@mapier/imsg-sdk 0.1.0

package/dist/gateway/imsg.js

@@ -0,0 +1,676 @@
+import { execFile } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { imsgBinary } from '../imsg/binary.js';
+import { sendReaction } from '../imsg/react.js';
+import { ImsgRpc } from '../imsg/rpc.js';
+import { readPatchedGatewayCapabilities } from '../imsg/status.js';
+import { toReactionNoteType } from './types.js';
+import { classifyGroupChatResolution } from './portable-chat.js';
+const CREATE_GROUP_SCRIPT = fileURLToPath(new URL('../../scripts/create-group.applescript', import.meta.url));
+// `imsg react` exit 0 does NOT mean the tapback landed (observed live
+// 2026-07-02: one react silently no-oped, another landed in the wrong chat).
+// After firing we poll history until the reaction shows on the target
+// message, or give up and report ok:false.
+const REACT_VERIFY_ATTEMPTS = 8;
+const REACT_VERIFY_INTERVAL_MS = 1000;
+// createGroup: how long we poll for the new thread to materialize in
+// chats.list + history after the compose script exits (which can also lie —
+// observed silent failure 2026-07-02 when a recipient flapped to SMS).
+const GROUP_VERIFY_ATTEMPTS = 6;
+const GROUP_VERIFY_INTERVAL_MS = 2000;
+// How many recent chats resolveDmChat scans. chats.list is newest-first by
+// last_message_at, so the DM of anyone mid-onboarding is comfortably inside a
+// generous window; a completion for a long-dormant thread that has fallen out
+// of it re-warms on the user's next inbound anyway (the pre-existing backstop).
+const CHAT_SCAN_LIMIT = 40;
+// Group resolution is a boot/control operation, not a hot path. chats.list
+// reads chat.db locally and already returns each row's stable GUID and members,
+// so one high-ceiling directory read is both faster and more complete than
+// opening message history for every group. Request one extra row so an account
+// beyond the ceiling still fails closed instead of claiming uniqueness from a
+// partial directory.
+const GROUP_CHAT_SCAN_LIMIT = 100_000;
+// Tier-2 (bridge) verify-after-fire polling. Bridge calls are async IMCore
+// dispatch, not synchronous AppleScript — same "exit 0 lies" discipline as
+// react()/createGroup(), just a different underlying mechanism (a private
+// API queued through openclaw's v2 IPC, not UI automation), so these do NOT
+// take uiMutex: the bridge is built for concurrent access, unlike Messages.app's
+// single GUI focus.
+const TIER2_VERIFY_ATTEMPTS = 6;
+const TIER2_VERIFY_INTERVAL_MS = 1000;
+// Group metadata propagation is materially slower than message/reaction
+// readback on the host (live-observed at 10-15s on macOS 26).
+const GROUP_MUTATION_VERIFY_ATTEMPTS = 20;
+// How far back verify-after-fire scans history for an explicitly-targeted
+// message guid (tapback/edit/unsend/delete can target ANY message, not just
+// the newest — contract §2 — so this window is generous, matching the
+// existing recentReactions/resolveDmChat scan-window convention).
+const TIER2_HISTORY_SCAN = 30;
+// Serializes react() and createGroup() — both drive Messages.app UI
+// automation and share one GUI session (docs/gateway-contract.md §2 "UI
+// automation mutex"). send() does not take this lock; it's AppleScript
+// events, no UI focus needed, and parallelizes fine.
+class Mutex {
+    tail = Promise.resolve();
+    run(fn) {
+        const result = this.tail.then(fn, fn);
+        this.tail = result.then(() => undefined, () => undefined);
+        return result;
+    }
+}
+function delay(ms) {
+    return new Promise((r) => setTimeout(r, ms));
+}
+function normalizeHandle(h) {
+    return h.trim().toLowerCase();
+}
+function sameParticipants(participants, wanted) {
+    if (!participants || participants.length !== wanted.size)
+        return false;
+    return participants.every((h) => wanted.has(normalizeHandle(h)));
+}
+// The react CLI targets the most recent INCOMING message (its own help text,
+// imsg 0.12.0) — our own bubbles are never the target.
+function newestIncoming(history) {
+    for (let i = history.length - 1; i >= 0; i--) {
+        const m = history[i];
+        if (m && !m.is_from_me && !m.is_reaction)
+            return m;
+    }
+    return undefined;
+}
+function hasOwnReaction(msg, reaction) {
+    return Boolean(msg?.reactions?.some((r) => r.is_from_me && r.type === reaction));
+}
+function runCreateGroupScript(handles, firstMessage) {
+    return new Promise((resolve, reject) => {
+        execFile('osascript', [CREATE_GROUP_SCRIPT, ...handles, firstMessage], { timeout: 30_000 }, (err) => err ? reject(err) : resolve());
+    });
+}
+// The long-lived RPC process's chats.list view stays stale after its own
+// group mutations on macOS 26. A fresh CLI process sees the update, so group
+// verify-after-fire uses this read-only subprocess with the same configured
+// binary. Output is one JSON object per line.
+function readFreshChats(limit) {
+    return new Promise((resolve, reject) => {
+        execFile(imsgBinary(), ['chats', '--limit', String(limit), '--json'], { timeout: 10_000 }, (err, stdout) => {
+            if (err) {
+                reject(err);
+                return;
+            }
+            try {
+                resolve(stdout
+                    .split('\n')
+                    .filter(Boolean)
+                    .map((line) => JSON.parse(line)));
+            }
+            catch (parseErr) {
+                reject(parseErr);
+            }
+        });
+    });
+}
+// Real Gateway: wraps the long-lived ImsgRpc child (send/history/subscribe)
+// plus the UI-automation primitives (react, group create) behind the
+// hardening docs/gateway-contract.md and the B1 task spec require. See
+// gateway/types.ts for the react()/ReactResult shape.
+//
+// All reaction STATE comes from history's per-message `reactions[]` aggregate
+// (verified live on imsg 0.12.0, 2026-07-02) — authoritative and restart-safe,
+// unlike stream-tracking, which is blind to anything before boot. The
+// subscribe stream still delivers reaction EVENTS for realtime wake-ups.
+export class ImsgGateway {
+    capabilities;
+    rpc;
+    uiMutex = new Mutex();
+    eventQueue = [];
+    waiters = [];
+    subscribed = false;
+    constructor(onExit) {
+        this.capabilities = readPatchedGatewayCapabilities();
+        this.rpc = new ImsgRpc((msg) => this.pushEvent(msg), onExit);
+    }
+    pushEvent(msg) {
+        this.eventQueue.push(msg);
+        this.waiters.shift()?.();
+    }
+    async *subscribe(sinceId) {
+        // Host-verified 2026-07-14: watch.subscribe requests `attachments:true`,
+        // enriching every live event with local-file metadata.
+        // Single-consumer by contract (§1): eventQueue/waiters are instance-shared,
+        // so a second iterator would silently steal events and double-register the
+        // underlying watch. One long-lived subscription per process (src/index.ts);
+        // reconnect = new gateway.
+        if (this.subscribed) {
+            throw new Error('ImsgGateway.subscribe: already subscribed — one consumer per gateway');
+        }
+        this.subscribed = true;
+        await this.rpc.subscribe(sinceId);
+        for (;;) {
+            const next = this.eventQueue.shift();
+            if (next) {
+                yield next;
+            }
+            else {
+                await new Promise((resolve) => this.waiters.push(resolve));
+            }
+        }
+    }
+    history(chatId, limit = 30) {
+        // Host-verified 2026-07-14: messages.history requests `attachments:true`;
+        // rows pass through without reshaping.
+        return this.rpc.history(chatId, limit);
+    }
+    async listChats(limit = 10_000) {
+        const chats = await this.rpc.chats(limit);
+        return chats.flatMap((chat) => {
+            if (!chat.guid || !chat.participants)
+                return [];
+            return [
+                {
+                    chatId: chat.id,
+                    conversationExternalId: chat.guid,
+                    isGroup: chat.is_group,
+                    participantExternalIds: [...chat.participants].sort(),
+                    lastMessageAt: chat.last_message_at ?? null,
+                },
+            ];
+        });
+    }
+    historyRange(chatId, range) {
+        return this.rpc.historyRange(chatId, range);
+    }
+    send(target, text) {
+        return this.rpc.send(target, text);
+    }
+    async react(chatId, reaction, expectedGuid) {
+        return this.uiMutex.run(async () => {
+            const recent = await this.rpc.history(chatId, 10);
+            const target = newestIncoming(recent);
+            if (!target || (expectedGuid !== undefined && target.guid !== expectedGuid)) {
+                return { ok: true, skipped: 'stale-target' };
+            }
+            // Toggle guard: same reaction from us already on the target means a new
+            // fire would REMOVE it (live incident 2026-07-01) — skip instead.
+            if (hasOwnReaction(target, reaction)) {
+                return { ok: true, skipped: 'already-reacted' };
+            }
+            // DM-only: the automation verifies the focused thread by handle digits,
+            // which group titles don't carry (contract §2).
+            const handle = target.sender ?? target.chat_identifier;
+            if (target.is_group || !handle)
+                return { ok: false };
+            try {
+                await sendReaction(handle, reaction);
+            }
+            catch (err) {
+                // Wrong-chat abort or osascript failure — nothing was sent.
+                console.error(`[gateway] react aborted before firing: ${String(err)}`);
+                return { ok: false };
+            }
+            // Verify it actually landed on the intended message — exit 0 lies.
+            // Deliberately holds uiMutex through the poll: the next react()'s toggle
+            // guard needs this reaction visible in history, or it would double-fire.
+            for (let attempt = 0; attempt < REACT_VERIFY_ATTEMPTS; attempt++) {
+                await delay(REACT_VERIFY_INTERVAL_MS);
+                const after = await this.rpc.history(chatId, 10);
+                if (hasOwnReaction(after.find((m) => m.guid === target.guid), reaction)) {
+                    return { ok: true };
+                }
+            }
+            return { ok: false };
+        });
+    }
+    async createGroup(handles, firstMessage) {
+        return this.uiMutex.run(async () => {
+            await runCreateGroupScript(handles, firstMessage);
+            const wanted = new Set(handles.map(normalizeHandle));
+            // Locate the thread by CONTENT, not just participant set: an existing
+            // group with the same members must only match if our first message
+            // actually landed there (Messages may reuse the existing thread), and
+            // a compose that silently failed (observed 2026-07-02, SMS-flapped
+            // recipient) must surface as an error, not a stale chatId.
+            for (let attempt = 0; attempt < GROUP_VERIFY_ATTEMPTS; attempt++) {
+                await delay(GROUP_VERIFY_INTERVAL_MS);
+                const chats = await this.rpc.chats(20);
+                const candidates = chats.filter((c) => c.is_group && sameParticipants(c.participants, wanted));
+                for (const candidate of candidates) {
+                    const recent = await this.rpc.history(candidate.id, 3);
+                    if (recent.some((m) => m.is_from_me && m.text === firstMessage)) {
+                        return { chatId: candidate.id };
+                    }
+                }
+            }
+            throw new Error('createGroup: first message never appeared in any matching group thread — compose likely failed silently ' +
+                '(check recipients are iMessage-reachable; SMS handles cannot join an iMessage group)');
+        });
+    }
+    // Inbound tapbacks on OUR messages, newest-first — read from history's
+    // reactions[] aggregate, so it survives restarts.
+    async recentReactions(chatId, limit = 10) {
+        const recent = await this.rpc.history(chatId, 30);
+        const notes = [];
+        for (const m of recent) {
+            if (!m.is_from_me || !m.reactions)
+                continue;
+            for (const r of m.reactions) {
+                if (!r.is_from_me)
+                    notes.push({ id: r.id, reaction: toReactionNoteType(r.type), emoji: r.emoji });
+            }
+        }
+        return notes.sort((a, b) => b.id - a.id).slice(0, limit);
+    }
+    // Recover a handle→chat_id the runtime cache lost (pod restart) by reading
+    // it back from chat.db via chats.list — the same source createGroup's
+    // content-verify uses (this.rpc.chats). A DM row is the non-group chat whose
+    // sole participant is this handle. Read-only: returns null when no thread
+    // exists, never composes one.
+    async resolveDmChat(handle) {
+        const wanted = normalizeHandle(handle);
+        const chats = await this.rpc.chats(CHAT_SCAN_LIMIT);
+        const dm = chats.find((c) => !c.is_group && c.participants?.length === 1 && normalizeHandle(c.participants[0] ?? '') === wanted);
+        return dm?.id ?? null;
+    }
+    async resolveGroupChat(request) {
+        const chats = await this.rpc.chats(GROUP_CHAT_SCAN_LIMIT + 1);
+        const directoryComplete = chats.length <= GROUP_CHAT_SCAN_LIMIT;
+        const groupChats = chats.slice(0, GROUP_CHAT_SCAN_LIMIT).filter((chat) => chat.is_group);
+        const groups = [];
+        let everyGroupReadable = true;
+        for (const chat of groupChats) {
+            if (!chat.guid) {
+                everyGroupReadable = false;
+                continue;
+            }
+            groups.push({
+                chatId: chat.id,
+                conversationExternalId: chat.guid,
+                // `participants` is optional on the imsg wire. Report the unknown as
+                // unknown: `?? []` would read as "this group has no members" and turn
+                // an unreadable directory into a confident participant mismatch.
+                participantExternalIds: chat.participants ?? null,
+            });
+        }
+        return classifyGroupChatResolution({
+            request,
+            directoryComplete: directoryComplete && everyGroupReadable,
+            groups,
+        });
+    }
+    // Host-verified 2026-07-14 against the patched bridge.
+    async sendStatus(guid) {
+        try {
+            const result = await this.rpc.messageSendStatus(guid);
+            return {
+                ok: result.ok,
+                guid: result.guid,
+                send_state: result.send_state,
+                service: result.service,
+                delivered_at: result.delivered_at,
+                date_read: result.status_fields?.date_read ?? null,
+                is_read: result.status_fields?.date_read !== null && result.status_fields?.date_read !== undefined,
+                status_fields: result.status_fields,
+            };
+        }
+        catch (err) {
+            console.error(`[gateway] sendStatus failed: ${String(err)}`);
+            return {
+                ok: false,
+                guid,
+                send_state: 'pending',
+                service: null,
+                delivered_at: null,
+                date_read: null,
+                is_read: false,
+                status_fields: null,
+            };
+        }
+    }
+    // Host-verified 2026-07-14 for reachable and unavailable addresses.
+    async checkHandle(address, opts) {
+        try {
+            const result = await this.rpc.checkHandle(address, opts);
+            return {
+                ok: result.ok,
+                available: result.available,
+                idStatus: result.id_status,
+                destination: result.destination,
+                service: result.service,
+                aliasType: result.alias_type,
+                address: result.address,
+            };
+        }
+        catch (err) {
+            console.error(`[gateway] checkHandle failed: ${String(err)}`);
+            return {
+                ok: false,
+                available: false,
+                idStatus: 0,
+                destination: '',
+                service: 'iMessage',
+                aliasType: opts?.aliasType ?? null,
+                address,
+            };
+        }
+    }
+    // ---- Tier 2 (bridge-backed). Patched-fork verbs are fail-closed through
+    // capabilities read from `imsg status --json`; stock imsg omits those
+    // selector markers even when it exposes the same RPC method names. ----
+    // Targeted tapback via the bridge: any message guid, explicit add/remove,
+    // works in group chats. Same closed 6-type Reaction set as react(); custom
+    // emoji is the separately gated emojiTapback() verb below.
+    async tapback(chatId, targetGuid, reaction, remove = false) {
+        const recent = await this.rpc.history(chatId, TIER2_HISTORY_SCAN);
+        const target = recent.find((m) => m.guid === targetGuid);
+        if (!target)
+            return { ok: false };
+        const active = hasOwnReaction(target, reaction);
+        if (remove ? !active : active) {
+            return { ok: true, skipped: remove ? 'not-reacted' : 'already-reacted' };
+        }
+        try {
+            await this.rpc.tapback(chatId, targetGuid, reaction, remove);
+        }
+        catch (err) {
+            console.error(`[gateway] tapback failed: ${String(err)}`);
+            return { ok: false };
+        }
+        for (let attempt = 0; attempt < TIER2_VERIFY_ATTEMPTS; attempt++) {
+            await delay(TIER2_VERIFY_INTERVAL_MS);
+            const after = await this.rpc.history(chatId, TIER2_HISTORY_SCAN);
+            const found = after.find((m) => m.guid === targetGuid);
+            const nowActive = hasOwnReaction(found, reaction);
+            if (remove ? !nowActive : nowActive)
+                return { ok: true };
+        }
+        return { ok: false };
+    }
+    async emojiTapback(chatId, targetGuid, emoji, remove = false) {
+        if (!this.capabilities.emojiTapback || !emoji)
+            return { ok: false };
+        const recent = await this.rpc.history(chatId, TIER2_HISTORY_SCAN);
+        const target = recent.find((m) => m.guid === targetGuid);
+        if (!target)
+            return { ok: false };
+        const active = target.reactions?.some((r) => r.is_from_me && r.type === 'custom' && r.emoji === emoji) ?? false;
+        if (remove ? !active : active) {
+            return { ok: true, skipped: remove ? 'not-reacted' : 'already-reacted' };
+        }
+        try {
+            await this.rpc.emojiTapback(chatId, targetGuid, emoji, remove);
+        }
+        catch (err) {
+            console.error(`[gateway] emojiTapback failed: ${String(err)}`);
+            return { ok: false };
+        }
+        for (let attempt = 0; attempt < TIER2_VERIFY_ATTEMPTS; attempt++) {
+            await delay(TIER2_VERIFY_INTERVAL_MS);
+            const after = await this.rpc.history(chatId, TIER2_HISTORY_SCAN);
+            const found = after.find((m) => m.guid === targetGuid);
+            const nowActive = found?.reactions?.some((r) => r.is_from_me && r.type === 'custom' && r.emoji === emoji) ?? false;
+            if (remove ? !nowActive : nowActive)
+                return { ok: true };
+        }
+        return { ok: false };
+    }
+    // Rich send to an EXISTING chat only (no find-or-create `to:` form, unlike
+    // send()). No extra verification beyond the RPC's own report — mirrors
+    // send(), which relies on the same `{ ok, id?, guid? }` contract and the
+    // natural echo via subscribe().
+    // Subject, text/effect, and reply paths are host-verified.
+    async sendRich(chatId, text, opts) {
+        try {
+            return await this.rpc.sendRich(chatId, text, opts);
+        }
+        catch (err) {
+            console.error(`[gateway] sendRich failed: ${String(err)}`);
+            return { ok: false };
+        }
+    }
+    // Host run 2026-07-14: subject + poll confirmed receiver-visible on the test
+    // phone; poll.send returns the balloon guid as `guid` (not `messageGuid`).
+    // send.attachment returns a guid synchronously; send.rich url mode is async
+    // (`{ok, queued}`) and returns NO guid — see sendRichLink.
+    async sendAttachment(chatId, filePath, opts) {
+        try {
+            return await this.rpc.sendAttachment(chatId, filePath, opts);
+        }
+        catch (err) {
+            console.error(`[gateway] sendAttachment failed: ${String(err)}`);
+            return { ok: false };
+        }
+    }
+    // Host-verified delivered after the patched fork's secure staging fix.
+    async sendSticker(chatId, filePath, opts) {
+        if (!this.capabilities.stickerSend)
+            return { ok: false };
+        try {
+            const result = await this.rpc.sendSticker(chatId, filePath, opts);
+            return { ok: result.ok, guid: result.transfer_guid, id: result.message_id };
+        }
+        catch (err) {
+            console.error(`[gateway] sendSticker failed: ${String(err)}`);
+            return { ok: false };
+        }
+    }
+    async sendPoll(chatId, question, options) {
+        if (options.length < 2)
+            return { ok: false };
+        try {
+            const result = await this.rpc.sendPoll(chatId, question, options);
+            return { ok: true, guid: result.guid };
+        }
+        catch (err) {
+            console.error(`[gateway] sendPoll failed: ${String(err)}`);
+            return { ok: false };
+        }
+    }
+    // The url submode returns `{ok, queued}` with NO guid. Host-verified delivered
+    // after the patched fork moved the deferred bridge send onto its synchronous
+    // path; callers still cannot use the queued response itself as delivery proof.
+    async sendRichLink(chatId, url) {
+        try {
+            return await this.rpc.sendRichLink(chatId, url);
+        }
+        catch (err) {
+            console.error(`[gateway] sendRichLink failed: ${String(err)}`);
+            return { ok: false };
+        }
+    }
+    // Edits mutate the target row's text IN PLACE — no new row, no subscribe()
+    // event (contract §2). Verified by re-reading history for the changed text.
+    async editMessage(chatId, targetGuid, text) {
+        try {
+            await this.rpc.editMessage(chatId, targetGuid, text);
+        }
+        catch (err) {
+            console.error(`[gateway] editMessage failed: ${String(err)}`);
+            return { ok: false };
+        }
+        for (let attempt = 0; attempt < TIER2_VERIFY_ATTEMPTS; attempt++) {
+            await delay(TIER2_VERIFY_INTERVAL_MS);
+            const after = await this.rpc.history(chatId, TIER2_HISTORY_SCAN);
+            if (after.find((m) => m.guid === targetGuid)?.text === text)
+                return { ok: true };
+        }
+        return { ok: false };
+    }
+    // Live-verified on macOS 26: retractMessagePart: leaves the row in history
+    // with its text cleared. There is no separate is_unsent marker.
+    async unsendMessage(chatId, targetGuid) {
+        try {
+            await this.rpc.unsendMessage(chatId, targetGuid);
+        }
+        catch (err) {
+            console.error(`[gateway] unsend failed: ${String(err)}`);
+            return { ok: false };
+        }
+        for (let attempt = 0; attempt < TIER2_VERIFY_ATTEMPTS; attempt++) {
+            await delay(TIER2_VERIFY_INTERVAL_MS);
+            const after = await this.rpc.history(chatId, TIER2_HISTORY_SCAN);
+            const found = after.find((m) => m.guid === targetGuid);
+            if (!found?.text)
+                return { ok: true };
+        }
+        return { ok: false };
+    }
+    // Live-verified on macOS 26: deleteChatItems: is a local-view mutation with
+    // no stable history postcondition (the row persisted in one run and was
+    // absent in another; no is_deleted marker exists). Pre-check the guid so an
+    // unknown target still fails closed, then treat a successful RPC dispatch
+    // as the only observable success signal. The pre-check POLLS (unlike
+    // tapback's single-shot scan) because delete's common caller targets a
+    // just-sent guid that can lag history by a beat — a one-shot read would
+    // fail closed on a message that is about to appear.
+    async deleteMessage(chatId, targetGuid) {
+        let targetFound = false;
+        for (let attempt = 0; attempt < TIER2_VERIFY_ATTEMPTS; attempt++) {
+            const recent = await this.rpc.history(chatId, TIER2_HISTORY_SCAN);
+            if (recent.some((m) => m.guid === targetGuid)) {
+                targetFound = true;
+                break;
+            }
+            await delay(TIER2_VERIFY_INTERVAL_MS);
+        }
+        if (!targetFound)
+            return { ok: false };
+        try {
+            await this.rpc.deleteMessage(chatId, targetGuid);
+            return { ok: true };
+        }
+        catch (err) {
+            console.error(`[gateway] delete failed: ${String(err)}`);
+            return { ok: false };
+        }
+    }
+    // Fire-and-forget: no observable verification surface through this
+    // interface (contract §2). `ok: true` means dispatched without error,
+    // never confirmed.
+    async setTyping(chatId, on) {
+        try {
+            await this.rpc.setTyping(chatId, on);
+            return { ok: true };
+        }
+        catch (err) {
+            console.error(`[gateway] setTyping failed: ${String(err)}`);
+            return { ok: false };
+        }
+    }
+    async markRead(chatId) {
+        try {
+            await this.rpc.markRead(chatId);
+            return { ok: true };
+        }
+        catch (err) {
+            console.error(`[gateway] markRead failed: ${String(err)}`);
+            return { ok: false };
+        }
+    }
+    // Verified against chats.list's display_name field (the same source
+    // createGroup/resolveDmChat already read via this.rpc.chats).
+    async renameGroup(chatId, name) {
+        try {
+            await this.rpc.renameGroup(chatId, name);
+        }
+        catch (err) {
+            console.error(`[gateway] renameGroup failed: ${String(err)}`);
+            return { ok: false };
+        }
+        try {
+            for (let attempt = 0; attempt < GROUP_MUTATION_VERIFY_ATTEMPTS; attempt++) {
+                await delay(TIER2_VERIFY_INTERVAL_MS);
+                const chats = await readFreshChats(CHAT_SCAN_LIMIT);
+                if (chats.find((c) => c.id === chatId)?.display_name === name)
+                    return { ok: true };
+            }
+        }
+        catch (err) {
+            console.error(`[gateway] renameGroup verification failed: ${String(err)}`);
+        }
+        return { ok: false };
+    }
+    // No photo field exists anywhere in imsg's JSON output (docs/json.md) —
+    // fire-and-forget, same as setTyping/markRead.
+    async setGroupPhoto(chatId, filePath) {
+        if (!this.capabilities.groupPhoto)
+            return { ok: false };
+        try {
+            await this.rpc.setGroupPhoto(chatId, filePath);
+            return { ok: true };
+        }
+        catch (err) {
+            console.error(`[gateway] setGroupPhoto failed: ${String(err)}`);
+            return { ok: false };
+        }
+    }
+    async addParticipant(chatId, handle) {
+        if (!this.capabilities.groupParticipants)
+            return { ok: false };
+        return this.fireAndVerifyParticipant(chatId, handle, true, () => this.rpc.addParticipant(chatId, handle));
+    }
+    async removeParticipant(chatId, handle) {
+        if (!this.capabilities.groupParticipants)
+            return { ok: false };
+        return this.fireAndVerifyParticipant(chatId, handle, false, () => this.rpc.removeParticipant(chatId, handle));
+    }
+    async fireAndVerifyParticipant(chatId, handle, wantPresent, fire) {
+        const wanted = normalizeHandle(handle);
+        try {
+            await fire();
+        }
+        catch (err) {
+            console.error(`[gateway] ${wantPresent ? 'addParticipant' : 'removeParticipant'} failed: ${String(err)}`);
+            return { ok: false };
+        }
+        try {
+            for (let attempt = 0; attempt < GROUP_MUTATION_VERIFY_ATTEMPTS; attempt++) {
+                await delay(TIER2_VERIFY_INTERVAL_MS);
+                const chats = await readFreshChats(CHAT_SCAN_LIMIT);
+                const participants = chats.find((c) => c.id === chatId)?.participants ?? [];
+                const present = participants.some((h) => normalizeHandle(h) === wanted);
+                if (present === wantPresent)
+                    return { ok: true };
+            }
+        }
+        catch (err) {
+            console.error(`[gateway] participant verification failed: ${String(err)}`);
+        }
+        return { ok: false };
+    }
+    // participants[] excludes the local user always (contract §2 "Participants
+    // exclude the local user") — leaving never changes it, so there is no field
+    // to verify against. Fire-and-forget, same as setGroupPhoto.
+    async leaveGroup(chatId) {
+        try {
+            await this.rpc.leaveGroup(chatId);
+            return { ok: true };
+        }
+        catch (err) {
+            console.error(`[gateway] leaveGroup failed: ${String(err)}`);
+            return { ok: false };
+        }
+    }
+    async shareNamePhoto(chatId) {
+        if (!this.capabilities.namePhotoSharing)
+            return { ok: false, effectStarted: false };
+        let effectStarted = false;
+        try {
+            const status = await this.rpc.namePhotoStatus(chatId);
+            if (!status.ok || !status.available)
+                return { ok: false, effectStarted: false };
+            if (status.should_offer !== true)
+                return { ok: true, skipped: 'not-offered' };
+            effectStarted = true;
+            const shared = await this.rpc.shareNamePhoto(chatId);
+            return shared.ok && shared.requested ? { ok: true } : { ok: false, effectStarted: true };
+        }
+        catch (err) {
+            console.error(`[gateway] shareNamePhoto failed: ${String(err)}`);
+            return { ok: false, effectStarted };
+        }
+    }
+    stop() {
+        this.rpc.stop();
+    }
+}
+//# sourceMappingURL=imsg.js.map