@awiki/dsh-plugin 0.3.2 → 0.3.4

package/lib/types/index.js

@@ -34,6 +34,7 @@ var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn,
     done = true;
 };
 import { Context } from '@deepseek-ai/cordis';
+import { createHash, randomUUID, timingSafeEqual } from 'node:crypto';
 import { homedir } from 'node:os';
 import { isAbsolute, join } from 'node:path';
 import z from '@deepseek-ai/schemastery';
@@ -53,6 +54,7 @@ import { AwikiImageAttachmentCache, minimumImageAttachmentCacheMaxBytes } from "
 import { AwikiSentMailStore, isLocalSentMailId } from "./sent-mail-store.js";
 import { AwikiConversationPreferenceStore, normalizeConversationPreferenceMutation, } from "./conversation-preferences.js";
 import { AwikiAgentListener, DshAwikiListenerAgentRuntime, } from "./listener.js";
+import { IdentityRealtimeSupervisor, } from "./realtime-supervisor.js";
 export { AWIKI_CLEAR_LOCAL_DATA_CONFIRMATION, AWIKI_LOGOUT_CONFIRMATION } from "./types.js";
 export { AWIKI_EXTERNAL_HTTP_MAX_BODY_BYTES, AwikiExternalHttpAuthError, } from "./external-http-auth.js";
 export { AWIKI_DOMAIN_FIELD, AWIKI_SETTINGS_NAMESPACE, AwikiSettingsSchema, DEFAULT_AWIKI_DOMAIN, normalizeAwikiDomain, validateAwikiSettings, } from "./settings.js";
@@ -85,6 +87,7 @@ export const Config = z.object({
     attachmentMaxBytes: z.number().default(DEFAULT_ATTACHMENT_MAX_BYTES),
     imageAttachmentCacheMaxBytes: z.number().default(DEFAULT_IMAGE_ATTACHMENT_CACHE_MAX_BYTES),
     pollIntervalMs: z.number().default(DEFAULT_POLL_INTERVAL_MS),
+    realtimeEnabled: z.boolean().default(true),
     listenerEnabled: z.boolean().default(false),
     listenerAllowedPeers: z.array(z.string()).default([]),
     listenerWorkspacePath: z.string(),
@@ -115,10 +118,17 @@ const FAILURE_CODES = new Set([
     'network',
     'remote',
 ]);
-const LISTENER_RESTART_BASE_DELAY_MS = 1_000;
-const LISTENER_RESTART_MAX_DELAY_MS = 30_000;
-const LISTENER_RESTART_MAX_ATTEMPT = 6;
-const LISTENER_STABLE_RESET_MS = 60_000;
+const DEVICE_JOIN_APPROVAL_CONFIRMATION = 'APPROVE';
+const DEVICE_REVOKE_CONFIRMATION = 'REVOKE';
+const DEVICE_JOIN_CHALLENGE_TTL_SECONDS = 240;
+const RESUMABLE_JOIN_PHASES = new Set([
+    'pending',
+    'challenge_prepared',
+    'response_prepared',
+    'response_verified',
+    'approval_prepared',
+    'authorized',
+]);
 const FAILURE_MESSAGES = {
     'not-registered': 'No AWiki identity is registered for this deployment.',
     'signed-out': 'This installation is signed out of AWiki.',
@@ -148,6 +158,67 @@ class ProviderUnavailableError extends Error {
 }
 class SummaryProviderUnavailableError extends Error {
 }
+function candidateJoinPhase(value) {
+    if (value.remoteState === 'rejected')
+        return 'rejected';
+    if (value.remoteState === 'cancelled' || value.localPhase === 'cancelled')
+        return 'cancelled';
+    if (value.remoteState === 'expired' || value.localPhase === 'expired')
+        return 'expired';
+    if (value.localPhase === 'authorized'
+        && value.remoteState === 'consumed'
+        && value.completed
+        && value.identity !== undefined)
+        return 'authorized';
+    if (value.sas !== undefined) {
+        return value.remoteState === 'response_verified' && /^\d{6}$/u.test(value.sas)
+            ? 'sas-ready'
+            : undefined;
+    }
+    if (value.remoteState === 'challenge_sent'
+        || value.remoteState === 'response_verified'
+        || value.remoteState === 'consumed'
+        || value.localPhase !== 'pending')
+        return 'verifying';
+    return value.remoteState === 'pending' ? 'pending' : undefined;
+}
+function adminJoinPhase(value) {
+    if (value.remoteState === 'rejected')
+        return 'rejected';
+    if (value.remoteState === 'cancelled' || value.localPhase === 'cancelled')
+        return 'cancelled';
+    if (value.remoteState === 'expired' || value.localPhase === 'expired')
+        return 'expired';
+    if (value.localPhase === 'authorized' && value.remoteState === 'consumed')
+        return 'authorized';
+    if (value.sas !== undefined) {
+        return value.remoteState === 'response_verified' && /^\d{6}$/u.test(value.sas)
+            ? 'sas-ready'
+            : undefined;
+    }
+    if (value.remoteState === 'challenge_sent'
+        || value.remoteState === 'response_verified'
+        || value.remoteState === 'consumed'
+        || value.localPhase !== 'pending')
+        return 'verifying';
+    return value.remoteState === 'pending' ? 'pending' : undefined;
+}
+function requestJoinPhase(value) {
+    switch (value.state) {
+        case 'pending': return 'pending';
+        case 'challenge_sent':
+        case 'response_verified': return 'verifying';
+        case 'consumed': return 'authorized';
+        case 'cancelled': return 'cancelled';
+        case 'rejected': return 'rejected';
+        case 'expired': return 'expired';
+    }
+}
+function constantTimeSasMatches(expected, actual) {
+    if (!/^\d{6}$/u.test(expected) || !/^\d{6}$/u.test(actual))
+        return false;
+    return timingSafeEqual(Buffer.from(expected, 'ascii'), Buffer.from(actual, 'ascii'));
+}
 /** Validate and preserve one SDK service URL without accepting insecure remote HTTP. */
 function serviceUrl(field, raw, allowInsecureLoopbackForTesting) {
     let url;
@@ -275,6 +346,10 @@ function resolveConfig(config) {
         throw new TypeError('awiki: pollIntervalMs must be a safe integer from 1000 through 60000');
     }
     const listenerEnabled = config.listenerEnabled ?? false;
+    const realtimeEnabled = config.realtimeEnabled ?? true;
+    if (listenerEnabled && !realtimeEnabled) {
+        throw new TypeError('awiki: listenerEnabled requires realtimeEnabled');
+    }
     const listenerWorkspacePath = config.listenerWorkspacePath?.trim() || join(dshHome, 'workspaces', 'awiki');
     if (!isAbsolute(listenerWorkspacePath)) {
         throw new TypeError('awiki: listenerWorkspacePath must be an absolute path');
@@ -301,6 +376,7 @@ function resolveConfig(config) {
         attachmentMaxBytes,
         imageAttachmentCacheMaxBytes,
         pollIntervalMs,
+        realtimeEnabled,
         listenerEnabled,
         listener: {
             allowedPeers,
@@ -461,6 +537,7 @@ function normalizeRecoveryPrepareRequest(request) {
     return { ...operation, phone, otp };
 }
 const IDENTITY_ACCESS_RESPONSE_MAX_BYTES = 64 * 1024;
+const SERVER_INFO_RESPONSE_MAX_BYTES = 64 * 1024;
 const RECOVERY_RECONCILIATION_RESPONSE_MAX_BYTES = 4 * 1024;
 /** Read one untrusted discovery response without buffering beyond the fixed Host limit. */
 async function readBoundedResponseText(response, maxBytes) {
@@ -690,6 +767,14 @@ let AwikiService = (() => {
     let _inspectIdentityAccess_decorators;
     let _sendRegistrationOtp_decorators;
     let _registerIdentity_decorators;
+    let _beginDeviceJoin_decorators;
+    let _getDeviceJoinStatus_decorators;
+    let _cancelDeviceJoin_decorators;
+    let _refreshDeviceManagement_decorators;
+    let _startDeviceJoinVerification_decorators;
+    let _approveDeviceJoin_decorators;
+    let _rejectDeviceJoin_decorators;
+    let _revokeDevice_decorators;
     let _updateDisplayName_decorators;
     let _getProfile_decorators;
     let _updateProfile_decorators;
@@ -735,6 +820,14 @@ let AwikiService = (() => {
             _inspectIdentityAccess_decorators = [Remote];
             _sendRegistrationOtp_decorators = [Remote];
             _registerIdentity_decorators = [Remote];
+            _beginDeviceJoin_decorators = [Remote];
+            _getDeviceJoinStatus_decorators = [Remote];
+            _cancelDeviceJoin_decorators = [Remote];
+            _refreshDeviceManagement_decorators = [Remote];
+            _startDeviceJoinVerification_decorators = [Remote];
+            _approveDeviceJoin_decorators = [Remote];
+            _rejectDeviceJoin_decorators = [Remote];
+            _revokeDevice_decorators = [Remote];
             _updateDisplayName_decorators = [Remote];
             _getProfile_decorators = [Remote];
             _updateProfile_decorators = [Remote];
@@ -777,6 +870,14 @@ let AwikiService = (() => {
             __esDecorate(this, null, _inspectIdentityAccess_decorators, { kind: "method", name: "inspectIdentityAccess", static: false, private: false, access: { has: obj => "inspectIdentityAccess" in obj, get: obj => obj.inspectIdentityAccess }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _sendRegistrationOtp_decorators, { kind: "method", name: "sendRegistrationOtp", static: false, private: false, access: { has: obj => "sendRegistrationOtp" in obj, get: obj => obj.sendRegistrationOtp }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _registerIdentity_decorators, { kind: "method", name: "registerIdentity", static: false, private: false, access: { has: obj => "registerIdentity" in obj, get: obj => obj.registerIdentity }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _beginDeviceJoin_decorators, { kind: "method", name: "beginDeviceJoin", static: false, private: false, access: { has: obj => "beginDeviceJoin" in obj, get: obj => obj.beginDeviceJoin }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _getDeviceJoinStatus_decorators, { kind: "method", name: "getDeviceJoinStatus", static: false, private: false, access: { has: obj => "getDeviceJoinStatus" in obj, get: obj => obj.getDeviceJoinStatus }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _cancelDeviceJoin_decorators, { kind: "method", name: "cancelDeviceJoin", static: false, private: false, access: { has: obj => "cancelDeviceJoin" in obj, get: obj => obj.cancelDeviceJoin }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _refreshDeviceManagement_decorators, { kind: "method", name: "refreshDeviceManagement", static: false, private: false, access: { has: obj => "refreshDeviceManagement" in obj, get: obj => obj.refreshDeviceManagement }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _startDeviceJoinVerification_decorators, { kind: "method", name: "startDeviceJoinVerification", static: false, private: false, access: { has: obj => "startDeviceJoinVerification" in obj, get: obj => obj.startDeviceJoinVerification }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _approveDeviceJoin_decorators, { kind: "method", name: "approveDeviceJoin", static: false, private: false, access: { has: obj => "approveDeviceJoin" in obj, get: obj => obj.approveDeviceJoin }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _rejectDeviceJoin_decorators, { kind: "method", name: "rejectDeviceJoin", static: false, private: false, access: { has: obj => "rejectDeviceJoin" in obj, get: obj => obj.rejectDeviceJoin }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _revokeDevice_decorators, { kind: "method", name: "revokeDevice", static: false, private: false, access: { has: obj => "revokeDevice" in obj, get: obj => obj.revokeDevice }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _updateDisplayName_decorators, { kind: "method", name: "updateDisplayName", static: false, private: false, access: { has: obj => "updateDisplayName" in obj, get: obj => obj.updateDisplayName }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _getProfile_decorators, { kind: "method", name: "getProfile", static: false, private: false, access: { has: obj => "getProfile" in obj, get: obj => obj.getProfile }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _updateProfile_decorators, { kind: "method", name: "updateProfile", static: false, private: false, access: { has: obj => "updateProfile" in obj, get: obj => obj.updateProfile }, metadata: _metadata }, null, _instanceExtraInitializers);
@@ -827,6 +928,12 @@ let AwikiService = (() => {
         sessionMutation = Promise.resolve();
         sessionRevision = 0;
         activeIdentityDid;
+        pendingDeviceJoin;
+        activeDeviceJoinSessionId;
+        requestRefs = new Map();
+        requestSessions = new Map();
+        deviceRefs = new Map();
+        deviceIds = new Map();
         activeSummaryRequests = new Set();
         summaryProvider;
         recoveryReconciliationTarget;
@@ -871,14 +978,14 @@ let AwikiService = (() => {
                 this.workspaceContext = workspaceCtx;
                 const provider = this.provider;
                 if (provider !== undefined)
-                    void this.startListener(provider);
+                    this.ensureAgentConsumer(provider);
                 workspaceCtx.effect(() => async () => {
                     if (this.workspaceContext !== workspaceCtx)
                         return;
                     this.workspaceContext = undefined;
                     const current = this.provider;
                     if (current !== undefined)
-                        await this.stopListener(current);
+                        await this.stopAgentConsumer(current);
                 }, 'awiki: release Workspace listener composition');
             });
             registerAwikiTools(ctx, this);
@@ -901,6 +1008,8 @@ let AwikiService = (() => {
         registerClientFactory(factory) {
             if (this.provider !== undefined)
                 throw new Error('awiki: a client provider is already registered');
+            this.pendingDeviceJoin = undefined;
+            this.activeDeviceJoinSessionId = undefined;
             const client = factory({
                 userServiceUrl: this.resolved.userServiceUrl,
                 userServiceDomain: this.startupUserServiceDomain,
@@ -915,14 +1024,29 @@ let AwikiService = (() => {
             });
             const provider = {
                 client,
-                listenerRestartAttempt: 0,
-                listenerGeneration: 0,
-                listenerRecoveryBlocked: false,
+                realtimeGeneration: 0,
+                agentConsumerGeneration: 0,
+                localDeviceJoinRequestCountAfterSync: 0,
             };
             this.provider = provider;
-            void this.startListener(provider);
+            this.ensureRealtimeSupervisor(provider);
+            this.ensureAgentConsumer(provider);
             return () => this.disposeProvider(provider);
         }
+        /** Safe same-process diagnostics for focused E2E. Never exposed through Typert Remote. */
+        getRealtimeDiagnostics() {
+            const provider = this.provider;
+            const realtime = provider?.realtimeSupervisor?.diagnostics() ?? {
+                connected: false,
+                activeSessionCount: 0,
+                startCount: 0,
+                stopCount: 0,
+            };
+            return {
+                ...realtime,
+                localDeviceJoinRequestCountAfterSync: provider?.localDeviceJoinRequestCountAfterSync ?? 0,
+            };
+        }
         /** Register the optional Model Proxy recovery target without exposing an arbitrary callback or token. */
         registerRecoveryReconciliationTarget(target) {
             if (this.recoveryReconciliationTarget !== undefined) {
@@ -960,14 +1084,43 @@ let AwikiService = (() => {
          * Read settings needed by the browser presentation.
          * @returns Browser-safe polling configuration without SDK endpoints or state paths.
          */
-        getConfig() {
-            return Promise.resolve({
+        async getConfig() {
+            let handleRecoveryPhoneEnabled = false;
+            const abort = new AbortController();
+            const timeout = setTimeout(() => { abort.abort(); }, 10_000);
+            try {
+                const response = await fetch(new URL('/user-service/v1/server-info', this.resolved.userServiceUrl), {
+                    method: 'GET',
+                    headers: { accept: 'application/json', 'cache-control': 'no-store' },
+                    cache: 'no-store',
+                    redirect: 'error',
+                    signal: abort.signal,
+                });
+                if (response.ok) {
+                    const text = await readBoundedResponseText(response, SERVER_INFO_RESPONSE_MAX_BYTES);
+                    const value = text === undefined ? undefined : JSON.parse(text);
+                    if (typeof value === 'object' && value !== null && value.schema_version === 1) {
+                        const methods = value.identity?.handle_recovery?.methods;
+                        handleRecoveryPhoneEnabled = Array.isArray(methods) && methods.some((method) => (typeof method === 'object' && method !== null
+                            && method.id === 'phone'
+                            && method.enabled === true
+                            && method.verification?.required === true
+                            && method.verification?.type === 'sms_otp'));
+                    }
+                }
+            }
+            catch { }
+            finally {
+                clearTimeout(timeout);
+            }
+            return {
                 ok: true,
                 value: {
                     pollIntervalMs: this.resolved.pollIntervalMs,
                     attachmentMaxBytes: this.resolved.attachmentMaxBytes,
+                    handleRecoveryPhoneEnabled,
                 },
-            });
+            };
         }
         /**
          * Read the deployment's identity status.
@@ -989,6 +1142,9 @@ let AwikiService = (() => {
             if (!identity.ok)
                 return identity;
             this.activeIdentityDid = identity.value?.did;
+            const provider = this.provider;
+            if (identity.value !== null && provider !== undefined)
+                this.ensureProviderRuntime(provider);
             return identity.value === null
                 ? { ok: true, value: { status: 'unregistered' } }
                 : { ok: true, value: { status: 'active', identity: identity.value } };
@@ -1015,7 +1171,7 @@ let AwikiService = (() => {
                     this.publishSession(session);
                     const provider = this.provider;
                     if (provider !== undefined)
-                        await this.stopListener(provider);
+                        await this.stopProviderRuntime(provider);
                     return { ok: true, value: session };
                 }
                 catch {
@@ -1040,7 +1196,7 @@ let AwikiService = (() => {
                     this.publishSession(session);
                     const provider = this.provider;
                     if (provider !== undefined)
-                        void this.startListener(provider);
+                        this.ensureProviderRuntime(provider);
                     return { ok: true, value: session };
                 }
                 catch {
@@ -1098,8 +1254,14 @@ let AwikiService = (() => {
                 return { ok: false, error: failure('remote') };
             }
         }
-        sendRegistrationOtp(request) {
-            return this.run(client => client.sendRegistrationOtp(request));
+        async sendRegistrationOtp(request) {
+            this.pendingDeviceJoin = undefined;
+            return this.run(async (client) => {
+                if (await this.selectDeviceJoinSession(client) !== null) {
+                    throw Object.assign(new Error('join already exists'), { name: 'AwikiSdkError', code: 'conflict' });
+                }
+                return client.sendRegistrationOtp(request);
+            });
         }
         /**
          * Register and persist the deployment's only AWiki identity.
@@ -1107,10 +1269,177 @@ let AwikiService = (() => {
          * @returns The new public identity or a closed failure.
          */
         async registerIdentity(request) {
-            const result = await this.run(client => client.registerIdentity(request));
-            if (result.ok)
-                await this.activateRegisteredIdentity(result.value);
-            return result;
+            this.pendingDeviceJoin = undefined;
+            const result = await this.run(async (client) => {
+                if (await this.selectDeviceJoinSession(client) !== null) {
+                    throw Object.assign(new Error('join already exists'), { name: 'AwikiSdkError', code: 'conflict' });
+                }
+                return client.registerIdentity(request);
+            });
+            if (!result.ok)
+                return result;
+            if (result.value.status === 'registered') {
+                await this.activateRegisteredIdentity(result.value.identity);
+                return { ok: true, value: { status: 'registered', identity: result.value.identity } };
+            }
+            this.pendingDeviceJoin = {
+                continuationId: result.value.continuationId,
+                fullHandle: result.value.fullHandle,
+                mode: result.value.mode,
+                requiresUserPresence: result.value.requiresUserPresence,
+            };
+            return {
+                ok: true,
+                value: {
+                    status: 'join-required',
+                    fullHandle: result.value.fullHandle,
+                    mode: result.value.mode,
+                    requiresUserPresence: result.value.requiresUserPresence,
+                },
+            };
+        }
+        /** Consume the exact in-memory continuation; ordinary Join never claims rebind user presence. */
+        async beginDeviceJoin() {
+            const continuation = this.pendingDeviceJoin;
+            if (continuation === undefined)
+                return { ok: false, error: failure('conflict') };
+            if (continuation.mode !== 'ordinary' || continuation.requiresUserPresence) {
+                return { ok: false, error: failure('forbidden') };
+            }
+            this.pendingDeviceJoin = undefined;
+            const result = await this.run(client => client.beginDeviceJoin({
+                continuationId: continuation.continuationId,
+                operationId: `dsh-device-join-${randomUUID()}`,
+                userPresenceConfirmed: false,
+            }));
+            if (!result.ok)
+                return result;
+            this.activeDeviceJoinSessionId = result.value.joinSessionId;
+            return this.applyCandidateJoinProgress(result.value);
+        }
+        /** Restore from Core local_sessions and advance only the exact resumable Join. */
+        async getDeviceJoinStatus() {
+            const result = await this.run(async (client) => {
+                const joinSessionId = await this.selectDeviceJoinSession(client);
+                return joinSessionId === null ? null : client.getDeviceJoinStatus(joinSessionId);
+            });
+            if (!result.ok)
+                return result;
+            if (result.value === null)
+                return { ok: true, value: null };
+            this.activeDeviceJoinSessionId = result.value.joinSessionId;
+            return this.applyCandidateJoinProgress(result.value);
+        }
+        async cancelDeviceJoin() {
+            const result = await this.run(async (client) => {
+                const joinSessionId = await this.selectDeviceJoinSession(client);
+                if (joinSessionId === null)
+                    return null;
+                return client.cancelDeviceJoin(joinSessionId);
+            });
+            if (!result.ok)
+                return result;
+            this.pendingDeviceJoin = undefined;
+            this.activeDeviceJoinSessionId = undefined;
+            return { ok: true, value: { completed: true } };
+        }
+        /** Reliable-sync and project only Host-opaque device/request references. */
+        refreshDeviceManagement() {
+            return this.run(client => this.deviceManagementSnapshot(client));
+        }
+        async startDeviceJoinVerification(request) {
+            const joinSessionId = this.requestSessions.get(request?.requestRef);
+            if (joinSessionId === undefined)
+                return { ok: false, error: failure('invalid-request') };
+            const result = await this.run(async (client) => {
+                await this.requireDeviceManager(client);
+                await client.syncDeviceManagement();
+                let notice = (await client.listLocalDeviceJoinRequests())
+                    .find(value => value.joinSessionId === joinSessionId);
+                if (notice === undefined) {
+                    throw Object.assign(new Error('request not found'), { name: 'AwikiSdkError', code: 'not-found' });
+                }
+                const localProgress = await this.localAdminJoinProgress(client, notice);
+                if (localProgress !== undefined)
+                    return localProgress;
+                if (!notice.canStartVerification) {
+                    throw Object.assign(new Error('request unavailable'), { name: 'AwikiSdkError', code: 'forbidden' });
+                }
+                const operationId = `dsh-device-verify-${createHash('sha256').update(joinSessionId).digest('hex').slice(0, 32)}`;
+                let started;
+                try {
+                    started = await client.startDeviceJoinVerification({
+                        joinSessionId,
+                        operationId,
+                        challengeTtlSeconds: DEVICE_JOIN_CHALLENGE_TTL_SECONDS,
+                    });
+                }
+                catch (error) {
+                    await client.syncDeviceManagement();
+                    notice = (await client.listLocalDeviceJoinRequests())
+                        .find(value => value.joinSessionId === joinSessionId);
+                    const recovered = notice === undefined ? undefined : await this.localAdminJoinProgress(client, notice);
+                    if (recovered !== undefined)
+                        return recovered;
+                    throw error;
+                }
+                await client.syncDeviceManagement();
+                notice = (await client.listLocalDeviceJoinRequests())
+                    .find(value => value.joinSessionId === joinSessionId);
+                if (notice === undefined)
+                    return started;
+                return (await this.localAdminJoinProgress(client, notice)) ?? started;
+            });
+            return result.ok ? this.publicAdminJoinProgress(request.requestRef, result.value) : result;
+        }
+        async approveDeviceJoin(request) {
+            if (request?.confirmation !== DEVICE_JOIN_APPROVAL_CONFIRMATION) {
+                return { ok: false, error: failure('invalid-request') };
+            }
+            const joinSessionId = this.requestSessions.get(request.requestRef);
+            if (joinSessionId === undefined || !/^\d{6}$/u.test(request.enteredSas)) {
+                return { ok: false, error: failure('invalid-request') };
+            }
+            const result = await this.run(async (client) => {
+                await this.requireDeviceManager(client);
+                const progress = await client.getLocalDeviceJoinVerificationProgress(joinSessionId);
+                if (progress.sas === undefined || !constantTimeSasMatches(progress.sas, request.enteredSas)) {
+                    throw Object.assign(new Error('sas mismatch'), { name: 'AwikiSdkError', code: 'forbidden' });
+                }
+                const prompt = await client.prepareDeviceJoinApproval(joinSessionId);
+                return client.confirmDeviceJoinApproval(prompt.approvalHandle);
+            });
+            return result.ok ? this.publicAdminJoinProgress(request.requestRef, result.value) : result;
+        }
+        async rejectDeviceJoin(request) {
+            const joinSessionId = this.requestSessions.get(request?.requestRef);
+            if (joinSessionId === undefined
+                || (request.reason !== 'user_rejected' && request.reason !== 'sas_mismatch')) {
+                return { ok: false, error: failure('invalid-request') };
+            }
+            const result = await this.run(async (client) => {
+                await this.requireDeviceManager(client);
+                return client.rejectDeviceJoin(joinSessionId, request.reason);
+            });
+            return result.ok ? this.publicAdminJoinProgress(request.requestRef, result.value) : result;
+        }
+        async revokeDevice(request) {
+            if (request?.confirmation !== DEVICE_REVOKE_CONFIRMATION) {
+                return { ok: false, error: failure('invalid-request') };
+            }
+            const deviceId = this.deviceIds.get(request.deviceRef);
+            if (deviceId === undefined)
+                return { ok: false, error: failure('invalid-request') };
+            return this.run(async (client) => {
+                await this.requireDeviceManager(client);
+                const devices = await client.getDeviceRegistry();
+                const target = devices.find(device => device.deviceId === deviceId);
+                if (target === undefined || target.isCurrent) {
+                    throw Object.assign(new Error('device unavailable'), { name: 'AwikiSdkError', code: 'forbidden' });
+                }
+                await client.revokeDevice(deviceId);
+                return this.deviceManagementSnapshot(client);
+            });
         }
         /**
          * Update the deployment identity's public WNS display name.
@@ -1136,10 +1465,16 @@ let AwikiService = (() => {
         }
         /** Start durable phone recovery for one existing full Handle. */
         sendRecoveryOtp(request) {
+            this.pendingDeviceJoin = undefined;
             const normalized = normalizeRecoveryOtpRequest(request);
             if (normalized === undefined)
                 return Promise.resolve({ ok: false, error: failure('invalid-request') });
-            return this.run(client => client.sendRecoveryOtp(normalized), { allowSignedOut: true });
+            return this.run(async (client) => {
+                if (await this.selectDeviceJoinSession(client) !== null) {
+                    throw Object.assign(new Error('join already exists'), { name: 'AwikiSdkError', code: 'conflict' });
+                }
+                return client.sendRecoveryOtp(normalized);
+            }, { allowSignedOut: true });
         }
         /** Verify a recovery OTP and freeze its exact intent before the remote commit. */
         prepareRecovery(request) {
@@ -1586,11 +1921,11 @@ let AwikiService = (() => {
             return this.mutateSession(async () => {
                 const provider = this.provider;
                 if (provider !== undefined)
-                    await this.stopListener(provider);
+                    await this.stopProviderRuntime(provider);
                 const result = await this.run(client => client.clearLocalData(), { allowSignedOut: true });
                 if (!result.ok) {
                     if (provider !== undefined && this.provider === provider)
-                        void this.startListener(provider);
+                        this.ensureProviderRuntime(provider);
                     return result;
                 }
                 try {
@@ -1600,10 +1935,10 @@ let AwikiService = (() => {
                     await this.sessionStore.signIn();
                     this.signedOut = false;
                     this.activeIdentityDid = undefined;
+                    this.pendingDeviceJoin = undefined;
+                    this.activeDeviceJoinSessionId = undefined;
                     this.invalidateSummaries();
                     this.publishSession({ status: 'unregistered' });
-                    if (provider !== undefined && this.provider === provider)
-                        void this.startListener(provider);
                     return result;
                 }
                 catch {
@@ -1636,8 +1971,7 @@ let AwikiService = (() => {
                     if (!alreadyActive) {
                         const session = { status: 'active', identity };
                         this.publishSession(session);
-                        await provider.listenerStartup;
-                        await this.startListener(provider);
+                        this.ensureProviderRuntime(provider);
                     }
                     return reconciled;
                 }
@@ -1678,19 +2012,164 @@ let AwikiService = (() => {
                 return false;
             }
         }
-        /** Publish one newly registered identity and start its listener through the existing session path. */
+        /** Select the only resumable new-device session; Core local_sessions is the sole restart SoT. */
+        async selectDeviceJoinSession(client) {
+            const sessions = await client.listLocalDeviceJoinSessions();
+            if (this.activeDeviceJoinSessionId !== undefined) {
+                const tracked = sessions.find(value => (value.side === 'new_device' && value.joinSessionId === this.activeDeviceJoinSessionId));
+                if (tracked !== undefined)
+                    return tracked.joinSessionId;
+                this.activeDeviceJoinSessionId = undefined;
+            }
+            const resumable = sessions.filter(value => (value.side === 'new_device' && RESUMABLE_JOIN_PHASES.has(value.localPhase)));
+            if (resumable.length > 1) {
+                throw Object.assign(new Error('multiple local joins'), { name: 'AwikiSdkError', code: 'conflict' });
+            }
+            const selected = resumable[0];
+            this.activeDeviceJoinSessionId = selected?.joinSessionId;
+            return selected?.joinSessionId ?? null;
+        }
+        async applyCandidateJoinProgress(value) {
+            const phase = candidateJoinPhase(value);
+            if (phase === undefined)
+                return { ok: false, error: failure('remote') };
+            if (phase === 'cancelled' || phase === 'rejected' || phase === 'expired') {
+                this.activeDeviceJoinSessionId = undefined;
+            }
+            if (phase === 'authorized') {
+                if (value.identity === undefined)
+                    return { ok: false, error: failure('remote') };
+                await this.activateRegisteredIdentity(value.identity);
+            }
+            return {
+                ok: true,
+                value: {
+                    phase,
+                    expiresAt: value.expiresAt,
+                    ...(phase === 'sas-ready' && value.sas !== undefined ? { sas: value.sas } : {}),
+                    completed: phase === 'authorized',
+                },
+            };
+        }
+        publicAdminJoinProgress(requestRef, value) {
+            const phase = adminJoinPhase(value);
+            if (phase === undefined)
+                return { ok: false, error: failure('remote') };
+            return {
+                ok: true,
+                value: {
+                    requestRef,
+                    phase,
+                    expiresAt: value.expiresAt,
+                    ...(phase === 'sas-ready' && value.sas !== undefined ? { sas: value.sas } : {}),
+                },
+            };
+        }
+        async localAdminJoinProgress(client, notice) {
+            const local = (await client.listLocalDeviceJoinSessions())
+                .find(session => session.side === 'admin' && session.joinSessionId === notice.joinSessionId);
+            if (local === undefined) {
+                return notice.claimedByCurrentDevice
+                    ? client.getLocalDeviceJoinVerificationProgress(notice.joinSessionId)
+                    : undefined;
+            }
+            if (local.localPhase === 'challenge_prepared') {
+                return {
+                    joinSessionId: notice.joinSessionId,
+                    localPhase: local.localPhase,
+                    remoteState: notice.state,
+                    expiresAt: local.expiresAt,
+                };
+            }
+            return client.getLocalDeviceJoinVerificationProgress(notice.joinSessionId);
+        }
+        async requireDeviceManager(client) {
+            const current = await client.getCurrentDeviceSummary();
+            if (!current.canManage || current.role !== 'admin' || current.readiness !== 'admin_ready') {
+                throw Object.assign(new Error('device manager required'), { name: 'AwikiSdkError', code: 'forbidden' });
+            }
+        }
+        requestRef(joinSessionId) {
+            const existing = this.requestRefs.get(joinSessionId);
+            if (existing !== undefined)
+                return existing;
+            const reference = `join-${randomUUID()}`;
+            this.requestRefs.set(joinSessionId, reference);
+            this.requestSessions.set(reference, joinSessionId);
+            return reference;
+        }
+        deviceRef(deviceId) {
+            const existing = this.deviceRefs.get(deviceId);
+            if (existing !== undefined)
+                return existing;
+            const reference = `device-${randomUUID()}`;
+            this.deviceRefs.set(deviceId, reference);
+            this.deviceIds.set(reference, deviceId);
+            return reference;
+        }
+        async deviceManagementSnapshot(client) {
+            await client.syncDeviceManagement();
+            const current = await client.getCurrentDeviceSummary();
+            if (!current.canManage || current.role !== 'admin' || current.readiness !== 'admin_ready') {
+                this.requestRefs.clear();
+                this.requestSessions.clear();
+                this.deviceRefs.clear();
+                this.deviceIds.clear();
+                return {
+                    canManage: false,
+                    ...current.role === undefined ? {} : { role: current.role },
+                    readiness: current.readiness,
+                    devices: [],
+                    requests: [],
+                };
+            }
+            const requests = await client.listLocalDeviceJoinRequests();
+            await Promise.all(requests
+                .filter(request => request.claimedByCurrentDevice)
+                .map(request => client.getLocalDeviceJoinVerificationProgress(request.joinSessionId).catch(() => undefined)));
+            const devices = await client.getDeviceRegistry();
+            return {
+                canManage: true,
+                role: 'admin',
+                readiness: 'admin_ready',
+                devices: devices.map(device => this.publicDevice(device)),
+                requests: requests.map(request => ({
+                    requestRef: this.requestRef(request.joinSessionId),
+                    candidateKeyFingerprint: request.candidateKeyFingerprint,
+                    issuedAt: request.issuedAt,
+                    expiresAt: request.expiresAt,
+                    state: requestJoinPhase(request),
+                    claimedByCurrentDevice: request.claimedByCurrentDevice,
+                    canStartVerification: request.canStartVerification,
+                })),
+            };
+        }
+        publicDevice(device) {
+            return {
+                deviceRef: this.deviceRef(device.deviceId),
+                status: device.status,
+                role: device.role,
+                managementReady: device.managementReady,
+                isCurrent: device.isCurrent,
+            };
+        }
+        /** Publish one newly registered identity, then start realtime only in the background. */
         async activateRegisteredIdentity(identity) {
+            this.pendingDeviceJoin = undefined;
+            this.activeDeviceJoinSessionId = undefined;
             this.activeIdentityDid = identity.did;
             this.publishSession({ status: 'active', identity });
             const provider = this.provider;
-            if (provider !== undefined) {
-                await provider.listenerStartup;
-                await this.startListener(provider);
-            }
+            if (provider !== undefined)
+                this.ensureProviderRuntime(provider);
         }
         /** Invalidate cached session work and cancel every model request still owned by the old session. */
         invalidateSummaries() {
             this.sessionRevision += 1;
+            this.requestRefs.clear();
+            this.requestSessions.clear();
+            this.deviceRefs.clear();
+            this.deviceIds.clear();
             for (const controller of this.activeSummaryRequests)
                 controller.abort();
             this.activeSummaryRequests.clear();
@@ -1792,158 +2271,194 @@ let AwikiService = (() => {
             this.sessionMutation = pending.then(() => undefined, () => undefined);
             return pending;
         }
-        /** Start one exact identity-bound listener, atomically releasing a failed startup. */
-        startListener(provider) {
-            if (!this.resolved.listenerEnabled
-                || provider.listener !== undefined
-                || provider.listenerRecoveryBlocked
-                || this.provider !== provider) {
-                return Promise.resolve();
-            }
-            if (provider.listenerStartup !== undefined)
-                return provider.listenerStartup;
-            if (provider.listenerCleanup !== undefined || provider.listenerRestartTimer !== undefined)
-                return Promise.resolve();
-            const workspaceContext = this.workspaceContext;
-            const source = provider.client.listener;
-            if (workspaceContext === undefined || source === undefined)
-                return Promise.resolve();
-            const generation = provider.listenerGeneration;
-            const logger = this.ctx.logger('awiki-listener');
+        /** Start identity realtime and the optional Agent consumer without blocking identity success. */
+        ensureProviderRuntime(provider) {
+            const identityDid = this.activeIdentityDid;
+            if (provider.runtimeReplacement !== undefined)
+                return;
+            if (identityDid !== undefined
+                && provider.realtimeIdentityDid !== undefined
+                && provider.realtimeIdentityDid !== identityDid) {
+                this.replaceProviderRuntime(provider, identityDid);
+                return;
+            }
+            this.ensureRealtimeSupervisor(provider);
+            this.ensureAgentConsumer(provider);
+        }
+        replaceProviderRuntime(provider, identityDid) {
+            if (provider.runtimeReplacement !== undefined || this.provider !== provider)
+                return;
+            const replacement = (async () => {
+                await this.stopProviderRuntime(provider);
+                if (this.provider !== provider || this.activeIdentityDid !== identityDid)
+                    return;
+                this.ensureRealtimeSupervisor(provider);
+                this.ensureAgentConsumer(provider);
+            })();
+            const observed = replacement
+                .catch((error) => {
+                this.ctx.logger('awiki-realtime').warn('AWiki identity realtime replacement failed: %s', error instanceof Error ? error.message : 'unknown failure');
+            })
+                .finally(() => {
+                if (provider.runtimeReplacement === observed)
+                    delete provider.runtimeReplacement;
+                if (this.provider === provider)
+                    this.ensureProviderRuntime(provider);
+            });
+            provider.runtimeReplacement = observed;
+        }
+        ensureRealtimeSupervisor(provider) {
+            if (!this.resolved.realtimeEnabled
+                || provider.realtimeSupervisor !== undefined
+                || provider.realtimeStartup !== undefined
+                || this.provider !== provider
+                || (provider.client.realtime ?? provider.client.listener) === undefined)
+                return;
+            const generation = provider.realtimeGeneration;
+            const source = provider.client.realtime ?? provider.client.listener;
+            if (source === undefined)
+                return;
+            const logger = this.ctx.logger('awiki-realtime');
             const startup = (async () => {
                 if (await this.isSignedOut())
                     return;
-                if (await provider.client.getIdentity() === null)
+                const identity = await provider.client.getIdentity();
+                if (identity === null || !this.realtimeFenceMatches(provider, generation))
                     return;
-                if (!this.listenerFenceMatches(provider, workspaceContext, generation))
-                    return;
-                const agents = new DshAwikiListenerAgentRuntime(workspaceContext, this.resolved.listener.workspacePath);
-                const listener = new AwikiAgentListener(source, agents, this.resolved.listener, logger);
-                provider.listener = listener;
+                this.activeIdentityDid = identity.did;
+                const supervisor = new IdentityRealtimeSupervisor(source, {
+                    onSynchronized: cause => this.onRealtimeSynchronized(provider, generation, cause),
+                }, logger);
+                provider.realtimeSupervisor = supervisor;
+                provider.realtimeIdentityDid = identity.did;
+                supervisor.start();
+                this.ensureAgentConsumer(provider);
+            })();
+            const observed = startup
+                .catch((error) => {
+                logger.warn('AWiki realtime startup failed: %s', error instanceof Error ? error.message : 'unknown failure');
+            })
+                .finally(() => {
+                if (provider.realtimeStartup === observed)
+                    delete provider.realtimeStartup;
+            });
+            provider.realtimeStartup = observed;
+        }
+        realtimeFenceMatches(provider, generation) {
+            return this.provider === provider && provider.realtimeGeneration === generation;
+        }
+        async onRealtimeSynchronized(provider, generation, cause) {
+            if (!this.realtimeFenceMatches(provider, generation))
+                return;
+            if (cause === 'system_notification' || cause === 'stream_recovery') {
                 try {
-                    await listener.start();
+                    provider.localDeviceJoinRequestCountAfterSync = (await provider.client.listLocalDeviceJoinRequests()).length;
                 }
-                catch (error) {
-                    if (provider.listener === listener)
-                        delete provider.listener;
-                    try {
-                        await listener.dispose();
-                    }
-                    catch {
-                        provider.listenerRecoveryBlocked = true;
-                    }
-                    if (!provider.listenerRecoveryBlocked && provider.listenerRestartAttempt > 0) {
-                        this.scheduleListenerRestart(provider, workspaceContext, generation);
-                    }
-                    throw error;
+                catch {
+                    this.ctx.logger('awiki-realtime').debug('AWiki realtime could not observe local device Join requests');
                 }
-                if (!this.listenerFenceMatches(provider, workspaceContext, generation)) {
-                    if (provider.listener === listener)
-                        delete provider.listener;
-                    try {
-                        await listener.dispose();
-                    }
-                    catch (error) {
-                        provider.listenerRecoveryBlocked = true;
-                        throw error;
-                    }
+            }
+            if (!['session_start', 'connection_ready', 'reconnected', 'message', 'message_update'].includes(cause))
+                return;
+            this.ensureAgentConsumer(provider);
+            await provider.agentConsumerStartup;
+            if (!this.realtimeFenceMatches(provider, generation))
+                return;
+            await provider.agentConsumer?.reconcileOnce();
+        }
+        ensureAgentConsumer(provider) {
+            const workspaceContext = this.workspaceContext;
+            const source = provider.client.agentInbox ?? provider.client.listener;
+            const identityDid = this.activeIdentityDid;
+            if (!this.resolved.listenerEnabled
+                || workspaceContext === undefined
+                || source === undefined
+                || identityDid === undefined
+                || this.provider !== provider)
+                return;
+            if (provider.agentConsumer !== undefined && provider.agentConsumerIdentityDid === identityDid)
+                return;
+            if (provider.agentConsumerStartup !== undefined)
+                return;
+            const generation = ++provider.agentConsumerGeneration;
+            const logger = this.ctx.logger('awiki-listener');
+            const startup = (async () => {
+                await this.detachAgentConsumer(provider);
+                if (!this.agentConsumerFenceMatches(provider, workspaceContext, identityDid, generation))
                     return;
-                }
-                provider.listenerStartedAt = Date.now();
-                void listener.whenTerminated().then((result) => {
-                    if (result.kind === 'failed') {
-                        this.releaseFailedListener(provider, listener, workspaceContext, generation, result.error);
-                    }
-                });
+                const agents = new DshAwikiListenerAgentRuntime(workspaceContext, this.resolved.listener.workspacePath);
+                const consumer = new AwikiAgentListener(source, agents, {
+                    ...this.resolved.listener,
+                    identityScope: identityDid,
+                }, logger);
+                provider.agentConsumer = consumer;
+                provider.agentConsumerIdentityDid = identityDid;
+                await consumer.reconcileOnce();
             })();
             const observed = startup
                 .catch((error) => {
-                logger.warn('AWiki listener startup failed: %s', error instanceof Error ? error.message : 'unknown failure');
+                logger.warn('AWiki Agent consumer startup failed: %s', error instanceof Error ? error.message : 'unknown failure');
             })
                 .finally(() => {
-                if (provider.listenerStartup === observed)
-                    delete provider.listenerStartup;
+                if (provider.agentConsumerStartup === observed)
+                    delete provider.agentConsumerStartup;
             });
-            provider.listenerStartup = observed;
-            return observed;
-        }
-        async stopListener(provider) {
-            provider.listenerGeneration += 1;
-            provider.listenerRestartAttempt = 0;
-            delete provider.listenerStartedAt;
-            const timer = provider.listenerRestartTimer;
-            if (timer !== undefined) {
-                delete provider.listenerRestartTimer;
-                clearTimeout(timer);
-            }
-            await provider.listenerStartup;
-            await provider.listenerCleanup;
-            const listener = provider.listener;
-            if (listener === undefined)
-                return;
-            delete provider.listener;
-            try {
-                await listener.dispose();
-            }
-            catch (error) {
-                provider.listenerRecoveryBlocked = true;
-                throw error;
-            }
+            provider.agentConsumerStartup = observed;
         }
-        listenerFenceMatches(provider, workspaceContext, generation) {
+        agentConsumerFenceMatches(provider, workspaceContext, identityDid, generation) {
             return this.provider === provider
                 && this.workspaceContext === workspaceContext
-                && provider.listenerGeneration === generation;
+                && this.activeIdentityDid === identityDid
+                && provider.agentConsumerGeneration === generation;
         }
-        releaseFailedListener(provider, listener, workspaceContext, generation, error) {
-            if (provider.listener !== listener)
+        async detachAgentConsumer(provider) {
+            const consumer = provider.agentConsumer;
+            if (consumer === undefined)
                 return;
-            delete provider.listener;
-            const startedAt = provider.listenerStartedAt;
-            delete provider.listenerStartedAt;
-            if (startedAt !== undefined && Date.now() - startedAt >= LISTENER_STABLE_RESET_MS) {
-                provider.listenerRestartAttempt = 0;
-            }
-            const logger = this.ctx.logger('awiki-listener');
-            logger.warn('AWiki listener lifecycle failed: %s', error instanceof Error ? error.message : 'unknown failure');
-            let disposed = false;
-            const cleanup = listener.dispose()
-                .then(() => { disposed = true; }, (cleanupError) => {
-                provider.listenerRecoveryBlocked = true;
-                logger.warn('AWiki listener cleanup failed: %s', cleanupError instanceof Error ? cleanupError.message : 'unknown failure');
-            });
+            delete provider.agentConsumer;
+            delete provider.agentConsumerIdentityDid;
+            const cleanup = consumer.dispose();
             const observed = cleanup.finally(() => {
-                if (provider.listenerCleanup === observed)
-                    delete provider.listenerCleanup;
-                if (disposed)
-                    this.scheduleListenerRestart(provider, workspaceContext, generation);
+                if (provider.agentConsumerCleanup === observed)
+                    delete provider.agentConsumerCleanup;
             });
-            provider.listenerCleanup = observed;
-        }
-        scheduleListenerRestart(provider, workspaceContext, generation) {
-            if (provider.listenerRestartTimer !== undefined
-                || !this.listenerFenceMatches(provider, workspaceContext, generation))
+            provider.agentConsumerCleanup = observed;
+            await observed;
+        }
+        async stopAgentConsumer(provider) {
+            provider.agentConsumerGeneration += 1;
+            await provider.agentConsumerStartup;
+            await provider.agentConsumerCleanup;
+            await this.detachAgentConsumer(provider);
+        }
+        async stopRealtimeSupervisor(provider) {
+            provider.realtimeGeneration += 1;
+            await provider.realtimeStartup;
+            const supervisor = provider.realtimeSupervisor;
+            if (supervisor === undefined)
                 return;
-            provider.listenerRestartAttempt = Math.min(provider.listenerRestartAttempt + 1, LISTENER_RESTART_MAX_ATTEMPT);
-            const exponent = provider.listenerRestartAttempt - 1;
-            const delay = Math.min(LISTENER_RESTART_BASE_DELAY_MS * 2 ** exponent, LISTENER_RESTART_MAX_DELAY_MS);
-            const timer = setTimeout(() => {
-                if (provider.listenerRestartTimer !== timer)
-                    return;
-                delete provider.listenerRestartTimer;
-                if (!this.listenerFenceMatches(provider, workspaceContext, generation))
-                    return;
-                void this.startListener(provider);
-            }, delay);
-            provider.listenerRestartTimer = timer;
+            delete provider.realtimeSupervisor;
+            delete provider.realtimeIdentityDid;
+            await supervisor.dispose();
+        }
+        async stopProviderRuntime(provider) {
+            await Promise.all([
+                this.stopRealtimeSupervisor(provider),
+                this.stopAgentConsumer(provider),
+            ]);
         }
         /** Clear one exact provider slot before joining its one shared disposal. */
         disposeProvider(provider) {
-            if (this.provider === provider)
+            if (this.provider === provider) {
                 this.provider = undefined;
+                this.pendingDeviceJoin = undefined;
+                this.activeDeviceJoinSessionId = undefined;
+                this.invalidateSummaries();
+            }
             provider.disposal ??= (async () => {
                 try {
-                    await this.stopListener(provider);
+                    await provider.runtimeReplacement;
+                    await this.stopProviderRuntime(provider);
                 }
                 finally {
                     await provider.client.dispose();