@glyphteck/veyl 0.63.7 → 0.65.0

package/docs/api.md

@@ -54,7 +54,7 @@ const unsubscribeAuth = auth.subscribe((user) => console.log(user));
 const unsubscribeLinks = auth.links.watch(user.uid, renderLinks, showError);
 const link = await auth.links.create();
 await auth.links.add({ token, label });
-await auth.links.activate(sessionToken);
+await auth.activateToken(sessionToken);
 
 const inventory = await auth.passkeys.list(user.uid, {
   currentPasskeyId,
@@ -66,7 +66,11 @@ unsubscribeAuth();
 await auth.logout();
 ```
 
-`openAuth()` owns the shared register, login, token, one-use link, passkey inventory, verified deletion, session observation, and sign-out choreography. Its `cloud` input is a transport rather than a Firebase dependency. A platform supplies only the local credential ceremony: browser WebAuthn on web, `react-native-passkeys` on iOS, or a browser-assisted port in the Node runtime. Browser adapters must decode the server's binary options before the ceremony and return a JSON-safe credential afterward, as the placeholder helpers above indicate. Errors are normalized at this boundary so every client receives the same recoverable registration and login outcomes. The platform still owns when to prompt, how to present the prompt, navigation, local credential storage, and UI feedback.
+`openAuth()` owns the shared register, login, token, one-use link, passkey inventory, verified deletion, session observation, and sign-out choreography. `activateToken()` is the generic in-memory account-session activation boundary for a custom token returned by a token-only login, registration, or passkey-link flow; it is not nested under passkey links because those flows share the same isolated auth-slot operation. Never persist that token. The `cloud` input is a transport rather than a Firebase dependency. A platform supplies only the local credential ceremony: browser WebAuthn on web, `react-native-passkeys` on iOS, or a browser-assisted port in the Node runtime. Browser adapters must decode the server's binary options before the ceremony and return a JSON-safe credential afterward, as the placeholder helpers above indicate. Errors are normalized at this boundary so every client receives the same recoverable registration and login outcomes. The platform still owns when to prompt, how to present the prompt, navigation, local credential storage, and UI feedback.
+
+## Account profiles
+
+`@glyphteck/veyl/account-profiles` owns one environment-scoped public remembered-account registry and exactly one active runtime. Platform storage supplies atomic `read`, synchronous-reducer `update`, and payload-free `subscribe` ports; `resolveAuthenticatedProfile` is the platform authority that maps those public rows to matching live isolated auth sessions. A remembered row alone is never authenticated. A client reserves a random profile id before authentication, exchanges the memory-only custom token inside that named auth slot, and commits the authenticated Firebase user's uid through `reservation.activate(fields, activation)`. If the uid already owns a durable profile id, the client adopts that authenticated session into the canonical named slot before discarding the provisional slot; neither the token nor the Firebase user enters registry storage. The owner awaits the previous runtime's `lock()` and `close()` before opening the selected profile. Every successful selection advances `lastUsedAt`; the owner exposes that descending recency order for UI and the resolver uses it for live-auth fallback. `switchTo(profileId)` independently verifies the requested profile through the resolver before invalidating the current runtime. `signOut()` retains the public row as an exact-account login shortcut; `remove(profileId)` forgets it. Both resume the most recently selected remaining live authenticated profile when available, while `resumeAuthenticated()` handles platform auth loss explicitly. External storage signals trigger an authoritative reread, and an externally removed active row closes locally without repeating the originating platform cleanup. The client exposes Login only when the resolver finds no live authenticated profile.
 
 ## Graphical account owner
 
@@ -105,6 +109,8 @@ await account.profile.setAvatar(preparedWebpBytes);
 
 await account.createVault(password);
 const session = await account.unlock(password);
+await account.verifyVaultPasswordForChange(currentPassword);
+await account.changeVaultPassword({ currentPassword, newPassword });
 const unsubscribeChat = account.chat.subscribe(() => {
   console.log(account.chat.getSnapshot().chats);
 });
@@ -131,7 +137,6 @@ await account.support.report(targetUid, { note: 'context' });
 await account.user.getSnapshot().updateSettings({ moneyFormat: 'btc' });
 await account.push.add(preparedPushLease);
 await account.push.drop({ did: preparedPushLease.did });
-await account.verifyPassword(password);
 
 const unsubscribePeers = account.peers.subscribe(() => {
   console.log(account.peers.getSnapshot());
@@ -146,10 +151,10 @@ unsubscribeWallet();
 unsubscribeChat();
 account.lock();
 unsubscribe();
-account.close();
+await account.close();
 ```
 
-`openAccount()` owns authenticated user observation, username and avatar publication, vault observation and creation, vault unlock/lock, encrypted settings/network selection, presence, late wallet readiness, public Bitcoin data, support/report commands, chat and peer/profile composition, account switching, and secret-bearing session teardown. Focused-chat presence is separately owned by the chat session's encrypted ephemeral live transport. The account snapshot exposes `user`, `vault`, `vaultReady`, `vaultError`, `session`, `wallet`, `walletError`, `network`, and `lockState`; stable domain owners such as `bitcoin` and `support` live directly on the returned account owner.
+`openAccount()` owns authenticated user observation, username and avatar publication, vault observation and creation, vault unlock/lock, encrypted settings/network selection, presence, late wallet readiness, public Bitcoin data, support/report commands, chat and peer/profile composition, account switching, and secret-bearing session teardown. Focused-chat presence is separately owned by the chat session's encrypted ephemeral live transport. The account snapshot exposes `user`, `vault`, `vaultReady`, `vaultError`, `session`, `wallet`, `walletError`, `network`, and `lockState`; stable domain owners such as `bitcoin` and `support` live directly on the returned account owner. Graphical password-change flows call `verifyVaultPasswordForChange(currentPassword)` before revealing the new-password step, then call the atomic `changeVaultPassword({ currentPassword, newPassword })` command. Both are account-bound local decryptions; the first immediately clears its temporary seed, while the second preserves and verifies the existing Vault Signature identity before replacing the authoritative ciphertext.
 
 `account.profile` owns the server mutation after a platform has prepared avatar bytes or collected a username. Browser canvas work and native image manipulation remain platform-local; both then call the same `setAvatar`, `clearAvatar`, or `setUsername` command. Successful avatar commands update the shared user owner before returning.
 
@@ -159,7 +164,7 @@ account.close();
 
 `account.wallet` is the stable account-scoped wallet composition used by Node, web, and iOS. It owns the one live `core/wallet/session.js` engine, its transfer store, cached pre-Spark display state, transaction aggregation, wallet-derived peer recency, late Spark attachment, and lock teardown. `getSnapshot()` preserves the shared `{ value, txValue }` contract; `transactions` exposes aggregate/search/chart data and `transfers` exposes focused list and keyed subscriptions. Graphical wallet providers only adapt those SDK subscriptions and add browser/native behavior through the `wallet` platform ports.
 
-Encrypted settings remain commands on `account.user`, so graphical clients and the high-level Node runtime mutate the same normalized owner instead of creating another settings facade. `account.push` owns only authenticated server lease add/drop; APNs permission, token, environment, badge, presentation, and tap behavior remain iOS ports. `verifyPassword()` checks the currently observed vault locally. After a platform-specific confirmation, `delete({ confirm: true })` drains decryptable inbox/chat membership, marks every discovered chat deleted, commits server account deletion, clears the unlocked encrypted cache, clears local avatar state, and locks. A discovery, chat-marking, or server failure leaves the unlocked account and cache available for retry; platform credential, remembered-account, push-token, and final auth cleanup runs only after that shared command commits.
+Encrypted settings remain commands on `account.user`, so graphical clients and the high-level Node runtime mutate the same normalized owner instead of creating another settings facade. `account.push` owns only authenticated server lease add/drop; APNs permission, token, environment, badge, presentation, and tap behavior remain iOS ports. `delete({ confirm: true, password })` verifies the currently observed vault inside the same account- and session-bound operation that drains decryptable inbox/chat membership, marks every discovered chat deleted, commits server account deletion, clears the unlocked encrypted cache, clears local avatar state, and locks. A verification, discovery, chat-marking, or server failure leaves the unlocked account and cache available for retry; platform credential, remembered-account, push-token, and final auth cleanup runs only after that shared command commits.
 
 Platform code still owns the WebAuthn/native passkey ceremony itself, Face ID and secure storage, foreground/background and browser events, navigation, toasts, and UI; the surrounding auth state machine belongs to `openAuth()`. `unlock(password, options)` accepts platform lifecycle callbacks such as `onSeedDecrypted`, `onSettingsUnlocked`, and `onSessionReady` without importing those platforms. Wallet startup remains asynchronous: chat keys, vault proof, and the encrypted cache may make the account usable before `walletReady` settles.
 
@@ -214,7 +219,7 @@ await veyl.account.delete({ confirm: true });
 - `acceptTerms()` records the current agreement through the shared user owner without forcing a vault unlock.
 - `logout` signs out and tears down only this runtime.
 - `logoutAll` revokes every product session generation, tears down this runtime locally, and stops a persistent CLI owner after its in-flight work drains.
-- `delete({ confirm: true })` drains decryptable inbox state, marks all discoverable chats deleted, destroys the complete account/network encrypted cache scope, proves vault possession, deletes identifiable account data, removes the local profile, and stops a persistent CLI owner after its in-flight work drains.
+- `delete({ confirm: true, key? })` drains decryptable inbox state, marks all discoverable chats deleted, destroys the complete account/network encrypted cache scope, proves vault possession inside the same destructive operation, deletes identifiable account data, removes the local profile, and stops a persistent CLI owner after its in-flight work drains. `key` is required only when the runtime has no saved vault key.
 
 Account summaries report identity, network, local credential/vault availability, public wallet/chat keys, auth kind, an explicit managed-bot marker when assigned by Glyphteck's owner namespace, and current signed-in/unlocked state. Account and vault keys are never included in summaries.
 

package/docs/cli.md

@@ -24,7 +24,7 @@ veyl account terms
 veyl account accept-terms
 veyl account logout
 veyl account logout-all
-veyl account delete --confirm
+veyl account delete --confirm [--key VALUE]
 
 veyl vault create [--key VALUE] [--no-save-key]
 veyl vault unlock [--key VALUE] [--no-save-key]

package/package.json

@@ -11,6 +11,7 @@
     "exports": {
         ".": "./dist/index.js",
         "./account": "./dist/account.js",
+        "./account-profiles": "./dist/accountprofiles.js",
         "./auth": "./dist/auth.js"
     },
     "bin": {
@@ -36,10 +37,10 @@
         "access": "public"
     },
     "scripts": {
-        "build": "bun build src/index.js src/cli.js src/runtime/kdf-worker-thread.js --target=node --outdir dist --entry-naming '[name].[ext]' && bun build src/account.js src/auth.js --target=browser --outdir dist",
+        "build": "bun build src/index.js src/cli.js src/runtime/kdf-worker-thread.js --target=node --outdir dist --entry-naming '[name].[ext]' && bun build src/account.js src/accountprofiles.js src/auth.js --target=browser --outdir dist",
         "prepack": "bun run build",
         "start": "node src/cli.js",
         "lint": "eslint src --quiet"
     },
-    "version": "0.63.7"
+    "version": "0.65.0"
 }