@glyphteck/veyl 0.66.3 → 0.68.0

package/dist/accountprofiles.js

@@ -115,6 +115,7 @@ var CHAT_MANIFEST_MAX_BYTES = 256 * KIB_BYTES;
 var CHAT_RECEIPT_MAX_MEMBERS = 32;
 var CHAT_ORDINARY_DELIVERY_MAX_MEMBERS = 128;
 var CHAT_MAX_MEMBERS = 256;
+var CHAT_LARGE_GROUP_MENTION_MAX_TARGETS = 16;
 var CHAT_MAX_TEXT_CHARS = 2048;
 var CHAT_TITLE_INPUT_MAX_CHARS = 16;
 var CHAT_MAX_REACTIONS = CHAT_MAX_MEMBERS;
@@ -249,6 +250,57 @@ function cleanBytes(...values) {
   }
 }
 
+// ../../core/passkey.js
+var PASSKEY_ENVIRONMENT_MISMATCH = "passkey-environment-mismatch";
+var PASSKEY_PROVIDER_ALREADY_LINKED = "passkey-provider-already-linked";
+var PASSKEY_REGISTER_INVALID = "passkey-register-invalid";
+var PASSKEY_RP_MISMATCH = "passkey-rp-mismatch";
+var PASSKEY_UNLINKED = "passkey-unlinked";
+var PASSKEY_CANCELLED_CODES = new Set(["ERR_USER_CANCELLED"]);
+var PASSKEY_CANCELLED_NAMES = new Set(["UserCancelledException"]);
+var PASSKEY_CONTROLLED_ERRORS = new Set([
+  PASSKEY_ENVIRONMENT_MISMATCH,
+  PASSKEY_PROVIDER_ALREADY_LINKED,
+  PASSKEY_REGISTER_INVALID,
+  PASSKEY_RP_MISMATCH,
+  PASSKEY_UNLINKED
+]);
+function canDeletePasskey(row, passkeys, currentPasskeyId) {
+  if (row?.type === "pending")
+    return true;
+  return row?.type === "passkey" && Array.isArray(passkeys) && passkeys.length > 1 && row.id !== cleanText(currentPasskeyId);
+}
+function passkeyError(code, message, cause) {
+  const error = new Error(message);
+  error.code = code;
+  error.cause = cause;
+  return error;
+}
+function normalizePasskeyLoginError(error, options = {}) {
+  if (options.localhostSilo === true && error?.code === "functions/failed-precondition" && cleanText(error?.message).includes("Localhost uses a separate passkey silo")) {
+    return passkeyError(PASSKEY_ENVIRONMENT_MISMATCH, "This passkey belongs to glyphteck.com, not localhost.", error);
+  }
+  if (error?.code === "functions/not-found") {
+    return passkeyError(PASSKEY_UNLINKED, "This passkey is no longer linked to an account.", error);
+  }
+  if (error?.code === "functions/failed-precondition") {
+    return passkeyError(PASSKEY_RP_MISMATCH, "This passkey belongs to a different Glyphteck passkey setup.", error);
+  }
+  return error;
+}
+function normalizePasskeyRegisterError(error, options = {}) {
+  if (error?.name === "CredentialAlreadyExistsException" || error?.name === "InvalidStateError" || error?.code === "functions/already-exists") {
+    return passkeyError(PASSKEY_PROVIDER_ALREADY_LINKED, "you already have a passkey for this account", error);
+  }
+  if (error?.code === "functions/failed-precondition") {
+    return passkeyError(PASSKEY_RP_MISMATCH, "This passkey belongs to a different Glyphteck passkey setup.", error);
+  }
+  if (options.invalidArgument === true && error?.code === "functions/invalid-argument" && error?.message) {
+    return passkeyError(PASSKEY_REGISTER_INVALID, error.message, error);
+  }
+  return error;
+}
+
 // ../../core/account/profiles.js
 var ACCOUNT_PROFILES_VERSION = 1;
 var PROFILE_ID_RE = /^[0-9a-f]{32}$/;
@@ -512,6 +564,71 @@ function deselectAccountProfile(value, profileId) {
   return freezeRegistry({ ...registry, selectedProfileId: null });
 }
 
+// ../../core/account/scope.js
+var ACCOUNT_SCOPE_STALE_CODE = "account-scope/stale";
+var PROFILE_ID_RE2 = /^[0-9a-f]{32}$/;
+var ACCOUNT_SCOPE_CAPABILITIES = new WeakSet;
+function requireGeneration(value) {
+  const generation = Number(value);
+  if (!Number.isSafeInteger(generation) || generation < 0) {
+    throw new Error("account scope generation required");
+  }
+  return generation;
+}
+function requireProfileId(value) {
+  const profileId = lowerText(value);
+  if (!PROFILE_ID_RE2.test(profileId))
+    throw new Error("account scope profile id required");
+  return profileId;
+}
+function requireText(value, label) {
+  const text = cleanText(value);
+  if (!text)
+    throw new Error(`${label} required`);
+  return text;
+}
+function staleAccountScopeError(scope = null) {
+  const error = new Error("account scope is no longer active");
+  error.code = ACCOUNT_SCOPE_STALE_CODE;
+  error.profileId = scope?.profileId || null;
+  error.generation = Number.isSafeInteger(scope?.generation) ? scope.generation : null;
+  return error;
+}
+function createAccountScope({
+  environment,
+  generation,
+  isCurrent,
+  profileId,
+  uid
+} = {}) {
+  if (typeof isCurrent !== "function")
+    throw new Error("account scope current-state port required");
+  const normalizedEnvironment = lowerText(requireText(environment, "account scope environment"));
+  const normalizedGeneration = requireGeneration(generation);
+  const normalizedProfileId = requireProfileId(profileId);
+  const normalizedUid = requireText(uid, "account scope uid");
+  const accountOwnerKey = `${normalizedEnvironment}:${normalizedProfileId}:${normalizedUid}`;
+  const scope = {
+    accountOwnerKey,
+    environment: normalizedEnvironment,
+    generation: normalizedGeneration,
+    key: `${accountOwnerKey}:${normalizedGeneration}`,
+    profileId: normalizedProfileId,
+    uid: normalizedUid,
+    isCurrent: () => isCurrent() === true,
+    assertCurrent() {
+      if (!scope.isCurrent())
+        throw staleAccountScopeError(scope);
+      return scope;
+    }
+  };
+  ACCOUNT_SCOPE_CAPABILITIES.add(scope);
+  return Object.freeze(scope);
+}
+function isAccountScope(value) {
+  return !!value && typeof value === "object" && ACCOUNT_SCOPE_CAPABILITIES.has(value);
+}
+
 // src/accountprofiles.js
 var ACCOUNT_PROFILE_STALE_CODE = "account-profiles/stale";
 var ACCOUNT_PROFILE_AUTH_REQUIRED_CODE = "account-profiles/auth-required";
@@ -606,7 +723,7 @@ function requirePorts(options) {
     onError: typeof options.onError === "function" ? options.onError : null
   };
 }
-async function resolveAuthenticatedProfile(owner, generation, reason) {
+async function resolveAuthenticatedProfile(owner, generation, reason, details = {}) {
   ensureGeneration(owner, generation);
   const registry = owner.registry;
   const context = Object.freeze({
@@ -614,6 +731,7 @@ async function resolveAuthenticatedProfile(owner, generation, reason) {
     generation,
     reason,
     requestedProfileId: owner.requestedProfileId,
+    rejectedProfileId: details.rejectedProfileId || null,
     isCurrent: () => !owner.closing && !owner.closed && owner.generation === generation
   });
   const profileId = await owner.ports.resolveAuthenticatedProfile(registry, context);
@@ -626,12 +744,16 @@ async function resolveAuthenticatedProfile(owner, generation, reason) {
   return profile;
 }
 function publicSnapshot(owner) {
+  const activeBinding = owner.active?.lease.valid === true && owner.active.scope?.isCurrent() === true ? owner.active.binding : null;
   return Object.freeze({
     ready: owner.ready,
     environment: owner.registry.environment,
     profiles: accountProfilesByRecency(owner.registry),
     selectedProfileId: owner.registry.selectedProfileId,
-    activeProfileId: owner.active?.profile.profileId || null,
+    activeBinding,
+    activeProfileId: activeBinding ? owner.active.profile.profileId : null,
+    activeScope: activeBinding?.scope || null,
+    activeScopeKey: activeBinding?.scope.key || null,
     status: owner.status,
     generation: owner.generation,
     error: owner.error
@@ -693,12 +815,23 @@ function ensureRequested(owner, generation, profileId) {
     throw staleTransitionError();
 }
 function transitionContext(owner, lease, reason, details = {}) {
+  const profile = lease.profileId ? owner.registry.profiles.find((item) => item.profileId === lease.profileId) || null : null;
+  const isCurrent = () => !owner.closing && !owner.closed && lease.valid;
   return Object.freeze({
+    environment: owner.registry.environment,
     generation: lease.generation,
     profileId: lease.profileId,
+    uid: profile?.uid || null,
     reason,
     ...details,
-    isCurrent: () => !owner.closing && !owner.closed && lease.valid
+    scope: profile ? createAccountScope({
+      environment: owner.registry.environment,
+      generation: lease.generation,
+      profileId: lease.profileId,
+      uid: profile.uid,
+      isCurrent
+    }) : null,
+    isCurrent
   });
 }
 function report(owner, operation, error, profile = null) {
@@ -721,7 +854,13 @@ async function cleanupBinding(owner, binding, context) {
     binding.lease.valid = false;
     await attempt("lock", () => binding.runtime.lock());
   }
-  await attempt("clearNotification", () => owner.ports.clearNotification(profile, context));
+  if (binding?.scope?.key && binding.scope.accountOwnerKey) {
+    await attempt("clearNotification", () => owner.ports.clearNotification(Object.freeze({
+      owner: binding.scope,
+      profile,
+      context
+    })));
+  }
   if (binding) {
     try {
       await owner.ports.dropPush(profile, binding.runtime, context);
@@ -821,7 +960,13 @@ async function openTarget(owner, profile, generation, reason, options = {}) {
     return discardCandidate(owner, profile, runtime, lease, "stale", null);
   }
   owner.openingLease = null;
-  owner.active = { profile, runtime, lease };
+  owner.active = {
+    profile,
+    runtime,
+    lease,
+    scope: context.scope,
+    binding: Object.freeze({ runtime, scope: context.scope })
+  };
   publish(owner, "idle", null);
   return runtime;
 }
@@ -981,7 +1126,9 @@ async function applyAuthenticatedProfile(owner, profile, generation, reason, opt
 }
 async function resumeAuthenticatedProfile(owner, generation, reason, options = {}) {
   publish(owner, reason, null);
-  const profile = await resolveAuthenticatedProfile(owner, generation, reason);
+  const profile = await resolveAuthenticatedProfile(owner, generation, reason, {
+    rejectedProfileId: options.rejectedProfileId
+  });
   return applyAuthenticatedProfile(owner, profile, generation, reason, options);
 }
 function transitionFailure(owner, error, generation, profileId) {
@@ -1009,12 +1156,15 @@ async function initialize(owner) {
     throw error;
   }
 }
-function requestAuthenticatedProfileResume(owner) {
+function requestAuthenticatedProfileResume(owner, options = {}) {
   ensureReady(owner);
+  const rejectedProfileId = options.rejectedProfileId == null ? null : readAccountProfileId(options.rejectedProfileId);
   const generation = requestSelection(owner, null, false);
   return enqueue(owner, async () => {
     try {
-      return await resumeAuthenticatedProfile(owner, generation, "restoring");
+      return await resumeAuthenticatedProfile(owner, generation, "restoring", {
+        rejectedProfileId
+      });
     } catch (error) {
       if (!isStaleAccountProfileTransition(error))
         publish(owner, "error", error);
@@ -1353,11 +1503,11 @@ function createAccountProfiles(options = {}) {
       const generation = requestSelection(owner, profileId, false);
       return enqueue(owner, () => switchExisting(owner, profileId, generation));
     },
-    resumeAuthenticated: () => requestAuthenticatedProfileResume(owner),
+    resumeAuthenticated: (options2) => requestAuthenticatedProfileResume(owner, options2),
     refresh: () => requestProfileRefresh(owner),
     signOut: (profileId) => requestProfileSignOut(owner, profileId),
     remove: (profileId) => requestProfileRemoval(owner, profileId),
-    getActiveRuntime: () => owner.active?.runtime || null,
+    getActiveBinding: () => owner.snapshot.activeBinding,
     close: () => closeProfiles(owner)
   });
 }

package/dist/auth.js

@@ -82,8 +82,8 @@ function normalizePasskeyLoginError(error, options = {}) {
   return error;
 }
 function normalizePasskeyRegisterError(error, options = {}) {
-  if (error?.name === "InvalidStateError" || error?.code === "functions/already-exists") {
-    return passkeyError(PASSKEY_PROVIDER_ALREADY_LINKED, "this provider already has a passkey for this account. choose another provider, device, or security key", error);
+  if (error?.name === "CredentialAlreadyExistsException" || error?.name === "InvalidStateError" || error?.code === "functions/already-exists") {
+    return passkeyError(PASSKEY_PROVIDER_ALREADY_LINKED, "you already have a passkey for this account", error);
   }
   if (error?.code === "functions/failed-precondition") {
     return passkeyError(PASSKEY_RP_MISMATCH, "This passkey belongs to a different Glyphteck passkey setup.", error);
@@ -95,7 +95,7 @@ function normalizePasskeyRegisterError(error, options = {}) {
 }
 
 // ../../core/agreement.js
-var TERMS_VERSION = "2026-08-22.4";
+var TERMS_VERSION = "2026-09-01.1";
 var CURRENT_AGREEMENT = Object.freeze({
   termsVersion: TERMS_VERSION
 });