@glyphteck/veyl 0.57.0 → 0.58.0

package/dist/index.js

@@ -46,26 +46,6 @@ var __export = (target, all) => {
 var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
-// ../../core/agreement.js
-function hasCurrentAgreement(user) {
-  const agreement = user?.agreement;
-  return agreement?.termsVersion === CURRENT_AGREEMENT.termsVersion && agreement?.communityRulesVersion === CURRENT_AGREEMENT.communityRulesVersion && !!agreement?.acceptedAt;
-}
-function requireCurrentTermsVersion(value) {
-  const version = typeof value === "string" ? value.trim() : "";
-  if (version !== TERMS_VERSION) {
-    throw new Error(`Current Terms version ${TERMS_VERSION} must be accepted.`);
-  }
-  return version;
-}
-var TERMS_VERSION = "2026-07-15", COMMUNITY_RULES_VERSION = "2026-05-11.1", CURRENT_AGREEMENT;
-var init_agreement = __esm(() => {
-  CURRENT_AGREEMENT = Object.freeze({
-    termsVersion: TERMS_VERSION,
-    communityRulesVersion: COMMUNITY_RULES_VERSION
-  });
-});
-
 // ../../node_modules/.bun/@noble+hashes@2.2.0/node_modules/@noble/hashes/utils.js
 function isBytes(a) {
   return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array" && "BYTES_PER_ELEMENT" in a && a.BYTES_PER_ELEMENT === 1;
@@ -8777,6 +8757,19 @@ var init_avatar = __esm(() => {
   AVATAR_VERSION_RE = /^[0-9a-f]{64}$/;
 });
 
+// ../../core/agreement.js
+function hasCurrentAgreement(user) {
+  const agreement = user?.agreement;
+  return agreement?.termsVersion === CURRENT_AGREEMENT.termsVersion && agreement?.communityRulesVersion === CURRENT_AGREEMENT.communityRulesVersion && !!agreement?.acceptedAt;
+}
+var TERMS_VERSION = "2026-07-15", COMMUNITY_RULES_VERSION = "2026-05-11.1", CURRENT_AGREEMENT;
+var init_agreement = __esm(() => {
+  CURRENT_AGREEMENT = Object.freeze({
+    termsVersion: TERMS_VERSION,
+    communityRulesVersion: COMMUNITY_RULES_VERSION
+  });
+});
+
 // ../../core/utils/time.js
 function timestampMs(value, fallback = null, options = {}) {
   let ms = null;
@@ -32453,9 +32446,9 @@ function stopped(signal) {
 }
 async function listenAccount(client, options = {}) {
   const messageSource = nextListenerSource();
-  const compact2 = options.compact === true || options.agent === true;
-  const incomingOnly = options.incomingOnly === false ? false : options.incomingOnly === true || options.incoming === true || options.agent === true;
-  const transientChats = options.agent === true && options.persistentChats !== true;
+  const compact2 = options.compact !== false;
+  const incomingOnly = options.incomingOnly !== false;
+  const transientChats = options.persistentChats !== true;
   const chatCount = cleanCount(options.chatCount || options.chats, DEFAULT_CHAT_COUNT, 500);
   const messageCount = cleanCount(options.messageCount || options.messages, DEFAULT_MESSAGE_COUNT);
   const replayMessageLimit = cleanCount(options.replayMessageLimit, DEFAULT_REPLAY_MESSAGE_LIMIT, DEFAULT_REPLAY_MESSAGE_LIMIT);
@@ -32614,7 +32607,7 @@ async function listenAccount(client, options = {}) {
       }
       page.release?.();
       if (count >= replayMessageLimit) {
-        throw new Error(`agent replay checkpoint not found: ${chat.id}`);
+        throw new Error(`listener replay checkpoint not found: ${chat.id}`);
       }
       count = Math.min(replayMessageLimit, count * 2);
     }
@@ -41131,7 +41124,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "veyl",
-    version: "0.57.0",
+    version: "0.58.0",
     private: true,
     license: "UNLICENSED",
     workspaces: {
@@ -41248,15 +41241,13 @@ function cleanOptionalUsername(value) {
 }
 function agreementSummary(user) {
   const agreement = user?.agreement || null;
-  const acceptedAt = timestampMs(agreement?.acceptedAt);
   return {
-    current: { ...CURRENT_AGREEMENT },
-    accepted: agreement ? {
-      termsVersion: agreement.termsVersion || null,
-      communityRulesVersion: agreement.communityRulesVersion || null,
-      acceptedAt
-    } : null,
-    currentAccepted: hasCurrentAgreement(user)
+    links: {
+      terms: links.terms,
+      communityRules: links.communityRules
+    },
+    accepted: hasCurrentAgreement(user),
+    acceptedAt: timestampMs(agreement?.acceptedAt)
   };
 }
 function cleanTargetValue(value) {
@@ -41530,10 +41521,10 @@ class AccountRuntime {
       uid: profile.uid,
       username: profile.username,
       profile: profile.profile,
-      credentialId: profile.credentialId,
       network: this.session?.network || profile.network || this.network,
+      hasAccountKey: !!(profile.privateKeyPem || this.options.accountKey || this.options.credential?.privateKeyPem),
       hasVault: profile.hasVault === true,
-      hasVaultSecret: !!(profile.vaultSecret || this.options.vaultSecret),
+      hasVaultKey: !!(profile.vaultSecret || this.options.vaultKey),
       walletPK: profile.walletPK || null,
       chatPK: profile.chatPK || null,
       notificationPK: profile.notificationPK || null,
@@ -41559,7 +41550,6 @@ class AccountRuntime {
     const username = cleanUsername3(options.username);
     const profileName = this.store.profile || username;
     const network = String(options.network || this.network).toUpperCase();
-    const termsVersion = requireCurrentTermsVersion(options.termsVersion);
     const machine = options.credential || this.options.credential || this.ports.createCredential();
     const namespaceKeyPath = options.namespaceKeyPath || this.options.namespaceKeyPath;
     const namespaceClaim = options.namespaceClaim || (namespaceKeyPath ? await this.ports.signNamespaceClaim({
@@ -41571,7 +41561,7 @@ class AccountRuntime {
     const start = await this.callAccountEndpoint("/account/create/start", {
       username,
       publicKeyPem: machine.publicKeyPem,
-      termsVersion,
+      termsVersion: TERMS_VERSION,
       ...namespaceClaim ? { namespaceClaim } : {}
     });
     const finish = await this.callAccountEndpoint("/account/create/finish", {
@@ -41580,33 +41570,30 @@ class AccountRuntime {
     });
     await this.ports.signIn(this.auth, finish.token);
     this.autoLogin = true;
-    const profile = await this.saveProfile({
+    await this.saveProfile({
       profile: profileName,
       username,
       uid: finish.uid,
       network,
       credentialId: finish.credentialId || machine.credentialId,
       publicKeyPem: machine.publicKeyPem,
-      privateKeyPem: options.saveCredential === false ? null : machine.privateKeyPem,
+      privateKeyPem: options.saveKey === false ? null : machine.privateKeyPem,
       auth: "machine",
       bot: finish.bot === BOT_PROFILE_MARKER ? BOT_PROFILE_MARKER : null,
       createdAt: Date.now(),
       hasVault: false
     });
-    return {
-      ...this.accountSummary(profile),
-      publicKeyPem: machine.publicKeyPem,
-      privateKeyPem: machine.privateKeyPem
-    };
+    return machine.privateKeyPem;
   }
   async loginAccount(options = {}) {
     const username = cleanOptionalUsername(options.username);
     const profile = await this.loadProfile(this.store.profile || username);
-    const credential = options.credential || this.options.credential;
-    const credentialId = options.credentialId || credential?.credentialId || profile.credentialId;
-    const privateKeyPem = options.privateKeyPem || credential?.privateKeyPem || profile.privateKeyPem;
+    const key = String(options.key || this.options.accountKey || this.ports.env?.VEYL_ACCOUNT_KEY || "").trim();
+    const credential = options.credential || this.options.credential || (key ? this.ports.readCredential(key) : null);
+    const credentialId = credential?.credentialId || profile.credentialId;
+    const privateKeyPem = credential?.privateKeyPem || profile.privateKeyPem;
     if (!credentialId || !privateKeyPem) {
-      throw new Error("machine credential required");
+      throw new Error("account key required");
     }
     const namespaceKeyPath = options.namespaceKeyPath || this.options.namespaceKeyPath;
     const namespaceClaim = options.namespaceClaim || (namespaceKeyPath ? await this.ports.signNamespaceClaim({
@@ -41630,6 +41617,8 @@ class AccountRuntime {
       uid: finish.uid || profile.uid,
       username: finish.username || profile.username,
       credentialId,
+      publicKeyPem: credential?.publicKeyPem || profile.publicKeyPem,
+      privateKeyPem: options.saveKey === false ? profile.privateKeyPem || null : privateKeyPem,
       bot: finish.bot === BOT_PROFILE_MARKER ? BOT_PROFILE_MARKER : null,
       lastLoginAt: Date.now()
     });
@@ -41653,38 +41642,32 @@ class AccountRuntime {
     const username = cleanUsername3(options.username);
     const profileName = this.store.profile || username;
     const network = String(options.network || this.network).toUpperCase();
-    const termsVersion = requireCurrentTermsVersion(options.termsVersion);
     const flow = await this.ports.runPasskeyFlow({
       mode: "create",
       label: options.label || username,
       webUrl: options.webUrl,
       timeoutMs: options.timeoutMs,
       onUrl: options.onPasskeyUrl,
-      termsVersion
+      termsVersion: TERMS_VERSION
     });
     const user = await this.ports.signIn(this.auth, flow.token);
     this.autoLogin = true;
     await this.accountOwner.profile.setUsername(username);
     const machine = options.credential || this.ports.createCredential();
     const credential = machine ? await this.addMachineCredential(machine) : null;
-    const profile = await this.saveProfile({
+    await this.saveProfile({
       profile: profileName,
       username,
       uid: user.uid,
       network,
       credentialId: credential?.credentialId || machine?.credentialId || null,
       publicKeyPem: machine?.publicKeyPem || null,
-      privateKeyPem: options.saveCredential === false ? null : machine?.privateKeyPem || null,
+      privateKeyPem: options.saveKey === false ? null : machine?.privateKeyPem || null,
       auth: "passkey",
       createdAt: Date.now(),
       hasVault: false
     });
-    return {
-      ...this.accountSummary(profile),
-      passkey: true,
-      publicKeyPem: machine?.publicKeyPem || null,
-      privateKeyPem: machine?.privateKeyPem || null
-    };
+    return machine.privateKeyPem;
   }
   async loginPasskeyAccount(options = {}) {
     const requested = cleanOptionalUsername(options.username);
@@ -41700,7 +41683,7 @@ class AccountRuntime {
     this.autoLogin = true;
     const username = await this.readUsername(user.uid, stored?.username || requested);
     const hasSavedCredential = !!(stored?.credentialId && stored?.privateKeyPem);
-    const machine = hasSavedCredential ? null : options.credential || this.ports.createCredential();
+    const machine = hasSavedCredential ? null : options.credential || (options.saveKey === false ? null : this.ports.createCredential());
     const credential = machine ? await this.addMachineCredential(machine) : null;
     const profile = await this.saveProfile({
       ...stored || {},
@@ -41710,17 +41693,12 @@ class AccountRuntime {
       network: String(stored?.network || options.network || this.network).toUpperCase(),
       credentialId: credential?.credentialId || stored?.credentialId || machine?.credentialId || null,
       publicKeyPem: machine?.publicKeyPem || stored?.publicKeyPem || null,
-      privateKeyPem: options.saveCredential === false ? stored?.privateKeyPem || null : machine?.privateKeyPem || stored?.privateKeyPem || null,
+      privateKeyPem: options.saveKey === false ? stored?.privateKeyPem || null : machine?.privateKeyPem || stored?.privateKeyPem || null,
       auth: "passkey",
       bot: null,
       lastLoginAt: Date.now()
     });
-    return {
-      ...this.accountSummary(profile),
-      passkey: true,
-      publicKeyPem: machine?.publicKeyPem || null,
-      privateKeyPem: machine?.privateKeyPem || null
-    };
+    return this.accountSummary(profile);
   }
   async me() {
     const profile = await this.store.load();
@@ -41756,7 +41734,7 @@ class AccountRuntime {
       throw new Error("account login required");
     }
     if (profile.auth === "passkey" && (!profile.credentialId || !profile.privateKeyPem)) {
-      await this.loginPasskeyAccount({ username: profile.profile, saveCredential: false });
+      await this.loginPasskeyAccount({ username: profile.profile, saveKey: false });
       return this.profileData;
     }
     await this.loginAccount({
@@ -41783,7 +41761,6 @@ class AccountRuntime {
     return agreementSummary(await this.readyAccountUser(options));
   }
   async acceptAccountTerms(options = {}) {
-    requireCurrentTermsVersion(options.termsVersion);
     const user = await this.readyAccountUser(options);
     if (!hasCurrentAgreement(user)) {
       await user.acceptAgreement();
@@ -41871,9 +41848,9 @@ class AccountRuntime {
     if (await this.cloud.user.vault.exists(profile.uid)) {
       throw new Error("vault already exists");
     }
-    const vaultSecret = String(options.secret || this.options.vaultSecret || this.ports.env?.VEYL_VAULT_SECRET || this.ports.randomSecret()).trim();
+    const vaultSecret = String(options.key || this.options.vaultKey || this.ports.env?.VEYL_VAULT_KEY || this.ports.randomSecret()).trim();
     if (!vaultSecret) {
-      throw new Error("vault secret required");
+      throw new Error("vault key required");
     }
     const encrypted = options.masterSeed ? await this.ports.vaultCrypto.encryptMasterSeed(options.masterSeed, vaultSecret, { registry: options.registry }) : await this.ports.vaultCrypto.encryptSeed(vaultSecret, { registry: options.registry });
     const vault = packSeedData(encrypted);
@@ -41882,7 +41859,7 @@ class AccountRuntime {
     const next = await this.saveProfile({
       ...profile,
       hasVault: true,
-      vaultSecret: options.saveSecret === false ? null : vaultSecret,
+      vaultSecret: options.saveKey === false ? null : vaultSecret,
       network: session.network,
       walletPK: session.walletPK,
       chatPK: session.chatPK,
@@ -41891,16 +41868,13 @@ class AccountRuntime {
     });
     this.session.account = this.accountSummary(next);
     this.trackWalletIdentity(session);
-    return {
-      ...this.accountSummary(next),
-      vaultSecret
-    };
+    return vaultSecret;
   }
   async exportWallet(options = {}) {
     const profile = await this.ensureAuth();
-    const vaultSecret = String(options.secret || this.options.vaultSecret || this.ports.env?.VEYL_VAULT_SECRET || profile.vaultSecret || "").trim();
+    const vaultSecret = String(options.key || this.options.vaultKey || this.ports.env?.VEYL_VAULT_KEY || profile.vaultSecret || "").trim();
     if (!vaultSecret) {
-      throw new Error("vault secret required");
+      throw new Error("vault key required");
     }
     const vault = await this.cloud.user.vault.read(profile.uid);
     if (!vault) {
@@ -41916,9 +41890,9 @@ class AccountRuntime {
     if (this.session) {
       return this.accountSummary(profile);
     }
-    const vaultSecret = String(options.secret || this.options.vaultSecret || this.ports.env?.VEYL_VAULT_SECRET || profile.vaultSecret || "").trim();
+    const vaultSecret = String(options.key || this.options.vaultKey || this.ports.env?.VEYL_VAULT_KEY || profile.vaultSecret || "").trim();
     if (!vaultSecret) {
-      throw new Error("vault secret required");
+      throw new Error("vault key required");
     }
     const vault = await this.cloud.user.vault.read(profile.uid);
     if (!vault) {
@@ -41928,7 +41902,7 @@ class AccountRuntime {
     const next = await this.saveProfile({
       ...profile,
       hasVault: true,
-      vaultSecret: options.saveSecret === false ? profile.vaultSecret || null : profile.vaultSecret || vaultSecret,
+      vaultSecret: options.saveKey === false ? profile.vaultSecret || null : profile.vaultSecret || vaultSecret,
       network: session.network,
       walletPK: session.walletPK || profile.walletPK || null,
       chatPK: session.chatPK,
@@ -42163,7 +42137,7 @@ class AccountRuntime {
     }
   }
 }
-var API_VERSION = 3, REQUIRED_FUNCTION_PORTS;
+var API_VERSION = 4, REQUIRED_FUNCTION_PORTS;
 var init_client = __esm(() => {
   init_values();
   init_pack();
@@ -42174,6 +42148,7 @@ var init_client = __esm(() => {
   init_username();
   init_time();
   init_vault();
+  init_links();
   init_account();
   init_auth();
   init_listen();
@@ -42184,6 +42159,7 @@ var init_client = __esm(() => {
     "openLocalCache",
     "runPasskeyFlow",
     "createCredential",
+    "readCredential",
     "signChallenge",
     "signNamespaceClaim",
     "signIn",
@@ -177108,6 +177084,16 @@ function credentialIdForPublicKey(publicKeyPem) {
   }
   return createHash3("sha256").update(key).digest("base64url");
 }
+function machineCredential(privateKey, publicKey) {
+  const publicKeyPem = publicKey.export({ type: "spki", format: "pem" });
+  const privateKeyPem = privateKey.export({ type: "pkcs8", format: "pem" });
+  return {
+    type: "ed25519",
+    credentialId: credentialIdForPublicKey(publicKeyPem),
+    publicKeyPem,
+    privateKeyPem
+  };
+}
 function createMachineCredential(options2 = {}) {
   let privateKey;
   let publicKey;
@@ -177132,15 +177118,11 @@ function createMachineCredential(options2 = {}) {
   } else {
     ({ privateKey, publicKey } = generateKeyPairSync("ed25519"));
   }
-  const publicKeyPem = publicKey.export({ type: "spki", format: "pem" });
-  const privateKeyPem = privateKey.export({ type: "pkcs8", format: "pem" });
-  const credentialId = credentialIdForPublicKey(publicKeyPem);
-  return {
-    type: "ed25519",
-    credentialId,
-    publicKeyPem,
-    privateKeyPem
-  };
+  return machineCredential(privateKey, publicKey);
+}
+function readMachineCredential(key) {
+  const privateKey = createPrivateKey(String(key ?? ""));
+  return machineCredential(privateKey, createPublicKey(privateKey));
 }
 function signMachineChallenge(privateKeyPem, challenge2) {
   const key = createPrivateKey(String(privateKeyPem ?? ""));
@@ -177650,6 +177632,7 @@ function createNodePorts(options2 = {}) {
     })),
     runPasskeyFlow: options2.runPasskeyFlow || runPasskeyBrowserFlow,
     createCredential: options2.createCredential || createMachineCredential,
+    readCredential: options2.readCredential || readMachineCredential,
     signChallenge: options2.signChallenge || signMachineChallenge,
     signNamespaceClaim: options2.signNamespaceClaim || signNamespaceClaim,
     signIn: options2.signIn || signInRuntime,
@@ -177957,7 +177940,6 @@ class Fleet {
     }) || (() => {});
     const accountEventOptions = typeof this.eventOptions === "function" ? await this.eventOptions(profile) : this.eventOptions;
     record.listenTask = record.client.listen({
-      ...DEFAULT_EVENT_OPTIONS,
       ...accountEventOptions || {},
       signal: controller.signal,
       onEvent: (event2) => {
@@ -178251,13 +178233,9 @@ class Fleet {
 function createFleet(options2 = {}) {
   return new Fleet(options2);
 }
-var DEFAULT_BOOT_CONCURRENCY = 4, DEFAULT_EVENT_BACKLOG = 1000, DEFAULT_START_TIMEOUT_MS = 30000, DEFAULT_EVENT_OPTIONS;
+var DEFAULT_BOOT_CONCURRENCY = 4, DEFAULT_EVENT_BACKLOG = 1000, DEFAULT_START_TIMEOUT_MS = 30000;
 var init_fleet = __esm(() => {
   init_node();
-  DEFAULT_EVENT_OPTIONS = Object.freeze({
-    agent: true,
-    replay: false
-  });
 });
 
 // src/fleet-journal.js
@@ -179130,7 +179108,7 @@ class FleetOwner {
         homeDir: this.homeDir,
         activate: false,
         credential: material.credential,
-        vaultSecret: material.vaultSecret,
+        vaultKey: material.vaultSecret,
         namespaceKeyPath: this.options.namespaceKeyPath,
         getVaultMasterSeed: () => {
           const derived = deriveFleetAccount(this.seed, accountIndex);
@@ -179264,7 +179242,6 @@ class FleetOwner {
         throw new Error("stop the fleet owner before provisioning an account");
       }
       return this.withStoppedOwnerLock(async () => {
-        requireCurrentTermsVersion(input.termsVersion);
         const record = accountRecord(input, this.manifest.nextAccountIndex);
         if (this.slot(record.profile)) {
           throw new Error(`fleet profile exists: ${record.profile}`);
@@ -179273,30 +179250,23 @@ class FleetOwner {
           throw new Error(`fleet username exists: ${record.username}`);
         }
         await this.saveProfiles([...this.manifest.profiles, record], record.accountIndex + 1);
-        return this.finishProvision(record, {
-          create: true,
-          termsVersion: input.termsVersion
-        });
+        return this.finishProvision(record, { create: true });
       });
     });
   }
-  resume(profile, options2 = {}) {
+  resume(profile) {
     return this.mutate(async () => {
       if (this.fleet) {
         throw new Error("stop the fleet owner before resuming provisioning");
       }
       return this.withStoppedOwnerLock(async () => {
-        requireCurrentTermsVersion(options2.termsVersion);
         const record = this.slot(profile);
         if (!record)
           throw new Error("fleet profile not found");
         if (record.state !== "provisioning") {
           throw new Error("fleet profile is already provisioned");
         }
-        return this.finishProvision(record, {
-          create: false,
-          termsVersion: options2.termsVersion
-        });
+        return this.finishProvision(record, { create: false });
       });
     });
   }
@@ -179328,7 +179298,7 @@ class FleetOwner {
       homeDir: this.homeDir,
       activate: false,
       credential: material.credential,
-      vaultSecret: material.vaultSecret,
+      vaultKey: material.vaultSecret,
       namespaceKeyPath: this.options.namespaceKeyPath,
       namespaceKeyOptional: true
     }, record);
@@ -179336,13 +179306,13 @@ class FleetOwner {
       let account = await client2.account.me();
       if (!account?.uid) {
         if (options2.create) {
-          account = await client2.account.create({
+          await client2.account.create({
             username: record.username,
             network: record.network,
-            termsVersion: options2.termsVersion,
             credential: material.credential,
-            saveCredential: false
+            saveKey: false
           });
+          account = await client2.account.me();
         } else {
           try {
             account = await client2.account.login({
@@ -179351,13 +179321,13 @@ class FleetOwner {
           } catch (error) {
             if (error?.code !== "not-found")
               throw error;
-            account = await client2.account.create({
+            await client2.account.create({
               username: record.username,
               network: record.network,
-              termsVersion: options2.termsVersion,
               credential: material.credential,
-              saveCredential: false
+              saveKey: false
             });
+            account = await client2.account.me();
           }
         }
       } else {
@@ -179366,12 +179336,13 @@ class FleetOwner {
         });
       }
       if (account.hasVault !== true) {
-        account = await client2.vault.create({
-          secret: material.vaultSecret,
+        await client2.vault.create({
+          key: material.vaultSecret,
           masterSeed: material.masterSeed,
           registry: material.registry,
-          saveSecret: false
+          saveKey: false
         });
+        account = await client2.account.me();
       } else {
         await client2.ensureUnlocked();
         account = await client2.account.me();
@@ -179416,7 +179387,6 @@ async function openFleetOwner(options2 = {}) {
   });
 }
 var init_fleet_owner = __esm(() => {
-  init_agreement();
   init_username();
   init_node();
   init_fleet_manifest();
@@ -179673,7 +179643,6 @@ __export(exports_src, {
   cleanProfileName: () => cleanProfileName,
   callFleetControl: () => callFleetControl,
   VERSION: () => VERSION,
-  TERMS_VERSION: () => TERMS_VERSION,
   SdkError: () => SdkError,
   ProfileStore: () => ProfileStore,
   OPERATION_OUTCOME_UNKNOWN_CODE: () => OPERATION_OUTCOME_UNKNOWN_CODE,
@@ -179690,7 +179659,6 @@ __export(exports_src, {
   API_VERSION: () => API_VERSION
 });
 var init_src = __esm(() => {
-  init_agreement();
   init_account();
   init_auth();
   init_client();
@@ -179737,7 +179705,6 @@ export {
   cleanProfileName,
   callFleetControl,
   VERSION,
-  TERMS_VERSION,
   SdkError,
   ProfileStore,
   OPERATION_OUTCOME_UNKNOWN_CODE,

package/docs/agents.md

@@ -6,19 +6,21 @@ The SDK is not a privileged backend. It authenticates, decrypts the vault, signs
 
 ## Setup
 
+Creating an account accepts Veyl's [Terms](https://veyl.glyphteck.com/legal#terms) and [Community Rules](https://veyl.glyphteck.com/community-rules).
+
 ```js
-import { open, TERMS_VERSION } from '@glyphteck/veyl';
+import { open } from '@glyphteck/veyl';
 
-const veyl = await open({ profile: 'runner', network: 'REGTEST' });
-await veyl.account.create({
+const veyl = await open({ network: 'REGTEST' });
+const accountKey = await veyl.account.create({
   username: 'runner',
-  termsVersion: TERMS_VERSION,
-  saveCredential: true,
 });
-await veyl.vault.create({ saveSecret: true });
+const vaultKey = await veyl.vault.create();
 ```
 
-The human or controlling application must be shown the public Terms and Community Rules and explicitly agree before creation. Never infer agreement. Use `REGTEST` for disposable automation.
+The first call returns the account key used to authenticate this machine. The second returns the vault key that unlocks the vault and every feature derived from it. The SDK saves both in the local profile by default; treat both returned values as secrets.
+
+Use `REGTEST` for disposable automation.
 
 For existing accounts:
 
@@ -35,7 +37,6 @@ Keep that client alive. Repeated cold CLI invocations re-run authentication, vau
 const controller = new AbortController();
 
 await veyl.listen({
-  agent: true,
   replay: false,
   signal: controller.signal,
   async onEvent(event) {
@@ -51,7 +52,7 @@ await veyl.listen({
 });
 ```
 
-This is a live subscription to shared chat-list and transfer state, not a polling loop. In the default agent mode, a changed chat is opened briefly and released after processing, so hundreds of peers do not become hundreds of retained message listeners. A long-lived fleet can opt into `persistentChats: true` with `persistentChatIdleMs` to keep active conversations mounted, mark peer messages read before policy effects, and release only idle conversations; the account-level chat-list subscription reopens them when new activity arrives. Each listener has independent replay/filter state. Slow callbacks should hand work to an application queue if they must preserve event throughput.
+This is a live subscription to shared chat-list and transfer state, not a polling loop. By default it emits compact peer-authored events and opens a changed chat only long enough to process it, so hundreds of peers do not become hundreds of retained message listeners. Set `compact: false` or `incomingOnly: false` when complete payloads or self-authored messages are required. A long-lived fleet can opt into `persistentChats: true` with `persistentChatIdleMs` to keep active conversations mounted, mark peer messages read before policy effects, and release only idle conversations; the account-level chat-list subscription reopens them when new activity arrives. Each listener has independent replay/filter state. Slow callbacks should hand work to an application queue if they must preserve event throughput.
 
 Compact message events include reusable `replyTo` and `reactTo` targets. Transaction events carry the same simplified transfer shape returned by wallet history.
 
@@ -70,7 +71,7 @@ unsubscribe();
 
 The mounted route preserves its coherent transcript and retention lifecycle until leave. Account-wide `listen` remains the wakeup surface; entered chat is the focused conversation surface.
 
-For multiple agent identities, run one local `openFleetOwner`. It derives every account's machine credential, vault-unlock secret, and Veyl master seed from one versioned root and account index. It opens one normal public client per secret-free manifest profile, tags each event with its account, and runs host policies above those clients. It grants no admin access and bypasses no product owner.
+For multiple agent identities, run one local `openFleetOwner`. It derives every account's machine credential, vault key, and Veyl master seed from one versioned root and account index. It opens one normal public client per secret-free manifest profile, tags each event with its account, and runs host policies above those clients. It grants no admin access and bypasses no product owner.
 
 ```js
 import { openFleetOwner } from '@glyphteck/veyl';
@@ -82,7 +83,7 @@ fleet.use(agentPolicy);
 await fleet.start();
 ```
 
-Back up the fleet root once. The manifest and local profiles contain public account metadata, not derived private keys or vault secrets. Account indexes are never reused.
+Back up the fleet root once. The manifest and local profiles contain public account metadata, not derived account or vault keys. Account indexes are never reused.
 
 ## Error policy
 
@@ -109,7 +110,7 @@ Then issue commands from other processes through the owner-only local socket:
 veyl --profile runner --session default wallet balance
 veyl --profile runner --session default chat send @alice "hello"
 veyl --profile runner --session default chat enter @alice
-veyl --profile runner --session default session events --agent
+veyl --profile runner --session default session events
 veyl --profile runner --session default session stop
 ```
 
@@ -119,7 +120,7 @@ An entered chat remains mounted in the foreground session if its output shell di
 
 ## Safety rules
 
-- Treat `vault export`, machine private keys, vault secrets, passkey link URLs, invoices, and signed withdrawal material as sensitive.
+- Treat `vault export`, account keys, vault keys, passkey link URLs, invoices, and signed withdrawal material as sensitive.
 - Never log a passkey link URL; it is a one-time account-access credential.
 - Never call account deletion or withdrawal confirmation without explicit authority.
 - Prefer `withdrawal.prepare` for review and `withdrawal.confirm` only after the amount, address, speed, and fees are accepted. Preserve the returned quote id and fee amount as one pair for confirmation; preparation may restructure Spark leaves even though it does not spend or broadcast.
@@ -133,15 +134,16 @@ An entered chat remains mounted in the foreground session if its output shell di
 VEYL_HOME=/secure/veyl-home
 VEYL_PROFILE=runner
 VEYL_NETWORK=REGTEST
-VEYL_VAULT_SECRET=...
+VEYL_ACCOUNT_KEY=...
+VEYL_VAULT_KEY=...
 VEYL_WEB_URL=https://veyl.glyphteck.com
 ```
 
 Use an application secret manager and disable package persistence when appropriate:
 
 ```js
-await veyl.account.create({ saveCredential: false, ... });
-await veyl.vault.create({ saveSecret: false, secret });
+await veyl.account.create({ saveKey: false, ... });
+await veyl.vault.create({ saveKey: false, key });
 ```
 
 ## Surface boundaries