@glyphteck/veyl 0.50.0 → 0.51.0

package/dist/cli.js

@@ -236,7 +236,7 @@ function randomBytes(bytesLength = 32) {
     throw new RangeError(`"bytesLength" expected <= 65536, got ${bytesLength}`);
   return cr.getRandomValues(new Uint8Array(bytesLength));
 }
-var isLE, swap8IfBE, swap32IfBE, hasHexBuiltin, hexes, asciis, nextTick = async () => {}, oidNist = (suffix) => ({
+var isLE, swap8IfBE, swap32IfBE, hasHexBuiltin, hexes, asciis, oidNist = (suffix) => ({
   oid: Uint8Array.from([6, 9, 96, 134, 72, 1, 101, 3, 4, 2, suffix])
 });
 var init_utils = __esm(() => {
@@ -8447,6 +8447,7 @@ async function openVaultAccountSession(vault, password, options = {}) {
     onSettingsUnlocked,
     onSeedDecrypted,
     onStage,
+    masterSeed: suppliedMasterSeed = null,
     isCurrent = () => true,
     diag = null
   } = options;
@@ -8513,10 +8514,17 @@ async function openVaultAccountSession(vault, password, options = {}) {
     onStage?.("decrypting");
     const decryptStartedAt = Date.now();
     mark(diag, "vault.unlock.decrypt.start", { source });
-    try {
-      masterSeed = await decryptSeed2(ct, salt, iv, normalizePassword(password), kdf);
-    } catch (error) {
-      throw vaultPasswordError(error);
+    if (suppliedMasterSeed) {
+      if (!(suppliedMasterSeed instanceof Uint8Array) || suppliedMasterSeed.length !== 32) {
+        throw new Error("vault master seed required");
+      }
+      masterSeed = suppliedMasterSeed.slice();
+    } else {
+      try {
+        masterSeed = await decryptSeed2(ct, salt, iv, normalizePassword(password), kdf);
+      } catch (error) {
+        throw vaultPasswordError(error);
+      }
     }
     mark(diag, "vault.unlock.decrypt.done", { elapsedMs: Date.now() - decryptStartedAt, source });
     onStage?.("seed-decrypted");
@@ -14550,6 +14558,16 @@ function createChatDelete({
     }
     return [...byId.values()];
   };
+  const revokeTargetDeliveries = async (targets) => {
+    const capabilities = targets.filter((target) => target.deliveryRegistered && target.linkId && target.peerChatPK && chatPK && notificationPrivateKey).map((target) => deriveInboundDeliveryCapability(notificationPrivateKey, {
+      linkId: target.linkId,
+      chatId: target.chatId,
+      selfChatPK: chatPK,
+      peerChatPK: target.peerChatPK
+    }));
+    await Promise.all(capabilities.map((capability) => cloud.delivery.revoke(capability)));
+    return capabilities.length;
+  };
   const deleteChat = async (chat, options = {}) => {
     const targets = getDeleteTargets(chat);
     if (!targets.length)
@@ -14563,13 +14581,8 @@ function createChatDelete({
     try {
       hideDeletingChats(chatIds, options);
       try {
-        const capabilities = targets.filter((target) => target.deliveryRegistered && target.linkId && target.peerChatPK && chatPK && notificationPrivateKey).map((target) => deriveInboundDeliveryCapability(notificationPrivateKey, {
-          linkId: target.linkId,
-          chatId: target.chatId,
-          selfChatPK: chatPK,
-          peerChatPK: target.peerChatPK
-        }));
-        await Promise.all(capabilities.map((capability) => cloud.delivery.revoke(capability)));
+        await revokeTargetDeliveries(targets);
+        await options.onDeliveryRevoked?.();
         await cloud.chat.delete(targets, { cleanup: options.cleanup !== false });
         confirmDeletedChats(chatIds);
       } catch (error) {
@@ -22629,16 +22642,18 @@ function createChatSession({
   const dropChat = (...args) => deleteActions.dropChat(...args);
   const dropUnavailableChat = (...args) => deleteActions.dropUnavailableChat(...args);
   const deleteChat = (...args) => deleteActions.deleteChat(...args);
-  const retirePeerChat = async (peerChatPK) => {
+  const retirePeerChat = async (peerChatPK, options = {}) => {
     const sendOptions = sendOptionsForPeer(peerChatPK);
-    if (!sendOptions?.chatId)
+    if (!sendOptions?.chatId) {
+      await options.onDeliveryRevoked?.();
       return false;
+    }
     const chat = sendOptions.ownEntry || getChatEntry(sendOptions.chatId) || {
       id: sendOptions.chatId,
       linkId: sendOptions.linkId,
       peerChatPK
     };
-    return deleteChat(chat, { cleanup: false });
+    return deleteChat(chat, { ...options, cleanup: false });
   };
   const restoreDeletedChat = (...args) => deleteActions.restoreDeletedChat(...args);
   const wasChatDeletedLocally = (...args) => deleteActions.wasChatDeletedLocally(...args);
@@ -25079,11 +25094,13 @@ function getReportAttachmentMeta(msg) {
     mimeType: cleanText(msg?.m) || reportAttachmentMime(kind)
   };
 }
-function buildReportFields({ msg, note } = {}) {
+function buildReportFields({ msg, note, chatId } = {}) {
   const type = cleanText(msg?.t);
   const content = type === "txt" ? cleanText(msg?.c) : "";
   const cleanedNote = cleanText(note);
   const report = {};
+  const sourceChatId = cleanText(chatId);
+  const sourceMessageId = cleanText(msg?.cid) || cleanText(msg?.actionId) || cleanText(msg?.id);
   if (type) {
     report.type = type;
   }
@@ -25093,6 +25110,13 @@ function buildReportFields({ msg, note } = {}) {
   if (cleanedNote) {
     report.note = cleanedNote;
   }
+  if (type) {
+    if (!sourceChatId || !sourceMessageId) {
+      throw new Error("message report source required");
+    }
+    report.chatId = sourceChatId;
+    report.messageId = sourceMessageId;
+  }
   return report;
 }
 var init_report = () => {};
@@ -25191,7 +25215,7 @@ function openSupport({ cloud, getUid } = {}) {
       }
       await cloud.reports.submit({
         uid,
-        ...buildReportFields({ msg: message, note: options.note }),
+        ...buildReportFields({ msg: message, note: options.note, chatId: options.chatId }),
         ...path ? { path } : {}
       });
       return { submitted: true, attachmentIncluded: !!path };
@@ -31472,6 +31496,7 @@ function openAccount(options = {}) {
         },
         onSeedDecrypted: unlockOptions.onSeedDecrypted,
         onStage: (stage) => setStage(stage, unlockOptions.onStage),
+        masterSeed: unlockOptions.masterSeed,
         isCurrent,
         diag
       });
@@ -32495,6 +32520,9 @@ async function listenAccount(client, options = {}) {
   const processedWakeVersions = new Map;
   const wantedWakeVersions = new Map;
   let activeChatIds = new Set;
+  let chatSyncRequested = false;
+  let chatSyncEmit = false;
+  let chatSyncTask = Promise.resolve();
   let ready = false;
   let closed = false;
   function clearChatActivityTimer(chatId) {
@@ -32723,6 +32751,21 @@ async function listenAccount(client, options = {}) {
     }
     await Promise.all(chats.map((chat) => attachChat(chat, emitInitial)));
   }
+  function requestChatSync(emitInitial = ready) {
+    if (!includeChats || closed)
+      return chatSyncTask;
+    chatSyncRequested = true;
+    chatSyncEmit ||= emitInitial;
+    chatSyncTask = chatSyncTask.catch(() => {}).then(async () => {
+      while (chatSyncRequested && !closed) {
+        const emitChanges = chatSyncEmit;
+        chatSyncRequested = false;
+        chatSyncEmit = false;
+        await syncChats(emitChanges);
+      }
+    });
+    return chatSyncTask;
+  }
   function applyTransfers(emitChanges) {
     if (!includeTransactions)
       return;
@@ -32749,7 +32792,9 @@ async function listenAccount(client, options = {}) {
     applyTransfers(replay);
   };
   try {
-    await syncChats(replay);
+    if (includeChats) {
+      await client.runtimeChat.list({ count: 1 });
+    }
     if (stopped(options.signal))
       return;
     if (includeTransactions) {
@@ -32760,11 +32805,14 @@ async function listenAccount(client, options = {}) {
       unsubscribeWallet = runtime.wallet.subscribe(syncTransactionHistory);
       syncTransactionHistory();
     }
-    ready = true;
-    emit(event("ready", { account: compact2 ? compactAccount(account) : account }));
     unsubscribeChatList = includeChats ? runtime.chat.subscribe(() => {
-      syncChats(true).catch((error) => emit(event("error", { message: error?.message || String(error) })));
+      requestChatSync(true).catch((error) => emit(event("error", { message: error?.message || String(error) })));
     }) : () => {};
+    ready = true;
+    emit(event("ready", { account: compact2 ? compactAccount(account) : account }));
+    requestChatSync(replay).catch((error) => emit(event("error", {
+      message: error?.message || String(error)
+    })));
     if (!stopped(options.signal)) {
       await new Promise((resolve) => options.signal?.addEventListener?.("abort", resolve, { once: true }));
     }
@@ -33272,11 +33320,12 @@ function createRuntimeProductActions({
       if (peer.uid === user.uid)
         throw new Error("cannot block self");
       const chatSnapshot = runtime.chat.getSnapshot();
-      await user.blockPeer(peer);
       try {
-        await chatSnapshot.retirePeerChat(peer.chatPK);
+        await chatSnapshot.retirePeerChat(peer.chatPK, {
+          onDeliveryRevoked: () => user.blockPeer(peer)
+        });
       } catch (error) {
-        throw new Error(`user blocked, but chat cleanup failed: ${error?.message || error}`, { cause: error });
+        throw new Error(`block failed during private route retirement: ${error?.message || error}`, { cause: error });
       }
       runtime.peers.getSnapshot().dropPeer(peer);
       return { blocked: true, peer: publicPeer({ ...peer, blocked: true }) };
@@ -33340,9 +33389,11 @@ function createRuntimeProductActions({
         throw new Error("report target uid required");
       let message = null;
       let attachmentBytes2 = null;
+      let sourceChatId = "";
       if (options.messageId) {
         const target = await chat.messageForPeer(peer.chatPK, options.messageId, { count: 100 });
         message = target.message;
+        sourceChatId = target.chat.id;
         const attachment = getReportAttachmentMeta(message);
         if (attachment) {
           attachmentBytes2 = await target.runtime.chat.getSnapshot().readMessageFile(peer.chatPK, message);
@@ -33351,7 +33402,8 @@ function createRuntimeProductActions({
       const result = await supportOwner.report(peer.uid, {
         message,
         note: options.note,
-        attachmentBytes: attachmentBytes2
+        attachmentBytes: attachmentBytes2,
+        ...message ? { chatId: sourceChatId } : {}
       });
       return { ...result, peer: publicPeer(peer) };
     }
@@ -41108,7 +41160,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "veyl",
-    version: "0.50.0",
+    version: "0.51.0",
     private: true,
     license: "Apache-2.0",
     workspaces: {
@@ -41365,10 +41417,10 @@ class AccountRuntime {
     });
     this.runtimeMoney = createRuntimeMoneyActions({
       getRuntime: async () => {
-        await this.ensureUnlocked();
+        await this.ensureWalletReady();
         return this.runtime;
       },
-      getSession: () => this.ensureUnlocked(),
+      getSession: () => this.ensureWalletReady(),
       resolvePeer: (peer, resolveOptions) => this.resolvePeer(peer, resolveOptions),
       chat: this.runtimeChat
     });
@@ -41788,17 +41840,21 @@ class AccountRuntime {
     this.accountOwner.setNetwork(defaultNetwork);
     await this.ensureUserState();
     let opened;
+    let masterSeed = null;
     try {
+      masterSeed = await this.options.getVaultMasterSeed?.() || null;
       opened = await this.accountOwner.unlock(vaultSecret, {
         vault,
-        source: "sdk"
+        source: "sdk",
+        masterSeed
       });
-      await opened.walletReady;
       this.userSnapshot = this.userOwner.getSnapshot();
     } catch (error) {
       if (opened)
         this.accountOwner.lock();
       throw error;
+    } finally {
+      cleanBytes(masterSeed);
     }
     this.session = Object.assign(opened, {
       uid: profile.uid,
@@ -41810,6 +41866,23 @@ class AccountRuntime {
     this.startRuntimeOwners();
     return this.session;
   }
+  trackWalletIdentity(session) {
+    session.walletReady.then(async ({ walletPK }) => {
+      if (this.session !== session || session.closed)
+        return;
+      const profile = this.profileData;
+      if (!profile || profile.walletPK === walletPK)
+        return;
+      const next = await this.saveProfile({
+        ...profile,
+        network: session.network,
+        walletPK
+      });
+      if (this.session === session && !session.closed) {
+        session.account = this.accountSummary(next);
+      }
+    }).catch(() => {});
+  }
   async createVault(options = {}) {
     const profile = await this.ensureAuth();
     if (await this.cloud.user.vault.exists(profile.uid)) {
@@ -41834,6 +41907,7 @@ class AccountRuntime {
       vaultCreatedAt: Date.now()
     });
     this.session.account = this.accountSummary(next);
+    this.trackWalletIdentity(session);
     return {
       ...this.accountSummary(next),
       vaultSecret
@@ -41873,11 +41947,12 @@ class AccountRuntime {
       hasVault: true,
       vaultSecret: options.saveSecret === false ? profile.vaultSecret || null : profile.vaultSecret || vaultSecret,
       network: session.network,
-      walletPK: session.walletPK,
+      walletPK: session.walletPK || profile.walletPK || null,
       chatPK: session.chatPK,
       lastUnlockedAt: Date.now()
     });
     this.session.account = this.accountSummary(next);
+    this.trackWalletIdentity(session);
     return this.accountSummary(next);
   }
   closeVaultSession() {
@@ -41912,6 +41987,15 @@ class AccountRuntime {
     }
     return this.session;
   }
+  async ensureWalletReady() {
+    const session = await this.ensureUnlocked();
+    if (!session.wallet)
+      await session.walletReady;
+    if (this.session !== session || session.closed || !session.wallet) {
+      throw new Error("account changed during wallet boot");
+    }
+    return session;
+  }
   async resolvePeer(peer, options = {}) {
     await this.ensureUnlocked();
     const value = cleanPeer(peer);
@@ -42100,6 +42184,7 @@ var API_VERSION = 3, REQUIRED_FUNCTION_PORTS;
 var init_client = __esm(() => {
   init_values();
   init_pack();
+  init_core();
   init_agreement();
   init_network();
   init_username();
@@ -56656,7 +56741,7 @@ async function asyncLoop(iters, tick, cb) {
     const diff = Date.now() - ts;
     if (diff >= 0 && diff < tick)
       continue;
-    await nextTick2();
+    await nextTick();
     ts += diff;
   }
 }
@@ -56718,7 +56803,7 @@ function randomBytes5(bytesLength = 32) {
   }
   throw new Error("crypto.getRandomValues must be defined");
 }
-var hasHexBuiltin3, hexes2, asciis2, nextTick2 = async () => {};
+var hasHexBuiltin3, hexes2, asciis2, nextTick = async () => {};
 var init_utils4 = __esm(() => {
   init_cryptoNode();
   /*! noble-hashes - MIT License (c) 2022 Paul Miller (paulmillr.com) */
@@ -158250,9 +158335,6 @@ function isFirestoreValue(obj) {
   }
   return false;
 }
-function deleteField() {
-  return new DeleteFieldValueImpl("deleteField");
-}
 function serverTimestamp() {
   return new ServerTimestampFieldValueImpl("serverTimestamp");
 }
@@ -176621,7 +176703,9 @@ function createFirebaseCloud({ db, auth: auth2, getAuth: getAuth2, functions: fu
       await callFunction("setAvatarModeration", { uid, banned: true });
       return true;
     }
-    await setDoc(doc(db, "moderation", uid), { banned: { [feature]: { until: null } } }, { merge: true });
+    if (feature !== "chat")
+      throw new Error("unsupported moderation feature");
+    await callFunction("setChatModeration", { uid, banned: true });
     return true;
   }
   async function unbanAdminUser(uid, feature = "chat") {
@@ -176630,7 +176714,9 @@ function createFirebaseCloud({ db, auth: auth2, getAuth: getAuth2, functions: fu
       await callFunction("setAvatarModeration", { uid, banned: false });
       return true;
     }
-    await setDoc(doc(db, "moderation", uid), { banned: { [feature]: deleteField() } }, { merge: true });
+    if (feature !== "chat")
+      throw new Error("unsupported moderation feature");
+    await callFunction("setChatModeration", { uid, banned: false });
     return true;
   }
   async function readAdminUserMetrics() {
@@ -176644,6 +176730,12 @@ function createFirebaseCloud({ db, auth: auth2, getAuth: getAuth2, functions: fu
       throw new Error("createFirebaseCloud requires storage");
     return getDownloadURL(ref2(targetStorage, path));
   }
+  async function deleteAdminReportedChat(uid, reportId) {
+    requireUid(uid);
+    if (!reportId)
+      throw new Error("report id required");
+    return callFunction("deleteReportedChat", { uid, reportId });
+  }
   return {
     user: {
       vault: {
@@ -176769,6 +176861,7 @@ function createFirebaseCloud({ db, auth: auth2, getAuth: getAuth2, functions: fu
       reports: {
         watchOffenders: watchAdminReportOffenders,
         watchUser: watchAdminUserReports,
+        deleteChat: deleteAdminReportedChat,
         evidence: {
           path: adminReportEvidencePath
         }
@@ -176869,983 +176962,142 @@ var init_cloud2 = __esm(() => {
   init_config3();
 });
 
-// ../../node_modules/.bun/@noble+hashes@2.2.0/node_modules/@noble/hashes/_blake.js
-function G1s(a, b, c, d, x) {
-  a = a + b + x | 0;
-  d = rotr(d ^ a, 16);
-  c = c + d | 0;
-  b = rotr(b ^ c, 12);
-  return { a, b, c, d };
-}
-function G2s(a, b, c, d, x) {
-  a = a + b + x | 0;
-  d = rotr(d ^ a, 8);
-  c = c + d | 0;
-  b = rotr(b ^ c, 7);
-  return { a, b, c, d };
+// src/runtime/kdf-worker.js
+import { availableParallelism } from "node:os";
+import { Worker } from "node:worker_threads";
+function positiveInteger(value, fallback) {
+  const number = Math.floor(Number(value));
+  return Number.isFinite(number) && number > 0 ? number : fallback;
+}
+function defaultVaultKdfWorkers(options2 = {}) {
+  const parallelism = positiveInteger(options2.parallelism, availableParallelism());
+  const memoryBudgetKib = positiveInteger(options2.memoryBudgetKib, DEFAULT_KDF_MEMORY_BUDGET_KIB);
+  const perWorkerKib = positiveInteger(options2.memoryKib, KDF_MEMORY_KIB);
+  return Math.max(1, Math.min(Math.ceil(parallelism / 2), Math.floor(memoryBudgetKib / perWorkerKib)));
+}
+function workerError(details = {}) {
+  const error = new Error(details.message || "vault KDF failed");
+  error.name = details.name || "Error";
+  error.code = details.code || "";
+  return error;
 }
-var BSIGMA;
-var init__blake = __esm(() => {
-  init_utils();
-  BSIGMA = /* @__PURE__ */ Uint8Array.from([
-    0,
-    1,
-    2,
-    3,
-    4,
-    5,
-    6,
-    7,
-    8,
-    9,
-    10,
-    11,
-    12,
-    13,
-    14,
-    15,
-    14,
-    10,
-    4,
-    8,
-    9,
-    15,
-    13,
-    6,
-    1,
-    12,
-    0,
-    2,
-    11,
-    7,
-    5,
-    3,
-    11,
-    8,
-    12,
-    0,
-    5,
-    2,
-    15,
-    13,
-    10,
-    14,
-    3,
-    6,
-    7,
-    1,
-    9,
-    4,
-    7,
-    9,
-    3,
-    1,
-    13,
-    12,
-    11,
-    14,
-    2,
-    6,
-    5,
-    10,
-    4,
-    0,
-    15,
-    8,
-    9,
-    0,
-    5,
-    7,
-    2,
-    4,
-    10,
-    15,
-    14,
-    1,
-    11,
-    12,
-    6,
-    8,
-    3,
-    13,
-    2,
-    12,
-    6,
-    10,
-    0,
-    11,
-    8,
-    3,
-    4,
-    13,
-    7,
-    5,
-    15,
-    14,
-    1,
-    9,
-    12,
-    5,
-    1,
-    15,
-    14,
-    13,
-    4,
-    10,
-    0,
-    7,
-    6,
-    3,
-    9,
-    2,
-    8,
-    11,
-    13,
-    11,
-    7,
-    14,
-    12,
-    1,
-    3,
-    9,
-    5,
-    0,
-    15,
-    4,
-    8,
-    6,
-    2,
-    10,
-    6,
-    15,
-    14,
-    9,
-    11,
-    3,
-    0,
-    8,
-    12,
-    2,
-    13,
-    7,
-    1,
-    4,
-    10,
-    5,
-    10,
-    2,
-    8,
-    4,
-    7,
-    6,
-    1,
-    5,
-    15,
-    11,
-    9,
-    14,
-    3,
-    12,
-    13,
-    0,
-    0,
-    1,
-    2,
-    3,
-    4,
-    5,
-    6,
-    7,
-    8,
-    9,
-    10,
-    11,
-    12,
-    13,
-    14,
-    15,
-    14,
-    10,
-    4,
-    8,
-    9,
-    15,
-    13,
-    6,
-    1,
-    12,
-    0,
-    2,
-    11,
-    7,
-    5,
-    3,
-    11,
-    8,
-    12,
-    0,
-    5,
-    2,
-    15,
-    13,
-    10,
-    14,
-    3,
-    6,
-    7,
-    1,
-    9,
-    4,
-    7,
-    9,
-    3,
-    1,
-    13,
-    12,
-    11,
-    14,
-    2,
-    6,
-    5,
-    10,
-    4,
-    0,
-    15,
-    8,
-    9,
-    0,
-    5,
-    7,
-    2,
-    4,
-    10,
-    15,
-    14,
-    1,
-    11,
-    12,
-    6,
-    8,
-    3,
-    13,
-    2,
-    12,
-    6,
-    10,
-    0,
-    11,
-    8,
-    3,
-    4,
-    13,
-    7,
-    5,
-    15,
-    14,
-    1,
-    9
-  ]);
-});
-
-// ../../node_modules/.bun/@noble+hashes@2.2.0/node_modules/@noble/hashes/blake2.js
-function G1b(a, b, c, d, msg, x) {
-  const Xl = msg[x], Xh = msg[x + 1];
-  let Al = BBUF[2 * a], Ah = BBUF[2 * a + 1];
-  let Bl = BBUF[2 * b], Bh = BBUF[2 * b + 1];
-  let Cl = BBUF[2 * c], Ch = BBUF[2 * c + 1];
-  let Dl = BBUF[2 * d], Dh = BBUF[2 * d + 1];
-  let ll = add3L(Al, Bl, Xl);
-  Ah = add3H(ll, Ah, Bh, Xh);
-  Al = ll | 0;
-  ({ Dh, Dl } = { Dh: Dh ^ Ah, Dl: Dl ^ Al });
-  ({ Dh, Dl } = { Dh: rotr32H(Dh, Dl), Dl: rotr32L(Dh, Dl) });
-  ({ h: Ch, l: Cl } = add(Ch, Cl, Dh, Dl));
-  ({ Bh, Bl } = { Bh: Bh ^ Ch, Bl: Bl ^ Cl });
-  ({ Bh, Bl } = { Bh: rotrSH(Bh, Bl, 24), Bl: rotrSL(Bh, Bl, 24) });
-  BBUF[2 * a] = Al, BBUF[2 * a + 1] = Ah;
-  BBUF[2 * b] = Bl, BBUF[2 * b + 1] = Bh;
-  BBUF[2 * c] = Cl, BBUF[2 * c + 1] = Ch;
-  BBUF[2 * d] = Dl, BBUF[2 * d + 1] = Dh;
-}
-function G2b(a, b, c, d, msg, x) {
-  const Xl = msg[x], Xh = msg[x + 1];
-  let Al = BBUF[2 * a], Ah = BBUF[2 * a + 1];
-  let Bl = BBUF[2 * b], Bh = BBUF[2 * b + 1];
-  let Cl = BBUF[2 * c], Ch = BBUF[2 * c + 1];
-  let Dl = BBUF[2 * d], Dh = BBUF[2 * d + 1];
-  let ll = add3L(Al, Bl, Xl);
-  Ah = add3H(ll, Ah, Bh, Xh);
-  Al = ll | 0;
-  ({ Dh, Dl } = { Dh: Dh ^ Ah, Dl: Dl ^ Al });
-  ({ Dh, Dl } = { Dh: rotrSH(Dh, Dl, 16), Dl: rotrSL(Dh, Dl, 16) });
-  ({ h: Ch, l: Cl } = add(Ch, Cl, Dh, Dl));
-  ({ Bh, Bl } = { Bh: Bh ^ Ch, Bl: Bl ^ Cl });
-  ({ Bh, Bl } = { Bh: rotrBH(Bh, Bl, 63), Bl: rotrBL(Bh, Bl, 63) });
-  BBUF[2 * a] = Al, BBUF[2 * a + 1] = Ah;
-  BBUF[2 * b] = Bl, BBUF[2 * b + 1] = Bh;
-  BBUF[2 * c] = Cl, BBUF[2 * c + 1] = Ch;
-  BBUF[2 * d] = Dl, BBUF[2 * d + 1] = Dh;
-}
-function checkBlake2Opts(outputLen, opts = {}, keyLen, saltLen, persLen) {
-  anumber(keyLen);
-  if (outputLen <= 0 || outputLen > keyLen)
-    throw new Error("outputLen bigger than keyLen");
-  const { key, salt, personalization } = opts;
-  if (key !== undefined && (key.length < 1 || key.length > keyLen))
-    throw new Error('"key" expected to be undefined or of length=1..' + keyLen);
-  if (salt !== undefined)
-    abytes(salt, saltLen, "salt");
-  if (personalization !== undefined)
-    abytes(personalization, persLen, "personalization");
-}
-
-class _BLAKE2 {
-  buffer;
-  buffer32;
-  finished = false;
-  destroyed = false;
-  length = 0;
-  pos = 0;
-  blockLen;
-  outputLen;
-  canXOF = false;
-  constructor(blockLen, outputLen) {
-    anumber(blockLen);
-    anumber(outputLen);
-    this.blockLen = blockLen;
-    this.outputLen = outputLen;
-    this.buffer = new Uint8Array(blockLen);
-    this.buffer32 = u32(this.buffer);
-  }
-  update(data) {
-    aexists(this);
-    abytes(data);
-    const { blockLen, buffer, buffer32 } = this;
-    const len = data.length;
-    const offset = data.byteOffset;
-    const buf = data.buffer;
-    for (let pos = 0;pos < len; ) {
-      if (this.pos === blockLen) {
-        swap32IfBE(buffer32);
-        this.compress(buffer32, 0, false);
-        swap32IfBE(buffer32);
-        this.pos = 0;
-      }
-      const take = Math.min(blockLen - this.pos, len - pos);
-      const dataOffset = offset + pos;
-      if (take === blockLen && !(dataOffset % 4) && pos + take < len) {
-        const data32 = new Uint32Array(buf, dataOffset, Math.floor((len - pos) / 4));
-        swap32IfBE(data32);
-        for (let pos32 = 0;pos + blockLen < len; pos32 += buffer32.length, pos += blockLen) {
-          this.length += blockLen;
-          this.compress(data32, pos32, false);
-        }
-        swap32IfBE(data32);
+function createVaultKdfWorkerPool(options2 = {}) {
+  const size = positiveInteger(options2.size, defaultVaultKdfWorkers(options2));
+  const workerUrl = options2.workerUrl || new URL("./kdf-worker-thread.js", import.meta.url);
+  const workers = [];
+  const queue = [];
+  const pending = new Map;
+  let sequence = 0;
+  let closed = false;
+  function dispatch() {
+    if (closed)
+      return;
+    for (const slot of workers) {
+      if (slot.task || !queue.length)
         continue;
-      }
-      buffer.set(data.subarray(pos, pos + take), this.pos);
-      this.pos += take;
-      this.length += take;
-      pos += take;
-    }
-    return this;
-  }
-  digestInto(out) {
-    aexists(this);
-    aoutput(out, this);
-    const { pos, buffer32 } = this;
-    this.finished = true;
-    clean(this.buffer.subarray(pos));
-    swap32IfBE(buffer32);
-    this.compress(buffer32, 0, true);
-    swap32IfBE(buffer32);
-    if (out.byteOffset & 3)
-      throw new RangeError('"digestInto() output" expected 4-byte aligned byteOffset, got ' + out.byteOffset);
-    const state = this.get();
-    const out32 = u32(out);
-    const full = Math.floor(this.outputLen / 4);
-    for (let i = 0;i < full; i++)
-      out32[i] = swap8IfBE(state[i]);
-    const tail = this.outputLen % 4;
-    if (!tail)
+      const task = queue.shift();
+      slot.task = task;
+      pending.set(task.id, { slot, task });
+      slot.worker.ref();
+      slot.worker.postMessage({
+        id: task.id,
+        password: task.password.buffer,
+        salt: task.salt.buffer,
+        params: task.params
+      }, [task.password.buffer, task.salt.buffer]);
+    }
+  }
+  function finish(slot, task, operation, value) {
+    if (slot.task !== task)
       return;
-    const off = full * 4;
-    const word = state[full];
-    for (let i = 0;i < tail; i++)
-      out[off + i] = word >>> 8 * i;
-  }
-  digest() {
-    const { buffer, outputLen } = this;
-    this.digestInto(buffer);
-    const res = buffer.slice(0, outputLen);
-    this.destroy();
-    return res;
-  }
-  _cloneInto(to) {
-    const { buffer, length, finished, destroyed, outputLen, pos } = this;
-    to ||= new this.constructor({ dkLen: outputLen });
-    to.set(...this.get());
-    to.buffer.set(buffer);
-    to.destroyed = destroyed;
-    to.finished = finished;
-    to.length = length;
-    to.pos = pos;
-    to.outputLen = outputLen;
-    return to;
-  }
-  clone() {
-    return this._cloneInto();
-  }
-}
-function compress2(s, offset, msg, rounds, v0, v1, v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, v12, v13, v14, v15) {
-  let j = 0;
-  for (let i = 0;i < rounds; i++) {
-    ({ a: v0, b: v4, c: v8, d: v12 } = G1s(v0, v4, v8, v12, msg[offset + s[j++]]));
-    ({ a: v0, b: v4, c: v8, d: v12 } = G2s(v0, v4, v8, v12, msg[offset + s[j++]]));
-    ({ a: v1, b: v5, c: v9, d: v13 } = G1s(v1, v5, v9, v13, msg[offset + s[j++]]));
-    ({ a: v1, b: v5, c: v9, d: v13 } = G2s(v1, v5, v9, v13, msg[offset + s[j++]]));
-    ({ a: v2, b: v6, c: v10, d: v14 } = G1s(v2, v6, v10, v14, msg[offset + s[j++]]));
-    ({ a: v2, b: v6, c: v10, d: v14 } = G2s(v2, v6, v10, v14, msg[offset + s[j++]]));
-    ({ a: v3, b: v7, c: v11, d: v15 } = G1s(v3, v7, v11, v15, msg[offset + s[j++]]));
-    ({ a: v3, b: v7, c: v11, d: v15 } = G2s(v3, v7, v11, v15, msg[offset + s[j++]]));
-    ({ a: v0, b: v5, c: v10, d: v15 } = G1s(v0, v5, v10, v15, msg[offset + s[j++]]));
-    ({ a: v0, b: v5, c: v10, d: v15 } = G2s(v0, v5, v10, v15, msg[offset + s[j++]]));
-    ({ a: v1, b: v6, c: v11, d: v12 } = G1s(v1, v6, v11, v12, msg[offset + s[j++]]));
-    ({ a: v1, b: v6, c: v11, d: v12 } = G2s(v1, v6, v11, v12, msg[offset + s[j++]]));
-    ({ a: v2, b: v7, c: v8, d: v13 } = G1s(v2, v7, v8, v13, msg[offset + s[j++]]));
-    ({ a: v2, b: v7, c: v8, d: v13 } = G2s(v2, v7, v8, v13, msg[offset + s[j++]]));
-    ({ a: v3, b: v4, c: v9, d: v14 } = G1s(v3, v4, v9, v14, msg[offset + s[j++]]));
-    ({ a: v3, b: v4, c: v9, d: v14 } = G2s(v3, v4, v9, v14, msg[offset + s[j++]]));
-  }
-  return { v0, v1, v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, v12, v13, v14, v15 };
-}
-var B2B_IV, BBUF, _BLAKE2b, blake2b, B2S_IV, _BLAKE2s;
-var init_blake2 = __esm(() => {
-  init__blake();
-  init__md();
-  init__u64();
-  init_utils();
-  B2B_IV = /* @__PURE__ */ Uint32Array.from([
-    4089235720,
-    1779033703,
-    2227873595,
-    3144134277,
-    4271175723,
-    1013904242,
-    1595750129,
-    2773480762,
-    2917565137,
-    1359893119,
-    725511199,
-    2600822924,
-    4215389547,
-    528734635,
-    327033209,
-    1541459225
-  ]);
-  BBUF = /* @__PURE__ */ new Uint32Array(32);
-  _BLAKE2b = class _BLAKE2b extends _BLAKE2 {
-    v0l = B2B_IV[0] | 0;
-    v0h = B2B_IV[1] | 0;
-    v1l = B2B_IV[2] | 0;
-    v1h = B2B_IV[3] | 0;
-    v2l = B2B_IV[4] | 0;
-    v2h = B2B_IV[5] | 0;
-    v3l = B2B_IV[6] | 0;
-    v3h = B2B_IV[7] | 0;
-    v4l = B2B_IV[8] | 0;
-    v4h = B2B_IV[9] | 0;
-    v5l = B2B_IV[10] | 0;
-    v5h = B2B_IV[11] | 0;
-    v6l = B2B_IV[12] | 0;
-    v6h = B2B_IV[13] | 0;
-    v7l = B2B_IV[14] | 0;
-    v7h = B2B_IV[15] | 0;
-    constructor(opts = {}) {
-      const olen = opts.dkLen === undefined ? 64 : opts.dkLen;
-      super(128, olen);
-      checkBlake2Opts(olen, opts, 64, 16, 16);
-      let { key, personalization, salt } = opts;
-      let keyLength = 0;
-      if (key !== undefined) {
-        abytes(key, undefined, "key");
-        keyLength = key.length;
-      }
-      this.v0l ^= this.outputLen | keyLength << 8 | 1 << 16 | 1 << 24;
-      if (salt !== undefined) {
-        abytes(salt, undefined, "salt");
-        const slt = u32(salt);
-        this.v4l ^= swap8IfBE(slt[0]);
-        this.v4h ^= swap8IfBE(slt[1]);
-        this.v5l ^= swap8IfBE(slt[2]);
-        this.v5h ^= swap8IfBE(slt[3]);
-      }
-      if (personalization !== undefined) {
-        abytes(personalization, undefined, "personalization");
-        const pers = u32(personalization);
-        this.v6l ^= swap8IfBE(pers[0]);
-        this.v6h ^= swap8IfBE(pers[1]);
-        this.v7l ^= swap8IfBE(pers[2]);
-        this.v7h ^= swap8IfBE(pers[3]);
-      }
-      if (key !== undefined) {
-        const tmp = new Uint8Array(this.blockLen);
-        tmp.set(key);
-        this.update(tmp);
+    pending.delete(task.id);
+    slot.task = null;
+    slot.worker.unref();
+    operation(value);
+    dispatch();
+  }
+  function failSlot(slot, error) {
+    if (slot.failed)
+      return;
+    slot.failed = true;
+    const task = slot.task;
+    if (task)
+      finish(slot, task, task.reject, error);
+    if (closed)
+      return;
+    const index = workers.indexOf(slot);
+    if (index >= 0)
+      workers.splice(index, 1);
+    spawn();
+    dispatch();
+  }
+  function spawn() {
+    const worker = new Worker(workerUrl, { type: "module" });
+    const slot = { worker, task: null, failed: false };
+    worker.unref();
+    worker.on("message", ({ id, key, error }) => {
+      const active = pending.get(id);
+      if (!active || active.slot !== slot)
+        return;
+      if (error) {
+        finish(slot, active.task, active.task.reject, workerError(error));
+        return;
       }
-    }
-    get() {
-      let { v0l, v0h, v1l, v1h, v2l, v2h, v3l, v3h, v4l, v4h, v5l, v5h, v6l, v6h, v7l, v7h } = this;
-      return [v0l, v0h, v1l, v1h, v2l, v2h, v3l, v3h, v4l, v4h, v5l, v5h, v6l, v6h, v7l, v7h];
-    }
-    set(v0l, v0h, v1l, v1h, v2l, v2h, v3l, v3h, v4l, v4h, v5l, v5h, v6l, v6h, v7l, v7h) {
-      this.v0l = v0l | 0;
-      this.v0h = v0h | 0;
-      this.v1l = v1l | 0;
-      this.v1h = v1h | 0;
-      this.v2l = v2l | 0;
-      this.v2h = v2h | 0;
-      this.v3l = v3l | 0;
-      this.v3h = v3h | 0;
-      this.v4l = v4l | 0;
-      this.v4h = v4h | 0;
-      this.v5l = v5l | 0;
-      this.v5h = v5h | 0;
-      this.v6l = v6l | 0;
-      this.v6h = v6h | 0;
-      this.v7l = v7l | 0;
-      this.v7h = v7h | 0;
-    }
-    compress(msg, offset, isLast) {
-      this.get().forEach((v, i) => BBUF[i] = v);
-      BBUF.set(B2B_IV, 16);
-      let { h, l } = fromBig(BigInt(this.length));
-      BBUF[24] = B2B_IV[8] ^ l;
-      BBUF[25] = B2B_IV[9] ^ h;
-      if (isLast) {
-        BBUF[28] = ~BBUF[28];
-        BBUF[29] = ~BBUF[29];
-      }
-      let j = 0;
-      const s = BSIGMA;
-      for (let i = 0;i < 12; i++) {
-        G1b(0, 4, 8, 12, msg, offset + 2 * s[j++]);
-        G2b(0, 4, 8, 12, msg, offset + 2 * s[j++]);
-        G1b(1, 5, 9, 13, msg, offset + 2 * s[j++]);
-        G2b(1, 5, 9, 13, msg, offset + 2 * s[j++]);
-        G1b(2, 6, 10, 14, msg, offset + 2 * s[j++]);
-        G2b(2, 6, 10, 14, msg, offset + 2 * s[j++]);
-        G1b(3, 7, 11, 15, msg, offset + 2 * s[j++]);
-        G2b(3, 7, 11, 15, msg, offset + 2 * s[j++]);
-        G1b(0, 5, 10, 15, msg, offset + 2 * s[j++]);
-        G2b(0, 5, 10, 15, msg, offset + 2 * s[j++]);
-        G1b(1, 6, 11, 12, msg, offset + 2 * s[j++]);
-        G2b(1, 6, 11, 12, msg, offset + 2 * s[j++]);
-        G1b(2, 7, 8, 13, msg, offset + 2 * s[j++]);
-        G2b(2, 7, 8, 13, msg, offset + 2 * s[j++]);
-        G1b(3, 4, 9, 14, msg, offset + 2 * s[j++]);
-        G2b(3, 4, 9, 14, msg, offset + 2 * s[j++]);
-      }
-      this.v0l ^= BBUF[0] ^ BBUF[16];
-      this.v0h ^= BBUF[1] ^ BBUF[17];
-      this.v1l ^= BBUF[2] ^ BBUF[18];
-      this.v1h ^= BBUF[3] ^ BBUF[19];
-      this.v2l ^= BBUF[4] ^ BBUF[20];
-      this.v2h ^= BBUF[5] ^ BBUF[21];
-      this.v3l ^= BBUF[6] ^ BBUF[22];
-      this.v3h ^= BBUF[7] ^ BBUF[23];
-      this.v4l ^= BBUF[8] ^ BBUF[24];
-      this.v4h ^= BBUF[9] ^ BBUF[25];
-      this.v5l ^= BBUF[10] ^ BBUF[26];
-      this.v5h ^= BBUF[11] ^ BBUF[27];
-      this.v6l ^= BBUF[12] ^ BBUF[28];
-      this.v6h ^= BBUF[13] ^ BBUF[29];
-      this.v7l ^= BBUF[14] ^ BBUF[30];
-      this.v7h ^= BBUF[15] ^ BBUF[31];
-      clean(BBUF);
-    }
-    destroy() {
-      this.destroyed = true;
-      clean(this.buffer32);
-      this.set(0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0);
-    }
-  };
-  blake2b = /* @__PURE__ */ createHasher((opts) => new _BLAKE2b(opts));
-  B2S_IV = /* @__PURE__ */ SHA256_IV.slice();
-  _BLAKE2s = class _BLAKE2s extends _BLAKE2 {
-    v0 = B2S_IV[0] | 0;
-    v1 = B2S_IV[1] | 0;
-    v2 = B2S_IV[2] | 0;
-    v3 = B2S_IV[3] | 0;
-    v4 = B2S_IV[4] | 0;
-    v5 = B2S_IV[5] | 0;
-    v6 = B2S_IV[6] | 0;
-    v7 = B2S_IV[7] | 0;
-    constructor(opts = {}) {
-      const olen = opts.dkLen === undefined ? 32 : opts.dkLen;
-      super(64, olen);
-      checkBlake2Opts(olen, opts, 32, 8, 8);
-      let { key, personalization, salt } = opts;
-      let keyLength = 0;
-      if (key !== undefined) {
-        abytes(key, undefined, "key");
-        keyLength = key.length;
-      }
-      this.v0 ^= this.outputLen | keyLength << 8 | 1 << 16 | 1 << 24;
-      if (salt !== undefined) {
-        abytes(salt, undefined, "salt");
-        const slt = u32(salt);
-        this.v4 ^= swap8IfBE(slt[0]);
-        this.v5 ^= swap8IfBE(slt[1]);
-      }
-      if (personalization !== undefined) {
-        abytes(personalization, undefined, "personalization");
-        const pers = u32(personalization);
-        this.v6 ^= swap8IfBE(pers[0]);
-        this.v7 ^= swap8IfBE(pers[1]);
-      }
-      if (key !== undefined) {
-        const tmp = new Uint8Array(this.blockLen);
-        tmp.set(key);
-        this.update(tmp);
+      finish(slot, active.task, active.task.resolve, new Uint8Array(key));
+    });
+    worker.on("error", (error) => failSlot(slot, error));
+    worker.on("exit", (code) => {
+      if (closed)
+        return;
+      failSlot(slot, new Error(`vault KDF worker exited (${code})`));
+    });
+    workers.push(slot);
+  }
+  for (let index = 0;index < size; index += 1)
+    spawn();
+  return Object.freeze({
+    size,
+    derive(password, salt, params = {}) {
+      if (closed)
+        return Promise.reject(new Error("vault KDF pool closed"));
+      const passwordBytes = encoder3.encode(String(password ?? ""));
+      const saltBytes = new Uint8Array(salt);
+      return new Promise((resolve, reject) => {
+        sequence += 1;
+        queue.push({
+          id: sequence,
+          password: passwordBytes,
+          salt: saltBytes,
+          params,
+          resolve,
+          reject
+        });
+        dispatch();
+      });
+    },
+    async close() {
+      if (closed)
+        return;
+      closed = true;
+      const error = new Error("vault KDF pool closed");
+      for (const task of queue.splice(0)) {
+        task.password.fill(0);
+        task.salt.fill(0);
+        task.reject(error);
       }
+      for (const { task } of pending.values())
+        task.reject(error);
+      pending.clear();
+      await Promise.all(workers.map(({ worker }) => worker.terminate()));
+      workers.length = 0;
     }
-    get() {
-      const { v0, v1, v2, v3, v4, v5, v6, v7 } = this;
-      return [v0, v1, v2, v3, v4, v5, v6, v7];
-    }
-    set(v0, v1, v2, v3, v4, v5, v6, v7) {
-      this.v0 = v0 | 0;
-      this.v1 = v1 | 0;
-      this.v2 = v2 | 0;
-      this.v3 = v3 | 0;
-      this.v4 = v4 | 0;
-      this.v5 = v5 | 0;
-      this.v6 = v6 | 0;
-      this.v7 = v7 | 0;
-    }
-    compress(msg, offset, isLast) {
-      const { h, l } = fromBig(BigInt(this.length));
-      const { v0, v1, v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, v12, v13, v14, v15 } = compress2(BSIGMA, offset, msg, 10, this.v0, this.v1, this.v2, this.v3, this.v4, this.v5, this.v6, this.v7, B2S_IV[0], B2S_IV[1], B2S_IV[2], B2S_IV[3], l ^ B2S_IV[4], h ^ B2S_IV[5], isLast ? ~B2S_IV[6] : B2S_IV[6], B2S_IV[7]);
-      this.v0 ^= v0 ^ v8;
-      this.v1 ^= v1 ^ v9;
-      this.v2 ^= v2 ^ v10;
-      this.v3 ^= v3 ^ v11;
-      this.v4 ^= v4 ^ v12;
-      this.v5 ^= v5 ^ v13;
-      this.v6 ^= v6 ^ v14;
-      this.v7 ^= v7 ^ v15;
-    }
-    destroy() {
-      this.destroyed = true;
-      clean(this.buffer32);
-      this.set(0, 0, 0, 0, 0, 0, 0, 0);
-    }
-  };
-});
-
-// ../../node_modules/.bun/@noble+hashes@2.2.0/node_modules/@noble/hashes/argon2.js
-function mul3(a, b) {
-  const aL = a & 65535;
-  const aH = a >>> 16;
-  const bL = b & 65535;
-  const bH = b >>> 16;
-  const ll = Math.imul(aL, bL);
-  const hl = Math.imul(aH, bL);
-  const lh = Math.imul(aL, bH);
-  const hh = Math.imul(aH, bH);
-  const carry = (ll >>> 16) + (hl & 65535) + lh;
-  const high = hh + (hl >>> 16) + (carry >>> 16) | 0;
-  const low = carry << 16 | ll & 65535;
-  return { h: high, l: low };
-}
-function mul23(a, b) {
-  const { h, l } = mul3(a, b);
-  return { h: (h << 1 | l >>> 31) & 4294967295, l: l << 1 & 4294967295 };
-}
-function blamka(Ah, Al, Bh, Bl) {
-  const { h: Ch, l: Cl } = mul23(Al, Bl);
-  const Rll = add3L(Al, Bl, Cl);
-  return { h: add3H(Rll, Ah, Bh, Ch), l: Rll | 0 };
-}
-function G(a, b, c, d) {
-  let Al = A2_BUF[2 * a], Ah = A2_BUF[2 * a + 1];
-  let Bl = A2_BUF[2 * b], Bh = A2_BUF[2 * b + 1];
-  let Cl = A2_BUF[2 * c], Ch = A2_BUF[2 * c + 1];
-  let Dl = A2_BUF[2 * d], Dh = A2_BUF[2 * d + 1];
-  ({ h: Ah, l: Al } = blamka(Ah, Al, Bh, Bl));
-  ({ Dh, Dl } = { Dh: Dh ^ Ah, Dl: Dl ^ Al });
-  ({ Dh, Dl } = { Dh: rotr32H(Dh, Dl), Dl: rotr32L(Dh, Dl) });
-  ({ h: Ch, l: Cl } = blamka(Ch, Cl, Dh, Dl));
-  ({ Bh, Bl } = { Bh: Bh ^ Ch, Bl: Bl ^ Cl });
-  ({ Bh, Bl } = { Bh: rotrSH(Bh, Bl, 24), Bl: rotrSL(Bh, Bl, 24) });
-  ({ h: Ah, l: Al } = blamka(Ah, Al, Bh, Bl));
-  ({ Dh, Dl } = { Dh: Dh ^ Ah, Dl: Dl ^ Al });
-  ({ Dh, Dl } = { Dh: rotrSH(Dh, Dl, 16), Dl: rotrSL(Dh, Dl, 16) });
-  ({ h: Ch, l: Cl } = blamka(Ch, Cl, Dh, Dl));
-  ({ Bh, Bl } = { Bh: Bh ^ Ch, Bl: Bl ^ Cl });
-  ({ Bh, Bl } = { Bh: rotrBH(Bh, Bl, 63), Bl: rotrBL(Bh, Bl, 63) });
-  A2_BUF[2 * a] = Al, A2_BUF[2 * a + 1] = Ah;
-  A2_BUF[2 * b] = Bl, A2_BUF[2 * b + 1] = Bh;
-  A2_BUF[2 * c] = Cl, A2_BUF[2 * c + 1] = Ch;
-  A2_BUF[2 * d] = Dl, A2_BUF[2 * d + 1] = Dh;
-}
-function P(v00, v01, v02, v03, v04, v05, v06, v07, v08, v09, v10, v11, v12, v13, v14, v15) {
-  G(v00, v04, v08, v12);
-  G(v01, v05, v09, v13);
-  G(v02, v06, v10, v14);
-  G(v03, v07, v11, v15);
-  G(v00, v05, v10, v15);
-  G(v01, v06, v11, v12);
-  G(v02, v07, v08, v13);
-  G(v03, v04, v09, v14);
-}
-function block(x, xPos, yPos, outPos, needXor) {
-  for (let i = 0;i < 256; i++)
-    A2_BUF[i] = x[xPos + i] ^ x[yPos + i];
-  for (let i = 0;i < 128; i += 16) {
-    P(i, i + 1, i + 2, i + 3, i + 4, i + 5, i + 6, i + 7, i + 8, i + 9, i + 10, i + 11, i + 12, i + 13, i + 14, i + 15);
-  }
-  for (let i = 0;i < 16; i += 2) {
-    P(i, i + 1, i + 16, i + 17, i + 32, i + 33, i + 48, i + 49, i + 64, i + 65, i + 80, i + 81, i + 96, i + 97, i + 112, i + 113);
-  }
-  if (needXor)
-    for (let i = 0;i < 256; i++)
-      x[outPos + i] ^= A2_BUF[i] ^ x[xPos + i] ^ x[yPos + i];
-  else
-    for (let i = 0;i < 256; i++)
-      x[outPos + i] = A2_BUF[i] ^ x[xPos + i] ^ x[yPos + i];
-  clean(A2_BUF);
-}
-function Hp(A, dkLen) {
-  const A8 = u8(A);
-  const T = new Uint32Array(1);
-  const T8 = u8(T);
-  T[0] = swap8IfBE(dkLen);
-  if (dkLen <= 64)
-    return blake2b.create({ dkLen }).update(T8).update(A8).digest();
-  const out = new Uint8Array(dkLen);
-  let V = blake2b.create({}).update(T8).update(A8).digest();
-  let pos = 0;
-  out.set(V.subarray(0, 32));
-  pos += 32;
-  for (;dkLen - pos > 64; pos += 32) {
-    const Vh = blake2b.create({}).update(V);
-    Vh.digestInto(V);
-    Vh.destroy();
-    out.set(V.subarray(0, 32), pos);
-  }
-  out.set(blake2b(V, { dkLen: dkLen - pos }), pos);
-  clean(V, T);
-  return out;
-}
-function indexAlpha(r, s, laneLen, segmentLen, index, randL, sameLane = false) {
-  let area;
-  if (r === 0) {
-    if (s === 0)
-      area = index - 1;
-    else if (sameLane)
-      area = s * segmentLen + index - 1;
-    else
-      area = s * segmentLen + (index == 0 ? -1 : 0);
-  } else if (sameLane)
-    area = laneLen - segmentLen + index - 1;
-  else
-    area = laneLen - segmentLen + (index == 0 ? -1 : 0);
-  const startPos = r !== 0 && s !== ARGON2_SYNC_POINTS - 1 ? (s + 1) * segmentLen : 0;
-  const rel = area - 1 - mul3(area, mul3(randL, randL).h).h;
-  return (startPos + rel) % laneLen;
-}
-function isU32(num2) {
-  return Number.isSafeInteger(num2) && num2 >= 0 && num2 < maxUint32;
-}
-function argon2Opts(opts) {
-  const merged = {
-    version: 19,
-    dkLen: 32,
-    maxmem: maxUint32 - 1,
-    asyncTick: 10
-  };
-  for (let [k, v] of Object.entries(opts))
-    if (v !== undefined)
-      merged[k] = v;
-  const { dkLen, p, m, t, version: version8, onProgress, asyncTick } = merged;
-  if (!isU32(dkLen) || dkLen < 4)
-    throw new Error('"dkLen" must be 4..');
-  if (!isU32(p) || p < 1 || p >= Math.pow(2, 24))
-    throw new Error('"p" must be 1..2^24');
-  if (!isU32(m))
-    throw new Error('"m" must be 0..2^32');
-  if (!isU32(t) || t < 1)
-    throw new Error('"t" (iterations) must be 1..2^32');
-  if (onProgress !== undefined && typeof onProgress !== "function")
-    throw new Error('"progressCb" must be a function');
-  anumber(asyncTick, "asyncTick");
-  if (!isU32(m) || m < 8 * p)
-    throw new Error('"m" (memory) must be at least 8*p bytes');
-  if (version8 !== 16 && version8 !== 19)
-    throw new Error('"version" must be 0x10 or 0x13, got ' + version8);
-  return merged;
-}
-function argon2Init(password, salt, type, opts) {
-  password = kdfInputToBytes(password, "password");
-  salt = kdfInputToBytes(salt, "salt");
-  if (!isU32(password.length))
-    throw new Error('"password" must be less of length 1..4Gb');
-  if (!isU32(salt.length) || salt.length < 8)
-    throw new Error('"salt" must be of length 8..4Gb');
-  if (!Object.values(AT).includes(type))
-    throw new Error('"type" was invalid');
-  let { p, dkLen, m, t, version: version8, key, personalization, maxmem, onProgress, asyncTick } = argon2Opts(opts);
-  key = abytesOrZero(key, "key");
-  personalization = abytesOrZero(personalization, "personalization");
-  const h = blake2b.create();
-  const BUF = new Uint32Array(1);
-  const BUF8 = u8(BUF);
-  for (let item of [p, dkLen, m, t, version8, type]) {
-    BUF[0] = swap8IfBE(item);
-    h.update(BUF8);
-  }
-  for (let i of [password, salt, key, personalization]) {
-    BUF[0] = swap8IfBE(i.length);
-    h.update(BUF8).update(i);
-  }
-  const H0 = new Uint32Array(18);
-  const H0_8 = u8(H0);
-  h.digestInto(H0_8);
-  const lanes = p;
-  const mP = 4 * p * Math.floor(m / (ARGON2_SYNC_POINTS * p));
-  const laneLen = Math.floor(mP / p);
-  const segmentLen = Math.floor(laneLen / ARGON2_SYNC_POINTS);
-  const memUsed = mP * 1024;
-  if (!isU32(maxmem))
-    throw new Error('"maxmem" expected <2**32, got ' + maxmem);
-  if (memUsed > maxmem)
-    throw new Error('"maxmem" limit was hit: memUsed(mP*1024)=' + memUsed + ", maxmem=" + maxmem);
-  const B = new Uint32Array(memUsed / 4);
-  for (let l = 0;l < p; l++) {
-    const i = 256 * laneLen * l;
-    H0[17] = swap8IfBE(l);
-    H0[16] = swap8IfBE(0);
-    B.set(swap32IfBE(u32(Hp(H0, 1024))), i);
-    H0[16] = swap8IfBE(1);
-    B.set(swap32IfBE(u32(Hp(H0, 1024))), i + 256);
-  }
-  let perBlock = () => {};
-  if (onProgress) {
-    const totalBlock = t * ARGON2_SYNC_POINTS * p * segmentLen - 2 * p;
-    const callbackPer = Math.max(Math.floor(totalBlock / 1e4), 1);
-    let blockCnt = 0;
-    perBlock = () => {
-      blockCnt++;
-      if (onProgress && (!(blockCnt % callbackPer) || blockCnt === totalBlock))
-        onProgress(blockCnt / totalBlock);
-    };
-  }
-  clean(BUF, H0);
-  return { type, mP, p, t, version: version8, B, laneLen, lanes, segmentLen, dkLen, perBlock, asyncTick };
-}
-function argon2Output(B, p, laneLen, dkLen) {
-  const B_final = new Uint32Array(256);
-  for (let l = 0;l < p; l++)
-    for (let j = 0;j < 256; j++)
-      B_final[j] ^= B[256 * (laneLen * l + laneLen - 1) + j];
-  const res = Hp(swap32IfBE(B_final), dkLen);
-  clean(B, B_final);
-  return res;
-}
-function processBlock(B, address, l, r, s, index, laneLen, segmentLen, lanes, offset, prev, dataIndependent, needXor) {
-  if (offset % laneLen)
-    prev = offset - 1;
-  let randL, randH;
-  if (dataIndependent) {
-    let i128 = index % 128;
-    if (i128 === 0) {
-      address[256 + 12]++;
-      block(address, 256, 2 * 256, 0, false);
-      block(address, 0, 2 * 256, 0, false);
-    }
-    randL = address[2 * i128];
-    randH = address[2 * i128 + 1];
-  } else {
-    const T = 256 * prev;
-    randL = B[T];
-    randH = B[T + 1];
-  }
-  const refLane = r === 0 && s === 0 ? l : randH % lanes;
-  const refPos = indexAlpha(r, s, laneLen, segmentLen, index, randL, refLane == l);
-  const refBlock = laneLen * refLane + refPos;
-  block(B, 256 * prev, 256 * refBlock, offset * 256, needXor);
-}
-async function argon2Async(type, password, salt, opts) {
-  const { mP, p, t, version: version8, B, laneLen, lanes, segmentLen, dkLen, perBlock, asyncTick } = argon2Init(password, salt, type, opts);
-  const address = new Uint32Array(3 * 256);
-  address[256 + 6] = mP;
-  address[256 + 8] = t;
-  address[256 + 10] = type;
-  let ts = Date.now();
-  for (let r = 0;r < t; r++) {
-    const needXor = r !== 0 && version8 === 19;
-    address[256 + 0] = r;
-    for (let s = 0;s < ARGON2_SYNC_POINTS; s++) {
-      address[256 + 4] = s;
-      const dataIndependent = type == AT.Argon2i || type == AT.Argon2id && r === 0 && s < 2;
-      for (let l = 0;l < p; l++) {
-        address[256 + 2] = l;
-        address[256 + 12] = 0;
-        let startPos = 0;
-        if (r === 0 && s === 0) {
-          startPos = 2;
-          if (dataIndependent) {
-            address[256 + 12]++;
-            block(address, 256, 2 * 256, 0, false);
-            block(address, 0, 2 * 256, 0, false);
-          }
-        }
-        let offset = l * laneLen + s * segmentLen + startPos;
-        let prev = offset % laneLen ? offset - 1 : offset + laneLen - 1;
-        for (let index = startPos;index < segmentLen; index++, offset++, prev++) {
-          perBlock();
-          processBlock(B, address, l, r, s, index, laneLen, segmentLen, lanes, offset, prev, dataIndependent, needXor);
-          const diff = Date.now() - ts;
-          if (!(diff >= 0 && diff < asyncTick)) {
-            await nextTick();
-            ts += diff;
-          }
-        }
-      }
-    }
-  }
-  clean(address);
-  return argon2Output(B, p, laneLen, dkLen);
-}
-var AT, ARGON2_SYNC_POINTS = 4, abytesOrZero = (buf, errorTitle = "") => {
-  if (buf === undefined)
-    return Uint8Array.of();
-  return kdfInputToBytes(buf, errorTitle);
-}, A2_BUF, maxUint32, argon2idAsync = (password, salt, opts) => argon2Async(AT.Argon2id, password, salt, opts);
-var init_argon2 = __esm(() => {
-  init__u64();
-  init_blake2();
-  init_utils();
-  AT = { Argond2d: 0, Argon2i: 1, Argon2id: 2 };
-  A2_BUF = new Uint32Array(256);
-  maxUint32 = Math.pow(2, 32);
-});
-
-// src/kdf.js
-async function deriveVaultKey(password, salt, params = {}) {
-  return argon2idAsync(String(password ?? ""), new Uint8Array(salt), {
-    t: params.t,
-    m: params.m,
-    p: params.p,
-    dkLen: params.dkLen,
-    version: params.version,
-    asyncTick: 10
   });
 }
-var init_kdf2 = __esm(() => {
-  init_argon2();
+var KDF_MEMORY_KIB, DEFAULT_KDF_MEMORY_BUDGET_KIB, encoder3;
+var init_kdf_worker = __esm(() => {
+  KDF_MEMORY_KIB = 64 * 1024;
+  DEFAULT_KDF_MEMORY_BUDGET_KIB = 512 * 1024;
+  encoder3 = new TextEncoder;
 });
 
 // src/machine.js
@@ -178376,6 +177628,10 @@ var init_passkey2 = __esm(() => {
 // src/runtime/node.js
 import { randomBytes as randomBytes10 } from "node:crypto";
 import process5 from "node:process";
+function sharedVaultCrypto() {
+  defaultKdfPool ||= createVaultKdfWorkerPool();
+  return createVaultSeedCrypto((password, salt, params) => defaultKdfPool.derive(password, salt, params));
+}
 function appName(profile) {
   const name7 = cleanProfileName(profile, "");
   return name7 ? `veyl-sdk-${name7}` : "veyl-sdk";
@@ -178400,7 +177656,7 @@ function createNodePorts(options2 = {}) {
     store,
     cloudContext,
     ownsCloud,
-    vaultCrypto: options2.vaultCrypto || vaultCrypto,
+    vaultCrypto: options2.vaultCrypto || sharedVaultCrypto(),
     walletClass: options2.walletClass || SparkWalletNodeJS,
     openLocalCache: options2.openLocalCache || ((cacheSeed, { uid, network }) => openLocalDataCache(cacheSeed, {
       homeDir: store.dir,
@@ -178423,23 +177679,22 @@ function createAccountRuntime(options2 = {}) {
 async function open(options2 = {}) {
   return createAccountRuntime(options2);
 }
-var vaultCrypto;
+var defaultKdfPool = null;
 var init_node = __esm(() => {
   init_index_node();
   init_vaultseed();
   init_cache();
   init_client();
   init_cloud2();
-  init_kdf2();
+  init_kdf_worker();
   init_machine();
   init_namespace2();
   init_passkey2();
   init_storage();
-  vaultCrypto = createVaultSeedCrypto(deriveVaultKey);
 });
 
 // src/fleet.js
-function positiveInteger(value, fallback, maximum = Number.MAX_SAFE_INTEGER) {
+function positiveInteger2(value, fallback, maximum = Number.MAX_SAFE_INTEGER) {
   const number = Math.floor(Number(value));
   return Number.isFinite(number) && number > 0 ? Math.min(number, maximum) : fallback;
 }
@@ -178536,6 +177791,9 @@ function publicAccount(record) {
     error: record.error || null
   });
 }
+function keepsSession(current, next) {
+  return current.profile === next.profile && current.accountIndex === next.accountIndex && current.username === next.username && current.network === next.network;
+}
 
 class Fleet {
   constructor(options2 = {}) {
@@ -178543,13 +177801,15 @@ class Fleet {
     this.openClient = options2.openClient || open;
     this.clientOptions = options2.clientOptions || {};
     this.eventOptions = options2.eventOptions || {};
-    this.bootConcurrency = positiveInteger(options2.bootConcurrency, DEFAULT_BOOT_CONCURRENCY, 32);
-    this.maxPendingEvents = positiveInteger(options2.maxPendingEvents, DEFAULT_EVENT_BACKLOG, 1e5);
-    this.startTimeoutMs = positiveInteger(options2.startTimeoutMs, DEFAULT_START_TIMEOUT_MS);
+    this.bootConcurrency = positiveInteger2(options2.bootConcurrency, DEFAULT_BOOT_CONCURRENCY, 32);
+    this.maxPendingEvents = positiveInteger2(options2.maxPendingEvents, DEFAULT_EVENT_BACKLOG, 1e5);
+    this.startTimeoutMs = positiveInteger2(options2.startTimeoutMs, DEFAULT_START_TIMEOUT_MS);
     this.policies = policyList(options2.policies);
     this.records = new Map;
     this.listeners = new Set;
     this.startedFleetPolicies = [];
+    this.policyReloading = false;
+    this.reloading = null;
     this.state = "idle";
     this.starting = null;
     this.stopping = null;
@@ -178615,8 +177875,6 @@ class Fleet {
     return operation(client2, publicAccount(record));
   }
   queuePolicies(record, event2) {
-    if (!this.policies.length)
-      return;
     record.pendingEvents += 1;
     if (record.pendingEvents > this.maxPendingEvents) {
       record.pendingEvents -= 1;
@@ -178630,6 +177888,18 @@ class Fleet {
       });
       return;
     }
+    if (this.policyReloading) {
+      record.reloadEvents.push(event2);
+      return;
+    }
+    if (!this.policies.length) {
+      record.pendingEvents -= 1;
+      return;
+    }
+    this.dispatchPolicies(record, event2);
+  }
+  dispatchPolicies(record, event2) {
+    const policies = this.policies;
     const context = Object.freeze({
       account: record.profile,
       client: record.client,
@@ -178637,7 +177907,7 @@ class Fleet {
       fleet: this
     });
     record.policyTail = record.policyTail.then(async () => {
-      for (const policy of this.policies) {
+      for (const policy of policies) {
         await policy.onEvent?.(context);
       }
     }).catch((error) => {
@@ -178663,6 +177933,7 @@ class Fleet {
       listenTask: Promise.resolve(),
       unsubscribeRevoked: () => {},
       startedPolicies: [],
+      reloadEvents: [],
       closed: false
     };
     this.records.set(profile.profile, record);
@@ -178728,6 +177999,167 @@ class Fleet {
     record.status = "ready";
     this.emit("account-ready", { account: publicAccount(record) });
   }
+  async stopRecordPolicies(record) {
+    const errors = [];
+    await record.policyTail.catch((error) => errors.push(error));
+    for (const policy of [...record.startedPolicies].reverse()) {
+      try {
+        await policy.stop?.({
+          account: record.profile,
+          client: record.client,
+          fleet: this
+        });
+      } catch (error) {
+        errors.push(error);
+      }
+    }
+    record.startedPolicies = [];
+    return errors;
+  }
+  async startRecordPolicies(record, policies, profile = record.profile) {
+    const started = [];
+    try {
+      for (const policy of policies) {
+        await policy.start?.({
+          account: profile,
+          client: record.client,
+          fleet: this
+        });
+        started.push(policy);
+      }
+      return started;
+    } catch (error) {
+      for (const policy of started.reverse()) {
+        await policy.stop?.({
+          account: profile,
+          client: record.client,
+          fleet: this
+        }).catch(() => {});
+      }
+      throw error;
+    }
+  }
+  flushReloadEvents() {
+    for (const record of this.records.values()) {
+      const events = record.reloadEvents.splice(0);
+      if (record.closed || record.status === "stopped") {
+        record.pendingEvents = Math.max(0, record.pendingEvents - events.length);
+        continue;
+      }
+      for (const item of events)
+        this.dispatchPolicies(record, item);
+    }
+    this.policyReloading = false;
+  }
+  async reconcile(options2 = {}) {
+    if (this.reloading)
+      return this.reloading;
+    if (this.state !== "running") {
+      throw new Error("fleet must be running to reload");
+    }
+    const profiles = normalizeFleetProfiles(options2.profiles);
+    const policies = policyList(options2.policies);
+    this.reloading = (async () => {
+      this.policyReloading = true;
+      this.emit("reload-start", {
+        fleet: {
+          state: "reloading",
+          accounts: profiles
+        }
+      });
+      const desired = new Map(profiles.filter((profile) => profile.enabled && profile.state === "ready").map((profile) => [profile.profile, profile]));
+      const retained = [];
+      const removed = [];
+      for (const record of this.records.values()) {
+        const next = desired.get(record.profile.profile);
+        if (next && record.status === "ready" && keepsSession(record.profile, next)) {
+          retained.push({ record, profile: next });
+          desired.delete(next.profile);
+        } else {
+          removed.push(record);
+        }
+      }
+      const prepared = [];
+      const preparedFleetPolicies = [];
+      try {
+        for (const policy of policies) {
+          await policy.startFleet?.({ profiles, fleet: this });
+          preparedFleetPolicies.push(policy);
+        }
+        for (const item of retained) {
+          const started = await this.startRecordPolicies(item.record, policies, item.profile);
+          prepared.push({ ...item, started });
+        }
+      } catch (error) {
+        for (const item of prepared.reverse()) {
+          for (const policy of item.started.reverse()) {
+            await policy.stop?.({
+              account: item.profile,
+              client: item.record.client,
+              fleet: this
+            }).catch(() => {});
+          }
+        }
+        if (preparedFleetPolicies.length) {
+          for (const policy of preparedFleetPolicies.reverse()) {
+            await policy.stopFleet?.({ profiles, fleet: this }).catch(() => {});
+          }
+        }
+        this.flushReloadEvents();
+        throw error;
+      }
+      const errors = [];
+      await Promise.all(removed.map(async (record) => {
+        errors.push(...await this.closeRecord(record));
+        this.records.delete(record.profile.profile);
+      }));
+      for (const item of retained) {
+        errors.push(...await this.stopRecordPolicies(item.record));
+      }
+      for (const policy of [...this.startedFleetPolicies].reverse()) {
+        try {
+          await policy.stopFleet?.({
+            profiles: this.profiles,
+            fleet: this
+          });
+        } catch (error) {
+          errors.push(error);
+        }
+      }
+      this.profiles = profiles;
+      this.policies = policies;
+      this.startedFleetPolicies = [...policies];
+      for (const item of prepared) {
+        item.record.profile = item.profile;
+        item.record.startedPolicies = item.started;
+      }
+      const added = [...desired.values()];
+      const bootResults = await Promise.allSettled(added.map((profile) => this.boot(profile)));
+      for (let index = 0;index < bootResults.length; index += 1) {
+        const result = bootResults[index];
+        if (result.status !== "rejected")
+          continue;
+        errors.push(result.reason);
+        const record = this.records.get(added[index].profile);
+        if (!record)
+          continue;
+        record.error = result.reason?.message || String(result.reason);
+        errors.push(...await this.closeRecord(record));
+      }
+      this.flushReloadEvents();
+      const status = this.status();
+      this.emit("reloaded", {
+        fleet: status,
+        errors: errors.map((error) => error?.message || String(error))
+      });
+      return status;
+    })().finally(() => {
+      if (this.policyReloading)
+        this.flushReloadEvents();
+      this.reloading = null;
+    });
+    return this.reloading;
+  }
   async start() {
     if (this.state === "running")
       return this.status();
@@ -178778,18 +178210,11 @@ class Fleet {
     };
     record.controller.abort();
     await attempt(() => record.listenTask);
-    await attempt(() => record.policyTail);
-    for (const policy of [...record.startedPolicies].reverse()) {
-      await attempt(() => policy.stop?.({
-        account: record.profile,
-        client: record.client,
-        fleet: this
-      }));
-    }
+    errors.push(...await this.stopRecordPolicies(record));
     await attempt(() => record.unsubscribeRevoked());
     await attempt(() => record.client?.close());
     record.closed = true;
-    record.status = errors.length ? "error" : "stopped";
+    record.status = errors.length || record.error ? "error" : "stopped";
     if (errors.length) {
       record.error = errors[0]?.message || String(errors[0]);
     }
@@ -179673,6 +179098,7 @@ class FleetOwner {
     this.homeDir = options2.homeDir || defaultHomeDir();
     this.openClient = options2.openClient || createAccountRuntime;
     this.policies = [...options2.policies || []];
+    this.policyLoader = options2.policyLoader || null;
     this.lock = options2.lock || new FleetOwnerLock({
       homeDir: this.homeDir,
       name: this.manifest.name,
@@ -179712,13 +179138,22 @@ class FleetOwner {
       throw new Error(`fleet account index missing: ${profile.profile}`);
     }
     const material = deriveFleetAccount(this.seed, profile.accountIndex);
+    const accountIndex = profile.accountIndex;
     try {
       return {
         ...await this.baseClientOptions(profile),
         homeDir: this.homeDir,
         activate: false,
         credential: material.credential,
-        vaultSecret: material.vaultSecret
+        vaultSecret: material.vaultSecret,
+        getVaultMasterSeed: () => {
+          const derived = deriveFleetAccount(this.seed, accountIndex);
+          try {
+            return derived.masterSeed.slice();
+          } finally {
+            derived.destroy();
+          }
+        }
       };
     } finally {
       material.destroy();
@@ -179768,6 +179203,33 @@ class FleetOwner {
     this.policies.push(policy);
     return this;
   }
+  setPolicyLoader(loader) {
+    if (typeof loader !== "function") {
+      throw new Error("fleet policy loader required");
+    }
+    this.policyLoader = loader;
+    return this;
+  }
+  reload() {
+    return this.mutate(async () => {
+      const manifest = await loadFleetManifest({
+        path: this.manifest.path
+      });
+      const policies = this.policyLoader ? await this.policyLoader() : this.policies;
+      if (!Array.isArray(policies)) {
+        throw new Error("fleet policy loader must return an array");
+      }
+      if (this.fleet) {
+        await this.fleet.reconcile({
+          profiles: manifest.profiles,
+          policies
+        });
+      }
+      this.manifest = manifest;
+      this.policies = [...policies];
+      return this.status();
+    });
+  }
   async stop() {
     if (!this.fleet) {
       await this.lock.release();