@awiki/dsh-plugin 0.3.7 → 0.3.11-rc.1

package/lib/types/client/controller.js

@@ -1,5 +1,33 @@
-/** React-free browser controller for the deployment's one AWiki identity. */
+import { AwikiDraftStore } from "./drafts.js";
+import { SHORT_HANDLE_INVITE_MESSAGE } from "../registration-policy.js";
 import { IndexedDbAwikiBrowserImageCache, } from "./image-cache.js";
+import { clearMailBrowserCache } from "./mail-list-cache.js";
+const GENERIC_BUSINESS_FAILURE_MESSAGE = 'AWiki 暂时无法完成此操作，请稍后重试。';
+const GENERIC_CARRIER_FAILURE_MESSAGE = '暂时无法连接 AWiki Host，请稍后重试。';
+const GENERIC_THROW_FAILURE_MESSAGE = 'AWiki 调用暂时失败，请稍后重试。';
+/** Project only a stable business code into Browser copy; provider messages remain Host-only. */
+function genericFailureMessage(failure) {
+    switch (failure.code) {
+        case 'network':
+            return '无法连接 AWiki 服务，请检查网络后重试。';
+        case 'rate-limited':
+            return 'AWiki 请求过于频繁，请稍后重试。';
+        case 'not-registered':
+            return '请先注册 AWiki 身份后重试。';
+        case 'signed-out':
+            return '当前 AWiki 身份已退出，请重新进入后重试。';
+        case 'identity-recovery-required':
+            return '当前设备的 AWiki 身份凭证已失效，请重新恢复身份。';
+        case 'device-rejoin-required':
+            return '当前设备已被撤销，请重新申请加入。';
+        default:
+            return GENERIC_BUSINESS_FAILURE_MESSAGE;
+    }
+}
+/** Carrier diagnostics are not a Browser contract, including for unknown carrier codes. */
+function genericCarrierFailureMessage(_failure) {
+    return GENERIC_CARRIER_FAILURE_MESSAGE;
+}
 /** Turn a registration rejection into an actionable message without exposing remote response text. */
 function registrationFailureMessage(failure) {
     switch (failure.code) {
@@ -13,23 +41,29 @@ function registrationFailureMessage(failure) {
             return '验证码状态已失效，请重新获取验证码后再注册。';
         case 'handle-unavailable':
             return '该 Handle 刚刚已被注册。请返回身份入口，再按恢复流程重新获取验证码。';
+        case 'short-handle-invite-required':
+            return SHORT_HANDLE_INVITE_MESSAGE;
         case 'conflict':
             return '注册冲突：服务端可能已收到上次注册请求，或该手机号 / Handle 已绑定其他身份。请保留当前页面并再次提交；若仍失败，请勿清除本机身份数据，联系管理员并提供失败时间。';
         case 'rate-limited':
             return '注册请求过于频繁，请稍后重试。';
         case 'network':
             return '无法连接 AWiki 服务，请检查网络后重试。';
+        case 'identity-recovery-required':
+            return '这台设备保留了原 AWiki 身份，但本地登录状态已被清除。请先恢复该身份或完整清除这台设备上的 AWiki 身份数据，再重新注册。';
         case 'forbidden':
             return '当前 AWiki 服务未开放公开注册，或该手机号不在注册白名单。请使用已获准的手机号，或联系管理员开通注册权限。';
         case 'remote':
             return 'AWiki 服务暂时无法完成注册，请稍后重试；若持续失败，请联系管理员并提供失败时间。';
         default:
-            return `${failure.code}：${failure.message}`;
+            return 'AWiki 服务暂时无法完成注册，请稍后重试；若持续失败，请联系管理员并提供失败时间。';
     }
 }
 /** Turn a verification-code request failure into a safe next action. */
 function registrationOtpFailureMessage(failure) {
     switch (failure.code) {
+        case 'short-handle-invite-required':
+            return SHORT_HANDLE_INVITE_MESSAGE;
         case 'rate-limited':
             return '验证码发送过于频繁，请等待限流解除后再重新获取。';
         case 'invalid-request':
@@ -59,13 +93,13 @@ function recoveryPreparationFailureMessage(failure) {
         case 'remote':
             return 'AWiki 服务暂时无法验证恢复信息，请稍后重试。';
         default:
-            return `${failure.code}：${failure.message}`;
+            return 'AWiki 服务暂时无法验证恢复信息，请稍后重试。';
     }
 }
 function recoveryContinuationFailureMessage(failure, phase) {
     const remoteCommitted = phase === 'remote_committed' || phase === 'identity_transition_pending';
     if (remoteCommitted && ['invalid-request', 'conflict', 'forbidden', 'remote'].includes(failure.code)) {
-        return '身份已在服务端恢复，但本机切换尚未完成。请保留当前恢复操作，并继续完成本机切换；不要重新获取验证码或创建新身份。';
+        return '身份已在服务端恢复，本机切换尚未完成。可以重试本机切换，也可以返回入口稍后继续；请勿为同一账号重复发起恢复。';
     }
     switch (failure.code) {
         case 'network':
@@ -74,11 +108,14 @@ function recoveryContinuationFailureMessage(failure, phase) {
                 : '恢复请求结果尚未确认。请保留当前恢复操作并重新检查状态，不要重复提交。';
         case 'invalid-request':
         case 'conflict':
-            return '身份恢复暂未完成。请保留当前恢复操作并重新检查状态，不要重新获取验证码或创建新身份。';
+            return '身份恢复暂未完成。请重新检查状态，或返回入口稍后继续；请勿为同一账号重复发起恢复。';
         case 'rate-limited':
             return '恢复状态检查过于频繁，请稍后继续。';
+        case 'remote':
+        case 'forbidden':
+            return 'AWiki 服务暂时未能完成恢复。可以重新检查结果，或返回入口稍后继续。';
         default:
-            return `${failure.code}：${failure.message}`;
+            return '身份恢复暂未完成。请保留当前恢复操作并重新检查状态，不要重新获取验证码或创建新身份。';
     }
 }
 function identityAccessInspectionFailureMessage(failure) {
@@ -90,9 +127,10 @@ function identityAccessInspectionFailureMessage(failure) {
         case 'remote':
             return 'AWiki 服务暂时无法确认该 Handle 的状态，请稍后重试。';
         default:
-            return `${failure.code}：${failure.message}`;
+            return 'AWiki 服务暂时无法确认该 Handle 的状态，请稍后重试。';
     }
 }
+const IDENTITY_ACCESS_FAILURE_MESSAGE = '暂时无法读取本机身份状态，请稍后重新检查。';
 const INITIAL_VIEW = Object.freeze({
     status: 'cold',
     sessionStatus: 'unregistered',
@@ -106,7 +144,6 @@ const INITIAL_VIEW = Object.freeze({
     groupAccess: null,
     groupMembers: Object.freeze([]),
     groupMembersHasMore: false,
-    groupRecovery: null,
     messages: Object.freeze([]),
     historyHasMore: false,
     localPending: false,
@@ -114,11 +151,14 @@ const INITIAL_VIEW = Object.freeze({
     pending: null,
     error: null,
     attachmentMaxBytes: 0,
-    profileName: null,
-    legacySharedStateDetected: false,
+    handleRecoveryPhoneEnabled: false,
     summaries: Object.freeze({}),
+    identityAccess: null,
+    accessLoading: true,
+    accessError: null,
     recoveryOperationId: null,
     recoveryProgress: null,
+    recoveryOtpRetryAt: null,
 });
 /** Turn a closed Host summary failure into one actionable Chinese message. */
 function summaryFailureMessage(failure) {
@@ -128,7 +168,7 @@ function summaryFailureMessage(failure) {
         case 'summary-cancelled': return 'AI 总结已取消，请重新生成。';
         case 'summary-invalid-output': return '模型没有返回有效的结构化摘要，请重新生成。';
         case 'summary-failed': return '暂时无法生成 AI 总结，请检查模型连接后重试。';
-        default: return `${failure.code}：${failure.message}`;
+        default: return '暂时无法生成 AI 总结，请检查模型连接后重试。';
     }
 }
 /** Turn closed mail failures into safe, actionable browser messages. */
@@ -156,7 +196,7 @@ function groupCreateFailureMessage(failure) {
         case 'network': return '无法连接 AWiki 服务，请检查网络后重试。';
         case 'conflict': return '群聊创建状态发生冲突，请刷新群聊列表后确认是否已经创建。';
         case 'remote': return 'AWiki 服务暂时无法创建群聊，请稍后重试。';
-        default: return `${failure.code}：${failure.message}`;
+        default: return 'AWiki 服务暂时无法创建群聊，请稍后重试。';
     }
 }
 /** Keep group authorization failures actionable without exposing raw service text. */
@@ -175,47 +215,12 @@ function groupReadFailureMessage(failure) {
         case 'remote':
             return 'AWiki 暂时无法读取这个群聊，请稍后重试。';
         default:
-            return `${failure.code}：${failure.message}`;
+            return 'AWiki 暂时无法读取这个群聊，请稍后重试。';
     }
 }
-function groupRecoveryFailureMessage(failure) {
-    return failure.code === 'network'
-        ? '无法连接 AWiki 服务，暂时不能恢复旧群聊身份。'
-        : '暂时不能检查旧群聊身份，请稍后重试。';
-}
 function conversationPreferenceFailureMessage(_failure) {
     return '无法保存本机会话设置，请稍后重试。';
 }
-function recoveryFingerprint(parts) {
-    let hash = 0x811c9dc5;
-    for (const part of parts) {
-        for (let index = 0; index < part.length; index += 1) {
-            hash ^= part.charCodeAt(index);
-            hash = Math.imul(hash, 0x01000193);
-        }
-        hash ^= 0;
-        hash = Math.imul(hash, 0x01000193);
-    }
-    return (hash >>> 0).toString(16).padStart(8, '0');
-}
-function groupRecoveryProjection(summary, hiddenGroupDids) {
-    const hiddenItems = summary.items.filter(item => hiddenGroupDids.has(item.groupDid));
-    const hiddenPending = hiddenItems.filter(item => item.status === 'pending').length;
-    const hiddenBlocked = hiddenItems.filter(item => item.status === 'blocked').length;
-    const pending = Math.max(0, summary.pending - hiddenPending);
-    const blocked = Math.max(0, summary.blocked - hiddenBlocked);
-    const visibleItems = summary.items
-        .filter(item => !hiddenGroupDids.has(item.groupDid))
-        .map(item => `${item.status}:${item.groupDid}`)
-        .sort();
-    const signature = `v1:${pending}:${blocked}:${recoveryFingerprint(visibleItems)}`;
-    if (blocked > 0)
-        return { view: { status: 'blocked', pending, blocked }, signature };
-    return {
-        view: pending > 0 ? { status: 'pending', pending, blocked: 0 } : null,
-        signature,
-    };
-}
 function groupReadFailureReason(failure) {
     switch (failure.code) {
         case 'group-identity-stale': return 'recovering';
@@ -245,49 +250,70 @@ async function callGroupRead(operation) {
     }
 }
 /** Flatten the carrier and business result once for every controller caller. */
-async function call(operation, failureMessage = failure => `${failure.code}：${failure.message}`, carrierFailureMessage = message => `连接 AWiki Host 失败：${message}`) {
+async function call(operation, failureMessage = genericFailureMessage, carrierFailureMessage = genericCarrierFailureMessage) {
     try {
         const carried = await operation();
         if (!carried.ok)
-            return { ok: false, error: carrierFailureMessage(carried.error.message) };
+            return { ok: false, error: carrierFailureMessage(carried.error) };
         if (!carried.value.ok) {
             return { ok: false, error: failureMessage(carried.value.error) };
         }
         return { ok: true, value: carried.value.value };
     }
-    catch (error) {
-        return {
-            ok: false,
-            error: error instanceof Error ? `AWiki 调用失败：${error.message}` : 'AWiki 调用失败',
-        };
+    catch {
+        return { ok: false, error: GENERIC_THROW_FAILURE_MESSAGE };
+    }
+}
+/** Flatten the carrier and the isolated Guest Integration business result. */
+async function callIntegration(operation) {
+    try {
+        const carried = await operation();
+        if (!carried.ok)
+            return { ok: false, error: genericCarrierFailureMessage(carried.error) };
+        if (!carried.value.ok) {
+            const failure = carried.value.error;
+            const error = failure.code === 'not-found'
+                ? '尚未创建 Integration。'
+                : failure.code === 'conflict'
+                    ? 'Integration 已在其他位置更新，请重新加载后再试。'
+                    : failure.code === 'invalid-request'
+                        ? 'Integration 信息不完整或格式不正确。'
+                        : failure.code === 'unauthorized' || failure.code === 'forbidden'
+                            ? '当前 AWiki 身份无权管理此 Integration。'
+                            : failure.code === 'rate-limited'
+                                ? 'Integration 操作过于频繁，请稍后重试。'
+                                : '临时消息服务暂时不可用，请稍后重试。';
+            return { ok: false, error, failureCode: failure.code };
+        }
+        return { ok: true, value: carried.value.value };
+    }
+    catch {
+        return { ok: false, error: '临时消息服务暂时不可用，请稍后重试。' };
     }
 }
 /** Preserve only the stable business code for controller-level state transitions. */
-async function callWithFailureCode(operation) {
+async function callWithFailureCode(operation, failureMessage = genericFailureMessage) {
     try {
         const carried = await operation();
         if (!carried.ok)
-            return { ok: false, error: `连接 AWiki Host 失败：${carried.error.message}` };
+            return { ok: false, error: genericCarrierFailureMessage(carried.error) };
         if (!carried.value.ok) {
             return {
                 ok: false,
-                error: `${carried.value.error.code}：${carried.value.error.message}`,
+                error: failureMessage(carried.value.error),
                 failureCode: carried.value.error.code,
             };
         }
         return { ok: true, value: carried.value.value };
     }
-    catch (error) {
-        return {
-            ok: false,
-            error: error instanceof Error ? `AWiki 调用失败：${error.message}` : 'AWiki 调用失败',
-        };
+    catch {
+        return { ok: false, error: GENERIC_THROW_FAILURE_MESSAGE };
     }
 }
-function recoveryCarrierFailureMessage(message) {
-    return message.includes('business result failed boundary validation')
+function recoveryCarrierFailureMessage(failure) {
+    return failure.code === 'invalid-response'
         ? '恢复信息已验证，但暂时无法读取恢复状态。请稍后重试。'
-        : `连接 AWiki Host 失败：${message}`;
+        : '暂时无法连接 AWiki Host，无法完成身份恢复。请稍后重试。';
 }
 /** Append unique values while retaining existing references. */
 function appendUnique(current, incoming, id) {
@@ -386,23 +412,19 @@ function sameIdentity(identity, peer) {
 const GROUP_HISTORY_RETRY_DELAYS_MS = [250, 750, 1_500, 2_500];
 /** Runtime-only decoded-byte budget that prevents repeat Host calls while browsing. */
 const BROWSER_IMAGE_ATTACHMENT_CACHE_MAX_BYTES = 32 * 1024 * 1024;
-const RECOVERY_OPERATION_STORAGE_PREFIX = 'awiki.handle-recovery.operation.v2:';
-function recoveryOperationStorageKey(tenantDomain) {
-    return `${RECOVERY_OPERATION_STORAGE_PREFIX}${encodeURIComponent(tenantDomain)}`;
+const RECOVERY_OPERATION_STORAGE_KEY = 'awiki.handle-recovery.operation.v1';
+const RECOVERY_OTP_RETRY_STORAGE_KEY = 'awiki.handle-recovery.retry-at.v1';
+function recoveryOperationStorageKey(tenantId) {
+    return tenantId === undefined || tenantId === ''
+        ? RECOVERY_OPERATION_STORAGE_KEY
+        : `${RECOVERY_OPERATION_STORAGE_KEY}.${encodeURIComponent(tenantId)}`;
 }
-function storedRecoveryOperation(tenantDomain) {
-    try {
-        return globalThis.localStorage?.getItem(recoveryOperationStorageKey(tenantDomain)) ?? null;
-    }
-    catch {
-        return null;
-    }
+function recoveryTenantKey(tenantId) {
+    return tenantId === undefined || tenantId === '' ? 'default' : tenantId;
 }
-function storeRecoveryOperation(tenantDomain, operationId) {
-    if (tenantDomain === undefined)
-        return;
+function storeRecoveryOperation(operationId, tenantId) {
     try {
-        const key = recoveryOperationStorageKey(tenantDomain);
+        const key = recoveryOperationStorageKey(tenantId);
         if (operationId === null)
             globalThis.localStorage?.removeItem(key);
         else
@@ -412,6 +434,49 @@ function storeRecoveryOperation(tenantDomain, operationId) {
         // Recovery remains durable in Core even when browser storage is unavailable.
     }
 }
+function recoveryOtpRetryStorageKey(operationId, tenantId) {
+    return `${RECOVERY_OTP_RETRY_STORAGE_KEY}.${encodeURIComponent(recoveryTenantKey(tenantId))}.${encodeURIComponent(operationId)}`;
+}
+function recoveryOtpRetryAt(result) {
+    const advertised = Date.parse(result.retryAt);
+    const deadline = Number.isFinite(advertised)
+        ? advertised
+        : Date.now() + Math.max(0, result.retryAfterSeconds) * 1_000;
+    return new Date(deadline).toISOString();
+}
+function storedRecoveryOtpRetryAt(operationId, tenantId) {
+    if (operationId === null)
+        return null;
+    try {
+        const key = recoveryOtpRetryStorageKey(operationId, tenantId);
+        const value = globalThis.localStorage?.getItem(key);
+        if (value === null || value === undefined)
+            return null;
+        const deadline = Date.parse(value);
+        if (!Number.isFinite(deadline) || deadline <= Date.now()) {
+            globalThis.localStorage?.removeItem(key);
+            return null;
+        }
+        return new Date(deadline).toISOString();
+    }
+    catch {
+        return null;
+    }
+}
+function storeRecoveryOtpRetryAt(operationId, retryAt, tenantId) {
+    try {
+        globalThis.localStorage?.setItem(recoveryOtpRetryStorageKey(operationId, tenantId), retryAt);
+    }
+    catch { }
+}
+function clearRecoveryOtpRetryAt(operationId, tenantId) {
+    if (operationId === null)
+        return;
+    try {
+        globalThis.localStorage?.removeItem(recoveryOtpRetryStorageKey(operationId, tenantId));
+    }
+    catch { }
+}
 /** Wait between group-history readiness probes without retaining controller state. */
 function delay(milliseconds) {
     return new Promise(resolve => setTimeout(resolve, milliseconds));
@@ -458,13 +523,20 @@ function targetOf(conversation) {
 export class AwikiController {
     remote;
     persistentImageCache;
+    drafts = new AwikiDraftStore();
     view = INITIAL_VIEW;
     listeners = new Set();
+    /** Runtime-only selected operations survive tenant round trips without reopening stale browser hints after reload. */
+    recoveryOperationsByTenant = new Map();
     config = null;
     conversationsCursor;
     historyCursor;
     groupMembersCursor;
     timer;
+    opening;
+    drawerOpen = false;
+    accessRequest;
+    tenantTransition;
     generation = 0;
     selectionRevision = 0;
     disposed = false;
@@ -476,18 +548,12 @@ export class AwikiController {
     directProfiles = new Map();
     /** Last trustworthy group title for the active identity, keyed by canonical Group DID. */
     groupTitles = new Map();
-    /** Current secret-free Core journal state, keyed by canonical Group DID. */
-    groupRecoveryItems = new Map();
     /** Identity-scoped product overlays. Core conversations and history remain untouched. */
     hiddenConversationPreferences = new Map();
-    dismissedGroupRecoverySignature;
-    lastGroupRecoverySignature;
-    lastGroupRecoverySummary;
     /** Verified image payloads retained outside observable state for instant remounts. */
     imageAttachments = new Map();
     imageAttachmentCacheBytes = 0;
     presentationCacheOwnerDid = null;
-    groupRecoveryOperation;
     /**
      * @param remote - generated Host Remote namespace.
      * @param persistentImageCache - browser-origin verified preview cache.
@@ -503,51 +569,67 @@ export class AwikiController {
         this.listeners.add(listener);
         return () => { this.listeners.delete(listener); };
     };
+    /** Open the deployment-matched dynamic Integration guide. */
+    openIntegrationGuide() {
+        const url = this.config?.integrationGuideUrl;
+        if (url !== undefined)
+            window.open(url, '_blank', 'noopener,noreferrer');
+    }
     /** Load Host policy and the shared identity state without starting drawer polling. */
-    async loadSession() {
+    async loadSession(preserveView = false) {
         if (this.disposed)
             return { ok: false, error: 'AWiki 插件已卸载' };
-        this.close();
-        this.summaryBaselines.clear();
+        this.stopPollingLifecycle();
+        if (!preserveView)
+            this.summaryBaselines.clear();
+        const previous = this.view;
+        const previousTenant = this.config?.tenantId;
         const generation = this.generation;
-        this.publish({ ...INITIAL_VIEW, status: 'loading' });
+        if (!preserveView)
+            this.publish({ ...INITIAL_VIEW, status: 'loading' });
+        const failed = (error) => {
+            if (preserveView)
+                this.publish({ ...this.view, error });
+            else
+                this.fail(error);
+            return { ok: false, error };
+        };
         const config = await call(() => this.remote.getConfig());
         if (!this.current(generation))
             return { ok: true, value: undefined };
         if (!config.ok)
-            return this.fail(config.error);
+            return failed(config.error);
         this.config = config.value;
         const session = await call(() => this.remote.getSession());
         if (!this.current(generation))
             return { ok: true, value: undefined };
         if (!session.ok)
-            return this.fail(session.error);
+            return failed(session.error);
         const identity = session.value.status === 'active' ? session.value.identity : null;
+        const sameOwner = preserveView && previousTenant === config.value.tenantId
+            && previous.sessionStatus === session.value.status && previous.identity?.did === identity?.did;
+        this.drafts.setScope(config.value.tenantId ?? 'default', identity?.did ?? session.value.status);
         this.activatePresentationCache(identity);
+        const selectedRecovery = previousTenant === config.value.tenantId
+            ? previous.recoveryOperationId
+            : this.recoveryOperationsByTenant.get(recoveryTenantKey(config.value.tenantId)) ?? null;
         this.publish({
-            ...this.view,
+            ...(sameOwner ? this.view : INITIAL_VIEW),
             status: 'ready',
             sessionStatus: session.value.status,
             identity: session.value.status === 'active' ? session.value.identity : null,
             error: null,
             attachmentMaxBytes: config.value.attachmentMaxBytes,
-            profileName: config.value.profileName ?? null,
-            legacySharedStateDetected: config.value.legacySharedStateDetected ?? false,
-            recoveryOperationId: storedRecoveryOperation(config.value.tenantDomain),
+            handleRecoveryPhoneEnabled: config.value.handleRecoveryPhoneEnabled,
+            recoveryOperationId: selectedRecovery,
+            recoveryOtpRetryAt: storedRecoveryOtpRetryAt(selectedRecovery, config.value.tenantId),
         });
-        const operationId = storedRecoveryOperation(config.value.tenantDomain);
-        if (operationId !== null) {
-            const recovery = await call(() => this.remote.getRecoveryStatus({ operationId }));
-            if (this.current(generation) && recovery.ok) {
-                this.publish({ ...this.view, recoveryOperationId: operationId, recoveryProgress: recovery.value });
-                if (recovery.value.phase === 'applied') {
-                    storeRecoveryOperation(config.value.tenantDomain, null);
-                    this.publish({ ...this.view, recoveryOperationId: null, recoveryProgress: recovery.value });
-                    if (identity === null)
-                        return this.loadSession();
-                }
-            }
-        }
+        await this.refreshIdentityAccess();
+        if (!this.current(generation))
+            return { ok: true, value: undefined };
+        if (identity !== null && previous.identity?.did !== identity.did
+            && this.view.recoveryOperationId === null && this.view.identityAccess?.recoveries.length === 0)
+            this.drafts.clearFlow();
         if (identity !== null) {
             await this.loadConversationPreferences(generation);
             const profile = await call(() => this.remote.getProfile());
@@ -561,19 +643,42 @@ export class AwikiController {
      * @returns successful readiness or one display-safe Host failure.
      */
     async open() {
-        const loaded = await this.loadSession();
-        if (!loaded.ok)
-            return loaded;
+        this.drawerOpen = true;
+        if (this.tenantTransition !== undefined) {
+            return this.tenantTransition.then(() => this.view.error === null ? { ok: true, value: undefined } : { ok: false, error: this.view.error }, () => ({ ok: false, error: this.view.error ?? '租户切换未完成，请重试' }));
+        }
+        if (this.opening !== undefined)
+            return this.opening;
+        const opening = this.openOnce();
+        this.opening = opening;
+        try {
+            return await opening;
+        }
+        finally {
+            if (this.opening === opening)
+                this.opening = undefined;
+        }
+    }
+    async openOnce() {
+        const loading = this.loadSession(this.view.status === 'ready');
         const generation = this.generation;
-        if (this.view.identity !== null) {
-            const listed = await this.refreshConversationsAndRecoverGroups(generation);
-            if (!listed.ok)
-                return listed;
+        const loaded = await loading;
+        if (!loaded.ok && this.view.status !== 'ready')
+            return loaded;
+        if (!this.current(generation) || !this.drawerOpen)
+            return loaded;
+        let listed = loaded;
+        if (loaded.ok && this.view.identity !== null) {
+            listed = await this.refreshConversations(generation, this.view.conversations.length > 0);
+            if (this.view.selectedConversationId !== null)
+                await this.poll(generation);
         }
-        if (this.current(generation)) {
+        if (this.current(generation) && this.drawerOpen) {
+            if (this.timer !== undefined)
+                clearInterval(this.timer);
             this.timer = setInterval(() => { void this.poll(generation); }, this.config?.pollIntervalMs ?? 3_000);
         }
-        return { ok: true, value: undefined };
+        return listed;
     }
     /** Sign out locally while retaining the SDK-owned identity and database. */
     async logout(request) {
@@ -582,6 +687,7 @@ export class AwikiController {
         const result = await call(() => this.remote.logout(request));
         if (!result.ok)
             return result;
+        this.drafts.clearScope();
         this.close();
         this.conversationsCursor = undefined;
         this.historyCursor = undefined;
@@ -592,7 +698,9 @@ export class AwikiController {
             status: 'ready',
             sessionStatus: 'signed-out',
             attachmentMaxBytes: this.config?.attachmentMaxBytes ?? 0,
+            handleRecoveryPhoneEnabled: this.config?.handleRecoveryPhoneEnabled ?? false,
         });
+        await this.loadSession();
         return result;
     }
     /** Resume the preserved local identity and reload its conversations. */
@@ -609,7 +717,52 @@ export class AwikiController {
     }
     /** Stop polling and invalidate all in-flight drawer work. */
     close() {
+        this.drawerOpen = false;
+        this.opening = undefined;
+        this.stopPollingLifecycle();
+    }
+    /** Fence old requests before switching, then restore the currently visible tenant view. */
+    async switchTenant(change) {
+        if (this.disposed)
+            throw new Error('AWiki 插件已卸载');
+        if (this.tenantTransition !== undefined)
+            throw new Error('租户正在切换，请稍候');
+        this.opening = undefined;
+        this.stopPollingLifecycle();
+        this.conversationsCursor = undefined;
+        this.historyCursor = undefined;
+        this.unreadAtOpen.clear();
+        this.clearPresentationCache();
+        this.publish({ ...INITIAL_VIEW, status: 'loading' });
+        const transition = (async () => {
+            let switchError;
+            try {
+                await change();
+            }
+            catch (error) {
+                switchError = error;
+            }
+            // On failure the Host restores its previous tenant. Reload that exact committed state too.
+            if (!this.disposed) {
+                const loaded = this.drawerOpen ? await this.openOnce() : await this.loadSession();
+                if (!loaded.ok)
+                    throw new Error(loaded.error);
+            }
+            if (switchError !== undefined)
+                throw switchError;
+        })();
+        this.tenantTransition = transition;
+        try {
+            await transition;
+        }
+        finally {
+            if (this.tenantTransition === transition)
+                this.tenantTransition = undefined;
+        }
+    }
+    stopPollingLifecycle() {
         this.generation += 1;
+        this.accessRequest = undefined;
         this.selectionRevision += 1;
         if (this.timer !== undefined)
             clearInterval(this.timer);
@@ -624,7 +777,125 @@ export class AwikiController {
      * @returns challenge retry metadata or one display-safe failure.
      */
     async sendRegistrationOtp(request) {
-        return this.withPending('发送验证码', () => call(() => this.remote.sendRegistrationOtp(request), registrationOtpFailureMessage));
+        const result = await this.withPending('发送验证码', () => callWithFailureCode(() => this.remote.sendRegistrationOtp(request), registrationOtpFailureMessage));
+        return !result.ok && result.failureCode !== 'short-handle-invite-required'
+            ? { ok: false, error: result.error }
+            : result;
+    }
+    /** Discover Core-owned work without selecting an account or activating a session. */
+    refreshIdentityAccess() {
+        if (this.accessRequest !== undefined)
+            return this.accessRequest;
+        const request = this.loadIdentityAccess();
+        this.accessRequest = request;
+        const settled = () => { if (this.accessRequest === request)
+            this.accessRequest = undefined; };
+        void request.then(settled, settled);
+        return request;
+    }
+    async loadIdentityAccess() {
+        const generation = this.generation;
+        const revision = this.recoveryRevision;
+        this.publish({ ...this.view, accessLoading: true, accessError: null });
+        const result = await call(() => this.remote.getIdentityAccessState());
+        if (!this.recoveryCurrent(generation, revision))
+            return this.recoveryLeft();
+        if (!result.ok) {
+            this.publish({ ...this.view, accessLoading: false, accessError: IDENTITY_ACCESS_FAILURE_MESSAGE });
+            return { ok: false, error: IDENTITY_ACCESS_FAILURE_MESSAGE };
+        }
+        const candidates = result.value.recoveries;
+        const selected = this.view.recoveryOperationId;
+        this.publish({ ...this.view, identityAccess: result.value, recoveryOperationId: selected,
+            recoveryProgress: selected === this.view.recoveryOperationId ? this.view.recoveryProgress : null,
+            recoveryOtpRetryAt: storedRecoveryOtpRetryAt(selected, this.config?.tenantId) });
+        if (selected !== null) {
+            const status = await callWithFailureCode(() => this.remote.getRecoveryStatus({ operationId: selected }));
+            if (!this.recoveryCurrent(generation, revision))
+                return this.recoveryLeft();
+            if (!status.ok) {
+                if (status.failureCode === 'not-found' && candidates.length === 0) {
+                    clearRecoveryOtpRetryAt(selected, this.config?.tenantId);
+                    this.rememberRecoveryOperation(null, this.config?.tenantId);
+                    this.publish({ ...this.view, recoveryOperationId: null, recoveryProgress: null, recoveryOtpRetryAt: null });
+                }
+                else {
+                    this.publish({ ...this.view, accessLoading: false, accessError: IDENTITY_ACCESS_FAILURE_MESSAGE });
+                    return { ok: false, error: IDENTITY_ACCESS_FAILURE_MESSAGE };
+                }
+            }
+            else {
+                const complete = status.value.phase === 'applied';
+                if (complete)
+                    clearRecoveryOtpRetryAt(selected, this.config?.tenantId);
+                this.publish({ ...this.view, recoveryProgress: status.value,
+                    recoveryOtpRetryAt: complete ? null : storedRecoveryOtpRetryAt(selected, this.config?.tenantId),
+                    identityAccess: result.value });
+            }
+        }
+        this.publish({ ...this.view, accessLoading: false, accessError: null });
+        return { ok: true, value: undefined };
+    }
+    async selectRecovery(operationId) {
+        if (!this.view.identityAccess?.recoveries.some(value => value.operationId === operationId)) {
+            return { ok: false, error: '恢复操作已变化，请刷新后重试。' };
+        }
+        if (this.view.recoveryOperationId !== null)
+            this.leaveRecovery();
+        else
+            this.recoveryRevision++;
+        this.rememberRecoveryOperation(operationId, this.config?.tenantId);
+        this.publish({ ...this.view, recoveryOperationId: operationId, recoveryProgress: null,
+            recoveryOtpRetryAt: storedRecoveryOtpRetryAt(operationId, this.config?.tenantId) });
+        const result = await this.refreshRecoveryStatus();
+        return result.ok ? { ok: true, value: undefined } : result;
+    }
+    recoveryRevision = 0;
+    pendingRecovery = false;
+    recoveryCurrent(generation, revision) {
+        return this.current(generation) && revision === this.recoveryRevision;
+    }
+    recoveryLeft() {
+        return { ok: false, error: '已离开此恢复流程；进度保留在本机。' };
+    }
+    rememberRecoveryOperation(operationId, tenantId) {
+        const key = recoveryTenantKey(tenantId);
+        if (operationId === null) {
+            this.recoveryOperationsByTenant.delete(key);
+            storeRecoveryOperation(null, tenantId);
+        }
+        else {
+            this.recoveryOperationsByTenant.set(key, operationId);
+        }
+    }
+    /** Navigation only. Never cancel or delete the Core-owned operation. */
+    leaveRecovery() {
+        this.recoveryRevision++;
+        this.accessRequest = undefined;
+        const wasPending = this.pendingRecovery;
+        if (wasPending)
+            this.pendingRequest = undefined;
+        this.pendingRecovery = false;
+        this.drafts.clearFlow();
+        this.rememberRecoveryOperation(null, this.config?.tenantId);
+        this.publish({ ...this.view, recoveryOperationId: null, recoveryProgress: null, accessError: null,
+            accessLoading: false, pending: wasPending ? null : this.view.pending, error: null });
+    }
+    /** Inspect this tenant's durable operations before requesting any new OTP for a Handle. */
+    async continueRecoveryForHandle(handle) {
+        const target = handle.trim().toLowerCase();
+        const loaded = await this.refreshIdentityAccess();
+        if (!loaded.ok)
+            return loaded;
+        const matches = this.view.identityAccess?.recoveries.filter(value => target.includes('.')
+            ? value.fullHandle.toLowerCase() === target
+            : value.fullHandle.slice(0, value.fullHandle.indexOf('.')).toLowerCase() === target) ?? [];
+        if (matches.length > 1)
+            return { ok: false, error: '此账号的恢复状态存在冲突，请重新检查。' };
+        if (matches.length === 0)
+            return { ok: true, value: false };
+        const selected = await this.selectRecovery(matches[0].operationId);
+        return selected.ok ? { ok: true, value: true } : selected;
     }
     /** Classify one Handle before sending exactly one registration or recovery OTP. */
     async inspectIdentityAccess(request) {
@@ -638,15 +909,144 @@ export class AwikiController {
     async registerIdentity(request) {
         const generation = this.generation;
         const result = await this.withPending('注册身份', () => call(() => this.remote.registerIdentity(request), registrationFailureMessage));
-        if (!result.ok)
+        if (!result.ok) {
+            if (this.current(generation))
+                await this.refreshIdentityAccess();
             return result;
+        }
         if (!this.current(generation))
             return result;
-        this.activatePresentationCache(result.value);
-        this.publish({ ...this.view, sessionStatus: 'active', identity: result.value, error: null });
-        await this.refreshConversationsAndRecoverGroups(generation);
+        if (result.value.status === 'join-required') {
+            this.publish({ ...this.view, identityAccess: { choice: result.value, joining: false, recoveries: [] } });
+        }
+        if (result.value.status === 'registered') {
+            this.drafts.clearScope();
+            this.drafts.setScope(this.config?.tenantId ?? 'default', result.value.identity.did);
+            this.activatePresentationCache(result.value.identity);
+            this.publish({ ...this.view, sessionStatus: 'active', identity: result.value.identity, error: null });
+            await this.refreshConversations(generation);
+        }
         return result;
     }
+    async beginDeviceJoin() {
+        const generation = this.generation;
+        const result = await this.withPending('开始加入设备', () => call(() => this.remote.beginDeviceJoin()));
+        if (result.ok && this.current(generation))
+            this.publish({ ...this.view, identityAccess: { choice: null, joining: true, recoveries: [] } });
+        return result;
+    }
+    async getDeviceJoinStatus() {
+        const generation = this.generation;
+        const result = await call(() => this.remote.getDeviceJoinStatus());
+        if (!this.current(generation))
+            return { ok: false, error: '身份环境已改变，请重新确认当前流程。' };
+        if (result.ok && result.value?.completed) {
+            this.drafts.clearFlow();
+            await this.open();
+        }
+        return result;
+    }
+    cancelDeviceJoin() {
+        return this.withPending('取消加入设备', async () => {
+            const generation = this.generation;
+            const result = await call(() => this.remote.cancelDeviceJoin());
+            if (result.ok && this.current(generation))
+                this.publish({ ...this.view, identityAccess: { choice: null, joining: false, recoveries: [] } });
+            return result.ok ? { ok: true, value: undefined } : result;
+        });
+    }
+    /** Cancel one exact Join choice and send Recovery OTP only while its original browser scope remains current. */
+    async beginRecoveryFromDeviceJoin(request) {
+        const generation = this.generation;
+        const tenantId = this.config?.tenantId;
+        const flowScope = this.drafts.getScope('recovery:retryDeadline');
+        const flowEpoch = this.drafts.epoch(flowScope);
+        const changed = () => ({
+            ok: false,
+            error: '恢复能力或身份环境已改变，请重新检查后再选择。',
+        });
+        const scopeCurrent = () => this.current(generation)
+            && this.config?.tenantId === tenantId
+            && this.drafts.getScope('recovery:retryDeadline') === flowScope
+            && this.drafts.epoch(flowScope) === flowEpoch;
+        if (!scopeCurrent())
+            return changed();
+        const latest = await call(() => this.remote.getConfig());
+        if (!scopeCurrent())
+            return changed();
+        if (!latest.ok)
+            return { ok: false, error: '暂时无法确认服务器的恢复能力，请稍后重试。' };
+        if (latest.value.tenantId !== tenantId)
+            return changed();
+        this.config = latest.value;
+        this.publish({ ...this.view, handleRecoveryPhoneEnabled: latest.value.handleRecoveryPhoneEnabled });
+        if (latest.value.tenantOnline === false) {
+            return { ok: false, error: '暂时无法确认服务器的恢复能力，请稍后重试。' };
+        }
+        if (!latest.value.handleRecoveryPhoneEnabled) {
+            return { ok: false, error: '当前服务器未启用手机号恢复，请加入新设备或联系管理员。' };
+        }
+        const current = () => scopeCurrent() && this.config?.handleRecoveryPhoneEnabled === true;
+        const result = await this.withPending('开始恢复身份', async () => {
+            const discarded = await call(() => this.remote.cancelDeviceJoin());
+            if (!discarded.ok)
+                return discarded;
+            if (!current())
+                return changed();
+            this.publish({ ...this.view, identityAccess: { choice: null, joining: false, recoveries: [] } });
+            if (request.phone === '')
+                return { ok: true, value: null };
+            return call(() => this.remote.sendRecoveryOtp(request), registrationOtpFailureMessage);
+        }, { publishFailure: false, recovery: true });
+        if (!result.ok) {
+            if (current())
+                await this.continueRecoveryForHandle(request.fullHandle);
+            return result;
+        }
+        if (result.value === null)
+            return result;
+        this.recordRecoveryOtp(result.value, tenantId);
+        const sameFlow = this.config?.tenantId === tenantId
+            && this.drafts.getScope('recovery:retryDeadline') === flowScope
+            && this.drafts.epoch(flowScope) === flowEpoch;
+        if (!sameFlow)
+            return result;
+        const retryAt = recoveryOtpRetryAt(result.value);
+        this.publish({ ...this.view, recoveryOperationId: result.value.operationId, recoveryProgress: null,
+            recoveryOtpRetryAt: retryAt });
+        await this.refreshRecoveryStatus();
+        return result;
+    }
+    retireDeviceIdentityForRejoin() {
+        return this.withPending('准备重新加入设备', async () => {
+            const result = await call(() => this.remote.retireDeviceIdentityForRejoin());
+            if (!result.ok)
+                return result;
+            this.publish({ ...this.view, sessionStatus: 'unregistered', identity: null, error: null });
+            return { ok: true, value: undefined };
+        });
+    }
+    refreshDeviceManagement() {
+        return call(() => this.remote.refreshDeviceManagement());
+    }
+    startDeviceJoinVerification(request) {
+        return this.withPending('开始设备验证', () => call(() => this.remote.startDeviceJoinVerification(request)));
+    }
+    approveDeviceJoin(request) {
+        return this.withPending('批准设备', () => call(() => this.remote.approveDeviceJoin(request)));
+    }
+    rejectDeviceJoin(request) {
+        return this.withPending('拒绝设备', () => call(() => this.remote.rejectDeviceJoin(request)));
+    }
+    revokeDevice(request) {
+        return this.withPending('撤销设备', () => call(() => this.remote.revokeDevice(request)));
+    }
+    prepareRootTransfer(request) {
+        return this.withPending('准备授予管理权', () => call(() => this.remote.prepareRootTransfer(request)));
+    }
+    confirmRootTransfer(request) {
+        return this.withPending('验证并授予管理权', () => call(() => this.remote.confirmRootTransfer(request)));
+    }
     /**
      * Update the deployment identity's public display name.
      * @param displayName - replacement display name selected by the user.
@@ -686,105 +1086,135 @@ export class AwikiController {
         this.publish({ ...this.view, identity, profile: result.value, error: null });
         return result;
     }
-    /** Request a recovery OTP and persist only its secret-free operation id in the browser. */
+    /** Request a dedicated OTP only within the selected account flow. */
     async sendRecoveryOtp(request) {
-        const result = await this.withPending('发送恢复验证码', () => call(() => this.remote.sendRecoveryOtp(request), registrationOtpFailureMessage), { publishFailure: false });
-        if (!result.ok)
+        const generation = this.generation;
+        const revision = this.recoveryRevision;
+        const tenantId = this.config?.tenantId;
+        const flowScope = this.drafts.getScope('recovery:retryDeadline');
+        const result = await this.withPending('发送恢复验证码', () => call(() => this.remote.sendRecoveryOtp(request), registrationOtpFailureMessage), { publishFailure: false, recovery: true });
+        if (!result.ok) {
+            if (!this.recoveryCurrent(generation, revision))
+                return this.recoveryLeft();
+            await this.continueRecoveryForHandle(request.fullHandle);
             return result;
-        storeRecoveryOperation(this.config?.tenantDomain, result.value.operationId);
-        this.publish({ ...this.view, recoveryOperationId: result.value.operationId, recoveryProgress: null });
-        return result;
+        }
+        this.recordRecoveryOtp(result.value, tenantId);
+        if (!this.recoveryCurrent(generation, revision)
+            || this.config?.tenantId !== tenantId
+            || this.drafts.getScope('recovery:retryDeadline') !== flowScope)
+            return result;
+        this.publish({ ...this.view, recoveryOperationId: result.value.operationId, recoveryProgress: null,
+            recoveryOtpRetryAt: recoveryOtpRetryAt(result.value) });
+        await this.refreshRecoveryStatus();
+        return this.recoveryCurrent(generation, revision) ? result : this.recoveryLeft();
     }
-    /** Verify the recovery OTP without attempting the remote identity mutation yet. */
-    async prepareRecovery(request) {
-        const operationId = this.view.recoveryOperationId;
-        if (operationId === null)
-            return this.fail('请先获取恢复验证码');
-        const result = await this.withPending('验证恢复信息', () => call(() => this.remote.prepareRecovery({ ...request, operationId }), recoveryPreparationFailureMessage, recoveryCarrierFailureMessage), { publishFailure: false });
-        if (result.ok)
-            this.publish({ ...this.view, recoveryProgress: result.value });
-        return result;
+    recordRecoveryOtp(result, tenantId) {
+        this.rememberRecoveryOperation(result.operationId, tenantId);
+        storeRecoveryOtpRetryAt(result.operationId, recoveryOtpRetryAt(result), tenantId);
     }
-    /** Commit the prepared operation once. Unknown outcomes remain available through status refresh. */
-    async activateRecovery() {
+    /** Publish results only into the exact selected flow; Core work survives navigation. */
+    async runRecovery(label, operation, enterWhenApplied = false) {
+        const generation = this.generation;
+        const revision = this.recoveryRevision;
         const operationId = this.view.recoveryOperationId;
         if (operationId === null)
-            return this.fail('没有可继续的身份恢复操作');
-        if (this.view.recoveryProgress?.phase !== 'ready_to_commit')
-            return this.fail('请先完成恢复信息验证');
-        const phase = this.view.recoveryProgress.phase;
-        const result = await this.withPending('恢复身份', () => call(() => this.remote.activateRecovery({ operationId }), failure => recoveryContinuationFailureMessage(failure, phase), recoveryCarrierFailureMessage), { publishFailure: false });
-        if (!result.ok)
+            return { ok: false, error: '没有可继续的身份恢复操作' };
+        const result = await this.withPending(label, () => operation(operationId), { publishFailure: false, recovery: true });
+        if (!this.recoveryCurrent(generation, revision))
+            return this.recoveryLeft();
+        if (!result.ok) {
+            // Reconcile authority after an ambiguous failure, never infer whether Commit occurred.
+            const status = await call(() => this.remote.getRecoveryStatus({ operationId }), undefined, recoveryCarrierFailureMessage);
+            if (!this.recoveryCurrent(generation, revision))
+                return this.recoveryLeft();
+            this.publish({ ...this.view, recoveryProgress: status.ok ? status.value : this.view.recoveryProgress,
+                accessError: status.ok ? null : IDENTITY_ACCESS_FAILURE_MESSAGE });
             return result;
-        this.publish({ ...this.view, recoveryProgress: result.value });
-        if (result.value.phase === 'applied') {
-            storeRecoveryOperation(this.config?.tenantDomain, null);
-            this.publish({ ...this.view, recoveryOperationId: null, recoveryProgress: result.value });
-            await this.open();
         }
+        this.publish({ ...this.view, recoveryProgress: result.value, accessError: null });
+        if (result.value.phase === 'applied')
+            clearRecoveryOtpRetryAt(operationId, this.config?.tenantId);
+        if (enterWhenApplied && result.value.phase === 'applied')
+            return this.enterRecoveredSession();
         return result;
     }
-    /** Refresh Core status without repeating activation. */
+    async prepareRecovery(request) {
+        if (!this.view.recoveryProgress?.allowedActions?.includes('prepare'))
+            return { ok: false, error: '请先检查恢复状态' };
+        return this.runRecovery('验证恢复信息', operationId => call(() => this.remote.prepareRecovery({ ...request, operationId }), recoveryPreparationFailureMessage, recoveryCarrierFailureMessage));
+    }
+    async activateRecovery() {
+        const progress = this.view.recoveryProgress;
+        if (!progress?.allowedActions?.includes('activate'))
+            return { ok: false, error: '请先完成恢复信息验证' };
+        return this.runRecovery('恢复身份', operationId => call(() => this.remote.activateRecovery({ operationId }), failure => recoveryContinuationFailureMessage(failure, progress.phase), recoveryCarrierFailureMessage), true);
+    }
+    /** Read-only even for applied operations. Entering the identity is a separate action. */
     async refreshRecoveryStatus() {
+        const generation = this.generation;
+        const revision = this.recoveryRevision;
         const operationId = this.view.recoveryOperationId;
         if (operationId === null)
-            return this.fail('没有可查询的身份恢复操作');
-        const result = await this.withPending('刷新恢复状态', () => call(() => this.remote.getRecoveryStatus({ operationId }), undefined, recoveryCarrierFailureMessage), { publishFailure: false });
-        if (!result.ok)
+            return { ok: false, error: '没有可查询的身份恢复操作' };
+        const result = await this.withPending('刷新恢复状态', async () => {
+            const status = await call(() => this.remote.getRecoveryStatus({ operationId }), undefined, recoveryCarrierFailureMessage);
+            return status.ok ? status : { ok: false, error: IDENTITY_ACCESS_FAILURE_MESSAGE };
+        }, { publishFailure: false, recovery: true });
+        if (!this.recoveryCurrent(generation, revision))
+            return this.recoveryLeft();
+        if (!result.ok) {
+            this.publish({ ...this.view, accessError: IDENTITY_ACCESS_FAILURE_MESSAGE });
             return result;
-        this.publish({ ...this.view, recoveryProgress: result.value });
-        if (result.value.phase === 'applied') {
-            storeRecoveryOperation(this.config?.tenantDomain, null);
-            this.publish({ ...this.view, recoveryOperationId: null, recoveryProgress: result.value });
-            await this.open();
         }
+        this.publish({ ...this.view, recoveryProgress: result.value, accessError: null });
+        if (result.value.phase === 'applied')
+            clearRecoveryOtpRetryAt(operationId, this.config?.tenantId);
         return result;
     }
-    /** Resume only a Core-declared retryable or uncertain phase. */
     async resumeRecovery() {
-        const operationId = this.view.recoveryOperationId;
         const progress = this.view.recoveryProgress;
-        if (operationId === null || progress === null)
-            return this.fail('请先刷新恢复状态');
-        if (!progress.retryable && !['remote_outcome_unknown', 'remote_committed', 'identity_transition_pending'].includes(progress.phase)) {
-            return this.fail('当前恢复状态不能重试');
+        if (!progress?.allowedActions?.includes('resume'))
+            return { ok: false, error: '当前恢复状态不能重试' };
+        return this.runRecovery('继续恢复身份', operationId => call(() => this.remote.resumeRecovery({ operationId }), failure => recoveryContinuationFailureMessage(failure, progress.phase), recoveryCarrierFailureMessage), true);
+    }
+    async enterRecoveredSession() {
+        const generation = this.generation;
+        const revision = this.recoveryRevision;
+        const progress = this.view.recoveryProgress;
+        if (progress?.phase !== 'applied' || !progress.allowedActions?.includes('activate_identity')) {
+            return { ok: false, error: '当前恢复身份尚不可进入，请重新检查。' };
         }
-        const result = await this.withPending('继续恢复身份', () => call(() => this.remote.resumeRecovery({ operationId }), failure => recoveryContinuationFailureMessage(failure, progress.phase), recoveryCarrierFailureMessage), { publishFailure: false });
+        const result = await this.withPending('进入恢复后的身份', () => call(() => this.remote.enterRecoveredSession({ operationId: progress.operationId })), { publishFailure: false, recovery: true });
+        if (!this.recoveryCurrent(generation, revision))
+            return this.recoveryLeft();
         if (!result.ok)
             return result;
-        this.publish({ ...this.view, recoveryProgress: result.value });
-        if (result.value.phase === 'applied') {
-            storeRecoveryOperation(this.config?.tenantDomain, null);
-            this.publish({ ...this.view, recoveryOperationId: null, recoveryProgress: result.value });
-            await this.open();
-        }
-        return result;
+        clearRecoveryOtpRetryAt(progress.operationId, this.config?.tenantId);
+        this.leaveRecovery();
+        const opened = await this.open();
+        return opened.ok ? result : opened;
     }
-    /** Discard only a pre-attempt operation. */
+    /** Only Core-authorized pre-attempt cancellation destroys the pending operation. */
     async discardRecovery() {
+        const generation = this.generation;
+        const revision = this.recoveryRevision;
         const operationId = this.view.recoveryOperationId;
         if (operationId === null)
             return { ok: true, value: undefined };
-        const phase = this.view.recoveryProgress?.phase;
-        if (phase !== undefined && phase !== 'awaiting_factor' && phase !== 'ready_to_commit') {
-            return this.fail('当前恢复状态不能取消');
+        if (!this.view.recoveryProgress?.allowedActions?.includes('discard_pre_attempt')) {
+            return { ok: false, error: '当前恢复状态不能取消；可以返回入口，稍后继续。' };
         }
-        const result = await this.withPending('取消身份恢复', () => call(() => this.remote.discardRecovery({ operationId })), { publishFailure: false });
+        const result = await this.withPending('取消身份恢复', () => call(() => this.remote.discardRecovery({ operationId })), { publishFailure: false, recovery: true });
+        if (!this.recoveryCurrent(generation, revision))
+            return this.recoveryLeft();
         if (!result.ok)
             return result;
-        storeRecoveryOperation(this.config?.tenantDomain, null);
-        this.publish({ ...this.view, recoveryOperationId: null, recoveryProgress: null });
+        clearRecoveryOtpRetryAt(operationId, this.config?.tenantId);
+        this.leaveRecovery();
+        void this.refreshIdentityAccess();
         return { ok: true, value: undefined };
     }
-    /** Return cached browser-safe runtime policy, or load it once on demand. */
-    async getConfig() {
-        if (this.config !== null)
-            return { ok: true, value: this.config };
-        const result = await call(() => this.remote.getConfig(), mailFailureMessage);
-        if (result.ok)
-            this.config = result.value;
-        return result;
-    }
     /** Read the active deployment identity's public mailbox state. */
     getMailAccount() {
         return call(() => this.remote.getMailAccount(), mailFailureMessage);
@@ -805,16 +1235,6 @@ export class AwikiController {
     sendMail(request) {
         return call(() => this.remote.sendMail(request), mailFailureMessage);
     }
-    /** Download one explicitly selected mail attachment without retaining its bytes. */
-    async downloadMailAttachment(request) {
-        if (this.disposed)
-            return { ok: false, error: 'AWiki 插件已卸载' };
-        const generation = this.generation;
-        const result = await call(() => this.remote.downloadMailAttachment(request), mailFailureMessage);
-        if (!this.current(generation))
-            return { ok: false, error: 'AWiki 已关闭' };
-        return result;
-    }
     /**
      * Load another page of the conversation roster.
      * @returns successful pagination or one display-safe failure.
@@ -834,33 +1254,10 @@ export class AwikiController {
             ...this.view,
             conversations: appendUnique(this.view.conversations, conversations.visible, value => value.id),
             hiddenConversations: conversations.hidden,
-            groupRecovery: this.currentGroupRecoveryView(),
             conversationsHasMore: result.value.hasMore && result.value.nextCursor !== undefined,
         });
         return { ok: true, value: undefined };
     }
-    /** Synchronize account projections, then retry Core's durable group-rebind journal. */
-    async retryGroupRebindRecovery() {
-        const generation = this.generation;
-        return this.withPending('恢复群聊身份', async () => {
-            const listed = await this.refreshConversations(generation, true);
-            if (!listed.ok)
-                return { ok: false, error: listed.error };
-            return this.resumeGroupRebindRecovery(generation);
-        });
-    }
-    /** Dismiss only the current recovery-summary revision; Core recovery remains untouched. */
-    async dismissGroupRecoveryNotice() {
-        const signature = this.lastGroupRecoverySignature;
-        if (signature === undefined || this.view.groupRecovery === null)
-            return { ok: true, value: undefined };
-        const result = await call(() => this.remote.updateConversationPreference({ action: 'dismiss-group-recovery', signature }), conversationPreferenceFailureMessage);
-        if (!result.ok)
-            return this.fail(result.error);
-        this.applyConversationPreferences(result.value);
-        this.publish({ ...this.view, groupRecovery: null, error: null });
-        return { ok: true, value: undefined };
-    }
     /** Hide one recent row locally without leaving a group or deleting history. */
     async hideConversation(conversationId) {
         const conversation = this.view.conversations.find(item => item.id === conversationId);
@@ -896,7 +1293,6 @@ export class AwikiController {
                     refreshing: false,
                 }
                 : {}),
-            groupRecovery: this.currentGroupRecoveryView(),
             error: null,
         });
         return { ok: true, value: undefined };
@@ -918,7 +1314,6 @@ export class AwikiController {
             ...this.view,
             conversations: appendUnique([conversation], this.view.conversations, item => item.id),
             hiddenConversations: this.hiddenConversationsView(),
-            groupRecovery: this.currentGroupRecoveryView(),
             error: null,
         });
         return { ok: true, value: undefined };
@@ -949,10 +1344,15 @@ export class AwikiController {
             return this.selectConversation(existing.id);
         }
         const generation = this.generation;
-        const resolved = await this.withPending('查找用户', () => call(() => this.remote.resolvePeer({ peer })));
-        if (!resolved.ok) {
-            return resolved.error.startsWith('not-found') ? this.fail('该 Handle 不存在') : resolved;
-        }
+        const resolved = await this.withPending('查找用户', async () => {
+            const result = await callWithFailureCode(() => this.remote.resolvePeer({ peer }));
+            if (!result.ok) {
+                return { ok: false, error: result.failureCode === 'not-found' ? '该 Handle 不存在' : result.error };
+            }
+            return result;
+        });
+        if (!resolved.ok)
+            return resolved;
         if (!this.current(generation))
             return { ok: true, value: undefined };
         if (resolved.value.did === identity.did)
@@ -1074,9 +1474,6 @@ export class AwikiController {
         const generation = this.generation;
         this.publish({ ...this.view, pending: '刷新群成员', error: null });
         const result = await (async () => {
-            if (this.view.groupAccess?.status !== 'available' && this.view.groupAccess?.status !== 'loading') {
-                await this.resumeGroupRebindRecovery(this.generation);
-            }
             const refreshed = await this.loadGroupState(conversation, true, true);
             return refreshed.ok ? { ok: true, value: undefined } : refreshed;
         })();
@@ -1613,28 +2010,94 @@ export class AwikiController {
         }
         return result;
     }
-    /** Clear Host-owned local data and immediately remove every cached browser projection. */
+    /** Clear current-tenant local data and only its owned browser projections. */
     async clearLocalData(request) {
         if (this.disposed)
             return { ok: false, error: 'AWiki 插件已卸载' };
+        const generation = this.generation;
+        const ownerDid = this.presentationCacheOwnerDid;
+        const tenantId = this.config?.tenantId;
         const result = await call(() => this.remote.clearLocalData(request));
         if (!result.ok)
             return result;
-        await this.persistentImageCache.clear().catch(() => undefined);
+        const owners = [...(result.value.clearedIdentityDids ?? []), ...(ownerDid === null ? [] : [ownerDid])];
+        for (const owner of new Set(owners)) {
+            await this.persistentImageCache.clear(owner).catch(() => undefined);
+            try {
+                clearMailBrowserCache(globalThis.localStorage, owner);
+            }
+            catch { }
+        }
+        clearRecoveryOtpRetryAt(this.view.recoveryOperationId, tenantId);
+        this.rememberRecoveryOperation(null, tenantId);
+        if (!this.current(generation))
+            return result;
+        this.drafts.clearScope();
         this.close();
-        const tenantDomain = this.config?.tenantDomain;
-        this.config = null;
+        // Preserve tenantId for the confirm-time getConfig scope check without reopening.
         this.conversationsCursor = undefined;
         this.historyCursor = undefined;
         this.unreadAtOpen.clear();
         this.summaryBaselines.clear();
         this.clearPresentationCache();
-        storeRecoveryOperation(tenantDomain, null);
-        this.publish({ ...INITIAL_VIEW, status: 'ready' });
+        this.publish({ ...INITIAL_VIEW, status: 'ready', accessLoading: false,
+            attachmentMaxBytes: this.config?.attachmentMaxBytes ?? INITIAL_VIEW.attachmentMaxBytes,
+            handleRecoveryPhoneEnabled: this.config?.handleRecoveryPhoneEnabled ?? false,
+            identityAccess: { choice: null, joining: false, recoveries: [] } });
         return result;
     }
+    /** Read the Integration without coupling Guest Gateway health to the main AWiki view. */
+    getIntegration() {
+        return callIntegration(() => this.remote.getIntegration());
+    }
+    createIntegration(request) {
+        return callIntegration(() => this.remote.createIntegration(request));
+    }
+    updateIntegration(request) {
+        return callIntegration(() => this.remote.updateIntegration(request));
+    }
+    rotateIntegrationId(request) {
+        return callIntegration(() => this.remote.rotateIntegrationId(request));
+    }
+    closeIntegration(request) {
+        return callIntegration(() => this.remote.closeIntegration(request));
+    }
+    reopenIntegration(request) {
+        return callIntegration(() => this.remote.reopenIntegration(request));
+    }
+    /** Return only locally known groups for which the active identity is authoritative owner. */
+    async listOwnedGroups() {
+        const groups = [];
+        const visited = new Set();
+        let cursor;
+        for (let pageIndex = 0; pageIndex < 20 && groups.length < 20; pageIndex += 1) {
+            const conversations = await call(() => this.remote.listConversations({
+                limit: 100,
+                ...(cursor === undefined ? {} : { cursor }),
+            }));
+            if (!conversations.ok)
+                return conversations;
+            for (const conversation of conversations.value.items) {
+                if (conversation.kind !== 'group' || visited.has(conversation.groupDid))
+                    continue;
+                visited.add(conversation.groupDid);
+                const snapshot = await call(() => this.remote.getGroup({ groupDid: conversation.groupDid }));
+                if (!snapshot.ok)
+                    continue;
+                if (snapshot.value.myRole === 'owner')
+                    groups.push(snapshot.value);
+                if (groups.length >= 20)
+                    break;
+            }
+            cursor = conversations.value.nextCursor;
+            if (cursor === undefined)
+                break;
+        }
+        return { ok: true, value: groups };
+    }
     /** Stop timers, invalidate work, and drop subscribers during HMR unload. */
     dispose() {
+        this.drafts.clear();
         this.disposed = true;
         this.close();
         this.listeners.clear();
@@ -1654,25 +2117,12 @@ export class AwikiController {
                 hiddenAt: hidden.hiddenAt,
             });
         }
-        this.dismissedGroupRecoverySignature = preferences.dismissedGroupRecoverySignature;
     }
     hiddenConversationsView() {
         return [...this.hiddenConversationPreferences.values()]
             .sort((left, right) => right.hiddenAt - left.hiddenAt)
             .map(item => item.conversation);
     }
-    currentGroupRecoveryView() {
-        const summary = this.lastGroupRecoverySummary;
-        if (summary === undefined)
-            return this.view.groupRecovery;
-        const hiddenGroupDids = new Set([...this.hiddenConversationPreferences.values()]
-            .map(item => item.conversation)
-            .filter((conversation) => conversation.kind === 'group')
-            .map(conversation => conversation.groupDid));
-        const projection = groupRecoveryProjection(summary, hiddenGroupDids);
-        this.lastGroupRecoverySignature = projection.signature;
-        return projection.signature === this.dismissedGroupRecoverySignature ? null : projection.view;
-    }
     async reconcileConversationPage(incoming, generation) {
         const current = [...this.view.conversations, ...this.view.hiddenConversations];
         const conversations = incoming.map(item => this.cacheConversation(item, current.find(candidate => candidate.id === item.id)));
@@ -1723,7 +2173,6 @@ export class AwikiController {
                 ? refreshed.visible
                 : appendUnique(refreshed.visible, this.view.conversations, value => value.id),
             hiddenConversations: refreshed.hidden,
-            groupRecovery: this.currentGroupRecoveryView(),
             conversationsHasMore: firstPage
                 ? result.value.hasMore && result.value.nextCursor !== undefined
                 : this.view.conversationsHasMore,
@@ -1734,14 +2183,18 @@ export class AwikiController {
     /** List the active identity's own conversations and detect a revoked local credential. */
     async listConversationPage(request) {
         const result = await callWithFailureCode(() => this.remote.listConversations(request));
+        if (!result.ok && result.failureCode === 'device-rejoin-required') {
+            this.enterBlockedIdentityState('device-rejoin-required');
+            return { ok: false, error: '当前设备已被撤销，请重新申请加入。' };
+        }
         if (!result.ok && (result.failureCode === 'identity-recovery-required' || result.failureCode === 'forbidden')) {
-            this.enterIdentityRecoveryRequired();
+            this.enterBlockedIdentityState('recovery-required');
             return { ok: false, error: '当前设备的 AWiki 身份凭证已失效，请重新恢复身份。' };
         }
         return result.ok ? result : { ok: false, error: result.error };
     }
     /** Replace only visible browser projections; Core identity and SQLite state remain untouched. */
-    enterIdentityRecoveryRequired() {
+    enterBlockedIdentityState(status) {
         if (this.view.identity === null)
             return;
         this.close();
@@ -1750,14 +2203,11 @@ export class AwikiController {
         this.groupMembersCursor = undefined;
         this.unreadAtOpen.clear();
         this.summaryBaselines.clear();
-        this.groupRecoveryItems.clear();
-        this.lastGroupRecoverySignature = undefined;
-        this.lastGroupRecoverySummary = undefined;
         this.clearImageAttachments();
         this.publish({
             ...this.view,
             status: 'ready',
-            sessionStatus: 'recovery-required',
+            sessionStatus: status,
             conversations: Object.freeze([]),
             hiddenConversations: Object.freeze([]),
             conversationsHasMore: false,
@@ -1766,7 +2216,6 @@ export class AwikiController {
             groupAccess: null,
             groupMembers: Object.freeze([]),
             groupMembersHasMore: false,
-            groupRecovery: null,
             messages: Object.freeze([]),
             historyHasMore: false,
             localPending: false,
@@ -1776,49 +2225,6 @@ export class AwikiController {
             summaries: Object.freeze({}),
         });
     }
-    /** Hydrate account-projected groups before asking Core to resume their durable rebind jobs. */
-    async refreshConversationsAndRecoverGroups(generation, background = false) {
-        const listed = await this.refreshConversations(generation, background);
-        if (!listed.ok || !this.current(generation))
-            return listed;
-        await this.resumeGroupRebindRecovery(generation);
-        return listed;
-    }
-    resumeGroupRebindRecovery(generation) {
-        const active = this.groupRecoveryOperation;
-        if (active !== undefined && active.generation === generation)
-            return active.operation;
-        let operation;
-        operation = call(() => this.remote.resumeGroupRebindRecovery(), groupRecoveryFailureMessage).then((result) => {
-            if (!this.current(generation))
-                return result;
-            if (result.ok) {
-                this.lastGroupRecoverySummary = result.value;
-                this.groupRecoveryItems.clear();
-                for (const item of result.value.items) {
-                    this.groupRecoveryItems.set(item.groupDid, item.status);
-                }
-            }
-            else {
-                this.lastGroupRecoverySummary = undefined;
-                this.lastGroupRecoverySignature = 'unavailable';
-            }
-            this.publish({
-                ...this.view,
-                groupRecovery: result.ok
-                    ? this.currentGroupRecoveryView()
-                    : this.dismissedGroupRecoverySignature === 'unavailable'
-                        ? null
-                        : { status: 'unavailable', pending: 0, blocked: 0 },
-            });
-            return result;
-        }).finally(() => {
-            if (this.groupRecoveryOperation?.operation === operation)
-                this.groupRecoveryOperation = undefined;
-        });
-        this.groupRecoveryOperation = { generation, operation };
-        return operation;
-    }
     async loadHistory(older) {
         const conversationId = this.view.selectedConversationId;
         if (conversationId === null)
@@ -1862,13 +2268,7 @@ export class AwikiController {
             return;
         this.polling = true;
         try {
-            const knownGroups = new Set(this.view.conversations
-                .filter(conversation => conversation.kind === 'group')
-                .map(conversation => conversation.groupDid));
-            const listed = await this.refreshConversations(generation, true);
-            if (listed.ok && this.view.conversations.some(conversation => conversation.kind === 'group' && !knownGroups.has(conversation.groupDid))) {
-                await this.resumeGroupRebindRecovery(generation);
-            }
+            await this.refreshConversations(generation, true);
             const selected = this.view.selectedConversationId;
             if (selected === null || !this.current(generation))
                 return;
@@ -1882,6 +2282,19 @@ export class AwikiController {
                 this.publish({ ...this.view, error: 'AWiki 远端消息归属不一致，请重新打开会话。' });
                 return;
             }
+            const displayPeers = [...new Set([
+                    ...this.view.messages.map(message => message.senderDid),
+                    ...this.view.groupMembers.flatMap(member => member.did === undefined ? [] : [member.did]),
+                ])];
+            const displayProfiles = [];
+            for (let start = 0; start < displayPeers.length; start += 100) {
+                const profileResult = await call(() => this.remote.getDisplayProfiles(displayPeers.slice(start, start + 100)));
+                if (!this.current(generation) || this.view.selectedConversationId !== selected)
+                    return;
+                if (profileResult.ok)
+                    displayProfiles.push(...profileResult.value);
+            }
+            const byDid = new Map(displayProfiles.filter(profile => profile.cacheHit).map(profile => [profile.did, profile]));
             const existingIds = new Set(this.view.messages.map(message => message.id));
             const incoming = result.value.items.filter(message => !existingIds.has(message.id));
             const messages = mergeLatestMessages(this.view.messages, result.value.items);
@@ -1891,7 +2304,22 @@ export class AwikiController {
             }
             this.publish({
                 ...this.view,
-                messages,
+                messages: messages.map(message => {
+                    const profile = byDid.get(message.senderDid);
+                    if (profile === undefined)
+                        return message;
+                    const { senderDisplayName: _snapshot, ...rest } = message;
+                    const handle = profile.handle ?? message.senderHandle;
+                    return { ...rest, ...profile.displayName === undefined ? {} : { senderDisplayName: profile.displayName }, ...handle === undefined ? {} : { senderHandle: handle } };
+                }),
+                groupMembers: this.view.groupMembers.map(member => {
+                    const profile = member.did === undefined ? undefined : byDid.get(member.did);
+                    if (profile === undefined)
+                        return member;
+                    const { displayName: _snapshot, ...rest } = member;
+                    const handle = profile.handle ?? member.handle;
+                    return { ...rest, ...profile.displayName === undefined ? {} : { displayName: profile.displayName }, ...handle === undefined ? {} : { handle } };
+                }),
                 summaries: this.staleSummaries(selected, incoming),
             });
         }
@@ -1899,20 +2327,34 @@ export class AwikiController {
             this.polling = false;
         }
     }
+    pendingRequest;
     async withPending(label, operation, options = {}) {
         if (this.disposed)
             return { ok: false, error: 'AWiki 插件已卸载' };
+        if (this.pendingRequest !== undefined)
+            return { ok: false, error: '上一项操作仍在处理，请稍候再试。' };
+        const token = Symbol(label);
+        this.pendingRequest = token;
+        this.pendingRecovery = options.recovery === true;
         const generation = this.generation;
         this.publish({ ...this.view, pending: label, error: null });
-        const result = await operation();
-        if (!this.current(generation))
+        try {
+            const result = await operation();
+            if (this.current(generation) && this.pendingRequest === token)
+                this.publish({
+                    ...this.view, error: result.ok || options.publishFailure === false ? null : result.error,
+                });
             return result;
-        this.publish({
-            ...this.view,
-            pending: null,
-            error: result.ok || options.publishFailure === false ? null : result.error,
-        });
-        return result;
+        }
+        finally {
+            if (this.pendingRequest === token) {
+                this.pendingRequest = undefined;
+                this.pendingRecovery = false;
+                // Closing/reopening invalidates reads, but the original mutation still settles.
+                if (!this.disposed)
+                    this.publish({ ...this.view, pending: null });
+            }
+        }
     }
     appendMessage(message) {
         if (this.view.selectedConversationId !== message.conversationId)
@@ -1963,14 +2405,7 @@ export class AwikiController {
         return selected === null ? undefined : this.view.conversations.find(value => value.id === selected);
     }
     publishGroupAccessFailure(conversation, reason) {
-        const journal = this.groupRecoveryItems.get(conversation.groupDid);
-        const status = reason === 'not-member'
-            ? journal === 'blocked'
-                ? 'blocked'
-                : journal === 'pending'
-                    ? 'recovering'
-                    : 'not-member'
-            : reason;
+        const status = reason;
         this.publish({
             ...this.view,
             groupAccess: { groupDid: conversation.groupDid, status },
@@ -1984,11 +2419,7 @@ export class AwikiController {
             return;
         this.directProfiles.clear();
         this.groupTitles.clear();
-        this.groupRecoveryItems.clear();
         this.hiddenConversationPreferences.clear();
-        this.dismissedGroupRecoverySignature = undefined;
-        this.lastGroupRecoverySignature = undefined;
-        this.lastGroupRecoverySummary = undefined;
         this.clearImageAttachments();
         this.presentationCacheOwnerDid = ownerDid;
     }
@@ -1996,11 +2427,7 @@ export class AwikiController {
     clearPresentationCache() {
         this.directProfiles.clear();
         this.groupTitles.clear();
-        this.groupRecoveryItems.clear();
         this.hiddenConversationPreferences.clear();
-        this.dismissedGroupRecoverySignature = undefined;
-        this.lastGroupRecoverySignature = undefined;
-        this.lastGroupRecoverySummary = undefined;
         this.clearImageAttachments();
         this.presentationCacheOwnerDid = null;
     }