@glyphteck/veyl 0.68.0 → 0.69.0

package/dist/kdf-worker-thread.js

@@ -48,39 +48,7 @@ var __export = (target, all) => {
 var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
-// ../../node_modules/.bun/@noble+hashes@2.3.0/node_modules/@noble/hashes/_u64.js
-function fromBig(n, le = false) {
-  if (le)
-    return { h: Number(n & U32_MASK64), l: Number(n >> _32n & U32_MASK64) };
-  return { h: Number(n >> _32n & U32_MASK64) | 0, l: Number(n & U32_MASK64) | 0 };
-}
-function split(lst, le = false) {
-  const len = lst.length;
-  let Ah = new Uint32Array(len);
-  let Al = new Uint32Array(len);
-  for (let i = 0;i < len; i++) {
-    const { h, l } = fromBig(lst[i], le);
-    [Ah[i], Al[i]] = [h, l];
-  }
-  return [Ah, Al];
-}
-function setU64FromNum(view, byteOffset, n, isLE) {
-  const h = fromNumH(n);
-  const l = fromNumL(n);
-  view.setUint32(byteOffset, isLE ? l : h, isLE);
-  view.setUint32(byteOffset + 4, isLE ? h : l, isLE);
-}
-function add(Ah, Al, Bh, Bl) {
-  const l = (Al >>> 0) + (Bl >>> 0);
-  return { h: Ah + Bh + (l / 2 ** 32 | 0) | 0, l: l | 0 };
-}
-var U32_MASK64, _32n, fromNumH = (n) => n / 2 ** 32 | 0, fromNumL = (n) => n >>> 0, shrSH = (h, _l, s) => h >>> s, shrSL = (h, l, s) => h << 32 - s | l >>> s, rotrSH = (h, l, s) => h >>> s | l << 32 - s, rotrSL = (h, l, s) => h << 32 - s | l >>> s, rotrBH = (h, l, s) => h << 64 - s | l >>> s - 32, rotrBL = (h, l, s) => h >>> s - 32 | l << 64 - s, rotr32H = (_h, l) => l, rotr32L = (h, _l) => h, add3L = (Al, Bl, Cl) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0), add3H = (low, Ah, Bh, Ch) => Ah + Bh + Ch + (low / 2 ** 32 | 0) | 0, add4L = (Al, Bl, Cl, Dl) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0), add4H = (low, Ah, Bh, Ch, Dh) => Ah + Bh + Ch + Dh + (low / 2 ** 32 | 0) | 0, add5L = (Al, Bl, Cl, Dl, El) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0) + (El >>> 0), add5H = (low, Ah, Bh, Ch, Dh, Eh) => Ah + Bh + Ch + Dh + Eh + (low / 2 ** 32 | 0) | 0;
-var init__u64 = __esm(() => {
-  U32_MASK64 = /* @__PURE__ */ (() => BigInt(2 ** 32 - 1))();
-  _32n = /* @__PURE__ */ BigInt(32);
-});
-
-// ../../node_modules/.bun/@noble+hashes@2.3.0/node_modules/@noble/hashes/utils.js
+// ../../node_modules/.bun/@noble+hashes@2.4.0/node_modules/@noble/hashes/utils.js
 function isBytes(a) {
   return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array" && "BYTES_PER_ELEMENT" in a && a.BYTES_PER_ELEMENT === 1;
 }
@@ -198,7 +166,12 @@ function hexToBytes(hex) {
 function utf8ToBytes(str) {
   if (typeof str !== "string")
     throw new TypeError("string expected");
-  return new Uint8Array(new TextEncoder().encode(str));
+  const encoded = new TextEncoder().encode(str);
+  try {
+    return new Uint8Array(encoded);
+  } finally {
+    clean(encoded);
+  }
 }
 function kdfInputToBytes(data, errorTitle = "") {
   if (typeof data === "string")
@@ -221,10 +194,10 @@ function concatBytes(...arrays) {
   return res;
 }
 function checkOpts(defaults, opts, title = "opts") {
-  aobject(defaults, "defaults");
+  aopts(defaults, "defaults");
   if (opts !== undefined)
-    aobject(opts, title);
-  const merged = Object.assign(defaults, opts);
+    aopts(opts, title);
+  const merged = Object.assign(Object.create(null), defaults, opts);
   return merged;
 }
 function createHasher(hashCons, info = {}) {
@@ -252,6 +225,13 @@ function randomBytes(bytesLength = 32) {
 var atitle = (title) => title ? `"${title}" ` : "", aobject = (value, label) => {
   if (value === null || typeof value !== "object" || Array.isArray(value))
     throw new TypeError((label === "object" ? "" : `"${label}" `) + "expected object, got type=" + typeof value);
+}, aopts = (value, label) => {
+  aobject(value, label);
+  const proto = Object.getPrototypeOf(value);
+  if (proto !== Object.prototype && proto !== null)
+    throw new TypeError(`"${label}" expected plain object`);
+  if (Object.hasOwn(value, "__proto__"))
+    throw new TypeError(`"${label}.__proto__" is not allowed`);
 }, isLE, swap8IfBE, swap32IfBE, hasHexBuiltin, hexes, oidNist = (suffix) => ({
   oid: Uint8Array.from([6, 9, 96, 134, 72, 1, 101, 3, 4, 2, suffix])
 });
@@ -263,7 +243,39 @@ var init_utils = __esm(() => {
   hexes = /* @__PURE__ */ Array.from({ length: 256 }, (_, i) => i.toString(16).padStart(2, "0"));
 });
 
-// ../../node_modules/.bun/@noble+hashes@2.3.0/node_modules/@noble/hashes/_md.js
+// ../../node_modules/.bun/@noble+hashes@2.4.0/node_modules/@noble/hashes/_u64.js
+function fromBig(n, le = false) {
+  if (le)
+    return { h: Number(n & U32_MASK64), l: Number(n >> _32n & U32_MASK64) };
+  return { h: Number(n >> _32n & U32_MASK64) | 0, l: Number(n & U32_MASK64) | 0 };
+}
+function split(lst, le = false) {
+  const len = lst.length;
+  let Ah = new Uint32Array(len);
+  let Al = new Uint32Array(len);
+  for (let i = 0;i < len; i++) {
+    const { h, l } = fromBig(lst[i], le);
+    [Ah[i], Al[i]] = [h, l];
+  }
+  return [Ah, Al];
+}
+function setU64FromNum(view, byteOffset, n, isLE2) {
+  const h = fromNumH(n);
+  const l = fromNumL(n);
+  view.setUint32(byteOffset, isLE2 ? l : h, isLE2);
+  view.setUint32(byteOffset + 4, isLE2 ? h : l, isLE2);
+}
+function add(Ah, Al, Bh, Bl) {
+  const l = (Al >>> 0) + (Bl >>> 0);
+  return { h: Ah + Bh + (l / 2 ** 32 | 0) | 0, l: l | 0 };
+}
+var U32_MASK64, _32n, fromNumH = (n) => n / 2 ** 32 | 0, fromNumL = (n) => n >>> 0, shrSH = (h, _l, s) => h >>> s, shrSL = (h, l, s) => h << 32 - s | l >>> s, rotrSH = (h, l, s) => h >>> s | l << 32 - s, rotrSL = (h, l, s) => h << 32 - s | l >>> s, rotrBH = (h, l, s) => h << 64 - s | l >>> s - 32, rotrBL = (h, l, s) => h >>> s - 32 | l << 64 - s, rotr32H = (_h, l) => l, rotr32L = (h, _l) => h, add3L = (Al, Bl, Cl) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0), add3H = (low, Ah, Bh, Ch) => Ah + Bh + Ch + (low / 2 ** 32 | 0) | 0, add4L = (Al, Bl, Cl, Dl) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0), add4H = (low, Ah, Bh, Ch, Dh) => Ah + Bh + Ch + Dh + (low / 2 ** 32 | 0) | 0, add5L = (Al, Bl, Cl, Dl, El) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0) + (El >>> 0), add5H = (low, Ah, Bh, Ch, Dh, Eh) => Ah + Bh + Ch + Dh + Eh + (low / 2 ** 32 | 0) | 0;
+var init__u64 = __esm(() => {
+  U32_MASK64 = /* @__PURE__ */ (() => BigInt(2 ** 32 - 1))();
+  _32n = /* @__PURE__ */ BigInt(32);
+});
+
+// ../../node_modules/.bun/@noble+hashes@2.4.0/node_modules/@noble/hashes/_md.js
 function Chi(a, b, c) {
   return a & b ^ ~a & c;
 }
@@ -402,10 +414,7 @@ var init__md = __esm(() => {
 // src/runtime/kdf-worker-thread.js
 import { parentPort } from "node:worker_threads";
 
-// ../../node_modules/.bun/@noble+hashes@2.3.0/node_modules/@noble/hashes/argon2.js
-init__u64();
-
-// ../../node_modules/.bun/@noble+hashes@2.3.0/node_modules/@noble/hashes/_blake.js
+// ../../node_modules/.bun/@noble+hashes@2.4.0/node_modules/@noble/hashes/_blake.js
 var BSIGMA = /* @__PURE__ */ Uint8Array.from([
   0,
   1,
@@ -665,7 +674,7 @@ var BSIGMA = /* @__PURE__ */ Uint8Array.from([
   9
 ]);
 
-// ../../node_modules/.bun/@noble+hashes@2.3.0/node_modules/@noble/hashes/blake2.js
+// ../../node_modules/.bun/@noble+hashes@2.4.0/node_modules/@noble/hashes/blake2.js
 init__u64();
 init_utils();
 var B2B_IV = /* @__PURE__ */ Uint32Array.from([
@@ -1000,7 +1009,7 @@ class _BLAKE2b extends _BLAKE2 {
 }
 var blake2b = /* @__PURE__ */ createHasher((opts) => new _BLAKE2b(opts));
 
-// ../../node_modules/.bun/@noble+hashes@2.3.0/node_modules/@noble/hashes/argon2.js
+// ../../node_modules/.bun/@noble+hashes@2.4.0/node_modules/@noble/hashes/argon2.js
 init_utils();
 var AT = { Argon2d: 0, Argon2i: 1, Argon2id: 2 };
 var ARGON2_SYNC_POINTS = 4;
@@ -1009,25 +1018,6 @@ var abytesOrZero = (buf, errorTitle = "") => {
     return Uint8Array.of();
   return kdfInputToBytes(buf, errorTitle);
 };
-function mul(a, b) {
-  const aL = a & 65535;
-  const aH = a >>> 16;
-  const bL = b & 65535;
-  const bH = b >>> 16;
-  const ll = Math.imul(aL, bL);
-  const hl = Math.imul(aH, bL);
-  const lh = Math.imul(aL, bH);
-  const hh = Math.imul(aH, bH);
-  const carry = (ll >>> 16) + (hl & 65535) + lh;
-  const high = hh + (hl >>> 16) + (carry >>> 16) | 0;
-  const low = carry << 16 | ll & 65535;
-  return { h: high, l: low };
-}
-function mulHi(a, b) {
-  const aL = a & 65535, aH = a >>> 16, bL = b & 65535, bH = b >>> 16;
-  const carry = (Math.imul(aL, bL) >>> 16) + (Math.imul(aH, bL) & 65535) + Math.imul(aL, bH);
-  return Math.imul(aH, bH) + (Math.imul(aH, bL) >>> 16) + (carry >>> 16) | 0;
-}
 var A2_BUF = new Uint32Array(256);
 function G(a, b, c, d) {
   let Al = A2_BUF[2 * a], Ah = A2_BUF[2 * a + 1];
@@ -1036,41 +1026,41 @@ function G(a, b, c, d) {
   let Dl = A2_BUF[2 * d], Dh = A2_BUF[2 * d + 1];
   let ml = 0, mh = 0, rl = 0, xh = 0, xl = 0;
   ml = Math.imul(Al, Bl);
-  mh = mulHi(Al, Bl);
+  mh = ((Al >>> 0) * (Bl >>> 0) - (ml >>> 0)) / 4294967296 + 0.5 | 0;
   rl = (Al >>> 0) + (Bl >>> 0) + (ml << 1 >>> 0);
   Ah = Ah + Bh + (mh << 1 | ml >>> 31) + (rl / 4294967296 | 0) | 0;
   Al = rl | 0;
   xh = Dh ^ Ah;
   xl = Dl ^ Al;
-  Dh = rotr32H(xh, xl);
-  Dl = rotr32L(xh, xl);
+  Dh = xl;
+  Dl = xh;
   ml = Math.imul(Cl, Dl);
-  mh = mulHi(Cl, Dl);
+  mh = ((Cl >>> 0) * (Dl >>> 0) - (ml >>> 0)) / 4294967296 + 0.5 | 0;
   rl = (Cl >>> 0) + (Dl >>> 0) + (ml << 1 >>> 0);
   Ch = Ch + Dh + (mh << 1 | ml >>> 31) + (rl / 4294967296 | 0) | 0;
   Cl = rl | 0;
   xh = Bh ^ Ch;
   xl = Bl ^ Cl;
-  Bh = rotrSH(xh, xl, 24);
-  Bl = rotrSL(xh, xl, 24);
+  Bh = xh >>> 24 | xl << 8;
+  Bl = xh << 8 | xl >>> 24;
   ml = Math.imul(Al, Bl);
-  mh = mulHi(Al, Bl);
+  mh = ((Al >>> 0) * (Bl >>> 0) - (ml >>> 0)) / 4294967296 + 0.5 | 0;
   rl = (Al >>> 0) + (Bl >>> 0) + (ml << 1 >>> 0);
   Ah = Ah + Bh + (mh << 1 | ml >>> 31) + (rl / 4294967296 | 0) | 0;
   Al = rl | 0;
   xh = Dh ^ Ah;
   xl = Dl ^ Al;
-  Dh = rotrSH(xh, xl, 16);
-  Dl = rotrSL(xh, xl, 16);
+  Dh = xh >>> 16 | xl << 16;
+  Dl = xh << 16 | xl >>> 16;
   ml = Math.imul(Cl, Dl);
-  mh = mulHi(Cl, Dl);
+  mh = ((Cl >>> 0) * (Dl >>> 0) - (ml >>> 0)) / 4294967296 + 0.5 | 0;
   rl = (Cl >>> 0) + (Dl >>> 0) + (ml << 1 >>> 0);
   Ch = Ch + Dh + (mh << 1 | ml >>> 31) + (rl / 4294967296 | 0) | 0;
   Cl = rl | 0;
   xh = Bh ^ Ch;
   xl = Bl ^ Cl;
-  Bh = rotrBH(xh, xl, 63);
-  Bl = rotrBL(xh, xl, 63);
+  Bh = xh << 1 | xl >>> 31;
+  Bl = xh >>> 31 | xl << 1;
   A2_BUF[2 * a] = Al, A2_BUF[2 * a + 1] = Ah;
   A2_BUF[2 * b] = Bl, A2_BUF[2 * b + 1] = Bh;
   A2_BUF[2 * c] = Cl, A2_BUF[2 * c + 1] = Ch;
@@ -1087,20 +1077,27 @@ function P(v00, v01, v02, v03, v04, v05, v06, v07, v08, v09, v10, v11, v12, v13,
   G(v03, v04, v09, v14);
 }
 function block(x, xPos, yPos, outPos, needXor) {
-  for (let i = 0;i < 256; i++)
-    A2_BUF[i] = x[xPos + i] ^ x[yPos + i];
+  if (needXor) {
+    for (let i = 0;i < 256; i++) {
+      const r = x[xPos + i] ^ x[yPos + i];
+      A2_BUF[i] = r;
+      x[outPos + i] ^= r;
+    }
+  } else {
+    for (let i = 0;i < 256; i++) {
+      const r = x[xPos + i] ^ x[yPos + i];
+      A2_BUF[i] = r;
+      x[outPos + i] = r;
+    }
+  }
   for (let i = 0;i < 128; i += 16) {
     P(i, i + 1, i + 2, i + 3, i + 4, i + 5, i + 6, i + 7, i + 8, i + 9, i + 10, i + 11, i + 12, i + 13, i + 14, i + 15);
   }
   for (let i = 0;i < 16; i += 2) {
     P(i, i + 1, i + 16, i + 17, i + 32, i + 33, i + 48, i + 49, i + 64, i + 65, i + 80, i + 81, i + 96, i + 97, i + 112, i + 113);
   }
-  if (needXor)
-    for (let i = 0;i < 256; i++)
-      x[outPos + i] ^= A2_BUF[i] ^ x[xPos + i] ^ x[yPos + i];
-  else
-    for (let i = 0;i < 256; i++)
-      x[outPos + i] = A2_BUF[i] ^ x[xPos + i] ^ x[yPos + i];
+  for (let i = 0;i < 256; i++)
+    x[outPos + i] ^= A2_BUF[i];
   clean(A2_BUF);
 }
 function Hp(A, dkLen) {
@@ -1139,19 +1136,28 @@ function indexAlpha(r, s, laneLen, segmentLen, index, randL, sameLane = false) {
   else
     area = laneLen - segmentLen + (index == 0 ? -1 : 0);
   const startPos = r !== 0 && s !== ARGON2_SYNC_POINTS - 1 ? (s + 1) * segmentLen : 0;
-  const rel = area - 1 - mul(area, mul(randL, randL).h).h;
+  const randLow = Math.imul(randL, randL);
+  const randHigh = ((randL >>> 0) * (randL >>> 0) - (randLow >>> 0)) / 4294967296 + 0.5 | 0;
+  const areaLow = Math.imul(area, randHigh);
+  const areaHigh = ((area >>> 0) * (randHigh >>> 0) - (areaLow >>> 0)) / 4294967296 + 0.5 | 0;
+  const rel = area - 1 - areaHigh;
   return (startPos + rel) % laneLen;
 }
 var maxUint32 = Math.pow(2, 32);
+var ARGON2_DEFAULT_MEMORY = 1024 ** 2;
+var ARGON2_DEFAULT_MAXMEM = ARGON2_DEFAULT_MEMORY * 1024;
 function isU32(num) {
   return Number.isSafeInteger(num) && num >= 0 && num < maxUint32;
 }
-function argon2Opts(opts) {
+function argon2Opts(opts = {}) {
   opts = checkOpts({}, opts);
   const merged = {
+    t: 3,
+    m: ARGON2_DEFAULT_MEMORY,
+    p: 1,
     version: 19,
     dkLen: 32,
-    maxmem: maxUint32 - 1,
+    maxmem: ARGON2_DEFAULT_MAXMEM,
     asyncTick: 10
   };
   for (let [k, v] of Object.entries(opts))
@@ -1175,63 +1181,89 @@ function argon2Opts(opts) {
     throw new Error('"version" must be 0x10 or 0x13, got ' + version);
   return merged;
 }
-function argon2Init(password, salt, type, opts) {
-  password = kdfInputToBytes(password, "password");
-  salt = kdfInputToBytes(salt, "salt");
-  if (!isU32(password.length))
-    throw new Error('"password" must be less of length 1..4Gb');
-  if (!isU32(salt.length) || salt.length < 8)
-    throw new Error('"salt" must be of length 8..4Gb');
-  if (!Object.values(AT).includes(type))
-    throw new Error('"type" was invalid');
-  let { p, dkLen, m, t, version, key, personalization, maxmem, onProgress, asyncTick } = argon2Opts(opts);
-  key = abytesOrZero(key, "key");
-  personalization = abytesOrZero(personalization, "personalization");
-  const h = blake2b.create();
+function argon2InitialHash(password, salt, type, opts) {
+  const ownedInputs = [];
   const BUF = new Uint32Array(1);
   const BUF8 = u8(BUF);
-  for (let item of [p, dkLen, m, t, version, type]) {
-    BUF[0] = swap8IfBE(item);
-    h.update(BUF8);
-  }
-  for (let i of [password, salt, key, personalization]) {
-    BUF[0] = swap8IfBE(i.length);
-    h.update(BUF8).update(i);
-  }
-  const H0 = new Uint32Array(18);
-  const H0_8 = u8(H0);
-  h.digestInto(H0_8);
-  const lanes = p;
-  const mP = 4 * p * Math.floor(m / (ARGON2_SYNC_POINTS * p));
-  const laneLen = Math.floor(mP / p);
-  const segmentLen = Math.floor(laneLen / ARGON2_SYNC_POINTS);
-  const memUsed = mP * 1024;
-  if (!isU32(maxmem))
-    throw new Error('"maxmem" expected <2**32, got ' + maxmem);
-  if (memUsed > maxmem)
-    throw new Error('"maxmem" limit was hit: memUsed(mP*1024)=' + memUsed + ", maxmem=" + maxmem);
-  const B = new Uint32Array(memUsed / 4);
-  for (let l = 0;l < p; l++) {
-    const i = 256 * laneLen * l;
-    H0[17] = swap8IfBE(l);
-    H0[16] = swap8IfBE(0);
-    B.set(swap32IfBE(u32(Hp(H0, 1024))), i);
-    H0[16] = swap8IfBE(1);
-    B.set(swap32IfBE(u32(Hp(H0, 1024))), i + 256);
+  let h;
+  let H0;
+  let succeeded = false;
+  const rememberOwned = (input, bytes) => {
+    if (typeof input === "string")
+      ownedInputs.push(bytes);
+    return bytes;
+  };
+  try {
+    const passwordBytes = rememberOwned(password, kdfInputToBytes(password, "password"));
+    const saltBytes = rememberOwned(salt, kdfInputToBytes(salt, "salt"));
+    if (!isU32(passwordBytes.length))
+      throw new Error('"password" must be less of length 1..4Gb');
+    if (!isU32(saltBytes.length) || saltBytes.length < 8)
+      throw new Error('"salt" must be of length 8..4Gb');
+    if (!Object.values(AT).includes(type))
+      throw new Error('"type" was invalid');
+    let { p, dkLen, m, t, version, key, personalization, maxmem, onProgress, asyncTick } = argon2Opts(opts);
+    const keyInput = key;
+    key = rememberOwned(keyInput, abytesOrZero(keyInput, "key"));
+    const personalizationInput = personalization;
+    personalization = rememberOwned(personalizationInput, abytesOrZero(personalizationInput, "personalization"));
+    h = blake2b.create();
+    for (let item of [p, dkLen, m, t, version, type]) {
+      BUF[0] = swap8IfBE(item);
+      h.update(BUF8);
+    }
+    for (let i of [passwordBytes, saltBytes, key, personalization]) {
+      BUF[0] = swap8IfBE(i.length);
+      h.update(BUF8).update(i);
+    }
+    H0 = new Uint32Array(18);
+    h.digestInto(u8(H0));
+    succeeded = true;
+    return { H0, p, dkLen, m, t, version, maxmem, onProgress, asyncTick };
+  } finally {
+    if (h)
+      h.destroy();
+    clean(BUF, ...ownedInputs);
+    if (!succeeded && H0)
+      clean(H0);
   }
-  let perBlock = () => {};
-  if (onProgress) {
-    const totalBlock = t * ARGON2_SYNC_POINTS * p * segmentLen - 2 * p;
-    const callbackPer = Math.max(Math.floor(totalBlock / 1e4), 1);
-    let blockCnt = 0;
-    perBlock = () => {
-      blockCnt++;
-      if (onProgress && (!(blockCnt % callbackPer) || blockCnt === totalBlock))
-        onProgress(blockCnt / totalBlock);
-    };
+}
+function argon2Init(password, salt, type, opts) {
+  const { H0, p, dkLen, m, t, version, maxmem, onProgress, asyncTick } = argon2InitialHash(password, salt, type, opts);
+  try {
+    const lanes = p;
+    const mP = 4 * p * Math.floor(m / (ARGON2_SYNC_POINTS * p));
+    const laneLen = Math.floor(mP / p);
+    const segmentLen = Math.floor(laneLen / ARGON2_SYNC_POINTS);
+    const memUsed = mP * 1024;
+    if (!isU32(maxmem))
+      throw new Error('"maxmem" expected <2**32, got ' + maxmem);
+    if (memUsed > maxmem)
+      throw new Error('"maxmem" limit was hit: memUsed(mP*1024)=' + memUsed + ", maxmem=" + maxmem);
+    const B = new Uint32Array(memUsed / 4);
+    for (let l = 0;l < p; l++) {
+      const i = 256 * laneLen * l;
+      H0[17] = swap8IfBE(l);
+      H0[16] = swap8IfBE(0);
+      B.set(swap32IfBE(u32(Hp(H0, 1024))), i);
+      H0[16] = swap8IfBE(1);
+      B.set(swap32IfBE(u32(Hp(H0, 1024))), i + 256);
+    }
+    let perBlock = () => {};
+    if (onProgress) {
+      const totalBlock = t * ARGON2_SYNC_POINTS * p * segmentLen - 2 * p;
+      const callbackPer = Math.max(Math.floor(totalBlock / 1e4), 1);
+      let blockCnt = 0;
+      perBlock = () => {
+        blockCnt++;
+        if (onProgress && (!(blockCnt % callbackPer) || blockCnt === totalBlock))
+          onProgress(blockCnt / totalBlock);
+      };
+    }
+    return { type, mP, p, t, version, B, laneLen, lanes, segmentLen, dkLen, perBlock, asyncTick };
+  } finally {
+    clean(H0);
   }
-  clean(BUF, H0);
-  return { type, mP, p, t, version, B, laneLen, lanes, segmentLen, dkLen, perBlock, asyncTick };
 }
 function argon2Output(B, p, laneLen, dkLen) {
   const B_final = new Uint32Array(256);
@@ -1242,9 +1274,8 @@ function argon2Output(B, p, laneLen, dkLen) {
   clean(B, B_final);
   return res;
 }
-function* argon2Blocks(ctx) {
+function* argon2Blocks(ctx, address) {
   const { type, mP, p, t, version, B, laneLen, lanes, segmentLen, perBlock } = ctx;
-  const address = new Uint32Array(3 * 256);
   address[256 + 6] = mP;
   address[256 + 8] = t;
   address[256 + 10] = type;
@@ -1298,11 +1329,11 @@ function* argon2Blocks(ctx) {
 }
 function argon2(type, password, salt, opts) {
   const ctx = argon2Init(password, salt, type, opts);
-  const blocks = argon2Blocks(ctx);
+  const blocks = argon2Blocks(ctx, new Uint32Array(3 * 256));
   while (!blocks.next().done) {}
   return argon2Output(ctx.B, ctx.p, ctx.laneLen, ctx.dkLen);
 }
-var argon2id = (password, salt, opts) => argon2(AT.Argon2id, password, salt, opts);
+var argon2id = (password, salt, opts = {}) => argon2(AT.Argon2id, password, salt, opts);
 
 // src/runtime/kdf-worker-thread.js
 if (!parentPort)

package/docs/agents.md

@@ -2,7 +2,7 @@
 
 Use the JavaScript API for a long-running agent and the canonical CLI for one-off shell work. A local read-only MCP resource server can help an MCP-capable host discover the installed SDK documentation, but it cannot operate Veyl.
 
-The SDK is not a privileged backend. It authenticates, decrypts the vault, signs wallet operations, encrypts/signs chat actions, and maintains encrypted local cache state exactly like web and iOS. Machine credentials and passkeys are authentication capabilities, not human-or-bot classifications. Third-party agents use ordinary public profiles; only namespace-authorized Glyphteck services carry the managed bot marker.
+The SDK is not a privileged backend. It authenticates, decrypts the vault, signs wallet operations, encrypts/signs chat actions, and maintains encrypted local cache state exactly like web and iOS. A public profile is `sdk` while it is machine-only and becomes `app` if a passkey is linked. That describes its available client surface, not whether a person or agent operates it.
 
 ## Setup
 
@@ -101,7 +101,7 @@ Agents should correct normal validation errors from their messages. They should
 - preserve `operationId`;
 - do not blindly repeat a Spark send, request payment, external invoice payment, or withdrawal;
 - reconcile public wallet history or application state first;
-- retry Lightning only when `retryable === true`, using the exact same `idempotencyKey`.
+- retry Lightning only when `retryable === true`, using `operationId` as the exact same `transferId`.
 
 This is intentionally a small contract for the one class of error where automatic self-correction can lose money. Veyl does not maintain a large error taxonomy for ordinary mistakes.
 

package/docs/api.md

@@ -25,6 +25,14 @@ The auth and account compositions consume explicit runtime ports and have no dir
 
 Most product methods ensure login and vault unlock when saved account and vault keys are available. Long-running callers should explicitly login/unlock once and call `close()` when finished.
 
+### Local access and connectivity
+
+The shared account owner separates `localReady`, `online`, and `connection` in its snapshot. `localReady` means the exact locally signed-in account has enough encrypted bootstrap data for vault unlock; it is not server authorization. Unlock opens encrypted cached chats and wallet history without waiting for cloud services. Cached balance is display-only and must be labeled last known. `online` becomes true after cloud reads and online proof succeed; reconnect attaches services to the same unlocked session. Chat writes fail with `unavailable` while offline, and live wallet readiness remains mandatory for payments. There is no offline mutation queue.
+
+Custom platform hosts may provide `bootstrapStorage.read(uid)`, `write(uid, snapshot)`, and `remove(uid)` to `openAccount`, and call `setInternetAvailable(false | true | null)` with platform reachability. Encrypt bootstrap data under the account/environment-bound install key; never put decrypted private content there. Standard web, iOS and Node adapters supply encrypted storage. Logout or observed revocation removes it.
+
+Node authentication is currently process-local: a fresh SDK/CLI process still needs the network to authenticate, even with saved credentials. Cached access supports an already-authenticated long-running SDK process; saved username/profile metadata cannot establish an offline session. Web and iOS can restore their platform-persisted signed-in auth slots.
+
 ## Graphical auth owner
 
 ```js
@@ -193,7 +201,7 @@ try {
 }
 ```
 
-An unknown Spark send, payment-request payment, invoice payment, or withdrawal outcome has `retryable: false`. Reconcile wallet transactions or the named operation before deciding what to do; blindly repeating it can spend twice. An unknown Lightning payment is retryable only when the same caller-supplied `idempotencyKey` will be reused. Direct CLI errors and persistent-session transport preserve these fields instead of reducing them to an error string.
+An unknown Spark send, payment-request payment, invoice payment, or withdrawal outcome has `retryable: false`. Reconcile wallet transactions or the named operation before deciding what to do; blindly repeating it can spend twice. An unknown Lightning payment is retryable only when the same `transferId` will be reused. Veyl creates that UUID before the first attempt and returns it as `operationId` on an uncertain outcome. Direct CLI errors and persistent-session transport preserve these fields instead of reducing them to an error string.
 
 ## Account
 
@@ -214,7 +222,7 @@ await veyl.account.logoutAll();
 await veyl.account.delete({ confirm: true });
 ```
 
-- `create` makes an ordinary account authenticated by a local machine credential and returns its account key directly. Authentication does not assign a public bot label.
+- `create` makes an account authenticated by a local machine credential, publishes its account type as `sdk`, and returns its account key directly.
 - `createPasskey({ username, webUrl, onUrl })` creates a normal passkey account through a browser-assisted WebAuthn flow, installs a local machine credential for future CLI sessions, and returns that account key directly.
 - `login({ username?, key?, saveKey? })` authenticates with an account key. The key can instead come from `open({ accountKey })` or `VEYL_ACCOUNT_KEY`.
 - `loginPasskey({ username?, webUrl?, onUrl? })` authenticates through the browser-assisted passkey flow.
@@ -225,7 +233,7 @@ await veyl.account.delete({ confirm: true });
 - `logoutAll` revokes every product session generation, tears down this runtime locally, and stops a persistent CLI owner after its in-flight work drains.
 - `delete({ confirm: true, key? })` drains decryptable inbox state, marks all discoverable chats deleted, destroys the complete account/network encrypted cache scope, proves vault possession inside the same destructive operation, deletes identifiable account data, removes the local profile, and stops a persistent CLI owner after its in-flight work drains. `key` is required only when the runtime has no saved vault key.
 
-Account summaries report identity, network, local credential/vault availability, public wallet/chat keys, auth kind, an explicit managed-bot marker when assigned by Glyphteck's owner namespace, and current signed-in/unlocked state. Account and vault keys are never included in summaries.
+Account summaries report identity, network, local credential/vault availability, public wallet/chat keys, auth kind, public `app` or `sdk` account type, and current signed-in/unlocked state. Linking a passkey promotes the type to `app`; account and vault keys are never included in summaries.
 
 ## Vault
 
@@ -257,7 +265,7 @@ await veyl.cache.show();
 await veyl.cache.clear();
 ```
 
-`uploadAvatar` accepts prepared WebP bytes and uses the shared profile/avatar backend owner. `setChatAdmission` publishes a public `direct` mode (`open`, `requests`, or `closed`), a `groups` mode (`open` or `closed`), and a fixed-size padded set of private pair-capability commitments for up to eight allowed direct peers. Allowed peers may be usernames or public chat keys; their identities are resolved locally and are not published in the policy. Missing policies remain open for ordinary accounts, while malformed present policies fail closed. Existing chats retain their private routes.
+`uploadAvatar` accepts prepared WebP bytes and uses the shared profile/avatar backend owner. `setChatAdmission` publishes a public `direct` mode (`open`, `requests`, or `closed`), a `groups` mode (`open` or `closed`), and a fixed-size padded set of private pair-capability commitments for up to eight allowed direct peers. Allowed peers may be usernames or public chat keys; their identities are resolved locally and are not published in the policy. Missing policies remain open for ordinary accounts, while malformed present policies fail closed. Existing membership does not bypass a closed policy: disallowed chats are hidden and unavailable for admission-controlled actions, but policy changes never delete a direct or leave a group. `groups: closed` also prevents new group membership.
 
 Settings use the shared normalization and encrypted settings document. Changing `walletNetwork` locks the current vault so the next unlock boots the selected network. Cache methods operate on the same vault-encrypted display and media cache as the other clients.
 
@@ -272,7 +280,7 @@ await veyl.peers.block('@alice');
 await veyl.peers.unblock('@alice');
 ```
 
-Peer resolution accepts `@username`, username, chat public key, or wallet public key when the operation supports it. Blocking self is rejected. Peer/profile results are public projections and do not expose local cache internals. `peers.show` authoritatively refreshes a cached identity; a confirmed missing profile evicts it and deletes loaded chats through the shared missing-peer owner. Normal chat/wallet actions keep the shared cached fast path, while their server-side operations still validate the authoritative route they mutate.
+Peer resolution accepts `@username`, username, chat public key, or wallet public key when the operation supports it. Blocking self is rejected. A block independently submits a narrow user report, retires every private chat route containing that peer, and returns `reported` separately from `blocked`; report failure never prevents the block. Peer/profile results are public projections and do not expose local cache internals. `peers.show` authoritatively refreshes a cached identity; a confirmed missing profile evicts it and deletes loaded chats through the shared missing-peer owner. Normal chat/wallet actions keep the shared cached fast path, while their server-side operations still validate the authoritative route they mutate.
 
 ## Chat
 
@@ -326,7 +334,7 @@ await veyl.chat.react('@alice', sent.message.id, '+1');
 await veyl.chat.unreact('@alice', sent.message.id);
 await veyl.chat.save('@alice', sent.message.id);
 await veyl.chat.unsave('@alice', sent.message.id);
-await veyl.chat.update('@alice', sent.message.id, 'edited');
+await veyl.chat.update('@alice', sent.message.id, 'edited'); // own text, strictly within 10 minutes
 await veyl.chat.delete('@alice', sent.message.id);
 await veyl.chat.retention('@alice', '24h');
 await veyl.chat.deleteChat('@alice', { cleanup: true });
@@ -419,7 +427,7 @@ await veyl.lightning.quote(invoice.encodedInvoice, { amountSats: 10 });
 await veyl.lightning.pay(invoice.encodedInvoice, {
   amountSats: 10,
   maxFeeSats: 5,
-  idempotencyKey: 'order-123',
+  transferId: '019c0000-0000-7000-8000-000000000001',
 });
 await veyl.lightning.receive(receiveId);
 await veyl.lightning.send(sendId);
@@ -552,7 +560,7 @@ Losing the root loses every derived account. Back it up as carefully as a wallet
 
 An existing account cannot retroactively acquire a derived master seed. Adopting one requires a one-time authenticated handoff that installs its root-derived account key and encrypts the existing master seed under its root-derived vault key without changing wallet/chat material.
 
-The Glyphteck namespace seed is separate from a fleet root. `veyl namespace init` creates that owner-only local key once. When its default file exists under the fleet `homeDir`, provisioning automatically signs a short-lived claim bound to the exact derived machine credential so a reserved canonical username can use the normal public account-creation transaction. The seed is never stored in the manifest or an account profile. Other fleet operators do not have this key and cannot claim the reserved namespace.
+The Veyl namespace seed is separate from a fleet root. `veyl namespace init` creates that owner-only local key once. When its default file exists under the fleet `homeDir`, provisioning automatically signs a short-lived claim bound to the exact derived machine credential so a reserved canonical username can use the normal public account-creation transaction. The seed is never stored in the manifest or an account profile. Other fleet operators do not have this key and cannot claim the reserved namespace.
 
 The owner opens one ordinary public client per enabled ready profile, runs account boots with bounded concurrency, tags events with their manifest account, preserves per-account policy order, fails visibly on backlog overflow, and closes every client on stop. An owner-only PID lock prevents two local processes from operating the fleet. It reclaims a dead same-host PID after a crash but never signals or replaces a healthy owner. Shared owners still control chat ordering, wallet serialization, encryption, cache, and account revocation.
 

package/docs/cli.md

@@ -10,7 +10,7 @@ Run `veyl help` for the live inventory. The command families are summarized belo
 veyl namespace init
 ```
 
-This one-time owner command creates `~/.veyl/namespace.seed` with mode `0600` and prints only its public key and fingerprint. It never prints the private seed. `veyl account create @name --reserved` signs a short-lived reserved-name claim for the exact new machine credential. The explicit flag prevents ordinary account creation from disclosing an unnecessary namespace-owner signature. The fleet owner detects the same file under its `homeDir` because a Glyphteck-operated fleet is already public operator context. Ordinary installations without the trusted seed cannot claim a reserved username.
+This one-time owner command creates `~/.veyl/namespace.seed` with mode `0600` and prints only its public key and fingerprint. It never prints the private seed. `veyl account create @name --reserved` signs a short-lived reserved-name claim for the exact new machine credential. The explicit flag prevents ordinary account creation from disclosing an unnecessary namespace-owner signature. The fleet owner detects the same file under its `homeDir` because a Veyl-managed fleet is already public operator context. Ordinary installations without the trusted seed cannot claim a reserved username.
 
 The namespace seed is not accepted through a command argument, environment variable, profile, or fleet manifest. Back up the file offline; losing it removes the ability to authorize another reserved account.
 
@@ -63,7 +63,7 @@ veyl peers block @alice
 veyl peers unblock @alice
 ```
 
-Blocking yourself is rejected. Blocking deletes the canonical direct chat and leaves every decrypted group containing that UID. A future successor containing the block is dropped locally; no readable server membership graph exists.
+Blocking yourself is rejected. Blocking independently submits a narrow user report, deletes the canonical direct chat, and leaves every decrypted group containing that UID. Report failure does not prevent the block and is exposed separately in the command result. A future successor containing the block is dropped locally; no readable server membership graph exists.
 
 ## Chat
 
@@ -150,7 +150,7 @@ veyl wallet search @alice
 ```bash
 veyl lightning invoice 10 --memo "coffee" --expiry 3600
 veyl lightning quote INVOICE [--amount SATS]
-veyl lightning pay INVOICE [--amount SATS] [--max-fee SATS] [--idempotency-key KEY] [--operation-id AGENT_JOB_ID]
+veyl lightning pay INVOICE [--amount SATS] [--max-fee SATS] [--transfer-id UUID]
 veyl lightning receive ID
 veyl lightning send ID
 
@@ -161,7 +161,7 @@ veyl withdrawal confirm ADDRESS SATS [--speed MEDIUM] [--fee-quote-id ID --fee-a
 
 `withdrawal quote` and `withdrawal prepare` do not spend or broadcast, but the Spark SDK may restructure wallet leaves while producing an exact quote. Pass both reviewed `feeQuoteId` and `feeAmountSats` back to `withdrawal confirm`; omitting both requests a fresh quote, while providing only one is rejected. `withdrawal confirm` performs the spend.
 
-Money commands print stable `code`, `operation`, `operationId`, `outcome`, and `retryable` fields when the SDK cannot determine whether a mutation committed. Do not replay a result with `code: "operation_outcome_unknown"` unless `retryable` is true. Today that is true only for Lightning when the exact same `--idempotency-key` can be reused; otherwise reconcile wallet history first.
+Money commands print stable `code`, `operation`, `operationId`, `outcome`, and `retryable` fields when the SDK cannot determine whether a mutation committed. Do not replay a result with `code: "operation_outcome_unknown"` unless `retryable` is true. Today that is true only for Lightning: reuse the returned `operationId` as the exact same `--transfer-id`; otherwise reconcile wallet history first.
 
 ## Invites
 

package/docs/validation.md

@@ -28,7 +28,7 @@ CLI paths and persistent-session dispatch come from `src/commands.js`. Both one-
 
 The canonical registry defines 78 CLI commands, 70 persistent-session product commands, and 16 command groups. Wallet mnemonic export and passkey-link creation stay one-shot CLI/JavaScript API only; the namespace key, session owner, and documentation resource process controls also remain CLI-only. Registry coverage checks map every enabled session command and real CLI path to its declared public client method, with `chat.reactTo` retained only as a JavaScript convenience alias over the same reaction operation.
 
-Focused contract coverage mounts the real framework-free chat route through the public SDK runtime, verifies live projection, explicit leave, and manual/disabled read policy, and exercises persistent-session streaming plus abort-driven embedding shutdown. Agent-listener coverage proves a changed conversation uses a transient message window and releases it instead of retaining one listener per loaded chat, including a 500-chat requested window. Replay coverage expands older pages until a per-chat checkpoint is found, then emits only the newer messages. New-chat admission coverage uses real MLS Welcomes to prove a frozen public callback boundary, block precedence, fail-closed decisions, prekey cleanup, and established-chat bypass. The packaged single-agent example proves pinned owner filtering, default Node live transport, stable typing-to-message composition, deterministic final delivery, app-server JSONL/backpressure/errors, steering, owner-only state, and completed-turn recovery. Fleet coverage opens fake public clients under bounded concurrency, tags their events, runs policies, and proves all account and policy lifecycles close. Root coverage proves stable isolated account derivation, monotonically indexed recovery, and owner-only seed storage; manifest and profile coverage rejects or omits per-account secrets. Namespace coverage proves the local private seed is mode `0600`, never returned by initialization, and produces a claim that verifies only for its exact username, machine credential, and expiry; it also keeps the generated Functions trust anchor aligned with the shared public key. Local-owner coverage proves a second healthy process is never replaced and a dead same-host PID lock can be reclaimed without signaling it. The bounded event checkpoint persists processed IDs and baseline policy coverage proves historical messages are recorded without bot behavior. Action-journal coverage proves completed effects survive restart, replay-safe chat actions can reuse their deterministic CID, interrupted money actions stop for reconciliation, and a replayed faucet request is paid and mirrored once. The canonical Glyphteck runtime now consumes the packaged fleet example through ordinary SDK clients; remaining live fleet observations belong only in the root manual queue.
+Focused contract coverage mounts the real framework-free chat route through the public SDK runtime, verifies live projection, explicit leave, and manual/disabled read policy, and exercises persistent-session streaming plus abort-driven embedding shutdown. Agent-listener coverage proves a changed conversation uses a transient message window and releases it instead of retaining one listener per loaded chat, including a 500-chat requested window. Replay coverage expands older pages until a per-chat checkpoint is found, then emits only the newer messages. Chat-admission coverage uses real MLS Welcomes to prove a frozen public callback boundary, block precedence, fail-closed decisions, prekey cleanup, and ongoing enforcement for established chats without automatic delete or leave events. The packaged single-agent example proves pinned owner filtering, default Node live transport, stable typing-to-message composition, deterministic final delivery, app-server JSONL/backpressure/errors, steering, owner-only state, and completed-turn recovery. Fleet coverage opens fake public clients under bounded concurrency, tags their events, runs policies, and proves all account and policy lifecycles close. Root coverage proves stable isolated account derivation, monotonically indexed recovery, and owner-only seed storage; manifest and profile coverage rejects or omits per-account secrets. Namespace coverage proves the local private seed is mode `0600`, never returned by initialization, and produces a claim that verifies only for its exact username, machine credential, and expiry; it also keeps the generated Functions trust anchor aligned with the shared public key. Local-owner coverage proves a second healthy process is never replaced and a dead same-host PID lock can be reclaimed without signaling it. The bounded event checkpoint persists processed IDs and baseline policy coverage proves historical messages are recorded without bot behavior. Action-journal coverage proves completed effects survive restart, replay-safe chat actions can reuse their deterministic CID, interrupted money actions stop for reconciliation, and a replayed faucet request is paid and mirrored once. The canonical Veyl-managed runtime now consumes the packaged fleet example through ordinary SDK clients; remaining live fleet observations belong only in the root manual queue.
 
 Run `bun check:sdk` from the repository root to validate the exact public package artifact without mutating the intentionally versionless source manifest. The check builds the SDK, stamps the root product version into a temporary copy, dry-run packs it, verifies the required public runtime entries, documentation, fleet example, and single-account connector, and rejects private source or tests.