@glyphteck/veyl 0.66.3 → 0.67.0

package/dist/account.js

@@ -7281,7 +7281,7 @@ function closeSessionResources({ wallet, chatPK, chatPrivateKey, chatSigningSecr
   close(vaultAccess);
   close(vaultSigner);
   close(localCache);
-  pending.push(lockWallet(wallet));
+  lockWallet(wallet);
   lockChat(chatPrivateKey, chatPK);
   cleanBytes(chatSigningSecret, notificationPrivateKey, notificationPublicKey);
   return Promise.allSettled(pending).then(() => {
@@ -7857,6 +7857,8 @@ function settingsState(settings = defaultSettings) {
 var defaultUser = {
   uid: null,
   authReady: false,
+  authSessionReady: false,
+  authSessionActive: false,
   authCredential: null,
   profileReady: false,
   username: null,
@@ -7878,12 +7880,16 @@ var defaultUser = {
   settingsReady: false,
   settings: settingsState()
 };
+function isAccountAuthenticationError(error) {
+  const code = typeof error?.code === "string" ? error.code.toLowerCase() : "";
+  return code === "permission-denied" || code.endsWith("/permission-denied") || code === "unauthenticated" || code.endsWith("/unauthenticated");
+}
 function createUser({ cloud, network, avatarCache = null, diag = null, onSessionRevoked = null }) {
   if (!cloud) {
     throw new Error("createUser requires { cloud }");
   }
-  if (avatarCache && [avatarCache.read, avatarCache.write, avatarCache.remove, avatarCache.removeAll].some((method) => typeof method !== "function")) {
-    throw new Error("avatarCache requires read, write, remove, and removeAll");
+  if (avatarCache && [avatarCache.read, avatarCache.write, avatarCache.remove].some((method) => typeof method !== "function")) {
+    throw new Error("avatarCache requires read, write, and remove");
   }
   let activeNetwork = network;
   let state = defaultUser;
@@ -8021,9 +8027,6 @@ function createUser({ cloud, network, avatarCache = null, diag = null, onSession
       return;
     runCacheTask("user.avatar.cache.remove", () => avatarCache.remove(uid));
   }
-  function clearCachedAvatars() {
-    runCacheTask("user.avatar.cache.clear", () => avatarCache.removeAll());
-  }
   async function fetchAvatar(uid, { version = null, force = false, clear = false, persist = true } = {}) {
     if (!uid)
       return;
@@ -8106,6 +8109,54 @@ function createUser({ cloud, network, avatarCache = null, diag = null, onSession
   function isCurrentUser(uid, session) {
     return started && authSession === session && userUid === uid;
   }
+  function revokeAuthentication(authUser, {
+    code = "",
+    local = false,
+    reason = "session-inactive"
+  } = {}) {
+    if (revokingSession)
+      return;
+    revokingSession = true;
+    let callback;
+    try {
+      callback = onSessionRevoked?.({
+        uid: authUser.uid,
+        code,
+        reason
+      });
+    } catch (error) {
+      callback = Promise.reject(error);
+    }
+    markDiag(diag, "user.auth.revoked", {
+      code,
+      local,
+      reason
+    });
+    setState((user) => ({
+      ...user,
+      authSessionReady: true,
+      authSessionActive: false,
+      authCredential: null
+    }));
+    let operation = Promise.resolve(callback).catch((error) => markError(diag, "user.session.revoke.local", Date.now(), error));
+    if (!local) {
+      operation = operation.then(() => cloud.auth.logout()).catch((error) => markError(diag, "user.session.revoke.auth", Date.now(), error));
+    }
+    operation.finally(() => {
+      if (userUid === authUser.uid) {
+        revokingSession = false;
+      }
+    });
+  }
+  function revokeAuthenticationError(authUser, error, reason) {
+    if (!isAccountAuthenticationError(error))
+      return false;
+    revokeAuthentication(authUser, {
+      code: error?.code || "",
+      reason
+    });
+    return true;
+  }
   function watchUser(authUser) {
     if (!started)
       return;
@@ -8115,7 +8166,6 @@ function createUser({ cloud, network, avatarCache = null, diag = null, onSession
     closeUserWatches();
     markDiag(diag, "user.auth.state", { signedIn: !!authUser });
     if (!authUser) {
-      const signedOutUid = userUid;
       revokingSession = false;
       userUid = null;
       clearSettingsKey(settingsKey);
@@ -8124,17 +8174,11 @@ function createUser({ cloud, network, avatarCache = null, diag = null, onSession
       agreementStored = null;
       agreementOverride = null;
       agreementAcceptance = null;
-      if (signedOutUid) {
-        clearCachedAvatars();
-      }
       avatarFetch = { uid: null, key: null, promise: null };
       setState({ ...defaultUser, authReady: true });
       return;
     }
     const authUidChanged = userUid !== authUser.uid;
-    if (userUid && authUidChanged) {
-      clearCachedAvatars();
-    }
     userUid = authUser.uid;
     if (authUidChanged) {
       clearSettingsKey(settingsKey);
@@ -8164,32 +8208,28 @@ function createUser({ cloud, network, avatarCache = null, diag = null, onSession
     userWatches.push(cloud.auth.session.watch(authUser.uid, current((authSessionState) => {
       if (authSessionState?.active) {
         const authCredential = authSessionState.authCredential;
-        setState((user) => user.authCredential?.kind === authCredential?.kind && user.authCredential?.id === authCredential?.id ? user : { ...user, authCredential });
-        return;
-      }
-      if (revokingSession)
-        return;
-      revokingSession = true;
-      if (cloud.auth.session.isLocalTermination?.(authUser.uid, authSessionState?.generation)) {
-        Promise.resolve(onSessionRevoked?.({ uid: authUser.uid })).catch((error) => markError(diag, "user.session.revoke.local", Date.now(), error)).finally(() => {
-          if (userUid === authUser.uid) {
-            revokingSession = false;
-          }
+        setState((user) => user.authSessionReady && user.authSessionActive && user.authCredential?.kind === authCredential?.kind && user.authCredential?.id === authCredential?.id ? user : {
+          ...user,
+          authSessionReady: true,
+          authSessionActive: true,
+          authCredential
         });
         return;
       }
-      Promise.resolve(onSessionRevoked?.({ uid: authUser.uid })).catch((error) => markError(diag, "user.session.revoke.local", Date.now(), error)).then(() => cloud.auth.logout()).catch((error) => markError(diag, "user.session.revoke.auth", Date.now(), error)).finally(() => {
-        if (userUid === authUser.uid) {
-          revokingSession = false;
-        }
+      revokeAuthentication(authUser, {
+        local: cloud.auth.session.isLocalTermination?.(authUser.uid, authSessionState?.generation) === true,
+        reason: "session-inactive"
       });
     }), current((error) => {
       markError(diag, "user.session.listen", authStartedAt, error);
+      revokeAuthenticationError(authUser, error, "session-listener");
     })));
     userWatches.push(cloud.user.admin.watch(authUser.uid, current((allowed) => {
       setState((user) => ({ ...user, isAdmin: allowed, adminReady: true }));
     }), current((error) => {
       markError(diag, "user.admin.listen", authStartedAt, error);
+      if (revokeAuthenticationError(authUser, error, "admin-listener"))
+        return;
       setState((user) => ({ ...user, isAdmin: false, adminReady: true }));
     })));
     userWatches.push(cloud.user.private.watch(authUser.uid, current((privateData, info = {}) => {
@@ -8213,6 +8253,8 @@ function createUser({ cloud, network, avatarCache = null, diag = null, onSession
       }));
     }), current((error) => {
       markError(diag, "user.settings.snapshot", authStartedAt, error);
+      if (revokeAuthenticationError(authUser, error, "settings-listener"))
+        return;
       settingsStored = null;
       agreementStored = null;
       setState((user) => ({
@@ -8225,6 +8267,8 @@ function createUser({ cloud, network, avatarCache = null, diag = null, onSession
       setState((user) => ({ ...user, banned: banned ?? null }));
     }), current((error) => {
       markError(diag, "user.moderation.listen", authStartedAt, error);
+      if (revokeAuthenticationError(authUser, error, "moderation-listener"))
+        return;
       setState((user) => ({ ...user, banned: null }));
     })));
     userWatches.push(cloud.user.blocked.watch(authUser.uid, current((blocked, info = {}) => {
@@ -8237,6 +8281,8 @@ function createUser({ cloud, network, avatarCache = null, diag = null, onSession
       });
     }), current((error) => {
       markError(diag, "user.blocked.listen", authStartedAt, error);
+      if (revokeAuthenticationError(authUser, error, "blocked-listener"))
+        return;
       setState((user) => ({ ...user, blockedReady: false }));
     })));
     userWatches.push(cloud.user.profile.watch(authUser.uid, current((profileData, info = {}) => {
@@ -8283,6 +8329,8 @@ function createUser({ cloud, network, avatarCache = null, diag = null, onSession
       }
     }), current((error) => {
       markError(diag, "user.profile.snapshot", authStartedAt, error);
+      if (revokeAuthenticationError(authUser, error, "profile-listener"))
+        return;
       avatarFetch = { uid: null, key: null, promise: null };
       setState((user) => ({
         ...user,
@@ -41653,20 +41701,36 @@ function openAccount(options = {}) {
   let closePromise = null;
   let state;
   let chatSession = null;
+  let revokedUid = null;
+  let revocationPromise = null;
   let nextAgreement = agreementContract(options.agreement || CURRENT_AGREEMENT);
   const listeners = new Set;
   let activeWriteTail = Promise.resolve();
   const sessionCloseWork = new Set;
   const operationBarrier = createAccountOperationCloseBarrier();
+  function revokeSession(details = {}) {
+    const { uid = null } = details;
+    const accountUid = uid || state?.uid || null;
+    if (accountUid && revokedUid === accountUid) {
+      return revocationPromise || Promise.resolve();
+    }
+    revokedUid = accountUid;
+    let callback;
+    try {
+      callback = options.onSessionRevoked?.({ ...details, uid: accountUid });
+    } catch (error) {
+      callback = Promise.reject(error);
+    }
+    lock();
+    revocationPromise = Promise.resolve(callback);
+    return revocationPromise;
+  }
   const user = options.user || createUser({
     cloud,
     network: options.network || defaultNetwork,
     avatarCache,
     diag,
-    onSessionRevoked: ({ uid } = {}) => {
-      lock();
-      options.onSessionRevoked?.({ uid: uid || state?.uid || null });
-    }
+    onSessionRevoked: revokeSession
   });
   state = emptyState(user.getSnapshot(), options.network || defaultNetwork);
   const chat = createChatSession({
@@ -41915,6 +41979,24 @@ function openAccount(options = {}) {
         code: error?.code || "",
         message: error?.message || String(error)
       });
+      if (isAccountAuthenticationError(error)) {
+        revokeSession({
+          uid,
+          code: error?.code || "",
+          reason: "vault-listener"
+        }).catch((revocationError) => {
+          diag?.("account.session.revoke.error", {
+            code: revocationError?.code || "",
+            message: revocationError?.message || String(revocationError)
+          });
+        }).then(() => cloud.auth.logout()).catch((logoutError) => {
+          diag?.("account.session.revoke.auth.error", {
+            code: logoutError?.code || "",
+            message: logoutError?.message || String(logoutError)
+          });
+        });
+        return;
+      }
       lock();
       emit2({ vault: null, vaultReady: true, vaultError: error });
     });

package/dist/accountprofiles.js

@@ -249,6 +249,57 @@ function cleanBytes(...values) {
   }
 }
 
+// ../../core/passkey.js
+var PASSKEY_ENVIRONMENT_MISMATCH = "passkey-environment-mismatch";
+var PASSKEY_PROVIDER_ALREADY_LINKED = "passkey-provider-already-linked";
+var PASSKEY_REGISTER_INVALID = "passkey-register-invalid";
+var PASSKEY_RP_MISMATCH = "passkey-rp-mismatch";
+var PASSKEY_UNLINKED = "passkey-unlinked";
+var PASSKEY_CANCELLED_CODES = new Set(["ERR_USER_CANCELLED"]);
+var PASSKEY_CANCELLED_NAMES = new Set(["UserCancelledException"]);
+var PASSKEY_CONTROLLED_ERRORS = new Set([
+  PASSKEY_ENVIRONMENT_MISMATCH,
+  PASSKEY_PROVIDER_ALREADY_LINKED,
+  PASSKEY_REGISTER_INVALID,
+  PASSKEY_RP_MISMATCH,
+  PASSKEY_UNLINKED
+]);
+function canDeletePasskey(row, passkeys, currentPasskeyId) {
+  if (row?.type === "pending")
+    return true;
+  return row?.type === "passkey" && Array.isArray(passkeys) && passkeys.length > 1 && row.id !== cleanText(currentPasskeyId);
+}
+function passkeyError(code, message, cause) {
+  const error = new Error(message);
+  error.code = code;
+  error.cause = cause;
+  return error;
+}
+function normalizePasskeyLoginError(error, options = {}) {
+  if (options.localhostSilo === true && error?.code === "functions/failed-precondition" && cleanText(error?.message).includes("Localhost uses a separate passkey silo")) {
+    return passkeyError(PASSKEY_ENVIRONMENT_MISMATCH, "This passkey belongs to glyphteck.com, not localhost.", error);
+  }
+  if (error?.code === "functions/not-found") {
+    return passkeyError(PASSKEY_UNLINKED, "This passkey is no longer linked to an account.", error);
+  }
+  if (error?.code === "functions/failed-precondition") {
+    return passkeyError(PASSKEY_RP_MISMATCH, "This passkey belongs to a different Glyphteck passkey setup.", error);
+  }
+  return error;
+}
+function normalizePasskeyRegisterError(error, options = {}) {
+  if (error?.name === "CredentialAlreadyExistsException" || error?.name === "InvalidStateError" || error?.code === "functions/already-exists") {
+    return passkeyError(PASSKEY_PROVIDER_ALREADY_LINKED, "you already have a passkey for this account", error);
+  }
+  if (error?.code === "functions/failed-precondition") {
+    return passkeyError(PASSKEY_RP_MISMATCH, "This passkey belongs to a different Glyphteck passkey setup.", error);
+  }
+  if (options.invalidArgument === true && error?.code === "functions/invalid-argument" && error?.message) {
+    return passkeyError(PASSKEY_REGISTER_INVALID, error.message, error);
+  }
+  return error;
+}
+
 // ../../core/account/profiles.js
 var ACCOUNT_PROFILES_VERSION = 1;
 var PROFILE_ID_RE = /^[0-9a-f]{32}$/;
@@ -606,7 +657,7 @@ function requirePorts(options) {
     onError: typeof options.onError === "function" ? options.onError : null
   };
 }
-async function resolveAuthenticatedProfile(owner, generation, reason) {
+async function resolveAuthenticatedProfile(owner, generation, reason, details = {}) {
   ensureGeneration(owner, generation);
   const registry = owner.registry;
   const context = Object.freeze({
@@ -614,6 +665,7 @@ async function resolveAuthenticatedProfile(owner, generation, reason) {
     generation,
     reason,
     requestedProfileId: owner.requestedProfileId,
+    rejectedProfileId: details.rejectedProfileId || null,
     isCurrent: () => !owner.closing && !owner.closed && owner.generation === generation
   });
   const profileId = await owner.ports.resolveAuthenticatedProfile(registry, context);
@@ -981,7 +1033,9 @@ async function applyAuthenticatedProfile(owner, profile, generation, reason, opt
 }
 async function resumeAuthenticatedProfile(owner, generation, reason, options = {}) {
   publish(owner, reason, null);
-  const profile = await resolveAuthenticatedProfile(owner, generation, reason);
+  const profile = await resolveAuthenticatedProfile(owner, generation, reason, {
+    rejectedProfileId: options.rejectedProfileId
+  });
   return applyAuthenticatedProfile(owner, profile, generation, reason, options);
 }
 function transitionFailure(owner, error, generation, profileId) {
@@ -1009,12 +1063,15 @@ async function initialize(owner) {
     throw error;
   }
 }
-function requestAuthenticatedProfileResume(owner) {
+function requestAuthenticatedProfileResume(owner, options = {}) {
   ensureReady(owner);
+  const rejectedProfileId = options.rejectedProfileId == null ? null : readAccountProfileId(options.rejectedProfileId);
   const generation = requestSelection(owner, null, false);
   return enqueue(owner, async () => {
     try {
-      return await resumeAuthenticatedProfile(owner, generation, "restoring");
+      return await resumeAuthenticatedProfile(owner, generation, "restoring", {
+        rejectedProfileId
+      });
     } catch (error) {
       if (!isStaleAccountProfileTransition(error))
         publish(owner, "error", error);
@@ -1353,7 +1410,7 @@ function createAccountProfiles(options = {}) {
       const generation = requestSelection(owner, profileId, false);
       return enqueue(owner, () => switchExisting(owner, profileId, generation));
     },
-    resumeAuthenticated: () => requestAuthenticatedProfileResume(owner),
+    resumeAuthenticated: (options2) => requestAuthenticatedProfileResume(owner, options2),
     refresh: () => requestProfileRefresh(owner),
     signOut: (profileId) => requestProfileSignOut(owner, profileId),
     remove: (profileId) => requestProfileRemoval(owner, profileId),

package/dist/auth.js

@@ -82,8 +82,8 @@ function normalizePasskeyLoginError(error, options = {}) {
   return error;
 }
 function normalizePasskeyRegisterError(error, options = {}) {
-  if (error?.name === "InvalidStateError" || error?.code === "functions/already-exists") {
-    return passkeyError(PASSKEY_PROVIDER_ALREADY_LINKED, "this provider already has a passkey for this account. choose another provider, device, or security key", error);
+  if (error?.name === "CredentialAlreadyExistsException" || error?.name === "InvalidStateError" || error?.code === "functions/already-exists") {
+    return passkeyError(PASSKEY_PROVIDER_ALREADY_LINKED, "you already have a passkey for this account", error);
   }
   if (error?.code === "functions/failed-precondition") {
     return passkeyError(PASSKEY_RP_MISMATCH, "This passkey belongs to a different Glyphteck passkey setup.", error);

package/dist/cli.js

@@ -7922,7 +7922,7 @@ function closeSessionResources({ wallet, chatPK, chatPrivateKey, chatSigningSecr
   close(vaultAccess);
   close(vaultSigner);
   close(localCache);
-  pending.push(lockWallet(wallet));
+  lockWallet(wallet);
   lockChat(chatPrivateKey, chatPK);
   cleanBytes(chatSigningSecret, notificationPrivateKey, notificationPublicKey);
   return Promise.allSettled(pending).then(() => {
@@ -8551,12 +8551,16 @@ function settingsState(settings = defaultSettings) {
     }
   };
 }
+function isAccountAuthenticationError(error) {
+  const code = typeof error?.code === "string" ? error.code.toLowerCase() : "";
+  return code === "permission-denied" || code.endsWith("/permission-denied") || code === "unauthenticated" || code.endsWith("/unauthenticated");
+}
 function createUser({ cloud, network, avatarCache = null, diag = null, onSessionRevoked = null }) {
   if (!cloud) {
     throw new Error("createUser requires { cloud }");
   }
-  if (avatarCache && [avatarCache.read, avatarCache.write, avatarCache.remove, avatarCache.removeAll].some((method) => typeof method !== "function")) {
-    throw new Error("avatarCache requires read, write, remove, and removeAll");
+  if (avatarCache && [avatarCache.read, avatarCache.write, avatarCache.remove].some((method) => typeof method !== "function")) {
+    throw new Error("avatarCache requires read, write, and remove");
   }
   let activeNetwork = network;
   let state = defaultUser;
@@ -8694,9 +8698,6 @@ function createUser({ cloud, network, avatarCache = null, diag = null, onSession
       return;
     runCacheTask("user.avatar.cache.remove", () => avatarCache.remove(uid));
   }
-  function clearCachedAvatars() {
-    runCacheTask("user.avatar.cache.clear", () => avatarCache.removeAll());
-  }
   async function fetchAvatar(uid, { version = null, force = false, clear = false, persist = true } = {}) {
     if (!uid)
       return;
@@ -8779,6 +8780,54 @@ function createUser({ cloud, network, avatarCache = null, diag = null, onSession
   function isCurrentUser(uid, session) {
     return started && authSession === session && userUid === uid;
   }
+  function revokeAuthentication(authUser, {
+    code = "",
+    local = false,
+    reason = "session-inactive"
+  } = {}) {
+    if (revokingSession)
+      return;
+    revokingSession = true;
+    let callback;
+    try {
+      callback = onSessionRevoked?.({
+        uid: authUser.uid,
+        code,
+        reason
+      });
+    } catch (error) {
+      callback = Promise.reject(error);
+    }
+    markDiag(diag, "user.auth.revoked", {
+      code,
+      local,
+      reason
+    });
+    setState((user) => ({
+      ...user,
+      authSessionReady: true,
+      authSessionActive: false,
+      authCredential: null
+    }));
+    let operation = Promise.resolve(callback).catch((error) => markError(diag, "user.session.revoke.local", Date.now(), error));
+    if (!local) {
+      operation = operation.then(() => cloud.auth.logout()).catch((error) => markError(diag, "user.session.revoke.auth", Date.now(), error));
+    }
+    operation.finally(() => {
+      if (userUid === authUser.uid) {
+        revokingSession = false;
+      }
+    });
+  }
+  function revokeAuthenticationError(authUser, error, reason) {
+    if (!isAccountAuthenticationError(error))
+      return false;
+    revokeAuthentication(authUser, {
+      code: error?.code || "",
+      reason
+    });
+    return true;
+  }
   function watchUser(authUser) {
     if (!started)
       return;
@@ -8788,7 +8837,6 @@ function createUser({ cloud, network, avatarCache = null, diag = null, onSession
     closeUserWatches();
     markDiag(diag, "user.auth.state", { signedIn: !!authUser });
     if (!authUser) {
-      const signedOutUid = userUid;
       revokingSession = false;
       userUid = null;
       clearSettingsKey(settingsKey);
@@ -8797,17 +8845,11 @@ function createUser({ cloud, network, avatarCache = null, diag = null, onSession
       agreementStored = null;
       agreementOverride = null;
       agreementAcceptance = null;
-      if (signedOutUid) {
-        clearCachedAvatars();
-      }
       avatarFetch = { uid: null, key: null, promise: null };
       setState({ ...defaultUser, authReady: true });
       return;
     }
     const authUidChanged = userUid !== authUser.uid;
-    if (userUid && authUidChanged) {
-      clearCachedAvatars();
-    }
     userUid = authUser.uid;
     if (authUidChanged) {
       clearSettingsKey(settingsKey);
@@ -8837,32 +8879,28 @@ function createUser({ cloud, network, avatarCache = null, diag = null, onSession
     userWatches.push(cloud.auth.session.watch(authUser.uid, current((authSessionState) => {
       if (authSessionState?.active) {
         const authCredential = authSessionState.authCredential;
-        setState((user) => user.authCredential?.kind === authCredential?.kind && user.authCredential?.id === authCredential?.id ? user : { ...user, authCredential });
-        return;
-      }
-      if (revokingSession)
-        return;
-      revokingSession = true;
-      if (cloud.auth.session.isLocalTermination?.(authUser.uid, authSessionState?.generation)) {
-        Promise.resolve(onSessionRevoked?.({ uid: authUser.uid })).catch((error) => markError(diag, "user.session.revoke.local", Date.now(), error)).finally(() => {
-          if (userUid === authUser.uid) {
-            revokingSession = false;
-          }
+        setState((user) => user.authSessionReady && user.authSessionActive && user.authCredential?.kind === authCredential?.kind && user.authCredential?.id === authCredential?.id ? user : {
+          ...user,
+          authSessionReady: true,
+          authSessionActive: true,
+          authCredential
         });
         return;
       }
-      Promise.resolve(onSessionRevoked?.({ uid: authUser.uid })).catch((error) => markError(diag, "user.session.revoke.local", Date.now(), error)).then(() => cloud.auth.logout()).catch((error) => markError(diag, "user.session.revoke.auth", Date.now(), error)).finally(() => {
-        if (userUid === authUser.uid) {
-          revokingSession = false;
-        }
+      revokeAuthentication(authUser, {
+        local: cloud.auth.session.isLocalTermination?.(authUser.uid, authSessionState?.generation) === true,
+        reason: "session-inactive"
       });
     }), current((error) => {
       markError(diag, "user.session.listen", authStartedAt, error);
+      revokeAuthenticationError(authUser, error, "session-listener");
     })));
     userWatches.push(cloud.user.admin.watch(authUser.uid, current((allowed) => {
       setState((user) => ({ ...user, isAdmin: allowed, adminReady: true }));
     }), current((error) => {
       markError(diag, "user.admin.listen", authStartedAt, error);
+      if (revokeAuthenticationError(authUser, error, "admin-listener"))
+        return;
       setState((user) => ({ ...user, isAdmin: false, adminReady: true }));
     })));
     userWatches.push(cloud.user.private.watch(authUser.uid, current((privateData, info = {}) => {
@@ -8886,6 +8924,8 @@ function createUser({ cloud, network, avatarCache = null, diag = null, onSession
       }));
     }), current((error) => {
       markError(diag, "user.settings.snapshot", authStartedAt, error);
+      if (revokeAuthenticationError(authUser, error, "settings-listener"))
+        return;
       settingsStored = null;
       agreementStored = null;
       setState((user) => ({
@@ -8898,6 +8938,8 @@ function createUser({ cloud, network, avatarCache = null, diag = null, onSession
       setState((user) => ({ ...user, banned: banned ?? null }));
     }), current((error) => {
       markError(diag, "user.moderation.listen", authStartedAt, error);
+      if (revokeAuthenticationError(authUser, error, "moderation-listener"))
+        return;
       setState((user) => ({ ...user, banned: null }));
     })));
     userWatches.push(cloud.user.blocked.watch(authUser.uid, current((blocked, info = {}) => {
@@ -8910,6 +8952,8 @@ function createUser({ cloud, network, avatarCache = null, diag = null, onSession
       });
     }), current((error) => {
       markError(diag, "user.blocked.listen", authStartedAt, error);
+      if (revokeAuthenticationError(authUser, error, "blocked-listener"))
+        return;
       setState((user) => ({ ...user, blockedReady: false }));
     })));
     userWatches.push(cloud.user.profile.watch(authUser.uid, current((profileData, info = {}) => {
@@ -8956,6 +9000,8 @@ function createUser({ cloud, network, avatarCache = null, diag = null, onSession
       }
     }), current((error) => {
       markError(diag, "user.profile.snapshot", authStartedAt, error);
+      if (revokeAuthenticationError(authUser, error, "profile-listener"))
+        return;
       avatarFetch = { uid: null, key: null, promise: null };
       setState((user) => ({
         ...user,
@@ -9186,6 +9232,8 @@ var init_user = __esm(() => {
   defaultUser = {
     uid: null,
     authReady: false,
+    authSessionReady: false,
+    authSessionActive: false,
     authCredential: null,
     profileReady: false,
     username: null,
@@ -45674,20 +45722,36 @@ function openAccount(options = {}) {
   let closePromise = null;
   let state;
   let chatSession = null;
+  let revokedUid = null;
+  let revocationPromise = null;
   let nextAgreement = agreementContract(options.agreement || CURRENT_AGREEMENT);
   const listeners = new Set;
   let activeWriteTail = Promise.resolve();
   const sessionCloseWork = new Set;
   const operationBarrier = createAccountOperationCloseBarrier();
+  function revokeSession(details = {}) {
+    const { uid = null } = details;
+    const accountUid = uid || state?.uid || null;
+    if (accountUid && revokedUid === accountUid) {
+      return revocationPromise || Promise.resolve();
+    }
+    revokedUid = accountUid;
+    let callback;
+    try {
+      callback = options.onSessionRevoked?.({ ...details, uid: accountUid });
+    } catch (error) {
+      callback = Promise.reject(error);
+    }
+    lock();
+    revocationPromise = Promise.resolve(callback);
+    return revocationPromise;
+  }
   const user = options.user || createUser({
     cloud,
     network: options.network || defaultNetwork,
     avatarCache,
     diag,
-    onSessionRevoked: ({ uid } = {}) => {
-      lock();
-      options.onSessionRevoked?.({ uid: uid || state?.uid || null });
-    }
+    onSessionRevoked: revokeSession
   });
   state = emptyState(user.getSnapshot(), options.network || defaultNetwork);
   const chat = createChatSession({
@@ -45936,6 +46000,24 @@ function openAccount(options = {}) {
         code: error?.code || "",
         message: error?.message || String(error)
       });
+      if (isAccountAuthenticationError(error)) {
+        revokeSession({
+          uid,
+          code: error?.code || "",
+          reason: "vault-listener"
+        }).catch((revocationError) => {
+          diag?.("account.session.revoke.error", {
+            code: revocationError?.code || "",
+            message: revocationError?.message || String(revocationError)
+          });
+        }).then(() => cloud.auth.logout()).catch((logoutError) => {
+          diag?.("account.session.revoke.auth.error", {
+            code: logoutError?.code || "",
+            message: logoutError?.message || String(logoutError)
+          });
+        });
+        return;
+      }
       lock();
       emit2({ vault: null, vaultReady: true, vaultError: error });
     });
@@ -46400,8 +46482,8 @@ function normalizePasskeyLoginError(error, options = {}) {
   return error;
 }
 function normalizePasskeyRegisterError(error, options = {}) {
-  if (error?.name === "InvalidStateError" || error?.code === "functions/already-exists") {
-    return passkeyError(PASSKEY_PROVIDER_ALREADY_LINKED, "this provider already has a passkey for this account. choose another provider, device, or security key", error);
+  if (error?.name === "CredentialAlreadyExistsException" || error?.name === "InvalidStateError" || error?.code === "functions/already-exists") {
+    return passkeyError(PASSKEY_PROVIDER_ALREADY_LINKED, "you already have a passkey for this account", error);
   }
   if (error?.code === "functions/failed-precondition") {
     return passkeyError(PASSKEY_RP_MISMATCH, "This passkey belongs to a different Glyphteck passkey setup.", error);
@@ -56424,7 +56506,7 @@ var package_default;
 var init_package2 = __esm(() => {
   package_default = {
     name: "veyl",
-    version: "0.66.3",
+    version: "0.67.0",
     packageManager: "bun@1.4.0",
     private: true,
     license: "UNLICENSED",
@@ -201665,18 +201747,25 @@ class Fleet {
     const client2 = this.client(profile);
     return operation(client2, publicAccount(record));
   }
+  failRecord(record, error) {
+    const message = error?.message || String(error);
+    record.error ||= message;
+    record.status = "error";
+    record.controller.abort(error);
+    if (record.failureEmitted)
+      return;
+    record.failureEmitted = true;
+    this.emit("account-error", {
+      account: publicAccount(record),
+      error: record.error
+    });
+  }
   queuePolicies(record, event2) {
     record.pendingEvents += 1;
     if (record.pendingEvents > this.maxPendingEvents) {
       record.pendingEvents -= 1;
       const error = new Error(`fleet event backlog exceeded for ${record.profile.profile}`);
-      record.error = error.message;
-      record.status = "error";
-      record.controller.abort(error);
-      this.emit("account-error", {
-        account: publicAccount(record),
-        error: error.message
-      });
+      this.failRecord(record, error);
       return;
     }
     if (this.policyReloading) {
@@ -201725,69 +201814,64 @@ class Fleet {
       unsubscribeRevoked: () => {},
       startedPolicies: [],
       reloadEvents: [],
-      closed: false
+      closed: false,
+      failureEmitted: false
     };
     this.records.set(profile.profile, record);
     this.emit("account-starting", { account: publicAccount(record) });
-    const baseOptions = typeof this.clientOptions === "function" ? await this.clientOptions(profile) : this.clientOptions;
-    record.client = await this.openClient({
-      ...baseOptions || {},
-      profile: profile.profile,
-      ...profile.network ? { network: profile.network } : {}
-    }, profile);
-    await record.client.ensureUnlocked();
-    for (const policy of this.policies) {
-      record.startedPolicies.push(policy);
-      await policy.start?.({
-        account: profile,
-        client: record.client,
-        fleet: this
-      });
-    }
-    let readyResolve;
-    let readyReject;
-    const ready2 = new Promise((resolve2, reject) => {
-      readyResolve = resolve2;
-      readyReject = reject;
-    });
-    record.unsubscribeRevoked = record.client.subscribeSessionRevoked?.(() => {
-      const error = new Error("account session revoked");
-      record.error = error.message;
-      record.status = "error";
-      controller.abort(error);
-      readyReject(error);
-      this.emit("account-error", {
-        account: publicAccount(record),
-        error: error.message
-      });
-    }) || (() => {});
-    const accountEventOptions = typeof this.eventOptions === "function" ? await this.eventOptions(profile) : this.eventOptions;
-    record.listenTask = record.client.listen({
-      ...accountEventOptions || {},
-      signal: controller.signal,
-      onEvent: (event2) => {
-        if (event2?.type === "ready")
-          readyResolve();
-        this.emit("account-event", {
-          account: publicAccount(record),
-          event: event2
+    try {
+      const baseOptions = typeof this.clientOptions === "function" ? await this.clientOptions(profile) : this.clientOptions;
+      record.client = await this.openClient({
+        ...baseOptions || {},
+        profile: profile.profile,
+        ...profile.network ? { network: profile.network } : {}
+      }, profile);
+      await record.client.ensureUnlocked();
+      for (const policy of this.policies) {
+        record.startedPolicies.push(policy);
+        await policy.start?.({
+          account: profile,
+          client: record.client,
+          fleet: this
         });
-        this.queuePolicies(record, event2);
       }
-    }).catch((error) => {
-      if (controller.signal.aborted)
-        return;
-      record.error = error?.message || String(error);
-      record.status = "error";
-      readyReject(error);
-      this.emit("account-error", {
-        account: publicAccount(record),
-        error: record.error
+      let readyResolve;
+      let readyReject;
+      const ready2 = new Promise((resolve2, reject) => {
+        readyResolve = resolve2;
+        readyReject = reject;
+      });
+      record.unsubscribeRevoked = record.client.subscribeSessionRevoked?.(() => {
+        const error = new Error("account session revoked");
+        this.failRecord(record, error);
+        readyReject(error);
+      }) || (() => {});
+      const accountEventOptions = typeof this.eventOptions === "function" ? await this.eventOptions(profile) : this.eventOptions;
+      record.listenTask = record.client.listen({
+        ...accountEventOptions || {},
+        signal: controller.signal,
+        onEvent: (event2) => {
+          if (event2?.type === "ready")
+            readyResolve();
+          this.emit("account-event", {
+            account: publicAccount(record),
+            event: event2
+          });
+          this.queuePolicies(record, event2);
+        }
+      }).catch((error) => {
+        if (controller.signal.aborted)
+          return;
+        this.failRecord(record, error);
+        readyReject(error);
       });
-    });
-    await waitFor3(ready2, this.startTimeoutMs, `fleet profile start timed out: ${profile.profile}`);
-    record.status = "ready";
-    this.emit("account-ready", { account: publicAccount(record) });
+      await waitFor3(ready2, this.startTimeoutMs, `fleet profile start timed out: ${profile.profile}`);
+      record.status = "ready";
+      this.emit("account-ready", { account: publicAccount(record) });
+    } catch (error) {
+      this.failRecord(record, error);
+      throw error;
+    }
   }
   async stopRecordPolicies(record) {
     const errors = [];
@@ -201999,10 +202083,13 @@ class Fleet {
       }
     };
     record.controller.abort();
-    await attempt(() => record.listenTask);
-    errors.push(...await this.stopRecordPolicies(record));
     await attempt(() => record.unsubscribeRevoked());
-    await attempt(() => record.client?.close());
+    errors.push(...await this.stopRecordPolicies(record));
+    const closeTask = Promise.resolve().then(() => record.client?.close());
+    await Promise.all([
+      attempt(() => record.listenTask),
+      attempt(() => closeTask)
+    ]);
     record.closed = true;
     record.status = errors.length || record.error ? "error" : "stopped";
     if (errors.length) {

package/dist/index.js

@@ -7921,7 +7921,7 @@ function closeSessionResources({ wallet, chatPK, chatPrivateKey, chatSigningSecr
   close(vaultAccess);
   close(vaultSigner);
   close(localCache);
-  pending.push(lockWallet(wallet));
+  lockWallet(wallet);
   lockChat(chatPrivateKey, chatPK);
   cleanBytes(chatSigningSecret, notificationPrivateKey, notificationPublicKey);
   return Promise.allSettled(pending).then(() => {
@@ -8550,12 +8550,16 @@ function settingsState(settings = defaultSettings) {
     }
   };
 }
+function isAccountAuthenticationError(error) {
+  const code = typeof error?.code === "string" ? error.code.toLowerCase() : "";
+  return code === "permission-denied" || code.endsWith("/permission-denied") || code === "unauthenticated" || code.endsWith("/unauthenticated");
+}
 function createUser({ cloud, network, avatarCache = null, diag = null, onSessionRevoked = null }) {
   if (!cloud) {
     throw new Error("createUser requires { cloud }");
   }
-  if (avatarCache && [avatarCache.read, avatarCache.write, avatarCache.remove, avatarCache.removeAll].some((method) => typeof method !== "function")) {
-    throw new Error("avatarCache requires read, write, remove, and removeAll");
+  if (avatarCache && [avatarCache.read, avatarCache.write, avatarCache.remove].some((method) => typeof method !== "function")) {
+    throw new Error("avatarCache requires read, write, and remove");
   }
   let activeNetwork = network;
   let state = defaultUser;
@@ -8693,9 +8697,6 @@ function createUser({ cloud, network, avatarCache = null, diag = null, onSession
       return;
     runCacheTask("user.avatar.cache.remove", () => avatarCache.remove(uid));
   }
-  function clearCachedAvatars() {
-    runCacheTask("user.avatar.cache.clear", () => avatarCache.removeAll());
-  }
   async function fetchAvatar(uid, { version = null, force = false, clear = false, persist = true } = {}) {
     if (!uid)
       return;
@@ -8778,6 +8779,54 @@ function createUser({ cloud, network, avatarCache = null, diag = null, onSession
   function isCurrentUser(uid, session) {
     return started && authSession === session && userUid === uid;
   }
+  function revokeAuthentication(authUser, {
+    code = "",
+    local = false,
+    reason = "session-inactive"
+  } = {}) {
+    if (revokingSession)
+      return;
+    revokingSession = true;
+    let callback;
+    try {
+      callback = onSessionRevoked?.({
+        uid: authUser.uid,
+        code,
+        reason
+      });
+    } catch (error) {
+      callback = Promise.reject(error);
+    }
+    markDiag(diag, "user.auth.revoked", {
+      code,
+      local,
+      reason
+    });
+    setState((user) => ({
+      ...user,
+      authSessionReady: true,
+      authSessionActive: false,
+      authCredential: null
+    }));
+    let operation = Promise.resolve(callback).catch((error) => markError(diag, "user.session.revoke.local", Date.now(), error));
+    if (!local) {
+      operation = operation.then(() => cloud.auth.logout()).catch((error) => markError(diag, "user.session.revoke.auth", Date.now(), error));
+    }
+    operation.finally(() => {
+      if (userUid === authUser.uid) {
+        revokingSession = false;
+      }
+    });
+  }
+  function revokeAuthenticationError(authUser, error, reason) {
+    if (!isAccountAuthenticationError(error))
+      return false;
+    revokeAuthentication(authUser, {
+      code: error?.code || "",
+      reason
+    });
+    return true;
+  }
   function watchUser(authUser) {
     if (!started)
       return;
@@ -8787,7 +8836,6 @@ function createUser({ cloud, network, avatarCache = null, diag = null, onSession
     closeUserWatches();
     markDiag(diag, "user.auth.state", { signedIn: !!authUser });
     if (!authUser) {
-      const signedOutUid = userUid;
       revokingSession = false;
       userUid = null;
       clearSettingsKey(settingsKey);
@@ -8796,17 +8844,11 @@ function createUser({ cloud, network, avatarCache = null, diag = null, onSession
       agreementStored = null;
       agreementOverride = null;
       agreementAcceptance = null;
-      if (signedOutUid) {
-        clearCachedAvatars();
-      }
       avatarFetch = { uid: null, key: null, promise: null };
       setState({ ...defaultUser, authReady: true });
       return;
     }
     const authUidChanged = userUid !== authUser.uid;
-    if (userUid && authUidChanged) {
-      clearCachedAvatars();
-    }
     userUid = authUser.uid;
     if (authUidChanged) {
       clearSettingsKey(settingsKey);
@@ -8836,32 +8878,28 @@ function createUser({ cloud, network, avatarCache = null, diag = null, onSession
     userWatches.push(cloud.auth.session.watch(authUser.uid, current((authSessionState) => {
       if (authSessionState?.active) {
         const authCredential = authSessionState.authCredential;
-        setState((user) => user.authCredential?.kind === authCredential?.kind && user.authCredential?.id === authCredential?.id ? user : { ...user, authCredential });
-        return;
-      }
-      if (revokingSession)
-        return;
-      revokingSession = true;
-      if (cloud.auth.session.isLocalTermination?.(authUser.uid, authSessionState?.generation)) {
-        Promise.resolve(onSessionRevoked?.({ uid: authUser.uid })).catch((error) => markError(diag, "user.session.revoke.local", Date.now(), error)).finally(() => {
-          if (userUid === authUser.uid) {
-            revokingSession = false;
-          }
+        setState((user) => user.authSessionReady && user.authSessionActive && user.authCredential?.kind === authCredential?.kind && user.authCredential?.id === authCredential?.id ? user : {
+          ...user,
+          authSessionReady: true,
+          authSessionActive: true,
+          authCredential
         });
         return;
       }
-      Promise.resolve(onSessionRevoked?.({ uid: authUser.uid })).catch((error) => markError(diag, "user.session.revoke.local", Date.now(), error)).then(() => cloud.auth.logout()).catch((error) => markError(diag, "user.session.revoke.auth", Date.now(), error)).finally(() => {
-        if (userUid === authUser.uid) {
-          revokingSession = false;
-        }
+      revokeAuthentication(authUser, {
+        local: cloud.auth.session.isLocalTermination?.(authUser.uid, authSessionState?.generation) === true,
+        reason: "session-inactive"
       });
     }), current((error) => {
       markError(diag, "user.session.listen", authStartedAt, error);
+      revokeAuthenticationError(authUser, error, "session-listener");
     })));
     userWatches.push(cloud.user.admin.watch(authUser.uid, current((allowed) => {
       setState((user) => ({ ...user, isAdmin: allowed, adminReady: true }));
     }), current((error) => {
       markError(diag, "user.admin.listen", authStartedAt, error);
+      if (revokeAuthenticationError(authUser, error, "admin-listener"))
+        return;
       setState((user) => ({ ...user, isAdmin: false, adminReady: true }));
     })));
     userWatches.push(cloud.user.private.watch(authUser.uid, current((privateData, info = {}) => {
@@ -8885,6 +8923,8 @@ function createUser({ cloud, network, avatarCache = null, diag = null, onSession
       }));
     }), current((error) => {
       markError(diag, "user.settings.snapshot", authStartedAt, error);
+      if (revokeAuthenticationError(authUser, error, "settings-listener"))
+        return;
       settingsStored = null;
       agreementStored = null;
       setState((user) => ({
@@ -8897,6 +8937,8 @@ function createUser({ cloud, network, avatarCache = null, diag = null, onSession
       setState((user) => ({ ...user, banned: banned ?? null }));
     }), current((error) => {
       markError(diag, "user.moderation.listen", authStartedAt, error);
+      if (revokeAuthenticationError(authUser, error, "moderation-listener"))
+        return;
       setState((user) => ({ ...user, banned: null }));
     })));
     userWatches.push(cloud.user.blocked.watch(authUser.uid, current((blocked, info = {}) => {
@@ -8909,6 +8951,8 @@ function createUser({ cloud, network, avatarCache = null, diag = null, onSession
       });
     }), current((error) => {
       markError(diag, "user.blocked.listen", authStartedAt, error);
+      if (revokeAuthenticationError(authUser, error, "blocked-listener"))
+        return;
       setState((user) => ({ ...user, blockedReady: false }));
     })));
     userWatches.push(cloud.user.profile.watch(authUser.uid, current((profileData, info = {}) => {
@@ -8955,6 +8999,8 @@ function createUser({ cloud, network, avatarCache = null, diag = null, onSession
       }
     }), current((error) => {
       markError(diag, "user.profile.snapshot", authStartedAt, error);
+      if (revokeAuthenticationError(authUser, error, "profile-listener"))
+        return;
       avatarFetch = { uid: null, key: null, promise: null };
       setState((user) => ({
         ...user,
@@ -9185,6 +9231,8 @@ var init_user = __esm(() => {
   defaultUser = {
     uid: null,
     authReady: false,
+    authSessionReady: false,
+    authSessionActive: false,
     authCredential: null,
     profileReady: false,
     username: null,
@@ -45673,20 +45721,36 @@ function openAccount(options = {}) {
   let closePromise = null;
   let state;
   let chatSession = null;
+  let revokedUid = null;
+  let revocationPromise = null;
   let nextAgreement = agreementContract(options.agreement || CURRENT_AGREEMENT);
   const listeners = new Set;
   let activeWriteTail = Promise.resolve();
   const sessionCloseWork = new Set;
   const operationBarrier = createAccountOperationCloseBarrier();
+  function revokeSession(details = {}) {
+    const { uid = null } = details;
+    const accountUid = uid || state?.uid || null;
+    if (accountUid && revokedUid === accountUid) {
+      return revocationPromise || Promise.resolve();
+    }
+    revokedUid = accountUid;
+    let callback;
+    try {
+      callback = options.onSessionRevoked?.({ ...details, uid: accountUid });
+    } catch (error) {
+      callback = Promise.reject(error);
+    }
+    lock();
+    revocationPromise = Promise.resolve(callback);
+    return revocationPromise;
+  }
   const user = options.user || createUser({
     cloud,
     network: options.network || defaultNetwork,
     avatarCache,
     diag,
-    onSessionRevoked: ({ uid } = {}) => {
-      lock();
-      options.onSessionRevoked?.({ uid: uid || state?.uid || null });
-    }
+    onSessionRevoked: revokeSession
   });
   state = emptyState(user.getSnapshot(), options.network || defaultNetwork);
   const chat = createChatSession({
@@ -45935,6 +45999,24 @@ function openAccount(options = {}) {
         code: error?.code || "",
         message: error?.message || String(error)
       });
+      if (isAccountAuthenticationError(error)) {
+        revokeSession({
+          uid,
+          code: error?.code || "",
+          reason: "vault-listener"
+        }).catch((revocationError) => {
+          diag?.("account.session.revoke.error", {
+            code: revocationError?.code || "",
+            message: revocationError?.message || String(revocationError)
+          });
+        }).then(() => cloud.auth.logout()).catch((logoutError) => {
+          diag?.("account.session.revoke.auth.error", {
+            code: logoutError?.code || "",
+            message: logoutError?.message || String(logoutError)
+          });
+        });
+        return;
+      }
       lock();
       emit2({ vault: null, vaultReady: true, vaultError: error });
     });
@@ -46399,8 +46481,8 @@ function normalizePasskeyLoginError(error, options = {}) {
   return error;
 }
 function normalizePasskeyRegisterError(error, options = {}) {
-  if (error?.name === "InvalidStateError" || error?.code === "functions/already-exists") {
-    return passkeyError(PASSKEY_PROVIDER_ALREADY_LINKED, "this provider already has a passkey for this account. choose another provider, device, or security key", error);
+  if (error?.name === "CredentialAlreadyExistsException" || error?.name === "InvalidStateError" || error?.code === "functions/already-exists") {
+    return passkeyError(PASSKEY_PROVIDER_ALREADY_LINKED, "you already have a passkey for this account", error);
   }
   if (error?.code === "functions/failed-precondition") {
     return passkeyError(PASSKEY_RP_MISMATCH, "This passkey belongs to a different Glyphteck passkey setup.", error);
@@ -56423,7 +56505,7 @@ var package_default;
 var init_package2 = __esm(() => {
   package_default = {
     name: "veyl",
-    version: "0.66.3",
+    version: "0.67.0",
     packageManager: "bun@1.4.0",
     private: true,
     license: "UNLICENSED",
@@ -201664,18 +201746,25 @@ class Fleet {
     const client2 = this.client(profile);
     return operation(client2, publicAccount(record));
   }
+  failRecord(record, error) {
+    const message = error?.message || String(error);
+    record.error ||= message;
+    record.status = "error";
+    record.controller.abort(error);
+    if (record.failureEmitted)
+      return;
+    record.failureEmitted = true;
+    this.emit("account-error", {
+      account: publicAccount(record),
+      error: record.error
+    });
+  }
   queuePolicies(record, event2) {
     record.pendingEvents += 1;
     if (record.pendingEvents > this.maxPendingEvents) {
       record.pendingEvents -= 1;
       const error = new Error(`fleet event backlog exceeded for ${record.profile.profile}`);
-      record.error = error.message;
-      record.status = "error";
-      record.controller.abort(error);
-      this.emit("account-error", {
-        account: publicAccount(record),
-        error: error.message
-      });
+      this.failRecord(record, error);
       return;
     }
     if (this.policyReloading) {
@@ -201724,69 +201813,64 @@ class Fleet {
       unsubscribeRevoked: () => {},
       startedPolicies: [],
       reloadEvents: [],
-      closed: false
+      closed: false,
+      failureEmitted: false
     };
     this.records.set(profile.profile, record);
     this.emit("account-starting", { account: publicAccount(record) });
-    const baseOptions = typeof this.clientOptions === "function" ? await this.clientOptions(profile) : this.clientOptions;
-    record.client = await this.openClient({
-      ...baseOptions || {},
-      profile: profile.profile,
-      ...profile.network ? { network: profile.network } : {}
-    }, profile);
-    await record.client.ensureUnlocked();
-    for (const policy of this.policies) {
-      record.startedPolicies.push(policy);
-      await policy.start?.({
-        account: profile,
-        client: record.client,
-        fleet: this
-      });
-    }
-    let readyResolve;
-    let readyReject;
-    const ready2 = new Promise((resolve2, reject) => {
-      readyResolve = resolve2;
-      readyReject = reject;
-    });
-    record.unsubscribeRevoked = record.client.subscribeSessionRevoked?.(() => {
-      const error = new Error("account session revoked");
-      record.error = error.message;
-      record.status = "error";
-      controller.abort(error);
-      readyReject(error);
-      this.emit("account-error", {
-        account: publicAccount(record),
-        error: error.message
-      });
-    }) || (() => {});
-    const accountEventOptions = typeof this.eventOptions === "function" ? await this.eventOptions(profile) : this.eventOptions;
-    record.listenTask = record.client.listen({
-      ...accountEventOptions || {},
-      signal: controller.signal,
-      onEvent: (event2) => {
-        if (event2?.type === "ready")
-          readyResolve();
-        this.emit("account-event", {
-          account: publicAccount(record),
-          event: event2
+    try {
+      const baseOptions = typeof this.clientOptions === "function" ? await this.clientOptions(profile) : this.clientOptions;
+      record.client = await this.openClient({
+        ...baseOptions || {},
+        profile: profile.profile,
+        ...profile.network ? { network: profile.network } : {}
+      }, profile);
+      await record.client.ensureUnlocked();
+      for (const policy of this.policies) {
+        record.startedPolicies.push(policy);
+        await policy.start?.({
+          account: profile,
+          client: record.client,
+          fleet: this
         });
-        this.queuePolicies(record, event2);
       }
-    }).catch((error) => {
-      if (controller.signal.aborted)
-        return;
-      record.error = error?.message || String(error);
-      record.status = "error";
-      readyReject(error);
-      this.emit("account-error", {
-        account: publicAccount(record),
-        error: record.error
+      let readyResolve;
+      let readyReject;
+      const ready2 = new Promise((resolve2, reject) => {
+        readyResolve = resolve2;
+        readyReject = reject;
+      });
+      record.unsubscribeRevoked = record.client.subscribeSessionRevoked?.(() => {
+        const error = new Error("account session revoked");
+        this.failRecord(record, error);
+        readyReject(error);
+      }) || (() => {});
+      const accountEventOptions = typeof this.eventOptions === "function" ? await this.eventOptions(profile) : this.eventOptions;
+      record.listenTask = record.client.listen({
+        ...accountEventOptions || {},
+        signal: controller.signal,
+        onEvent: (event2) => {
+          if (event2?.type === "ready")
+            readyResolve();
+          this.emit("account-event", {
+            account: publicAccount(record),
+            event: event2
+          });
+          this.queuePolicies(record, event2);
+        }
+      }).catch((error) => {
+        if (controller.signal.aborted)
+          return;
+        this.failRecord(record, error);
+        readyReject(error);
       });
-    });
-    await waitFor3(ready2, this.startTimeoutMs, `fleet profile start timed out: ${profile.profile}`);
-    record.status = "ready";
-    this.emit("account-ready", { account: publicAccount(record) });
+      await waitFor3(ready2, this.startTimeoutMs, `fleet profile start timed out: ${profile.profile}`);
+      record.status = "ready";
+      this.emit("account-ready", { account: publicAccount(record) });
+    } catch (error) {
+      this.failRecord(record, error);
+      throw error;
+    }
   }
   async stopRecordPolicies(record) {
     const errors = [];
@@ -201998,10 +202082,13 @@ class Fleet {
       }
     };
     record.controller.abort();
-    await attempt(() => record.listenTask);
-    errors.push(...await this.stopRecordPolicies(record));
     await attempt(() => record.unsubscribeRevoked());
-    await attempt(() => record.client?.close());
+    errors.push(...await this.stopRecordPolicies(record));
+    const closeTask = Promise.resolve().then(() => record.client?.close());
+    await Promise.all([
+      attempt(() => record.listenTask),
+      attempt(() => closeTask)
+    ]);
     record.closed = true;
     record.status = errors.length || record.error ? "error" : "stopped";
     if (errors.length) {

package/package.json

@@ -42,5 +42,5 @@
         "start": "node src/cli.js",
         "lint": "eslint src --quiet"
     },
-    "version": "0.66.3"
+    "version": "0.67.0"
 }