generation))
             return result;
+        try {
+            globalThis.localStorage?.removeItem(operationKey);
+        }
+        catch { /* Preserve the resume ID when cleanup is unavailable. */ }
+        this.drafts.write(this.drafts.getScope('compose:groupFrozen'), 'compose:groupFrozen', false, false, true);
         const conversation = this.cacheConversation(result.value.conversation);
         this.publish({
             ...this.view,
             conversations: appendUnique([conversation], this.view.conversations, value => value.id),
             error: null,
         });
-        const selected = await this.selectConversation(result.value.conversation.id);
+        // Navigation belongs to the live dialog instance; a closed form cannot redirect it.
+        const selected = draftOperationId === undefined ? await this.selectConversation(result.value.conversation.id) : { ok: true };
         if (!this.current(generation))
             return result;
         const failed = result.value.failedMembers.map(item => item.member);
         const warning = failed.length === 0
             ? selected.ok ? null : '群聊已创建，但暂时无法打开消息历史。'
-            : `群聊已创建，但以下成员未加入：${failed.join('、')}`;
+            : `群聊已创建，以下成员的邀请或加密准备未完成，请在群成员中重试：${failed.join('、')}`;
         if (warning !== null)
             this.publish({ ...this.view, error: warning });
         return result;
     }
+    groupCreationStorageKey() {
+        return `awiki.group-create.v2:${this.drafts.getScope('compose:groupName')}`;
+    }
+    restoreGroupCreationDraft() {
+        const scope = this.drafts.getScope('compose:groupName');
+        this.drafts.write(scope, 'compose:groupName', '', '', true);
+        this.drafts.write(scope, 'compose:groupMembers', '', '', true);
+        this.drafts.write(scope, 'compose:encryptedGroup', false, false, true);
+        this.drafts.write(scope, 'compose:groupFrozen', false, false, true);
+        // Retain the operation independently of the new form, including legacy records.
+        const generation = this.generation;
+        const prefix = this.groupCreationStorageKey();
+        try {
+            const storage = globalThis.localStorage;
+            if (storage === undefined)
+                return;
+            const keys = [prefix, ...JSON.parse(storage.getItem(`${prefix}:index`) ?? '[]')];
+            for (const key of keys.slice(0, 8)) {
+                const value = JSON.parse(storage.getItem(key) ?? 'null');
+                if (value === null || typeof value.operationId !== 'string' || typeof value.name !== 'string' || !Array.isArray(value.members))
+                    continue;
+                void call(() => this.remote.createGroup(value)).then(result => {
+                    if (!result.ok || !this.current(generation))
+                        return;
+                    storage.removeItem(key);
+                    void this.refreshConversations(generation);
+                });
+            }
+        }
+        catch { /* Keep unreadable legacy records; they must not freeze a new form. */ }
+    }
     /** Join one open group by its canonical DID, then select the refreshed conversation. */
     async joinGroup(groupDidInput) {
         const groupDid = groupDidInput.trim();
@@ -1566,9 +1689,9 @@ export class AwikiController {
                 groupDid: group.groupDid,
                 member,
             }));
+            const refreshed = await this.reloadSelectedGroupAfterMutation(group.groupDid);
             if (!invited.ok)
                 return invited;
-            const refreshed = await this.reloadSelectedGroupAfterMutation(group.groupDid);
             if (!refreshed.ok) {
                 return {
                     ok: false,
@@ -1689,18 +1812,21 @@ export class AwikiController {
     async loadGroupState(conversation, reset, preserveAvailableOnNetworkFailure = false) {
         const generation = this.generation;
         const selectionRevision = this.selectionRevision;
+        const readRevision = ++this.groupReadRevision;
+        const isCurrent = () => this.currentSelection(generation, selectionRevision, conversation.id)
+            && this.groupReadRevision === readRevision;
         const snapshot = await callGroupRead(() => this.remote.getGroup({ groupDid: conversation.groupDid }));
         if (!snapshot.ok) {
             const retainAvailable = preserveAvailableOnNetworkFailure
                 && snapshot.reason === 'network-error'
                 && this.view.groupAccess?.groupDid === conversation.groupDid
                 && this.view.groupAccess.status === 'available';
-            if (!retainAvailable && this.currentSelection(generation, selectionRevision, conversation.id)) {
+            if (!retainAvailable && isCurrent()) {
                 this.publishGroupAccessFailure(conversation, snapshot.reason);
             }
             return snapshot;
         }
-        if (this.currentSelection(generation, selectionRevision, conversation.id)) {
+        if (isCurrent()) {
             const access = this.view.groupAccess;
             this.publish({
                 ...this.view,
@@ -1717,12 +1843,12 @@ export class AwikiController {
                 && members.reason === 'network-error'
                 && this.view.groupAccess?.groupDid === conversation.groupDid
                 && this.view.groupAccess.status === 'available';
-            if (!retainAvailable && this.currentSelection(generation, selectionRevision, conversation.id)) {
+            if (!retainAvailable && isCurrent()) {
                 this.publishGroupAccessFailure(conversation, members.reason);
             }
             return members;
         }
-        if (!this.currentSelection(generation, selectionRevision, conversation.id))
+        if (!isCurrent())
             return snapshot;
         if (members.value.pageGroup !== undefined && members.value.pageGroup !== conversation.groupDid) {
             return this.fail('群成员列表归属不一致，请刷新后重试');
@@ -1798,7 +1924,7 @@ export class AwikiController {
             messages: mergeLatestMessages(this.view.messages, committed.value.items),
             historyHasMore: remote.value.hasMore && remote.value.nextCursor !== undefined,
             refreshing: false,
-            error: existingError?.startsWith('群聊已创建，但以下成员未加入：') ? existingError : null,
+            error: existingError?.startsWith('群聊已创建，以下成员的邀请或加密准备未完成，请在群成员中重试：') ? existingError : null,
             summaries: this.staleSummaries(conversationId, incoming),
         });
     }
@@ -1964,27 +2090,37 @@ export class AwikiController {
      * @param clientMessageId - optional logical identity shared with the optimistic row.
      * @returns successful delivery or one display-safe failure.
      */
-    async sendText(text, clientMessageId, mentions) {
+    async sendText(text, clientMessageId, mentions, security) {
         const conversation = this.selectedConversation();
         if (conversation === undefined)
             return this.fail('请先选择会话');
+        if (conversation.kind === 'direct' && this.view.messageSecurityReady !== true)
+            return this.fail('消息模式尚未就绪，请刷新后重试');
+        if (conversation.kind === 'group' && this.view.selectedGroup?.encrypted && !this.view.selectedGroup.canSendSecure)
+            return this.fail('群加密尚未就绪，请等待群主完成准备或修复');
         if (conversation.kind === 'group' && this.view.groupAccess?.status !== 'available') {
             return this.fail('当前身份尚未获得这个群聊的发送权限，请先重新检查群成员状态。');
         }
         const conversationId = conversation.id;
         const generation = this.generation;
         const result = await this.withPending('发送消息', () => call(() => this.remote.sendText({
+            security: security ?? 'plain',
             target: targetOf(conversation),
             text,
             idempotencyKey: clientMessageId ?? crypto.randomUUID(),
             ...mentions === undefined || mentions.length === 0 ? {} : { mentions },
         })));
-        if (!result.ok)
+        if (!result.ok) {
+            if (conversation.kind === 'group' && this.current(generation) && this.view.selectedGroup?.groupDid === conversation.groupDid) {
+                this.publish({ ...this.view, selectedGroup: { ...this.view.selectedGroup, canSendSecure: false } });
+                await this.loadGroupState(conversation, true, true);
+            }
             return result;
+        }
         if (!this.current(generation) || this.view.selectedConversationId !== conversationId) {
             return { ok: true, value: undefined };
         }
-        this.appendMessage(result.value);
+        this.appendMessage(result.value, clientMessageId);
         return { ok: true, value: undefined };
     }
     /**
@@ -1996,12 +2132,17 @@ export class AwikiController {
         const conversation = this.selectedConversation();
         if (conversation === undefined)
             return this.fail('请先选择会话');
+        if (conversation.kind === 'direct' && this.view.messageSecurityReady !== true)
+            return this.fail('消息模式尚未就绪，请刷新后重试');
+        if (conversation.kind === 'group' && this.view.selectedGroup?.encrypted && !this.view.selectedGroup.canSendSecure)
+            return this.fail('群加密尚未就绪，请等待群主完成准备或修复');
         if (conversation.kind === 'group' && this.view.groupAccess?.status !== 'available') {
             return this.fail('当前身份尚未获得这个群聊的发送权限，请先重新检查群成员状态。');
         }
         const conversationId = conversation.id;
         const generation = this.generation;
         const request = {
+            security: file.security ?? 'plain',
             target: targetOf(conversation),
             fileName: file.fileName,
             mimeType: file.mimeType,
@@ -2010,12 +2151,17 @@ export class AwikiController {
             idempotencyKey: file.clientMessageId ?? crypto.randomUUID(),
         };
         const result = await this.withPending('发送附件', () => call(() => this.remote.sendAttachment(request)));
-        if (!result.ok)
+        if (!result.ok) {
+            if (conversation.kind === 'group' && this.current(generation) && this.view.selectedGroup?.groupDid === conversation.groupDid) {
+                this.publish({ ...this.view, selectedGroup: { ...this.view.selectedGroup, canSendSecure: false } });
+                await this.loadGroupState(conversation, true, true);
+            }
             return result;
+        }
         if (!this.current(generation) || this.view.selectedConversationId !== conversationId) {
             return { ok: true, value: undefined };
         }
-        this.appendMessage(result.value);
+        this.appendMessage(result.value, file.clientMessageId);
         return { ok: true, value: undefined };
     }
     /**
@@ -2062,13 +2208,14 @@ export class AwikiController {
             return { ok: false, error: 'AWiki 插件已卸载' };
         const generation = this.generation;
         const ownerDid = this.presentationCacheOwnerDid;
-        const tenantId = this.config?.tenantId;
+        const tenantId = (this.config?.tenantStorageScopeId ?? this.config?.tenantId);
         const result = await call(() => this.remote.clearLocalData(request));
         if (!result.ok)
             return result;
         const owners = [...(result.value.clearedIdentityDids ?? []), ...(ownerDid === null ? [] : [ownerDid])];
         for (const owner of new Set(owners)) {
             await this.persistentImageCache.clear(owner).catch(() => undefined);
+            await avatarCache.clear(owner);
             try {
                 clearMailBrowserCache(globalThis.localStorage, owner);
             }
@@ -2148,14 +2295,49 @@ export class AwikiController {
         this.close();
         this.listeners.clear();
     }
+    async retryMessageSecurity() {
+        await this.loadConversationPreferences(this.generation);
+    }
     async loadConversationPreferences(generation) {
+        this.publish({ ...this.view, messageSecurityReady: false, messageSecurityError: false });
         const result = await call(() => this.remote.getConversationPreferences(), conversationPreferenceFailureMessage);
-        if (!result.ok || !this.current(generation))
+        if (!this.current(generation))
+            return;
+        if (!result.ok) {
+            this.publish({ ...this.view, messageSecurityError: true });
+            this.fail(result.error);
             return;
+        }
         this.applyConversationPreferences(result.value);
         this.publish({ ...this.view, hiddenConversations: this.hiddenConversationsView() });
     }
+    async setMessageSecurity(conversationId, encrypted) {
+        if (this.view.messageSecurityReady !== true)
+            return this.fail('消息模式尚未就绪，请重试读取');
+        const generation = this.generation;
+        const previous = this.view.encryptedConversationIds ?? [];
+        this.publish({ ...this.view, encryptedConversationIds: encrypted ? [...new Set([...previous, conversationId])] : previous.filter(id => id !== conversationId) });
+        const result = await this.withPending('保存消息模式', () => call(() => this.remote.updateConversationPreference({ action: 'security', conversationId, encrypted })));
+        if (!result.ok) {
+            if (this.current(generation))
+                this.publish({ ...this.view, encryptedConversationIds: previous });
+            return result;
+        }
+        if (this.current(generation))
+            this.applyConversationPreferences(result.value);
+        return { ok: true, value: undefined };
+    }
+    async repairSelectedGroupSecurity() {
+        const group = this.view.selectedGroup;
+        if (group === null)
+            return this.fail('请先选择群聊');
+        const result = await this.withPending('修复群加密', () => call(() => this.remote.repairGroupSecurity({ groupDid: group.groupDid })));
+        if (!result.ok)
+            return result;
+        return this.reloadSelectedGroupAfterMutation(group.groupDid);
+    }
     applyConversationPreferences(preferences) {
+        this.publish({ ...this.view, messageSecurityReady: true, messageSecurityError: false, encryptedConversationIds: [...(preferences.encryptedConversationIds ?? [])] });
         this.hiddenConversationPreferences.clear();
         for (const hidden of preferences.hiddenConversations) {
             this.hiddenConversationPreferences.set(hidden.conversation.id, {
@@ -2256,6 +2438,9 @@ export class AwikiController {
             sessionStatus: status,
             conversations: Object.freeze([]),
             hiddenConversations: Object.freeze([]),
+            messageSecurityReady: false,
+            messageSecurityError: false,
+            encryptedConversationIds: Object.freeze([]),
             conversationsHasMore: false,
             selectedConversationId: null,
             selectedGroup: null,
@@ -2313,14 +2498,30 @@ export class AwikiController {
         if (this.polling || !this.current(generation) || this.view.identity === null)
             return;
         this.polling = true;
+        if (globalThis.document?.visibilityState !== 'hidden' && Date.now() - this.lastAvatarProfileCheck >= 60_000)
+            void this.refreshAvatarProfile();
         try {
             await this.refreshConversations(generation, true);
             const selected = this.view.selectedConversationId;
             if (selected === null || !this.current(generation))
                 return;
             const selectedConversation = this.selectedConversation();
-            if (selectedConversation?.kind === 'group' && this.view.groupAccess?.status !== 'available')
-                return;
+            if (selectedConversation?.kind === 'group' && this.view.groupAccess?.status !== 'available') {
+                const access = this.view.groupAccess?.status;
+                if (access === 'blocked' || access === 'not-member')
+                    return;
+                await this.loadGroupState(selectedConversation, false, true);
+                if (!this.current(generation) || this.view.selectedConversationId !== selected
+                    || this.getSnapshot().groupAccess?.status !== 'available')
+                    return;
+            }
+            if (selectedConversation?.kind === 'group' && this.view.selectedGroup?.encrypted) {
+                const status = await callGroupRead(() => this.remote.getGroup({ groupDid: selectedConversation.groupDid }));
+                if (!this.current(generation) || this.view.selectedConversationId !== selected)
+                    return;
+                if (status.ok)
+                    this.publish({ ...this.view, selectedGroup: status.value });
+            }
             const result = await call(() => this.remote.getHistory({ conversationId: selected }));
             if (!this.current(generation) || !result.ok || this.view.selectedConversationId !== selected)
                 return;
@@ -2402,9 +2603,14 @@ export class AwikiController {
             }
         }
     }
-    appendMessage(message) {
+    appendMessage(message, logicalId) {
         if (this.view.selectedConversationId !== message.conversationId)
             return;
+        // Core resolves a queued logical ID to the accepted group event ID. Retire
+        // only that explicit alias, including history reads started before acceptance.
+        if (logicalId !== undefined && logicalId !== message.id) {
+            this.retiredMessageIds.add(`${message.conversationId}/${logicalId}`);
+        }
         const isNew = !this.view.messages.some(current => current.id === message.id);
         const messages = appendMessageById(this.view.messages, message);
         if ((this.unreadAtOpen.get(message.conversationId) ?? 0) > 0 && messages.length > this.view.messages.length) {
@@ -2463,6 +2669,7 @@ export class AwikiController {
         const ownerDid = identity?.did ?? null;
         if (ownerDid === this.presentationCacheOwnerDid)
             return;
+        this.retiredMessageIds.clear();
         this.directProfiles.clear();
         this.groupTitles.clear();
         this.hiddenConversationPreferences.clear();
@@ -2471,6 +2678,7 @@ export class AwikiController {
     }
     /** Drop every browser projection without touching the Core-owned SQLite cache. */
     clearPresentationCache() {
+        this.retiredMessageIds.clear();
         this.directProfiles.clear();
         this.groupTitles.clear();
         this.hiddenConversationPreferences.clear();
@@ -2574,7 +2782,10 @@ export class AwikiController {
         /* v8 ignore next -- every asynchronous and public mutation path checks disposal before publishing. */
         if (this.disposed)
             return;
-        this.view = Object.freeze(view);
+        const hasRetired = view.messages.some(message => this.retiredMessageIds.has(`${message.conversationId}/${message.id}`));
+        this.view = Object.freeze(hasRetired
+            ? { ...view, messages: view.messages.filter(message => !this.retiredMessageIds.has(`${message.conversationId}/${message.id}`)) }
+            : view);
         for (const listener of [...this.listeners])
             listener();
     }