@glyphteck/veyl 0.4.1 → 0.5.0

package/dist/cli.js

@@ -33491,7 +33491,7 @@ var require_src2 = __commonJS((exports) => {
 
 // ../../node_modules/.bun/@grpc+grpc-js@1.14.3/node_modules/@grpc/grpc-js/build/src/channelz.js
 var require_channelz = __commonJS((exports) => {
-  var __dirname = "/Users/zaksorel/glyphteck/veyl/node_modules/.bun/@grpc+grpc-js@1.14.3/node_modules/@grpc/grpc-js/build/src";
+  var __dirname = "/home/runner/work/veyl/veyl/node_modules/.bun/@grpc+grpc-js@1.14.3/node_modules/@grpc/grpc-js/build/src";
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.registerChannelzSocket = exports.registerChannelzServer = exports.registerChannelzSubchannel = exports.registerChannelzChannel = exports.ChannelzCallTrackerStub = exports.ChannelzCallTracker = exports.ChannelzChildrenTrackerStub = exports.ChannelzChildrenTracker = exports.ChannelzTrace = exports.ChannelzTraceStub = undefined;
   exports.unregisterChannelzRef = unregisterChannelzRef;
@@ -38894,7 +38894,7 @@ var require_duration = __commonJS((exports) => {
 
 // ../../node_modules/.bun/@grpc+grpc-js@1.14.3/node_modules/@grpc/grpc-js/build/src/orca.js
 var require_orca = __commonJS((exports) => {
-  var __dirname = "/Users/zaksorel/glyphteck/veyl/node_modules/.bun/@grpc+grpc-js@1.14.3/node_modules/@grpc/grpc-js/build/src";
+  var __dirname = "/home/runner/work/veyl/veyl/node_modules/.bun/@grpc+grpc-js@1.14.3/node_modules/@grpc/grpc-js/build/src";
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.OrcaOobMetricsSubchannelWrapper = exports.GRPC_METRICS_HEADER = exports.ServerMetricRecorder = exports.PerRequestMetricRecorder = undefined;
   exports.createOrcaClient = createOrcaClient;
@@ -48428,7 +48428,7 @@ var require_src4 = __commonJS((exports) => {
 
 // ../../node_modules/.bun/@grpc+grpc-js@1.9.15/node_modules/@grpc/grpc-js/build/src/channelz.js
 var require_channelz2 = __commonJS((exports) => {
-  var __dirname = "/Users/zaksorel/glyphteck/veyl/node_modules/.bun/@grpc+grpc-js@1.9.15/node_modules/@grpc/grpc-js/build/src";
+  var __dirname = "/home/runner/work/veyl/veyl/node_modules/.bun/@grpc+grpc-js@1.9.15/node_modules/@grpc/grpc-js/build/src";
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.setup = exports.getChannelzServiceDefinition = exports.getChannelzHandlers = exports.unregisterChannelzRef = exports.registerChannelzSocket = exports.registerChannelzServer = exports.registerChannelzSubchannel = exports.registerChannelzChannel = exports.ChannelzCallTracker = exports.ChannelzChildrenTracker = exports.ChannelzTrace = undefined;
   var net_1 = __require("net");
@@ -61204,6 +61204,148 @@ async function openAes(key, iv, ct, aad) {
   return new Uint8Array(pt);
 }
 
+// ../../shared/crypto/kdf.js
+"use client";
+var ROOT_SALT = encoder.encode("GLYPHTECK");
+function listParts(parts = []) {
+  if (Array.isArray(parts)) {
+    return parts;
+  }
+  return [parts];
+}
+function encodeScope(label, parts = []) {
+  return encoder.encode(JSON.stringify([label, ...listParts(parts)]));
+}
+function deriveKey(input, label, parts = [], size = 32) {
+  return hkdf(sha256, input, ROOT_SALT, encodeScope(label, parts), size);
+}
+
+// ../../shared/crypto/vaultsignature.js
+"use client";
+var VAULT_SIGNATURE_PROTOCOL = "veyl-vault-signature-v1";
+var VAULT_SIGNING_KEY_SCOPE = "vault-signing-key-v1";
+var VAULT_LEASE_PURPOSE = "vault-lease";
+var VAULT_SIGNATURE_PURPOSES = Object.freeze({
+  DELETE_ACCOUNT: "delete-account",
+  LOGOUT_ALL_DEVICES: "logout-all-devices",
+  SET_CHAT_IDENTITY: "set-chat-identity",
+  SET_WALLET_IDENTITY: "set-wallet-identity"
+});
+var BASE64URL_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+function signatureError(code, message, cause = null) {
+  const error = new Error(message);
+  error.code = `vault-signature/${code}`;
+  if (cause)
+    error.cause = cause;
+  return error;
+}
+function base64url2(bytes) {
+  const source = toBytes(bytes, "base64url bytes");
+  let encoded = "";
+  for (let index = 0;index < source.length; index += 3) {
+    const a = source[index];
+    const hasB = index + 1 < source.length;
+    const hasC = index + 2 < source.length;
+    const b = hasB ? source[index + 1] : 0;
+    const c = hasC ? source[index + 2] : 0;
+    encoded += BASE64URL_ALPHABET[a >>> 2];
+    encoded += BASE64URL_ALPHABET[(a & 3) << 4 | b >>> 4];
+    if (hasB)
+      encoded += BASE64URL_ALPHABET[(b & 15) << 2 | c >>> 6];
+    if (hasC)
+      encoded += BASE64URL_ALPHABET[c & 63];
+  }
+  return encoded;
+}
+function cleanPurpose(value) {
+  const purpose = typeof value === "string" ? value.trim() : "";
+  if (!/^[a-z][a-z0-9-]{0,63}$/u.test(purpose)) {
+    throw signatureError("invalid-purpose", "vault signature purpose required");
+  }
+  return purpose;
+}
+function cleanGeneration(value) {
+  const generation = Number(value);
+  if (!Number.isSafeInteger(generation) || generation < 1) {
+    throw signatureError("invalid-generation", "active session generation required");
+  }
+  return generation;
+}
+function cleanClientSessionId(value) {
+  const clientSessionId = typeof value === "string" ? value.trim() : "";
+  if (!/^[A-Za-z0-9_-]{24,80}$/u.test(clientSessionId)) {
+    throw signatureError("invalid-client-session", "client session required");
+  }
+  return clientSessionId;
+}
+function vaultSigningPublicKey(masterSeed) {
+  const secret = deriveKey(toBytes(masterSeed, "master seed"), VAULT_SIGNING_KEY_SCOPE);
+  try {
+    return toHex(ed25519.getPublicKey(secret));
+  } finally {
+    cleanBytes(secret);
+  }
+}
+function createVaultSigner(masterSeed) {
+  const secret = deriveKey(toBytes(masterSeed, "master seed"), VAULT_SIGNING_KEY_SCOPE);
+  const publicKey = toHex(ed25519.getPublicKey(secret));
+  let closed = false;
+  return {
+    publicKey,
+    get closed() {
+      return closed;
+    },
+    sign(bytes) {
+      if (closed) {
+        throw signatureError("signer-closed", "vault signer closed");
+      }
+      return toHex(ed25519.sign(toBytes(bytes, "vault signature bytes"), secret));
+    },
+    close() {
+      if (closed)
+        return;
+      closed = true;
+      cleanBytes(secret);
+    }
+  };
+}
+function createVaultSignature(signer, claims, purpose, payload = null, now = Date.now()) {
+  if (!signer?.publicKey || typeof signer?.sign !== "function") {
+    throw signatureError("invalid-signer", "vault signer required");
+  }
+  const uid = typeof claims?.uid === "string" ? claims.uid.trim() : "";
+  if (!uid) {
+    throw signatureError("invalid-uid", "vault signature uid required");
+  }
+  let message;
+  try {
+    message = encoder.encode(JSON.stringify([
+      VAULT_SIGNATURE_PROTOCOL,
+      uid,
+      cleanGeneration(claims?.sessionGeneration),
+      cleanClientSessionId(claims?.clientSessionId),
+      cleanPurpose(purpose),
+      now,
+      base64url2(randomBytes3(24)),
+      payload
+    ]));
+  } catch (error) {
+    if (error?.code)
+      throw error;
+    throw signatureError("message-construction", "vault signature message failed", error);
+  }
+  try {
+    return {
+      message: base64url2(message),
+      signature: signer.sign(message)
+    };
+  } catch (error) {
+    if (error?.code)
+      throw error;
+    throw signatureError("signing", "vault signature signing failed", error);
+  }
+}
+
 // ../../shared/crypto/seed.js
 "use client";
 var VAULT_SALT = sha256(encoder.encode("vault-v1"));
@@ -61438,21 +61580,22 @@ function getChatSeed(registry) {
 async function encryptSeedWithPassword(seed, pwd, options = {}) {
   const salt = randomBytes3(SALT_BYTES);
   const params = normalizeVaultKdf(options.params);
-  const deriveKey = getVaultDeriveKey(options);
+  const deriveKey2 = getVaultDeriveKey(options);
   const registry = normalizeSecretRegistry(options.registry || createSecretRegistry());
+  const vaultSigningPK = vaultSigningPublicKey(seed);
   const sealedRegistry = await sealSecretRegistry(seed, registry);
-  const key = await deriveKey(pwd, salt, params);
+  const key = await deriveKey2(pwd, salt, params);
   try {
     const { iv, ct } = await sealAes(key, seed);
-    return { crypto: options.crypto || VAULT_CRYPTO, kdf: params, ciphertext: ct, salt, iv, registry: sealedRegistry };
+    return { crypto: options.crypto || VAULT_CRYPTO, kdf: params, ciphertext: ct, salt, iv, registry: sealedRegistry, vaultSigningPK };
   } finally {
     key.fill(0);
   }
 }
 async function decryptSeed(ciphertext, salt, iv, pwd, params = VAULT_KDF, options = {}) {
   const kdf = normalizeVaultKdf(params);
-  const deriveKey = getVaultDeriveKey(options);
-  const key = await deriveKey(pwd, salt, kdf);
+  const deriveKey2 = getVaultDeriveKey(options);
+  const key = await deriveKey2(pwd, salt, kdf);
   try {
     return await openAes(key, iv, ciphertext);
   } finally {
@@ -61543,6 +61686,196 @@ var WALLET_PENDING_TRANSFER_STALE_RETRY_MS = 2 * MINUTE_MS;
 var WALLET_PENDING_TRANSFER_STUCK_RETRY_MS = 10 * MINUTE_MS;
 var WALLET_TRANSFER_CACHE_WRITE_DELAY_MS = 3 * MS_PER_SECOND;
 
+// ../../shared/links.js
+var ROOT_DOMAIN = "glyphteck.com";
+var domains = Object.freeze({
+  root: ROOT_DOMAIN,
+  rootDev: `dev.${ROOT_DOMAIN}`,
+  veyl: `veyl.${ROOT_DOMAIN}`,
+  veylTest: `test.veyl.${ROOT_DOMAIN}`,
+  veylDev: `dev.veyl.${ROOT_DOMAIN}`
+});
+var origins = Object.freeze({
+  root: `https://${domains.root}`,
+  rootDev: `https://${domains.rootDev}`,
+  rootDevWeb: `https://${domains.rootDev}:3001`,
+  veyl: `https://${domains.veyl}`,
+  veylTest: `https://${domains.veylTest}`,
+  veylDev: `https://${domains.veylDev}`,
+  veylDevWeb: `https://${domains.veylDev}:3000`
+});
+var links = Object.freeze({
+  root: origins.root,
+  rootDev: origins.rootDev,
+  rootDevWeb: origins.rootDevWeb,
+  veyl: origins.veyl,
+  veylTest: origins.veylTest,
+  veylDev: origins.veylDev,
+  veylDevWeb: origins.veylDevWeb,
+  contact: `mailto:contact@${ROOT_DOMAIN}`,
+  regtestFaucet: "https://app.lightspark.com/regtest-faucet"
+});
+var localHosts = Object.freeze([
+  domains.rootDev,
+  domains.veylDev
+]);
+var appDomains = Object.freeze([
+  domains.veyl,
+  domains.veylTest
+]);
+var appLinkDomains = Object.freeze([
+  domains.veyl,
+  domains.veylTest,
+  domains.veylDev
+]);
+var allowedPasskeyOrigins = Object.freeze([
+  origins.root,
+  origins.rootDev,
+  origins.rootDevWeb,
+  origins.veylDev,
+  origins.veylDevWeb,
+  origins.veylTest,
+  origins.veyl
+]);
+var storageCorsOrigins = Object.freeze([
+  origins.rootDevWeb,
+  origins.veylDev,
+  origins.veylDevWeb,
+  origins.veyl,
+  origins.veylTest
+]);
+var webApps = Object.freeze({
+  veyl: Object.freeze({
+    domain: domains.veylDev,
+    origin: origins.veylDevWeb,
+    port: "3000"
+  })
+});
+
+// ../../shared/network.js
+var DEFAULT_NETWORK = "REGTEST";
+var MAINNET_NETWORK = "MAINNET";
+var REGTEST_NETWORK = "REGTEST";
+var MAINNET_DOMAIN = domains.veyl;
+var REGTEST_DOMAIN = domains.veylTest;
+function resolveNetwork(env = {}) {
+  const raw = env?.EXPO_PUBLIC_NETWORK ?? env?.NEXT_PUBLIC_NETWORK ?? env?.VEYL_NETWORK ?? env?.NETWORK ?? DEFAULT_NETWORK;
+  return String(raw).toUpperCase();
+}
+function getAddressNetwork(address) {
+  const a = String(address ?? "").trim();
+  if (!a)
+    return null;
+  if (/^bcrt1[ac-hj-np-z02-9]{39,87}$/i.test(a))
+    return REGTEST_NETWORK;
+  if (/^bc1[ac-hj-np-z02-9]{39,87}$/i.test(a))
+    return MAINNET_NETWORK;
+  if (/^[13][a-km-zA-HJ-NP-Z1-9]{25,34}$/.test(a))
+    return MAINNET_NETWORK;
+  return null;
+}
+function isAddressOnNetwork(address, network) {
+  const detected = getAddressNetwork(address);
+  return detected !== null && detected === String(network ?? "").toUpperCase();
+}
+
+// ../../shared/settings.js
+var SEND_ON_SCAN_ENABLED = false;
+var WALLET_NETWORKS = new Set([MAINNET_NETWORK, REGTEST_NETWORK]);
+var defaultSettings = {
+  glass: true,
+  moneyFormat: "usd",
+  ghostWallet: true,
+  showChatPreviews: true,
+  sendOnScan: false,
+  confirmSend: false,
+  faceID: null,
+  walletNetwork: null,
+  autolock: {
+    timer: "never",
+    onHide: false,
+    onBlur: false,
+    onBackground: false
+  }
+};
+function normalizeWalletNetworkSetting(value) {
+  if (value == null)
+    return null;
+  const network = String(value).trim().toUpperCase();
+  if (!WALLET_NETWORKS.has(network)) {
+    throw new Error("bad walletNetwork");
+  }
+  return network;
+}
+function normalizeAutolock(autolock, base = defaultSettings.autolock) {
+  if (autolock !== undefined && (!autolock || typeof autolock !== "object" || Array.isArray(autolock))) {
+    throw new Error("bad autolock");
+  }
+  const next = {
+    ...defaultSettings.autolock,
+    ...base || {},
+    ...autolock || {}
+  };
+  if (next.timer !== "never" && (!Number.isInteger(next.timer) || next.timer < AUTOLOCK_MIN_MINUTES || next.timer > AUTOLOCK_MAX_MINUTES)) {
+    throw new Error("bad timer");
+  }
+  if (typeof next.onHide !== "boolean") {
+    throw new Error("bad onHide");
+  }
+  if (typeof next.onBlur !== "boolean") {
+    throw new Error("bad onBlur");
+  }
+  if (typeof next.onBackground !== "boolean") {
+    throw new Error("bad onBackground");
+  }
+  return next;
+}
+function normalizeSettings(settings, base = defaultSettings) {
+  if (!settings || typeof settings !== "object" || Array.isArray(settings)) {
+    throw new Error("settings object required");
+  }
+  const current = {
+    ...defaultSettings,
+    ...base || {},
+    autolock: {
+      ...defaultSettings.autolock,
+      ...base?.autolock || {}
+    }
+  };
+  const next = {
+    ...current,
+    ...settings,
+    ghostWallet: defaultSettings.ghostWallet
+  };
+  next.autolock = normalizeAutolock(settings.autolock, current.autolock);
+  next.walletNetwork = normalizeWalletNetworkSetting(next.walletNetwork);
+  if (!["btc", "usd", "sats"].includes(next.moneyFormat)) {
+    throw new Error("bad moneyFormat");
+  }
+  if (typeof next.glass !== "boolean") {
+    throw new Error("glass must be boolean");
+  }
+  if (typeof next.ghostWallet !== "boolean") {
+    throw new Error("ghostWallet must be boolean");
+  }
+  if (typeof next.showChatPreviews !== "boolean") {
+    throw new Error("showChatPreviews must be boolean");
+  }
+  if (typeof next.sendOnScan !== "boolean") {
+    throw new Error("sendOnScan must be boolean");
+  }
+  if (!SEND_ON_SCAN_ENABLED) {
+    next.sendOnScan = false;
+  }
+  if (typeof next.confirmSend !== "boolean") {
+    throw new Error("confirmSend must be boolean");
+  }
+  if (next.faceID !== null && typeof next.faceID !== "boolean") {
+    throw new Error("faceID must be boolean or null");
+  }
+  return next;
+}
+
 // ../../shared/crypto/canonical.js
 "use client";
 function isPlainObject(value) {
@@ -61588,22 +61921,6 @@ function canonicalBytes(value, label = "value") {
   return encoder.encode(canonicalJson(value, label));
 }
 
-// ../../shared/crypto/kdf.js
-"use client";
-var ROOT_SALT = encoder.encode("GLYPHTECK");
-function listParts(parts = []) {
-  if (Array.isArray(parts)) {
-    return parts;
-  }
-  return [parts];
-}
-function encodeScope(label, parts = []) {
-  return encoder.encode(JSON.stringify([label, ...listParts(parts)]));
-}
-function deriveKey(input, label, parts = [], size = 32) {
-  return hkdf(sha256, input, ROOT_SALT, encodeScope(label, parts), size);
-}
-
 // ../../node_modules/.bun/@noble+ciphers@2.2.0/node_modules/@noble/ciphers/_arx.js
 var encodeStr = (str) => Uint8Array.from(str.split(""), (c) => c.charCodeAt(0));
 var sigma16_32 = /* @__PURE__ */ (() => swap32IfBE2(u322(encodeStr("expand 16-byte k"))))();
@@ -62371,91 +62688,6 @@ var unpackBodyData = (bytes, nonceBytes = BOX_NONCE_BYTES) => {
   return { nonce: packed.nonce, ct: packed.ct };
 };
 
-// ../../shared/settings.js
-var SEND_ON_SCAN_ENABLED = false;
-var defaultSettings = {
-  glass: true,
-  moneyFormat: "usd",
-  ghostWallet: true,
-  showChatPreviews: true,
-  sendOnScan: false,
-  confirmSend: false,
-  faceID: null,
-  autolock: {
-    timer: "never",
-    onHide: false,
-    onBlur: false,
-    onBackground: false
-  }
-};
-function normalizeAutolock(autolock, base = defaultSettings.autolock) {
-  if (autolock !== undefined && (!autolock || typeof autolock !== "object" || Array.isArray(autolock))) {
-    throw new Error("bad autolock");
-  }
-  const next = {
-    ...defaultSettings.autolock,
-    ...base || {},
-    ...autolock || {}
-  };
-  if (next.timer !== "never" && (!Number.isInteger(next.timer) || next.timer < AUTOLOCK_MIN_MINUTES || next.timer > AUTOLOCK_MAX_MINUTES)) {
-    throw new Error("bad timer");
-  }
-  if (typeof next.onHide !== "boolean") {
-    throw new Error("bad onHide");
-  }
-  if (typeof next.onBlur !== "boolean") {
-    throw new Error("bad onBlur");
-  }
-  if (typeof next.onBackground !== "boolean") {
-    throw new Error("bad onBackground");
-  }
-  return next;
-}
-function normalizeSettings(settings, base = defaultSettings) {
-  if (!settings || typeof settings !== "object" || Array.isArray(settings)) {
-    throw new Error("settings object required");
-  }
-  const current = {
-    ...defaultSettings,
-    ...base || {},
-    autolock: {
-      ...defaultSettings.autolock,
-      ...base?.autolock || {}
-    }
-  };
-  const next = {
-    ...current,
-    ...settings,
-    ghostWallet: defaultSettings.ghostWallet
-  };
-  next.autolock = normalizeAutolock(settings.autolock, current.autolock);
-  if (!["btc", "usd", "sats"].includes(next.moneyFormat)) {
-    throw new Error("bad moneyFormat");
-  }
-  if (typeof next.glass !== "boolean") {
-    throw new Error("glass must be boolean");
-  }
-  if (typeof next.ghostWallet !== "boolean") {
-    throw new Error("ghostWallet must be boolean");
-  }
-  if (typeof next.showChatPreviews !== "boolean") {
-    throw new Error("showChatPreviews must be boolean");
-  }
-  if (typeof next.sendOnScan !== "boolean") {
-    throw new Error("sendOnScan must be boolean");
-  }
-  if (!SEND_ON_SCAN_ENABLED) {
-    next.sendOnScan = false;
-  }
-  if (typeof next.confirmSend !== "boolean") {
-    throw new Error("confirmSend must be boolean");
-  }
-  if (next.faceID !== null && typeof next.faceID !== "boolean") {
-    throw new Error("faceID must be boolean or null");
-  }
-  return next;
-}
-
 // ../../shared/utils/text.js
 function cleanText(value) {
   return typeof value === "string" ? value.trim() : "";
@@ -63044,7 +63276,13 @@ function walletPubkey(value) {
   }
   return key;
 }
-function closeSessionResources({ wallet, chatPrivateKey, localCache } = {}) {
+function closeSessionResources({ wallet, chatPrivateKey, localCache, vaultAccess, vaultSigner } = {}) {
+  try {
+    vaultAccess?.close?.();
+  } catch {}
+  try {
+    vaultSigner?.close?.();
+  } catch {}
   try {
     localCache?.close?.();
   } catch {}
@@ -63086,6 +63324,8 @@ function createAccountSession(resources = {}) {
       session.wallet = null;
       session.chatPrivateKey = null;
       session.localCache = null;
+      session.vaultAccess = null;
+      session.vaultSigner = null;
     }
   };
   return session;
@@ -63093,7 +63333,7 @@ function createAccountSession(resources = {}) {
 function closeAccountSession(session) {
   session?.close?.();
 }
-async function openAccountSessionFromSecrets(walletEntropy, chatSeed, { SparkWallet, network, accountNumber } = {}) {
+async function openAccountSessionFromSecrets(walletEntropy, chatSeed, masterSeed, { SparkWallet, network, accountNumber, cloud, uid } = {}) {
   if (!SparkWallet) {
     throw new Error("SparkWallet missing");
   }
@@ -63104,6 +63344,8 @@ async function openAccountSessionFromSecrets(walletEntropy, chatSeed, { SparkWal
   let wallet = null;
   let chatPrivateKey = null;
   let chatPubKey = null;
+  let vaultSigner = null;
+  let vaultAccess = null;
   try {
     const result = await SparkWallet.initialize({
       mnemonicOrSeed: walletMnemonic,
@@ -63122,15 +63364,24 @@ async function openAccountSessionFromSecrets(walletEntropy, chatSeed, { SparkWal
     const chatKeyPair = getKeyPair(chatSeed);
     chatPrivateKey = chatKeyPair.priv;
     chatPubKey = chatKeyPair.pub;
+    vaultSigner = createVaultSigner(masterSeed);
+    if (cloud) {
+      if (!uid)
+        throw new Error("vault signature uid missing");
+      vaultAccess = await cloud.auth.vaultSignature.open(vaultSigner);
+    }
     return createAccountSession({
       wallet,
       walletPK,
       chatPK: toHex(chatPubKey),
       chatPrivateKey,
-      network
+      network,
+      vaultSigner,
+      vaultAccess,
+      vaultSigningPK: vaultSigner.publicKey
     });
   } catch (error) {
-    closeSessionResources({ wallet, chatPrivateKey });
+    closeSessionResources({ wallet, chatPrivateKey, vaultAccess, vaultSigner });
     throw error;
   } finally {
     cleanBytes(chatSeed, chatPubKey);
@@ -63141,7 +63392,7 @@ async function openRegistryAccountSession(masterSeed, registryEnvelope, options
   const walletEntropy = getDefaultWalletEntropy(registry);
   const chatSeed = getChatSeed(registry);
   try {
-    return await openAccountSessionFromSecrets(walletEntropy, chatSeed, options);
+    return await openAccountSessionFromSecrets(walletEntropy, chatSeed, masterSeed, options);
   } finally {
     cleanBytes(walletEntropy, chatSeed);
   }
@@ -87292,7 +87543,7 @@ var base642 = hasBase64Builtin2 ? {
   }
 } : chain2(radix22(6), alphabet2("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"), padding2(6), join2(""));
 var base64nopad2 = chain2(radix22(6), alphabet2("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"), join2(""));
-var base64url2 = hasBase64Builtin2 ? {
+var base64url3 = hasBase64Builtin2 ? {
   encode(b) {
     abytes6(b);
     return b.toBase64({ alphabet: "base64url" });
@@ -115540,7 +115791,7 @@ async function openOwnChatEntry(chatPrivKey, entryId, body) {
   try {
     const { nonce, ct } = unpackBodyData(body);
     const entry = await openJson(key, nonce, ct, entryAad(entryId));
-    if (entry?.v !== CHAT_ENTRY_VERSION || !entry?.linkId || !entry?.chatId || !entry?.peerChatPK) {
+    if (entry?.v !== CHAT_ENTRY_VERSION || !entry?.linkId || !entry?.chatId || !entry?.peerChatPK || !cleanText(entry?.peerUid)) {
       throw new Error("invalid chat entry");
     }
     const { actors, ...entryFields } = entry;
@@ -115554,12 +115805,16 @@ async function openOwnChatEntry(chatPrivKey, entryId, body) {
   }
 }
 function makeOwnChatEntry(pair, fields = {}) {
+  const peerUid = cleanText(fields.peerUid);
+  if (!peerUid) {
+    throw new Error("chat peer uid required");
+  }
   return {
     protocol: CHAT_PROTOCOL_VERSION,
     linkId: pair.linkId,
     chatId: pair.chatId,
     peerChatPK: pair.peerChatPK,
-    peerUid: cleanText(fields.peerUid),
+    peerUid,
     signingKeysByChatKey: {
       ...fields.signingKeysByChatKey || {},
       [pair.chatPK]: pair.signingKey.publicKey,
@@ -115583,72 +115838,6 @@ var SYSTEM_RETENTION_KIND = "retention";
 var DEFAULT_REACTION_EMOJI = "❤️";
 var HOLD_VISIBLE_KEY = "__holdVisible";
 
-// ../../shared/links.js
-var ROOT_DOMAIN = "glyphteck.com";
-var domains = Object.freeze({
-  root: ROOT_DOMAIN,
-  rootDev: `dev.${ROOT_DOMAIN}`,
-  veyl: `veyl.${ROOT_DOMAIN}`,
-  veylTest: `test.veyl.${ROOT_DOMAIN}`,
-  veylDev: `dev.veyl.${ROOT_DOMAIN}`
-});
-var origins = Object.freeze({
-  root: `https://${domains.root}`,
-  rootDev: `https://${domains.rootDev}`,
-  rootDevWeb: `https://${domains.rootDev}:3001`,
-  veyl: `https://${domains.veyl}`,
-  veylTest: `https://${domains.veylTest}`,
-  veylDev: `https://${domains.veylDev}`,
-  veylDevWeb: `https://${domains.veylDev}:3000`
-});
-var links = Object.freeze({
-  root: origins.root,
-  rootDev: origins.rootDev,
-  rootDevWeb: origins.rootDevWeb,
-  veyl: origins.veyl,
-  veylTest: origins.veylTest,
-  veylDev: origins.veylDev,
-  veylDevWeb: origins.veylDevWeb,
-  contact: `mailto:contact@${ROOT_DOMAIN}`,
-  regtestFaucet: "https://app.lightspark.com/regtest-faucet"
-});
-var localHosts = Object.freeze([
-  domains.rootDev,
-  domains.veylDev
-]);
-var appDomains = Object.freeze([
-  domains.veyl,
-  domains.veylTest
-]);
-var appLinkDomains = Object.freeze([
-  domains.veyl,
-  domains.veylTest,
-  domains.veylDev
-]);
-var allowedPasskeyOrigins = Object.freeze([
-  origins.root,
-  origins.rootDev,
-  origins.rootDevWeb,
-  origins.veylDev,
-  origins.veylDevWeb,
-  origins.veylTest,
-  origins.veyl
-]);
-var storageCorsOrigins = Object.freeze([
-  origins.rootDevWeb,
-  origins.veylDev,
-  origins.veylDevWeb,
-  origins.veyl,
-  origins.veylTest
-]);
-var webApps = Object.freeze({
-  veyl: Object.freeze({
-    domain: domains.veylDev,
-    origin: origins.veylDevWeb,
-    port: "3000"
-  })
-});
-
 // ../../shared/chat/messages/text.js
 var DOMAIN_LABEL_PATTERN = "[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?";
 var DOMAIN_TLD_PATTERN = "(?:[a-z]{2,63}|xn--[a-z0-9-]{2,59})";
@@ -116309,6 +116498,15 @@ function getDisplayMessages(messages, selfChatPublicKey, peerChatPublicKey, opti
 }
 
 // ../../shared/chat/messages/compose.js
+var REQUEST_NETWORKS = new Set([MAINNET_NETWORK, REGTEST_NETWORK]);
+function requestNetwork(message) {
+  const network = String(message?.network ?? "").trim().toUpperCase();
+  return REQUEST_NETWORKS.has(network) ? network : null;
+}
+function isRequestOnNetwork(message, network) {
+  const request = requestNetwork(message);
+  return request !== null && request === String(network ?? "").trim().toUpperCase();
+}
 function setReply(msg, replyId) {
   const nextReplyId = String(replyId ?? "").trim();
   if (!nextReplyId) {
@@ -116319,12 +116517,16 @@ function setReply(msg, replyId) {
     r: nextReplyId
   };
 }
-function makeReq(amount) {
+function makeReq(amount, network) {
   const a = String(amount ?? "").trim();
   if (!a) {
     throw new Error("amount required");
   }
-  return { t: "req", a };
+  const request = requestNetwork({ network });
+  if (!request) {
+    throw new Error("wallet network required");
+  }
+  return { t: "req", a, network: request };
 }
 function setReqTx(msg, tx) {
   const a = String(msg?.a ?? "").trim();
@@ -116332,6 +116534,10 @@ function setReqTx(msg, tx) {
   if (!a || !nextTx) {
     throw new Error("request and tx required");
   }
+  const network = requestNetwork(msg);
+  if (!network) {
+    throw new Error("request wallet network missing");
+  }
   return {
     ...typeof msg?.s === "string" && msg.s ? { s: msg.s } : {},
     ...typeof msg?.cid === "string" && msg.cid ? { cid: msg.cid } : {},
@@ -116339,6 +116545,7 @@ function setReqTx(msg, tx) {
     ...retentionPatch(msg),
     t: "req",
     a,
+    network,
     tx: nextTx
   };
 }
@@ -116755,7 +116962,7 @@ function hasPositiveTimestamp(value) {
   return timestampMs(value, null, { positive: true }) != null;
 }
 function isCurrentChatCacheEntry(chat) {
-  return !!chat && isHex64(chat.id) && isHex64(chat.linkId) && isHex32(chat.entryId) && isHex64(chat.peerChatPK) && hasPositiveTimestamp(chat.ts);
+  return !!chat && isHex64(chat.id) && isHex64(chat.linkId) && isHex32(chat.entryId) && isHex64(chat.peerChatPK) && !!cleanText(chat.peerUid) && hasPositiveTimestamp(chat.ts);
 }
 function isCurrentUserChatEntry(chat) {
   return isCurrentChatCacheEntry(chat);
@@ -117892,6 +118099,7 @@ function simplifyAccountTransfer(tx) {
 }
 
 // ../../shared/account/actions/chat.js
+var DELETE_ALL_CHATS_BATCH_SIZE = 400;
 function createChatActions({ readCloud, readSession, inbox, peers }) {
   function writeOptions(active, chat, options = {}) {
     return {
@@ -118162,6 +118370,19 @@ function createChatActions({ readCloud, readSession, inbox, peers }) {
       deleted: true
     };
   }
+  async function deleteAll() {
+    const active = await readSession();
+    const chats = await inbox.drain(active);
+    const targets = chats.map((chat) => ({
+      chatId: chat.id,
+      entryId: chat.entryId || ownChatEntryId(active.chatPrivateKey, chat.id),
+      ...chat.linkId ? { linkId: chat.linkId } : {}
+    }));
+    for (let index = 0;index < targets.length; index += DELETE_ALL_CHATS_BATCH_SIZE) {
+      await readCloud().chat.delete(targets.slice(index, index + DELETE_ALL_CHATS_BATCH_SIZE), { cleanup: false });
+    }
+    return targets.length;
+  }
   async function retention(peer, value, options = {}) {
     const active = await readSession();
     const chat = await chatForPeer(peer, options);
@@ -118193,6 +118414,7 @@ function createChatActions({ readCloud, readSession, inbox, peers }) {
     unsave,
     deleteMessage,
     deleteChat,
+    deleteAll,
     retention
   };
 }
@@ -118215,7 +118437,14 @@ function createInboxSync({ readCloud }) {
     }
     return { chats: current, processed };
   }
-  return { load, sync };
+  async function drain(active, chats = null) {
+    let current = Array.isArray(chats) ? chats : await load(active, 50);
+    while (await processInbox(readCloud(), active.uid, active.chatPK, active.chatPrivateKey, { currentChats: current })) {
+      current = await load(active, Math.max(current.length, 50));
+    }
+    return current;
+  }
+  return { drain, load, sync };
 }
 
 // ../../shared/navigation/params.js
@@ -118492,14 +118721,9 @@ async function claimIncomingTransfersById(wallet, transfers = [], { onClaimed, e
         markDone(diag, "wallet.pendingTxs.claim.sdk", claimStartedAt, { count: ids.length, mode: "all", claimed: claimedIds2.length });
       } catch (error) {
         markError(diag, "wallet.pendingTxs.claim.sdk", claimStartedAt, error, { count: ids.length, mode: "all" });
-        console.debug?.("could not claim pending transfers", error?.message ?? error);
-      }
-      try {
-        const pendingIds2 = await queryPendingTransferIds(wallet, ids, diag);
-        claimedIds2.push(...ids.filter((id) => !pendingIds2.has(id)));
-      } catch (error) {
-        console.debug?.("could not verify pending transfers", error?.message ?? error);
       }
+      const pendingIds2 = await queryPendingTransferIds(wallet, ids, diag).catch(() => new Set);
+      claimedIds2.push(...ids.filter((id) => !pendingIds2.has(id)));
       const uniqueClaimedIds = [...new Set(claimedIds2)];
       if (uniqueClaimedIds.length) {
         onClaimed?.(uniqueClaimedIds);
@@ -118542,7 +118766,6 @@ async function claimIncomingTransfersById(wallet, transfers = [], { onClaimed, e
         }
       } catch (error) {
         markError(diag, "wallet.pendingTxs.claim.sdk", claimStartedAt, error, { count: 1 });
-        console.debug?.("could not claim pending transfer", error?.message ?? error);
       }
       await yieldToUi();
     }
@@ -118587,33 +118810,6 @@ async function claimPendingIncomingTransfers(wallet, { limit = WALLET_PENDING_TR
   });
 }
 
-// ../../shared/network.js
-var DEFAULT_NETWORK = "REGTEST";
-var MAINNET_NETWORK = "MAINNET";
-var REGTEST_NETWORK = "REGTEST";
-var MAINNET_DOMAIN = domains.veyl;
-var REGTEST_DOMAIN = domains.veylTest;
-function resolveNetwork(env = {}) {
-  const raw = env?.EXPO_PUBLIC_NETWORK ?? env?.NEXT_PUBLIC_NETWORK ?? env?.VEYL_NETWORK ?? env?.NETWORK ?? DEFAULT_NETWORK;
-  return String(raw).toUpperCase();
-}
-function getAddressNetwork(address) {
-  const a = String(address ?? "").trim();
-  if (!a)
-    return null;
-  if (/^bcrt1[ac-hj-np-z02-9]{39,87}$/i.test(a))
-    return REGTEST_NETWORK;
-  if (/^bc1[ac-hj-np-z02-9]{39,87}$/i.test(a))
-    return MAINNET_NETWORK;
-  if (/^[13][a-km-zA-HJ-NP-Z1-9]{25,34}$/.test(a))
-    return MAINNET_NETWORK;
-  return null;
-}
-function isAddressOnNetwork(address, network) {
-  const detected = getAddressNetwork(address);
-  return detected !== null && detected === String(network ?? "").toUpperCase();
-}
-
 // ../../shared/wallet/deposits.js
 var AUTO_CLAIM_MAX_FEE_SATS = WALLET_AUTO_CLAIM_MAX_FEE_SATS;
 var CLAIM_PAGE_SIZE = WALLET_CLAIM_PAGE_SIZE;
@@ -118708,9 +118904,7 @@ async function claimStaticDeposits(wallet, { getFundingAddress, maxFeeSats = AUT
       if (claim) {
         claimed = true;
       }
-    } catch (error) {
-      console.debug?.("could not claim deposit", key, error?.message ?? error);
-    }
+    } catch {}
   }
   return claimed;
 }
@@ -119440,7 +119634,8 @@ function createMoneyActions({ readCloud, readSession, resolvePeer, sendPayload }
     };
   }
   async function request(peer, sats, options = {}) {
-    return sendPayload(peer, makeReq(String(cleanPositiveSats(sats))), options);
+    const active = await readSession();
+    return sendPayload(peer, makeReq(String(cleanPositiveSats(sats)), active.network), options);
   }
   async function pay(requestId, options = {}) {
     const active = await readSession();
@@ -119463,6 +119658,9 @@ function createMoneyActions({ readCloud, readSession, resolvePeer, sendPayload }
     if (!isPeerMsg(message, active.chatPK)) {
       throw new Error("cannot pay your own request");
     }
+    if (!isRequestOnNetwork(message, active.network)) {
+      throw new Error(`switch wallet network to ${requestNetwork(message)?.toLowerCase() || "the request network"} before paying`);
+    }
     const amountSats = cleanPositiveSats(message.a);
     const profile = await resolvePeer(message.from || message.s || chat.peerChatPK);
     if (!profile.walletPK) {
@@ -151934,9 +152132,6 @@ function avatarUrlWithVersion(url, version8) {
 // ../../shared/community.js
 var COMMUNITY_RULES_VERSION = "2026-05-11.1";
 var COMMUNITY_RULES_DATE = "2026-05-11";
-function hasCurrentCommunityRules(user) {
-  return user?.communityRulesVersion === COMMUNITY_RULES_VERSION && !!user?.communityRulesAcceptedAt;
-}
 var COMMUNITY_SECTIONS = [
   {
     title: "Use veyl directly and lawfully",
@@ -152031,6 +152226,15 @@ function requireUid(uid) {
 function recordFromDoc(snap) {
   return snap?.exists?.() ? { ...snap.data(), id: snap.id } : null;
 }
+function authSessionGeneration(value) {
+  const generation = Number(value);
+  return Number.isSafeInteger(generation) && generation > 0 ? generation : null;
+}
+function vaultSignatureError(code, message) {
+  const error = new Error(message);
+  error.code = `vault-signature/${code}`;
+  return error;
+}
 function recordsFromSnapshot(snapshot) {
   return snapshot.docs.map(recordFromDoc).filter(Boolean);
 }
@@ -152107,6 +152311,10 @@ function createFirebaseCloud({ db, auth: auth2, getAuth: getAuth2, functions: fu
   if (!db) {
     throw new Error("createFirebaseCloud requires db");
   }
+  let activeVaultSigner = null;
+  let vaultLeaseExpiresAt = 0;
+  let vaultLeaseRequest = null;
+  let vaultOpenRequest = null;
   function pageTs(value) {
     if (value instanceof Timestamp2) {
       return value;
@@ -152263,34 +152471,179 @@ function createFirebaseCloud({ db, auth: auth2, getAuth: getAuth2, functions: fu
   function watchAuth(onUpdate, onError) {
     return onAuthStateChanged(requireAuth(), onUpdate, onError);
   }
+  function watchAuthSession(uid, onUpdate, onError) {
+    requireUid(uid);
+    const user = requireAuth().currentUser;
+    let active = true;
+    let unsubscribe = () => {};
+    if (!user || user.uid !== uid) {
+      Promise.resolve().then(() => {
+        if (active)
+          onUpdate?.({ active: false, generation: null, currentGeneration: null });
+      });
+      return () => {
+        active = false;
+      };
+    }
+    user.getIdTokenResult().then((result) => {
+      if (!active)
+        return;
+      const generation = authSessionGeneration(result?.claims?.sessionGeneration);
+      if (!generation) {
+        onUpdate?.({ active: false, generation: null, currentGeneration: null });
+        return;
+      }
+      unsubscribe = onSnapshot(doc(db, "auth_sessions", uid), (snap) => {
+        if (!active)
+          return;
+        const currentGeneration = authSessionGeneration(snap.data()?.generation);
+        onUpdate?.({
+          active: currentGeneration === generation,
+          generation,
+          currentGeneration
+        });
+      }, (error) => {
+        if (active)
+          onError?.(error);
+      });
+    }).catch((error) => {
+      if (active)
+        onError?.(error);
+    });
+    return () => {
+      active = false;
+      unsubscribe();
+    };
+  }
   async function logout() {
     await signOut(requireAuth());
     return true;
   }
   async function logoutDevices() {
-    await callFunction("logoutDevices");
+    await callVaultFunction("logoutDevices", VAULT_SIGNATURE_PURPOSES.LOGOUT_ALL_DEVICES);
     return true;
   }
-  async function readOnboarding(uid) {
-    requireUid(uid);
-    const [profileDoc, seedDoc, userDoc] = await Promise.all([
-      getDoc(doc(db, "profiles", uid)),
-      getDoc(doc(db, "seeds", uid)),
-      getDoc(doc(db, "users", uid))
-    ]);
-    const profile = profileDoc.exists() ? profileDoc.data() : null;
-    const user = userDoc.exists() ? userDoc.data() : null;
+  async function clientSessionClaims() {
+    const user = requireAuth().currentUser;
+    if (!user?.uid) {
+      throw new Error("signed in user required");
+    }
+    const token = await user.getIdTokenResult();
+    const sessionGeneration = authSessionGeneration(token?.claims?.sessionGeneration);
+    const clientSessionId = token?.claims?.clientSessionId;
+    if (!sessionGeneration || typeof clientSessionId !== "string" || !clientSessionId) {
+      throw new Error("invalid client session");
+    }
     return {
-      uid,
-      hasUsername: !!profile?.username,
-      hasAvatarEntry: !!profile && Object.prototype.hasOwnProperty.call(profile, "avatar"),
-      hasVault: seedDoc.exists(),
-      communityRulesVersion: user?.communityRulesVersion || null,
-      communityRulesDate: user?.communityRulesDate || null,
-      communityRulesAcceptedAt: user?.communityRulesAcceptedAt || null,
-      hasCurrentCommunityRules: hasCurrentCommunityRules(user)
+      uid: user.uid,
+      sessionGeneration,
+      clientSessionId
+    };
+  }
+  function vaultSignatureClaims() {
+    return clientSessionClaims();
+  }
+  async function signVaultRequest(purpose, payload = null, signer = activeVaultSigner) {
+    if (!signer) {
+      throw vaultSignatureError("locked", "unlocked vault required");
+    }
+    try {
+      return createVaultSignature(signer, await vaultSignatureClaims(), purpose, payload);
+    } catch (error) {
+      if (!error?.code) {
+        error.code = "vault-signature/proof-construction";
+      }
+      throw error;
+    }
+  }
+  async function grantVaultLease(signer = activeVaultSigner, force = false) {
+    if (!signer || signer !== activeVaultSigner) {
+      throw new Error("unlocked vault required");
+    }
+    if (!force && vaultLeaseExpiresAt - Date.now() > 15000) {
+      return { expiresAt: vaultLeaseExpiresAt };
+    }
+    if (vaultLeaseRequest?.signer === signer) {
+      return vaultLeaseRequest.promise;
+    }
+    const promise = (async () => {
+      const result = await callFunction("grantVaultLease", {
+        vaultSignature: await signVaultRequest(VAULT_LEASE_PURPOSE, null, signer)
+      });
+      if (signer !== activeVaultSigner) {
+        throw new Error("vault locked during authorization");
+      }
+      const expiresAt = Number(result?.expiresAt);
+      if (!Number.isFinite(expiresAt) || expiresAt <= Date.now()) {
+        throw new Error("invalid vault lease");
+      }
+      vaultLeaseExpiresAt = expiresAt;
+      return { expiresAt };
+    })().finally(() => {
+      if (vaultLeaseRequest?.promise === promise) {
+        vaultLeaseRequest = null;
+      }
+    });
+    vaultLeaseRequest = { signer, promise };
+    return promise;
+  }
+  async function openVaultSignature(signer) {
+    if (!signer?.publicKey || typeof signer?.sign !== "function") {
+      throw vaultSignatureError("invalid-signer", "vault signer required");
+    }
+    if (activeVaultSigner?.closed) {
+      activeVaultSigner = null;
+      vaultLeaseExpiresAt = 0;
+      vaultLeaseRequest = null;
+      vaultOpenRequest = null;
+    }
+    if (activeVaultSigner && activeVaultSigner !== signer) {
+      throw vaultSignatureError("already-open", "vault signature already open");
+    }
+    activeVaultSigner = signer;
+    const openPromise = grantVaultLease(signer, true);
+    vaultOpenRequest = { signer, promise: openPromise };
+    try {
+      await openPromise;
+    } catch (error) {
+      if (activeVaultSigner === signer) {
+        activeVaultSigner = null;
+        vaultLeaseExpiresAt = 0;
+      }
+      throw error;
+    } finally {
+      if (vaultOpenRequest?.promise === openPromise) {
+        vaultOpenRequest = null;
+      }
+    }
+    let closed = false;
+    return {
+      close() {
+        if (closed)
+          return;
+        closed = true;
+        if (activeVaultSigner !== signer)
+          return;
+        activeVaultSigner = null;
+        vaultLeaseExpiresAt = 0;
+        callFunction("dropVaultLease").catch(() => {});
+      }
     };
   }
+  async function callVaultFunction(name7, purpose, payload = null) {
+    const signer = activeVaultSigner;
+    if (!signer)
+      throw new Error("unlocked vault required");
+    if (vaultOpenRequest?.signer === signer) {
+      await vaultOpenRequest.promise;
+    }
+    if (signer !== activeVaultSigner) {
+      throw vaultSignatureError("locked", "unlocked vault required");
+    }
+    return callFunction(name7, {
+      vaultSignature: await signVaultRequest(purpose, payload, signer)
+    });
+  }
   async function isAdmin(uid) {
     if (!uid)
       return false;
@@ -152313,27 +152666,18 @@ function createFirebaseCloud({ db, auth: auth2, getAuth: getAuth2, functions: fu
     const snap = await getDoc(doc(db, "seeds", uid));
     return snap.exists();
   }
-  async function writeVault(uid, vault) {
+  async function writeVault(uid, vault, { vaultSigningPK } = {}) {
     requireUid(uid);
-    if (!vault) {
-      throw new Error("vault required");
+    if (!vault || !vaultSigningPK) {
+      throw new Error("vault enrollment required");
     }
-    await setDoc(doc(db, "seeds", uid), { es: writeCloudBytes(vault, "vault bytes") });
-    return true;
-  }
-  async function replaceVault(uid, { vault, expectedHash, from, to, walletPK, chatPK, network } = {}) {
-    requireUid(uid);
-    if (!vault || !expectedHash || !from || !to) {
-      throw new Error("vault replacement required");
+    const user = requireAuth().currentUser;
+    if (user?.uid !== uid) {
+      throw new Error("vault account mismatch");
     }
-    await callFunction("replaceVault", {
-      expectedHash,
-      from,
-      to,
+    await callFunction("createVault", {
       vault: cloudBytesBase64(vault, "vault bytes"),
-      walletPK: walletPK || null,
-      chatPK: chatPK || null,
-      network: network || null
+      vaultSigningPK
     });
     return true;
   }
@@ -152378,13 +152722,13 @@ function createFirebaseCloud({ db, auth: auth2, getAuth: getAuth2, functions: fu
   async function writeProfileWalletPK(walletPK, { network } = {}) {
     if (!walletPK)
       throw new Error("wallet public key required");
-    await callFunction("setWalletPK", { walletPK, network });
+    await callVaultFunction("setWalletPK", VAULT_SIGNATURE_PURPOSES.SET_WALLET_IDENTITY, { walletPK, network });
     return true;
   }
   async function writeProfileChatPK(chatPK) {
     if (!chatPK)
       throw new Error("chat public key required");
-    await callFunction("setChatPK", { chatPK });
+    await callVaultFunction("setChatPK", VAULT_SIGNATURE_PURPOSES.SET_CHAT_IDENTITY, { chatPK });
     return true;
   }
   async function getUsername(username) {
@@ -152395,7 +152739,7 @@ function createFirebaseCloud({ db, auth: auth2, getAuth: getAuth2, functions: fu
     return true;
   }
   async function deleteUser2() {
-    await callFunction("deleteAccount");
+    await callVaultFunction("deleteAccount", VAULT_SIGNATURE_PURPOSES.DELETE_ACCOUNT);
     return true;
   }
   function watchProfile(uid, onUpdate, onError) {
@@ -152435,6 +152779,7 @@ function createFirebaseCloud({ db, auth: auth2, getAuth: getAuth2, functions: fu
       return openSettings(key, uid, readCloudBytes(saved, "settings body"));
     }
     const settings = normalizeSettings(defaultSettings);
+    await grantVaultLease(activeVaultSigner);
     await setDoc(doc(db, "users", uid), {
       settings: writeCloudBytes(await sealSettings(key, uid, settings), "settings body")
     }, { merge: true });
@@ -152448,6 +152793,7 @@ function createFirebaseCloud({ db, auth: auth2, getAuth: getAuth2, functions: fu
     const base = currentSettings || await readSettings(uid, key);
     const nextSettings = normalizeSettings(settings, base);
     const body = await sealSettings(key, uid, nextSettings);
+    await grantVaultLease(activeVaultSigner);
     await setDoc(doc(db, "users", uid), {
       settings: writeCloudBytes(body, "settings body")
     }, { merge: true });
@@ -152492,9 +152838,12 @@ function createFirebaseCloud({ db, auth: auth2, getAuth: getAuth2, functions: fu
   }
   function watchBlocked(uid, onUpdate, onError) {
     requireUid(uid);
-    return onSnapshot(collection(db, "users", uid, "blocked"), (snap) => {
+    return onSnapshot(collection(db, "users", uid, "blocked"), { includeMetadataChanges: true }, (snap) => {
       const blocked = snap.docs.map((item) => item.id).filter(Boolean).sort();
-      onUpdate?.(blocked);
+      onUpdate?.(blocked, {
+        fromCache: snap.metadata.fromCache,
+        pending: snap.metadata.hasPendingWrites
+      });
     }, onError);
   }
   function watchBitcoin(onUpdate, onError) {
@@ -152766,6 +153115,15 @@ function createFirebaseCloud({ db, auth: auth2, getAuth: getAuth2, functions: fu
       return resolveAuth()?.currentUser ?? null;
     },
     watch: watchAuth,
+    session: {
+      watch: watchAuthSession
+    },
+    vaultSignature: {
+      open: openVaultSignature,
+      ensure: () => grantVaultLease(activeVaultSigner),
+      sign: signVaultRequest,
+      call: callVaultFunction
+    },
     logout,
     logoutDevices,
     login: {
@@ -153275,10 +153633,8 @@ function createFirebaseCloud({ db, auth: auth2, getAuth: getAuth2, functions: fu
         read: readVault,
         exists: vaultExists,
         write: writeVault,
-        replace: replaceVault,
         watch: watchVault
       },
-      onboarding: readOnboarding,
       community: {
         accept: acceptCommunity
       },
@@ -154880,7 +155236,7 @@ async function runPasskeyBrowserFlow(options2 = {}) {
 }
 
 // src/storage.js
-import { access, chmod, mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { access, chmod, mkdir, readFile, rename, unlink as unlink2, writeFile } from "node:fs/promises";
 import { randomUUID } from "node:crypto";
 import { homedir } from "node:os";
 import { dirname as dirname2, join as join3 } from "node:path";
@@ -154977,6 +155333,22 @@ class ProfileStore {
     await this.writeActiveProfile(profileName);
     return next;
   }
+  async remove(profileName = "") {
+    const profile = cleanProfileName(profileName || this.profile || await this.readActiveProfile(), "");
+    if (!profile)
+      return false;
+    await unlink2(this.profilePath(profile)).catch((error) => {
+      if (error?.code !== "ENOENT")
+        throw error;
+    });
+    if (await this.readActiveProfile() === profile) {
+      await unlink2(this.activePath()).catch((error) => {
+        if (error?.code !== "ENOENT")
+          throw error;
+      });
+    }
+    return true;
+  }
 }
 
 // src/mcp.js
@@ -154985,10 +155357,15 @@ import process4 from "node:process";
 // package.json
 var package_default = {
   name: "@glyphteck/veyl",
-  version: "0.4.1",
+  version: "0.5.0",
   license: "Apache-2.0",
   type: "module",
   description: "Programmable Node.js client for Veyl accounts, vaults, chat, and wallet payments.",
+  repository: {
+    type: "git",
+    url: "https://github.com/glyphteck/veyl.git",
+    directory: "clients/headless"
+  },
   exports: {
     ".": "./dist/index.js"
   },
@@ -155099,6 +155476,7 @@ var HEADLESS_COMMANDS = Object.freeze([
     invokeCli: (client2, input, context) => context.options.passkey ? client2.account.loginPasskey(input) : client2.account.login({ username: input.username })
   }),
   command({ name: "account_me", group: "account", apiNames: ["me"], description: "Show the current local account.", paths: [["me"], ["account", "me"]], shortUsage: "me", structuredUsage: "account me", cliInput: optionsOnly, invoke: (client2) => client2.account.me() }),
+  command({ name: "account_delete", group: "account", apiNames: ["delete"], description: "Delete the unlocked account, its known chats, and its local profile.", properties: { confirm: booleanProp }, required: ["confirm"], paths: [["account", "delete"]], structuredUsage: "account delete --confirm", cliInput: optionsOnly, invoke: (client2, input) => client2.account.delete(input) }),
   command({ name: "vault_create", group: "vault", apiNames: ["create"], description: "Create and upload the local encrypted vault.", properties: { secret: stringProp, saveSecret: booleanProp }, paths: [["vault", "create"]], structuredUsage: "vault create", cliInput: vaultInput, invoke: (client2, input) => client2.vault.create(input) }),
   command({ name: "vault_unlock", group: "vault", apiNames: ["unlock"], description: "Unlock the local vault.", properties: { secret: stringProp }, paths: [["unlock"], ["vault", "unlock"]], shortUsage: "unlock", structuredUsage: "vault unlock [--secret value]", cliInput: vaultInput, invoke: (client2, input) => client2.vault.unlock(input) }),
   command({ name: "vault_lock", group: "vault", apiNames: ["lock"], description: "Lock the wallet and chat session.", paths: [["lock"], ["vault", "lock"]], shortUsage: "lock", structuredUsage: "vault lock", cliInput: optionsOnly, invoke: (client2) => client2.vault.lock() }),
@@ -155320,7 +155698,8 @@ class VeylHeadlessClient {
       createPasskey: (payload) => this.createPasskeyAccount(payload),
       login: (payload) => this.loginAccount(payload),
       loginPasskey: (payload) => this.loginPasskeyAccount(payload),
-      me: () => this.me()
+      me: () => this.me(),
+      delete: (payload) => this.deleteAccount(payload)
     };
     this.vault = {
       create: (payload) => this.createVault(payload),
@@ -155565,6 +155944,20 @@ class VeylHeadlessClient {
     this.profile = profile;
     return this.accountSummary(profile);
   }
+  async deleteAccount(options2 = {}) {
+    if (options2.confirm !== true) {
+      throw new Error("account deletion requires confirm: true");
+    }
+    await this.ensureUnlocked();
+    const profileName = this.profile?.profile || "";
+    const chats = await this.actions.chat.deleteAll();
+    await this.cloud.user.delete();
+    await this.lockVault();
+    await signOutHeadless(this.auth).catch(() => {});
+    await this.store.remove(profileName);
+    this.profile = null;
+    return { deleted: true, chats };
+  }
   async ensureAuth() {
     const profile = await this.loadProfile();
     if (this.auth?.currentUser?.uid === profile.uid) {
@@ -155580,7 +155973,9 @@ class VeylHeadlessClient {
   async bootSession(masterSeed, registry, profile) {
     const opened = await openRegistryAccountSession(masterSeed, registry, {
       SparkWallet: SparkWalletNodeJS,
-      network: profile.network || this.network
+      network: profile.network || this.network,
+      cloud: this.cloud,
+      uid: profile.uid
     });
     this.session = Object.assign(opened, {
       uid: profile.uid,
@@ -155593,7 +155988,7 @@ class VeylHeadlessClient {
   }
   async createVault(options2 = {}) {
     const profile = await this.ensureAuth();
-    if (options2.overwrite !== true && await this.cloud.user.vault.exists(profile.uid)) {
+    if (await this.cloud.user.vault.exists(profile.uid)) {
       throw new Error("vault already exists");
     }
     const vaultSecret = String(options2.secret || process5.env.VEYL_VAULT_SECRET || randomSecret()).trim();
@@ -155607,9 +156002,9 @@ class VeylHeadlessClient {
         deriveKey: deriveVaultKey,
         registry: registrySource
       });
-      const session = await this.bootSession(masterSeed, encrypted.registry, profile);
       const vault = packSeedData(encrypted);
-      await this.cloud.user.vault.write(profile.uid, vault);
+      await this.cloud.user.vault.write(profile.uid, vault, { vaultSigningPK: encrypted.vaultSigningPK });
+      const session = await this.bootSession(masterSeed, encrypted.registry, profile);
       await this.cloud.user.profile.walletpk.write(session.walletPK, { network: profile.network || this.network });
       await this.cloud.user.profile.chatpk.write(session.chatPK);
       await this.cloud.user.community.accept(profile.uid).catch(() => {});