@glyphteck/veyl 0.29.2 → 0.30.1

package/dist/cli.js

@@ -61224,11 +61224,13 @@ function deriveKey(input, label, parts = [], size = 32) {
 "use client";
 var VAULT_SIGNATURE_PROTOCOL = "veyl-vault-signature-v1";
 var VAULT_SIGNING_KEY_SCOPE = "vault-signing-key-v1";
-var VAULT_LEASE_PURPOSE = "vault-lease";
 var VAULT_SIGNATURE_PURPOSES = Object.freeze({
+  CREATE_PASSKEY_LINK: "create-passkey-link",
   DELETE_ACCOUNT: "delete-account",
+  DELETE_PASSKEY: "delete-passkey",
   LOGOUT_ALL_DEVICES: "logout-all-devices",
   SET_CHAT_IDENTITY: "set-chat-identity",
+  SET_SETTINGS: "set-settings",
   SET_WALLET_IDENTITY: "set-wallet-identity"
 });
 var BASE64URL_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
@@ -61271,12 +61273,12 @@ function cleanGeneration(value) {
   }
   return generation;
 }
-function cleanClientSessionId(value) {
-  const clientSessionId = typeof value === "string" ? value.trim() : "";
-  if (!/^[A-Za-z0-9_-]{24,80}$/u.test(clientSessionId)) {
-    throw signatureError("invalid-client-session", "client session required");
+function cleanSessionId(value) {
+  const sessionId = typeof value === "string" ? value.trim() : "";
+  if (!/^[A-Za-z0-9_-]{24,80}$/u.test(sessionId)) {
+    throw signatureError("invalid-session", "session required");
   }
-  return clientSessionId;
+  return sessionId;
 }
 function vaultSigningPublicKey(masterSeed) {
   const secret = deriveKey(toBytes(masterSeed, "master seed"), VAULT_SIGNING_KEY_SCOPE);
@@ -61323,7 +61325,7 @@ function createVaultSignature(signer, claims, purpose, payload = null, now = Dat
       VAULT_SIGNATURE_PROTOCOL,
       uid,
       cleanGeneration(claims?.sessionGeneration),
-      cleanClientSessionId(claims?.clientSessionId),
+      cleanSessionId(claims?.sessionId),
       cleanPurpose(purpose),
       now,
       base64url2(randomBytes3(24)),
@@ -61582,12 +61584,12 @@ async function encryptSeedWithPassword(seed, pwd, options = {}) {
   const params = normalizeVaultKdf(options.params);
   const deriveKey2 = getVaultDeriveKey(options);
   const registry = normalizeSecretRegistry(options.registry || createSecretRegistry());
-  const vaultSigningPK = vaultSigningPublicKey(seed);
+  const vaultPK = vaultSigningPublicKey(seed);
   const sealedRegistry = await sealSecretRegistry(seed, registry);
   const key = await deriveKey2(pwd, salt, params);
   try {
     const { iv, ct } = await sealAes(key, seed);
-    return { crypto: options.crypto || VAULT_CRYPTO, kdf: params, ciphertext: ct, salt, iv, registry: sealedRegistry, vaultSigningPK };
+    return { crypto: options.crypto || VAULT_CRYPTO, kdf: params, ciphertext: ct, salt, iv, registry: sealedRegistry, vaultPK };
   } finally {
     key.fill(0);
   }
@@ -63378,7 +63380,7 @@ async function openAccountSessionFromSecrets(walletEntropy, chatSeed, masterSeed
       network,
       vaultSigner,
       vaultAccess,
-      vaultSigningPK: vaultSigner.publicKey
+      vaultPK: vaultSigner.publicKey
     });
   } catch (error) {
     closeSessionResources({ wallet, chatPrivateKey, vaultAccess, vaultSigner });
@@ -152230,6 +152232,15 @@ function authSessionGeneration(value) {
   const generation = Number(value);
   return Number.isSafeInteger(generation) && generation > 0 ? generation : null;
 }
+function authCredentialFromClaims(claims) {
+  const kind = typeof claims?.credentialKind === "string" ? claims.credentialKind.trim() : "";
+  const id = typeof claims?.credentialId === "string" ? claims.credentialId.trim() : "";
+  return /^(machine|passkey)$/u.test(kind) && /^[A-Za-z0-9_-]{1,1500}$/u.test(id) ? { kind, id } : null;
+}
+function authCredentialDoc(db, credential) {
+  const collectionName = credential?.kind === "passkey" ? "passkeys" : credential?.kind === "machine" ? "machineCredentials" : "";
+  return collectionName ? doc(db, collectionName, credential.id) : null;
+}
 function vaultSignatureError(code, message) {
   const error = new Error(message);
   error.code = `vault-signature/${code}`;
@@ -152312,9 +152323,6 @@ function createFirebaseCloud({ db, auth: auth2, getAuth: getAuth2, functions: fu
     throw new Error("createFirebaseCloud requires db");
   }
   let activeVaultSigner = null;
-  let vaultLeaseExpiresAt = 0;
-  let vaultLeaseRequest = null;
-  let vaultOpenRequest = null;
   function pageTs(value) {
     if (value instanceof Timestamp2) {
       return value;
@@ -152475,11 +152483,12 @@ function createFirebaseCloud({ db, auth: auth2, getAuth: getAuth2, functions: fu
     requireUid(uid);
     const user = requireAuth().currentUser;
     let active = true;
-    let unsubscribe = () => {};
+    let unsubscribeSession = () => {};
+    let unsubscribeCredential = () => {};
     if (!user || user.uid !== uid) {
       Promise.resolve().then(() => {
         if (active)
-          onUpdate?.({ active: false, generation: null, currentGeneration: null });
+          onUpdate?.({ active: false, generation: null, currentGeneration: null, authCredential: null });
       });
       return () => {
         active = false;
@@ -152489,19 +152498,43 @@ function createFirebaseCloud({ db, auth: auth2, getAuth: getAuth2, functions: fu
       if (!active)
         return;
       const generation = authSessionGeneration(result?.claims?.sessionGeneration);
-      if (!generation) {
-        onUpdate?.({ active: false, generation: null, currentGeneration: null });
+      const sessionId = typeof result?.claims?.sessionId === "string" ? result.claims.sessionId : "";
+      const authCredential = authCredentialFromClaims(result?.claims);
+      const credentialRef = authCredentialDoc(db, authCredential);
+      if (!generation || !sessionId || !authCredential || !credentialRef) {
+        onUpdate?.({ active: false, generation: null, currentGeneration: null, authCredential: null });
         return;
       }
-      unsubscribe = onSnapshot(doc(db, "auth_sessions", uid), (snap) => {
-        if (!active)
+      let sessionReady = false;
+      let credentialReady = false;
+      let currentGeneration = null;
+      let credentialActive = false;
+      const emit = () => {
+        if (!active || !sessionReady || !credentialReady)
           return;
-        const currentGeneration = authSessionGeneration(snap.data()?.generation);
         onUpdate?.({
-          active: currentGeneration === generation,
+          active: currentGeneration === generation && credentialActive,
           generation,
-          currentGeneration
+          currentGeneration,
+          authCredential
         });
+      };
+      unsubscribeSession = onSnapshot(doc(db, "users", uid, "auth", "session"), (snap) => {
+        if (!active)
+          return;
+        sessionReady = true;
+        currentGeneration = authSessionGeneration(snap.data()?.generation);
+        emit();
+      }, (error) => {
+        if (active)
+          onError?.(error);
+      });
+      unsubscribeCredential = onSnapshot(credentialRef, (snap) => {
+        if (!active)
+          return;
+        credentialReady = true;
+        credentialActive = snap.exists() && snap.data()?.uid === uid;
+        emit();
       }, (error) => {
         if (active)
           onError?.(error);
@@ -152512,9 +152545,43 @@ function createFirebaseCloud({ db, auth: auth2, getAuth: getAuth2, functions: fu
     });
     return () => {
       active = false;
-      unsubscribe();
+      unsubscribeSession();
+      unsubscribeCredential();
     };
   }
+  function watchPasskeyLinks(uid, onUpdate, onError) {
+    requireUid(uid);
+    return onSnapshot(query(collection(db, "passkeyLinks"), where("uid", "==", uid)), (snapshot) => {
+      const links2 = snapshot.docs.map((snap) => {
+        const data = snap.data() || {};
+        if (data.status !== "pending")
+          return null;
+        return {
+          id: snap.id,
+          type: "pending",
+          status: "pending",
+          createdAt: timestampMs(data.createdAt, null)
+        };
+      }).filter(Boolean).sort((a, b) => (b.createdAt || 0) - (a.createdAt || 0));
+      onUpdate?.(links2);
+    }, onError);
+  }
+  function watchPasskeys(uid, onUpdate, onError) {
+    requireUid(uid);
+    return onSnapshot(query(collection(db, "passkeys"), where("uid", "==", uid)), (snapshot) => {
+      const passkeys = snapshot.docs.map((snap) => {
+        const data = snap.data() || {};
+        const label = typeof data.label === "string" ? data.label.trim() : "";
+        return {
+          id: snap.id,
+          type: "passkey",
+          label: label || "unnamed passkey",
+          createdAt: timestampMs(data.createdAt, null)
+        };
+      }).filter(Boolean).sort((a, b) => (b.createdAt || 0) - (a.createdAt || 0));
+      onUpdate?.(passkeys);
+    }, onError);
+  }
   async function logout() {
     await signOut(requireAuth());
     return true;
@@ -152523,25 +152590,25 @@ function createFirebaseCloud({ db, auth: auth2, getAuth: getAuth2, functions: fu
     await callVaultFunction("logoutDevices", VAULT_SIGNATURE_PURPOSES.LOGOUT_ALL_DEVICES);
     return true;
   }
-  async function clientSessionClaims() {
+  async function sessionClaims() {
     const user = requireAuth().currentUser;
     if (!user?.uid) {
       throw new Error("signed in user required");
     }
     const token = await user.getIdTokenResult();
     const sessionGeneration = authSessionGeneration(token?.claims?.sessionGeneration);
-    const clientSessionId = token?.claims?.clientSessionId;
-    if (!sessionGeneration || typeof clientSessionId !== "string" || !clientSessionId) {
-      throw new Error("invalid client session");
+    const sessionId = token?.claims?.sessionId;
+    if (!sessionGeneration || typeof sessionId !== "string" || !sessionId) {
+      throw new Error("invalid session");
     }
     return {
       uid: user.uid,
       sessionGeneration,
-      clientSessionId
+      sessionId
     };
   }
   function vaultSignatureClaims() {
-    return clientSessionClaims();
+    return sessionClaims();
   }
   async function signVaultRequest(purpose, payload = null, signer = activeVaultSigner) {
     if (!signer) {
@@ -152551,71 +152618,22 @@ function createFirebaseCloud({ db, auth: auth2, getAuth: getAuth2, functions: fu
       return createVaultSignature(signer, await vaultSignatureClaims(), purpose, payload);
     } catch (error) {
       if (!error?.code) {
-        error.code = "vault-signature/proof-construction";
+        error.code = "vault-signature/construction";
       }
       throw error;
     }
   }
-  async function grantVaultLease(signer = activeVaultSigner, force = false) {
-    if (!signer || signer !== activeVaultSigner) {
-      throw new Error("unlocked vault required");
-    }
-    if (!force && vaultLeaseExpiresAt - Date.now() > 15000) {
-      return { expiresAt: vaultLeaseExpiresAt };
-    }
-    if (vaultLeaseRequest?.signer === signer) {
-      return vaultLeaseRequest.promise;
-    }
-    const promise = (async () => {
-      const result = await callFunction("grantVaultLease", {
-        vaultSignature: await signVaultRequest(VAULT_LEASE_PURPOSE, null, signer)
-      });
-      if (signer !== activeVaultSigner) {
-        throw new Error("vault locked during authorization");
-      }
-      const expiresAt = Number(result?.expiresAt);
-      if (!Number.isFinite(expiresAt) || expiresAt <= Date.now()) {
-        throw new Error("invalid vault lease");
-      }
-      vaultLeaseExpiresAt = expiresAt;
-      return { expiresAt };
-    })().finally(() => {
-      if (vaultLeaseRequest?.promise === promise) {
-        vaultLeaseRequest = null;
-      }
-    });
-    vaultLeaseRequest = { signer, promise };
-    return promise;
-  }
   async function openVaultSignature(signer) {
     if (!signer?.publicKey || typeof signer?.sign !== "function") {
       throw vaultSignatureError("invalid-signer", "vault signer required");
     }
     if (activeVaultSigner?.closed) {
       activeVaultSigner = null;
-      vaultLeaseExpiresAt = 0;
-      vaultLeaseRequest = null;
-      vaultOpenRequest = null;
     }
     if (activeVaultSigner && activeVaultSigner !== signer) {
       throw vaultSignatureError("already-open", "vault signature already open");
     }
     activeVaultSigner = signer;
-    const openPromise = grantVaultLease(signer, true);
-    vaultOpenRequest = { signer, promise: openPromise };
-    try {
-      await openPromise;
-    } catch (error) {
-      if (activeVaultSigner === signer) {
-        activeVaultSigner = null;
-        vaultLeaseExpiresAt = 0;
-      }
-      throw error;
-    } finally {
-      if (vaultOpenRequest?.promise === openPromise) {
-        vaultOpenRequest = null;
-      }
-    }
     let closed = false;
     return {
       close() {
@@ -152625,8 +152643,6 @@ function createFirebaseCloud({ db, auth: auth2, getAuth: getAuth2, functions: fu
         if (activeVaultSigner !== signer)
           return;
         activeVaultSigner = null;
-        vaultLeaseExpiresAt = 0;
-        callFunction("dropVaultLease").catch(() => {});
       }
     };
   }
@@ -152634,9 +152650,6 @@ function createFirebaseCloud({ db, auth: auth2, getAuth: getAuth2, functions: fu
     const signer = activeVaultSigner;
     if (!signer)
       throw new Error("unlocked vault required");
-    if (vaultOpenRequest?.signer === signer) {
-      await vaultOpenRequest.promise;
-    }
     if (signer !== activeVaultSigner) {
       throw vaultSignatureError("locked", "unlocked vault required");
     }
@@ -152666,10 +152679,10 @@ function createFirebaseCloud({ db, auth: auth2, getAuth: getAuth2, functions: fu
     const snap = await getDoc(doc(db, "seeds", uid));
     return snap.exists();
   }
-  async function writeVault(uid, vault, { vaultSigningPK } = {}) {
+  async function writeVault(uid, vault, { vaultPK } = {}) {
     requireUid(uid);
-    if (!vault || !vaultSigningPK) {
-      throw new Error("vault enrollment required");
+    if (!vault || !vaultPK) {
+      throw new Error("vault and public key required");
     }
     const user = requireAuth().currentUser;
     if (user?.uid !== uid) {
@@ -152677,7 +152690,7 @@ function createFirebaseCloud({ db, auth: auth2, getAuth: getAuth2, functions: fu
     }
     await callFunction("createVault", {
       vault: cloudBytesBase64(vault, "vault bytes"),
-      vaultSigningPK
+      vaultPK
     });
     return true;
   }
@@ -152779,10 +152792,7 @@ function createFirebaseCloud({ db, auth: auth2, getAuth: getAuth2, functions: fu
       return openSettings(key, uid, readCloudBytes(saved, "settings body"));
     }
     const settings = normalizeSettings(defaultSettings);
-    await grantVaultLease(activeVaultSigner);
-    await setDoc(doc(db, "users", uid), {
-      settings: writeCloudBytes(await sealSettings(key, uid, settings), "settings body")
-    }, { merge: true });
+    await callVaultFunction("setSettings", VAULT_SIGNATURE_PURPOSES.SET_SETTINGS, { settings: bytesBase64(await sealSettings(key, uid, settings)) });
     return settings;
   }
   async function writeSettings(uid, settings, { currentSettings, key } = {}) {
@@ -152793,10 +152803,7 @@ function createFirebaseCloud({ db, auth: auth2, getAuth: getAuth2, functions: fu
     const base = currentSettings || await readSettings(uid, key);
     const nextSettings = normalizeSettings(settings, base);
     const body = await sealSettings(key, uid, nextSettings);
-    await grantVaultLease(activeVaultSigner);
-    await setDoc(doc(db, "users", uid), {
-      settings: writeCloudBytes(body, "settings body")
-    }, { merge: true });
+    await callVaultFunction("setSettings", VAULT_SIGNATURE_PURPOSES.SET_SETTINGS, { settings: bytesBase64(body) });
     return nextSettings;
   }
   async function writeUserActive(uid, active) {
@@ -152853,7 +152860,7 @@ function createFirebaseCloud({ db, auth: auth2, getAuth: getAuth2, functions: fu
   }
   async function readPeer(uid) {
     requireUid(uid);
-    const snap = await getDoc(doc(db, "profiles", uid));
+    const snap = await getDocFromServer(doc(db, "profiles", uid));
     return peerRecordFromDoc(snap);
   }
   async function readPeerActive(uid) {
@@ -153120,7 +153127,6 @@ function createFirebaseCloud({ db, auth: auth2, getAuth: getAuth2, functions: fu
     },
     vaultSignature: {
       open: openVaultSignature,
-      ensure: () => grantVaultLease(activeVaultSigner),
       sign: signVaultRequest,
       call: callVaultFunction
     },
@@ -153135,6 +153141,19 @@ function createFirebaseCloud({ db, auth: auth2, getAuth: getAuth2, functions: fu
       start: (payload) => callFunction("passkeyRegisterOptions", payload),
       token: (payload) => callFunction("passkeyRegisterVerify", payload),
       finish: (payload) => finishAuth("passkeyRegisterVerify", payload)
+    },
+    passkeys: {
+      watch: watchPasskeys,
+      deleteOptions: (payload) => callFunction("passkeyDeleteOptions", payload),
+      delete: (id, assertion = null) => callVaultFunction("deletePasskey", VAULT_SIGNATURE_PURPOSES.DELETE_PASSKEY, assertion ? { id, assertion } : { id })
+    },
+    passkeyLinks: {
+      info: (payload) => callFunction("passkeyLinkInfo", payload),
+      start: (payload) => callFunction("passkeyLinkOptions", payload),
+      use: (payload) => callFunction("usePasskeyLink", payload),
+      activate: (token) => signInWithCustomToken(requireAuth(), token),
+      create: () => callVaultFunction("createPasskeyLink", VAULT_SIGNATURE_PURPOSES.CREATE_PASSKEY_LINK),
+      watch: watchPasskeyLinks
     }
   };
   function userChatsQuery(uid, count, afterChat) {
@@ -155518,41 +155537,87 @@ function cliHelpLines(kind) {
   const field2 = kind === "structured" ? "structuredUsage" : "shortUsage";
   return HEADLESS_COMMANDS.map((item) => item[field2]).filter(Boolean);
 }
-// package.json
+// ../../package.json
 var package_default = {
-  name: "@glyphteck/veyl",
-  version: "0.29.2",
+  name: "veyl",
+  version: "0.30.1",
+  private: true,
   license: "Apache-2.0",
-  type: "module",
-  description: "Programmable Node.js client for Veyl accounts, vaults, chat, and wallet payments.",
-  repository: {
-    type: "git",
-    url: "https://github.com/glyphteck/veyl.git",
-    directory: "clients/headless"
-  },
-  exports: {
-    ".": "./dist/index.js"
-  },
-  bin: {
-    veyl: "dist/cli.js"
-  },
-  files: [
-    "dist",
-    "docs",
-    "README.md",
-    "package.json"
-  ],
-  engines: {
-    node: ">=22.0.0"
-  },
-  publishConfig: {
-    access: "public"
+  workspaces: {
+    packages: [
+      "clients/*",
+      "adapters/*",
+      "bots",
+      "shared"
+    ],
+    catalog: {
+      "@buildonspark/spark-sdk": "^0.8.8",
+      "@noble/ciphers": "^2.2.0",
+      "@noble/curves": "^2.2.0",
+      "@noble/hashes": "^2.2.0",
+      "@scure/bip39": "^2.2.0",
+      "@tailwindcss/postcss": "^4.3.2",
+      bech32: "^2.0.0",
+      firebase: "^12.16.0",
+      "lucide-react": "^1.24.0",
+      next: "16.3.0-preview.6",
+      "next-themes": "^0.4.6",
+      postcss: "^8.5.19",
+      react: "19.2.7",
+      "react-dom": "19.2.7",
+      tailwindcss: "^4.3.2",
+      "tw-animate-css": "^1.4.0"
+    }
   },
   scripts: {
-    build: "bun build src/index.js src/cli.js --target=node --outdir dist",
-    prepack: "bun run build",
-    start: "node src/cli.js",
-    lint: "eslint src --quiet"
+    admin: "bun scripts/admin/index.mjs",
+    bot: "bun scripts/admin/bot.mjs",
+    passkey: "bun scripts/admin/passkey.mjs",
+    push: "bun scripts/repo.mjs push",
+    merge: "bun scripts/repo.mjs merge",
+    dev: "bun scripts/dev.mjs",
+    make: "bun scripts/make.mjs",
+    map: "bun scripts/map.mjs",
+    dirty: "bun scripts/dirty.mjs",
+    "check:paths": "bun scripts/check-paths.mjs",
+    ban: "bun scripts/admin/ban.mjs",
+    nuke: "bun scripts/admin/nuke.mjs",
+    free: "bun scripts/admin/free.mjs",
+    lint: "eslint . --quiet",
+    "lint:warn": "eslint .",
+    "lint:quality": 'eslint . --rule "react-hooks/exhaustive-deps: warn" --rule "react-hooks/purity: warn" --rule "complexity: [warn, 20]" --rule "max-depth: [warn, 4]" --rule "max-lines-per-function: [warn, {max: 200, skipBlankLines: true, skipComments: true}]" --rule "max-params: [warn, 6]"',
+    "lint:fix": "eslint . --fix",
+    "install:clean": "bun scripts/deps.mjs clean-install",
+    update: "bun scripts/deps.mjs update",
+    "sync:frameworks": "bun scripts/sync-frameworks.mjs",
+    "check:frameworks": "bun scripts/sync-frameworks.mjs --check"
+  },
+  dependencies: {
+    "@buildonspark/spark-sdk": "^0.8.8",
+    "@noble/ciphers": "^2.2.0",
+    "@noble/curves": "^2.2.0",
+    "@noble/hashes": "^2.2.0",
+    "@scure/bip39": "^2.2.0",
+    "@veyl/shared": "workspace:*",
+    bech32: "^2.0.0",
+    firebase: "^12.16.0"
+  },
+  overrides: {
+    firebase: "catalog:",
+    next: "catalog:",
+    "react-native-quick-base64": "3.0.1"
+  },
+  patchedDependencies: {
+    "@noble/hashes@1.8.0": "patches/@noble__hashes@1.8.0.patch",
+    "react-native-keyboard-controller@1.22.0": "patches/react-native-keyboard-controller@1.22.0.patch",
+    "react-native-reanimated@4.5.0": "patches/react-native-reanimated@4.5.0.patch"
+  },
+  devDependencies: {
+    "@eslint/js": "^10.0.1",
+    "babel-plugin-react-compiler": "^1.0.0",
+    eslint: "^10.7.0",
+    "eslint-plugin-react-hooks": "^7.1.1",
+    globals: "^17.7.0"
   }
 };
 
@@ -156007,7 +156072,7 @@ class VeylHeadlessClient {
         registry: registrySource
       });
       const vault = packSeedData(encrypted);
-      await this.cloud.user.vault.write(profile.uid, vault, { vaultSigningPK: encrypted.vaultSigningPK });
+      await this.cloud.user.vault.write(profile.uid, vault, { vaultPK: encrypted.vaultPK });
       const session = await this.bootSession(masterSeed, encrypted.registry, profile);
       await this.cloud.user.profile.walletpk.write(session.walletPK, { network: profile.network || this.network });
       await this.cloud.user.profile.chatpk.write(session.chatPK);

package/dist/index.js

@@ -61223,11 +61223,13 @@ function deriveKey(input, label, parts = [], size = 32) {
 "use client";
 var VAULT_SIGNATURE_PROTOCOL = "veyl-vault-signature-v1";
 var VAULT_SIGNING_KEY_SCOPE = "vault-signing-key-v1";
-var VAULT_LEASE_PURPOSE = "vault-lease";
 var VAULT_SIGNATURE_PURPOSES = Object.freeze({
+  CREATE_PASSKEY_LINK: "create-passkey-link",
   DELETE_ACCOUNT: "delete-account",
+  DELETE_PASSKEY: "delete-passkey",
   LOGOUT_ALL_DEVICES: "logout-all-devices",
   SET_CHAT_IDENTITY: "set-chat-identity",
+  SET_SETTINGS: "set-settings",
   SET_WALLET_IDENTITY: "set-wallet-identity"
 });
 var BASE64URL_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
@@ -61270,12 +61272,12 @@ function cleanGeneration(value) {
   }
   return generation;
 }
-function cleanClientSessionId(value) {
-  const clientSessionId = typeof value === "string" ? value.trim() : "";
-  if (!/^[A-Za-z0-9_-]{24,80}$/u.test(clientSessionId)) {
-    throw signatureError("invalid-client-session", "client session required");
+function cleanSessionId(value) {
+  const sessionId = typeof value === "string" ? value.trim() : "";
+  if (!/^[A-Za-z0-9_-]{24,80}$/u.test(sessionId)) {
+    throw signatureError("invalid-session", "session required");
   }
-  return clientSessionId;
+  return sessionId;
 }
 function vaultSigningPublicKey(masterSeed) {
   const secret = deriveKey(toBytes(masterSeed, "master seed"), VAULT_SIGNING_KEY_SCOPE);
@@ -61322,7 +61324,7 @@ function createVaultSignature(signer, claims, purpose, payload = null, now = Dat
       VAULT_SIGNATURE_PROTOCOL,
       uid,
       cleanGeneration(claims?.sessionGeneration),
-      cleanClientSessionId(claims?.clientSessionId),
+      cleanSessionId(claims?.sessionId),
       cleanPurpose(purpose),
       now,
       base64url2(randomBytes3(24)),
@@ -61581,12 +61583,12 @@ async function encryptSeedWithPassword(seed, pwd, options = {}) {
   const params = normalizeVaultKdf(options.params);
   const deriveKey2 = getVaultDeriveKey(options);
   const registry = normalizeSecretRegistry(options.registry || createSecretRegistry());
-  const vaultSigningPK = vaultSigningPublicKey(seed);
+  const vaultPK = vaultSigningPublicKey(seed);
   const sealedRegistry = await sealSecretRegistry(seed, registry);
   const key = await deriveKey2(pwd, salt, params);
   try {
     const { iv, ct } = await sealAes(key, seed);
-    return { crypto: options.crypto || VAULT_CRYPTO, kdf: params, ciphertext: ct, salt, iv, registry: sealedRegistry, vaultSigningPK };
+    return { crypto: options.crypto || VAULT_CRYPTO, kdf: params, ciphertext: ct, salt, iv, registry: sealedRegistry, vaultPK };
   } finally {
     key.fill(0);
   }
@@ -63377,7 +63379,7 @@ async function openAccountSessionFromSecrets(walletEntropy, chatSeed, masterSeed
       network,
       vaultSigner,
       vaultAccess,
-      vaultSigningPK: vaultSigner.publicKey
+      vaultPK: vaultSigner.publicKey
     });
   } catch (error) {
     closeSessionResources({ wallet, chatPrivateKey, vaultAccess, vaultSigner });
@@ -152229,6 +152231,15 @@ function authSessionGeneration(value) {
   const generation = Number(value);
   return Number.isSafeInteger(generation) && generation > 0 ? generation : null;
 }
+function authCredentialFromClaims(claims) {
+  const kind = typeof claims?.credentialKind === "string" ? claims.credentialKind.trim() : "";
+  const id = typeof claims?.credentialId === "string" ? claims.credentialId.trim() : "";
+  return /^(machine|passkey)$/u.test(kind) && /^[A-Za-z0-9_-]{1,1500}$/u.test(id) ? { kind, id } : null;
+}
+function authCredentialDoc(db, credential) {
+  const collectionName = credential?.kind === "passkey" ? "passkeys" : credential?.kind === "machine" ? "machineCredentials" : "";
+  return collectionName ? doc(db, collectionName, credential.id) : null;
+}
 function vaultSignatureError(code, message) {
   const error = new Error(message);
   error.code = `vault-signature/${code}`;
@@ -152311,9 +152322,6 @@ function createFirebaseCloud({ db, auth: auth2, getAuth: getAuth2, functions: fu
     throw new Error("createFirebaseCloud requires db");
   }
   let activeVaultSigner = null;
-  let vaultLeaseExpiresAt = 0;
-  let vaultLeaseRequest = null;
-  let vaultOpenRequest = null;
   function pageTs(value) {
     if (value instanceof Timestamp2) {
       return value;
@@ -152474,11 +152482,12 @@ function createFirebaseCloud({ db, auth: auth2, getAuth: getAuth2, functions: fu
     requireUid(uid);
     const user = requireAuth().currentUser;
     let active = true;
-    let unsubscribe = () => {};
+    let unsubscribeSession = () => {};
+    let unsubscribeCredential = () => {};
     if (!user || user.uid !== uid) {
       Promise.resolve().then(() => {
         if (active)
-          onUpdate?.({ active: false, generation: null, currentGeneration: null });
+          onUpdate?.({ active: false, generation: null, currentGeneration: null, authCredential: null });
       });
       return () => {
         active = false;
@@ -152488,19 +152497,43 @@ function createFirebaseCloud({ db, auth: auth2, getAuth: getAuth2, functions: fu
       if (!active)
         return;
       const generation = authSessionGeneration(result?.claims?.sessionGeneration);
-      if (!generation) {
-        onUpdate?.({ active: false, generation: null, currentGeneration: null });
+      const sessionId = typeof result?.claims?.sessionId === "string" ? result.claims.sessionId : "";
+      const authCredential = authCredentialFromClaims(result?.claims);
+      const credentialRef = authCredentialDoc(db, authCredential);
+      if (!generation || !sessionId || !authCredential || !credentialRef) {
+        onUpdate?.({ active: false, generation: null, currentGeneration: null, authCredential: null });
         return;
       }
-      unsubscribe = onSnapshot(doc(db, "auth_sessions", uid), (snap) => {
-        if (!active)
+      let sessionReady = false;
+      let credentialReady = false;
+      let currentGeneration = null;
+      let credentialActive = false;
+      const emit = () => {
+        if (!active || !sessionReady || !credentialReady)
           return;
-        const currentGeneration = authSessionGeneration(snap.data()?.generation);
         onUpdate?.({
-          active: currentGeneration === generation,
+          active: currentGeneration === generation && credentialActive,
           generation,
-          currentGeneration
+          currentGeneration,
+          authCredential
         });
+      };
+      unsubscribeSession = onSnapshot(doc(db, "users", uid, "auth", "session"), (snap) => {
+        if (!active)
+          return;
+        sessionReady = true;
+        currentGeneration = authSessionGeneration(snap.data()?.generation);
+        emit();
+      }, (error) => {
+        if (active)
+          onError?.(error);
+      });
+      unsubscribeCredential = onSnapshot(credentialRef, (snap) => {
+        if (!active)
+          return;
+        credentialReady = true;
+        credentialActive = snap.exists() && snap.data()?.uid === uid;
+        emit();
       }, (error) => {
         if (active)
           onError?.(error);
@@ -152511,9 +152544,43 @@ function createFirebaseCloud({ db, auth: auth2, getAuth: getAuth2, functions: fu
     });
     return () => {
       active = false;
-      unsubscribe();
+      unsubscribeSession();
+      unsubscribeCredential();
     };
   }
+  function watchPasskeyLinks(uid, onUpdate, onError) {
+    requireUid(uid);
+    return onSnapshot(query(collection(db, "passkeyLinks"), where("uid", "==", uid)), (snapshot) => {
+      const links2 = snapshot.docs.map((snap) => {
+        const data = snap.data() || {};
+        if (data.status !== "pending")
+          return null;
+        return {
+          id: snap.id,
+          type: "pending",
+          status: "pending",
+          createdAt: timestampMs(data.createdAt, null)
+        };
+      }).filter(Boolean).sort((a, b) => (b.createdAt || 0) - (a.createdAt || 0));
+      onUpdate?.(links2);
+    }, onError);
+  }
+  function watchPasskeys(uid, onUpdate, onError) {
+    requireUid(uid);
+    return onSnapshot(query(collection(db, "passkeys"), where("uid", "==", uid)), (snapshot) => {
+      const passkeys = snapshot.docs.map((snap) => {
+        const data = snap.data() || {};
+        const label = typeof data.label === "string" ? data.label.trim() : "";
+        return {
+          id: snap.id,
+          type: "passkey",
+          label: label || "unnamed passkey",
+          createdAt: timestampMs(data.createdAt, null)
+        };
+      }).filter(Boolean).sort((a, b) => (b.createdAt || 0) - (a.createdAt || 0));
+      onUpdate?.(passkeys);
+    }, onError);
+  }
   async function logout() {
     await signOut(requireAuth());
     return true;
@@ -152522,25 +152589,25 @@ function createFirebaseCloud({ db, auth: auth2, getAuth: getAuth2, functions: fu
     await callVaultFunction("logoutDevices", VAULT_SIGNATURE_PURPOSES.LOGOUT_ALL_DEVICES);
     return true;
   }
-  async function clientSessionClaims() {
+  async function sessionClaims() {
     const user = requireAuth().currentUser;
     if (!user?.uid) {
       throw new Error("signed in user required");
     }
     const token = await user.getIdTokenResult();
     const sessionGeneration = authSessionGeneration(token?.claims?.sessionGeneration);
-    const clientSessionId = token?.claims?.clientSessionId;
-    if (!sessionGeneration || typeof clientSessionId !== "string" || !clientSessionId) {
-      throw new Error("invalid client session");
+    const sessionId = token?.claims?.sessionId;
+    if (!sessionGeneration || typeof sessionId !== "string" || !sessionId) {
+      throw new Error("invalid session");
     }
     return {
       uid: user.uid,
       sessionGeneration,
-      clientSessionId
+      sessionId
     };
   }
   function vaultSignatureClaims() {
-    return clientSessionClaims();
+    return sessionClaims();
   }
   async function signVaultRequest(purpose, payload = null, signer = activeVaultSigner) {
     if (!signer) {
@@ -152550,71 +152617,22 @@ function createFirebaseCloud({ db, auth: auth2, getAuth: getAuth2, functions: fu
       return createVaultSignature(signer, await vaultSignatureClaims(), purpose, payload);
     } catch (error) {
       if (!error?.code) {
-        error.code = "vault-signature/proof-construction";
+        error.code = "vault-signature/construction";
       }
       throw error;
     }
   }
-  async function grantVaultLease(signer = activeVaultSigner, force = false) {
-    if (!signer || signer !== activeVaultSigner) {
-      throw new Error("unlocked vault required");
-    }
-    if (!force && vaultLeaseExpiresAt - Date.now() > 15000) {
-      return { expiresAt: vaultLeaseExpiresAt };
-    }
-    if (vaultLeaseRequest?.signer === signer) {
-      return vaultLeaseRequest.promise;
-    }
-    const promise = (async () => {
-      const result = await callFunction("grantVaultLease", {
-        vaultSignature: await signVaultRequest(VAULT_LEASE_PURPOSE, null, signer)
-      });
-      if (signer !== activeVaultSigner) {
-        throw new Error("vault locked during authorization");
-      }
-      const expiresAt = Number(result?.expiresAt);
-      if (!Number.isFinite(expiresAt) || expiresAt <= Date.now()) {
-        throw new Error("invalid vault lease");
-      }
-      vaultLeaseExpiresAt = expiresAt;
-      return { expiresAt };
-    })().finally(() => {
-      if (vaultLeaseRequest?.promise === promise) {
-        vaultLeaseRequest = null;
-      }
-    });
-    vaultLeaseRequest = { signer, promise };
-    return promise;
-  }
   async function openVaultSignature(signer) {
     if (!signer?.publicKey || typeof signer?.sign !== "function") {
       throw vaultSignatureError("invalid-signer", "vault signer required");
     }
     if (activeVaultSigner?.closed) {
       activeVaultSigner = null;
-      vaultLeaseExpiresAt = 0;
-      vaultLeaseRequest = null;
-      vaultOpenRequest = null;
     }
     if (activeVaultSigner && activeVaultSigner !== signer) {
       throw vaultSignatureError("already-open", "vault signature already open");
     }
     activeVaultSigner = signer;
-    const openPromise = grantVaultLease(signer, true);
-    vaultOpenRequest = { signer, promise: openPromise };
-    try {
-      await openPromise;
-    } catch (error) {
-      if (activeVaultSigner === signer) {
-        activeVaultSigner = null;
-        vaultLeaseExpiresAt = 0;
-      }
-      throw error;
-    } finally {
-      if (vaultOpenRequest?.promise === openPromise) {
-        vaultOpenRequest = null;
-      }
-    }
     let closed = false;
     return {
       close() {
@@ -152624,8 +152642,6 @@ function createFirebaseCloud({ db, auth: auth2, getAuth: getAuth2, functions: fu
         if (activeVaultSigner !== signer)
           return;
         activeVaultSigner = null;
-        vaultLeaseExpiresAt = 0;
-        callFunction("dropVaultLease").catch(() => {});
       }
     };
   }
@@ -152633,9 +152649,6 @@ function createFirebaseCloud({ db, auth: auth2, getAuth: getAuth2, functions: fu
     const signer = activeVaultSigner;
     if (!signer)
       throw new Error("unlocked vault required");
-    if (vaultOpenRequest?.signer === signer) {
-      await vaultOpenRequest.promise;
-    }
     if (signer !== activeVaultSigner) {
       throw vaultSignatureError("locked", "unlocked vault required");
     }
@@ -152665,10 +152678,10 @@ function createFirebaseCloud({ db, auth: auth2, getAuth: getAuth2, functions: fu
     const snap = await getDoc(doc(db, "seeds", uid));
     return snap.exists();
   }
-  async function writeVault(uid, vault, { vaultSigningPK } = {}) {
+  async function writeVault(uid, vault, { vaultPK } = {}) {
     requireUid(uid);
-    if (!vault || !vaultSigningPK) {
-      throw new Error("vault enrollment required");
+    if (!vault || !vaultPK) {
+      throw new Error("vault and public key required");
     }
     const user = requireAuth().currentUser;
     if (user?.uid !== uid) {
@@ -152676,7 +152689,7 @@ function createFirebaseCloud({ db, auth: auth2, getAuth: getAuth2, functions: fu
     }
     await callFunction("createVault", {
       vault: cloudBytesBase64(vault, "vault bytes"),
-      vaultSigningPK
+      vaultPK
     });
     return true;
   }
@@ -152778,10 +152791,7 @@ function createFirebaseCloud({ db, auth: auth2, getAuth: getAuth2, functions: fu
       return openSettings(key, uid, readCloudBytes(saved, "settings body"));
     }
     const settings = normalizeSettings(defaultSettings);
-    await grantVaultLease(activeVaultSigner);
-    await setDoc(doc(db, "users", uid), {
-      settings: writeCloudBytes(await sealSettings(key, uid, settings), "settings body")
-    }, { merge: true });
+    await callVaultFunction("setSettings", VAULT_SIGNATURE_PURPOSES.SET_SETTINGS, { settings: bytesBase64(await sealSettings(key, uid, settings)) });
     return settings;
   }
   async function writeSettings(uid, settings, { currentSettings, key } = {}) {
@@ -152792,10 +152802,7 @@ function createFirebaseCloud({ db, auth: auth2, getAuth: getAuth2, functions: fu
     const base = currentSettings || await readSettings(uid, key);
     const nextSettings = normalizeSettings(settings, base);
     const body = await sealSettings(key, uid, nextSettings);
-    await grantVaultLease(activeVaultSigner);
-    await setDoc(doc(db, "users", uid), {
-      settings: writeCloudBytes(body, "settings body")
-    }, { merge: true });
+    await callVaultFunction("setSettings", VAULT_SIGNATURE_PURPOSES.SET_SETTINGS, { settings: bytesBase64(body) });
     return nextSettings;
   }
   async function writeUserActive(uid, active) {
@@ -152852,7 +152859,7 @@ function createFirebaseCloud({ db, auth: auth2, getAuth: getAuth2, functions: fu
   }
   async function readPeer(uid) {
     requireUid(uid);
-    const snap = await getDoc(doc(db, "profiles", uid));
+    const snap = await getDocFromServer(doc(db, "profiles", uid));
     return peerRecordFromDoc(snap);
   }
   async function readPeerActive(uid) {
@@ -153119,7 +153126,6 @@ function createFirebaseCloud({ db, auth: auth2, getAuth: getAuth2, functions: fu
     },
     vaultSignature: {
       open: openVaultSignature,
-      ensure: () => grantVaultLease(activeVaultSigner),
       sign: signVaultRequest,
       call: callVaultFunction
     },
@@ -153134,6 +153140,19 @@ function createFirebaseCloud({ db, auth: auth2, getAuth: getAuth2, functions: fu
       start: (payload) => callFunction("passkeyRegisterOptions", payload),
       token: (payload) => callFunction("passkeyRegisterVerify", payload),
       finish: (payload) => finishAuth("passkeyRegisterVerify", payload)
+    },
+    passkeys: {
+      watch: watchPasskeys,
+      deleteOptions: (payload) => callFunction("passkeyDeleteOptions", payload),
+      delete: (id, assertion = null) => callVaultFunction("deletePasskey", VAULT_SIGNATURE_PURPOSES.DELETE_PASSKEY, assertion ? { id, assertion } : { id })
+    },
+    passkeyLinks: {
+      info: (payload) => callFunction("passkeyLinkInfo", payload),
+      start: (payload) => callFunction("passkeyLinkOptions", payload),
+      use: (payload) => callFunction("usePasskeyLink", payload),
+      activate: (token) => signInWithCustomToken(requireAuth(), token),
+      create: () => callVaultFunction("createPasskeyLink", VAULT_SIGNATURE_PURPOSES.CREATE_PASSKEY_LINK),
+      watch: watchPasskeyLinks
     }
   };
   function userChatsQuery(uid, count, afterChat) {
@@ -155517,41 +155536,87 @@ function cliHelpLines(kind) {
   const field2 = kind === "structured" ? "structuredUsage" : "shortUsage";
   return HEADLESS_COMMANDS.map((item) => item[field2]).filter(Boolean);
 }
-// package.json
+// ../../package.json
 var package_default = {
-  name: "@glyphteck/veyl",
-  version: "0.29.2",
+  name: "veyl",
+  version: "0.30.1",
+  private: true,
   license: "Apache-2.0",
-  type: "module",
-  description: "Programmable Node.js client for Veyl accounts, vaults, chat, and wallet payments.",
-  repository: {
-    type: "git",
-    url: "https://github.com/glyphteck/veyl.git",
-    directory: "clients/headless"
-  },
-  exports: {
-    ".": "./dist/index.js"
-  },
-  bin: {
-    veyl: "dist/cli.js"
-  },
-  files: [
-    "dist",
-    "docs",
-    "README.md",
-    "package.json"
-  ],
-  engines: {
-    node: ">=22.0.0"
-  },
-  publishConfig: {
-    access: "public"
+  workspaces: {
+    packages: [
+      "clients/*",
+      "adapters/*",
+      "bots",
+      "shared"
+    ],
+    catalog: {
+      "@buildonspark/spark-sdk": "^0.8.8",
+      "@noble/ciphers": "^2.2.0",
+      "@noble/curves": "^2.2.0",
+      "@noble/hashes": "^2.2.0",
+      "@scure/bip39": "^2.2.0",
+      "@tailwindcss/postcss": "^4.3.2",
+      bech32: "^2.0.0",
+      firebase: "^12.16.0",
+      "lucide-react": "^1.24.0",
+      next: "16.3.0-preview.6",
+      "next-themes": "^0.4.6",
+      postcss: "^8.5.19",
+      react: "19.2.7",
+      "react-dom": "19.2.7",
+      tailwindcss: "^4.3.2",
+      "tw-animate-css": "^1.4.0"
+    }
   },
   scripts: {
-    build: "bun build src/index.js src/cli.js --target=node --outdir dist",
-    prepack: "bun run build",
-    start: "node src/cli.js",
-    lint: "eslint src --quiet"
+    admin: "bun scripts/admin/index.mjs",
+    bot: "bun scripts/admin/bot.mjs",
+    passkey: "bun scripts/admin/passkey.mjs",
+    push: "bun scripts/repo.mjs push",
+    merge: "bun scripts/repo.mjs merge",
+    dev: "bun scripts/dev.mjs",
+    make: "bun scripts/make.mjs",
+    map: "bun scripts/map.mjs",
+    dirty: "bun scripts/dirty.mjs",
+    "check:paths": "bun scripts/check-paths.mjs",
+    ban: "bun scripts/admin/ban.mjs",
+    nuke: "bun scripts/admin/nuke.mjs",
+    free: "bun scripts/admin/free.mjs",
+    lint: "eslint . --quiet",
+    "lint:warn": "eslint .",
+    "lint:quality": 'eslint . --rule "react-hooks/exhaustive-deps: warn" --rule "react-hooks/purity: warn" --rule "complexity: [warn, 20]" --rule "max-depth: [warn, 4]" --rule "max-lines-per-function: [warn, {max: 200, skipBlankLines: true, skipComments: true}]" --rule "max-params: [warn, 6]"',
+    "lint:fix": "eslint . --fix",
+    "install:clean": "bun scripts/deps.mjs clean-install",
+    update: "bun scripts/deps.mjs update",
+    "sync:frameworks": "bun scripts/sync-frameworks.mjs",
+    "check:frameworks": "bun scripts/sync-frameworks.mjs --check"
+  },
+  dependencies: {
+    "@buildonspark/spark-sdk": "^0.8.8",
+    "@noble/ciphers": "^2.2.0",
+    "@noble/curves": "^2.2.0",
+    "@noble/hashes": "^2.2.0",
+    "@scure/bip39": "^2.2.0",
+    "@veyl/shared": "workspace:*",
+    bech32: "^2.0.0",
+    firebase: "^12.16.0"
+  },
+  overrides: {
+    firebase: "catalog:",
+    next: "catalog:",
+    "react-native-quick-base64": "3.0.1"
+  },
+  patchedDependencies: {
+    "@noble/hashes@1.8.0": "patches/@noble__hashes@1.8.0.patch",
+    "react-native-keyboard-controller@1.22.0": "patches/react-native-keyboard-controller@1.22.0.patch",
+    "react-native-reanimated@4.5.0": "patches/react-native-reanimated@4.5.0.patch"
+  },
+  devDependencies: {
+    "@eslint/js": "^10.0.1",
+    "babel-plugin-react-compiler": "^1.0.0",
+    eslint: "^10.7.0",
+    "eslint-plugin-react-hooks": "^7.1.1",
+    globals: "^17.7.0"
   }
 };
 
@@ -156006,7 +156071,7 @@ class VeylHeadlessClient {
         registry: registrySource
       });
       const vault = packSeedData(encrypted);
-      await this.cloud.user.vault.write(profile.uid, vault, { vaultSigningPK: encrypted.vaultSigningPK });
+      await this.cloud.user.vault.write(profile.uid, vault, { vaultPK: encrypted.vaultPK });
       const session = await this.bootSession(masterSeed, encrypted.registry, profile);
       await this.cloud.user.profile.walletpk.write(session.walletPK, { network: profile.network || this.network });
       await this.cloud.user.profile.chatpk.write(session.chatPK);

package/package.json

@@ -1,6 +1,5 @@
 {
     "name": "@glyphteck/veyl",
-    "version": "0.29.2",
     "license": "Apache-2.0",
     "type": "module",
     "description": "Programmable Node.js client for Veyl accounts, vaults, chat, and wallet payments.",
@@ -32,5 +31,6 @@
         "prepack": "bun run build",
         "start": "node src/cli.js",
         "lint": "eslint src --quiet"
-    }
+    },
+    "version": "0.30.1"
 }