@bolloon/bolloon-agent 0.6.1 → 0.6.3

package/dist/electron-build/agents/gateway-group.js

@@ -0,0 +1,814 @@
+"use strict";
+/**
+ * gateway-group.ts — Agent Gateway P2P 群组 (2026-08-14)
+ *
+ * 群组 = OrbitDB events store, 全成员通过 OrbitDB pubsub 复制实时同步.
+ * 链接: orbitdb://<addr>?type=group&name=<群名>.
+ *
+ * 符合用户习惯: 群组 = 微信式群聊 — 加入链接即进群, 发消息全网同步.
+ * 持久化: ~/.bolloon/gateway-groups.json (重启后仍是群成员, 自动重开 store).
+ *
+ * 2026-09-24 跨进程可重开:
+ *   · 群消息 (OrbitDB events store 的 oplog 条目 + manifest) 现在真落盘 ——
+ *     `createBolloonIpfs` 用 FsBlockstore/FsDatastore 写 ~/.bolloon/orbitdb/ipfs/{blocks,datastore},
+ *     所以"建群的那个进程退出后, 新进程用群链接重开还能读到既有消息"。
+ *     (修复前: 区块只在内存, 新进程一开就报 "No block brokers capable of retrieving blocks")
+ *   · 读不到必须报读不到: `groupMessages` 在 store 打不开时**抛 GroupStoreUnreachableError**,
+ *     不再返回 `[]`。把"读不到"显示成"群里没有消息"是骗人, 本条不可回退。
+ *
+ * 2026-10-01 (P1) DID 门控:
+ *   · `createGroup(name, { gate: { owner, members?, membershipEvents? } })` 建的是**门控群**:
+ *     写入白名单 = 群主 OrbitDB 写身份 + 显式成员, 非名单成员 add 会被拒。
+ *   · 不给 `gate` → 行为**一字不变** (write:['*']); 默认翻成门控需要先迁移全部既有调用点。
+ *   · 成员变更 = `MembershipEvent` (成员自签 + 群主签, 双侧 Ed25519 验签), 读写入口
+ *     `recordMembershipEvent` / `groupMembershipEvents` / `groupWriteList`。
+ *   · **白名单不能就地改** (IPFS 型 AC 的白名单在内容寻址的 ACL 块里, 改它 = 换 store 地址),
+ *     所以"改成员"= 重建 store; 代价清单见 `group-access.ts` 的 `aclChangePlan()`。
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GroupStoreUnreachableError = void 0;
+exports.setGroupTestDb = setGroupTestDb;
+exports.resetGroupState = resetGroupState;
+exports.closeGroupResources = closeGroupResources;
+exports.parseGroupLink = parseGroupLink;
+exports.detectGroupLink = detectGroupLink;
+exports.onGroupMessage = onGroupMessage;
+exports.createGroup = createGroup;
+exports.joinGroup = joinGroup;
+exports.listGroups = listGroups;
+exports.leaveGroup = leaveGroup;
+exports.groupMessages = groupMessages;
+exports.groupMembers = groupMembers;
+exports.groupMembershipEvents = groupMembershipEvents;
+exports.recordMembershipEvent = recordMembershipEvent;
+exports.groupWriteList = groupWriteList;
+exports.groupSend = groupSend;
+exports.groupSendWithLang = groupSendWithLang;
+exports.readGroupMessage = readGroupMessage;
+exports.groupLink = groupLink;
+exports.groupInfo = groupInfo;
+exports.restoreGroups = restoreGroups;
+exports.rebuildGroupWithWriteList = rebuildGroupWithWriteList;
+exports.inviteMember = inviteMember;
+exports.kickMember = kickMember;
+exports.setGroupPrivacy = setGroupPrivacy;
+exports.groupStatus = groupStatus;
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const cid_database_js_1 = require("../orbitdb/cid-database.js");
+// 2026-09-28: 交流语言 (Efficode 是可选项, 不是默认项) —— 只有双方都声明才用
+const negotiate_js_1 = require("../efficode/negotiate.js");
+// 2026-10-01 (P1): **DID 门控** —— 群写入白名单从 write:['*'] 收紧成成员白名单。
+// 白名单里放的是 **OrbitDB 写身份 id** (66 位压缩 secp256k1 公钥 hex), 不是 DID 字符串
+// (canAppend 只比 identity.id; 放 DID 会永远匹配不上 → 谁都写不了)。
+// 成员变更 = 一条**双侧 Ed25519 验签**的群事件 (成员自签 + 群主签), 细节见 group-access.ts。
+const group_access_js_1 = require("../orbitdb/group-access.js");
+// ============ 依赖注入 (测试用, 避免单测起真实 OrbitDB 节点) ============
+let _dbOverride = null;
+/** 测试用: 注入 fake CIDDatabase */
+function setGroupTestDb(db) { _dbOverride = db; }
+function getDb() { return _dbOverride ?? (0, cid_database_js_1.getCIDDatabase)(); }
+/** 测试用: 清空 store 缓存 / 订阅 (避免测试间污染) */
+function resetGroupState() {
+    storeCache.clear();
+    onChangeCallbacks.clear();
+    openFailures.clear();
+}
+/**
+ * 关闭群聊使用的 OrbitDB/Helia 资源。
+ * 一次性 CLI、验收探针和测试必须在读回后调用它，否则底层 libp2p/Helia 句柄
+ * 会继续保持事件循环活跃，表现为“消息已读完但进程不退出”。
+ * 测试注入的 fake DB 不关闭，避免破坏测试夹具生命周期。
+ */
+async function closeGroupResources() {
+    storeCache.clear();
+    onChangeCallbacks.clear();
+    openFailures.clear();
+    if (_dbOverride)
+        return;
+    await (0, cid_database_js_1.getCIDDatabase)().close();
+}
+/**
+ * 群 store 打不开 (区块不在本机 / 地址不可解析)。
+ *
+ * 2026-09-24: 以前打不开 → `groupMessages` 返回 `[]`, 于是 CLI 把"整个群读不到"报成
+ * "群里本期没有过程痕迹 (群里真没有, 不是读失败)" —— 把"读不到"说成了"没有"。
+ * 现在读不到就抛: 上游 (task trail / API) 必须如实报 TRANSPORT_FAILED。
+ */
+class GroupStoreUnreachableError extends Error {
+    groupId;
+    address;
+    cause;
+    code = 'STORE_UNREACHABLE';
+    constructor(groupId, address, cause) {
+        const why = String(cause?.message ?? cause ?? '未知原因').slice(0, 160);
+        super(`群组 store 不可达 (${groupId}): ${why}`);
+        this.groupId = groupId;
+        this.address = address;
+        this.cause = cause;
+        this.name = 'GroupStoreUnreachableError';
+    }
+}
+exports.GroupStoreUnreachableError = GroupStoreUnreachableError;
+/** 打开失败的一句话原因 (给人类输出用; 没有失败记录时返回通用话术) */
+function unreachableReason(err) {
+    const m = String(err?.message ?? err ?? '').trim();
+    return m ? m.slice(0, 160) : '区块不在本机且没有可用的 block broker (跨机同步仍是另一回事, 需 peers)';
+}
+// ============ 持久化 ============
+const groupsFile = () => path.join(os.homedir() || '/tmp', '.bolloon', 'gateway-groups.json');
+async function loadGroups() {
+    try {
+        const { readFile } = await Promise.resolve().then(() => __importStar(require('fs/promises')));
+        const parsed = JSON.parse(await readFile(groupsFile(), 'utf-8'));
+        return Array.isArray(parsed) ? parsed : [];
+    }
+    catch {
+        return [];
+    }
+}
+async function saveGroups(list) {
+    try {
+        const { mkdir, writeFile } = await Promise.resolve().then(() => __importStar(require('fs/promises')));
+        await mkdir(path.dirname(groupsFile()), { recursive: true });
+        await writeFile(groupsFile(), JSON.stringify(list, null, 2), 'utf-8');
+    }
+    catch { /* 持久化失败静默 */ }
+}
+// ============ 链接解析 ============
+/** 解析群组链接: orbitdb://<addr>?type=group&name=<群名> (type 非 group 返回 null) */
+function parseGroupLink(link) {
+    const l = String(link || '').trim();
+    if (!l.startsWith('orbitdb://'))
+        return null;
+    const [base, query] = l.split('?');
+    let params = null;
+    try {
+        params = query ? new URLSearchParams(query) : null;
+    }
+    catch { /* 忽略 */ }
+    if (params && params.get('type') === 'group') {
+        let address = base.slice('orbitdb://'.length);
+        if (!address.startsWith('/'))
+            address = `/${address}`;
+        return { address, name: params.get('name') || undefined };
+    }
+    return null;
+}
+/** 从消息文本检测群组链接 */
+function detectGroupLink(text) {
+    const t = String(text || '');
+    const re = /(orbitdb:\/\/\/?orbitdb\/[^\s)'"<>，。；]*\?[^\s)'"<>，。；]*type=group[^\s)'"<>，。；]*)/;
+    const m = re.exec(t);
+    return m ? m[1].trim() : null;
+}
+// ============ store 缓存 (避免重复 open) ============
+const storeCache = new Map();
+/** 订阅回调注册 (server 层挂 SSE 广播) */
+const onChangeCallbacks = new Map();
+/** store 打开失败的原始原因 (按 groupId) —— 用来把"打不开"和"没有消息"分开 */
+const openFailures = new Map();
+function groupIdOf(address) {
+    // /orbitdb/zdpu... → zdpu... (地址后 12 位做短 id)
+    const m = /\/orbitdb\/(.{8,})/.exec(address);
+    return m ? m[1] : address;
+}
+/**
+ * 打开群组 store (缓存)。
+ * 打不开 → 记下原始原因 + 返回 null (不抛: 调用方各自决定用什么话术报)。
+ * 2026-09-24: 必须 try/catch —— openStoreByAddress 现在抛 OrbitDBStoreUnreachableError。
+ *
+ * 2026-10-01 (P1): **不再传 `accessController`**。打开一个**合法已存在地址**时, OrbitDB
+ * 从 manifest 里取回 ACL 并覆盖入参 (`@orbitdb/core` src/orbitdb.js:129-131), 所以这里
+ * 传 `write:['*']` 是**死代码** —— 之前那行会让人误以为"打开时放开成任何人可写"。
+ * 真正的写权限 = 建群时烧进 manifest 的白名单 (DID 门控群 = 成员白名单)。
+ * 能不能写由 manifest 决定 + 调用方是否 add/put 决定; 本函数不做权限判定。
+ */
+async function openGroupStore(address) {
+    const id = groupIdOf(address);
+    if (storeCache.has(id))
+        return storeCache.get(id);
+    const db = getDb();
+    let store = null;
+    try {
+        store = await db.openStoreByAddress(address, 'events', {});
+    }
+    catch (e) {
+        openFailures.set(id, e);
+        return null;
+    }
+    if (!store) {
+        openFailures.set(id, new Error('openStoreByAddress 返回 null (没拿到 store, 也没给出原因)'));
+        return null;
+    }
+    openFailures.delete(id);
+    storeCache.set(id, store);
+    // 订阅: 新消息 → 通知回调 (server SSE)
+    store.onChange(() => {
+        groupMessages(id, 5).then((msgs) => {
+            if (msgs.length === 0)
+                return;
+            const cb = onChangeCallbacks.get(id);
+            if (cb)
+                for (const fn of cb) {
+                    try {
+                        fn(msgs[msgs.length - 1]);
+                    }
+                    catch { /* 忽略 */ }
+                }
+        }).catch(() => { });
+    });
+    return store;
+}
+/** 注册群组消息回调 (返回退订函数) */
+function onGroupMessage(groupId, fn) {
+    if (!onChangeCallbacks.has(groupId))
+        onChangeCallbacks.set(groupId, new Set());
+    onChangeCallbacks.get(groupId).add(fn);
+    return () => { onChangeCallbacks.get(groupId)?.delete(fn); };
+}
+async function createGroup(name, opts) {
+    const groupName = String(name || '').trim() || `group-${Date.now().toString(36).slice(-4)}`;
+    try {
+        const db = getDb();
+        // ---- 门控分支: 先派生白名单 (验签不过就直接拒), 再建 store ----
+        // null = 不传 write 列表 ⇒ OrbitDB 默认 (创建者独占). 不再默认 ['*'].
+        let writeList = null;
+        let gateInfo = {};
+        let membershipEntries = [];
+        if (opts?.gate) {
+            const gate = opts.gate;
+            const applied = await (0, group_access_js_1.applyMembershipEvents)({
+                owner: gate.owner,
+                events: gate.membershipEvents ?? [],
+            });
+            if (applied.rejected.length > 0) {
+                return {
+                    ok: false,
+                    error: `拒绝据此建群: ${applied.rejected.length} 条成员事件未通过验签/授权 —— ${applied.rejected[0].reason}`,
+                };
+            }
+            // 白名单 = 群主 ∪ 事件派生成员 ∪ 直接点名成员
+            const ids = [
+                gate.owner.orbitdbId,
+                ...applied.members.map((m) => m.orbitdbId),
+                ...(gate.members ?? []).map((m) => m.orbitdbId),
+            ];
+            writeList = (0, group_access_js_1.normalizeWriteList)(ids);
+            gateInfo = { gated: true, ownerDid: gate.owner.did, ownerPublicKeyHex: gate.owner.publicKeyHex, aclWrite: writeList };
+            membershipEntries = applied.accepted.map(group_access_js_1.membershipEntryOf);
+        }
+        else if (opts?.acl === 'open') {
+            // 显式声明开放写入 (产品语义: 谁拿到邀请链接都能发言) —— 打一行 warn 留痕
+            writeList = ['*'];
+            console.warn(`[group] ${groupName}: acl=open ⇒ 任何人可写 (调用方显式声明)`);
+        }
+        else {
+            console.warn(`[group] ${groupName}: 未声明 acl ⇒ 创建者独占写入 (2026-10-01 起的默认)`);
+        }
+        const store = await db.openStore(`bolloon-gw-group-${groupName}`, 'events', 
+        // 注意: groupAccessOptions([]) 会抛错 (空名单会被 accessControllerOption 丢掉 ⇒ 落回默认),
+        // 所以"创建者独占"这条路只能**不传** AC 选项 ⇒ 传 {}.
+        writeList ? (0, group_access_js_1.groupAccessOptions)(writeList) : {});
+        const address = store.address;
+        const id = groupIdOf(address);
+        const link = `orbitdb://${address}?type=group&name=${encodeURIComponent(groupName)}`;
+        const info = {
+            id, name: groupName, address, link,
+            createdAt: new Date().toISOString(),
+            lastSyncAt: new Date().toISOString(),
+            // 2026-10-05: 隐私群标记 —— 建群默认隐私 (白名单/独占写); acl=open 才是公开
+            privacy: opts?.acl !== 'open',
+            ...gateInfo,
+        };
+        storeCache.set(id, store);
+        // 成员变更事件先落库 (它们是"谁能写"的凭证; 带 kind 字段, 不会被当成聊天消息)
+        for (const entry of membershipEntries)
+            await store.add(entry);
+        // 欢迎消息 (群主自我介绍)
+        const from = opts?.from || gateInfo.ownerDid || 'group-owner';
+        await store.add({ from, text: opts?.hello || `📢 群主创建了群「${groupName}」, 分享链接邀请成员加入`, ts: Date.now() });
+        const groups = await loadGroups();
+        await saveGroups([...groups.filter((g) => g.id !== id), info]);
+        return { ok: true, group: info };
+    }
+    catch (e) {
+        return { ok: false, error: `创建群组失败: ${String(e?.message || e).slice(0, 160)}` };
+    }
+}
+/**
+ * 通过链接加入群组: 打开 store (可写) + 持久化 + 幂等.
+ * 失败静默返回错误, 不影响本地.
+ */
+async function joinGroup(link) {
+    const parsed = parseGroupLink(link);
+    if (!parsed) {
+        return { ok: false, error: '不是群组链接 (需要 orbitdb://...?type=group&name=...)' };
+    }
+    // 幂等: 按地址去重
+    const existing = await loadGroups();
+    const id = groupIdOf(parsed.address);
+    if (existing.some((g) => g.id === id)) {
+        return { ok: true, already: true, group: existing.find((g) => g.id === id) };
+    }
+    const store = await openGroupStore(parsed.address);
+    if (!store) {
+        return {
+            ok: false,
+            code: 'STORE_UNREACHABLE',
+            error: `群组 store 不可达: ${unreachableReason(openFailures.get(id))}`,
+        };
+    }
+    const name = parsed.name || id.slice(0, 12);
+    const info = {
+        id, name, address: parsed.address,
+        link: `orbitdb://${parsed.address}?type=group&name=${encodeURIComponent(name)}`,
+        createdAt: new Date().toISOString(),
+        lastSyncAt: new Date().toISOString(),
+    };
+    await saveGroups([...existing, info]);
+    return { ok: true, group: info };
+}
+/** 列出已加入的群组 */
+async function listGroups() {
+    return loadGroups();
+}
+/**
+ * 退群 (2026-09-24): 从本机群列表里摘掉 (撤销"我是成员"这条本地事实)。
+ *
+ * 只改**本机**记录: 群 store 本身是公共 append-only 的, 别人那边的成员表/消息
+ * 不会因为本机退出而改 (本模块没有"踢人/解散"的权限, 也不假装有)。
+ * 返回 `removed` = 被摘掉的 groupId (按 id 或群名匹配)。
+ *
+ * 注意: leave 只摘本地群列表；需要结束进程资源时调用 `closeGroupResources()`。
+ */
+async function leaveGroup(idOrName) {
+    const raw = String(idOrName || '').trim();
+    if (!raw)
+        return { ok: false, error: '缺少 groupId (或群名)' };
+    const groups = await loadGroups();
+    const hit = groups.find((g) => g.id === raw) || groups.find((g) => g.name === raw) || null;
+    if (!hit)
+        return { ok: false, error: `本机没有这个群: ${raw} (既不是已加入群的 groupId, 也不是群名)` };
+    storeCache.delete(hit.id);
+    openFailures.delete(hit.id);
+    await saveGroups(groups.filter((g) => g.id !== hit.id));
+    return { ok: true, removed: hit.id };
+}
+/**
+ * 获取群组 store 的最新消息 (ts 升序, 取最后 N 条)。
+ *
+ * 两个"空"必须分开 (2026-09-24):
+ *   · 本机没这个群 (不在群列表里) → 返回 `[]` (上游 resolveGroupRef 已单独拦成 NOT_FOUND)
+ *   · 群在列表里但 store 打不开 → **抛 GroupStoreUnreachableError** (读不到 ≠ 没有消息)
+ */
+async function groupMessages(groupId, limit = 50) {
+    let store = storeCache.get(groupId) ?? null;
+    if (!store) {
+        const groups = await loadGroups();
+        const g = groups.find((x) => x.id === groupId);
+        if (!g)
+            return [];
+        store = await openGroupStore(g.address);
+        if (!store)
+            throw new GroupStoreUnreachableError(groupId, g.address, openFailures.get(groupId));
+    }
+    const all = await store.all();
+    const msgs = [];
+    for (const entry of all) {
+        const v = entry.value;
+        if (v && typeof v.text === 'string' && typeof v.from === 'string') {
+            const m = { from: v.from, text: v.text, ts: typeof v.ts === 'number' ? v.ts : 0 };
+            // 只透传字符串形态的语言声明; 别的形状一律当"没声明"(不让脏值进到解码分派)
+            if (typeof v.lang === 'string' && v.lang.trim())
+                m.lang = v.lang.trim();
+            // 2026-10-02: 新字段一律**先验形状再透传** (脏值当没声明, 不做修补)
+            const entryId = String(entry?.hash ?? entry?.id ?? '').trim();
+            if (entryId)
+                m.id = entryId;
+            if (Array.isArray(v.mentions)) {
+                const ms = v.mentions.map((x) => String(x ?? '').trim()).filter(Boolean);
+                if (ms.length)
+                    m.mentions = ms;
+            }
+            if (typeof v.replyTo === 'string' && v.replyTo.trim())
+                m.replyTo = v.replyTo.trim();
+            if (typeof v.branch === 'string' && v.branch.trim())
+                m.branch = v.branch.trim();
+            if (typeof v.kind === 'string' && v.kind.trim())
+                m.kind = v.kind.trim();
+            if (Array.isArray(v.attachments)) {
+                const at = v.attachments
+                    .filter((a) => a && typeof a.cid === 'string' && /^(image|audio|file)$/.test(String(a.kind)))
+                    .map((a) => ({
+                    kind: a.kind,
+                    cid: String(a.cid).trim(),
+                    ...(typeof a.name === 'string' && a.name.trim() ? { name: a.name.trim().slice(0, 120) } : {}),
+                    ...(typeof a.bytes === 'number' && Number.isFinite(a.bytes) ? { bytes: a.bytes } : {}),
+                }));
+                if (at.length)
+                    m.attachments = at;
+            }
+            msgs.push(m);
+        }
+    }
+    msgs.sort((a, b) => a.ts - b.ts);
+    return msgs.slice(-limit);
+}
+/** 群成员: 从消息里提取 from 去重 */
+async function groupMembers(groupId) {
+    const msgs = await groupMessages(groupId, 500);
+    return Array.from(new Set(msgs.map((m) => m.from)));
+}
+// ============ 2026-10-01 (P1): DID 门控 —— 成员事件读写 / 白名单自检 ============
+/** 读群 store 的**原始条目** (含非消息条目, 如成员事件)。打不开 → 抛 (与 groupMessages 同规矩) */
+async function allRawEntries(groupId) {
+    let store = storeCache.get(groupId) ?? null;
+    if (!store) {
+        const groups = await loadGroups();
+        const g = groups.find((x) => x.id === groupId);
+        if (!g)
+            return [];
+        store = await openGroupStore(g.address);
+        if (!store)
+            throw new GroupStoreUnreachableError(groupId, g.address, openFailures.get(groupId));
+    }
+    return store.all();
+}
+/**
+ * 读本群的全部成员变更事件, 并**逐条重新验签**。
+ * 没验过的事件**不算数** (进 rejected, 不进 accepted) —— 别把"库里有一条"当成"它是真的"。
+ */
+async function groupMembershipEvents(groupId) {
+    const raw = await allRawEntries(groupId);
+    const accepted = [];
+    const rejected = [];
+    for (const e of raw) {
+        const v = e.value;
+        if (!v || typeof v !== 'object' || v.kind !== group_access_js_1.GROUP_MEMBERSHIP_KIND)
+            continue;
+        const ev = v.event;
+        const r = await (0, group_access_js_1.verifyMembershipEvent)(ev);
+        if (r.ok)
+            accepted.push(ev);
+        else {
+            rejected.push({ event: ev, ok: false, reason: r.checks.filter((c) => !c.ok).map((c) => `${c.name}: ${c.detail}`).join(' | ') });
+        }
+    }
+    accepted.sort((a, b) => a.ts - b.ts);
+    return { accepted, rejected };
+}
+/**
+ * 落一条成员变更事件 (验签不过 → 拒写, 返回 error)。
+ * 注意: 能写这个 store 本身就要求调用者在白名单里 —— 本函数不代替 ACL, 只是入口处的形状/签名闸门。
+ */
+async function recordMembershipEvent(groupId, event) {
+    const v = await (0, group_access_js_1.verifyMembershipEvent)(event);
+    if (!v.ok) {
+        return { ok: false, error: `成员事件验签不过: ${v.checks.filter((c) => !c.ok).map((c) => c.name).join(',')}` };
+    }
+    let store = storeCache.get(groupId) ?? null;
+    if (!store) {
+        const groups = await loadGroups();
+        const g = groups.find((x) => x.id === groupId);
+        if (!g)
+            return { ok: false, error: '群组不存在 (先 joinGroup/createGroup)' };
+        store = await openGroupStore(g.address);
+        if (!store)
+            return { ok: false, error: `群组 store 不可达: ${unreachableReason(openFailures.get(groupId))}` };
+    }
+    try {
+        await store.add((0, group_access_js_1.membershipEntryOf)(event));
+        return { ok: true };
+    }
+    catch (e) {
+        return { ok: false, error: `写成员事件失败: ${String(e?.message || e).slice(0, 160)}` };
+    }
+}
+/**
+ * 从本群库里的成员事件**派生**写白名单 (群主 + add − remove)。
+ * 这就是"当前这条群地址的 ACL 应该长什么样"的**可核验答案**:
+ * 拿它去和 manifest 里真正的白名单比对 (或拿它去重建一个新 store)。
+ */
+async function groupWriteList(groupId, owner) {
+    const groups = await loadGroups();
+    const g = groups.find((x) => x.id === groupId);
+    const raw = await allRawEntries(groupId);
+    const events = [];
+    for (const e of raw) {
+        const v = e.value;
+        if (v && typeof v === 'object' && v.kind === group_access_js_1.GROUP_MEMBERSHIP_KIND && v.event)
+            events.push(v.event);
+    }
+    const applied = await (0, group_access_js_1.applyMembershipEvents)({ owner, events });
+    const gated = !!(g?.gated || applied.accepted.length > 0);
+    // 非门控的老群 (write:['*']) 派生不出成员白名单 —— 如实标 gated:false, 不硬凑
+    return { write: applied.write, members: applied.members, rejectedCount: applied.rejected.length, gated };
+}
+/** 发送群消息 (广播给所有成员) */
+async function groupSend(groupId, text, from, opts) {
+    const msg = String(text || '').trim();
+    if (!msg)
+        return { ok: false, error: '消息不能为空' };
+    let store = storeCache.get(groupId) ?? null;
+    if (!store) {
+        const groups = await loadGroups();
+        const g = groups.find((x) => x.id === groupId);
+        if (!g)
+            return { ok: false, error: '群组不存在 (先 joinGroup)' };
+        store = await openGroupStore(g.address);
+        if (!store) {
+            return { ok: false, error: `群组 store 不可达: ${unreachableReason(openFailures.get(groupId))}` };
+        }
+    }
+    try {
+        const record = { from: String(from || 'anonymous'), text: msg, ts: Date.now() };
+        // 只有显式给了合法声明才写字段 —— 不给就不写 (老读者读到的东西一字不变)
+        const lang = typeof opts?.lang === 'string' ? opts.lang.trim() : '';
+        if (lang)
+            record.lang = lang;
+        // 2026-10-02: 与 lang 同口径 —— **只有显式给了合法形状才写字段** (不给就不写, 老读者读到的一字不变)
+        const mentions = Array.isArray(opts?.mentions)
+            ? opts.mentions.map((x) => String(x ?? '').trim()).filter(Boolean).slice(0, 20)
+            : [];
+        if (mentions.length)
+            record.mentions = mentions;
+        const replyTo = typeof opts?.replyTo === 'string' ? opts.replyTo.trim() : '';
+        if (replyTo)
+            record.replyTo = replyTo.slice(0, 200);
+        const branch = typeof opts?.branch === 'string' ? opts.branch.trim() : '';
+        if (branch)
+            record.branch = branch.slice(0, 120);
+        const attachments = Array.isArray(opts?.attachments)
+            ? opts.attachments
+                .filter((a) => a && typeof a.cid === 'string' && a.cid.trim() && /^(image|audio|file)$/.test(String(a.kind)))
+                .slice(0, 8)
+                .map((a) => ({
+                kind: a.kind,
+                cid: String(a.cid).trim(),
+                ...(a.name ? { name: String(a.name).slice(0, 120) } : {}),
+                ...(typeof a.bytes === 'number' && Number.isFinite(a.bytes) ? { bytes: a.bytes } : {}),
+            }))
+            : [];
+        if (attachments.length)
+            record.attachments = attachments;
+        const kind = typeof opts?.kind === 'string' ? opts.kind.trim() : '';
+        if (kind)
+            record.kind = kind.slice(0, 40);
+        // 2026-10-02: 回传本条消息的 id —— 回复/建分支都要锚点 (拿不到就不给字段, 不假造)
+        const entry = (await store.add(record));
+        const id = String(entry?.hash ?? entry?.id ?? '').trim();
+        return id ? { ok: true, id } : { ok: true };
+    }
+    catch (e) {
+        return { ok: false, error: `发送失败: ${String(e?.message || e).slice(0, 160)}` };
+    }
+}
+/**
+ * 2026-09-28: 按语言裁决发群消息 —— 真可走的那条路。
+ *
+ * 双方都声明 efficode ⇒ 正文真编成 Efficode 包 (文本模式 Base64), `lang: 'efficode'` 一起落库;
+ * 否则**原文直发** + `lang: 'natural'` (或干脆不写字段, 由调用方定), 并记一笔回落原因。
+ * 裁决/编码/落库各自失败都有结构化结果, 不静默。
+ */
+async function groupSendWithLang(groupId, text, from, opts = { mine: undefined, theirs: undefined }) {
+    const enc = (0, negotiate_js_1.encodeForPeer)({ text, mine: opts.mine, theirs: opts.theirs, from, op: opts.op });
+    (0, negotiate_js_1.recordLangDecision)(enc.decision, { channel: `group:${groupId}`, peer: from });
+    const wantLang = enc.lang === 'efficode' || opts.record === 'always' ? enc.lang : '';
+    const r = await groupSend(groupId, enc.text, from, wantLang ? { lang: wantLang } : undefined);
+    return {
+        ok: r.ok,
+        error: r.error,
+        lang: enc.lang,
+        bytes: enc.bytes,
+        fallback: enc.decision.fallback,
+        reason: enc.decision.reason,
+        symbolic: enc.symbolic,
+    };
+}
+/**
+ * 2026-09-28: 读一条群消息 —— 严格按它自己声明的 `lang` 分派。
+ * 声明不是 efficode (含未知字符串 / 没声明) ⇒ 原样返回, **不进解码器**。
+ * 声明 efficode 且本机也声明支持 ⇒ 真解包 (畸形包抛, 由调用方如实报失败)。
+ */
+function readGroupMessage(msg, mine) {
+    return (0, negotiate_js_1.decodeFromPeer)({ payload: msg.text, declaredLang: msg.lang, mine });
+}
+/** 群组邀请链接 */
+async function groupLink(groupId) {
+    const groups = await loadGroups();
+    return groups.find((g) => g.id === groupId)?.link ?? null;
+}
+/** 群组信息 (含成员数/消息数) */
+async function groupInfo(groupId) {
+    const groups = await loadGroups();
+    const g = groups.find((x) => x.id === groupId);
+    if (!g)
+        return null;
+    const msgs = await groupMessages(groupId, 500);
+    const members = await groupMembers(groupId);
+    return { ...g, messageCount: msgs.length, memberCount: members.length };
+}
+/** 重启恢复: 重开所有已加入群组的 store (失败静默) */
+async function restoreGroups() {
+    const groups = await loadGroups();
+    if (groups.length === 0)
+        return { restored: 0, failed: 0, total: 0 };
+    let restored = 0;
+    let failed = 0;
+    for (const g of groups) {
+        const store = await openGroupStore(g.address).catch(() => null);
+        if (store)
+            restored++;
+        else
+            failed++;
+    }
+    return { restored, failed, total: groups.length };
+}
+// ─────────────────────────────────────────────────────────── 群运营能力 (2026-10-05, leo: 邀请/踢出/隐私/链接/状态)
+/**
+ * 重建群 store (新白名单) —— 这是"改成员"唯一诚实的路径。
+ *
+ * IPFS 型 AC 的白名单烧在内容寻址的 ACL manifest 里, 改它必然换 store 地址
+ * (见 `ACL_INPLACE_UPDATE.ipfsType` / `aclChangePlan`)。所以:
+ *   · 邀请 = 新白名单 + 被邀请者 → 重建;
+ *   · 踢出 = 新白名单 − 被踢者 → 重建。
+ * 重建 = 新地址、新链接、**历史消息不回放** (要保留必须显式回放)。
+ *
+ * 本函数做"换地址重建 + 历史回放 (逐条 add) + 本机链接更新", 返回新 GroupInfo。
+ * 迁移代价 (老链接作废/其他成员需重新 join) 由调用方 (CLI) 明示, 这里不假装无痛。
+ */
+async function rebuildGroupWithWriteList(groupId, mode, opts) {
+    const groups = await loadGroups();
+    const g = groups.find((x) => x.id === groupId);
+    if (!g)
+        return { ok: false, error: '群组不存在 (先 joinGroup/createGroup)' };
+    if (!g.gated) {
+        return {
+            ok: false,
+            error: `「${g.name}」不是门控群 (write:[*]), 没有白名单可改 —— 邀请=分享链接, 踢出=不适用 (人人可写)`,
+        };
+    }
+    const owner = {
+        did: g.ownerDid || '',
+        publicKeyHex: g.ownerPublicKeyHex || '',
+        orbitdbId: g.aclWrite?.[0] || '',
+    };
+    if (!owner.did || !owner.publicKeyHex || !owner.orbitdbId) {
+        return { ok: false, error: '缺少群主身份信息 (ownerDid/ownerPublicKeyHex/aclWrite 为空), 无法派生新白名单' };
+    }
+    // 当前白名单 = manifest 快照 (aclWrite, 上次重建/建群时烧进去的) 优先;
+    // 事件派生只在没有快照的老门控群兜底 (两套语义: 事件=成员自签加入, rebuild=群主单方改名单)
+    const derived = await groupWriteList(groupId, owner).catch(() => null);
+    const before = g.aclWrite && g.aclWrite.length > 0 ? g.aclWrite : (derived?.write ?? []);
+    const after = (0, group_access_js_1.normalizeWriteList)(mode.kind === 'add'
+        ? [...before, mode.ref.orbitdbId]
+        : before.filter((id) => id !== mode.orbitdbId));
+    const changed = before.join(',') !== after.join(',');
+    if (!changed) {
+        return { ok: false, error: mode.kind === 'add' ? '该成员已在白名单里' : '该成员不在白名单里' };
+    }
+    if (mode.kind === 'remove' && !before.includes(mode.orbitdbId)) {
+        return { ok: false, error: `白名单里没有 ${mode.orbitdbId.slice(0, 16)}…, 无需踢出` };
+    }
+    const plan = (0, group_access_js_1.aclChangePlan)({ before, after, messageCount: opts?.replayHistory ? undefined : 0 });
+    const db = getDb();
+    // 1) 读历史消息 (回放前) —— 只在显式要求时
+    const history = opts?.replayHistory ? await groupMessages(groupId, 100000) : [];
+    // 2) 建新 store (新白名单)
+    let store = null;
+    try {
+        store = await db.openStore(`bolloon-gw-group-${g.name}-r${Date.now().toString(36)}`, 'events', (0, group_access_js_1.groupAccessOptions)(after));
+    }
+    catch (e) {
+        return { ok: false, error: `重建 store 失败: ${String(e?.message || e).slice(0, 160)}` };
+    }
+    if (!store)
+        return { ok: false, error: '重建 store 返回空 (openStore 失败, 未改任何东西)' };
+    // 3) 迁移成员事件 (原样重放, 双侧签名保留) —— 否则新 store 派生白名单只剩群主, 成员全丢
+    try {
+        const rawAll = await allRawEntries(groupId);
+        for (const { value } of rawAll) {
+            const v = value;
+            if (v && typeof v === 'object' && v.kind === group_access_js_1.GROUP_MEMBERSHIP_KIND) {
+                try {
+                    await store.add(v);
+                }
+                catch (e) { /* 单条失败不阻断 */ }
+            }
+        }
+    }
+    catch (e) {
+        return { ok: false, error: `迁移成员事件失败: ${String(e?.message || e).slice(0, 120)}` };
+    }
+    // 4) 回放历史消息 (逐条 add, 保持 ts)
+    if (opts?.replayHistory) {
+        for (const m of history) {
+            try {
+                await store.add({ ...m });
+            }
+            catch (e) {
+                // 逐条静默跳过, 能回放多少算多少; 回放是尽力而为, 不阻断重建
+            }
+        }
+    }
+    // 5) 更新本机记录: 换地址/换链接; 老 store 不删 (占用不回收, 见 plan.costs)
+    const address = store.address;
+    const link = `orbitdb://${address}?type=group&name=${encodeURIComponent(g.name)}`;
+    const info = {
+        ...g,
+        address,
+        link,
+        lastSyncAt: new Date().toISOString(),
+        gated: true,
+        ownerDid: g.ownerDid,
+        aclWrite: after,
+        privacy: g.privacy ?? true,
+    };
+    await saveGroups(groups.map((x) => (x.id === groupId ? info : x)));
+    storeCache.set(groupId, store);
+    return { ok: true, group: info, before, after, costs: plan.costs };
+}
+/** 邀请: 把 orbitdbId 加进白名单 (重建路径) */
+async function inviteMember(groupId, ref) {
+    const r = await rebuildGroupWithWriteList(groupId, { kind: 'add', ref });
+    return { ok: r.ok, error: r.error, group: r.group, costs: r.costs };
+}
+/** 踢出: 把 orbitdbId 移出白名单 (重建路径; 协议上无法记"被踢者自签的 remove 事件", 不假装) */
+async function kickMember(groupId, orbitdbId) {
+    const r = await rebuildGroupWithWriteList(groupId, { kind: 'remove', orbitdbId });
+    return { ok: r.ok, error: r.error, group: r.group, costs: r.costs };
+}
+/** 设置隐私群标记 (只影响本机展示/默认 ACL 说明, 不改变 OrbitDB 权限语义) */
+async function setGroupPrivacy(groupId, privacy) {
+    const groups = await loadGroups();
+    const g = groups.find((x) => x.id === groupId);
+    if (!g)
+        return { ok: false, error: '群组不存在' };
+    const info = { ...g, privacy, lastSyncAt: new Date().toISOString() };
+    await saveGroups(groups.map((x) => (x.id === groupId ? info : x)));
+    return { ok: true, group: info };
+}
+/** 群状态快照: 成员/消息/白名单/gated/privacy/最后同步 (状态管理用) */
+async function groupStatus(groupId) {
+    const g = await groupInfo(groupId);
+    if (!g)
+        return { ok: false, error: '群组不存在' };
+    const members = await groupMembers(groupId);
+    const wl = await (async () => {
+        if (!g.gated || !g.ownerDid)
+            return g.aclWrite ?? [];
+        const owner = { did: g.ownerDid, publicKeyHex: g.ownerPublicKeyHex || '', orbitdbId: g.aclWrite?.[0] || '' };
+        if (!owner.orbitdbId || !owner.publicKeyHex)
+            return g.aclWrite ?? [];
+        const d = await groupWriteList(groupId, owner).catch(() => null);
+        return d ? d.write : (g.aclWrite ?? []);
+    })();
+    return {
+        ok: true,
+        status: {
+            group: g,
+            memberCount: members.length,
+            messageCount: g.messageCount ?? 0,
+            writeList: wl,
+            gated: !!g.gated,
+            privacy: g.privacy ?? !!g.gated,
+            ownerDid: g.ownerDid,
+            lastSyncAt: g.lastSyncAt,
+        },
+    };
+}
+//# sourceMappingURL=gateway-group.js.map