@glyphteck/veyl 0.51.0 → 0.55.0

package/docs/agents.md

@@ -2,7 +2,7 @@
 
 Use the JavaScript API for a long-running agent and the canonical CLI for one-off shell work. A local read-only MCP resource server can help an MCP-capable host discover the installed SDK documentation, but it cannot operate Veyl.
 
-Headless is not a privileged backend. It authenticates, decrypts the vault, signs wallet operations, encrypts/signs chat actions, and maintains encrypted local cache state exactly like web and iOS. Machine-created accounts are public bots; browser-created passkey accounts are normal human accounts.
+The SDK is not a privileged backend. It authenticates, decrypts the vault, signs wallet operations, encrypts/signs chat actions, and maintains encrypted local cache state exactly like web and iOS. Machine credentials and passkeys are authentication capabilities, not human-or-bot classifications. Third-party agents use ordinary public profiles; only namespace-authorized Glyphteck services carry the managed bot marker.
 
 ## Setup
 

package/docs/api.md

@@ -206,7 +206,7 @@ await veyl.account.logoutAll();
 await veyl.account.delete({ confirm: true });
 ```
 
-- `create` makes a machine-authenticated account publicly marked as a bot.
+- `create` makes an ordinary account authenticated by a local machine credential. Authentication does not assign a public bot label.
 - `createPasskey({ username, termsVersion, webUrl, onUrl })` creates a normal passkey account through a browser-assisted WebAuthn flow, then installs a local machine credential for future CLI sessions.
 - `login({ username?, credentialId?, privateKeyPem? })` authenticates a machine credential.
 - `loginPasskey({ username?, webUrl?, onUrl? })` authenticates through the browser-assisted passkey flow.
@@ -217,7 +217,7 @@ await veyl.account.delete({ confirm: true });
 - `logoutAll` revokes every product session generation, tears down this runtime locally, and stops a persistent CLI owner after its in-flight work drains.
 - `delete({ confirm: true })` drains decryptable inbox state, marks all discoverable chats deleted, destroys the complete account/network encrypted cache scope, proves vault possession, deletes identifiable account data, removes the local profile, and stops a persistent CLI owner after its in-flight work drains.
 
-Account summaries report identity, network, local credential/vault availability, public wallet/chat keys, auth kind, bot kind, and current signed-in/unlocked state. Private keys and vault secrets are never included in summaries.
+Account summaries report identity, network, local credential/vault availability, public wallet/chat keys, auth kind, an explicit managed-bot marker when assigned by Glyphteck's owner namespace, and current signed-in/unlocked state. Private keys and vault secrets are never included in summaries.
 
 ## Vault
 
@@ -319,7 +319,7 @@ const created = await veyl.invite.link({ kind: 'chat' });
 const parsed = veyl.invite.read(created.link);
 ```
 
-`kind` may be `join`, `chat`, `send`, or `request`; send/request links may include integer `sats`. These are direct URL strings produced and parsed by `core/invite.js`. Headless does not expose camera or QR behavior.
+`kind` may be `join`, `chat`, `send`, or `request`; send/request links may include integer `sats`. These are direct URL strings produced and parsed by `core/invite.js`. SDK does not expose camera or QR behavior.
 
 ## Wallet
 

package/docs/validation.md

@@ -39,7 +39,7 @@ API version 3 establishes `open()` as the public SDK composition root and remove
 | Group | CLI / session | Product owner used by the client |
 | --- | ---: | --- |
 | Namespace | 1 / 0 | owner-only local Ed25519 seed and portable reserved-name claim; intentionally not a persistent-session or general client capability |
-| Account | 8 / 8 | `core/account/user.js`, `core/account/session.js`; machine-auth transport in `functions/headless/account.js` |
+| Account | 8 / 8 | `core/account/user.js`, `core/account/session.js`; machine-auth transport in `functions/machineauth/account.js` |
 | Vault | 4 / 3 | `core/vault.js`, shared vault-seed crypto, and `core/account/session.js`; mnemonic export is not callable through the persistent session |
 | Profile | 3 / 3 | shared user owner and Firebase cloud adapter |
 | Settings | 2 / 2 | shared user settings owner and normalization |
@@ -48,7 +48,7 @@ API version 3 establishes `open()` as the public SDK composition root and remove
 | Chat | 21 / 21 | `core/chat/session.js`, the framework-free mounted message route, shared actions, message batches, history, retention, and attachment owners |
 | Wallet | 10 / 10 | `core/wallet/session.js`, claim, transfer-store, and tx-data owners |
 | Lightning | 5 / 5 | the same shared wallet session and Spark request owners |
-| Withdrawal | 3 / 3 | shared wallet session, fee normalization, and withdrawal review owner |
+| Withdrawal | 3 / 3 | shared wallet session, fee normalization, and generic payment-intent/L1 review owner |
 | Invite | 2 / 2 | `core/invite.js`; direct URL strings only |
 | Passkeys | 3 / 2 | shared passkey eligibility plus the normal cloud passkey owners; bearer-link creation is one-shot only and WebAuthn stays browser-assisted |
 | Support | 3 / 3 | shared feedback, bug, report, message lookup, and evidence builders |
@@ -87,7 +87,7 @@ API version 3 establishes `open()` as the public SDK composition root and remove
 - Deleted-chat tombstones prevent stale owner/list snapshots from resurrecting a locally deleted chat.
 - Multiple event subscribers share the underlying message-batch source lease.
 - Concurrent chat-list publications cannot attach the same event source twice and accidentally release its only lease; two subscribers each received two successive live messages exactly once.
-- Headless history and event projection use the same retention and reaction derivation primitives as route UI, including reaction removal updates to an already-visible message.
+- SDK history and event projection use the same retention and reaction derivation primitives as route UI, including reaction removal updates to an already-visible message.
 - Explicit message deletion emits immediate removal; retention/source expiry remains held for an already-open route until release.
 - Self-block is rejected, blocked state is reflected in returned/listed peer projections, and blocked chats are hidden.
 - Blocking retires the known opaque generation. If a sender writes into a newly issued generation while delivery remains blocked, the recipient's encrypted first-accepted timestamp floors every later listener, history page, cleanup scan, and direct lookup; the blocked-period record did not appear after unblocking and was rejected by targeted save lookup.
@@ -101,7 +101,7 @@ API version 3 establishes `open()` as the public SDK composition root and remove
 - Ambiguous money mutations expose `operation_outcome_unknown` with the caller operation id. Spark sends, request/invoice payments, and withdrawals are non-retryable until reconciled; Lightning is retryable only with the exact same idempotency key.
 - Invalid withdrawal input fails before wallet mutation.
 - A prepared withdrawal rejects when its post-fee output falls below the destination script's dust floor; the confirmed P2TR boundary is 330 sats.
-- The live CLI confirmation exposed that reviewed fee flags were not entering the command input, so it obtained a second quote; the fee happened to remain 2,190 sats. CLI confirmation now accepts the reviewed quote id and fee amount as one pair, a partial pair rejects before wallet work, and focused dispatch coverage proves the complete pair reaches the shared withdrawal mutation.
+- The live CLI confirmation exposed that reviewed fee flags were not entering the command input, so it obtained a second quote; the fee happened to remain 2,190 sats. CLI confirmation now accepts the reviewed quote id and fee amount as one pair, a partial pair rejects before wallet work, and focused dispatch coverage proves the complete pair reaches the shared Bitcoin payment mutation.
 - Static funding uses one identity-scoped confirmed-UTXO source. The former catch-all address-query fallback was removed so an upstream failure cannot double requests or silently change the privacy shape.
 - A live 810-sat static funding output was claimed once for 711 sats after the 99-sat claim fee. A second explicit claim returned false and history contained one completed funding row, proving idempotent convergence rather than a duplicate claim.
 - The receiver completed its funding claim before the sender's cooperative-exit transfer reached completed status. The existing outgoing reconciler stopped after two unresolved checks, so the sender row stayed pending until an explicit refresh. Cooperative exits now retain a bounded 15-second exact-transfer check for up to ten minutes; ordinary direct transfers keep the earlier low-cost stop policy.
@@ -112,7 +112,7 @@ API version 3 establishes `open()` as the public SDK composition root and remove
 - Account deletion removes the local profile, closes wallet/vault owners, drains in-flight local work, and automatically exits every current persistent runtime as soon as its credential/session watch becomes invalid.
 - Account deletion drains pending cache writes and destroys the account/network cache scope, including its install secret, rather than leaving encrypted remnants after the local profile is removed.
 - A send whose direct write response is ambiguous reuses its CID as the message document id and checks that exact committed document before reporting failure. The separate sealed ping may repeat in this rare case and is reconciled by its encrypted message id.
-- A disposable no-evidence peer report completed through the shared report/evidence builder, and deleting its reporter account removed the UID-owned report while repairing the target aggregate. Feedback/bug now share one backend input owner whose platform set includes headless.
+- A disposable no-evidence peer report completed through the shared report/evidence builder, and deleting its reporter account removed the UID-owned report while repairing the target aggregate. Feedback/bug share one backend input owner whose platform set includes the SDK.
 
 The blocked-send experiment exposed a real presentation bug—a committed ciphertext could be reported failed when the later ping was rejected—but its proposed atomic callable centralized sender/recipient IDs, both chat public keys, link ID, and chat ID on every send. The release review removed that architecture. Message and encrypted owner entry now commit directly in one client batch; the separate sealed-inbox call is best effort and cannot reverse the committed result. This preserves the narrow sender/recipient metadata exception required for block checks and sender-identifying push without joining it to the chat route.
 

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@glyphteck/veyl",
-    "license": "Apache-2.0",
+    "license": "SEE LICENSE IN LICENSE",
     "type": "module",
     "description": "Public JavaScript SDK and CLI for Veyl accounts, chat, and wallet payments.",
     "repository": {
@@ -25,6 +25,7 @@
         "examples/bot-fleet/policy.js",
         "examples/bot-fleet/runtime.js",
         "examples/bot-fleet/readme.md",
+        "LICENSE",
         "readme.md",
         "package.json"
     ],
@@ -40,5 +41,5 @@
         "start": "node src/cli.js",
         "lint": "eslint src --quiet"
     },
-    "version": "0.51.0"
+    "version": "0.55.0"
 }

package/readme.md

@@ -6,7 +6,7 @@ The SDK is a real client, not an admin API. It uses the same shared account, vau
 
 The public `open()` factory selects the Node runtime ports for filesystem profiles, Firebase transport, Spark, machine credentials, browser-assisted passkeys, and local encrypted cache. Official web and iOS clients use the `@glyphteck/veyl/auth` and `@glyphteck/veyl/account` entries with platform ports for the same passkey orchestration, authenticated user, encrypted settings, public-profile mutation, vault, network, presence, wallet, transfer, transaction, public Bitcoin data, chat-session, peer-directory, profile-search, support/reporting, authenticated push leases, account deletion, and teardown owners. They do not carry separate auth, passkey, account, profile, peer, search, chat, wallet, Bitcoin, transfer, transaction, settings, support, or deletion state machines. The browser/native credential ceremony, native notification presentation, and device-local credential cleanup remain platform behavior.
 
-## Install
+## Install the SDK
 
 ```bash
 npm install @glyphteck/veyl
@@ -14,51 +14,49 @@ npm install @glyphteck/veyl
 # or: bun add @glyphteck/veyl
 ```
 
-One-off CLI:
+## JavaScript quick start
 
-```bash
-npx -y @glyphteck/veyl help
+```js
+import { open, TERMS_VERSION } from '@glyphteck/veyl';
+
+const veyl = await open({ profile: 'runner', network: 'REGTEST' });
+await veyl.account.create({ username: 'runner', termsVersion: TERMS_VERSION });
+await veyl.vault.create();
+await veyl.chat.send('@alice', 'hello');
+console.log(await veyl.wallet.balance());
+await veyl.close();
 ```
 
-## Start
+The human or controlling application must show the public Terms and Community Rules and obtain explicit agreement before creating an account. Machine credentials and passkeys describe authentication capability, not whether a person or agent operates the account. Third-party agents use ordinary public profiles; only namespace-authorized Glyphteck services carry the managed bot marker. Use `REGTEST` for disposable automation and `MAINNET` only for real funds.
+
+## Optional CLI
+
+The package also ships a CLI for one-off shell work:
 
 ```bash
-veyl --network REGTEST account create @runner
-veyl vault create
-veyl account show
-veyl wallet address
+npx veyl --network REGTEST account create @runner
+npx veyl vault create
+npx veyl account show
+npx veyl wallet address
 ```
 
 Interactive account creation displays the public Terms and Community Rules URLs and asks for acceptance. Non-interactive callers must pass the exact current version:
 
 ```bash
-veyl --network REGTEST account create @runner --accept-terms 2026-07-15
+npx veyl --network REGTEST account create @runner --accept-terms 2026-07-15
 ```
 
-Machine-created accounts are publicly marked as bots. To create or log into a normal passkey account from a browser-capable terminal, add `--passkey` to `account create` or `account login`.
+To create or log into a normal passkey account from a browser-capable terminal, add `--passkey` to `account create` or `account login`.
 
 Glyphteck's owner-only reserved namespace uses one local key:
 
 ```bash
-veyl namespace init
-veyl --network REGTEST account create @faucet --reserved
+npx veyl namespace init
+npx veyl --network REGTEST account create @faucet --reserved
 ```
 
 Initialization writes the private seed only to `~/.veyl/namespace.seed` with mode `0600` and prints its public identity. The explicit `--reserved` account flow and Glyphteck fleet provisioning sign an exact, short-lived reserved-name claim when that file exists. General users do not possess the key and remain unable to claim reserved names.
 
-## JavaScript
-
-```js
-import { open, TERMS_VERSION } from '@glyphteck/veyl';
-
-const veyl = await open({ profile: 'runner', network: 'REGTEST' });
-await veyl.account.create({ username: 'runner', termsVersion: TERMS_VERSION });
-await veyl.vault.create();
-await veyl.chat.send('@alice', 'hello');
-console.log(await veyl.wallet.balance());
-await veyl.close();
-```
-
 Long-running agents should keep one unlocked client or foreground session alive. This reuses the same wallet, peer, chat, cache, and live-listener owners instead of paying cold login and wallet boot cost for every command.
 
 Agents can also mount one conversation through `veyl.chat.enter('@alice')`, or run one local `openFleetOwner(...)` for many accounts. A versioned fleet root derives isolated machine credentials, vault-unlock secrets, and Veyl master seeds by monotonically allocated account index, so the operator backs up one secret for an unbounded fleet. Fleet policies remain normal API consumers; they receive no Firebase Admin or wallet shortcuts.
@@ -105,3 +103,7 @@ Use `REGTEST` for development and disposable accounts. Use `MAINNET` only for re
 - [Agent operation](docs/agents.md)
 - [Documentation discovery](docs/discovery.md)
 - [Parity and validation](docs/validation.md)
+
+## License
+
+The official Veyl JavaScript SDK is distributed under its [proprietary SDK license](LICENSE); it is not currently open source. The license permits use of the unmodified SDK with Veyl, including normal compiled or bundled use, but not modified or standalone redistribution.