@glyphteck/veyl 0.65.1 → 0.65.2

package/dist/account.js

@@ -39612,14 +39612,19 @@ function openAccount(options = {}) {
       return;
     const startedAt = Date.now();
     diag?.("vault.cloud.listen.start", {});
-    const unsubscribe = cloud.user.vault.watch(uid, (vault) => {
+    const unsubscribe = cloud.user.vault.watch(uid, (vault, info = {}) => {
       if (state.uid !== uid)
         return;
       diag?.("vault.cloud.snapshot", {
         elapsedMs: Date.now() - startedAt,
-        hasVault: !!vault
+        hasVault: !!vault,
+        fromCache: !!info.fromCache
+      });
+      emit2({
+        vault: vault || null,
+        vaultReady: state.vaultReady || !info.fromCache,
+        vaultError: null
       });
-      emit2({ vault: vault || null, vaultReady: true, vaultError: null });
     }, (error) => {
       if (state.uid !== uid)
         return;

package/dist/cli.js

@@ -43598,14 +43598,19 @@ function openAccount(options = {}) {
       return;
     const startedAt = Date.now();
     diag?.("vault.cloud.listen.start", {});
-    const unsubscribe = cloud.user.vault.watch(uid, (vault) => {
+    const unsubscribe = cloud.user.vault.watch(uid, (vault, info = {}) => {
       if (state.uid !== uid)
         return;
       diag?.("vault.cloud.snapshot", {
         elapsedMs: Date.now() - startedAt,
-        hasVault: !!vault
+        hasVault: !!vault,
+        fromCache: !!info.fromCache
+      });
+      emit2({
+        vault: vault || null,
+        vaultReady: state.vaultReady || !info.fromCache,
+        vaultError: null
       });
-      emit2({ vault: vault || null, vaultReady: true, vaultError: null });
     }, (error) => {
       if (state.uid !== uid)
         return;
@@ -54062,7 +54067,7 @@ var package_default;
 var init_package2 = __esm(() => {
   package_default = {
     name: "veyl",
-    version: "0.65.1",
+    version: "0.65.2",
     packageManager: "bun@1.4.0",
     private: true,
     license: "UNLICENSED",
@@ -188179,8 +188184,12 @@ function createFirebaseCloud({ db, auth: auth2, getAuth: getAuth2, functions: fu
   }
   function watchVault(uid, onUpdate, onError) {
     requireUid(uid);
-    return onSnapshot(doc(db, "seeds", uid), (snap) => {
-      onUpdate?.(readCloudBytes(snap.data()?.es ?? null, "vault bytes"), { exists: snap.exists() });
+    return onSnapshot(doc(db, "seeds", uid), { includeMetadataChanges: true }, (snap) => {
+      onUpdate?.(readCloudBytes(snap.data()?.es ?? null, "vault bytes"), {
+        exists: snap.exists(),
+        fromCache: snap.metadata.fromCache,
+        pending: snap.metadata.hasPendingWrites
+      });
     }, onError);
   }
   async function acceptAgreement(uid, agreement) {

package/dist/index.js

@@ -43597,14 +43597,19 @@ function openAccount(options = {}) {
       return;
     const startedAt = Date.now();
     diag?.("vault.cloud.listen.start", {});
-    const unsubscribe = cloud.user.vault.watch(uid, (vault) => {
+    const unsubscribe = cloud.user.vault.watch(uid, (vault, info = {}) => {
       if (state.uid !== uid)
         return;
       diag?.("vault.cloud.snapshot", {
         elapsedMs: Date.now() - startedAt,
-        hasVault: !!vault
+        hasVault: !!vault,
+        fromCache: !!info.fromCache
+      });
+      emit2({
+        vault: vault || null,
+        vaultReady: state.vaultReady || !info.fromCache,
+        vaultError: null
       });
-      emit2({ vault: vault || null, vaultReady: true, vaultError: null });
     }, (error) => {
       if (state.uid !== uid)
         return;
@@ -54061,7 +54066,7 @@ var package_default;
 var init_package2 = __esm(() => {
   package_default = {
     name: "veyl",
-    version: "0.65.1",
+    version: "0.65.2",
     packageManager: "bun@1.4.0",
     private: true,
     license: "UNLICENSED",
@@ -188178,8 +188183,12 @@ function createFirebaseCloud({ db, auth: auth2, getAuth: getAuth2, functions: fu
   }
   function watchVault(uid, onUpdate, onError) {
     requireUid(uid);
-    return onSnapshot(doc(db, "seeds", uid), (snap) => {
-      onUpdate?.(readCloudBytes(snap.data()?.es ?? null, "vault bytes"), { exists: snap.exists() });
+    return onSnapshot(doc(db, "seeds", uid), { includeMetadataChanges: true }, (snap) => {
+      onUpdate?.(readCloudBytes(snap.data()?.es ?? null, "vault bytes"), {
+        exists: snap.exists(),
+        fromCache: snap.metadata.fromCache,
+        pending: snap.metadata.hasPendingWrites
+      });
     }, onError);
   }
   async function acceptAgreement(uid, agreement) {

package/docs/api.md

@@ -154,7 +154,7 @@ unsubscribe();
 await account.close();
 ```
 
-`openAccount()` owns authenticated user observation, username and avatar publication, vault observation and creation, vault unlock/lock, encrypted settings/network selection, presence, late wallet readiness, public Bitcoin data, support/report commands, chat and peer/profile composition, account switching, and secret-bearing session teardown. Focused-chat presence is separately owned by the chat session's encrypted ephemeral live transport. The account snapshot exposes `user`, `vault`, `vaultReady`, `vaultError`, `session`, `wallet`, `walletError`, `network`, and `lockState`; stable domain owners such as `bitcoin` and `support` live directly on the returned account owner. Graphical password-change flows call `verifyVaultPasswordForChange(currentPassword)` before revealing the new-password step, then call the atomic `changeVaultPassword({ currentPassword, newPassword })` command. Both are account-bound local decryptions; the first immediately clears its temporary seed, while the second preserves and verifies the existing Vault Signature identity before replacing the authoritative ciphertext.
+`openAccount()` owns authenticated user observation, username and avatar publication, vault observation and creation, vault unlock/lock, encrypted settings/network selection, presence, late wallet readiness, public Bitcoin data, support/report commands, chat and peer/profile composition, account switching, and secret-bearing session teardown. Focused-chat presence is separately owned by the chat session's encrypted ephemeral live transport. The account snapshot exposes `user`, `vault`, `vaultReady`, `vaultError`, `session`, `wallet`, `walletError`, `network`, and `lockState`; `vaultReady` becomes true only after the backend authorizes and confirms the current vault snapshot, while a cached snapshot may warm `vault` without authorizing a guarded route. Stable domain owners such as `bitcoin` and `support` live directly on the returned account owner. Graphical password-change flows call `verifyVaultPasswordForChange(currentPassword)` before revealing the new-password step, then call the atomic `changeVaultPassword({ currentPassword, newPassword })` command. Both are account-bound local decryptions; the first immediately clears its temporary seed, while the second preserves and verifies the existing Vault Signature identity before replacing the authoritative ciphertext.
 
 `account.profile` owns the server mutation after a platform has prepared avatar bytes or collected a username. Browser canvas work and native image manipulation remain platform-local; both then call the same `setAvatar`, `clearAvatar`, or `setUsername` command. Successful avatar commands update the shared user owner before returning.
 

package/package.json

@@ -42,5 +42,5 @@
         "start": "node src/cli.js",
         "lint": "eslint src --quiet"
     },
-    "version": "0.65.1"
+    "version": "0.65.2"
 }