@awiki/dsh-plugin 0.3.18 → 0.3.20

package/lib/index.js

@@ -1,8 +1,9 @@
-import { a as downloadedAttachment, c as successfulMailRecoveryObservability, l as isMessageTarget, n as DSH_AWIKI_PACKAGE_VERSION, o as failedMailRecoveryObservability, r as AwikiSdkError, s as fencedMailRecoveryObservability, t as DSH_AWIKI_MODEL_PROXY_PACKAGE_VERSION } from "./package-version.generated-D0MSDRZn.mjs";
-import "@deepseek-ai/cordis";
+import { a as downloadedAttachment, c as successfulMailRecoveryObservability, l as isMessageTarget, n as DSH_AWIKI_PACKAGE_VERSION, o as failedMailRecoveryObservability, r as AwikiSdkError, s as fencedMailRecoveryObservability, t as DSH_AWIKI_MODEL_PROXY_PACKAGE_VERSION } from "./package-version.generated-RNVj-2iA.mjs";
 import { createHash, randomUUID, timingSafeEqual } from "node:crypto";
-import { homedir } from "node:os";
+import { copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import { basename, dirname, isAbsolute, join, resolve } from "node:path";
+import "@deepseek-ai/cordis";
+import { homedir } from "node:os";
 import z from "@deepseek-ai/schemastery";
 import { Remote, TypertRemoteService } from "@deepseek-ai/dsh-typert-protocol";
 import { SettingsConflictError } from "@deepseek-ai/dsh-settings";
@@ -12,8 +13,122 @@ import { SessionId, SessionLogOffset } from "@deepseek-ai/dsh-session";
 import { installModelSelection } from "@deepseek-ai/dsh-agent";
 import { createUserMessage } from "@deepseek-ai/dsh-llm";
 import { fileURLToPath } from "node:url";
-import { copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { satisfies, validRange } from "semver";
+//#region lib/types/tenant-capability-cache.js
+/** Host-only metadata. Core owns feature truth; this contains no auth material. */
+var TenantCapabilityCache = class {
+	key;
+	directory;
+	path;
+	constructor(stateRoot, endpoint) {
+		this.key = createHash("sha256").update(JSON.stringify([
+			endpoint,
+			stateRoot,
+			1
+		])).digest("hex");
+		this.directory = join(stateRoot, "cache", "tenant-capabilities-v1");
+		this.path = join(this.directory, `${this.key}.json`);
+	}
+	read(validate) {
+		try {
+			const bytes = readFileSync(this.path);
+			if (bytes.length > 16384) return void 0;
+			const value = JSON.parse(bytes.toString("utf8"));
+			if (value.version !== 1 || value.key !== this.key || typeof value.metadata?.handleRecoveryPhoneEnabled !== "boolean") return void 0;
+			return validate(value.metadata);
+		} catch {
+			return;
+		}
+	}
+	write(metadata) {
+		const temporary = `${this.path}.${randomUUID()}.tmp`;
+		try {
+			mkdirSync(this.directory, {
+				recursive: true,
+				mode: 448
+			});
+			writeFileSync(temporary, JSON.stringify({
+				version: 1,
+				key: this.key,
+				metadata
+			}), {
+				mode: 384,
+				flag: "wx"
+			});
+			renameSync(temporary, this.path);
+			return true;
+		} catch {
+			try {
+				unlinkSync(temporary);
+			} catch {}
+			return false;
+		}
+	}
+};
+//#endregion
+//#region lib/types/backend-capabilities.js
+/** Keep the client ceiling and only project a confirmed positive byte limit. */
+function backendAttachmentMaxBytes(snapshot, clientLimit) {
+	if (snapshot?.status !== "confirmed" && snapshot?.status !== "stale") return clientLimit;
+	const capability = snapshot.capabilities.attachments;
+	if (capability?.support !== "supported") return clientLimit;
+	const raw = capability.limits?.max_object_bytes;
+	const value = typeof raw === "number" ? raw : typeof raw === "string" && /^\d+$/.test(raw) ? Number(raw) : NaN;
+	return Number.isSafeInteger(value) && value > 0 ? Math.min(clientLimit, value) : clientLimit;
+}
+const PUBLIC = [
+	"registration.handle_only",
+	"identity.multi_device",
+	"identity.device_revoke",
+	"identity.capability_upgrade",
+	"identity.root_transfer",
+	"agents.managed_agents",
+	"agents.daemon",
+	"services.mail",
+	"services.model_proxy",
+	"services.guest_gateway",
+	"account.state_sync",
+	"content.pages",
+	"content.sites",
+	"content.hosting",
+	"client_updates.policy"
+];
+const MESSAGE = [
+	"direct",
+	"groups",
+	"attachments",
+	"direct_e2ee",
+	"group_e2ee",
+	"encrypted_attachments",
+	"group_open_join",
+	"group_admin_add"
+];
+/** Project one source independently so a failed source cannot erase its peer. */
+function projectBackendSnapshot(snapshot, authenticated) {
+	const result = {};
+	for (const key of authenticated ? MESSAGE : PUBLIC) {
+		const support = snapshot?.capabilities[key]?.support;
+		result[key] = (snapshot?.status === "confirmed" || snapshot?.status === "stale") && (support === "supported" || support === "unsupported") ? support : "unknown";
+	}
+	return result;
+}
+/** Copy only allowlisted support states. Browser never sees endpoints or SDK errors. */
+async function projectBackendFeatures(client, authenticated) {
+	const sources = await Promise.allSettled([client.backendCapabilities?.(false, false), ...authenticated ? [client.backendCapabilities?.(true, false)] : []]);
+	const result = {};
+	for (const [index, source] of sources.entries()) if (source.status === "fulfilled") Object.assign(result, projectBackendSnapshot(source.value, index === 1));
+	else throw source.reason;
+	return result;
+}
+async function requireBackendFeature(client, key) {
+	const snapshot = await client.backendCapabilities?.(!key.includes("."), false);
+	const support = snapshot?.status === "confirmed" || snapshot?.status === "stale" ? snapshot.capabilities[key]?.support : "unknown";
+	if (support !== "supported") throw Object.assign(/* @__PURE__ */ new Error("Server feature unavailable"), {
+		name: "AwikiSdkError",
+		code: support === "unsupported" ? "backend-not-supported" : "backend-unconfirmed"
+	});
+}
+//#endregion
 //#region lib/types/builtin-tenant-config.js
 /** Build-injected two-slot tenant catalog with a source-tree default for tests. */
 function record$2(value) {
@@ -3718,6 +3833,7 @@ async function checkAwikiUpdatePolicy(options) {
 		signal.throwIfAborted();
 		const endpoint = new URL("/user-service/v1/server-info", origin);
 		endpoint.searchParams.set("client_platform", "dsh");
+		endpoint.searchParams.set("capabilities_version", "1");
 		const response = await bounded((options.fetcher ?? fetch)(endpoint, {
 			method: "GET",
 			headers: {
@@ -3746,7 +3862,19 @@ async function checkAwikiUpdatePolicy(options) {
 		const bytes = await bounded(readPolicyBody(response));
 		signal.throwIfAborted();
 		if (bytes.byteLength > MAX_POLICY_BYTES) throw new Error("policy response exceeds 1 MiB");
-		const policy = decodeServerInfoPolicy(JSON.parse(Buffer.from(bytes).toString("utf8")), origin, cached?.policy.policy_revision);
+		const document = JSON.parse(Buffer.from(bytes).toString("utf8"));
+		if (isRecord(document) && document.schema_version === 1 && document.capabilities_version === 1 && isRecord(document.client_updates) && isRecord(document.client_updates.policy) && document.client_updates.policy.protocol_version === 1 && document.client_updates.policy.enabled === false) return {
+			...cached === void 0 ? {
+				...base,
+				usedCache: false,
+				restricted: false,
+				modelProxyRestricted: false
+			} : statusFromPolicy(base, cached.policy, cached.checkedAt, false, true, options.installedRuntime),
+			offline: false,
+			policyUnavailable: true,
+			checkState: "unavailable"
+		};
+		const policy = decodeServerInfoPolicy(document, origin, cached?.policy.policy_revision);
 		if (policy === void 0) {
 			rmSync(cachePath, { force: true });
 			return {
@@ -4076,6 +4204,8 @@ const Config = z.object({
 	summaryMaxInputBytes: z.number().default(DEFAULT_SUMMARY_MAX_INPUT_BYTES)
 });
 const FAILURE_CODES = /* @__PURE__ */ new Set([
+	"backend-not-supported",
+	"backend-unconfirmed",
 	"client-version-unsupported",
 	"not-registered",
 	"signed-out",
@@ -4116,6 +4246,8 @@ const RESUMABLE_JOIN_PHASES = /* @__PURE__ */ new Set([
 	"approval_prepared"
 ]);
 const FAILURE_MESSAGES = {
+	"backend-not-supported": "This server does not support this feature.",
+	"backend-unconfirmed": "Server features are not confirmed yet. Please retry.",
 	"client-version-unsupported": "This AWiki plugin version is not supported by the active tenant. Update the plugin or switch tenants.",
 	"not-registered": "No AWiki identity is registered for this deployment.",
 	"signed-out": "This installation is signed out of AWiki.",
@@ -4198,7 +4330,7 @@ function publishedServiceBaseUrl(services, name, allowInsecureLoopbackForTesting
 	const candidate = services[name];
 	if (typeof candidate !== "object" || candidate === null || Array.isArray(candidate)) return void 0;
 	const value = candidate;
-	if (value.enabled !== true || typeof value.base_url !== "string") return void 0;
+	if (value.enabled !== true || value.protocol_version !== 1 || typeof value.base_url !== "string") return void 0;
 	try {
 		const baseUrl = serviceUrl(`server-info.services.${name}.base_url`, value.base_url, allowInsecureLoopbackForTesting);
 		if (new URL(baseUrl).search !== "") return void 0;
@@ -4649,6 +4781,7 @@ let AwikiService = (() => {
 	let _classSuper = TypertRemoteService;
 	let _instanceExtraInitializers = [];
 	let _getConfig_decorators;
+	let _refreshBackendCapabilities_decorators;
 	let _getIntegration_decorators;
 	let _createIntegration_decorators;
 	let _updateIntegration_decorators;
@@ -4721,6 +4854,7 @@ let AwikiService = (() => {
 		static {
 			const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
 			_getConfig_decorators = [Remote];
+			_refreshBackendCapabilities_decorators = [Remote];
 			_getIntegration_decorators = [Remote];
 			_createIntegration_decorators = [Remote];
 			_updateIntegration_decorators = [Remote];
@@ -4800,6 +4934,17 @@ let AwikiService = (() => {
 				},
 				metadata: _metadata
 			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _refreshBackendCapabilities_decorators, {
+				kind: "method",
+				name: "refreshBackendCapabilities",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "refreshBackendCapabilities" in obj,
+					get: (obj) => obj.refreshBackendCapabilities
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
 			__esDecorate(this, null, _getIntegration_decorators, {
 				kind: "method",
 				name: "getIntegration",
@@ -5572,6 +5717,15 @@ let AwikiService = (() => {
 		tenantSwitching = false;
 		tenantParticipants = /* @__PURE__ */ new Set();
 		activeCapabilities;
+		backendFeatures = {};
+		backendDiagnostics = {};
+		backendFeaturesTask;
+		backendFeaturesRevision = -1;
+		backendSubscriptions = /* @__PURE__ */ new Map();
+		backendSubscriptionPending = /* @__PURE__ */ new Set();
+		backendAttachmentLimit;
+		capabilityDiscoveryTask;
+		capabilityDiscoveryAt = 0;
 		updatePolicyStatus;
 		updatePolicyRequest;
 		updatePolicyTask;
@@ -5668,6 +5822,7 @@ let AwikiService = (() => {
 			registerAwikiTools(ctx, this);
 			ctx.effect(() => async () => {
 				this.updatePolicyRequest?.abort();
+				this.stopBackendSubscriptions();
 				const provider = this.provider;
 				if (provider !== void 0) await this.disposeProvider(provider);
 			}, "awiki: dispose current client provider");
@@ -5751,12 +5906,49 @@ let AwikiService = (() => {
 			this.conversationPreferenceStore = new AwikiConversationPreferenceStore(options.stateRoot);
 			this.mailListClient = new AwikiMailListClient(options.mailServiceUrl, this.externalHttpAuth);
 			this.integrationClient = void 0;
+			this.stopBackendSubscriptions();
+			this.backendFeatures = {};
+			this.backendDiagnostics = {};
+			this.backendFeaturesRevision = -1;
+			this.backendFeaturesTask = void 0;
+			this.backendAttachmentLimit = void 0;
+			this.capabilityDiscoveryTask = void 0;
+			this.capabilityDiscoveryAt = 0;
 			this.activeCapabilities = {
 				tenantId: tenant.tenantId,
 				generation: this.runtimeGeneration,
 				online: false,
 				handleRecoveryPhoneEnabled: false
 			};
+			const metadata = new TenantCapabilityCache(options.stateRoot, options.userServiceUrl).read((value) => {
+				const services = {
+					model_proxy: {
+						enabled: true,
+						protocol_version: 1,
+						base_url: value.modelProxyBaseUrl
+					},
+					guest_gateway: {
+						enabled: true,
+						protocol_version: 1,
+						base_url: value.guestGatewayBaseUrl
+					}
+				};
+				const modelProxyBaseUrl = publishedServiceBaseUrl(services, "model_proxy", this.resolved.allowInsecureLoopbackForTesting);
+				const guestGatewayBaseUrl = publishedServiceBaseUrl(services, "guest_gateway", false);
+				return {
+					handleRecoveryPhoneEnabled: value.handleRecoveryPhoneEnabled,
+					...modelProxyBaseUrl === void 0 ? {} : { modelProxyBaseUrl },
+					...guestGatewayBaseUrl === void 0 ? {} : { guestGatewayBaseUrl }
+				};
+			});
+			if (metadata !== void 0) {
+				this.activeCapabilities = {
+					...this.activeCapabilities,
+					...metadata,
+					online: true
+				};
+				this.integrationClient = metadata.guestGatewayBaseUrl === void 0 ? void 0 : new AwikiIntegrationClient(metadata.guestGatewayBaseUrl, this.externalHttpAuth);
+			}
 			this.signedOut = void 0;
 			this.activeIdentityDid = void 0;
 			this.pendingDeviceJoin = void 0;
@@ -5934,7 +6126,7 @@ let AwikiService = (() => {
 					await this.sessionStore.signIn();
 					this.signedOut = false;
 				}
-				await Promise.all([this.discoverTenantCapabilities(3e3), this.refreshUpdatePolicy()]);
+				Promise.all([this.refreshTenantCapabilities(), this.refreshUpdatePolicy()]).catch(() => void 0);
 				registry.commitActive(target.tenantId);
 				committed = true;
 				for (const participant of prepared) await participant.commitSwitch?.(context);
@@ -6012,16 +6204,22 @@ let AwikiService = (() => {
 		*/
 		async getConfig() {
 			this.ensureTenantOptions();
-			const capabilities = await this.discoverTenantCapabilities(1e4);
-			if (this.tenantSwitching || capabilities.generation !== this.runtimeGeneration || capabilities.tenantId !== this.activeTenant?.tenantId) return {
+			if (this.runtimeGeneration !== this.runtimeGeneration) return {
 				ok: false,
 				error: failure("conflict")
 			};
+			const capabilities = this.activeCapabilities;
+			this.refreshBackendProjection();
+			this.refreshTenantCapabilities(false).catch(() => void 0);
+			const serverFeatures = this.backendFeatures;
+			const attachmentMaxBytes = this.backendAttachmentLimit ?? this.resolved.attachmentMaxBytes;
 			return {
 				ok: true,
 				value: {
+					serverFeatures,
+					serverFeatureDiagnostics: this.backendDiagnostics,
 					pollIntervalMs: this.resolved.pollIntervalMs,
-					attachmentMaxBytes: this.resolved.attachmentMaxBytes,
+					attachmentMaxBytes,
 					mailAttachmentMaxCount: this.resolved.mailAttachmentMaxCount,
 					mailAttachmentMaxBytes: Math.min(this.resolved.mailAttachmentMaxBytes, MAIL_HTTP_UPLOAD_MAX_BYTES),
 					mailAttachmentDownloadMaxBytes: this.resolved.mailAttachmentMaxBytes,
@@ -6029,7 +6227,7 @@ let AwikiService = (() => {
 					handleRecoveryPhoneEnabled: capabilities.handleRecoveryPhoneEnabled,
 					...capabilities.guestGatewayBaseUrl === void 0 ? {} : { integrationGuideUrl: new URL("/guest/guide/integration", capabilities.guestGatewayBaseUrl).toString() },
 					tenantId: capabilities.tenantId,
-					tenantStorageScopeId: this.activeTenant?.storageScopeId,
+					tenantStorageScopeId: this.activeTenant.storageScopeId,
 					tenantGeneration: capabilities.generation,
 					tenantOnline: capabilities.online,
 					services: {
@@ -6039,6 +6237,17 @@ let AwikiService = (() => {
 				}
 			};
 		}
+		/** Explicit discovery retry; ordinary config reads retain their zero-argument contract. */
+		async refreshBackendCapabilities() {
+			this.ensureTenantOptions();
+			const generation = this.runtimeGeneration;
+			await Promise.allSettled([this.refreshTenantCapabilities(true), this.refreshBackendProjection(true)]);
+			if (generation !== this.runtimeGeneration) return {
+				ok: false,
+				error: failure("conflict")
+			};
+			return this.getConfig();
+		}
 		/** Trusted same-process capability binding for optional tenant participants. */
 		getTenantCapabilities() {
 			const capabilities = this.activeCapabilities;
@@ -6046,16 +6255,117 @@ let AwikiService = (() => {
 			return { ...capabilities };
 		}
 		/** Refresh the active tenant's optional service advertisement without affecting Core availability. */
-		refreshTenantCapabilities() {
+		refreshTenantCapabilities(force = true) {
 			this.ensureTenantOptions();
-			return this.discoverTenantCapabilities(1e4);
+			if (this.capabilityDiscoveryTask !== void 0) return this.capabilityDiscoveryTask;
+			if (!force && Date.now() - this.capabilityDiscoveryAt < 3e5 && this.activeCapabilities !== void 0) return Promise.resolve(this.activeCapabilities);
+			const generation = this.runtimeGeneration;
+			const task = this.discoverTenantCapabilities(1e4).finally(() => {
+				if (this.runtimeGeneration === generation && this.capabilityDiscoveryTask === task) {
+					this.capabilityDiscoveryTask = void 0;
+					this.capabilityDiscoveryAt = Date.now();
+				}
+			});
+			this.capabilityDiscoveryTask = task;
+			return task;
+		}
+		refreshBackendProjection(force = false) {
+			const provider = this.provider;
+			if (provider === void 0) return Promise.resolve();
+			if (this.backendFeaturesTask !== void 0) return this.backendFeaturesTask;
+			const revision = this.sessionRevision;
+			const generation = this.runtimeGeneration;
+			if (this.backendFeaturesRevision !== revision) {
+				this.backendFeatures = Object.fromEntries(Object.entries(this.backendFeatures).filter(([key]) => key.includes(".")));
+				this.backendAttachmentLimit = void 0;
+				this.backendDiagnostics = this.backendDiagnostics.public === void 0 ? {} : { public: this.backendDiagnostics.public };
+				this.backendFeaturesRevision = revision;
+			}
+			const current = () => provider === this.provider && revision === this.sessionRevision && generation === this.runtimeGeneration;
+			const task = (async () => {
+				const authenticated = !await this.isSignedOut() && await provider.client.getIdentity() !== null;
+				await Promise.all([false, ...authenticated ? [true] : []].map(async (local) => {
+					try {
+						this.observeBackendProjection(provider, local, current);
+						const snapshot = await provider.client.backendCapabilities?.(local, force);
+						if (!current()) return;
+						if (snapshot === void 0) return;
+						if (this.backendSubscriptions.has(local)) return;
+						this.recordBackendDiagnostics(local, snapshot);
+						if (snapshot.status === "unavailable") return;
+						this.backendFeatures = {
+							...this.backendFeatures,
+							...projectBackendSnapshot(snapshot, local)
+						};
+						if (local) this.backendAttachmentLimit = backendAttachmentMaxBytes(snapshot, this.resolved.attachmentMaxBytes);
+						if (this.backendFeatures["agents.managed_agents"] === "unsupported") await this.detachAgentConsumer(provider);
+						else if (this.backendFeatures["agents.managed_agents"] === "supported") this.ensureAgentConsumer(provider);
+					} catch (error) {
+						if (current()) this.ctx.logger("awiki-capabilities").debug("AWiki capability refresh failed: %s", error instanceof AwikiSdkError ? error.code : "unavailable");
+					}
+				}));
+			})().finally(() => {
+				if (this.backendFeaturesTask === task) this.backendFeaturesTask = void 0;
+			});
+			this.backendFeaturesTask = task;
+			task.catch(() => void 0);
+			return task;
+		}
+		recordBackendDiagnostics(local, snapshot) {
+			this.backendDiagnostics = {
+				...this.backendDiagnostics,
+				[local ? "message" : "public"]: {
+					...typeof snapshot.fetched_at === "number" ? { fetchedAt: snapshot.fetched_at } : {},
+					...snapshot.refresh_error === void 0 ? {} : { refreshError: snapshot.refresh_error }
+				}
+			};
+		}
+		stopBackendSubscriptions() {
+			for (const subscription of this.backendSubscriptions.values()) subscription.stop();
+			this.backendSubscriptions.clear();
+			this.backendSubscriptionPending.clear();
+		}
+		observeBackendProjection(provider, local, current) {
+			const subscribe = provider.client.subscribeBackendCapabilities;
+			if (subscribe === void 0 || this.backendSubscriptions.has(local) || this.backendSubscriptionPending.has(local)) return;
+			this.backendSubscriptionPending.add(local);
+			(async () => {
+				const subscription = await subscribe.call(provider.client, local);
+				if (!current()) {
+					subscription.stop();
+					return;
+				}
+				this.backendSubscriptionPending.delete(local);
+				this.backendSubscriptions.set(local, subscription);
+				try {
+					while (current()) {
+						const state = await subscription.nextUpdate();
+						if (state === null || !current()) break;
+						this.recordBackendDiagnostics(local, state.snapshot);
+						if (state.snapshot.status === "unavailable") continue;
+						this.backendFeatures = {
+							...this.backendFeatures,
+							...projectBackendSnapshot(state.snapshot, local)
+						};
+						if (local) this.backendAttachmentLimit = backendAttachmentMaxBytes(state.snapshot, this.resolved.attachmentMaxBytes);
+						if (this.backendFeatures["agents.managed_agents"] === "unsupported") await this.detachAgentConsumer(provider);
+						else if (this.backendFeatures["agents.managed_agents"] === "supported") this.ensureAgentConsumer(provider);
+					}
+				} finally {
+					subscription.stop();
+					if (this.backendSubscriptions.get(local) === subscription) this.backendSubscriptions.delete(local);
+				}
+			})().catch(() => {
+				if (current()) this.backendSubscriptionPending.delete(local);
+			});
 		}
 		async discoverTenantCapabilities(timeoutMs) {
 			const options = this.activeClientOptions;
 			const tenant = this.activeTenant;
 			if (options === void 0 || tenant === void 0) throw new ProviderUnavailableError();
 			const generation = this.runtimeGeneration;
-			const fallback = {
+			const previous = this.activeCapabilities;
+			const fallback = previous?.tenantId === tenant.tenantId && previous.generation === generation ? { ...previous } : {
 				tenantId: tenant.tenantId,
 				generation,
 				online: false,
@@ -6075,6 +6385,7 @@ let AwikiService = (() => {
 			try {
 				const endpoint = new URL("/user-service/v1/server-info", options.userServiceUrl);
 				endpoint.searchParams.set("client_platform", "dsh");
+				endpoint.searchParams.set("capabilities_version", "1");
 				const response = await fetch(endpoint, {
 					method: "GET",
 					headers: {
@@ -6089,19 +6400,37 @@ let AwikiService = (() => {
 				const text = await readBoundedResponseText(response, SERVER_INFO_RESPONSE_MAX_BYTES);
 				const value = text === void 0 ? void 0 : JSON.parse(text);
 				if (typeof value !== "object" || value === null || value.schema_version !== 1) return publish(fallback);
+				const versioned = value.capabilities_version === 1;
+				if (!versioned) {
+					if ("capabilities_version" in value) return publish({
+						tenantId: tenant.tenantId,
+						generation,
+						online: true,
+						handleRecoveryPhoneEnabled: false
+					});
+					return publish(fallback);
+				}
 				const methods = value.identity?.handle_recovery?.methods;
-				const handleRecoveryPhoneEnabled = Array.isArray(methods) && methods.some((method) => typeof method === "object" && method !== null && method.id === "phone" && method.enabled === true && method.verification?.required === true && method.verification?.type === "sms_otp");
-				const services = value.services;
+				const handleRecoveryPhoneEnabled = versioned && Array.isArray(methods) && methods.some((method) => typeof method === "object" && method !== null && method.id === "phone" && method.enabled === true && method.verification?.required === true && method.verification?.type === "sms_otp");
+				const services = versioned ? value.services : void 0;
 				const modelProxyBaseUrl = publishedServiceBaseUrl(services, "model_proxy", this.resolved.allowInsecureLoopbackForTesting);
 				const guestGatewayBaseUrl = publishedServiceBaseUrl(services, "guest_gateway", false);
-				return publish({
+				const capabilities = {
 					tenantId: tenant.tenantId,
 					generation,
 					online: true,
 					handleRecoveryPhoneEnabled,
 					...modelProxyBaseUrl === void 0 ? {} : { modelProxyBaseUrl },
 					...guestGatewayBaseUrl === void 0 ? {} : { guestGatewayBaseUrl }
-				});
+				};
+				if (this.runtimeGeneration === generation && this.activeTenant?.tenantId === tenant.tenantId) {
+					if (!new TenantCapabilityCache(options.stateRoot, options.userServiceUrl).write({
+						handleRecoveryPhoneEnabled,
+						...modelProxyBaseUrl === void 0 ? {} : { modelProxyBaseUrl },
+						...guestGatewayBaseUrl === void 0 ? {} : { guestGatewayBaseUrl }
+					})) this.ctx.logger("awiki-capabilities").debug("AWiki capability metadata persistence failed");
+				}
+				return publish(capabilities);
 			} catch {
 				return publish(fallback);
 			} finally {
@@ -6192,7 +6521,10 @@ let AwikiService = (() => {
 					const session = { status: "signed-out" };
 					this.publishSession(session);
 					const provider = this.provider;
-					if (provider !== void 0) await this.stopProviderRuntime(provider);
+					if (provider !== void 0) {
+						await this.stopProviderRuntime(provider);
+						await this.updateBackendDiscoveryLifecycle(provider, false);
+					}
 					return {
 						ok: true,
 						value: session
@@ -6225,7 +6557,10 @@ let AwikiService = (() => {
 					};
 					this.publishSession(session);
 					const provider = this.provider;
-					if (provider !== void 0) this.ensureProviderRuntime(provider);
+					if (provider !== void 0) {
+						this.ensureProviderRuntime(provider);
+						await this.updateBackendDiscoveryLifecycle(provider, true);
+					}
 					return {
 						ok: true,
 						value: session
@@ -6459,6 +6794,8 @@ let AwikiService = (() => {
 				const recoveries = await client.listPendingRecoveries();
 				const pendingRegistrations = await client.pendingIdentityRegistrations();
 				const creationMethods = await client.identityCreationMethods().catch(() => []);
+				const backend = await client.backendCapabilities?.(false);
+				const registrationHandleOnly = backend?.capabilities["registration.handle_only"]?.support === "supported" && (backend.status === "confirmed" || backend.status === "stale");
 				const identity = await client.getIdentity();
 				const capabilities = identity === null ? void 0 : await client.identityMethodCapabilities(identity.did);
 				const domain = this.activeClientOptions?.userServiceDomain;
@@ -6473,6 +6810,7 @@ let AwikiService = (() => {
 					},
 					joining,
 					creationMethods,
+					registrationHandleOnly,
 					pendingRegistrations,
 					...capabilities === void 0 ? {} : { methodCapabilities: capabilities },
 					recoveries: recoveries.filter((value) => domain !== void 0 && value.fullHandle.slice(value.fullHandle.indexOf(".") + 1) === domain)
@@ -6874,7 +7212,12 @@ let AwikiService = (() => {
 				ok: false,
 				error: failure("invalid-request")
 			};
-			const created = await this.run((client) => client.createGroup(normalized.name, normalized.encrypted, normalized.operationId));
+			const created = await this.run(async (client) => {
+				await requireBackendFeature(client, "groups");
+				if (normalized.encrypted) await requireBackendFeature(client, "group_e2ee");
+				if (normalized.members.length > 0) await requireBackendFeature(client, "group_admin_add");
+				return client.createGroup(normalized.name, normalized.encrypted, normalized.operationId);
+			});
 			if (!created.ok) return created;
 			const addedMembers = [];
 			const failedMembers = [];
@@ -6911,7 +7254,10 @@ let AwikiService = (() => {
 				ok: false,
 				error: failure("invalid-request")
 			});
-			return this.run((client) => client.repairGroupSecurity(groupDid));
+			return this.run(async (client) => {
+				await requireBackendFeature(client, "group_e2ee");
+				return client.repairGroupSecurity(groupDid);
+			});
 		}
 		/** Join one open group and return its authoritative membership state. */
 		joinGroup(request) {
@@ -6920,7 +7266,10 @@ let AwikiService = (() => {
 				ok: false,
 				error: failure("invalid-request")
 			});
-			return this.run((client) => client.joinGroup(groupDid));
+			return this.run(async (client) => {
+				await requireBackendFeature(client, "group_open_join");
+				return client.joinGroup(groupDid);
+			});
 		}
 		/** Leave one group. Core rejects owner leave and unsupported security profiles. */
 		async leaveGroup(request) {
@@ -7502,6 +7851,7 @@ let AwikiService = (() => {
 			return client.getLocalDeviceJoinVerificationProgress(notice.joinSessionId);
 		}
 		async requireDeviceManager(client) {
+			await requireBackendFeature(client, "identity.multi_device");
 			const current = await client.getCurrentDeviceSummary();
 			if (!current.canManage || current.role !== "admin" || current.readiness !== "admin_ready") throw Object.assign(/* @__PURE__ */ new Error("device manager required"), {
 				name: "AwikiSdkError",
@@ -7509,6 +7859,7 @@ let AwikiService = (() => {
 			});
 		}
 		async requireRootTransferRecipient(client, deviceId) {
+			await requireBackendFeature(client, "identity.root_transfer");
 			if (!client.trustedUserPresenceSupported) throw Object.assign(/* @__PURE__ */ new Error("trusted user presence unsupported"), {
 				name: "AwikiSdkError",
 				code: "forbidden"
@@ -7635,6 +7986,7 @@ let AwikiService = (() => {
 		}
 		/** Invalidate cached session work and cancel every model request still owned by the old session. */
 		invalidateSummaries() {
+			this.stopBackendSubscriptions();
 			this.sessionRevision += 1;
 			this.requestRefs.clear();
 			this.requestSessions.clear();
@@ -7718,7 +8070,10 @@ let AwikiService = (() => {
 					error: failure("invalid-request")
 				});
 			}
-			return this.run((client) => operation(client, request), options);
+			return this.run(async (client) => {
+				await requireBackendFeature(client, "services.mail");
+				return operation(client, request);
+			}, options);
 		}
 		/** Read and cache the private Host-owned session marker. */
 		async isSignedOut() {
@@ -7772,6 +8127,14 @@ let AwikiService = (() => {
 			this.sessionMutation = pending.then(() => void 0, () => void 0);
 			return pending;
 		}
+		/** Discovery is an optional projection, not authority for a committed session transition. */
+		async updateBackendDiscoveryLifecycle(provider, active) {
+			try {
+				await provider.client.setBackendDiscoveryActive?.(active);
+			} catch {
+				this.ctx.logger("awiki-backend").warn("AWiki backend discovery lifecycle unavailable");
+			}
+		}
 		/** Start identity realtime and the optional Agent consumer without blocking identity success. */
 		ensureProviderRuntime(provider) {
 			if (this.tenantSwitching) return;
@@ -7781,6 +8144,7 @@ let AwikiService = (() => {
 				this.replaceProviderRuntime(provider, identityDid);
 				return;
 			}
+			this.refreshBackendProjection();
 			this.ensureRealtimeSupervisor(provider);
 			this.ensureAgentConsumer(provider);
 		}
@@ -7857,6 +8221,7 @@ let AwikiService = (() => {
 			const logger = this.ctx.logger("awiki-listener");
 			const observed = (async () => {
 				await this.detachAgentConsumer(provider);
+				if ((await projectBackendFeatures(provider.client, false))["agents.managed_agents"] !== "supported") return;
 				if (!this.agentConsumerFenceMatches(provider, workspaceContext, identityDid, generation)) return;
 				const agents = new DshAwikiListenerAgentRuntime(workspaceContext, this.resolved.listener.workspacePath);
 				const consumer = new AwikiAgentListener(source, agents, {