@awiki/dsh-plugin 0.3.7-dsh-test.20260831.2 → 0.3.10

package/lib/index.js

@@ -1,16 +1,107 @@
-import { n as downloadedAttachment } from "./sdk-adapter-FGaOi8It.mjs";
+import { a as fencedMailRecoveryObservability, i as failedMailRecoveryObservability, o as successfulMailRecoveryObservability, r as downloadedAttachment, t as AwikiSdkError } from "./sdk-adapter-CYcJH7sM.mjs";
 import "@deepseek-ai/cordis";
 import { createHash, randomUUID, timingSafeEqual } from "node:crypto";
 import { homedir } from "node:os";
-import { isAbsolute, join } from "node:path";
+import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import z from "@deepseek-ai/schemastery";
 import { Remote, TypertRemoteService } from "@deepseek-ai/dsh-typert-protocol";
 import { SettingsConflictError, settingsNamespace } from "@deepseek-ai/dsh-settings";
-import { defineTool } from "@deepseek-ai/dsh-tools";
 import { chmod, lstat, mkdir, readFile, readdir, rename, rm, unlink, utimes, writeFile } from "node:fs/promises";
+import { defineTool } from "@deepseek-ai/dsh-tools";
 import { installModelSelection } from "@deepseek-ai/dsh-agent";
 import { createUserMessage } from "@deepseek-ai/dsh-llm";
 import { SessionId } from "@deepseek-ai/dsh-session";
+import { fileURLToPath } from "node:url";
+import { copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { satisfies } from "semver";
+//#region lib/types/version.js
+/** Shared strict version comparison for update presentation and Host gates. */
+function assertVersion(value) {
+	if (value.length > 256 || !/^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-(?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*)(?:\.(?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*))*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/u.test(value)) throw new Error("invalid semantic version");
+}
+function compareVersions(left, right) {
+	assertVersion(left);
+	assertVersion(right);
+	const parse = (value) => {
+		const withoutBuild = value.split("+", 1)[0];
+		const separator = withoutBuild.indexOf("-");
+		const core = (separator < 0 ? withoutBuild : withoutBuild.slice(0, separator)).split(".").map(BigInt);
+		return separator < 0 ? { core } : {
+			core,
+			prerelease: withoutBuild.slice(separator + 1).split(".")
+		};
+	};
+	const a = parse(left);
+	const b = parse(right);
+	for (let index = 0; index < 3; index += 1) {
+		const difference = a.core[index] - b.core[index];
+		if (difference !== 0n) return difference < 0n ? -1 : 1;
+	}
+	if (a.prerelease === void 0 || b.prerelease === void 0) return a.prerelease === b.prerelease ? 0 : a.prerelease === void 0 ? 1 : -1;
+	for (let index = 0; index < Math.min(a.prerelease.length, b.prerelease.length); index += 1) {
+		const leftPart = a.prerelease[index];
+		const rightPart = b.prerelease[index];
+		if (leftPart === rightPart) continue;
+		const leftNumeric = /^\d+$/u.test(leftPart);
+		if (leftNumeric !== /^\d+$/u.test(rightPart)) return leftNumeric ? -1 : 1;
+		if (leftNumeric) return BigInt(leftPart) < BigInt(rightPart) ? -1 : 1;
+		return leftPart < rightPart ? -1 : 1;
+	}
+	if (a.prerelease.length !== b.prerelease.length) return a.prerelease.length < b.prerelease.length ? -1 : 1;
+	return 0;
+}
+//#endregion
+//#region lib/types/desktop-distribution.js
+function decodeDesktopDistribution(value) {
+	if (typeof value !== "object" || value === null) return void 0;
+	const view = value;
+	if (view.schemaVersion !== 1 || view.distributionId !== "awiki-dsh-desktop" || typeof view.currentVersion !== "string" || view.channel !== "stable" && view.channel !== "prerelease" || typeof view.downloadPageUrl !== "string" || ![
+		"unchecked",
+		"checking",
+		"ready",
+		"failed"
+	].includes(String(view.state)) || typeof view.updateAvailable !== "boolean" || typeof view.usedCache !== "boolean" || view.latestVersion !== void 0 && typeof view.latestVersion !== "string" || view.checkedAt !== void 0 && typeof view.checkedAt !== "string" || view.noRelease !== void 0 && typeof view.noRelease !== "boolean") return void 0;
+	try {
+		assertVersion(view.currentVersion);
+		if (view.latestVersion !== void 0) assertVersion(view.latestVersion);
+		if (view.checkedAt !== void 0 && !Number.isFinite(Date.parse(view.checkedAt))) return void 0;
+		const url = new URL(view.downloadPageUrl);
+		if (url.protocol !== "https:" || url.username !== "" || url.password !== "") return void 0;
+	} catch {
+		return;
+	}
+	let bundledVersions;
+	if (view.bundledVersions !== void 0) {
+		if (typeof view.bundledVersions !== "object" || view.bundledVersions === null) return void 0;
+		const bundled = view.bundledVersions;
+		if (typeof bundled.plugin !== "string" || bundled.modelProxy !== void 0 && typeof bundled.modelProxy !== "string") return void 0;
+		try {
+			assertVersion(bundled.plugin);
+			if (bundled.modelProxy !== void 0) assertVersion(bundled.modelProxy);
+		} catch {
+			return;
+		}
+		bundledVersions = {
+			plugin: bundled.plugin,
+			...typeof bundled.modelProxy === "string" ? { modelProxy: bundled.modelProxy } : {}
+		};
+	}
+	return {
+		schemaVersion: 1,
+		distributionId: "awiki-dsh-desktop",
+		currentVersion: view.currentVersion,
+		channel: view.channel,
+		downloadPageUrl: view.downloadPageUrl,
+		state: view.state,
+		updateAvailable: view.updateAvailable,
+		usedCache: view.usedCache,
+		...typeof view.latestVersion === "string" ? { latestVersion: view.latestVersion } : {},
+		...typeof view.checkedAt === "string" ? { checkedAt: view.checkedAt } : {},
+		...typeof view.noRelease === "boolean" ? { noRelease: view.noRelease } : {},
+		...bundledVersions === void 0 ? {} : { bundledVersions }
+	};
+}
+//#endregion
 //#region lib/types/types.js
 /** Client-safe AWiki service and Remote data types. */
 /** Exact browser acknowledgement required before locally signing out. */
@@ -190,6 +281,511 @@ function responseMetadata(response) {
 	};
 }
 //#endregion
+//#region lib/types/integration-client.js
+/** Host-only fixed-scope client for Guest Integration management. */
+const MAX_REQUEST_BYTES = 65536;
+const MAX_RESPONSE_BYTES$1 = 1048576;
+const REQUEST_TIMEOUT_MS = 1e4;
+const INTEGRATION_STATUSES = ["active", "closed"];
+const TARGET_AVAILABILITIES = [
+	"eligible",
+	"group_not_found",
+	"owner_not_active",
+	"owner_mismatch",
+	"not_open_join",
+	"unsupported_security_profile",
+	"member_send_disabled",
+	"attachments_disabled",
+	"group_full",
+	"validation_unavailable"
+];
+const OPERATIONS = {
+	read: {
+		method: "GET",
+		path: "/guest/api/v1/management/integration"
+	},
+	create: {
+		method: "POST",
+		path: "/guest/api/v1/management/integration"
+	},
+	update: {
+		method: "PATCH",
+		path: "/guest/api/v1/management/integration"
+	},
+	rotate: {
+		method: "POST",
+		path: "/guest/api/v1/management/integration/rotate-id"
+	},
+	close: {
+		method: "POST",
+		path: "/guest/api/v1/management/integration/close"
+	},
+	reopen: {
+		method: "POST",
+		path: "/guest/api/v1/management/integration/reopen"
+	}
+};
+/** Browser-safe management input translated to the Gateway's snake-case contract. */
+function fields(request) {
+	return {
+		product_name: request.productName,
+		description: request.description,
+		contact_enabled: request.contactEnabled,
+		contact_description: request.contactDescription,
+		group_targets: request.groupTargets.map((target) => ({
+			...target.id === void 0 ? {} : { id: target.id },
+			group_did: target.groupDid,
+			description: target.description
+		}))
+	};
+}
+function view$1(raw) {
+	if (typeof raw !== "object" || raw === null) throw new TypeError("invalid Integration response");
+	const value = raw;
+	const owner = value.owner;
+	const groups = value.group_targets;
+	if (typeof owner !== "object" || owner === null || !Array.isArray(groups)) throw new TypeError("invalid Integration response");
+	return {
+		id: requiredString$1(value.id),
+		publicId: nullableString(value.public_id),
+		integrationUrl: nullableString(value.integration_url),
+		owner: {
+			tenantId: requiredString$1(owner.tenant_id),
+			handle: requiredString$1(owner.handle),
+			currentDid: requiredString$1(owner.current_did),
+			displayName: requiredString$1(owner.display_name)
+		},
+		productName: requiredString$1(value.product_name),
+		description: requiredString$1(value.description),
+		contactEnabled: requiredBoolean(value.contact_enabled),
+		contactDescription: requiredString$1(value.contact_description),
+		groupTargets: groups.map((group) => {
+			if (typeof group !== "object" || group === null) throw new TypeError("invalid Integration group");
+			const target = group;
+			return {
+				id: requiredString$1(target.id),
+				groupDid: requiredString$1(target.group_did),
+				displayName: requiredString$1(target.display_name),
+				avatarUrl: nullableString(target.avatar_url),
+				description: requiredString$1(target.description),
+				availability: requiredEnum(target.availability, TARGET_AVAILABILITIES)
+			};
+		}),
+		status: requiredEnum(value.status, INTEGRATION_STATUSES),
+		revision: requiredInteger(value.revision)
+	};
+}
+function requiredString$1(value) {
+	if (typeof value !== "string") throw new TypeError("invalid Integration response");
+	return value;
+}
+function nullableString(value) {
+	if (value === null) return null;
+	return requiredString$1(value);
+}
+function requiredBoolean(value) {
+	if (typeof value !== "boolean") throw new TypeError("invalid Integration response");
+	return value;
+}
+function requiredInteger(value) {
+	if (!Number.isSafeInteger(value)) throw new TypeError("invalid Integration response");
+	return value;
+}
+function requiredEnum(value, allowed) {
+	if (typeof value !== "string" || !allowed.includes(value)) throw new TypeError("invalid Integration response");
+	return value;
+}
+function failure$1(status, raw) {
+	const body = typeof raw === "object" && raw !== null ? raw : {};
+	const nested = typeof body.error === "object" && body.error !== null ? body.error : body;
+	const candidate = typeof nested.code === "string" ? nested.code : "";
+	const code = status === 404 ? "not-found" : status === 409 ? "conflict" : status === 400 ? "invalid-request" : status === 401 ? "unauthorized" : status === 403 ? "forbidden" : status === 429 ? "rate-limited" : status >= 500 ? "unavailable" : [
+		"not-found",
+		"conflict",
+		"invalid-request",
+		"forbidden",
+		"unauthorized",
+		"rate-limited",
+		"unavailable"
+	].includes(candidate) ? candidate : "remote";
+	return {
+		code,
+		message: integrationFailureMessage(code)
+	};
+}
+function integrationFailureMessage(code) {
+	switch (code) {
+		case "not-found": return "尚未创建 Integration。";
+		case "conflict": return "Integration 已在其他位置更新，请重新加载后再试。";
+		case "invalid-request": return "Integration 信息不完整或格式不正确。";
+		case "forbidden": return "当前 AWiki 身份无权管理这个 Integration。";
+		case "unauthorized": return "请先在 AWiki 正式版中登录。";
+		case "rate-limited": return "操作过于频繁，请稍后重试。";
+		case "unavailable": return "临时消息服务暂时不可用。";
+		case "network": return "无法连接临时消息服务。";
+		default: return "临时消息服务返回了无法识别的结果。";
+	}
+}
+async function readBounded$1(response) {
+	const reader = response.body?.getReader();
+	if (reader === void 0) return null;
+	const chunks = [];
+	let size = 0;
+	try {
+		while (true) {
+			const result = await reader.read();
+			if (result.done) break;
+			size += result.value.byteLength;
+			if (size > MAX_RESPONSE_BYTES$1) throw new TypeError("Integration response too large");
+			chunks.push(result.value);
+		}
+	} finally {
+		reader.releaseLock();
+	}
+	const bytes = new Uint8Array(size);
+	let offset = 0;
+	for (const chunk of chunks) {
+		bytes.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	if (bytes.length === 0) return null;
+	return JSON.parse(new TextDecoder().decode(bytes));
+}
+/** Fixed-origin client; callers cannot control path, method, headers, or transport. */
+var AwikiIntegrationClient = class {
+	origin;
+	auth;
+	constructor(origin, auth) {
+		this.origin = origin;
+		this.auth = auth;
+	}
+	read() {
+		return this.execute("read");
+	}
+	create(request) {
+		return this.execute("create", fields(request), request.idempotencyKey);
+	}
+	update(request) {
+		return this.execute("update", {
+			expected_revision: request.expectedRevision,
+			...fields(request)
+		}, request.idempotencyKey);
+	}
+	rotate(request) {
+		return this.execute("rotate", { expected_revision: request.expectedRevision }, request.idempotencyKey);
+	}
+	close(request) {
+		return this.execute("close", { expected_revision: request.expectedRevision }, request.idempotencyKey);
+	}
+	reopen(request) {
+		return this.execute("reopen", {
+			expected_revision: request.expectedRevision,
+			...fields(request)
+		}, request.idempotencyKey);
+	}
+	async execute(operation, body, idempotencyKey) {
+		const spec = OPERATIONS[operation];
+		const encoded = body === void 0 ? void 0 : JSON.stringify(body);
+		if (encoded !== void 0 && Buffer.byteLength(encoded, "utf8") > MAX_REQUEST_BYTES) return {
+			ok: false,
+			error: {
+				code: "invalid-request",
+				message: integrationFailureMessage("invalid-request")
+			}
+		};
+		const headers = new Headers({ accept: "application/json" });
+		if (encoded !== void 0) headers.set("content-type", "application/json");
+		if (idempotencyKey !== void 0) headers.set("idempotency-key", idempotencyKey);
+		const abort = new AbortController();
+		const timeout = setTimeout(() => {
+			abort.abort();
+		}, REQUEST_TIMEOUT_MS);
+		try {
+			const request = new Request(new URL(spec.path, this.origin), {
+				method: spec.method,
+				headers,
+				...encoded === void 0 ? {} : { body: encoded },
+				redirect: "error",
+				signal: abort.signal
+			});
+			const response = await this.auth.dispatch(request, (signed) => fetch(signed));
+			const raw = await readBounded$1(response);
+			if (!response.ok) return {
+				ok: false,
+				error: failure$1(response.status, raw)
+			};
+			return {
+				ok: true,
+				value: view$1(raw)
+			};
+		} catch (error) {
+			if (error instanceof AwikiExternalHttpAuthError && (error.code === "not-registered" || error.code === "signed-out")) return {
+				ok: false,
+				error: {
+					code: "unauthorized",
+					message: integrationFailureMessage("unauthorized")
+				}
+			};
+			return {
+				ok: false,
+				error: {
+					code: "network",
+					message: integrationFailureMessage("network")
+				}
+			};
+		} finally {
+			clearTimeout(timeout);
+		}
+	}
+};
+//#endregion
+//#region lib/types/legacy-sent-mail-cache.js
+/** Exact cleanup for the removed Host-local sent-mail authority. */
+function isMissing$4(error) {
+	return typeof error === "object" && error !== null && error.code === "ENOENT";
+}
+/** Clear only the legacy cache directory during the existing destructive local-data flow. */
+async function clearLegacySentMailCache(stateRoot) {
+	const hostDirectory = join(stateRoot, ".host");
+	const directory = join(hostDirectory, "sent-mail-v1");
+	try {
+		const host = await lstat(hostDirectory);
+		if (!host.isDirectory() || host.isSymbolicLink()) throw new TypeError("awiki: legacy sent-mail cache parent is invalid");
+		const target = await lstat(directory);
+		if (target.isDirectory() && !target.isSymbolicLink()) await rm(directory, {
+			recursive: true,
+			force: true
+		});
+		else await unlink(directory);
+	} catch (error) {
+		if (!isMissing$4(error)) throw error;
+	}
+}
+//#endregion
+//#region lib/types/mail-list-client.js
+/** Host-only server-authoritative outbound Mail query. */
+const MAIL_LIST_PATH = "/mail/rpc";
+const MAIL_LIST_PAGE_SIZE = 100;
+const MAIL_LIST_TIMEOUT_MS = 1e4;
+const MAX_RESPONSE_BYTES = 1048576;
+const MAX_UINT32 = 4294967295;
+function invalidResponse() {
+	throw new AwikiSdkError("remote");
+}
+function uint32(value) {
+	if (!Number.isSafeInteger(value) || value < 0 || value > MAX_UINT32) invalidResponse();
+	return value;
+}
+function requiredString(value, maxBytes) {
+	if (typeof value !== "string" || value.length === 0 || value.trim() !== value || /[\u0000-\u001f\u007f-\u009f]/u.test(value) || Buffer.byteLength(value, "utf8") > maxBytes) invalidResponse();
+	return value;
+}
+function addresses(value) {
+	if (value === null || value === void 0 || value === "") return [];
+	const raw = Array.isArray(value) ? value : typeof value === "string" ? value.split(/[;,]/u) : invalidResponse();
+	if (raw.length > 100) invalidResponse();
+	return raw.map((candidate) => {
+		const address = requiredString(typeof candidate === "string" ? candidate.trim() : candidate, 320);
+		if (!address.includes("@") || /\s/u.test(address)) invalidResponse();
+		return address;
+	});
+}
+function timestamp(value) {
+	const copied = requiredString(value, 64);
+	const match = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.(\d+))?(Z|[+-]\d{2}:\d{2})?$/u.exec(copied);
+	if (match === null) invalidResponse();
+	const year = Number(match[1]);
+	const month = Number(match[2]);
+	const day = Number(match[3]);
+	const hour = Number(match[4]);
+	const minute = Number(match[5]);
+	const second = Number(match[6]);
+	const zone = match[8];
+	const monthDays = [
+		31,
+		year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0) ? 29 : 28,
+		31,
+		30,
+		31,
+		30,
+		31,
+		31,
+		30,
+		31,
+		30,
+		31
+	];
+	if (year === 0 || month < 1 || month > 12 || day < 1 || day > monthDays[month - 1] || hour > 23 || minute > 59 || second > 59) invalidResponse();
+	if (zone !== void 0 && zone !== "Z") {
+		const offsetHour = Number(zone.slice(1, 3));
+		const offsetMinute = Number(zone.slice(4, 6));
+		if (offsetHour > 23 || offsetMinute > 59) invalidResponse();
+	}
+	return zone === void 0 ? `${copied}Z` : copied;
+}
+function boundedText$1(value, maxBytes, fallback) {
+	const source = typeof value === "string" && value.trim() !== "" ? value : fallback;
+	if (/\u0000/u.test(source)) invalidResponse();
+	if (Buffer.byteLength(source, "utf8") <= maxBytes) return {
+		value: source,
+		truncated: false
+	};
+	const characters = Array.from(source);
+	while (characters.length > 0 && Buffer.byteLength(characters.join(""), "utf8") > maxBytes) characters.pop();
+	return {
+		value: characters.join(""),
+		truncated: true
+	};
+}
+function summary(raw) {
+	if (typeof raw !== "object" || raw === null || Array.isArray(raw)) invalidResponse();
+	const value = raw;
+	if (value.direction !== "outbound" || typeof value.has_attachments !== "boolean") invalidResponse();
+	const subject = boundedText$1(value.subject, 1024, "(no subject)");
+	return {
+		id: requiredString(value.id, 2048),
+		folder: "sent",
+		from: addresses(value.from_addr),
+		to: addresses(value.to_addr),
+		cc: addresses(value.cc_addr),
+		subject: subject.value,
+		subjectTruncated: subject.truncated,
+		previewTruncated: false,
+		sentAt: timestamp(value.created_at),
+		unread: false,
+		hasAttachments: value.has_attachments
+	};
+}
+async function readBounded(response) {
+	const declared = response.headers.get("content-length");
+	if (declared !== null && /^\d+$/u.test(declared) && Number(declared) > MAX_RESPONSE_BYTES) invalidResponse();
+	const reader = response.body?.getReader();
+	if (reader === void 0) invalidResponse();
+	const chunks = [];
+	let size = 0;
+	try {
+		while (true) {
+			const result = await reader.read();
+			if (result.done) break;
+			size += result.value.byteLength;
+			if (size > MAX_RESPONSE_BYTES) invalidResponse();
+			chunks.push(result.value);
+		}
+	} finally {
+		reader.releaseLock();
+	}
+	const bytes = new Uint8Array(size);
+	let offset = 0;
+	for (const chunk of chunks) {
+		bytes.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	try {
+		return JSON.parse(new TextDecoder().decode(bytes));
+	} catch {
+		invalidResponse();
+	}
+}
+function rpcFailure(code) {
+	if (code === -32e3) throw new AwikiSdkError("not-registered");
+	if (code === -32001) throw new AwikiSdkError("forbidden");
+	if (code === -32002) throw new AwikiSdkError("not-found");
+	if (code === -32003) throw new AwikiSdkError("conflict");
+	if (code === -32004 || code === -32600 || code === -32602) throw new AwikiSdkError("invalid-request");
+	if (code === -32005) throw new AwikiSdkError("rate-limited");
+	invalidResponse();
+}
+function responseFailure(status) {
+	if (status === 401) throw new AwikiSdkError("not-registered");
+	if (status === 403) throw new AwikiSdkError("forbidden");
+	if (status === 429) throw new AwikiSdkError("rate-limited");
+	if (status >= 500) throw new AwikiSdkError("network");
+	invalidResponse();
+}
+/** Fixed Mail Service client; callers cannot select method, direction, headers, or transport. */
+var AwikiMailListClient = class {
+	origin;
+	auth;
+	constructor(origin, auth) {
+		this.origin = origin;
+		this.auth = auth;
+	}
+	async listOutbound(request) {
+		const offset = request.offset ?? 0;
+		const limit = request.limit ?? 20;
+		const firstPageNumber = Math.floor(offset / MAIL_LIST_PAGE_SIZE) + 1;
+		const first = await this.page(firstPageNumber);
+		const pageOffset = offset % MAIL_LIST_PAGE_SIZE;
+		let items = first.items.slice(pageOffset, pageOffset + limit);
+		let total = first.total;
+		if (items.length < limit && offset + items.length < total) {
+			const next = await this.page(firstPageNumber + 1);
+			total = next.total;
+			items = [...items, ...next.items.slice(0, limit - items.length)];
+		}
+		const nextOffset = offset + items.length;
+		const hasMore = nextOffset < total;
+		return {
+			items,
+			...hasMore ? { nextOffset } : {},
+			hasMore
+		};
+	}
+	async page(page) {
+		const abort = new AbortController();
+		const timeout = setTimeout(() => {
+			abort.abort();
+		}, MAIL_LIST_TIMEOUT_MS);
+		try {
+			const request = new Request(new URL(MAIL_LIST_PATH, this.origin), {
+				method: "POST",
+				headers: {
+					accept: "application/json",
+					"content-type": "application/json"
+				},
+				body: JSON.stringify({
+					jsonrpc: "2.0",
+					id: 1,
+					method: "mail.list",
+					params: {
+						direction: "outbound",
+						page,
+						page_size: MAIL_LIST_PAGE_SIZE
+					}
+				}),
+				redirect: "error",
+				signal: abort.signal
+			});
+			const response = await this.auth.dispatch(request, (signed) => fetch(signed));
+			if (!response.ok) responseFailure(response.status);
+			const raw = await readBounded(response);
+			if (typeof raw !== "object" || raw === null || Array.isArray(raw)) invalidResponse();
+			const envelope = raw;
+			if (envelope.jsonrpc !== "2.0" || envelope.id !== 1) invalidResponse();
+			if (envelope.error !== null && envelope.error !== void 0) {
+				if (typeof envelope.error !== "object" || Array.isArray(envelope.error)) invalidResponse();
+				rpcFailure(envelope.error.code);
+			}
+			if (typeof envelope.result !== "object" || envelope.result === null || Array.isArray(envelope.result)) invalidResponse();
+			const result = envelope.result;
+			if (!Array.isArray(result.items) || result.items.length > MAIL_LIST_PAGE_SIZE) invalidResponse();
+			return {
+				total: uint32(result.total),
+				items: result.items.map(summary)
+			};
+		} catch (error) {
+			if (error instanceof AwikiSdkError) throw error;
+			if (error instanceof AwikiExternalHttpAuthError) {
+				if (error.code === "not-registered") throw new AwikiSdkError("not-registered");
+				if (error.code === "signed-out") throw new AwikiSdkError("signed-out");
+			}
+			throw new AwikiSdkError("network");
+		} finally {
+			clearTimeout(timeout);
+		}
+	}
+};
+//#endregion
 //#region lib/types/tools.js
 /** Model-facing AWiki read and approved-send tools. */
 /** Model tool that reads the public deployment identity. */
@@ -555,10 +1151,55 @@ function mailSendRequest(request) {
 	};
 }
 //#endregion
+//#region lib/types/builtin-tenant-config.js
+/** Build-injected two-slot tenant catalog with a source-tree default for tests. */
+function record(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function definition(value) {
+	if (!record(value) || !record(value.display_name) || typeof value.display_name["zh-CN"] !== "string" || value.display_name["zh-CN"].trim() === "" || typeof value.display_name.en !== "string" || value.display_name.en.trim() === "" || typeof value.backend_origin !== "string" || typeof value.did_host !== "string") throw new Error("awiki: invalid built-in tenant definition");
+	const origin = new URL(value.backend_origin);
+	const loopback = origin.protocol === "http:" && [
+		"localhost",
+		"127.0.0.1",
+		"[::1]"
+	].includes(origin.hostname);
+	if (origin.protocol !== "https:" && !loopback || origin.username !== "" || origin.password !== "" || origin.pathname !== "/" || origin.search !== "" || origin.hash !== "" || !loopback && origin.port !== "") throw new Error("awiki: built-in tenant origin must be an HTTPS origin");
+	const didHost = value.did_host.trim().toLowerCase().replace(/\.$/u, "");
+	if (origin.hostname !== didHost) throw new Error("awiki: built-in tenant DID host must match its origin");
+	return {
+		displayName: {
+			"zh-CN": value.display_name["zh-CN"].trim(),
+			en: value.display_name.en.trim()
+		},
+		backendOrigin: origin.origin,
+		didHost
+	};
+}
+function decodeBuiltinTenantConfig(value) {
+	if (!record(value) || value.schema_version !== 1 || value.default_slot !== "primary" && value.default_slot !== "secondary" || !record(value.tenants) || Object.keys(value.tenants).sort().join(",") !== "primary,secondary") throw new Error("awiki: invalid built-in tenant config");
+	const primary = definition(value.tenants.primary);
+	const secondary = definition(value.tenants.secondary);
+	if (primary.backendOrigin === secondary.backendOrigin || primary.didHost === secondary.didHost) throw new Error("awiki: built-in tenant slots must use distinct endpoints");
+	return {
+		schemaVersion: 1,
+		defaultSlot: value.default_slot,
+		tenants: {
+			primary,
+			secondary
+		}
+	};
+}
+function rawConfig() {
+	return JSON.parse("{\n  \"schema_version\": 1,\n  \"default_slot\": \"primary\",\n  \"tenants\": {\n    \"primary\": {\n      \"display_name\": {\n        \"zh-CN\": \"AWiki 中国（上海）\",\n        \"en\": \"AWiki China (Shanghai)\"\n      },\n      \"backend_origin\": \"https://awiki.me\",\n      \"did_host\": \"awiki.me\"\n    },\n    \"secondary\": {\n      \"display_name\": {\n        \"zh-CN\": \"AWiki 全球（硅谷）\",\n        \"en\": \"AWiki Global (Silicon Valley)\"\n      },\n      \"backend_origin\": \"https://awiki.ai\",\n      \"did_host\": \"awiki.ai\"\n    }\n  }\n}\n");
+}
+const AWIKI_BUILTIN_TENANT_CONFIG = decodeBuiltinTenantConfig(rawConfig());
+const AWIKI_DEFAULT_BUILTIN_TENANT = AWIKI_BUILTIN_TENANT_CONFIG.tenants[AWIKI_BUILTIN_TENANT_CONFIG.defaultSlot];
+//#endregion
 //#region lib/types/domain.js
 /** Client-safe AWiki Handle provider domain constants and validation. */
 /** Default Handle provider domain for new AWiki deployments. */
-const DEFAULT_AWIKI_DOMAIN = "awiki.ai";
+const DEFAULT_AWIKI_DOMAIN = AWIKI_DEFAULT_BUILTIN_TENANT.didHost;
 /** Field carrying the Handle provider domain in the AWiki settings namespace. */
 const AWIKI_DOMAIN_FIELD = "domain";
 /** Settings namespace owned by the AWiki plugin. */
@@ -587,20 +1228,29 @@ const AWIKI_SETTINGS_RPC_CHANNEL = "/awiki-settings";
 const AWIKI_SETTINGS_RPC_ENDPOINTS = {
 	describe: "describe",
 	setDomain: "set-domain",
-	resetDomain: "reset-domain"
+	resetDomain: "reset-domain",
+	describeTenants: "describe-tenants",
+	createTenant: "create-tenant",
+	renameTenant: "rename-tenant",
+	switchTenant: "switch-tenant",
+	archiveTenant: "archive-tenant",
+	describeUpdatePolicy: "describe-update-policy",
+	refreshUpdatePolicy: "refresh-update-policy",
+	describeDesktopUpdate: "describe-desktop-update",
+	refreshDesktopUpdate: "refresh-desktop-update"
 };
 //#endregion
 //#region lib/types/settings-rpc.js
 /** Loopback-only Host transport for AWiki's durable plugin settings. */
-function isRecord$2(value) {
+function isRecord$4(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function expectedRevision(payload) {
-	if (!isRecord$2(payload) || !Number.isSafeInteger(payload.expectedRevision) || payload.expectedRevision < 0) return;
+	if (!isRecord$4(payload) || !Number.isSafeInteger(payload.expectedRevision) || payload.expectedRevision < 0) return;
 	return payload.expectedRevision;
 }
 function sanitizeLayer(value) {
-	if (!isRecord$2(value)) return void 0;
+	if (!isRecord$4(value)) return void 0;
 	if (!Object.hasOwn(value, "domain")) return {};
 	if (typeof value["domain"] !== "string") return void 0;
 	const domain = normalizeAwikiDomain(value[AWIKI_DOMAIN_FIELD]);
@@ -609,7 +1259,7 @@ function sanitizeLayer(value) {
 }
 function view(provider) {
 	const descriptor = provider.describe({ redactSecrets: true }).find((candidate) => candidate.ns === AWIKI_SETTINGS_NAMESPACE);
-	if (descriptor === void 0 || !isRecord$2(descriptor.value) || typeof descriptor.value.domain !== "string") return;
+	if (descriptor === void 0 || !isRecord$4(descriptor.value) || typeof descriptor.value.domain !== "string") return;
 	const domain = normalizeAwikiDomain(descriptor.value.domain);
 	if (domain !== descriptor.value.domain) return void 0;
 	const base = descriptor.base === void 0 ? void 0 : sanitizeLayer(descriptor.base);
@@ -653,14 +1303,138 @@ function cancelled() {
 		}
 	};
 }
+function publicTenantView(value) {
+	return {
+		schemaVersion: value.schemaVersion,
+		officialCatalogVersion: value.officialCatalogVersion,
+		generation: value.generation,
+		activeTenantId: value.activeTenantId,
+		tenants: value.tenants.map((tenant) => {
+			const slot = tenant.tenantId === "builtin-primary" ? "primary" : tenant.tenantId === "builtin-secondary" ? "secondary" : void 0;
+			return {
+				tenantId: tenant.tenantId,
+				storageScopeId: tenant.storageScopeId,
+				kind: tenant.kind,
+				displayName: tenant.displayName,
+				...slot === void 0 ? {} : { displayNames: AWIKI_BUILTIN_TENANT_CONFIG.tenants[slot].displayName },
+				backendBaseUrl: tenant.backendBaseUrl,
+				didHost: tenant.didHost,
+				lifecycle: tenant.lifecycle,
+				storageLayout: tenant.storageLayout
+			};
+		}),
+		switching: value.switching,
+		...value.diagnostic === void 0 ? {} : { diagnostic: value.diagnostic }
+	};
+}
+function tenantRejected(error) {
+	return {
+		ok: false,
+		error: {
+			code: "settings-rejected",
+			message: error instanceof Error && error.message.startsWith("awiki:") ? error.message : "The Host rejected the AWiki tenant change.",
+			details: { ns: AWIKI_SETTINGS_NAMESPACE }
+		}
+	};
+}
 /** Build a handler whose provider lookup remains correct across Cordis reinjection. */
-function createAwikiSettingsRpcHandler(getProvider) {
+function createAwikiSettingsRpcHandler(getProvider, tenantManagement) {
 	return async (endpoint, payload, signal) => {
 		if (signal.aborted) return cancelled();
+		if (endpoint === AWIKI_SETTINGS_RPC_ENDPOINTS.describeDesktopUpdate || endpoint === AWIKI_SETTINGS_RPC_ENDPOINTS.refreshDesktopUpdate) {
+			if (!isRecord$4(payload)) return badRequest();
+			try {
+				return {
+					ok: true,
+					value: (endpoint === AWIKI_SETTINGS_RPC_ENDPOINTS.refreshDesktopUpdate ? await tenantManagement?.refreshDesktopUpdate?.() : tenantManagement?.describeDesktopUpdate?.()) ?? null
+				};
+			} catch {
+				return unavailable();
+			}
+		}
+		if (endpoint === AWIKI_SETTINGS_RPC_ENDPOINTS.describeTenants) {
+			if (!isRecord$4(payload) || tenantManagement === void 0) return unavailable();
+			try {
+				return {
+					ok: true,
+					value: publicTenantView(tenantManagement.describe())
+				};
+			} catch (error) {
+				return tenantRejected(error);
+			}
+		}
+		if (endpoint === AWIKI_SETTINGS_RPC_ENDPOINTS.createTenant) {
+			if (!isRecord$4(payload) || typeof payload.displayName !== "string" || typeof payload.domain !== "string" || tenantManagement === void 0) return badRequest();
+			try {
+				return {
+					ok: true,
+					value: publicTenantView(tenantManagement.create(payload.displayName, payload.domain))
+				};
+			} catch (error) {
+				return tenantRejected(error);
+			}
+		}
+		if (endpoint === AWIKI_SETTINGS_RPC_ENDPOINTS.renameTenant) {
+			if (!isRecord$4(payload) || typeof payload.tenantId !== "string" || typeof payload.displayName !== "string" || tenantManagement === void 0) return badRequest();
+			try {
+				return {
+					ok: true,
+					value: publicTenantView(tenantManagement.rename(payload.tenantId, payload.displayName))
+				};
+			} catch (error) {
+				return tenantRejected(error);
+			}
+		}
+		if (endpoint === AWIKI_SETTINGS_RPC_ENDPOINTS.switchTenant) {
+			if (!isRecord$4(payload) || typeof payload.tenantId !== "string" || tenantManagement === void 0) return badRequest();
+			try {
+				return {
+					ok: true,
+					value: publicTenantView(await tenantManagement.switch(payload.tenantId))
+				};
+			} catch (error) {
+				return tenantRejected(error);
+			}
+		}
+		if (endpoint === AWIKI_SETTINGS_RPC_ENDPOINTS.archiveTenant) {
+			if (!isRecord$4(payload) || typeof payload.tenantId !== "string" || tenantManagement === void 0) return badRequest();
+			try {
+				return {
+					ok: true,
+					value: publicTenantView(tenantManagement.archive(payload.tenantId))
+				};
+			} catch (error) {
+				return tenantRejected(error);
+			}
+		}
+		if (endpoint === AWIKI_SETTINGS_RPC_ENDPOINTS.describeUpdatePolicy) {
+			const describeUpdate = tenantManagement?.describeUpdate;
+			if (!isRecord$4(payload) || describeUpdate === void 0) return unavailable();
+			try {
+				return {
+					ok: true,
+					value: describeUpdate.call(tenantManagement)
+				};
+			} catch (error) {
+				return tenantRejected(error);
+			}
+		}
+		if (endpoint === AWIKI_SETTINGS_RPC_ENDPOINTS.refreshUpdatePolicy) {
+			const refreshUpdate = tenantManagement?.refreshUpdate;
+			if (!isRecord$4(payload) || refreshUpdate === void 0) return unavailable();
+			try {
+				return {
+					ok: true,
+					value: await refreshUpdate.call(tenantManagement)
+				};
+			} catch (error) {
+				return tenantRejected(error);
+			}
+		}
 		const provider = getProvider();
 		if (provider === void 0) return unavailable();
 		if (endpoint === AWIKI_SETTINGS_RPC_ENDPOINTS.describe) {
-			if (!isRecord$2(payload)) return badRequest();
+			if (!isRecord$4(payload)) return badRequest();
 			const current = view(provider);
 			return current === void 0 ? unavailable() : {
 				ok: true,
@@ -671,7 +1445,7 @@ function createAwikiSettingsRpcHandler(getProvider) {
 		if (revision === void 0) return badRequest();
 		let operation;
 		if (endpoint === AWIKI_SETTINGS_RPC_ENDPOINTS.setDomain) {
-			if (!isRecord$2(payload) || typeof payload.domain !== "string") return badRequest();
+			if (!isRecord$4(payload) || typeof payload.domain !== "string") return badRequest();
 			let domain;
 			try {
 				domain = normalizeAwikiDomain(payload.domain);
@@ -740,7 +1514,7 @@ var AwikiSessionStore = class {
 			if (await readFile(this.markerPath, "utf8") !== SIGNED_OUT_MARKER) throw new TypeError("awiki: local session marker is invalid");
 			return true;
 		} catch (error) {
-			if (isMissing$4(error)) return false;
+			if (isMissing$3(error)) return false;
 			throw error;
 		}
 	}
@@ -758,7 +1532,7 @@ var AwikiSessionStore = class {
 				mode: 384
 			});
 		} catch (error) {
-			if (!isFileExists$3(error) || !await this.isSignedOut()) throw error;
+			if (!isFileExists$2(error) || !await this.isSignedOut()) throw error;
 		}
 		await chmod(this.markerPath, 384);
 	}
@@ -767,7 +1541,7 @@ var AwikiSessionStore = class {
 		try {
 			await unlink(this.markerPath);
 		} catch (error) {
-			if (!isMissing$4(error)) throw error;
+			if (!isMissing$3(error)) throw error;
 		}
 	}
 	async hasPrivateHostDirectory() {
@@ -776,15 +1550,15 @@ var AwikiSessionStore = class {
 			if (!directory.isDirectory() || directory.isSymbolicLink()) throw new TypeError("awiki: local session directory is invalid");
 			return true;
 		} catch (error) {
-			if (isMissing$4(error)) return false;
+			if (isMissing$3(error)) return false;
 			throw error;
 		}
 	}
 };
-function isMissing$4(error) {
+function isMissing$3(error) {
 	return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
 }
-function isFileExists$3(error) {
+function isFileExists$2(error) {
 	return typeof error === "object" && error !== null && "code" in error && error.code === "EEXIST";
 }
 //#endregion
@@ -877,7 +1651,7 @@ var AwikiImageAttachmentCache = class {
 				force: true
 			});
 		} catch (error) {
-			if (!isMissing$3(error)) throw error;
+			if (!isMissing$2(error)) throw error;
 		}
 	}
 	decode(input, ownerDid, request) {
@@ -903,7 +1677,7 @@ var AwikiImageAttachmentCache = class {
 		if (!await this.hasPrivateDirectory(this.hostDirectory)) throw new TypeError("awiki: local Host directory is invalid");
 		await chmod(this.hostDirectory, 448);
 		await mkdir(this.directory, { mode: 448 }).catch((error) => {
-			if (!isFileExists$2(error)) throw error;
+			if (!isFileExists$1(error)) throw error;
 		});
 		if (!await this.hasPrivateDirectory(this.directory)) throw new TypeError("awiki: local image cache directory is invalid");
 		await chmod(this.directory, 448);
@@ -941,233 +1715,17 @@ var AwikiImageAttachmentCache = class {
 			if (!metadata.isDirectory() || metadata.isSymbolicLink()) throw new TypeError("awiki: local image cache path is invalid");
 			return true;
 		} catch (error) {
-			if (isMissing$3(error)) return false;
+			if (isMissing$2(error)) return false;
 			throw error;
 		}
 	}
 };
-function isMissing$3(error) {
-	return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
-}
-function isFileExists$2(error) {
-	return typeof error === "object" && error !== null && "code" in error && error.code === "EEXIST";
-}
-//#endregion
-//#region lib/types/sent-mail-store.js
-/** Private, owner-bound persistence for mail successfully sent by this installation. */
-const STORE_VERSION$1 = 1;
-const STORE_DIRECTORY$1 = "sent-mail-v1";
-const MAX_RECORDS = 200;
-const MAX_STORE_BYTES$1 = 16777216;
-const PREVIEW_CHARACTERS = 160;
-const LOCAL_SENT_MAIL_ID_PREFIX = "awiki-sent-v1:";
-function invalidState$1() {
-	throw new TypeError("awiki: local sent-mail history is invalid");
-}
 function isMissing$2(error) {
-	return typeof error === "object" && error !== null && error.code === "ENOENT";
+	return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
 }
 function isFileExists$1(error) {
-	return typeof error === "object" && error !== null && error.code === "EEXIST";
-}
-function validToken(value, maxCharacters) {
-	return typeof value === "string" && value.length > 0 && value.trim() === value && Array.from(value).length <= maxCharacters && !/[\u0000-\u001f\u007f-\u009f]/u.test(value);
-}
-function validAddress(value) {
-	return typeof value === "string" && Array.from(value).length >= 3 && Array.from(value).length <= 320 && value.includes("@") && !/[\s\u0000-\u001f\u007f-\u009f]/u.test(value);
-}
-function decodeRecord(input) {
-	if (typeof input !== "object" || input === null || Array.isArray(input)) invalidState$1();
-	const value = input;
-	if (typeof value.id !== "string" || !/^awiki-sent-v1:[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/u.test(value.id) || value.serviceMessageId !== void 0 && !validToken(value.serviceMessageId, 2048) || value.from !== void 0 && !validAddress(value.from) || typeof value.sentAt !== "string" || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/u.test(value.sentAt) || !Number.isFinite(Date.parse(value.sentAt))) invalidState$1();
-	let request;
-	try {
-		request = mailSendRequest({
-			to: value.to,
-			cc: value.cc,
-			subject: value.subject,
-			bodyText: value.bodyText
-		});
-	} catch {
-		invalidState$1();
-	}
-	return {
-		id: value.id,
-		...value.serviceMessageId === void 0 ? {} : { serviceMessageId: value.serviceMessageId },
-		...value.from === void 0 ? {} : { from: value.from },
-		to: [...request.to],
-		cc: [...request.cc ?? []],
-		subject: request.subject,
-		bodyText: request.bodyText,
-		sentAt: value.sentAt
-	};
-}
-function message(record) {
-	const characters = Array.from(record.bodyText);
-	const preview = characters.slice(0, PREVIEW_CHARACTERS).join("");
-	return {
-		summary: {
-			id: record.id,
-			folder: "sent",
-			from: record.from === void 0 ? [] : [record.from],
-			to: [...record.to],
-			cc: [...record.cc],
-			subject: record.subject,
-			subjectTruncated: false,
-			preview,
-			previewTruncated: characters.length > PREVIEW_CHARACTERS,
-			sentAt: record.sentAt,
-			unread: false,
-			hasAttachments: false,
-			attachmentCount: 0
-		},
-		bodyText: record.bodyText,
-		bodyTruncated: false,
-		hasHtmlBody: false,
-		attachments: []
-	};
-}
-function isLocalSentMailId(messageId) {
-	return String(messageId).startsWith(LOCAL_SENT_MAIL_ID_PREFIX);
+	return typeof error === "object" && error !== null && "code" in error && error.code === "EEXIST";
 }
-/** Atomic, bounded history of sends accepted by the Mail Service. */
-var AwikiSentMailStore = class {
-	hostDirectory;
-	directory;
-	mutation = Promise.resolve();
-	constructor(stateRoot) {
-		this.hostDirectory = join(stateRoot, ".host");
-		this.directory = join(this.hostDirectory, STORE_DIRECTORY$1);
-	}
-	async list(ownerDid, request) {
-		const records = request.unreadOnly === true ? [] : await this.load(ownerDid);
-		const offset = request.offset ?? 0;
-		const limit = request.limit ?? 20;
-		const page = records.slice(offset, offset + limit);
-		const nextOffset = offset + page.length;
-		const hasMore = nextOffset < records.length;
-		return {
-			items: page.map((record) => message(record).summary),
-			...hasMore ? { nextOffset } : {},
-			hasMore
-		};
-	}
-	async read(ownerDid, messageId) {
-		if (!isLocalSentMailId(messageId)) return void 0;
-		const record = (await this.load(ownerDid)).find((candidate) => candidate.id === String(messageId));
-		return record === void 0 ? void 0 : message(record);
-	}
-	append(ownerDid, request, result, account) {
-		const normalized = mailSendRequest(request);
-		const record = {
-			id: `${LOCAL_SENT_MAIL_ID_PREFIX}${randomUUID()}`,
-			...result.messageId === void 0 ? {} : { serviceMessageId: String(result.messageId) },
-			...account?.mailboxAddress === void 0 ? {} : { from: account.mailboxAddress },
-			to: [...normalized.to],
-			cc: [...normalized.cc ?? []],
-			subject: normalized.subject,
-			bodyText: normalized.bodyText,
-			sentAt: (/* @__PURE__ */ new Date()).toISOString()
-		};
-		const append = async () => {
-			const records = await this.load(ownerDid);
-			await this.write(ownerDid, [record, ...records].slice(0, MAX_RECORDS));
-		};
-		const pending = this.mutation.then(append, append);
-		this.mutation = pending.catch(() => void 0);
-		return pending;
-	}
-	async clear() {
-		await this.mutation;
-		try {
-			if (!await this.hasDirectory(this.hostDirectory)) return;
-			const metadata = await lstat(this.directory);
-			if (metadata.isSymbolicLink() || !metadata.isDirectory()) {
-				await unlink(this.directory);
-				return;
-			}
-			await rm(this.directory, {
-				recursive: true,
-				force: true
-			});
-		} catch (error) {
-			if (!isMissing$2(error)) throw error;
-		}
-	}
-	async load(ownerDid) {
-		if (!await this.hasDirectory(this.hostDirectory) || !await this.hasDirectory(this.directory)) return [];
-		const path = this.path(ownerDid);
-		let text;
-		try {
-			const metadata = await lstat(path);
-			if (!metadata.isFile() || metadata.isSymbolicLink() || metadata.size > MAX_STORE_BYTES$1) invalidState$1();
-			text = await readFile(path, "utf8");
-		} catch (error) {
-			if (isMissing$2(error)) return [];
-			throw error;
-		}
-		let parsed;
-		try {
-			parsed = JSON.parse(text);
-		} catch {
-			invalidState$1();
-		}
-		if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) invalidState$1();
-		const value = parsed;
-		if (value.version !== STORE_VERSION$1 || value.ownerDid !== String(ownerDid) || !Array.isArray(value.records) || value.records.length > MAX_RECORDS) invalidState$1();
-		return value.records.map(decodeRecord);
-	}
-	async write(ownerDid, records) {
-		await this.ensureDirectory();
-		const path = this.path(ownerDid);
-		const temporary = join(this.directory, `.${this.key(ownerDid)}.${randomUUID()}.tmp`);
-		const text = JSON.stringify({
-			version: STORE_VERSION$1,
-			ownerDid: String(ownerDid),
-			records
-		});
-		if (Buffer.byteLength(text, "utf8") > MAX_STORE_BYTES$1) invalidState$1();
-		try {
-			await writeFile(temporary, text, {
-				flag: "wx",
-				mode: 384
-			});
-			await rename(temporary, path);
-			await chmod(path, 384);
-		} finally {
-			await unlink(temporary).catch(() => void 0);
-		}
-	}
-	async ensureDirectory() {
-		await mkdir(this.hostDirectory, {
-			recursive: true,
-			mode: 448
-		});
-		if (!await this.hasDirectory(this.hostDirectory)) invalidState$1();
-		await chmod(this.hostDirectory, 448);
-		await mkdir(this.directory, { mode: 448 }).catch((error) => {
-			if (!isFileExists$1(error)) throw error;
-		});
-		if (!await this.hasDirectory(this.directory)) invalidState$1();
-		await chmod(this.directory, 448);
-	}
-	async hasDirectory(path) {
-		try {
-			const metadata = await lstat(path);
-			if (!metadata.isDirectory() || metadata.isSymbolicLink()) invalidState$1();
-			return true;
-		} catch (error) {
-			if (isMissing$2(error)) return false;
-			throw error;
-		}
-	}
-	path(ownerDid) {
-		return join(this.directory, `${this.key(ownerDid)}.json`);
-	}
-	key(ownerDid) {
-		return createHash("sha256").update(String(ownerDid)).digest("hex");
-	}
-};
 //#endregion
 //#region lib/types/conversation-preferences.js
 const STORE_VERSION = 1;
@@ -1187,7 +1745,7 @@ function isMissing$1(error) {
 function isFileExists(error) {
 	return typeof error === "object" && error !== null && "code" in error && error.code === "EEXIST";
 }
-function isRecord$1(value) {
+function isRecord$3(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function boundedString$1(value, maximum) {
@@ -1210,7 +1768,7 @@ function optionalTimestamp(value) {
 }
 /** Rebuild a bounded display-only snapshot before it reaches private persistence. */
 function conversation(value) {
-	if (!isRecord$1(value)) invalidState();
+	if (!isRecord$3(value)) invalidState();
 	const kind = value.kind;
 	const id = boundedString$1(value.id, MAX_IDENTIFIER_CHARACTERS);
 	const title = boundedString$1(value.title, MAX_TITLE_CHARACTERS);
@@ -1249,14 +1807,14 @@ function conversation(value) {
 	invalidState();
 }
 function hiddenPreference(value) {
-	if (!isRecord$1(value) || !Number.isSafeInteger(value.hiddenAt) || value.hiddenAt < 0) invalidState();
+	if (!isRecord$3(value) || !Number.isSafeInteger(value.hiddenAt) || value.hiddenAt < 0) invalidState();
 	return {
 		conversation: conversation(value.conversation),
 		hiddenAt: value.hiddenAt
 	};
 }
 function preferences(value, expectedOwnerDid) {
-	if (!isRecord$1(value) || value.version !== STORE_VERSION || value.ownerDid !== String(expectedOwnerDid) || !Array.isArray(value.hiddenConversations) || value.hiddenConversations.length > MAX_HIDDEN_CONVERSATIONS) invalidState();
+	if (!isRecord$3(value) || value.version !== STORE_VERSION || value.ownerDid !== String(expectedOwnerDid) || !Array.isArray(value.hiddenConversations) || value.hiddenConversations.length > MAX_HIDDEN_CONVERSATIONS) invalidState();
 	const hiddenConversations = value.hiddenConversations.map(hiddenPreference);
 	const seen = /* @__PURE__ */ new Set();
 	for (const hidden of hiddenConversations) {
@@ -1285,7 +1843,7 @@ function emptyPreferences(ownerDid) {
 /** Validate one browser mutation before entering private Host persistence. */
 function normalizeConversationPreferenceMutation(value) {
 	try {
-		if (!isRecord$1(value)) return void 0;
+		if (!isRecord$3(value)) return void 0;
 		if (value.action === "hide") return {
 			action: "hide",
 			conversation: conversation(value.conversation)
@@ -1440,7 +1998,7 @@ function emptyState(identityScopeHash) {
 		conversations: {}
 	};
 }
-function isRecord(value) {
+function isRecord$2(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function boundedString(value, field) {
@@ -1449,15 +2007,15 @@ function boundedString(value, field) {
 }
 /** Validate and detach the complete state file before the listener trusts any route. */
 function parseState(value, identityScopeHash) {
-	if (isRecord(value) && value.version === 1) return emptyState(identityScopeHash);
-	if (isRecord(value) && value.version === STATE_VERSION && typeof value.identityScopeHash === "string" && value.identityScopeHash !== identityScopeHash) return emptyState(identityScopeHash);
-	if (!isRecord(value) || value.version !== STATE_VERSION || value.identityScopeHash !== identityScopeHash || !isRecord(value.conversations)) throw new TypeError("awiki: listener state is invalid");
+	if (isRecord$2(value) && value.version === 1) return emptyState(identityScopeHash);
+	if (isRecord$2(value) && value.version === STATE_VERSION && typeof value.identityScopeHash === "string" && value.identityScopeHash !== identityScopeHash) return emptyState(identityScopeHash);
+	if (!isRecord$2(value) || value.version !== STATE_VERSION || value.identityScopeHash !== identityScopeHash || !isRecord$2(value.conversations)) throw new TypeError("awiki: listener state is invalid");
 	const entries = Object.entries(value.conversations);
 	if (entries.length > MAX_CONVERSATIONS) throw new TypeError("awiki: listener state is too large");
 	const conversations = {};
 	for (const [conversationId, raw] of entries) {
 		const id = boundedString(conversationId, "conversation id");
-		if (!isRecord(raw)) throw new TypeError("awiki: listener conversation state is invalid");
+		if (!isRecord$2(raw)) throw new TypeError("awiki: listener conversation state is invalid");
 		if (Object.keys(raw).some((key) => ![
 			"peerDid",
 			"sessionId",
@@ -2026,6 +2584,9 @@ var IdentityRealtimeSupervisor = class {
 	lastFailureCode;
 	lastConnectedAtMs;
 	lastCommittedSyncCause;
+	lastSyncPagesFetched;
+	lastSyncMessagesHydrated;
+	lastSyncOlderHistoryExcluded;
 	retryTimer;
 	resolveRetry;
 	constructor(realtime, config = {}, logger = {
@@ -2059,7 +2620,10 @@ var IdentityRealtimeSupervisor = class {
 			lifecyclePhase: this.lifecyclePhase,
 			...this.lastFailureCode === void 0 ? {} : { lastFailureCode: this.lastFailureCode },
 			...this.lastConnectedAtMs === void 0 ? {} : { lastConnectedAtMs: this.lastConnectedAtMs },
-			...this.lastCommittedSyncCause === void 0 ? {} : { lastCommittedSyncCause: this.lastCommittedSyncCause }
+			...this.lastCommittedSyncCause === void 0 ? {} : { lastCommittedSyncCause: this.lastCommittedSyncCause },
+			...this.lastSyncPagesFetched === void 0 ? {} : { lastSyncPagesFetched: this.lastSyncPagesFetched },
+			...this.lastSyncMessagesHydrated === void 0 ? {} : { lastSyncMessagesHydrated: this.lastSyncMessagesHydrated },
+			...this.lastSyncOlderHistoryExcluded === void 0 ? {} : { lastSyncOlderHistoryExcluded: this.lastSyncOlderHistoryExcluded }
 		};
 	}
 	/** Fence late events, wake retry sleep, stop the exact session, and join the lifecycle. */
@@ -2134,57 +2698,815 @@ var IdentityRealtimeSupervisor = class {
 			}
 		}
 	}
-	async synchronize(cause, generation) {
-		await this.realtime.syncNow(syncReason(cause));
-		if (!this.current(generation)) return;
-		this.lastCommittedSyncCause = cause;
-		try {
-			await this.config.onSynchronized?.(cause);
+	async synchronize(cause, generation) {
+		const result = await this.realtime.syncNow(syncReason(cause));
+		if (!this.current(generation)) return;
+		this.lastCommittedSyncCause = cause;
+		this.lastSyncPagesFetched = result.pagesFetched;
+		this.lastSyncMessagesHydrated = result.messagesHydrated;
+		this.lastSyncOlderHistoryExcluded = result.olderHistoryExcluded;
+		try {
+			await this.config.onSynchronized?.(cause);
+		} catch (error) {
+			this.logger.warn("AWiki realtime post-sync consumer failed: %s", error instanceof Error ? error.message : "unknown failure");
+		}
+	}
+	observeConnection(event) {
+		if (event.kind !== "connection_state_changed") return;
+		this.connected = event.state === "connected";
+		if (this.connected) {
+			this.lifecyclePhase = "connected";
+			this.lastConnectedAtMs = Date.now();
+			this.lastFailureCode = void 0;
+		}
+	}
+	async stopSession(session) {
+		if (this.stoppedSessions.has(session)) return;
+		this.stoppedSessions.add(session);
+		if (this.activeSession === session) this.activeSession = void 0;
+		this.connected = false;
+		this.lifecyclePhase = "stopping";
+		this.stopCount += 1;
+		await session.stop();
+	}
+	waitForRetry(failures, generation) {
+		if (!this.current(generation)) return Promise.resolve();
+		const delay = Math.min(RETRY_BASE_DELAY_MS * 2 ** Math.min(failures - 1, 10), RETRY_MAX_DELAY_MS);
+		return new Promise((resolve) => {
+			const finish = () => {
+				if (this.retryTimer === timer) this.retryTimer = void 0;
+				if (this.resolveRetry === finish) this.resolveRetry = void 0;
+				resolve();
+			};
+			const timer = setTimeout(finish, delay);
+			this.retryTimer = timer;
+			this.resolveRetry = finish;
+		});
+	}
+	wakeRetry() {
+		const timer = this.retryTimer;
+		if (timer !== void 0) clearTimeout(timer);
+		this.resolveRetry?.();
+	}
+};
+//#endregion
+//#region lib/types/profile-state.js
+function assertProfileName(value, source) {
+	if (typeof value !== "string" || value.length === 0 || value.includes("/") || value.includes("\\") || value === "." || value === ".." || value === "node_modules") throw new TypeError(`awiki: ${source} supplied an invalid profile name`);
+	return value;
+}
+/** Resolve only profile identities supplied by an authoritative DSH service or Loader directory. */
+function resolveAwikiProfileName(ctx, dshHome) {
+	const desktopProfiles = ctx.get("desktopProfiles");
+	if (desktopProfiles !== void 0) return assertProfileName(desktopProfiles.current?.name, "desktopProfiles.current");
+	let profileDir;
+	try {
+		if (ctx.baseUrl === void 0) return void 0;
+		const baseUrl = new URL(ctx.baseUrl);
+		if (baseUrl.protocol !== "file:") return void 0;
+		profileDir = resolve(fileURLToPath(baseUrl));
+	} catch {
+		return;
+	}
+	const profilesDir = resolve(dshHome, "profiles");
+	if (dirname(profileDir) !== profilesDir) return void 0;
+	return assertProfileName(basename(profileDir), "Loader profile directory");
+}
+/** Preserve the historical fallback while isolating desktop/CLI profiles at the Host boundary. */
+function resolveAwikiStateRoot(ctx, dshHome) {
+	const profileName = resolveAwikiProfileName(ctx, dshHome);
+	return profileName === void 0 ? join(dshHome, "awiki", "im-core") : join(dshHome, "awiki", profileName, "im-core");
+}
+//#endregion
+//#region lib/types/tenant-registry.js
+/** Host-owned durable AWiki tenant catalog and storage-scope migration. */
+const AWIKI_TENANT_REGISTRY_SCHEMA_VERSION = 1;
+const AWIKI_OFFICIAL_CATALOG_VERSION = 2;
+const AWIKI_PRIMARY_TENANT_ID = "builtin-primary";
+const AWIKI_SECONDARY_TENANT_ID = "builtin-secondary";
+/** Compatibility aliases for existing callers; the persisted IDs are generic slots. */
+const AWIKI_CHINA_TENANT_ID = AWIKI_PRIMARY_TENANT_ID;
+const AWIKI_GLOBAL_TENANT_ID = AWIKI_SECONDARY_TENANT_ID;
+const OFFICIALS = ["primary", "secondary"].map((slot) => {
+	const configured = AWIKI_BUILTIN_TENANT_CONFIG.tenants[slot];
+	return {
+		slot,
+		tenantId: slot === "primary" ? AWIKI_PRIMARY_TENANT_ID : AWIKI_SECONDARY_TENANT_ID,
+		legacyTenantId: slot === "primary" ? "official-china" : "official-global",
+		storageScopeId: `builtin-${slot}-v1`,
+		displayName: configured.displayName["zh-CN"],
+		backendOrigin: configured.backendOrigin,
+		didHost: configured.didHost
+	};
+});
+/** Immutable snapshot of the DSH endpoint defaults shipped before tenant registries existed. */
+const PRE_REGISTRY_DEFAULT_DOMAIN = "awiki.info";
+const PRE_REGISTRY_DEFAULT_ENDPOINTS = endpointsForOrigin(`https://${PRE_REGISTRY_DEFAULT_DOMAIN}`, PRE_REGISTRY_DEFAULT_DOMAIN);
+function registryFilePath(baseStateRoot) {
+	return join(dirname(baseStateRoot), `${basename(baseStateRoot)}.tenant-registry.json`);
+}
+function endpointsForOrigin(origin, domain) {
+	return {
+		userServiceUrl: origin,
+		messageServiceUrl: origin,
+		mailServiceUrl: origin,
+		messageServicePublicUrl: origin,
+		messageServiceDid: `did:wba:${domain}`
+	};
+}
+function officialProfile(entry) {
+	return {
+		tenantId: entry.tenantId,
+		storageScopeId: entry.storageScopeId,
+		kind: "built_in",
+		displayName: entry.displayName,
+		backendBaseUrl: entry.backendOrigin,
+		didHost: entry.didHost,
+		lifecycle: "inactive",
+		storageLayout: "scope-v1",
+		endpoints: endpointsForOrigin(entry.backendOrigin, entry.didHost)
+	};
+}
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function safeString(value) {
+	return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function decodeEndpoints(value) {
+	if (!isRecord$1(value)) return void 0;
+	const userServiceUrl = safeString(value.userServiceUrl);
+	const messageServiceUrl = safeString(value.messageServiceUrl);
+	const mailServiceUrl = safeString(value.mailServiceUrl);
+	const messageServicePublicUrl = safeString(value.messageServicePublicUrl);
+	const messageServiceDid = safeString(value.messageServiceDid);
+	if (userServiceUrl === void 0 || messageServiceUrl === void 0 || mailServiceUrl === void 0 || messageServicePublicUrl === void 0 || messageServiceDid === void 0) return void 0;
+	return {
+		userServiceUrl,
+		messageServiceUrl,
+		mailServiceUrl,
+		messageServicePublicUrl,
+		messageServiceDid
+	};
+}
+function decodeTenant(value) {
+	if (!isRecord$1(value)) return void 0;
+	const tenantId = safeString(value.tenantId);
+	const storageScopeId = safeString(value.storageScopeId);
+	const displayName = safeString(value.displayName);
+	const backendBaseUrl = safeString(value.backendBaseUrl);
+	const didHost = safeString(value.didHost);
+	const endpoints = decodeEndpoints(value.endpoints);
+	if (tenantId === void 0 || storageScopeId === void 0 || displayName === void 0 || backendBaseUrl === void 0 || didHost === void 0 || endpoints === void 0 || value.kind !== "built_in" && value.kind !== "custom" || value.lifecycle !== "active" && value.lifecycle !== "inactive" && value.lifecycle !== "archived" || value.storageLayout !== "scope-v1" && value.storageLayout !== "legacy-base" && value.storageLayout !== "domain-v1") return;
+	return {
+		tenantId,
+		storageScopeId,
+		kind: value.kind,
+		displayName,
+		backendBaseUrl,
+		didHost,
+		lifecycle: value.lifecycle,
+		storageLayout: value.storageLayout,
+		endpoints
+	};
+}
+function decodeDocument(value) {
+	if (!isRecord$1(value) || value.schemaVersion !== 1 || !Number.isSafeInteger(value.officialCatalogVersion) || value.officialCatalogVersion < 1 || value.officialCatalogVersion > 2 || !Number.isSafeInteger(value.generation) || value.generation < 0 || typeof value.activeTenantId !== "string" || !Array.isArray(value.tenants)) return void 0;
+	const tenants = value.tenants.map(decodeTenant);
+	if (tenants.some((tenant) => tenant === void 0)) return void 0;
+	const complete = tenants;
+	if (new Set(complete.map((tenant) => tenant.tenantId)).size !== complete.length || new Set(complete.map((tenant) => tenant.storageScopeId)).size !== complete.length || !complete.some((tenant) => tenant.tenantId === value.activeTenantId && tenant.lifecycle === "active") || complete.filter((tenant) => tenant.lifecycle === "active").length !== 1) return void 0;
+	return {
+		schemaVersion: 1,
+		officialCatalogVersion: 2,
+		generation: value.generation,
+		activeTenantId: value.activeTenantId,
+		tenants: complete
+	};
+}
+function directoryHasData(path) {
+	try {
+		return statSync(path).isDirectory() && readdirSync(path).length > 0;
+	} catch {
+		return false;
+	}
+}
+function sameOfficialEndpoint(tenant, entry) {
+	const origin = entry.backendOrigin;
+	return tenant.didHost === entry.didHost || tenant.backendBaseUrl.replace(/\/$/u, "") === origin || tenant.endpoints.userServiceUrl.replace(/\/$/u, "") === origin;
+}
+function preservedTenantId(tenants, tenant) {
+	const base = `custom-${tenant.storageScopeId}`;
+	if (!tenants.some((candidate) => candidate.tenantId === base)) return base;
+	let suffix = 2;
+	while (tenants.some((candidate) => candidate.tenantId === `${base}-${suffix}`)) suffix += 1;
+	return `${base}-${suffix}`;
+}
+function activate(document, tenantId, generation) {
+	return {
+		...document,
+		generation,
+		activeTenantId: tenantId,
+		tenants: document.tenants.map((tenant) => ({
+			...tenant,
+			lifecycle: tenant.tenantId === tenantId ? "active" : tenant.lifecycle === "active" ? "inactive" : tenant.lifecycle
+		}))
+	};
+}
+function reconcileOfficials(document) {
+	const tenants = [...document.tenants];
+	let activeTenantId = document.activeTenantId;
+	for (const entry of OFFICIALS) {
+		let exactIndex = tenants.findIndex((tenant) => tenant.tenantId === entry.tenantId);
+		if (exactIndex >= 0) {
+			const current = tenants[exactIndex];
+			if (sameOfficialEndpoint(current, entry)) {
+				tenants[exactIndex] = {
+					...officialProfile(entry),
+					storageScopeId: current.storageScopeId,
+					storageLayout: current.storageLayout,
+					lifecycle: current.lifecycle
+				};
+				continue;
+			}
+			const preservedId = preservedTenantId(tenants, current);
+			tenants[exactIndex] = {
+				...current,
+				tenantId: preservedId,
+				kind: "custom"
+			};
+			if (activeTenantId === current.tenantId) activeTenantId = preservedId;
+			exactIndex = -1;
+		}
+		const legacyIndex = tenants.findIndex((tenant) => tenant.tenantId === entry.legacyTenantId);
+		if (legacyIndex >= 0) {
+			const current = tenants[legacyIndex];
+			if (sameOfficialEndpoint(current, entry)) {
+				tenants[legacyIndex] = {
+					...officialProfile(entry),
+					storageScopeId: current.storageScopeId,
+					storageLayout: current.storageLayout,
+					lifecycle: current.lifecycle
+				};
+				if (activeTenantId === current.tenantId) activeTenantId = entry.tenantId;
+				continue;
+			}
+			tenants[legacyIndex] = {
+				...current,
+				kind: "custom"
+			};
+		}
+		const endpointIndex = tenants.findIndex((tenant) => sameOfficialEndpoint(tenant, entry));
+		if (endpointIndex >= 0) {
+			const current = tenants[endpointIndex];
+			tenants[endpointIndex] = {
+				...officialProfile(entry),
+				storageScopeId: current.storageScopeId,
+				storageLayout: current.storageLayout,
+				lifecycle: current.lifecycle
+			};
+			if (activeTenantId === current.tenantId) activeTenantId = entry.tenantId;
+		} else tenants.push(officialProfile(entry));
+	}
+	return activate({
+		...document,
+		officialCatalogVersion: 2,
+		activeTenantId,
+		tenants
+	}, activeTenantId, document.generation);
+}
+function cloneDocument(document) {
+	return structuredClone(document);
+}
+/** Durable registry. All mutations are synchronous, backup-aware, and atomic. */
+var AwikiTenantRegistry = class AwikiTenantRegistry {
+	baseStateRoot;
+	filePath;
+	backupPath;
+	diagnosticPath;
+	document;
+	persistent;
+	constructor(baseStateRoot, document, persistent) {
+		this.baseStateRoot = baseStateRoot;
+		this.filePath = registryFilePath(baseStateRoot);
+		this.backupPath = `${this.filePath}.pre-v1.bak`;
+		this.diagnosticPath = `${this.filePath}.migration-error.txt`;
+		this.document = document;
+		this.persistent = persistent;
+	}
+	static open(baseStateRoot, seed) {
+		const filePath = registryFilePath(baseStateRoot);
+		if (existsSync(filePath)) try {
+			const decoded = decodeDocument(JSON.parse(readFileSync(filePath, "utf8")));
+			if (decoded === void 0) throw new Error("registry schema or invariants are invalid");
+			const registry = new AwikiTenantRegistry(baseStateRoot, reconcileOfficials(decoded), true);
+			if (JSON.stringify(decoded) !== JSON.stringify(registry.document)) registry.persist(true);
+			return registry;
 		} catch (error) {
-			this.logger.warn("AWiki realtime post-sync consumer failed: %s", error instanceof Error ? error.message : "unknown failure");
+			const diagnostic = `AWiki tenant registry was not migrated: ${error instanceof Error ? error.message : "unknown error"}\n`;
+			mkdirSync(dirname(filePath), { recursive: true });
+			writeFileSync(`${filePath}.migration-error.txt`, diagnostic, {
+				encoding: "utf8",
+				mode: 384
+			});
+			return new AwikiTenantRegistry(baseStateRoot, legacyDocument(seed, !seed.configured), false);
 		}
+		const hasLegacyData = directoryHasData(baseStateRoot);
+		const document = seed.configured || hasLegacyData ? legacyDocument(seed, hasLegacyData && !seed.configured) : freshDocument();
+		const registry = new AwikiTenantRegistry(baseStateRoot, document, true);
+		registry.persist(false);
+		return registry;
 	}
-	observeConnection(event) {
-		if (event.kind !== "connection_state_changed") return;
-		this.connected = event.state === "connected";
-		if (this.connected) {
-			this.lifecyclePhase = "connected";
-			this.lastConnectedAtMs = Date.now();
-			this.lastFailureCode = void 0;
+	snapshot(switching = false) {
+		return {
+			...cloneDocument(this.document),
+			switching,
+			...this.persistent ? {} : { diagnostic: this.diagnosticPath }
+		};
+	}
+	active() {
+		const tenant = this.document.tenants.find((candidate) => candidate.tenantId === this.document.activeTenantId);
+		if (tenant === void 0) throw new Error("awiki: active tenant is unavailable");
+		return structuredClone(tenant);
+	}
+	find(tenantId) {
+		const tenant = this.document.tenants.find((candidate) => candidate.tenantId === tenantId);
+		return tenant === void 0 ? void 0 : structuredClone(tenant);
+	}
+	stateRoot(tenant) {
+		if (tenant.storageLayout === "legacy-base") return this.baseStateRoot;
+		if (tenant.storageLayout === "domain-v1") return join(dirname(this.baseStateRoot), "tenants", tenant.didHost, basename(this.baseStateRoot));
+		return join(dirname(this.baseStateRoot), "tenant-scopes", tenant.storageScopeId, basename(this.baseStateRoot));
+	}
+	createCustom(displayName, rawDomain) {
+		const domain = normalizeAwikiDomain(rawDomain);
+		const name = displayName.trim();
+		if (name.length === 0 || Array.from(name).length > 80) throw new TypeError("awiki: tenant name is required and must not exceed 80 characters");
+		if (this.document.tenants.some((tenant) => tenant.didHost === domain || tenant.backendBaseUrl === `https://${domain}`)) throw new Error("awiki: a tenant with this endpoint already exists");
+		const tenant = {
+			tenantId: randomUUID(),
+			storageScopeId: randomUUID(),
+			kind: "custom",
+			displayName: name,
+			backendBaseUrl: `https://${domain}`,
+			didHost: domain,
+			lifecycle: "inactive",
+			storageLayout: "scope-v1",
+			endpoints: endpointsForOrigin(`https://${domain}`, domain)
+		};
+		this.document = {
+			...this.document,
+			tenants: [...this.document.tenants, tenant]
+		};
+		this.persist(true);
+		return structuredClone(tenant);
+	}
+	renameCustom(tenantId, displayName) {
+		const name = displayName.trim();
+		if (name.length === 0 || Array.from(name).length > 80) throw new TypeError("awiki: tenant name is required and must not exceed 80 characters");
+		const current = this.find(tenantId);
+		if (current === void 0) throw new Error("awiki: tenant does not exist");
+		if (current.kind === "built_in") throw new Error("awiki: official tenants cannot be modified");
+		const updated = {
+			...current,
+			displayName: name
+		};
+		this.document = {
+			...this.document,
+			tenants: this.document.tenants.map((tenant) => tenant.tenantId === tenantId ? updated : tenant)
+		};
+		this.persist(true);
+		return structuredClone(updated);
+	}
+	archiveCustom(tenantId) {
+		const current = this.find(tenantId);
+		if (current === void 0) throw new Error("awiki: tenant does not exist");
+		if (current.kind === "built_in") throw new Error("awiki: official tenants cannot be archived");
+		if (current.lifecycle === "active") throw new Error("awiki: switch away before archiving this tenant");
+		this.document = {
+			...this.document,
+			tenants: this.document.tenants.map((tenant) => tenant.tenantId === tenantId ? {
+				...tenant,
+				lifecycle: "archived"
+			} : tenant)
+		};
+		this.persist(true);
+	}
+	commitActive(tenantId) {
+		const target = this.document.tenants.find((tenant) => tenant.tenantId === tenantId);
+		if (target === void 0 || target.lifecycle === "archived") throw new Error("awiki: target tenant is unavailable");
+		const previous = this.document;
+		this.document = activate(previous, tenantId, previous.generation + 1);
+		try {
+			this.persist(true);
+		} catch (error) {
+			this.document = previous;
+			throw error;
 		}
+		return cloneDocument(this.document);
 	}
-	async stopSession(session) {
-		if (this.stoppedSessions.has(session)) return;
-		this.stoppedSessions.add(session);
-		if (this.activeSession === session) this.activeSession = void 0;
-		this.connected = false;
-		this.lifecyclePhase = "stopping";
-		this.stopCount += 1;
-		await session.stop();
+	persist(backup) {
+		if (!this.persistent) throw new Error("awiki: tenant registry is read-only until its migration diagnostic is resolved");
+		mkdirSync(dirname(this.filePath), { recursive: true });
+		if (backup && existsSync(this.filePath) && !existsSync(this.backupPath)) copyFileSync(this.filePath, this.backupPath);
+		const temporary = `${this.filePath}.${process.pid}.${randomUUID()}.tmp`;
+		writeFileSync(temporary, `${JSON.stringify(this.document, null, 2)}\n`, {
+			encoding: "utf8",
+			mode: 384
+		});
+		renameSync(temporary, this.filePath);
 	}
-	waitForRetry(failures, generation) {
-		if (!this.current(generation)) return Promise.resolve();
-		const delay = Math.min(RETRY_BASE_DELAY_MS * 2 ** Math.min(failures - 1, 10), RETRY_MAX_DELAY_MS);
-		return new Promise((resolve) => {
-			const finish = () => {
-				if (this.retryTimer === timer) this.retryTimer = void 0;
-				if (this.resolveRetry === finish) this.resolveRetry = void 0;
-				resolve();
+};
+function freshDocument() {
+	const tenants = OFFICIALS.map(officialProfile);
+	const activeTenantId = AWIKI_BUILTIN_TENANT_CONFIG.defaultSlot === "primary" ? AWIKI_PRIMARY_TENANT_ID : AWIKI_SECONDARY_TENANT_ID;
+	return activate({
+		schemaVersion: 1,
+		officialCatalogVersion: 2,
+		generation: 0,
+		activeTenantId,
+		tenants
+	}, activeTenantId, 0);
+}
+function legacyDocument(seed, usePreRegistryDefault) {
+	const selectedSlot = seed.legacyTenantSlot;
+	const selectedEntry = selectedSlot === void 0 ? void 0 : OFFICIALS.find((candidate) => candidate.slot === selectedSlot);
+	const historicalSeed = usePreRegistryDefault && selectedEntry === void 0 ? {
+		...seed,
+		domain: PRE_REGISTRY_DEFAULT_DOMAIN,
+		...PRE_REGISTRY_DEFAULT_ENDPOINTS
+	} : seed;
+	const domain = selectedEntry?.didHost ?? normalizeAwikiDomain(historicalSeed.domain);
+	const entry = selectedEntry ?? OFFICIALS.find((candidate) => candidate.didHost === domain);
+	const endpoints = selectedEntry === void 0 ? {
+		userServiceUrl: historicalSeed.userServiceUrl,
+		messageServiceUrl: historicalSeed.messageServiceUrl,
+		mailServiceUrl: historicalSeed.mailServiceUrl,
+		messageServicePublicUrl: historicalSeed.messageServicePublicUrl,
+		messageServiceDid: historicalSeed.messageServiceDid
+	} : endpointsForOrigin(selectedEntry.backendOrigin, selectedEntry.didHost);
+	const tenant = entry === void 0 ? {
+		tenantId: randomUUID(),
+		storageScopeId: randomUUID(),
+		kind: "custom",
+		displayName: domain,
+		backendBaseUrl: historicalSeed.userServiceUrl,
+		didHost: domain,
+		lifecycle: "active",
+		storageLayout: "legacy-base",
+		endpoints
+	} : {
+		...officialProfile(entry),
+		storageScopeId: randomUUID(),
+		lifecycle: "active",
+		storageLayout: "legacy-base",
+		endpoints
+	};
+	return reconcileOfficials({
+		schemaVersion: 1,
+		officialCatalogVersion: 2,
+		generation: 0,
+		activeTenantId: tenant.tenantId,
+		tenants: [tenant]
+	});
+}
+//#endregion
+//#region lib/types/package-version.generated.js
+/** Generated from package.json by scripts/sync-package-versions.mjs. */
+const DSH_AWIKI_PACKAGE_VERSION = "0.3.10";
+const DSH_AWIKI_MODEL_PROXY_PACKAGE_VERSION = "0.1.6";
+//#endregion
+//#region lib/types/update-policy.js
+/** Tenant-scoped DSH AWiki plugin update policy and verified cache. */
+const DSH_AWIKI_VERSION = DSH_AWIKI_PACKAGE_VERSION;
+const DSH_AWIKI_MODEL_PROXY_VERSION = DSH_AWIKI_MODEL_PROXY_PACKAGE_VERSION;
+const PRODUCT = "dsh-awiki";
+const CHANNEL = "stable";
+const MAX_POLICY_BYTES = 1048576;
+/** Load only this tenant's verified cache before its business runtime starts. */
+function readAwikiUpdatePolicyStatus(options) {
+	const origin = new URL(options.tenant.backendBaseUrl).origin;
+	const base = {
+		tenantId: options.tenant.tenantId,
+		policyOrigin: origin,
+		tenantGeneration: options.generation,
+		currentPluginVersion: options.currentPluginVersion ?? DSH_AWIKI_VERSION,
+		...options.currentModelProxyVersion === void 0 ? {} : { currentModelProxyVersion: options.currentModelProxyVersion }
+	};
+	const cached = readCache(policyCachePath(options.stateRoot, options.tenant.tenantId, origin), origin);
+	return cached === void 0 ? {
+		...base,
+		checkState: "unchecked",
+		offline: false,
+		usedCache: false,
+		policyUnavailable: true,
+		restricted: false,
+		modelProxyRestricted: false
+	} : statusFromPolicy(base, cached.policy, cached.checkedAt, false, true);
+}
+async function checkAwikiUpdatePolicy(options) {
+	const origin = new URL(options.tenant.backendBaseUrl).origin;
+	assertPolicyOrigin(origin, options.allowInsecureLoopback === true);
+	const cachePath = policyCachePath(options.stateRoot, options.tenant.tenantId, origin);
+	const cached = readCache(cachePath, origin);
+	const currentPluginVersion = options.currentPluginVersion ?? DSH_AWIKI_VERSION;
+	const base = {
+		tenantId: options.tenant.tenantId,
+		policyOrigin: origin,
+		tenantGeneration: options.generation,
+		currentPluginVersion,
+		...options.currentModelProxyVersion === void 0 ? {} : { currentModelProxyVersion: options.currentModelProxyVersion }
+	};
+	const timeout = AbortSignal.timeout(options.timeoutMs ?? 15e3);
+	const signal = options.signal === void 0 ? timeout : AbortSignal.any([options.signal, timeout]);
+	const bounded = async (operation) => {
+		signal.throwIfAborted();
+		let abort;
+		const cancelled = new Promise((_, reject) => {
+			abort = () => {
+				reject(signal.reason);
 			};
-			const timer = setTimeout(finish, delay);
-			this.retryTimer = timer;
-			this.resolveRetry = finish;
+			signal.addEventListener("abort", abort, { once: true });
 		});
+		try {
+			return await Promise.race([operation, cancelled]);
+		} finally {
+			signal.removeEventListener("abort", abort);
+		}
+	};
+	try {
+		signal.throwIfAborted();
+		const endpoint = new URL("/user-service/v1/server-info", origin);
+		endpoint.searchParams.set("client_platform", "dsh");
+		const response = await bounded((options.fetcher ?? fetch)(endpoint, {
+			method: "GET",
+			headers: {
+				accept: "application/json",
+				"cache-control": "no-store"
+			},
+			cache: "no-store",
+			redirect: "error",
+			signal
+		}));
+		signal.throwIfAborted();
+		if (response.status === 404 && options.tenant.kind === "custom") {
+			rmSync(cachePath, { force: true });
+			return {
+				...base,
+				offline: false,
+				usedCache: false,
+				policyUnavailable: true,
+				checkState: "unavailable",
+				restricted: false,
+				modelProxyRestricted: false
+			};
+		}
+		if (response.redirected || response.url !== "" && new URL(response.url).origin !== origin) throw new Error("update policy response crossed its tenant origin");
+		if (!response.ok) throw new Error(`policy status ${response.status}`);
+		const bytes = await bounded(readPolicyBody(response));
+		signal.throwIfAborted();
+		if (bytes.byteLength > MAX_POLICY_BYTES) throw new Error("policy response exceeds 1 MiB");
+		const policy = decodeServerInfoPolicy(JSON.parse(Buffer.from(bytes).toString("utf8")), origin, cached?.policy.policy_revision);
+		if (policy === void 0) {
+			rmSync(cachePath, { force: true });
+			return {
+				...base,
+				offline: false,
+				usedCache: false,
+				policyUnavailable: true,
+				checkState: "unavailable",
+				restricted: false,
+				modelProxyRestricted: false,
+				checkedAt: (/* @__PURE__ */ new Date()).toISOString()
+			};
+		}
+		if (cached !== void 0 && policy.policy_revision < cached.policy.policy_revision) throw new Error("policy revision moved backwards");
+		const checkedAt = (/* @__PURE__ */ new Date()).toISOString();
+		try {
+			writeCache(cachePath, {
+				checkedAt,
+				policy
+			});
+		} catch {}
+		return statusFromPolicy(base, policy, checkedAt, false, false);
+	} catch (error) {
+		if (options.signal?.aborted === true) throw error;
+		if (cached !== void 0) return {
+			...statusFromPolicy(base, cached.policy, cached.checkedAt, true, true),
+			checkState: "failed"
+		};
+		return {
+			...base,
+			offline: true,
+			usedCache: false,
+			policyUnavailable: true,
+			checkState: "failed",
+			restricted: false,
+			modelProxyRestricted: false
+		};
 	}
-	wakeRetry() {
-		const timer = this.retryTimer;
-		if (timer !== void 0) clearTimeout(timer);
-		this.resolveRetry?.();
+}
+async function readPolicyBody(response) {
+	const declaredLength = Number(response.headers.get("content-length"));
+	if (Number.isFinite(declaredLength) && declaredLength > MAX_POLICY_BYTES) throw new Error("policy response exceeds 1 MiB");
+	if (response.body === null) throw new Error("empty policy response");
+	const reader = response.body.getReader();
+	const chunks = [];
+	let length = 0;
+	try {
+		while (true) {
+			const { value, done } = await reader.read();
+			if (done) break;
+			length += value.byteLength;
+			if (length > MAX_POLICY_BYTES) {
+				await reader.cancel();
+				throw new Error("policy response exceeds 1 MiB");
+			}
+			chunks.push(value);
+		}
+	} finally {
+		reader.releaseLock();
 	}
-};
+	return Buffer.concat(chunks, length);
+}
+function statusFromPolicy(base, policy, checkedAt, offline, usedCache) {
+	const plugin = policy.packages.plugin;
+	const modelProxy = policy.packages.model_proxy;
+	const updateAvailable = compareVersions(base.currentPluginVersion, plugin.recommended_version) < 0 || modelProxy !== void 0 && base.currentModelProxyVersion !== void 0 && compareVersions(base.currentModelProxyVersion, modelProxy.recommended_version) < 0;
+	const command = upgradeCommand(base, plugin, modelProxy);
+	return {
+		...base,
+		checkState: "ready",
+		updateAvailable,
+		...command === void 0 ? {} : { upgradeCommand: command },
+		policyRevision: policy.policy_revision,
+		recommendedPluginVersion: plugin.recommended_version,
+		minimumPluginVersion: plugin.min_supported_version,
+		...modelProxy === void 0 ? {} : {
+			recommendedModelProxyVersion: modelProxy.recommended_version,
+			minimumModelProxyVersion: modelProxy.min_supported_version
+		},
+		releaseNotesUrl: policy.release_notes_url,
+		...plugin.installable === false ? {} : { pluginTarget: publicTarget(plugin) },
+		...modelProxy === void 0 || modelProxy.installable === false ? {} : { modelProxyTarget: publicTarget(modelProxy) },
+		offline,
+		usedCache,
+		policyUnavailable: false,
+		restricted: compareVersions(base.currentPluginVersion, plugin.min_supported_version) < 0,
+		modelProxyRestricted: modelProxy !== void 0 && base.currentModelProxyVersion !== void 0 && compareVersions(base.currentModelProxyVersion, modelProxy.min_supported_version) < 0,
+		checkedAt
+	};
+}
+/** Exact published targets only; never downgrade a newer installed component. */
+function upgradeCommand(current, plugin, proxy) {
+	const pluginUpgrade = compareVersions(current.currentPluginVersion, plugin.recommended_version) < 0;
+	const proxyUpgrade = proxy !== void 0 && current.currentModelProxyVersion !== void 0 && compareVersions(current.currentModelProxyVersion, proxy.recommended_version) < 0;
+	if (!pluginUpgrade && !proxyUpgrade || plugin.installable === false || current.currentModelProxyVersion !== void 0 && proxy?.installable === false) return void 0;
+	if (current.currentModelProxyVersion !== void 0 && (proxy === void 0 || compareVersions(current.currentModelProxyVersion, proxy.recommended_version) > 0)) return void 0;
+	const pluginVersion = pluginUpgrade ? plugin.recommended_version : current.currentPluginVersion;
+	if (current.currentModelProxyVersion !== void 0 && proxy?.requires_plugin !== void 0 && !satisfies(pluginVersion, proxy.requires_plugin, { includePrerelease: true })) return void 0;
+	return `dsh plugin add ${[pluginUpgrade ? `@awiki/dsh-plugin@${pluginVersion}` : void 0, proxyUpgrade ? `@awiki/dsh-model-proxy@${proxy.recommended_version}` : void 0].filter(Boolean).join(" ")}`;
+}
+function publicTarget(value) {
+	return {
+		name: value.name,
+		recommendedVersion: value.recommended_version,
+		minimumVersion: value.min_supported_version,
+		integrity: value.integrity,
+		...value.repository === void 0 ? {} : { repository: value.repository },
+		...value.requires_plugin === void 0 ? {} : { requiresPlugin: value.requires_plugin }
+	};
+}
+function decodePolicy(value, origin) {
+	if (!isRecord(value) || value.product !== PRODUCT || value.channel !== CHANNEL || value.policy_origin !== origin || !Number.isSafeInteger(value.policy_revision) || value.policy_revision < 1 || typeof value.published_at !== "string" || Number.isNaN(Date.parse(value.published_at)) || typeof value.release_notes_url !== "string" || !isRecord(value.packages)) throw new Error("invalid update policy");
+	const releaseNotes = value.release_notes_url === "" ? void 0 : new URL(value.release_notes_url);
+	if (releaseNotes !== void 0) assertPolicyOrigin(releaseNotes.origin, origin.startsWith("http://"));
+	const plugin = decodePackage(value.packages.plugin, "@awiki/dsh-plugin");
+	const modelProxy = value.packages.model_proxy === void 0 ? void 0 : decodePackage(value.packages.model_proxy, "@awiki/dsh-model-proxy");
+	if (compareVersions(plugin.min_supported_version, plugin.recommended_version) > 0 || modelProxy !== void 0 && compareVersions(modelProxy.min_supported_version, modelProxy.recommended_version) > 0) throw new Error("minimum version exceeds recommended version");
+	return {
+		product: PRODUCT,
+		channel: CHANNEL,
+		policy_origin: origin,
+		policy_revision: value.policy_revision,
+		published_at: value.published_at,
+		release_notes_url: releaseNotes?.toString() ?? "",
+		packages: {
+			plugin,
+			...modelProxy === void 0 ? {} : { model_proxy: modelProxy }
+		}
+	};
+}
+function decodeServerInfoPolicy(value, origin, minimumRevision = 0) {
+	if (!isRecord(value) || value.schema_version !== 1) throw new Error("invalid server-info");
+	const releases = value.client_versions;
+	if (!isRecord(releases) || releases.schema_version !== 1 || releases.channel !== CHANNEL || releases.policy_origin !== origin || !Number.isSafeInteger(releases.policy_revision) || releases.policy_revision < 1 || typeof releases.published_at !== "string" || Number.isNaN(Date.parse(releases.published_at)) || !isRecord(releases.products) || !isRecord(releases.products.dsh)) throw new Error("invalid client version policy");
+	if (releases.policy_revision < minimumRevision) throw new Error("policy revision moved backwards");
+	const product = releases.products.dsh;
+	if (product.enabled === false) {
+		if (product.compatibility === void 0 || product.compatibility === null) return void 0;
+		if (!isRecord(product.compatibility)) throw new Error("invalid DSH compatibility");
+		const component = (value, name) => {
+			if (!isRecord(value)) throw new Error("invalid DSH component compatibility");
+			return {
+				name,
+				recommended_version: value.recommended_version,
+				min_supported_version: value.minimum_supported_version,
+				installable: false
+			};
+		};
+		return decodePolicy({
+			product: PRODUCT,
+			channel: CHANNEL,
+			policy_origin: origin,
+			policy_revision: releases.policy_revision,
+			published_at: releases.published_at,
+			release_notes_url: product.release_notes_url ?? "",
+			packages: {
+				plugin: component(product.compatibility.plugin, "@awiki/dsh-plugin"),
+				...product.compatibility.model_proxy == null ? {} : { model_proxy: component(product.compatibility.model_proxy, "@awiki/dsh-model-proxy") }
+			}
+		}, origin);
+	}
+	if (product.enabled !== true || typeof product.release_notes_url !== "string" || !isRecord(product.plugin)) throw new Error("invalid DSH client version policy");
+	const plugin = decodeServerPackage(product.plugin, "@awiki/dsh-plugin");
+	const modelProxy = isRecord(product.model_proxy) && product.model_proxy.enabled === true ? decodeServerPackage(product.model_proxy, "@awiki/dsh-model-proxy") : void 0;
+	return decodePolicy({
+		product: PRODUCT,
+		channel: CHANNEL,
+		policy_origin: releases.policy_origin,
+		policy_revision: releases.policy_revision,
+		published_at: releases.published_at,
+		release_notes_url: product.release_notes_url,
+		packages: {
+			plugin,
+			...modelProxy === void 0 ? {} : { model_proxy: modelProxy }
+		}
+	}, origin);
+}
+function decodeServerPackage(value, expectedName) {
+	return decodePackage({
+		name: value.package_name,
+		recommended_version: value.recommended_version,
+		min_supported_version: value.minimum_supported_version,
+		integrity: value.integrity,
+		repository: value.repository === null ? void 0 : value.repository,
+		requires_plugin: value.requires_plugin === null ? void 0 : value.requires_plugin
+	}, expectedName);
+}
+function decodePackage(value, expectedName) {
+	if (!isRecord(value) || value.name !== expectedName || typeof value.recommended_version !== "string" || typeof value.min_supported_version !== "string" || value.installable !== false && (typeof value.integrity !== "string" || !/^sha512-[A-Za-z0-9+/]+={0,2}$/u.test(value.integrity)) || value.repository !== void 0 && typeof value.repository !== "string" || value.requires_plugin !== void 0 && typeof value.requires_plugin !== "string") throw new Error("invalid update package target");
+	assertVersion(value.recommended_version);
+	assertVersion(value.min_supported_version);
+	return {
+		name: value.name,
+		recommended_version: value.recommended_version,
+		min_supported_version: value.min_supported_version,
+		...value.installable === false ? { installable: false } : { integrity: value.integrity },
+		...value.repository === void 0 ? {} : { repository: value.repository },
+		...value.requires_plugin === void 0 ? {} : { requires_plugin: value.requires_plugin }
+	};
+}
+function policyCachePath(stateRoot, tenantId, origin) {
+	const key = createHash("sha256").update(`${tenantId}\n${origin}\n${PRODUCT}\n${CHANNEL}`, "utf8").digest("hex");
+	return join(stateRoot, "update-policy", `${key}.json`);
+}
+function readCache(path, origin) {
+	try {
+		const value = JSON.parse(readFileSync(path, "utf8"));
+		if (!isRecord(value) || typeof value.checkedAt !== "string") return void 0;
+		return {
+			checkedAt: value.checkedAt,
+			policy: decodePolicy(value.policy, origin)
+		};
+	} catch {
+		return;
+	}
+}
+function writeCache(path, value) {
+	mkdirSync(dirname(path), {
+		recursive: true,
+		mode: 448
+	});
+	const temporary = `${path}.tmp-${process.pid}`;
+	writeFileSync(temporary, `${JSON.stringify(value, void 0, 2)}\n`, { mode: 384 });
+	renameSync(temporary, path);
+}
+function assertPolicyOrigin(origin, allowLoopback) {
+	const url = new URL(origin);
+	if (url.protocol === "https:") return;
+	if (allowLoopback && url.protocol === "http:" && [
+		"localhost",
+		"127.0.0.1",
+		"[::1]"
+	].includes(url.hostname)) return;
+	throw new Error("update policy origin must use HTTPS");
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
 //#endregion
 //#region lib/types/index.js
-/** Unified AWiki identity, messaging, attachment, Remote, and model-tool service. */
 var __runInitializers = function(thisArg, initializers, value) {
 	var useValue = arguments.length > 2;
 	for (var i = 0; i < initializers.length; i++) value = useValue ? initializers[i].call(thisArg, value) : initializers[i].call(thisArg);
@@ -2231,10 +3553,10 @@ const DEFAULT_ATTACHMENT_MAX_BYTES = 10485760;
 const DEFAULT_IMAGE_ATTACHMENT_CACHE_MAX_BYTES = 67108864;
 /** Default browser polling interval while the AWiki drawer is open. */
 const DEFAULT_POLL_INTERVAL_MS = 3e3;
-/** Default AWiki production service origin. */
-const DEFAULT_AWIKI_SERVICE_URL = "https://awiki.ai";
-/** Default authoritative AWiki message-service DID. */
-const DEFAULT_AWIKI_MESSAGE_SERVICE_DID = "did:wba:awiki.ai";
+/** Package-configured primary AWiki service origin. */
+const DEFAULT_AWIKI_SERVICE_URL = AWIKI_DEFAULT_BUILTIN_TENANT.backendOrigin;
+/** Package-configured primary authoritative AWiki message-service DID. */
+const DEFAULT_AWIKI_MESSAGE_SERVICE_DID = `did:wba:${AWIKI_DEFAULT_BUILTIN_TENANT.didHost}`;
 /** Host-owned model input cap after message minimization. */
 const DEFAULT_SUMMARY_MAX_INPUT_BYTES = 32768;
 /** Hard limit for one user-triggered conversation summary. */
@@ -2243,6 +3565,7 @@ const MAX_SUMMARY_MESSAGES = 50;
 const Config = z.object({
 	userServiceUrl: z.string().default(DEFAULT_AWIKI_SERVICE_URL),
 	userServiceDomain: z.string().default(DEFAULT_AWIKI_DOMAIN),
+	legacyTenantSlot: z.string(),
 	messageServiceUrl: z.string().default(DEFAULT_AWIKI_SERVICE_URL),
 	mailServiceUrl: z.string(),
 	messageServicePublicUrl: z.string().default(DEFAULT_AWIKI_SERVICE_URL),
@@ -2260,6 +3583,7 @@ const Config = z.object({
 	summaryMaxInputBytes: z.number().default(DEFAULT_SUMMARY_MAX_INPUT_BYTES)
 });
 const FAILURE_CODES = /* @__PURE__ */ new Set([
+	"client-version-unsupported",
 	"not-registered",
 	"signed-out",
 	"already-registered",
@@ -2269,6 +3593,7 @@ const FAILURE_CODES = /* @__PURE__ */ new Set([
 	"handle-unavailable",
 	"not-found",
 	"forbidden",
+	"device-rejoin-required",
 	"identity-recovery-required",
 	"conflict",
 	"rate-limited",
@@ -2292,10 +3617,10 @@ const RESUMABLE_JOIN_PHASES = /* @__PURE__ */ new Set([
 	"challenge_prepared",
 	"response_prepared",
 	"response_verified",
-	"approval_prepared",
-	"authorized"
+	"approval_prepared"
 ]);
 const FAILURE_MESSAGES = {
+	"client-version-unsupported": "This AWiki plugin version is not supported by the active tenant. Update the plugin or switch tenants.",
 	"not-registered": "No AWiki identity is registered for this deployment.",
 	"signed-out": "This installation is signed out of AWiki.",
 	"already-registered": "This deployment already has an AWiki identity.",
@@ -2305,6 +3630,7 @@ const FAILURE_MESSAGES = {
 	"handle-unavailable": "The requested AWiki handle is unavailable.",
 	"not-found": "The requested AWiki resource was not found.",
 	"forbidden": "The AWiki operation is not permitted.",
+	"device-rejoin-required": "This device credential was revoked and must join the Handle again.",
 	"identity-recovery-required": "The local AWiki identity must be recovered before it can be used again.",
 	"conflict": "The AWiki operation conflicts with current state.",
 	"rate-limited": "The AWiki service rate-limited the request.",
@@ -2368,29 +3694,19 @@ function serviceUrl(field, raw, allowInsecureLoopbackForTesting) {
 	if (url.username !== "" || url.password !== "" || url.hash !== "") throw new TypeError(`awiki: ${field} must not contain credentials or a URL fragment`);
 	return raw;
 }
-/** Resolve the only supported post-recovery endpoint without accepting URL-carried state. */
-function recoveryReconciliationEndpoint(target, allowInsecureLoopbackForTesting) {
-	if (target?.kind !== "model-proxy-v1" || typeof target.baseURL !== "string") throw new TypeError("awiki: recovery reconciliation target is invalid");
-	const baseURL = serviceUrl("recoveryReconciliationTarget.baseURL", target.baseURL, allowInsecureLoopbackForTesting);
-	const parsed = new URL(baseURL);
-	if (parsed.search !== "") throw new TypeError("awiki: recovery reconciliation target must not contain a query");
-	return new URL("/api/identity-recovery", parsed).toString();
-}
-/** Accept only the closed Model Proxy success response; no ledger identifier may cross back. */
-async function acceptsRecoveryReconciliation(response) {
-	if (!response.ok) return false;
-	let value;
+function publishedServiceBaseUrl(services, name, allowInsecureLoopbackForTesting) {
+	if (typeof services !== "object" || services === null || Array.isArray(services)) return void 0;
+	const candidate = services[name];
+	if (typeof candidate !== "object" || candidate === null || Array.isArray(candidate)) return void 0;
+	const value = candidate;
+	if (value.enabled !== true || typeof value.base_url !== "string") return void 0;
 	try {
-		const text = await readBoundedResponseText(response, RECOVERY_RECONCILIATION_RESPONSE_MAX_BYTES);
-		if (text === void 0) return false;
-		value = JSON.parse(text);
+		const baseUrl = serviceUrl(`server-info.services.${name}.base_url`, value.base_url, allowInsecureLoopbackForTesting);
+		if (new URL(baseUrl).search !== "") return void 0;
+		return baseUrl;
 	} catch {
-		return false;
+		return;
 	}
-	if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
-	const result = value;
-	const keys = Object.keys(result).sort();
-	return keys.length === 2 && keys[0] === "idempotent" && keys[1] === "restored" && result.restored === true && typeof result.idempotent === "boolean";
 }
 /** Validate a provider domain without inferring it from an API endpoint. */
 function serviceDomain(raw, field = "userServiceDomain") {
@@ -2425,12 +3741,12 @@ function listenerAllowedPeers(raw, enabled) {
 	return peers;
 }
 /** Resolve and validate every deployment choice before publishing the service. */
-function resolveConfig(config) {
+function resolveConfig(ctx, config) {
 	const allowInsecureLoopbackForTesting = config.allowInsecureLoopbackForTesting ?? false;
 	const configuredStateRoot = config.stateRoot?.trim();
 	const configuredDshHome = process.env.DSH_HOME?.trim();
 	const dshHome = configuredDshHome === void 0 || configuredDshHome.length === 0 ? join(homedir(), ".dsh") : configuredDshHome;
-	const stateRoot = configuredStateRoot === void 0 || configuredStateRoot.length === 0 ? join(dshHome, "awiki", "im-core") : configuredStateRoot;
+	const stateRoot = configuredStateRoot === void 0 || configuredStateRoot.length === 0 ? resolveAwikiStateRoot(ctx, dshHome) : configuredStateRoot;
 	if (!isAbsolute(stateRoot)) throw new TypeError("awiki: stateRoot must be an absolute path");
 	const attachmentMaxBytes = config.attachmentMaxBytes ?? 10485760;
 	if (!Number.isSafeInteger(attachmentMaxBytes) || attachmentMaxBytes < 1) throw new TypeError("awiki: attachmentMaxBytes must be a positive safe integer");
@@ -2446,17 +3762,20 @@ function resolveConfig(config) {
 	const allowedPeers = listenerAllowedPeers(config.listenerAllowedPeers, listenerEnabled);
 	const summaryMaxInputBytes = config.summaryMaxInputBytes ?? 32768;
 	if (!Number.isSafeInteger(summaryMaxInputBytes) || summaryMaxInputBytes < 1024) throw new TypeError("awiki: summaryMaxInputBytes must be a safe integer of at least 1024");
-	const userServiceUrl = serviceUrl("userServiceUrl", config.userServiceUrl ?? "https://awiki.ai", allowInsecureLoopbackForTesting);
-	const messageServiceUrl = serviceUrl("messageServiceUrl", config.messageServiceUrl ?? "https://awiki.ai", allowInsecureLoopbackForTesting);
+	const userServiceUrl = serviceUrl("userServiceUrl", config.userServiceUrl ?? DEFAULT_AWIKI_SERVICE_URL, allowInsecureLoopbackForTesting);
+	const messageServiceUrl = serviceUrl("messageServiceUrl", config.messageServiceUrl ?? DEFAULT_AWIKI_SERVICE_URL, allowInsecureLoopbackForTesting);
 	const mailServiceUrl = serviceUrl("mailServiceUrl", config.mailServiceUrl ?? userServiceUrl, allowInsecureLoopbackForTesting);
-	const messageServicePublicUrl = serviceUrl("messageServicePublicUrl", config.messageServicePublicUrl ?? "https://awiki.ai", allowInsecureLoopbackForTesting);
+	const messageServicePublicUrl = serviceUrl("messageServicePublicUrl", config.messageServicePublicUrl ?? DEFAULT_AWIKI_SERVICE_URL, allowInsecureLoopbackForTesting);
+	const legacyTenantSlot = config.legacyTenantSlot?.trim();
+	if (legacyTenantSlot !== void 0 && legacyTenantSlot !== "primary" && legacyTenantSlot !== "secondary") throw new TypeError("awiki: legacyTenantSlot must be primary or secondary");
 	return {
 		userServiceUrl,
-		userServiceDomain: serviceDomain(config.userServiceDomain ?? "awiki.ai"),
+		userServiceDomain: serviceDomain(config.userServiceDomain ?? DEFAULT_AWIKI_DOMAIN),
+		...legacyTenantSlot === void 0 ? {} : { legacyTenantSlot },
 		messageServiceUrl,
 		mailServiceUrl,
 		messageServicePublicUrl,
-		messageServiceDid: serviceDid(config.messageServiceDid ?? "did:wba:awiki.ai"),
+		messageServiceDid: serviceDid(config.messageServiceDid ?? DEFAULT_AWIKI_MESSAGE_SERVICE_DID),
 		allowedAttachmentOrigins: attachmentOrigins(config.allowedAttachmentOrigins, messageServicePublicUrl, allowInsecureLoopbackForTesting),
 		allowInsecureLoopbackForTesting,
 		stateRoot,
@@ -2480,6 +3799,15 @@ function failure(code) {
 		message: FAILURE_MESSAGES[code]
 	};
 }
+function integrationUnavailable() {
+	return {
+		ok: false,
+		error: {
+			code: "unavailable",
+			message: "Guest messaging is not available for the active AWiki tenant."
+		}
+	};
+}
 /** Normalize SDK and provider failures without returning remote bodies, credentials, or causes. */
 function normalizeFailure(error) {
 	if (error instanceof ProviderUnavailableError) return {
@@ -2583,7 +3911,6 @@ function normalizeRecoveryPrepareRequest(request) {
 }
 const IDENTITY_ACCESS_RESPONSE_MAX_BYTES = 65536;
 const SERVER_INFO_RESPONSE_MAX_BYTES = 65536;
-const RECOVERY_RECONCILIATION_RESPONSE_MAX_BYTES = 4096;
 /** Read one untrusted discovery response without buffering beyond the fixed Host limit. */
 async function readBoundedResponseText(response, maxBytes) {
 	const declaredLength = response.headers.get("content-length");
@@ -2794,6 +4121,12 @@ let AwikiService = (() => {
 	let _classSuper = TypertRemoteService;
 	let _instanceExtraInitializers = [];
 	let _getConfig_decorators;
+	let _getIntegration_decorators;
+	let _createIntegration_decorators;
+	let _updateIntegration_decorators;
+	let _rotateIntegrationId_decorators;
+	let _closeIntegration_decorators;
+	let _reopenIntegration_decorators;
 	let _getIdentity_decorators;
 	let _getSession_decorators;
 	let _logout_decorators;
@@ -2801,7 +4134,9 @@ let AwikiService = (() => {
 	let _inspectIdentityAccess_decorators;
 	let _sendRegistrationOtp_decorators;
 	let _registerIdentity_decorators;
+	let _retireDeviceIdentityForRejoin_decorators;
 	let _beginDeviceJoin_decorators;
+	let _getIdentityAccessState_decorators;
 	let _getDeviceJoinStatus_decorators;
 	let _cancelDeviceJoin_decorators;
 	let _refreshDeviceManagement_decorators;
@@ -2809,6 +4144,8 @@ let AwikiService = (() => {
 	let _approveDeviceJoin_decorators;
 	let _rejectDeviceJoin_decorators;
 	let _revokeDevice_decorators;
+	let _prepareRootTransfer_decorators;
+	let _confirmRootTransfer_decorators;
 	let _updateDisplayName_decorators;
 	let _getProfile_decorators;
 	let _updateProfile_decorators;
@@ -2817,12 +4154,14 @@ let AwikiService = (() => {
 	let _activateRecovery_decorators;
 	let _getRecoveryStatus_decorators;
 	let _resumeRecovery_decorators;
+	let _enterRecoveredSession_decorators;
 	let _discardRecovery_decorators;
 	let _resolvePeer_decorators;
 	let _createGroup_decorators;
 	let _getGroup_decorators;
 	let _joinGroup_decorators;
 	let _leaveGroup_decorators;
+	let _getDisplayProfiles_decorators;
 	let _listGroupMembers_decorators;
 	let _addGroupMember_decorators;
 	let _removeGroupMember_decorators;
@@ -2846,6 +4185,12 @@ let AwikiService = (() => {
 		static {
 			const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
 			_getConfig_decorators = [Remote];
+			_getIntegration_decorators = [Remote];
+			_createIntegration_decorators = [Remote];
+			_updateIntegration_decorators = [Remote];
+			_rotateIntegrationId_decorators = [Remote];
+			_closeIntegration_decorators = [Remote];
+			_reopenIntegration_decorators = [Remote];
 			_getIdentity_decorators = [Remote];
 			_getSession_decorators = [Remote];
 			_logout_decorators = [Remote];
@@ -2853,7 +4198,9 @@ let AwikiService = (() => {
 			_inspectIdentityAccess_decorators = [Remote];
 			_sendRegistrationOtp_decorators = [Remote];
 			_registerIdentity_decorators = [Remote];
+			_retireDeviceIdentityForRejoin_decorators = [Remote];
 			_beginDeviceJoin_decorators = [Remote];
+			_getIdentityAccessState_decorators = [Remote];
 			_getDeviceJoinStatus_decorators = [Remote];
 			_cancelDeviceJoin_decorators = [Remote];
 			_refreshDeviceManagement_decorators = [Remote];
@@ -2861,6 +4208,8 @@ let AwikiService = (() => {
 			_approveDeviceJoin_decorators = [Remote];
 			_rejectDeviceJoin_decorators = [Remote];
 			_revokeDevice_decorators = [Remote];
+			_prepareRootTransfer_decorators = [Remote];
+			_confirmRootTransfer_decorators = [Remote];
 			_updateDisplayName_decorators = [Remote];
 			_getProfile_decorators = [Remote];
 			_updateProfile_decorators = [Remote];
@@ -2869,12 +4218,14 @@ let AwikiService = (() => {
 			_activateRecovery_decorators = [Remote];
 			_getRecoveryStatus_decorators = [Remote];
 			_resumeRecovery_decorators = [Remote];
+			_enterRecoveredSession_decorators = [Remote];
 			_discardRecovery_decorators = [Remote];
 			_resolvePeer_decorators = [Remote];
 			_createGroup_decorators = [Remote];
 			_getGroup_decorators = [Remote];
 			_joinGroup_decorators = [Remote];
 			_leaveGroup_decorators = [Remote];
+			_getDisplayProfiles_decorators = [Remote];
 			_listGroupMembers_decorators = [Remote];
 			_addGroupMember_decorators = [Remote];
 			_removeGroupMember_decorators = [Remote];
@@ -2905,6 +4256,72 @@ let AwikiService = (() => {
 				},
 				metadata: _metadata
 			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _getIntegration_decorators, {
+				kind: "method",
+				name: "getIntegration",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "getIntegration" in obj,
+					get: (obj) => obj.getIntegration
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _createIntegration_decorators, {
+				kind: "method",
+				name: "createIntegration",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "createIntegration" in obj,
+					get: (obj) => obj.createIntegration
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _updateIntegration_decorators, {
+				kind: "method",
+				name: "updateIntegration",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "updateIntegration" in obj,
+					get: (obj) => obj.updateIntegration
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _rotateIntegrationId_decorators, {
+				kind: "method",
+				name: "rotateIntegrationId",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "rotateIntegrationId" in obj,
+					get: (obj) => obj.rotateIntegrationId
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _closeIntegration_decorators, {
+				kind: "method",
+				name: "closeIntegration",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "closeIntegration" in obj,
+					get: (obj) => obj.closeIntegration
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _reopenIntegration_decorators, {
+				kind: "method",
+				name: "reopenIntegration",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "reopenIntegration" in obj,
+					get: (obj) => obj.reopenIntegration
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
 			__esDecorate(this, null, _getIdentity_decorators, {
 				kind: "method",
 				name: "getIdentity",
@@ -2982,6 +4399,17 @@ let AwikiService = (() => {
 				},
 				metadata: _metadata
 			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _retireDeviceIdentityForRejoin_decorators, {
+				kind: "method",
+				name: "retireDeviceIdentityForRejoin",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "retireDeviceIdentityForRejoin" in obj,
+					get: (obj) => obj.retireDeviceIdentityForRejoin
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
 			__esDecorate(this, null, _beginDeviceJoin_decorators, {
 				kind: "method",
 				name: "beginDeviceJoin",
@@ -2993,6 +4421,17 @@ let AwikiService = (() => {
 				},
 				metadata: _metadata
 			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _getIdentityAccessState_decorators, {
+				kind: "method",
+				name: "getIdentityAccessState",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "getIdentityAccessState" in obj,
+					get: (obj) => obj.getIdentityAccessState
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
 			__esDecorate(this, null, _getDeviceJoinStatus_decorators, {
 				kind: "method",
 				name: "getDeviceJoinStatus",
@@ -3070,6 +4509,28 @@ let AwikiService = (() => {
 				},
 				metadata: _metadata
 			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _prepareRootTransfer_decorators, {
+				kind: "method",
+				name: "prepareRootTransfer",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "prepareRootTransfer" in obj,
+					get: (obj) => obj.prepareRootTransfer
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _confirmRootTransfer_decorators, {
+				kind: "method",
+				name: "confirmRootTransfer",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "confirmRootTransfer" in obj,
+					get: (obj) => obj.confirmRootTransfer
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
 			__esDecorate(this, null, _updateDisplayName_decorators, {
 				kind: "method",
 				name: "updateDisplayName",
@@ -3158,6 +4619,17 @@ let AwikiService = (() => {
 				},
 				metadata: _metadata
 			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _enterRecoveredSession_decorators, {
+				kind: "method",
+				name: "enterRecoveredSession",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "enterRecoveredSession" in obj,
+					get: (obj) => obj.enterRecoveredSession
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
 			__esDecorate(this, null, _discardRecovery_decorators, {
 				kind: "method",
 				name: "discardRecovery",
@@ -3219,8 +4691,19 @@ let AwikiService = (() => {
 				static: false,
 				private: false,
 				access: {
-					has: (obj) => "leaveGroup" in obj,
-					get: (obj) => obj.leaveGroup
+					has: (obj) => "leaveGroup" in obj,
+					get: (obj) => obj.leaveGroup
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _getDisplayProfiles_decorators, {
+				kind: "method",
+				name: "getDisplayProfiles",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "getDisplayProfiles" in obj,
+					get: (obj) => obj.getDisplayProfiles
 				},
 				metadata: _metadata
 			}, null, _instanceExtraInitializers);
@@ -3445,11 +4928,23 @@ let AwikiService = (() => {
 		resolved = __runInitializers(this, _instanceExtraInitializers);
 		sessionStore;
 		imageAttachmentCache;
-		sentMailStore;
 		conversationPreferenceStore;
 		startupUserServiceDomain;
 		settingsProvider;
+		tenantRegistry;
+		activeTenant;
+		activeClientOptions;
+		clientFactory;
 		provider;
+		runtimeGeneration = 0;
+		tenantSwitching = false;
+		tenantParticipants = /* @__PURE__ */ new Set();
+		activeCapabilities;
+		updatePolicyStatus;
+		updatePolicyRequest;
+		updatePolicyTask;
+		updatePolicyTaskKey;
+		desktopDistribution;
 		signedOut;
 		sessionMutation = Promise.resolve();
 		sessionRevision = 0;
@@ -3460,12 +4955,14 @@ let AwikiService = (() => {
 		requestSessions = /* @__PURE__ */ new Map();
 		deviceRefs = /* @__PURE__ */ new Map();
 		deviceIds = /* @__PURE__ */ new Map();
+		rootTransfers = /* @__PURE__ */ new Map();
 		activeSummaryRequests = /* @__PURE__ */ new Set();
 		summaryProvider;
-		recoveryReconciliationTarget;
 		hostContext;
 		/** Trusted same-process external HTTP authentication dispatcher. Never Remote. */
 		externalHttpAuth;
+		integrationClient;
+		mailListClient;
 		workspaceContext;
 		/**
 		* @param ctx - owning Host context.
@@ -3474,12 +4971,8 @@ let AwikiService = (() => {
 		constructor(ctx, config) {
 			super(ctx, "awiki");
 			this.hostContext = ctx;
-			this.resolved = resolveConfig(config);
+			this.resolved = resolveConfig(ctx, config);
 			this.externalHttpAuth = createAwikiExternalHttpAuth(() => this.acquireExternalHttpAuthSession());
-			this.sessionStore = new AwikiSessionStore(this.resolved.stateRoot);
-			this.imageAttachmentCache = new AwikiImageAttachmentCache(this.resolved.stateRoot, this.resolved.attachmentMaxBytes, this.resolved.imageAttachmentCacheMaxBytes);
-			this.sentMailStore = new AwikiSentMailStore(this.resolved.stateRoot);
-			this.conversationPreferenceStore = new AwikiConversationPreferenceStore(this.resolved.stateRoot);
 			this.startupUserServiceDomain = this.resolved.userServiceDomain;
 			ctx.inject(["settings"], (settingsCtx) => {
 				const provider = settingsCtx.settings;
@@ -3498,7 +4991,17 @@ let AwikiService = (() => {
 				}, "awiki: release settings namespace");
 			});
 			ctx.inject(["connection"], (connectionCtx) => {
-				connectionCtx.connection.rpc.handle(AWIKI_SETTINGS_RPC_CHANNEL, createAwikiSettingsRpcHandler(() => this.settingsProvider), { authority: "loopback" });
+				connectionCtx.connection.rpc.handle(AWIKI_SETTINGS_RPC_CHANNEL, createAwikiSettingsRpcHandler(() => this.settingsProvider, {
+					describe: () => this.getTenantRegistryView(),
+					create: (displayName, domain) => this.createCustomTenant(displayName, domain),
+					rename: (tenantId, displayName) => this.renameCustomTenant(tenantId, displayName),
+					switch: (tenantId) => this.switchTenant(tenantId),
+					archive: (tenantId) => this.archiveCustomTenant(tenantId),
+					describeUpdate: () => this.getUpdatePolicyStatus(),
+					refreshUpdate: () => this.refreshUpdatePolicy(),
+					describeDesktopUpdate: () => this.getDesktopUpdate(),
+					refreshDesktopUpdate: () => this.refreshDesktopUpdate()
+				}), { authority: "loopback" });
 			});
 			ctx.inject(["workspaceRegistry"], (workspaceCtx) => {
 				this.workspaceContext = workspaceCtx;
@@ -3511,8 +5014,28 @@ let AwikiService = (() => {
 					if (current !== void 0) await this.stopAgentConsumer(current);
 				}, "awiki: release Workspace listener composition");
 			});
+			ctx.inject(["desktopDistribution"], (desktopCtx) => {
+				const service = desktopCtx.get("desktopDistribution");
+				if (typeof service !== "object" || service === null || !("getSnapshot" in service) || typeof service.getSnapshot !== "function" || !("check" in service) || typeof service.check !== "function") return;
+				const candidate = service;
+				if (decodeDesktopDistribution(candidate.getSnapshot()) === void 0) return;
+				this.desktopDistribution = candidate;
+				desktopCtx.effect(() => () => {
+					if (this.desktopDistribution === candidate) this.desktopDistribution = void 0;
+				});
+			});
+			ctx.effect(() => {
+				const timer = setInterval(() => {
+					this.refreshUpdatePolicy().catch(() => void 0);
+				}, 216e5);
+				timer.unref();
+				return () => {
+					clearInterval(timer);
+				};
+			});
 			registerAwikiTools(ctx, this);
 			ctx.effect(() => async () => {
+				this.updatePolicyRequest?.abort();
 				const provider = this.provider;
 				if (provider !== void 0) await this.disposeProvider(provider);
 			}, "awiki: dispose current client provider");
@@ -3528,30 +5051,276 @@ let AwikiService = (() => {
 		* @returns asynchronous disposer for the exact registered client.
 		*/
 		registerClientFactory(factory) {
-			if (this.provider !== void 0) throw new Error("awiki: a client provider is already registered");
+			if (this.clientFactory !== void 0 || this.provider !== void 0) throw new Error("awiki: a client provider is already registered");
+			this.clientFactory = factory;
+			try {
+				this.openTenantProvider(this.ensureTenantRegistry().active(), factory);
+			} catch (error) {
+				this.clientFactory = void 0;
+				throw error;
+			}
+			let active = true;
+			return async () => {
+				if (!active) return;
+				active = false;
+				this.clientFactory = void 0;
+				const current = this.provider;
+				if (current !== void 0) await this.disposeProvider(current);
+			};
+		}
+		ensureTenantRegistry() {
+			if (this.tenantRegistry !== void 0) return this.tenantRegistry;
+			const domain = this.startupUserServiceDomain;
+			const configuredOrigin = `https://${this.resolved.userServiceDomain}`;
+			const tenantOrigin = `https://${domain}`;
+			const derive = (value) => value.replace(/\/$/u, "") === configuredOrigin ? tenantOrigin : value;
+			const seed = {
+				domain,
+				configured: domain !== DEFAULT_AWIKI_DOMAIN || this.resolved.userServiceUrl.replace(/\/$/u, "") !== configuredOrigin || this.resolved.messageServiceUrl.replace(/\/$/u, "") !== configuredOrigin,
+				...this.resolved.legacyTenantSlot === void 0 ? {} : { legacyTenantSlot: this.resolved.legacyTenantSlot },
+				userServiceUrl: derive(this.resolved.userServiceUrl),
+				messageServiceUrl: derive(this.resolved.messageServiceUrl),
+				mailServiceUrl: derive(this.resolved.mailServiceUrl),
+				messageServicePublicUrl: derive(this.resolved.messageServicePublicUrl),
+				messageServiceDid: this.resolved.messageServiceDid === `did:wba:${this.resolved.userServiceDomain}` ? `did:wba:${domain}` : this.resolved.messageServiceDid
+			};
+			this.tenantRegistry = AwikiTenantRegistry.open(this.resolved.stateRoot, seed);
+			return this.tenantRegistry;
+		}
+		optionsForTenant(tenant) {
+			const endpoints = tenant.endpoints;
+			const messageServicePublicOrigin = new URL(endpoints.messageServicePublicUrl).origin;
+			return {
+				...endpoints,
+				userServiceDomain: tenant.didHost,
+				allowedAttachmentOrigins: tenant.storageLayout === "legacy-base" ? this.resolved.allowedAttachmentOrigins : [messageServicePublicOrigin],
+				attachmentMaxBytes: this.resolved.attachmentMaxBytes,
+				allowInsecureLoopbackForTesting: this.resolved.allowInsecureLoopbackForTesting,
+				stateRoot: this.ensureTenantRegistry().stateRoot(tenant)
+			};
+		}
+		ensureTenantOptions() {
+			if (this.activeClientOptions !== void 0) return this.activeClientOptions;
+			const tenant = this.ensureTenantRegistry().active();
+			const options = this.optionsForTenant(tenant);
+			this.bindTenantState(tenant, options);
+			return options;
+		}
+		bindTenantState(tenant, options) {
+			this.updatePolicyRequest?.abort();
+			this.updatePolicyStatus = void 0;
+			this.updatePolicyTask = void 0;
+			this.activeTenant = tenant;
+			this.activeClientOptions = options;
+			this.startupUserServiceDomain = tenant.didHost;
+			this.sessionStore = new AwikiSessionStore(options.stateRoot);
+			this.imageAttachmentCache = new AwikiImageAttachmentCache(options.stateRoot, this.resolved.attachmentMaxBytes, this.resolved.imageAttachmentCacheMaxBytes);
+			this.conversationPreferenceStore = new AwikiConversationPreferenceStore(options.stateRoot);
+			this.mailListClient = new AwikiMailListClient(options.mailServiceUrl, this.externalHttpAuth);
+			this.integrationClient = void 0;
+			this.activeCapabilities = {
+				tenantId: tenant.tenantId,
+				generation: this.runtimeGeneration,
+				online: false,
+				handleRecoveryPhoneEnabled: false
+			};
+			this.signedOut = void 0;
+			this.activeIdentityDid = void 0;
 			this.pendingDeviceJoin = void 0;
 			this.activeDeviceJoinSessionId = void 0;
+		}
+		openTenantProvider(tenant, factory, startRuntime = true) {
+			const options = this.optionsForTenant(tenant);
 			const provider = {
-				client: factory({
-					userServiceUrl: this.resolved.userServiceUrl,
-					userServiceDomain: this.startupUserServiceDomain,
-					messageServiceUrl: this.resolved.messageServiceUrl,
-					mailServiceUrl: this.resolved.mailServiceUrl,
-					messageServicePublicUrl: this.resolved.messageServicePublicUrl,
-					messageServiceDid: this.resolved.messageServiceDid,
-					allowedAttachmentOrigins: this.resolved.allowedAttachmentOrigins,
-					attachmentMaxBytes: this.resolved.attachmentMaxBytes,
-					allowInsecureLoopbackForTesting: this.resolved.allowInsecureLoopbackForTesting,
-					stateRoot: this.resolved.stateRoot
-				}),
+				client: factory(options),
 				realtimeGeneration: 0,
 				agentConsumerGeneration: 0,
 				localDeviceJoinRequestCountAfterSync: 0
 			};
+			this.bindTenantState(tenant, options);
 			this.provider = provider;
-			this.ensureRealtimeSupervisor(provider);
-			this.ensureAgentConsumer(provider);
-			return () => this.disposeProvider(provider);
+			this.refreshUpdatePolicy().catch(() => void 0);
+			if (startRuntime) this.ensureProviderRuntime(provider);
+			return provider;
+		}
+		/** Read the Host-owned catalog for trusted loopback settings surfaces. */
+		getTenantRegistryView() {
+			return this.ensureTenantRegistry().snapshot(this.tenantSwitching);
+		}
+		/** Browser-safe, same-process update state for Desktop and loopback settings. */
+		getUpdatePolicyStatus() {
+			const tenant = this.activeTenant ?? this.ensureTenantRegistry().active();
+			const modelProxyVersion = this.currentModelProxyVersion();
+			return this.updatePolicyStatus ?? readAwikiUpdatePolicyStatus({
+				tenant,
+				generation: this.runtimeGeneration,
+				stateRoot: this.resolved.stateRoot,
+				currentPluginVersion: DSH_AWIKI_VERSION,
+				...modelProxyVersion === void 0 ? {} : { currentModelProxyVersion: modelProxyVersion }
+			});
+		}
+		/** Only the Desktop provider owns its release source; tenants cannot override it. */
+		getDesktopUpdate() {
+			return decodeDesktopDistribution(this.desktopDistribution?.getSnapshot());
+		}
+		async refreshDesktopUpdate() {
+			const provider = this.desktopDistribution;
+			if (provider === void 0) return void 0;
+			const value = await provider.check();
+			return provider === this.desktopDistribution ? decodeDesktopDistribution(value) : this.getDesktopUpdate();
+		}
+		/** Refresh only the active generation; late results from old tenants are discarded. */
+		refreshUpdatePolicy() {
+			const key = JSON.stringify([this.runtimeGeneration, this.currentModelProxyVersion()]);
+			if (this.updatePolicyTask !== void 0 && this.updatePolicyTaskKey === key) return this.updatePolicyTask;
+			const task = this.performUpdatePolicyRefresh().finally(() => {
+				if (this.updatePolicyTask === task) this.updatePolicyTask = void 0;
+			});
+			this.updatePolicyTask = task;
+			this.updatePolicyTaskKey = key;
+			return task;
+		}
+		async performUpdatePolicyRefresh() {
+			const tenant = this.activeTenant ?? this.ensureTenantRegistry().active();
+			const generation = this.runtimeGeneration;
+			this.updatePolicyRequest?.abort();
+			const request = new AbortController();
+			this.updatePolicyRequest = request;
+			const currentModelProxyVersion = this.currentModelProxyVersion();
+			const status = await checkAwikiUpdatePolicy({
+				tenant,
+				generation,
+				stateRoot: this.resolved.stateRoot,
+				currentPluginVersion: DSH_AWIKI_VERSION,
+				...currentModelProxyVersion === void 0 ? {} : { currentModelProxyVersion },
+				allowInsecureLoopback: this.resolved.allowInsecureLoopbackForTesting,
+				signal: request.signal
+			});
+			if (this.updatePolicyRequest === request && this.runtimeGeneration === generation && this.activeTenant?.tenantId === tenant.tenantId) {
+				const wasRestricted = this.getUpdatePolicyStatus().restricted;
+				this.updatePolicyStatus = status;
+				this.hostContext.emit("awiki/update-policy", status);
+				if (status.restricted) {
+					this.invalidateSummaries();
+					const provider = this.provider;
+					if (provider !== void 0) try {
+						await this.stopProviderRuntime(provider);
+					} catch (error) {
+						this.ctx.logger("awiki-update").warn("AWiki restricted-version runtime shutdown failed: %s", error instanceof Error ? error.message : "unknown failure");
+					}
+				} else if (wasRestricted && this.provider !== void 0 && !this.tenantSwitching) this.ensureProviderRuntime(this.provider);
+			}
+			return this.getUpdatePolicyStatus();
+		}
+		currentModelProxyVersion() {
+			for (const participant of this.tenantParticipants) if (participant.component?.product === "dsh-awiki-model-proxy") return participant.component.version;
+		}
+		createCustomTenant(displayName, domain) {
+			this.assertVersionSupported();
+			this.ensureTenantRegistry().createCustom(displayName, domain);
+			return this.getTenantRegistryView();
+		}
+		renameCustomTenant(tenantId, displayName) {
+			this.assertVersionSupported();
+			this.ensureTenantRegistry().renameCustom(tenantId, displayName);
+			return this.getTenantRegistryView();
+		}
+		archiveCustomTenant(tenantId) {
+			this.assertVersionSupported();
+			this.ensureTenantRegistry().archiveCustom(tenantId);
+			return this.getTenantRegistryView();
+		}
+		/** Register one same-process resource owner in every transactional tenant change. */
+		registerTenantLifecycleParticipant(participant) {
+			if (this.tenantParticipants.has(participant)) throw new Error("awiki: tenant lifecycle participant is already registered");
+			this.tenantParticipants.add(participant);
+			if (participant.component !== void 0) this.updatePolicyStatus = void 0;
+			this.refreshUpdatePolicy().catch(() => void 0);
+			let active = true;
+			return () => {
+				if (!active) return;
+				active = false;
+				this.tenantParticipants.delete(participant);
+				if (participant.component !== void 0) this.updatePolicyStatus = void 0;
+				this.refreshUpdatePolicy().catch(() => void 0);
+			};
+		}
+		/** Replace the complete Core runtime and commit the active tenant only after opening succeeds. */
+		async switchTenant(tenantId) {
+			if (this.tenantSwitching) throw new Error("awiki: a tenant switch is already in progress");
+			const registry = this.ensureTenantRegistry();
+			const previousTenant = registry.active();
+			if (previousTenant.tenantId === tenantId) return this.getTenantRegistryView();
+			const target = registry.find(tenantId);
+			if (target === void 0 || target.lifecycle === "archived") throw new Error("awiki: target tenant is unavailable");
+			const factory = this.clientFactory;
+			const previousProvider = this.provider;
+			if (factory === void 0 || previousProvider === void 0) throw new Error("awiki: client provider is unavailable");
+			this.tenantSwitching = true;
+			this.updatePolicyRequest?.abort();
+			this.updatePolicyTask = void 0;
+			const context = {
+				from: previousTenant,
+				to: target,
+				generation: ++this.runtimeGeneration
+			};
+			const prepared = [];
+			let targetOpened = false;
+			let committed = false;
+			try {
+				await this.sessionMutation;
+				this.invalidateSummaries();
+				for (const participant of this.tenantParticipants) {
+					await participant.prepareSwitch(context);
+					prepared.push(participant);
+				}
+				await this.disposeProvider(previousProvider);
+				const targetProvider = this.openTenantProvider(target, factory, false);
+				targetOpened = true;
+				await targetProvider.client.getIdentity();
+				await Promise.all([this.discoverTenantCapabilities(3e3), this.refreshUpdatePolicy()]);
+				registry.commitActive(target.tenantId);
+				committed = true;
+				for (const participant of prepared) await participant.commitSwitch?.(context);
+				this.tenantSwitching = false;
+				this.ensureProviderRuntime(targetProvider);
+				const view = this.getTenantRegistryView();
+				this.hostContext.emit("awiki/tenant", view);
+				return view;
+			} catch (error) {
+				const rollbackFailures = [];
+				if (targetOpened) {
+					const current = this.provider;
+					if (current !== void 0) try {
+						await this.disposeProvider(current);
+					} catch (rollbackError) {
+						rollbackFailures.push(rollbackError);
+					}
+				}
+				if (committed) try {
+					registry.commitActive(previousTenant.tenantId);
+				} catch (rollbackError) {
+					rollbackFailures.push(rollbackError);
+				}
+				if (this.provider === void 0) try {
+					const restored = this.openTenantProvider(previousTenant, factory, false);
+					await restored.client.getIdentity();
+					this.ensureProviderRuntime(restored);
+				} catch (rollbackError) {
+					rollbackFailures.push(rollbackError);
+				}
+				for (const participant of prepared.reverse()) try {
+					await participant.rollbackSwitch?.(context);
+				} catch (rollbackError) {
+					rollbackFailures.push(rollbackError);
+				}
+				if (rollbackFailures.length > 0) throw new AggregateError([error, ...rollbackFailures], "awiki: tenant switch failed and rollback was incomplete");
+				this.tenantSwitching = false;
+				if (this.provider !== void 0) this.ensureProviderRuntime(this.provider);
+				throw new Error("awiki: tenant switch failed; the previous tenant was restored", { cause: error });
+			} finally {
+				this.tenantSwitching = false;
+			}
 		}
 		/** Safe same-process diagnostics for focused E2E. Never exposed through Typert Remote. */
 		getRealtimeDiagnostics() {
@@ -3570,18 +5339,6 @@ let AwikiService = (() => {
 				localDeviceJoinRequestCountAfterSync: provider?.localDeviceJoinRequestCountAfterSync ?? 0
 			};
 		}
-		/** Register the optional Model Proxy recovery target without exposing an arbitrary callback or token. */
-		registerRecoveryReconciliationTarget(target) {
-			if (this.recoveryReconciliationTarget !== void 0) throw new Error("awiki: a recovery reconciliation target is already registered");
-			const registered = Object.freeze({ endpoint: recoveryReconciliationEndpoint(target, this.resolved.allowInsecureLoopbackForTesting) });
-			this.recoveryReconciliationTarget = registered;
-			let active = true;
-			return () => {
-				if (!active) return;
-				active = false;
-				if (this.recoveryReconciliationTarget === registered) this.recoveryReconciliationTarget = void 0;
-			};
-		}
 		/** Register one replaceable conversation-summary provider for this deployment. */
 		registerSummaryProvider(provider) {
 			if (this.summaryProvider !== void 0) throw new Error("awiki: a summary provider is already registered");
@@ -3598,13 +5355,66 @@ let AwikiService = (() => {
 		* @returns Browser-safe polling configuration without SDK endpoints or state paths.
 		*/
 		async getConfig() {
-			let handleRecoveryPhoneEnabled = false;
+			this.ensureTenantOptions();
+			const capabilities = await this.discoverTenantCapabilities(1e4);
+			if (this.tenantSwitching || capabilities.generation !== this.runtimeGeneration || capabilities.tenantId !== this.activeTenant?.tenantId) return {
+				ok: false,
+				error: failure("conflict")
+			};
+			return {
+				ok: true,
+				value: {
+					pollIntervalMs: this.resolved.pollIntervalMs,
+					attachmentMaxBytes: this.resolved.attachmentMaxBytes,
+					handleRecoveryPhoneEnabled: capabilities.handleRecoveryPhoneEnabled,
+					...capabilities.guestGatewayBaseUrl === void 0 ? {} : { integrationGuideUrl: new URL("/guest/guide/integration", capabilities.guestGatewayBaseUrl).toString() },
+					tenantId: capabilities.tenantId,
+					tenantGeneration: capabilities.generation,
+					tenantOnline: capabilities.online,
+					services: {
+						modelProxy: { enabled: capabilities.modelProxyBaseUrl !== void 0 },
+						guestGateway: { enabled: capabilities.guestGatewayBaseUrl !== void 0 }
+					}
+				}
+			};
+		}
+		/** Trusted same-process capability binding for optional tenant participants. */
+		getTenantCapabilities() {
+			const capabilities = this.activeCapabilities;
+			if (capabilities === void 0) throw new Error("awiki: tenant capabilities are unavailable");
+			return { ...capabilities };
+		}
+		/** Refresh the active tenant's optional service advertisement without affecting Core availability. */
+		refreshTenantCapabilities() {
+			this.ensureTenantOptions();
+			return this.discoverTenantCapabilities(1e4);
+		}
+		async discoverTenantCapabilities(timeoutMs) {
+			const options = this.activeClientOptions;
+			const tenant = this.activeTenant;
+			if (options === void 0 || tenant === void 0) throw new ProviderUnavailableError();
+			const generation = this.runtimeGeneration;
+			const fallback = {
+				tenantId: tenant.tenantId,
+				generation,
+				online: false,
+				handleRecoveryPhoneEnabled: false
+			};
+			const publish = (capabilities) => {
+				if (this.runtimeGeneration === generation && this.activeTenant?.tenantId === tenant.tenantId) {
+					this.activeCapabilities = capabilities;
+					this.integrationClient = capabilities.guestGatewayBaseUrl === void 0 ? void 0 : new AwikiIntegrationClient(capabilities.guestGatewayBaseUrl, this.externalHttpAuth);
+				}
+				return capabilities;
+			};
 			const abort = new AbortController();
 			const timeout = setTimeout(() => {
 				abort.abort();
-			}, 1e4);
+			}, timeoutMs);
 			try {
-				const response = await fetch(new URL("/user-service/v1/server-info", this.resolved.userServiceUrl), {
+				const endpoint = new URL("/user-service/v1/server-info", options.userServiceUrl);
+				endpoint.searchParams.set("client_platform", "dsh");
+				const response = await fetch(endpoint, {
 					method: "GET",
 					headers: {
 						accept: "application/json",
@@ -3614,25 +5424,58 @@ let AwikiService = (() => {
 					redirect: "error",
 					signal: abort.signal
 				});
-				if (response.ok) {
-					const text = await readBoundedResponseText(response, SERVER_INFO_RESPONSE_MAX_BYTES);
-					const value = text === void 0 ? void 0 : JSON.parse(text);
-					if (typeof value === "object" && value !== null && value.schema_version === 1) {
-						const methods = value.identity?.handle_recovery?.methods;
-						handleRecoveryPhoneEnabled = Array.isArray(methods) && methods.some((method) => typeof method === "object" && method !== null && method.id === "phone" && method.enabled === true && method.verification?.required === true && method.verification?.type === "sms_otp");
-					}
-				}
-			} catch {} finally {
+				if (!response.ok) return publish(fallback);
+				const text = await readBoundedResponseText(response, SERVER_INFO_RESPONSE_MAX_BYTES);
+				const value = text === void 0 ? void 0 : JSON.parse(text);
+				if (typeof value !== "object" || value === null || value.schema_version !== 1) return publish(fallback);
+				const methods = value.identity?.handle_recovery?.methods;
+				const handleRecoveryPhoneEnabled = Array.isArray(methods) && methods.some((method) => typeof method === "object" && method !== null && method.id === "phone" && method.enabled === true && method.verification?.required === true && method.verification?.type === "sms_otp");
+				const services = value.services;
+				const modelProxyBaseUrl = publishedServiceBaseUrl(services, "model_proxy", this.resolved.allowInsecureLoopbackForTesting);
+				const guestGatewayBaseUrl = publishedServiceBaseUrl(services, "guest_gateway", false);
+				return publish({
+					tenantId: tenant.tenantId,
+					generation,
+					online: true,
+					handleRecoveryPhoneEnabled,
+					...modelProxyBaseUrl === void 0 ? {} : { modelProxyBaseUrl },
+					...guestGatewayBaseUrl === void 0 ? {} : { guestGatewayBaseUrl }
+				});
+			} catch {
+				return publish(fallback);
+			} finally {
 				clearTimeout(timeout);
 			}
-			return {
-				ok: true,
-				value: {
-					pollIntervalMs: this.resolved.pollIntervalMs,
-					attachmentMaxBytes: this.resolved.attachmentMaxBytes,
-					handleRecoveryPhoneEnabled
-				}
-			};
+		}
+		/** Read the Integration owned by the active full Handle through the fixed Host client. */
+		getIntegration() {
+			if (this.getUpdatePolicyStatus().restricted) return Promise.resolve(integrationUnavailable());
+			return this.integrationClient?.read() ?? Promise.resolve(integrationUnavailable());
+		}
+		/** Create the active full Handle's only Integration. */
+		createIntegration(request) {
+			if (this.getUpdatePolicyStatus().restricted) return Promise.resolve(integrationUnavailable());
+			return this.integrationClient?.create(request) ?? Promise.resolve(integrationUnavailable());
+		}
+		/** Update editable Integration fields with optimistic concurrency. */
+		updateIntegration(request) {
+			if (this.getUpdatePolicyStatus().restricted) return Promise.resolve(integrationUnavailable());
+			return this.integrationClient?.update(request) ?? Promise.resolve(integrationUnavailable());
+		}
+		/** Atomically replace the current public Integration id. */
+		rotateIntegrationId(request) {
+			if (this.getUpdatePolicyStatus().restricted) return Promise.resolve(integrationUnavailable());
+			return this.integrationClient?.rotate(request) ?? Promise.resolve(integrationUnavailable());
+		}
+		/** Close the Integration and revoke its current public id. */
+		closeIntegration(request) {
+			if (this.getUpdatePolicyStatus().restricted) return Promise.resolve(integrationUnavailable());
+			return this.integrationClient?.close(request) ?? Promise.resolve(integrationUnavailable());
+		}
+		/** Revalidate one closed Integration and issue a new public id. */
+		reopenIntegration(request) {
+			if (this.getUpdatePolicyStatus().restricted) return Promise.resolve(integrationUnavailable());
+			return this.integrationClient?.reopen(request) ?? Promise.resolve(integrationUnavailable());
 		}
 		/**
 		* Read the deployment's identity status.
@@ -3674,6 +5517,7 @@ let AwikiService = (() => {
 				ok: false,
 				error: failure("invalid-request")
 			});
+			this.sessionRevision += 1;
 			return this.mutateSession(async () => {
 				if (await this.isSignedOut()) return {
 					ok: true,
@@ -3741,12 +5585,17 @@ let AwikiService = (() => {
 		}
 		/** Classify one configured-domain Handle before selecting the registration or recovery OTP purpose. */
 		async inspectIdentityAccess(request) {
-			const target = identityAccessTarget(request, this.startupUserServiceDomain);
+			const options = this.activeClientOptions;
+			if (options === void 0) return {
+				ok: false,
+				error: normalizeFailure(new ProviderUnavailableError())
+			};
+			const target = identityAccessTarget(request, options.userServiceDomain);
 			if (target === void 0) return {
 				ok: false,
 				error: failure("invalid-request")
 			};
-			const endpoint = new URL(`/.well-known/handle/${encodeURIComponent(target.localPart)}`, this.resolved.userServiceUrl);
+			const endpoint = new URL(`/.well-known/handle/${encodeURIComponent(target.localPart)}`, options.userServiceUrl);
 			const abort = new AbortController();
 			const timeout = setTimeout(() => {
 				abort.abort();
@@ -3863,6 +5712,37 @@ let AwikiService = (() => {
 				}
 			};
 		}
+		/** Retire only this revoked device credential; ordinary local messages remain for the rejoined identity. */
+		retireDeviceIdentityForRejoin() {
+			return this.mutateSession(async () => {
+				const provider = this.provider;
+				if (provider !== void 0) await this.stopProviderRuntime(provider);
+				const result = await this.run((client) => client.retireDefaultIdentityForRejoin(), { allowSignedOut: true });
+				if (!result.ok) {
+					if (provider !== void 0 && this.provider === provider) this.ensureProviderRuntime(provider);
+					return result;
+				}
+				try {
+					await this.sessionStore.signIn();
+				} catch {
+					try {
+						await this.sessionStore.signIn();
+					} catch {
+						this.ctx.logger("awiki").warn("AWiki local session marker could not be refreshed after device retirement");
+					}
+				}
+				this.signedOut = false;
+				this.activeIdentityDid = void 0;
+				this.pendingDeviceJoin = void 0;
+				this.activeDeviceJoinSessionId = void 0;
+				this.invalidateSummaries();
+				this.publishSession({ status: "unregistered" });
+				return {
+					ok: true,
+					value: { completed: true }
+				};
+			});
+		}
 		/** Consume the exact in-memory continuation; ordinary Join never claims rebind user presence. */
 		async beginDeviceJoin() {
 			const continuation = this.pendingDeviceJoin;
@@ -3870,20 +5750,53 @@ let AwikiService = (() => {
 				ok: false,
 				error: failure("conflict")
 			};
-			if (continuation.mode !== "ordinary" || continuation.requiresUserPresence) return {
+			if (continuation.mode === "ordinary" && continuation.requiresUserPresence || continuation.mode === "handle-recovery-rebind" && !continuation.requiresUserPresence) return {
 				ok: false,
 				error: failure("forbidden")
 			};
-			this.pendingDeviceJoin = void 0;
-			const result = await this.run((client) => client.beginDeviceJoin({
-				continuationId: continuation.continuationId,
-				operationId: `dsh-device-join-${randomUUID()}`,
-				userPresenceConfirmed: false
-			}));
+			const result = await this.run(async (client) => {
+				let userPresenceConfirmed = false;
+				if (continuation.mode === "handle-recovery-rebind") {
+					if (!client.trustedUserPresenceSupported) throw Object.assign(/* @__PURE__ */ new Error("trusted user presence unsupported"), {
+						name: "AwikiSdkError",
+						code: "forbidden"
+					});
+					userPresenceConfirmed = await client.confirmUserPresence("Rejoin your recovered AWiki identity on this device");
+					if (!userPresenceConfirmed) throw Object.assign(/* @__PURE__ */ new Error("user presence denied"), {
+						name: "AwikiSdkError",
+						code: "forbidden"
+					});
+				}
+				this.pendingDeviceJoin = void 0;
+				return client.beginDeviceJoin({
+					continuationId: continuation.continuationId,
+					operationId: `dsh-device-join-${randomUUID()}`,
+					userPresenceConfirmed
+				});
+			});
 			if (!result.ok) return result;
 			this.activeDeviceJoinSessionId = result.value.joinSessionId;
 			return this.applyCandidateJoinProgress(result.value);
 		}
+		/** Read local workflow authority before offering a new login. No remote mutations. */
+		getIdentityAccessState() {
+			return this.run(async (client) => {
+				const joining = await this.selectDeviceJoinSession(client) !== null;
+				const recoveries = await client.listPendingRecoveries();
+				const domain = this.activeClientOptions?.userServiceDomain;
+				const choice = this.pendingDeviceJoin;
+				return {
+					choice: joining || choice === void 0 ? null : {
+						status: "join-required",
+						fullHandle: choice.fullHandle,
+						mode: choice.mode,
+						requiresUserPresence: choice.requiresUserPresence
+					},
+					joining,
+					recoveries: recoveries.filter((value) => domain !== void 0 && value.fullHandle.slice(value.fullHandle.indexOf(".") + 1) === domain)
+				};
+			}, { allowSignedOut: true });
+		}
 		/** Restore from Core local_sessions and advance only the exact resumable Join. */
 		async getDeviceJoinStatus() {
 			const result = await this.run(async (client) => {
@@ -3976,7 +5889,18 @@ let AwikiService = (() => {
 					code: "forbidden"
 				});
 				const prompt = await client.prepareDeviceJoinApproval(joinSessionId);
-				return client.confirmDeviceJoinApproval(prompt.approvalHandle);
+				try {
+					return await client.confirmDeviceJoinApproval(prompt.approvalHandle);
+				} catch (error) {
+					try {
+						await client.syncDeviceManagement();
+					} catch {}
+					try {
+						const recovered = await client.getLocalDeviceJoinVerificationProgress(joinSessionId);
+						if (adminJoinPhase(recovered) === "authorized") return recovered;
+					} catch {}
+					throw error;
+				}
 			});
 			return result.ok ? this.publicAdminJoinProgress(request.requestRef, result.value) : result;
 		}
@@ -4013,6 +5937,63 @@ let AwikiService = (() => {
 				return this.deviceManagementSnapshot(client);
 			});
 		}
+		/** Prepare a short-lived Core authorization without exposing it to Browser. */
+		async prepareRootTransfer(request) {
+			const deviceId = this.deviceIds.get(request?.deviceRef);
+			if (deviceId === void 0) return {
+				ok: false,
+				error: failure("invalid-request")
+			};
+			return this.run(async (client) => {
+				const did = await this.requireRootTransferRecipient(client, deviceId);
+				const preparation = await client.prepareRootKeyTransfer(deviceId);
+				if (preparation.recipient.did !== did || preparation.recipient.deviceId !== deviceId) throw Object.assign(/* @__PURE__ */ new Error("root transfer recipient mismatch"), {
+					name: "AwikiSdkError",
+					code: "remote"
+				});
+				for (const [reference, pending] of this.rootTransfers) if (pending.deviceId === deviceId) this.rootTransfers.delete(reference);
+				const transferRef = `root-transfer-${randomUUID()}`;
+				this.rootTransfers.set(transferRef, {
+					authorizationHandle: preparation.authorizationHandle,
+					deviceId,
+					deviceRef: request.deviceRef,
+					did
+				});
+				return {
+					transferRef,
+					deviceRef: request.deviceRef,
+					expiresAt: preparation.expiresAt
+				};
+			});
+		}
+		/** Authenticate locally, recheck fresh context, then consume one exact Core authorization. */
+		async confirmRootTransfer(request) {
+			const pending = this.rootTransfers.get(request?.transferRef);
+			if (pending === void 0) return {
+				ok: false,
+				error: failure("invalid-request")
+			};
+			this.rootTransfers.delete(request.transferRef);
+			return this.run(async (client) => {
+				if (!await client.confirmUserPresence("Grant AWiki device management access")) throw Object.assign(/* @__PURE__ */ new Error("user presence denied"), {
+					name: "AwikiSdkError",
+					code: "forbidden"
+				});
+				if (await this.requireRootTransferRecipient(client, pending.deviceId) !== pending.did) throw Object.assign(/* @__PURE__ */ new Error("root transfer identity changed"), {
+					name: "AwikiSdkError",
+					code: "forbidden"
+				});
+				const sent = await client.confirmAndSendRootKeyTransfer(pending.authorizationHandle);
+				if (sent.recipientDeviceId !== pending.deviceId) throw Object.assign(/* @__PURE__ */ new Error("root transfer receipt mismatch"), {
+					name: "AwikiSdkError",
+					code: "remote"
+				});
+				return {
+					deviceRef: pending.deviceRef,
+					acceptedAt: sent.acceptedAt
+				};
+			});
+		}
 		/**
 		* Update the deployment identity's public WNS display name.
 		* @param request - replacement display name selected by the user.
@@ -4068,12 +6049,7 @@ let AwikiService = (() => {
 				ok: false,
 				error: failure("invalid-request")
 			};
-			const result = await this.run((client) => client.activateRecovery(normalized), { allowSignedOut: true });
-			if (result.ok && !await this.applyRecoveredSession(result.value)) return {
-				ok: false,
-				error: failure("remote")
-			};
-			return result;
+			return this.run((client) => client.activateRecovery(normalized), { allowSignedOut: true });
 		}
 		/** Read durable recovery state before deciding whether a retry is valid. */
 		async getRecoveryStatus(request) {
@@ -4082,12 +6058,7 @@ let AwikiService = (() => {
 				ok: false,
 				error: failure("invalid-request")
 			};
-			const result = await this.run((client) => client.getRecoveryStatus(normalized), { allowSignedOut: true });
-			if (result.ok && !await this.applyRecoveredSession(result.value)) return {
-				ok: false,
-				error: failure("remote")
-			};
-			return result;
+			return this.run((client) => client.getRecoveryStatus(normalized), { allowSignedOut: true });
 		}
 		/** Resume only the exact Core-owned operation selected by the browser. */
 		async resumeRecovery(request) {
@@ -4096,12 +6067,23 @@ let AwikiService = (() => {
 				ok: false,
 				error: failure("invalid-request")
 			};
-			const result = await this.run((client) => client.resumeRecovery(normalized), { allowSignedOut: true });
-			if (result.ok && !await this.applyRecoveredSession(result.value)) return {
+			return this.run((client) => client.resumeRecovery(normalized), { allowSignedOut: true });
+		}
+		/** Explicitly enter an applied identity; reads and late Core completions never sign in. */
+		async enterRecoveredSession(request) {
+			const normalized = normalizeRecoveryOperation(request);
+			if (normalized === void 0) return {
 				ok: false,
-				error: failure("remote")
+				error: failure("invalid-request")
 			};
-			return result;
+			const requestGeneration = this.sessionRevision;
+			const result = await this.run((client) => client.getRecoveryStatus(normalized), { allowSignedOut: true });
+			if (!result.ok) return result;
+			if (result.value.phase !== "applied" || !result.value.allowedActions?.includes("activate_identity")) return {
+				ok: false,
+				error: failure("conflict")
+			};
+			return this.applyRecoveredSession(result.value, requestGeneration);
 		}
 		/** Discard only a pre-attempt operation; Core rejects post-attempt deletion. */
 		async discardRecovery(request) {
@@ -4188,6 +6170,13 @@ let AwikiService = (() => {
 			} : result;
 		}
 		/** Read one authoritative versioned member page. */
+		getDisplayProfiles(peers) {
+			if (!Array.isArray(peers) || peers.length > 100 || peers.some((peer) => typeof peer !== "string" || !peer.startsWith("did:"))) return Promise.resolve({
+				ok: false,
+				error: failure("invalid-request")
+			});
+			return this.run((client) => client.getDisplayProfiles(peers));
+		}
 		listGroupMembers(request) {
 			const groupDid = normalizeGroupDid(request?.groupDid);
 			if (groupDid === void 0 || request.cursor !== void 0 && (typeof request.cursor !== "string" || request.cursor.length > 4096) || request.limit !== void 0 && (!Number.isSafeInteger(request.limit) || request.limit < 1 || request.limit > 100)) return Promise.resolve({
@@ -4479,9 +6468,11 @@ let AwikiService = (() => {
 					error: failure("invalid-request")
 				};
 			}
+			const requestGeneration = this.sessionRevision;
 			return this.run(async (client) => {
-				if (normalized.folder !== "sent") return client.listMailInbox(normalized);
-				return this.sentMailStore.list(await this.ownerDid(client), normalized);
+				const page = normalized.folder === "sent" ? await this.mailListClient.listOutbound(normalized) : await client.listMailInbox(normalized);
+				if (this.sessionRevision !== requestGeneration) throw new AwikiSdkError("network");
+				return page;
 			});
 		}
 		/** Read one bounded plain-text mail message. */
@@ -4495,15 +6486,7 @@ let AwikiService = (() => {
 					error: failure("invalid-request")
 				};
 			}
-			return this.run(async (client) => {
-				if (!isLocalSentMailId(normalized.messageId)) return client.readMail(normalized);
-				const local = await this.sentMailStore.read(await this.ownerDid(client), normalized.messageId);
-				if (local === void 0) throw Object.assign(/* @__PURE__ */ new Error("sent mail not found"), {
-					name: "AwikiSdkError",
-					code: "not-found"
-				});
-				return local;
-			});
+			return this.run((client) => client.readMail(normalized));
 		}
 		/** Mark explicitly selected mail messages read. Browser callers require an explicit click. */
 		markMailRead(request) {
@@ -4520,21 +6503,7 @@ let AwikiService = (() => {
 					error: failure("invalid-request")
 				};
 			}
-			return this.run(async (client) => {
-				const result = await client.sendMail(normalized);
-				if (!result.accepted) return result;
-				try {
-					const ownerDid = await this.ownerDid(client);
-					const account = await client.getMailAccount().catch(() => void 0);
-					await this.sentMailStore.append(ownerDid, normalized, result, account);
-					return result;
-				} catch {
-					return result.warnings.length >= 100 ? result : {
-						...result,
-						warnings: [...result.warnings, "Sent history could not be saved locally."]
-					};
-				}
-			});
+			return this.run((client) => client.sendMail(normalized));
 		}
 		/**
 		* Permanently remove the exact SDK-owned local state after an explicit browser acknowledgement.
@@ -4547,17 +6516,19 @@ let AwikiService = (() => {
 				ok: false,
 				error: failure("invalid-request")
 			});
+			this.sessionRevision += 1;
 			return this.mutateSession(async () => {
 				const provider = this.provider;
 				if (provider !== void 0) await this.stopProviderRuntime(provider);
-				const result = await this.run((client) => client.clearLocalData(), { allowSignedOut: true });
+				let result = await this.run((client) => client.clearLocalData(), { allowSignedOut: true });
+				if (!result.ok && result.error.code === "remote") result = await this.run((client) => client.clearLocalData(), { allowSignedOut: true });
 				if (!result.ok) {
 					if (provider !== void 0 && this.provider === provider) this.ensureProviderRuntime(provider);
 					return result;
 				}
 				try {
 					await this.imageAttachmentCache.clear();
-					await this.sentMailStore.clear();
+					await clearLegacySentMailCache(this.activeClientOptions?.stateRoot ?? this.resolved.stateRoot);
 					await this.conversationPreferenceStore.clear();
 					await this.sessionStore.signIn();
 					this.signedOut = false;
@@ -4576,23 +6547,64 @@ let AwikiService = (() => {
 			});
 		}
 		/** Re-enter only after Core confirms that the exact recovered identity is applied locally. */
-		async applyRecoveredSession(progress) {
-			if (progress.phase !== "applied") return true;
+		async applyRecoveredSession(progress, requestGeneration) {
+			if (progress.phase !== "applied") return {
+				ok: true,
+				value: progress
+			};
 			return this.mutateSession(async () => {
 				const provider = this.provider;
-				if (provider === void 0) return false;
+				if (provider === void 0) return {
+					ok: false,
+					error: failure("remote")
+				};
+				if (this.sessionRevision !== requestGeneration) return {
+					ok: false,
+					error: {
+						...failure("remote"),
+						mailRecoveryObservability: fencedMailRecoveryObservability(this.activeIdentityDid === progress.currentDid, "replaced")
+					}
+				};
 				try {
 					const identity = await provider.client.getIdentity();
-					if (identity === null || identity.did !== progress.currentDid) return false;
+					const currentPrincipalMatchesRecovery = identity !== null && identity.did === progress.currentDid;
+					if (this.provider !== provider || this.sessionRevision !== requestGeneration) return {
+						ok: false,
+						error: {
+							...failure("remote"),
+							mailRecoveryObservability: fencedMailRecoveryObservability(currentPrincipalMatchesRecovery, "replaced")
+						}
+					};
+					if (!currentPrincipalMatchesRecovery) return {
+						ok: false,
+						error: {
+							...failure("remote"),
+							mailRecoveryObservability: fencedMailRecoveryObservability(false, "current")
+						}
+					};
 					const alreadyActive = this.signedOut === false && this.activeIdentityDid === identity.did;
 					if (!alreadyActive) {
 						await this.sessionStore.signIn();
+						if (this.provider !== provider || this.sessionRevision !== requestGeneration) return {
+							ok: false,
+							error: {
+								...failure("remote"),
+								mailRecoveryObservability: fencedMailRecoveryObservability(true, "replaced")
+							}
+						};
 						this.signedOut = false;
 						this.activeIdentityDid = identity.did;
 						this.invalidateSummaries();
+						requestGeneration = this.sessionRevision;
 					}
-					const reconciled = await this.reconcileRecoveredIdentity(provider, progress.operationId);
-					if (this.provider !== provider) return false;
+					const mailRecoveryObservability = await this.reconcileRecoveredMailbox(provider);
+					if (this.provider !== provider || this.sessionRevision !== requestGeneration) return {
+						ok: false,
+						error: {
+							...failure("remote"),
+							mailRecoveryObservability: fencedMailRecoveryObservability(true, "replaced")
+						}
+					};
 					if (!alreadyActive) {
 						const session = {
 							status: "active",
@@ -4601,49 +6613,38 @@ let AwikiService = (() => {
 						this.publishSession(session);
 						this.ensureProviderRuntime(provider);
 					}
-					return reconciled;
+					return {
+						ok: true,
+						value: {
+							...progress,
+							mailRecoveryObservability
+						}
+					};
 				} catch {
-					return false;
+					return {
+						ok: false,
+						error: failure("remote")
+					};
 				}
 			});
 		}
-		/** Rebind Mail first-use ownership and, when installed, the canonical model billing account. */
-		async reconcileRecoveredIdentity(provider, operationId) {
-			const logger = this.ctx.logger("awiki-recovery");
-			let mailboxRestored = false;
+		/** Rebind Mail first-use ownership and retain only its closed, secret-free classification. */
+		async reconcileRecoveredMailbox(provider) {
 			try {
 				await provider.client.getMailAccount();
-				mailboxRestored = true;
-			} catch {
-				logger.warn("awiki: recovered mailbox reconciliation is pending");
-			}
-			const target = this.recoveryReconciliationTarget;
-			if (target === void 0) return mailboxRestored;
-			try {
-				const authority = await provider.client.issueRecoveryAttestation({ operationId });
-				if (!await acceptsRecoveryReconciliation(await this.externalHttpAuth.dispatch(new Request(target.endpoint, {
-					method: "POST",
-					headers: { "content-type": "application/json" },
-					body: JSON.stringify({ attestation: authority.attestation })
-				}), (request) => fetch(request)))) {
-					logger.warn("awiki: recovered model account reconciliation is pending");
-					return false;
-				}
-				return mailboxRestored;
-			} catch {
-				logger.warn("awiki: recovered model account reconciliation is pending");
-				return false;
+				return successfulMailRecoveryObservability();
+			} catch (error) {
+				return failedMailRecoveryObservability(error);
 			}
 		}
 		/** Select the only resumable new-device session; Core local_sessions is the sole restart SoT. */
 		async selectDeviceJoinSession(client) {
-			const sessions = await client.listLocalDeviceJoinSessions();
+			const resumable = (await client.listLocalDeviceJoinSessions()).filter((value) => value.side === "new_device" && RESUMABLE_JOIN_PHASES.has(value.localPhase));
 			if (this.activeDeviceJoinSessionId !== void 0) {
-				const tracked = sessions.find((value) => value.side === "new_device" && value.joinSessionId === this.activeDeviceJoinSessionId);
+				const tracked = resumable.find((value) => value.joinSessionId === this.activeDeviceJoinSessionId);
 				if (tracked !== void 0) return tracked.joinSessionId;
 				this.activeDeviceJoinSessionId = void 0;
 			}
-			const resumable = sessions.filter((value) => value.side === "new_device" && RESUMABLE_JOIN_PHASES.has(value.localPhase));
 			if (resumable.length > 1) throw Object.assign(/* @__PURE__ */ new Error("multiple local joins"), {
 				name: "AwikiSdkError",
 				code: "conflict"
@@ -4710,6 +6711,25 @@ let AwikiService = (() => {
 				code: "forbidden"
 			});
 		}
+		async requireRootTransferRecipient(client, deviceId) {
+			if (!client.trustedUserPresenceSupported) throw Object.assign(/* @__PURE__ */ new Error("trusted user presence unsupported"), {
+				name: "AwikiSdkError",
+				code: "forbidden"
+			});
+			await this.requireDeviceManager(client);
+			await client.syncDeviceManagement();
+			const identity = await client.getIdentity();
+			if (identity === null) throw Object.assign(/* @__PURE__ */ new Error("identity required"), {
+				name: "AwikiSdkError",
+				code: "not-registered"
+			});
+			const target = (await client.getDeviceRegistry()).find((device) => device.deviceId === deviceId);
+			if (target === void 0 || target.isCurrent || target.status !== "active" || target.role !== "member" || target.managementReady) throw Object.assign(/* @__PURE__ */ new Error("root transfer recipient unavailable"), {
+				name: "AwikiSdkError",
+				code: "forbidden"
+			});
+			return identity.did;
+		}
 		requestRef(joinSessionId) {
 			const existing = this.requestRefs.get(joinSessionId);
 			if (existing !== void 0) return existing;
@@ -4734,8 +6754,10 @@ let AwikiService = (() => {
 				this.requestSessions.clear();
 				this.deviceRefs.clear();
 				this.deviceIds.clear();
+				this.rootTransfers.clear();
 				return {
 					canManage: false,
+					rootTransferSupported: client.trustedUserPresenceSupported,
 					...current.role === void 0 ? {} : { role: current.role },
 					readiness: current.readiness,
 					devices: [],
@@ -4744,11 +6766,20 @@ let AwikiService = (() => {
 			}
 			const requests = await client.listLocalDeviceJoinRequests();
 			await Promise.all(requests.filter((request) => request.claimedByCurrentDevice).map((request) => client.getLocalDeviceJoinVerificationProgress(request.joinSessionId).catch(() => void 0)));
+			const devices = await client.getDeviceRegistry();
+			const identity = await client.getIdentity();
+			const joinedAtByDeviceId = /* @__PURE__ */ new Map();
+			for (const request of requests) {
+				const previous = joinedAtByDeviceId.get(request.protocolDeviceId);
+				if (previous === void 0 || request.issuedAt > previous) joinedAtByDeviceId.set(request.protocolDeviceId, request.issuedAt);
+			}
+			const initialDeviceJoinedAt = identity === null ? void 0 : new Date(identity.registeredAt).toISOString();
 			return {
 				canManage: true,
+				rootTransferSupported: client.trustedUserPresenceSupported,
 				role: "admin",
 				readiness: "admin_ready",
-				devices: (await client.getDeviceRegistry()).map((device) => this.publicDevice(device)),
+				devices: devices.filter((device) => device.status === "active").map((device) => this.publicDevice(device, joinedAtByDeviceId.get(device.deviceId) ?? (device.isCurrent ? initialDeviceJoinedAt : void 0))),
 				requests: requests.map((request) => ({
 					requestRef: this.requestRef(request.joinSessionId),
 					candidateKeyFingerprint: request.candidateKeyFingerprint,
@@ -4760,9 +6791,12 @@ let AwikiService = (() => {
 				}))
 			};
 		}
-		publicDevice(device) {
+		publicDevice(device, joinedAt) {
+			const fingerprint = createHash("sha256").update(device.deviceId).digest("hex").slice(0, 8).toUpperCase();
 			return {
 				deviceRef: this.deviceRef(device.deviceId),
+				displayId: `${fingerprint.slice(0, 4)}-${fingerprint.slice(4)}`,
+				...joinedAt === void 0 ? {} : { joinedAt },
 				status: device.status,
 				role: device.role,
 				managementReady: device.managementReady,
@@ -4788,6 +6822,7 @@ let AwikiService = (() => {
 			this.requestSessions.clear();
 			this.deviceRefs.clear();
 			this.deviceIds.clear();
+			this.rootTransfers.clear();
 			for (const controller of this.activeSummaryRequests) controller.abort();
 			this.activeSummaryRequests.clear();
 		}
@@ -4809,6 +6844,11 @@ let AwikiService = (() => {
 		/** Invoke the current client and normalize every rejection to a public result. */
 		async run(operation, options = {}) {
 			try {
+				const generation = this.runtimeGeneration;
+				if (this.getUpdatePolicyStatus().restricted) return {
+					ok: false,
+					error: failure("client-version-unsupported")
+				};
 				if (options.allowSignedOut !== true && await this.isSignedOut()) return {
 					ok: false,
 					error: failure("signed-out")
@@ -4816,6 +6856,10 @@ let AwikiService = (() => {
 				const provider = this.provider;
 				if (provider === void 0) throw new ProviderUnavailableError();
 				const value = await operation(provider.client);
+				if (this.runtimeGeneration !== generation || this.provider !== provider) return {
+					ok: false,
+					error: failure("conflict")
+				};
 				if (options.skipAttachmentByteValidation !== true && containsUnexpectedBinary(value, /* @__PURE__ */ new Set())) return {
 					ok: false,
 					error: failure("remote")
@@ -4831,6 +6875,9 @@ let AwikiService = (() => {
 				};
 			}
 		}
+		assertVersionSupported() {
+			if (this.getUpdatePolicyStatus().restricted) throw new Error("awiki: this plugin version must be updated before using the active tenant");
+		}
 		/** Validate mail input before entering the provider and preserve fixed public failures. */
 		runValidatedMail(validate, operation) {
 			let request;
@@ -4883,12 +6930,22 @@ let AwikiService = (() => {
 		}
 		/** Serialize sign-in, sign-out, and destructive clear transitions. */
 		mutateSession(operation) {
-			const pending = this.sessionMutation.then(operation, operation);
+			const generation = this.runtimeGeneration;
+			if (this.tenantSwitching) return Promise.resolve({
+				ok: false,
+				error: failure("conflict")
+			});
+			const invoke = () => this.tenantSwitching || generation !== this.runtimeGeneration ? Promise.resolve({
+				ok: false,
+				error: failure("conflict")
+			}) : operation();
+			const pending = this.sessionMutation.then(invoke, invoke);
 			this.sessionMutation = pending.then(() => void 0, () => void 0);
 			return pending;
 		}
 		/** Start identity realtime and the optional Agent consumer without blocking identity success. */
 		ensureProviderRuntime(provider) {
+			if (this.tenantSwitching) return;
 			const identityDid = this.activeIdentityDid;
 			if (provider.runtimeReplacement !== void 0) return;
 			if (identityDid !== void 0 && provider.realtimeIdentityDid !== void 0 && provider.realtimeIdentityDid !== identityDid) {
@@ -4914,6 +6971,7 @@ let AwikiService = (() => {
 			provider.runtimeReplacement = observed;
 		}
 		ensureRealtimeSupervisor(provider) {
+			if (this.getUpdatePolicyStatus().restricted) return;
 			if (!this.resolved.realtimeEnabled || provider.realtimeSupervisor !== void 0 || provider.realtimeStartup !== void 0 || this.provider !== provider || (provider.client.realtime ?? provider.client.listener) === void 0) return;
 			const generation = provider.realtimeGeneration;
 			const source = provider.client.realtime ?? provider.client.listener;
@@ -4959,6 +7017,7 @@ let AwikiService = (() => {
 			await provider.agentConsumer?.reconcileOnce();
 		}
 		ensureAgentConsumer(provider) {
+			if (this.getUpdatePolicyStatus().restricted) return;
 			const workspaceContext = this.workspaceContext;
 			const source = provider.client.agentInbox ?? provider.client.listener;
 			const identityDid = this.activeIdentityDid;
@@ -4973,6 +7032,7 @@ let AwikiService = (() => {
 				const agents = new DshAwikiListenerAgentRuntime(workspaceContext, this.resolved.listener.workspacePath);
 				const consumer = new AwikiAgentListener(source, agents, {
 					...this.resolved.listener,
+					stateRoot: this.activeClientOptions?.stateRoot ?? this.resolved.listener.stateRoot,
 					identityScope: identityDid
 				}, logger);
 				provider.agentConsumer = consumer;
@@ -5047,4 +7107,4 @@ function containsUnexpectedBinary(value, seen) {
 	return false;
 }
 //#endregion
-export { AWIKI_CLEAR_LOCAL_DATA_CONFIRMATION, AWIKI_DOMAIN_FIELD, AWIKI_EXTERNAL_HTTP_MAX_BODY_BYTES, AWIKI_HISTORY_TOOL, AWIKI_IDENTITY_STATUS_TOOL, AWIKI_LIST_CONVERSATIONS_TOOL, AWIKI_LOGOUT_CONFIRMATION, AWIKI_MAIL_ACCOUNT_TOOL, AWIKI_MAIL_INBOX_TOOL, AWIKI_MAIL_MARK_READ_TOOL, AWIKI_MAIL_READ_TOOL, AWIKI_MAIL_SEND_TOOL, AWIKI_SEND_ATTACHMENT_TOOL, AWIKI_SEND_MESSAGE_TOOL, AWIKI_SETTINGS_NAMESPACE, AwikiExternalHttpAuthError, AwikiService, AwikiService as default, AwikiSettingsSchema, Config, DEFAULT_ATTACHMENT_MAX_BYTES, DEFAULT_AWIKI_DOMAIN, DEFAULT_AWIKI_MESSAGE_SERVICE_DID, DEFAULT_AWIKI_SERVICE_URL, DEFAULT_IMAGE_ATTACHMENT_CACHE_MAX_BYTES, DEFAULT_POLL_INTERVAL_MS, DEFAULT_SUMMARY_MAX_INPUT_BYTES, MAX_SUMMARY_MESSAGES, normalizeAwikiDomain, validateAwikiSettings };
+export { AWIKI_CHINA_TENANT_ID, AWIKI_CLEAR_LOCAL_DATA_CONFIRMATION, AWIKI_DOMAIN_FIELD, AWIKI_EXTERNAL_HTTP_MAX_BODY_BYTES, AWIKI_GLOBAL_TENANT_ID, AWIKI_HISTORY_TOOL, AWIKI_IDENTITY_STATUS_TOOL, AWIKI_LIST_CONVERSATIONS_TOOL, AWIKI_LOGOUT_CONFIRMATION, AWIKI_MAIL_ACCOUNT_TOOL, AWIKI_MAIL_INBOX_TOOL, AWIKI_MAIL_MARK_READ_TOOL, AWIKI_MAIL_READ_TOOL, AWIKI_MAIL_SEND_TOOL, AWIKI_OFFICIAL_CATALOG_VERSION, AWIKI_SEND_ATTACHMENT_TOOL, AWIKI_SEND_MESSAGE_TOOL, AWIKI_SETTINGS_NAMESPACE, AWIKI_TENANT_REGISTRY_SCHEMA_VERSION, AwikiExternalHttpAuthError, AwikiService, AwikiService as default, AwikiSettingsSchema, Config, DEFAULT_ATTACHMENT_MAX_BYTES, DEFAULT_AWIKI_DOMAIN, DEFAULT_AWIKI_MESSAGE_SERVICE_DID, DEFAULT_AWIKI_SERVICE_URL, DEFAULT_IMAGE_ATTACHMENT_CACHE_MAX_BYTES, DEFAULT_POLL_INTERVAL_MS, DEFAULT_SUMMARY_MAX_INPUT_BYTES, DSH_AWIKI_MODEL_PROXY_VERSION, DSH_AWIKI_VERSION, MAX_SUMMARY_MESSAGES, compareVersions as compareAwikiPluginVersions, normalizeAwikiDomain, validateAwikiSettings };