@awiki/dsh-plugin 0.3.16 → 0.3.18

package/lib/index.js

@@ -1,4 +1,4 @@
-import { a as fencedMailRecoveryObservability, i as failedMailRecoveryObservability, o as successfulMailRecoveryObservability, r as downloadedAttachment, s as isMessageTarget, t as AwikiSdkError } from "./sdk-adapter-DGcTiEZz.mjs";
+import { a as downloadedAttachment, c as successfulMailRecoveryObservability, l as isMessageTarget, n as DSH_AWIKI_PACKAGE_VERSION, o as failedMailRecoveryObservability, r as AwikiSdkError, s as fencedMailRecoveryObservability, t as DSH_AWIKI_MODEL_PROXY_PACKAGE_VERSION } from "./package-version.generated-D0MSDRZn.mjs";
 import "@deepseek-ai/cordis";
 import { createHash, randomUUID, timingSafeEqual } from "node:crypto";
 import { homedir } from "node:os";
@@ -2141,17 +2141,27 @@ function preferences(value, expectedOwnerDid) {
 		if (seen.has(hidden.conversation.id)) invalidState();
 		seen.add(hidden.conversation.id);
 	}
+	const encryptedConversationIds = value.encryptedConversationIds === void 0 ? [] : value.encryptedConversationIds;
+	if (!Array.isArray(encryptedConversationIds) || encryptedConversationIds.length > MAX_HIDDEN_CONVERSATIONS) invalidState();
 	return {
+		encryptedConversationIds: encryptedConversationIds.map((id) => {
+			const canonical = boundedString$1(id, MAX_IDENTIFIER_CHARACTERS);
+			if (!canonical.startsWith("dm:")) invalidState();
+			return canonical;
+		}),
 		version: STORE_VERSION,
 		ownerDid: String(expectedOwnerDid),
 		hiddenConversations
 	};
 }
 function publicPreferences(value) {
-	return { hiddenConversations: value.hiddenConversations.map((hidden) => ({
-		conversation: { ...hidden.conversation },
-		hiddenAt: hidden.hiddenAt
-	})) };
+	return {
+		encryptedConversationIds: [...value.encryptedConversationIds ?? []],
+		hiddenConversations: value.hiddenConversations.map((hidden) => ({
+			conversation: { ...hidden.conversation },
+			hiddenAt: hidden.hiddenAt
+		}))
+	};
 }
 function emptyPreferences(ownerDid) {
 	return {
@@ -2164,6 +2174,15 @@ function emptyPreferences(ownerDid) {
 function normalizeConversationPreferenceMutation(value) {
 	try {
 		if (!isRecord$3(value)) return void 0;
+		if (value.action === "security" && typeof value.encrypted === "boolean") {
+			const conversationId = boundedString$1(value.conversationId, MAX_IDENTIFIER_CHARACTERS);
+			if (!conversationId.startsWith("dm:")) return void 0;
+			return {
+				action: "security",
+				conversationId,
+				encrypted: value.encrypted
+			};
+		}
 		if (value.action === "hide") return {
 			action: "hide",
 			conversation: conversation(value.conversation)
@@ -2196,6 +2215,17 @@ var AwikiConversationPreferenceStore = class {
 			const current = await this.load(ownerDid);
 			let next;
 			switch (normalized.action) {
+				case "security": {
+					const ids = new Set(current.encryptedConversationIds ?? []);
+					if (normalized.encrypted) ids.add(normalized.conversationId);
+					else ids.delete(normalized.conversationId);
+					if (ids.size > MAX_HIDDEN_CONVERSATIONS) invalidState();
+					next = {
+						...current,
+						encryptedConversationIds: [...ids]
+					};
+					break;
+				}
 				case "hide": {
 					const snapshot = normalized.conversation;
 					const hidden = current.hiddenConversations.filter((item) => item.conversation.id !== snapshot.id);
@@ -2765,29 +2795,29 @@ var AwikiAgentListener = class {
 		await this.stateMutation;
 		const route = this.state.conversations[conversation.id];
 		if (route?.lastProcessedMessageId === message.id) return;
-		if (message.content.kind !== "text") {
+		if (message.content.kind !== "text" || message.encrypted === true && message.decryptionState !== "decrypted") {
 			await this.commit(conversation, message.id, route?.sessionId);
 			return;
 		}
 		const parsed = command(message.content.text);
 		if (parsed?.name === "/help") {
-			await this.reply(conversation, message.id, HELP_TEXT);
+			await this.reply(conversation, message, HELP_TEXT);
 			await this.commit(conversation, message.id, route?.sessionId);
 			return;
 		}
 		if (parsed?.name === "/status") {
-			await this.reply(conversation, message.id, route?.sessionId === void 0 ? NO_SESSION_TEXT : `当前 DSH 会话：${route.sessionId}`);
+			await this.reply(conversation, message, route?.sessionId === void 0 ? NO_SESSION_TEXT : `当前 DSH 会话：${route.sessionId}`);
 			await this.commit(conversation, message.id, route?.sessionId);
 			return;
 		}
 		if (parsed?.name === "/new" && parsed.argument.length === 0) {
 			await this.agents.reset(route?.sessionId);
-			await this.reply(conversation, message.id, RESET_TEXT);
+			await this.reply(conversation, message, RESET_TEXT);
 			await this.commit(conversation, message.id, void 0);
 			return;
 		}
 		if (parsed !== void 0 && parsed.name !== "/new") {
-			await this.reply(conversation, message.id, UNKNOWN_COMMAND_TEXT);
+			await this.reply(conversation, message, UNKNOWN_COMMAND_TEXT);
 			await this.commit(conversation, message.id, route?.sessionId);
 			return;
 		}
@@ -2803,10 +2833,10 @@ var AwikiAgentListener = class {
 		} catch {
 			output = AGENT_FAILURE_TEXT;
 		}
-		await this.reply(conversation, message.id, output);
+		await this.reply(conversation, message, output);
 		await this.commit(conversation, message.id, sessionId);
 	}
-	async reply(conversation, messageId, text) {
+	async reply(conversation, message, text) {
 		const parts = chunks(text);
 		for (const [index, part] of parts.entries()) await this.awiki.sendText({
 			target: {
@@ -2814,7 +2844,8 @@ var AwikiAgentListener = class {
 				conversationId: conversation.id
 			},
 			text: part,
-			idempotencyKey: replyKey(messageId, index)
+			security: message.encrypted === true ? "e2ee-required" : "plain",
+			idempotencyKey: replyKey(message.id, index)
 		});
 	}
 	async commit(conversation, messageId, sessionId) {
@@ -3137,7 +3168,7 @@ function endpointsForOrigin(origin, domain) {
 function officialProfile(entry) {
 	return {
 		tenantId: entry.tenantId,
-		storageScopeId: entry.storageScopeId,
+		storageScopeId: randomUUID(),
 		kind: "built_in",
 		displayName: entry.displayName,
 		backendBaseUrl: entry.backendOrigin,
@@ -3177,10 +3208,13 @@ function decodeTenant(value) {
 	const backendBaseUrl = safeString(value.backendBaseUrl);
 	const didHost = safeString(value.didHost);
 	const endpoints = decodeEndpoints(value.endpoints);
+	const preferenceTenantIds = value.preferenceTenantIds;
+	if (preferenceTenantIds !== void 0 && (!Array.isArray(preferenceTenantIds) || preferenceTenantIds.some((id) => typeof id !== "string" || id.trim() === "") || new Set(preferenceTenantIds).size !== preferenceTenantIds.length)) return void 0;
 	if (tenantId === void 0 || storageScopeId === void 0 || displayName === void 0 || backendBaseUrl === void 0 || didHost === void 0 || endpoints === void 0 || value.kind !== "built_in" && value.kind !== "custom" || value.lifecycle !== "active" && value.lifecycle !== "inactive" && value.lifecycle !== "archived" || value.storageLayout !== "scope-v1" && value.storageLayout !== "legacy-base" && value.storageLayout !== "domain-v1") return;
 	return {
 		tenantId,
 		storageScopeId,
+		...preferenceTenantIds === void 0 ? {} : { preferenceTenantIds },
 		kind: value.kind,
 		displayName,
 		backendBaseUrl,
@@ -3190,12 +3224,12 @@ function decodeTenant(value) {
 		endpoints
 	};
 }
-function decodeDocument(value) {
+function decodeDocument(value, allowDuplicateScopes = false) {
 	if (!isRecord$1(value) || value.schemaVersion !== 1 || !Number.isSafeInteger(value.officialCatalogVersion) || value.officialCatalogVersion < 1 || value.officialCatalogVersion > 2 || !Number.isSafeInteger(value.generation) || value.generation < 0 || typeof value.activeTenantId !== "string" || !Array.isArray(value.tenants)) return void 0;
 	const tenants = value.tenants.map(decodeTenant);
 	if (tenants.some((tenant) => tenant === void 0)) return void 0;
 	const complete = tenants;
-	if (new Set(complete.map((tenant) => tenant.tenantId)).size !== complete.length || new Set(complete.map((tenant) => tenant.storageScopeId)).size !== complete.length || !complete.some((tenant) => tenant.tenantId === value.activeTenantId && tenant.lifecycle === "active") || complete.filter((tenant) => tenant.lifecycle === "active").length !== 1) return void 0;
+	if (new Set(complete.map((tenant) => tenant.tenantId)).size !== complete.length || !allowDuplicateScopes && new Set(complete.map((tenant) => tenant.storageScopeId)).size !== complete.length || complete.some((tenant) => !/^[a-zA-Z0-9_-]+$/u.test(tenant.storageScopeId)) || !complete.some((tenant) => tenant.tenantId === value.activeTenantId && tenant.lifecycle === "active") || complete.filter((tenant) => tenant.lifecycle === "active").length !== 1) return void 0;
 	return {
 		schemaVersion: 1,
 		officialCatalogVersion: 2,
@@ -3213,7 +3247,7 @@ function directoryHasData(path) {
 }
 function sameOfficialEndpoint(tenant, entry) {
 	const origin = entry.backendOrigin;
-	return tenant.didHost === entry.didHost || tenant.backendBaseUrl.replace(/\/$/u, "") === origin || tenant.endpoints.userServiceUrl.replace(/\/$/u, "") === origin;
+	return tenant.didHost === entry.didHost && tenant.backendBaseUrl.replace(/\/$/u, "") === origin && tenant.endpoints.userServiceUrl.replace(/\/$/u, "") === origin;
 }
 function preservedTenantId(tenants, tenant) {
 	const base = `custom-${tenant.storageScopeId}`;
@@ -3244,6 +3278,7 @@ function reconcileOfficials(document) {
 				tenants[exactIndex] = {
 					...officialProfile(entry),
 					storageScopeId: current.storageScopeId,
+					...current.preferenceTenantIds === void 0 ? {} : { preferenceTenantIds: current.preferenceTenantIds },
 					storageLayout: current.storageLayout,
 					lifecycle: current.lifecycle
 				};
@@ -3253,7 +3288,8 @@ function reconcileOfficials(document) {
 			tenants[exactIndex] = {
 				...current,
 				tenantId: preservedId,
-				kind: "custom"
+				kind: "custom",
+				preferenceTenantIds: [.../* @__PURE__ */ new Set([current.tenantId, ...current.preferenceTenantIds ?? []])]
 			};
 			if (activeTenantId === current.tenantId) activeTenantId = preservedId;
 			exactIndex = -1;
@@ -3265,6 +3301,7 @@ function reconcileOfficials(document) {
 				tenants[legacyIndex] = {
 					...officialProfile(entry),
 					storageScopeId: current.storageScopeId,
+					preferenceTenantIds: [.../* @__PURE__ */ new Set([current.tenantId, ...current.preferenceTenantIds ?? []])],
 					storageLayout: current.storageLayout,
 					lifecycle: current.lifecycle
 				};
@@ -3282,6 +3319,7 @@ function reconcileOfficials(document) {
 			tenants[endpointIndex] = {
 				...officialProfile(entry),
 				storageScopeId: current.storageScopeId,
+				preferenceTenantIds: [.../* @__PURE__ */ new Set([current.tenantId, ...current.preferenceTenantIds ?? []])],
 				storageLayout: current.storageLayout,
 				lifecycle: current.lifecycle
 			};
@@ -3298,6 +3336,50 @@ function reconcileOfficials(document) {
 function cloneDocument(document) {
 	return structuredClone(document);
 }
+function tenantStateRoot(base, tenant) {
+	if (tenant.storageLayout === "legacy-base") return resolve(base);
+	if (tenant.storageLayout === "domain-v1") return resolve(dirname(base), "tenants", normalizeAwikiDomain(tenant.didHost), basename(base));
+	return resolve(dirname(base), "tenant-scopes", tenant.storageScopeId, basename(base));
+}
+function validateDocument(base, document) {
+	if (decodeDocument(document) === void 0 || new Set(document.tenants.map((tenant) => tenantStateRoot(base, tenant))).size !== document.tenants.length) throw new Error("registry schema or storage ownership invariants are invalid");
+}
+/** Repair only the known catalog-slot collision with a unique pre-migration owner. */
+function repairCatalogCollision(base, parsed, backupPath) {
+	const document = decodeDocument(parsed, true);
+	if (document === void 0 || !existsSync(backupPath)) return void 0;
+	const backup = decodeDocument(JSON.parse(readFileSync(backupPath, "utf8")));
+	if (backup === void 0) return void 0;
+	let repaired = false;
+	const tenants = [...document.tenants];
+	for (const entry of OFFICIALS) {
+		const group = tenants.filter((tenant) => tenant.storageScopeId === entry.storageScopeId);
+		if (group.length !== 2) continue;
+		const current = group.find((tenant) => tenant.tenantId === entry.tenantId && sameOfficialEndpoint(tenant, entry));
+		const preserved = group.find((tenant) => tenant.kind === "custom" && tenant.tenantId === `custom-${entry.storageScopeId}`);
+		if (current === void 0 || preserved === void 0 || current.storageLayout !== "scope-v1" || preserved.storageLayout !== "scope-v1") continue;
+		const owners = backup.tenants.filter((tenant) => tenant.storageScopeId === entry.storageScopeId);
+		const owner = owners[0];
+		if (owners.length !== 1 || owner === void 0 || owner.storageLayout !== preserved.storageLayout || owner.didHost !== preserved.didHost || owner.backendBaseUrl !== preserved.backendBaseUrl || JSON.stringify(owner.endpoints) !== JSON.stringify(preserved.endpoints)) continue;
+		const identityPath = join(tenantStateRoot(base, preserved), "identities", "registry.json");
+		if (existsSync(identityPath)) {
+			const identities = JSON.parse(readFileSync(identityPath, "utf8"));
+			if (!isRecord$1(identities) || !isRecord$1(identities.credentials) || Object.values(identities.credentials).some((value) => !isRecord$1(value) || typeof value.did !== "string" || !value.did.startsWith(`did:wba:${preserved.didHost}:`))) continue;
+		}
+		tenants[tenants.indexOf(current)] = {
+			...current,
+			storageScopeId: randomUUID()
+		};
+		repaired = true;
+	}
+	if (!repaired) return void 0;
+	const result = {
+		...document,
+		tenants
+	};
+	validateDocument(base, result);
+	return result;
+}
 /** Durable registry. All mutations are synchronous, backup-aware, and atomic. */
 var AwikiTenantRegistry = class AwikiTenantRegistry {
 	baseStateRoot;
@@ -3317,10 +3399,16 @@ var AwikiTenantRegistry = class AwikiTenantRegistry {
 	static open(baseStateRoot, seed) {
 		const filePath = registryFilePath(baseStateRoot);
 		if (existsSync(filePath)) try {
-			const decoded = decodeDocument(JSON.parse(readFileSync(filePath, "utf8")));
+			const parsed = JSON.parse(readFileSync(filePath, "utf8"));
+			const decoded = decodeDocument(parsed) ?? repairCatalogCollision(baseStateRoot, parsed, `${filePath}.pre-v1.bak`);
 			if (decoded === void 0) throw new Error("registry schema or invariants are invalid");
 			const registry = new AwikiTenantRegistry(baseStateRoot, reconcileOfficials(decoded), true);
-			if (JSON.stringify(decoded) !== JSON.stringify(registry.document)) registry.persist(true);
+			validateDocument(baseStateRoot, registry.document);
+			if (JSON.stringify(parsed) !== JSON.stringify(registry.document)) {
+				const repairBackup = `${filePath}.pre-scope-repair.bak`;
+				if (!existsSync(repairBackup)) copyFileSync(filePath, repairBackup);
+				registry.persist(true);
+			}
 			return registry;
 		} catch (error) {
 			const diagnostic = `AWiki tenant registry was not migrated: ${error instanceof Error ? error.message : "unknown error"}\n`;
@@ -3329,7 +3417,7 @@ var AwikiTenantRegistry = class AwikiTenantRegistry {
 				encoding: "utf8",
 				mode: 384
 			});
-			return new AwikiTenantRegistry(baseStateRoot, legacyDocument(seed, !seed.configured), false);
+			throw new Error("awiki: tenant registry needs repair; no environment was opened", { cause: error });
 		}
 		const hasLegacyData = directoryHasData(baseStateRoot);
 		const document = seed.configured || hasLegacyData ? legacyDocument(seed, hasLegacyData && !seed.configured) : freshDocument();
@@ -3354,9 +3442,7 @@ var AwikiTenantRegistry = class AwikiTenantRegistry {
 		return tenant === void 0 ? void 0 : structuredClone(tenant);
 	}
 	stateRoot(tenant) {
-		if (tenant.storageLayout === "legacy-base") return this.baseStateRoot;
-		if (tenant.storageLayout === "domain-v1") return join(dirname(this.baseStateRoot), "tenants", tenant.didHost, basename(this.baseStateRoot));
-		return join(dirname(this.baseStateRoot), "tenant-scopes", tenant.storageScopeId, basename(this.baseStateRoot));
+		return tenantStateRoot(this.baseStateRoot, tenant);
 	}
 	createCustom(displayName, rawDomain) {
 		const domain = normalizeAwikiDomain(rawDomain);
@@ -3426,6 +3512,7 @@ var AwikiTenantRegistry = class AwikiTenantRegistry {
 		return cloneDocument(this.document);
 	}
 	persist(backup) {
+		validateDocument(this.baseStateRoot, this.document);
 		if (!this.persistent) throw new Error("awiki: tenant registry is read-only until its migration diagnostic is resolved");
 		mkdirSync(dirname(this.filePath), { recursive: true });
 		if (backup && existsSync(this.filePath) && !existsSync(this.backupPath)) copyFileSync(this.filePath, this.backupPath);
@@ -3569,11 +3656,6 @@ function checkInstallation(requirements, installed) {
 	return {};
 }
 //#endregion
-//#region lib/types/package-version.generated.js
-/** Generated from package.json by scripts/sync-package-versions.mjs. */
-const DSH_AWIKI_PACKAGE_VERSION = "0.3.16";
-const DSH_AWIKI_MODEL_PROXY_PACKAGE_VERSION = "0.1.11";
-//#endregion
 //#region lib/types/update-policy.js
 /** Tenant-scoped DSH AWiki plugin update policy and verified cache. */
 const DSH_AWIKI_VERSION = DSH_AWIKI_PACKAGE_VERSION;
@@ -4011,6 +4093,7 @@ const FAILURE_CODES = /* @__PURE__ */ new Set([
 	"state-in-use",
 	"rate-limited",
 	"group-membership-required",
+	"group-member-encryption-not-ready",
 	"group-identity-stale",
 	"attachment-too-large",
 	"summary-unavailable",
@@ -4049,6 +4132,7 @@ const FAILURE_MESSAGES = {
 	"conflict": "The AWiki operation conflicts with current state.",
 	"state-in-use": "AWiki data is already open in another client.",
 	"rate-limited": "The AWiki service rate-limited the request.",
+	"group-member-encryption-not-ready": "The member has not prepared encrypted messaging.",
 	"group-membership-required": "The active AWiki identity is not a member of this group.",
 	"group-identity-stale": "The AWiki group identity binding is still recovering.",
 	"attachment-too-large": "The attachment exceeds this deployment's size limit.",
@@ -4258,6 +4342,8 @@ const MAX_PROFILE_TAGS = 5;
 const MAX_PROFILE_TAG_CHARACTERS = 30;
 const MAX_MESSAGE_CHARACTERS = 2e4;
 function normalizeCreateGroupRequest(request) {
+	if (request?.operationId !== void 0 && (typeof request.operationId !== "string" || !/^[a-zA-Z0-9_-]{1,100}$/.test(request.operationId))) return void 0;
+	if (request?.encrypted !== void 0 && typeof request.encrypted !== "boolean") return void 0;
 	if (typeof request?.name !== "string" || !Array.isArray(request.members)) return void 0;
 	const name = request.name.trim();
 	if (name.length === 0 || Array.from(name).length > MAX_GROUP_NAME_CHARACTERS) return void 0;
@@ -4274,7 +4360,9 @@ function normalizeCreateGroupRequest(request) {
 	}
 	return {
 		name,
-		members
+		members,
+		...request.operationId === void 0 ? {} : { operationId: request.operationId },
+		...request.encrypted === void 0 ? {} : { encrypted: request.encrypted }
 	};
 }
 function normalizeMember(value) {
@@ -4286,6 +4374,22 @@ function normalizeGroupDid(value) {
 	if (typeof value !== "string" || !value.startsWith("did:") || value.length > 2048) return void 0;
 	return value;
 }
+function validAvatarRequest(request, image) {
+	if (request === null || typeof request !== "object" || Array.isArray(request)) return false;
+	const value = request;
+	const keys = image ? [
+		"requestId",
+		"expectedProfileVersion",
+		"imageBase64"
+	] : ["requestId", "expectedProfileVersion"];
+	if (Object.keys(value).length !== keys.length || Object.keys(value).some((key) => !keys.includes(key))) return false;
+	if (typeof value.requestId !== "string" || !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/u.test(value.requestId)) return false;
+	if (typeof value.expectedProfileVersion !== "string" || !/^(0|[1-9][0-9]{0,18})$/u.test(value.expectedProfileVersion) || BigInt(value.expectedProfileVersion) > 9223372036854775807n) return false;
+	if (!image) return true;
+	if (typeof value.imageBase64 !== "string" || value.imageBase64.length === 0 || value.imageBase64.length > 699052) return false;
+	const bytes = Buffer.from(value.imageBase64, "base64");
+	return bytes.length <= 524288 && bytes.length >= 4 && bytes[0] === 255 && bytes[1] === 216 && bytes[bytes.length - 2] === 255 && bytes[bytes.length - 1] === 217 && bytes.toString("base64") === value.imageBase64;
+}
 function normalizeProfileRequest(request) {
 	if (typeof request?.displayName !== "string" || typeof request.bio !== "string" || !Array.isArray(request.tags)) return void 0;
 	const displayName = request.displayName.trim();
@@ -4385,6 +4489,7 @@ function identityAccessTarget(request, configuredDomain) {
 	};
 }
 function normalizeSendTextRequest(request) {
+	if (request?.security !== void 0 && request.security !== "plain" && request.security !== "e2ee-required") return void 0;
 	if (typeof request?.text !== "string" || typeof request.idempotencyKey !== "string" || !isMessageTarget(request.target)) return void 0;
 	const text = request.text;
 	const codePoints = Array.from(text);
@@ -4574,6 +4679,8 @@ let AwikiService = (() => {
 	let _prepareRootTransfer_decorators;
 	let _confirmRootTransfer_decorators;
 	let _updateDisplayName_decorators;
+	let _setAvatar_decorators;
+	let _clearAvatar_decorators;
 	let _getProfile_decorators;
 	let _updateProfile_decorators;
 	let _sendRecoveryOtp_decorators;
@@ -4586,6 +4693,7 @@ let AwikiService = (() => {
 	let _resolvePeer_decorators;
 	let _createGroup_decorators;
 	let _getGroup_decorators;
+	let _repairGroupSecurity_decorators;
 	let _joinGroup_decorators;
 	let _leaveGroup_decorators;
 	let _getDisplayProfiles_decorators;
@@ -4643,6 +4751,8 @@ let AwikiService = (() => {
 			_prepareRootTransfer_decorators = [Remote];
 			_confirmRootTransfer_decorators = [Remote];
 			_updateDisplayName_decorators = [Remote];
+			_setAvatar_decorators = [Remote];
+			_clearAvatar_decorators = [Remote];
 			_getProfile_decorators = [Remote];
 			_updateProfile_decorators = [Remote];
 			_sendRecoveryOtp_decorators = [Remote];
@@ -4655,6 +4765,7 @@ let AwikiService = (() => {
 			_resolvePeer_decorators = [Remote];
 			_createGroup_decorators = [Remote];
 			_getGroup_decorators = [Remote];
+			_repairGroupSecurity_decorators = [Remote];
 			_joinGroup_decorators = [Remote];
 			_leaveGroup_decorators = [Remote];
 			_getDisplayProfiles_decorators = [Remote];
@@ -5019,6 +5130,28 @@ let AwikiService = (() => {
 				},
 				metadata: _metadata
 			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _setAvatar_decorators, {
+				kind: "method",
+				name: "setAvatar",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "setAvatar" in obj,
+					get: (obj) => obj.setAvatar
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _clearAvatar_decorators, {
+				kind: "method",
+				name: "clearAvatar",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "clearAvatar" in obj,
+					get: (obj) => obj.clearAvatar
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
 			__esDecorate(this, null, _getProfile_decorators, {
 				kind: "method",
 				name: "getProfile",
@@ -5151,6 +5284,17 @@ let AwikiService = (() => {
 				},
 				metadata: _metadata
 			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _repairGroupSecurity_decorators, {
+				kind: "method",
+				name: "repairGroupSecurity",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "repairGroupSecurity" in obj,
+					get: (obj) => obj.repairGroupSecurity
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
 			__esDecorate(this, null, _joinGroup_decorators, {
 				kind: "method",
 				name: "joinGroup",
@@ -5773,6 +5917,11 @@ let AwikiService = (() => {
 			let committed = false;
 			try {
 				await this.sessionMutation;
+				await this.sessionStore.signOut();
+				this.signedOut = true;
+				this.sessionRevision += 1;
+				this.activeIdentityDid = void 0;
+				await new AwikiSessionStore(registry.stateRoot(target)).signOut();
 				this.invalidateSummaries();
 				for (const participant of this.tenantParticipants) {
 					await participant.prepareSwitch(context);
@@ -5781,7 +5930,10 @@ let AwikiService = (() => {
 				await this.disposeProvider(previousProvider);
 				const targetProvider = this.openTenantProvider(target, factory, false);
 				targetOpened = true;
-				await targetProvider.client.getIdentity();
+				if (await targetProvider.client.getIdentity() === null) {
+					await this.sessionStore.signIn();
+					this.signedOut = false;
+				}
 				await Promise.all([this.discoverTenantCapabilities(3e3), this.refreshUpdatePolicy()]);
 				registry.commitActive(target.tenantId);
 				committed = true;
@@ -5877,6 +6029,7 @@ let AwikiService = (() => {
 					handleRecoveryPhoneEnabled: capabilities.handleRecoveryPhoneEnabled,
 					...capabilities.guestGatewayBaseUrl === void 0 ? {} : { integrationGuideUrl: new URL("/guest/guide/integration", capabilities.guestGatewayBaseUrl).toString() },
 					tenantId: capabilities.tenantId,
+					tenantStorageScopeId: this.activeTenant?.storageScopeId,
 					tenantGeneration: capabilities.generation,
 					tenantOnline: capabilities.online,
 					services: {
@@ -6031,12 +6184,6 @@ let AwikiService = (() => {
 					ok: true,
 					value: { status: "signed-out" }
 				};
-				const identity = await this.run((client) => client.getIdentity(), { allowSignedOut: true });
-				if (!identity.ok) return identity;
-				if (identity.value === null) return {
-					ok: false,
-					error: failure("not-registered")
-				};
 				try {
 					await this.sessionStore.signOut();
 					this.signedOut = true;
@@ -6598,6 +6745,22 @@ let AwikiService = (() => {
 			if (result.ok) this.activeIdentityDid = result.value.did;
 			return result;
 		}
+		/** Replace only the current authenticated human account's avatar. */
+		setAvatar(request) {
+			if (!validAvatarRequest(request, true)) return Promise.resolve({
+				ok: false,
+				error: failure("invalid-request")
+			});
+			return this.run((client) => client.setAvatar(request));
+		}
+		/** Restore the current account's default character avatar. */
+		clearAvatar(request) {
+			if (!validAvatarRequest(request, false)) return Promise.resolve({
+				ok: false,
+				error: failure("invalid-request")
+			});
+			return this.run((client) => client.clearAvatar(request));
+		}
 		/** Return the public editable profile for the active identity. */
 		getProfile() {
 			return this.run((client) => client.getProfile());
@@ -6711,7 +6874,7 @@ let AwikiService = (() => {
 				ok: false,
 				error: failure("invalid-request")
 			};
-			const created = await this.run((client) => client.createGroup(normalized.name));
+			const created = await this.run((client) => client.createGroup(normalized.name, normalized.encrypted, normalized.operationId));
 			if (!created.ok) return created;
 			const addedMembers = [];
 			const failedMembers = [];
@@ -6741,6 +6904,15 @@ let AwikiService = (() => {
 			});
 			return this.run((client) => client.getGroup(groupDid));
 		}
+		/** Resume owner-held group encryption maintenance through Core. */
+		repairGroupSecurity(request) {
+			const groupDid = normalizeGroupDid(request?.groupDid);
+			if (groupDid === void 0) return Promise.resolve({
+				ok: false,
+				error: failure("invalid-request")
+			});
+			return this.run((client) => client.repairGroupSecurity(groupDid));
+		}
 		/** Join one open group and return its authoritative membership state. */
 		joinGroup(request) {
 			const groupDid = normalizeGroupDid(request?.groupDid);
@@ -6764,12 +6936,12 @@ let AwikiService = (() => {
 			} : result;
 		}
 		/** Read one authoritative versioned member page. */
-		getDisplayProfiles(peers) {
-			if (!Array.isArray(peers) || peers.length > 100 || peers.some((peer) => typeof peer !== "string" || !peer.startsWith("did:"))) return Promise.resolve({
+		getDisplayProfiles(peers, refresh) {
+			if (refresh !== void 0 && typeof refresh !== "boolean" || !Array.isArray(peers) || peers.length > 100 || peers.some((peer) => typeof peer !== "string" || !peer.startsWith("did:"))) return Promise.resolve({
 				ok: false,
 				error: failure("invalid-request")
 			});
-			return this.run((client) => client.getDisplayProfiles(peers));
+			return this.run((client) => client.getDisplayProfiles(peers, refresh));
 		}
 		listGroupMembers(request) {
 			const groupDid = normalizeGroupDid(request?.groupDid);
@@ -6968,6 +7140,10 @@ let AwikiService = (() => {
 		* @returns The accepted attachment message or a closed failure.
 		*/
 		async sendAttachment(request) {
+			if (request?.security !== void 0 && request.security !== "plain" && request.security !== "e2ee-required") return {
+				ok: false,
+				error: failure("invalid-request")
+			};
 			if (!isMessageTarget(request?.target)) return {
 				ok: false,
 				error: failure("invalid-request")
@@ -6976,6 +7152,7 @@ let AwikiService = (() => {
 			if (!decoded.ok) return decoded;
 			return this.run(async (client) => {
 				const message = await client.sendAttachment({
+					...request.security === void 0 ? {} : { security: request.security },
 					target: request.target,
 					attachment: {
 						fileName: request.fileName,