@glyphteck/veyl 0.68.0 → 0.70.0

package/dist/kdf-worker-thread.js

@@ -48,39 +48,7 @@ var __export = (target, all) => {
 var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
-// ../../node_modules/.bun/@noble+hashes@2.3.0/node_modules/@noble/hashes/_u64.js
-function fromBig(n, le = false) {
-  if (le)
-    return { h: Number(n & U32_MASK64), l: Number(n >> _32n & U32_MASK64) };
-  return { h: Number(n >> _32n & U32_MASK64) | 0, l: Number(n & U32_MASK64) | 0 };
-}
-function split(lst, le = false) {
-  const len = lst.length;
-  let Ah = new Uint32Array(len);
-  let Al = new Uint32Array(len);
-  for (let i = 0;i < len; i++) {
-    const { h, l } = fromBig(lst[i], le);
-    [Ah[i], Al[i]] = [h, l];
-  }
-  return [Ah, Al];
-}
-function setU64FromNum(view, byteOffset, n, isLE) {
-  const h = fromNumH(n);
-  const l = fromNumL(n);
-  view.setUint32(byteOffset, isLE ? l : h, isLE);
-  view.setUint32(byteOffset + 4, isLE ? h : l, isLE);
-}
-function add(Ah, Al, Bh, Bl) {
-  const l = (Al >>> 0) + (Bl >>> 0);
-  return { h: Ah + Bh + (l / 2 ** 32 | 0) | 0, l: l | 0 };
-}
-var U32_MASK64, _32n, fromNumH = (n) => n / 2 ** 32 | 0, fromNumL = (n) => n >>> 0, shrSH = (h, _l, s) => h >>> s, shrSL = (h, l, s) => h << 32 - s | l >>> s, rotrSH = (h, l, s) => h >>> s | l << 32 - s, rotrSL = (h, l, s) => h << 32 - s | l >>> s, rotrBH = (h, l, s) => h << 64 - s | l >>> s - 32, rotrBL = (h, l, s) => h >>> s - 32 | l << 64 - s, rotr32H = (_h, l) => l, rotr32L = (h, _l) => h, add3L = (Al, Bl, Cl) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0), add3H = (low, Ah, Bh, Ch) => Ah + Bh + Ch + (low / 2 ** 32 | 0) | 0, add4L = (Al, Bl, Cl, Dl) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0), add4H = (low, Ah, Bh, Ch, Dh) => Ah + Bh + Ch + Dh + (low / 2 ** 32 | 0) | 0, add5L = (Al, Bl, Cl, Dl, El) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0) + (El >>> 0), add5H = (low, Ah, Bh, Ch, Dh, Eh) => Ah + Bh + Ch + Dh + Eh + (low / 2 ** 32 | 0) | 0;
-var init__u64 = __esm(() => {
-  U32_MASK64 = /* @__PURE__ */ (() => BigInt(2 ** 32 - 1))();
-  _32n = /* @__PURE__ */ BigInt(32);
-});
-
-// ../../node_modules/.bun/@noble+hashes@2.3.0/node_modules/@noble/hashes/utils.js
+// ../../node_modules/.bun/@noble+hashes@2.4.0/node_modules/@noble/hashes/utils.js
 function isBytes(a) {
   return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array" && "BYTES_PER_ELEMENT" in a && a.BYTES_PER_ELEMENT === 1;
 }
@@ -198,7 +166,12 @@ function hexToBytes(hex) {
 function utf8ToBytes(str) {
   if (typeof str !== "string")
     throw new TypeError("string expected");
-  return new Uint8Array(new TextEncoder().encode(str));
+  const encoded = new TextEncoder().encode(str);
+  try {
+    return new Uint8Array(encoded);
+  } finally {
+    clean(encoded);
+  }
 }
 function kdfInputToBytes(data, errorTitle = "") {
   if (typeof data === "string")
@@ -221,10 +194,10 @@ function concatBytes(...arrays) {
   return res;
 }
 function checkOpts(defaults, opts, title = "opts") {
-  aobject(defaults, "defaults");
+  aopts(defaults, "defaults");
   if (opts !== undefined)
-    aobject(opts, title);
-  const merged = Object.assign(defaults, opts);
+    aopts(opts, title);
+  const merged = Object.assign(Object.create(null), defaults, opts);
   return merged;
 }
 function createHasher(hashCons, info = {}) {
@@ -252,6 +225,13 @@ function randomBytes(bytesLength = 32) {
 var atitle = (title) => title ? `"${title}" ` : "", aobject = (value, label) => {
   if (value === null || typeof value !== "object" || Array.isArray(value))
     throw new TypeError((label === "object" ? "" : `"${label}" `) + "expected object, got type=" + typeof value);
+}, aopts = (value, label) => {
+  aobject(value, label);
+  const proto = Object.getPrototypeOf(value);
+  if (proto !== Object.prototype && proto !== null)
+    throw new TypeError(`"${label}" expected plain object`);
+  if (Object.hasOwn(value, "__proto__"))
+    throw new TypeError(`"${label}.__proto__" is not allowed`);
 }, isLE, swap8IfBE, swap32IfBE, hasHexBuiltin, hexes, oidNist = (suffix) => ({
   oid: Uint8Array.from([6, 9, 96, 134, 72, 1, 101, 3, 4, 2, suffix])
 });
@@ -263,7 +243,39 @@ var init_utils = __esm(() => {
   hexes = /* @__PURE__ */ Array.from({ length: 256 }, (_, i) => i.toString(16).padStart(2, "0"));
 });
 
-// ../../node_modules/.bun/@noble+hashes@2.3.0/node_modules/@noble/hashes/_md.js
+// ../../node_modules/.bun/@noble+hashes@2.4.0/node_modules/@noble/hashes/_u64.js
+function fromBig(n, le = false) {
+  if (le)
+    return { h: Number(n & U32_MASK64), l: Number(n >> _32n & U32_MASK64) };
+  return { h: Number(n >> _32n & U32_MASK64) | 0, l: Number(n & U32_MASK64) | 0 };
+}
+function split(lst, le = false) {
+  const len = lst.length;
+  let Ah = new Uint32Array(len);
+  let Al = new Uint32Array(len);
+  for (let i = 0;i < len; i++) {
+    const { h, l } = fromBig(lst[i], le);
+    [Ah[i], Al[i]] = [h, l];
+  }
+  return [Ah, Al];
+}
+function setU64FromNum(view, byteOffset, n, isLE2) {
+  const h = fromNumH(n);
+  const l = fromNumL(n);
+  view.setUint32(byteOffset, isLE2 ? l : h, isLE2);
+  view.setUint32(byteOffset + 4, isLE2 ? h : l, isLE2);
+}
+function add(Ah, Al, Bh, Bl) {
+  const l = (Al >>> 0) + (Bl >>> 0);
+  return { h: Ah + Bh + (l / 2 ** 32 | 0) | 0, l: l | 0 };
+}
+var U32_MASK64, _32n, fromNumH = (n) => n / 2 ** 32 | 0, fromNumL = (n) => n >>> 0, shrSH = (h, _l, s) => h >>> s, shrSL = (h, l, s) => h << 32 - s | l >>> s, rotrSH = (h, l, s) => h >>> s | l << 32 - s, rotrSL = (h, l, s) => h << 32 - s | l >>> s, rotrBH = (h, l, s) => h << 64 - s | l >>> s - 32, rotrBL = (h, l, s) => h >>> s - 32 | l << 64 - s, rotr32H = (_h, l) => l, rotr32L = (h, _l) => h, add3L = (Al, Bl, Cl) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0), add3H = (low, Ah, Bh, Ch) => Ah + Bh + Ch + (low / 2 ** 32 | 0) | 0, add4L = (Al, Bl, Cl, Dl) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0), add4H = (low, Ah, Bh, Ch, Dh) => Ah + Bh + Ch + Dh + (low / 2 ** 32 | 0) | 0, add5L = (Al, Bl, Cl, Dl, El) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0) + (El >>> 0), add5H = (low, Ah, Bh, Ch, Dh, Eh) => Ah + Bh + Ch + Dh + Eh + (low / 2 ** 32 | 0) | 0;
+var init__u64 = __esm(() => {
+  U32_MASK64 = /* @__PURE__ */ (() => BigInt(2 ** 32 - 1))();
+  _32n = /* @__PURE__ */ BigInt(32);
+});
+
+// ../../node_modules/.bun/@noble+hashes@2.4.0/node_modules/@noble/hashes/_md.js
 function Chi(a, b, c) {
   return a & b ^ ~a & c;
 }
@@ -402,10 +414,7 @@ var init__md = __esm(() => {
 // src/runtime/kdf-worker-thread.js
 import { parentPort } from "node:worker_threads";
 
-// ../../node_modules/.bun/@noble+hashes@2.3.0/node_modules/@noble/hashes/argon2.js
-init__u64();
-
-// ../../node_modules/.bun/@noble+hashes@2.3.0/node_modules/@noble/hashes/_blake.js
+// ../../node_modules/.bun/@noble+hashes@2.4.0/node_modules/@noble/hashes/_blake.js
 var BSIGMA = /* @__PURE__ */ Uint8Array.from([
   0,
   1,
@@ -665,7 +674,7 @@ var BSIGMA = /* @__PURE__ */ Uint8Array.from([
   9
 ]);
 
-// ../../node_modules/.bun/@noble+hashes@2.3.0/node_modules/@noble/hashes/blake2.js
+// ../../node_modules/.bun/@noble+hashes@2.4.0/node_modules/@noble/hashes/blake2.js
 init__u64();
 init_utils();
 var B2B_IV = /* @__PURE__ */ Uint32Array.from([
@@ -1000,7 +1009,7 @@ class _BLAKE2b extends _BLAKE2 {
 }
 var blake2b = /* @__PURE__ */ createHasher((opts) => new _BLAKE2b(opts));
 
-// ../../node_modules/.bun/@noble+hashes@2.3.0/node_modules/@noble/hashes/argon2.js
+// ../../node_modules/.bun/@noble+hashes@2.4.0/node_modules/@noble/hashes/argon2.js
 init_utils();
 var AT = { Argon2d: 0, Argon2i: 1, Argon2id: 2 };
 var ARGON2_SYNC_POINTS = 4;
@@ -1009,25 +1018,6 @@ var abytesOrZero = (buf, errorTitle = "") => {
     return Uint8Array.of();
   return kdfInputToBytes(buf, errorTitle);
 };
-function mul(a, b) {
-  const aL = a & 65535;
-  const aH = a >>> 16;
-  const bL = b & 65535;
-  const bH = b >>> 16;
-  const ll = Math.imul(aL, bL);
-  const hl = Math.imul(aH, bL);
-  const lh = Math.imul(aL, bH);
-  const hh = Math.imul(aH, bH);
-  const carry = (ll >>> 16) + (hl & 65535) + lh;
-  const high = hh + (hl >>> 16) + (carry >>> 16) | 0;
-  const low = carry << 16 | ll & 65535;
-  return { h: high, l: low };
-}
-function mulHi(a, b) {
-  const aL = a & 65535, aH = a >>> 16, bL = b & 65535, bH = b >>> 16;
-  const carry = (Math.imul(aL, bL) >>> 16) + (Math.imul(aH, bL) & 65535) + Math.imul(aL, bH);
-  return Math.imul(aH, bH) + (Math.imul(aH, bL) >>> 16) + (carry >>> 16) | 0;
-}
 var A2_BUF = new Uint32Array(256);
 function G(a, b, c, d) {
   let Al = A2_BUF[2 * a], Ah = A2_BUF[2 * a + 1];
@@ -1036,41 +1026,41 @@ function G(a, b, c, d) {
   let Dl = A2_BUF[2 * d], Dh = A2_BUF[2 * d + 1];
   let ml = 0, mh = 0, rl = 0, xh = 0, xl = 0;
   ml = Math.imul(Al, Bl);
-  mh = mulHi(Al, Bl);
+  mh = ((Al >>> 0) * (Bl >>> 0) - (ml >>> 0)) / 4294967296 + 0.5 | 0;
   rl = (Al >>> 0) + (Bl >>> 0) + (ml << 1 >>> 0);
   Ah = Ah + Bh + (mh << 1 | ml >>> 31) + (rl / 4294967296 | 0) | 0;
   Al = rl | 0;
   xh = Dh ^ Ah;
   xl = Dl ^ Al;
-  Dh = rotr32H(xh, xl);
-  Dl = rotr32L(xh, xl);
+  Dh = xl;
+  Dl = xh;
   ml = Math.imul(Cl, Dl);
-  mh = mulHi(Cl, Dl);
+  mh = ((Cl >>> 0) * (Dl >>> 0) - (ml >>> 0)) / 4294967296 + 0.5 | 0;
   rl = (Cl >>> 0) + (Dl >>> 0) + (ml << 1 >>> 0);
   Ch = Ch + Dh + (mh << 1 | ml >>> 31) + (rl / 4294967296 | 0) | 0;
   Cl = rl | 0;
   xh = Bh ^ Ch;
   xl = Bl ^ Cl;
-  Bh = rotrSH(xh, xl, 24);
-  Bl = rotrSL(xh, xl, 24);
+  Bh = xh >>> 24 | xl << 8;
+  Bl = xh << 8 | xl >>> 24;
   ml = Math.imul(Al, Bl);
-  mh = mulHi(Al, Bl);
+  mh = ((Al >>> 0) * (Bl >>> 0) - (ml >>> 0)) / 4294967296 + 0.5 | 0;
   rl = (Al >>> 0) + (Bl >>> 0) + (ml << 1 >>> 0);
   Ah = Ah + Bh + (mh << 1 | ml >>> 31) + (rl / 4294967296 | 0) | 0;
   Al = rl | 0;
   xh = Dh ^ Ah;
   xl = Dl ^ Al;
-  Dh = rotrSH(xh, xl, 16);
-  Dl = rotrSL(xh, xl, 16);
+  Dh = xh >>> 16 | xl << 16;
+  Dl = xh << 16 | xl >>> 16;
   ml = Math.imul(Cl, Dl);
-  mh = mulHi(Cl, Dl);
+  mh = ((Cl >>> 0) * (Dl >>> 0) - (ml >>> 0)) / 4294967296 + 0.5 | 0;
   rl = (Cl >>> 0) + (Dl >>> 0) + (ml << 1 >>> 0);
   Ch = Ch + Dh + (mh << 1 | ml >>> 31) + (rl / 4294967296 | 0) | 0;
   Cl = rl | 0;
   xh = Bh ^ Ch;
   xl = Bl ^ Cl;
-  Bh = rotrBH(xh, xl, 63);
-  Bl = rotrBL(xh, xl, 63);
+  Bh = xh << 1 | xl >>> 31;
+  Bl = xh >>> 31 | xl << 1;
   A2_BUF[2 * a] = Al, A2_BUF[2 * a + 1] = Ah;
   A2_BUF[2 * b] = Bl, A2_BUF[2 * b + 1] = Bh;
   A2_BUF[2 * c] = Cl, A2_BUF[2 * c + 1] = Ch;
@@ -1087,20 +1077,27 @@ function P(v00, v01, v02, v03, v04, v05, v06, v07, v08, v09, v10, v11, v12, v13,
   G(v03, v04, v09, v14);
 }
 function block(x, xPos, yPos, outPos, needXor) {
-  for (let i = 0;i < 256; i++)
-    A2_BUF[i] = x[xPos + i] ^ x[yPos + i];
+  if (needXor) {
+    for (let i = 0;i < 256; i++) {
+      const r = x[xPos + i] ^ x[yPos + i];
+      A2_BUF[i] = r;
+      x[outPos + i] ^= r;
+    }
+  } else {
+    for (let i = 0;i < 256; i++) {
+      const r = x[xPos + i] ^ x[yPos + i];
+      A2_BUF[i] = r;
+      x[outPos + i] = r;
+    }
+  }
   for (let i = 0;i < 128; i += 16) {
     P(i, i + 1, i + 2, i + 3, i + 4, i + 5, i + 6, i + 7, i + 8, i + 9, i + 10, i + 11, i + 12, i + 13, i + 14, i + 15);
   }
   for (let i = 0;i < 16; i += 2) {
     P(i, i + 1, i + 16, i + 17, i + 32, i + 33, i + 48, i + 49, i + 64, i + 65, i + 80, i + 81, i + 96, i + 97, i + 112, i + 113);
   }
-  if (needXor)
-    for (let i = 0;i < 256; i++)
-      x[outPos + i] ^= A2_BUF[i] ^ x[xPos + i] ^ x[yPos + i];
-  else
-    for (let i = 0;i < 256; i++)
-      x[outPos + i] = A2_BUF[i] ^ x[xPos + i] ^ x[yPos + i];
+  for (let i = 0;i < 256; i++)
+    x[outPos + i] ^= A2_BUF[i];
   clean(A2_BUF);
 }
 function Hp(A, dkLen) {
@@ -1139,19 +1136,28 @@ function indexAlpha(r, s, laneLen, segmentLen, index, randL, sameLane = false) {
   else
     area = laneLen - segmentLen + (index == 0 ? -1 : 0);
   const startPos = r !== 0 && s !== ARGON2_SYNC_POINTS - 1 ? (s + 1) * segmentLen : 0;
-  const rel = area - 1 - mul(area, mul(randL, randL).h).h;
+  const randLow = Math.imul(randL, randL);
+  const randHigh = ((randL >>> 0) * (randL >>> 0) - (randLow >>> 0)) / 4294967296 + 0.5 | 0;
+  const areaLow = Math.imul(area, randHigh);
+  const areaHigh = ((area >>> 0) * (randHigh >>> 0) - (areaLow >>> 0)) / 4294967296 + 0.5 | 0;
+  const rel = area - 1 - areaHigh;
   return (startPos + rel) % laneLen;
 }
 var maxUint32 = Math.pow(2, 32);
+var ARGON2_DEFAULT_MEMORY = 1024 ** 2;
+var ARGON2_DEFAULT_MAXMEM = ARGON2_DEFAULT_MEMORY * 1024;
 function isU32(num) {
   return Number.isSafeInteger(num) && num >= 0 && num < maxUint32;
 }
-function argon2Opts(opts) {
+function argon2Opts(opts = {}) {
   opts = checkOpts({}, opts);
   const merged = {
+    t: 3,
+    m: ARGON2_DEFAULT_MEMORY,
+    p: 1,
     version: 19,
     dkLen: 32,
-    maxmem: maxUint32 - 1,
+    maxmem: ARGON2_DEFAULT_MAXMEM,
     asyncTick: 10
   };
   for (let [k, v] of Object.entries(opts))
@@ -1175,63 +1181,89 @@ function argon2Opts(opts) {
     throw new Error('"version" must be 0x10 or 0x13, got ' + version);
   return merged;
 }
-function argon2Init(password, salt, type, opts) {
-  password = kdfInputToBytes(password, "password");
-  salt = kdfInputToBytes(salt, "salt");
-  if (!isU32(password.length))
-    throw new Error('"password" must be less of length 1..4Gb');
-  if (!isU32(salt.length) || salt.length < 8)
-    throw new Error('"salt" must be of length 8..4Gb');
-  if (!Object.values(AT).includes(type))
-    throw new Error('"type" was invalid');
-  let { p, dkLen, m, t, version, key, personalization, maxmem, onProgress, asyncTick } = argon2Opts(opts);
-  key = abytesOrZero(key, "key");
-  personalization = abytesOrZero(personalization, "personalization");
-  const h = blake2b.create();
+function argon2InitialHash(password, salt, type, opts) {
+  const ownedInputs = [];
   const BUF = new Uint32Array(1);
   const BUF8 = u8(BUF);
-  for (let item of [p, dkLen, m, t, version, type]) {
-    BUF[0] = swap8IfBE(item);
-    h.update(BUF8);
-  }
-  for (let i of [password, salt, key, personalization]) {
-    BUF[0] = swap8IfBE(i.length);
-    h.update(BUF8).update(i);
-  }
-  const H0 = new Uint32Array(18);
-  const H0_8 = u8(H0);
-  h.digestInto(H0_8);
-  const lanes = p;
-  const mP = 4 * p * Math.floor(m / (ARGON2_SYNC_POINTS * p));
-  const laneLen = Math.floor(mP / p);
-  const segmentLen = Math.floor(laneLen / ARGON2_SYNC_POINTS);
-  const memUsed = mP * 1024;
-  if (!isU32(maxmem))
-    throw new Error('"maxmem" expected <2**32, got ' + maxmem);
-  if (memUsed > maxmem)
-    throw new Error('"maxmem" limit was hit: memUsed(mP*1024)=' + memUsed + ", maxmem=" + maxmem);
-  const B = new Uint32Array(memUsed / 4);
-  for (let l = 0;l < p; l++) {
-    const i = 256 * laneLen * l;
-    H0[17] = swap8IfBE(l);
-    H0[16] = swap8IfBE(0);
-    B.set(swap32IfBE(u32(Hp(H0, 1024))), i);
-    H0[16] = swap8IfBE(1);
-    B.set(swap32IfBE(u32(Hp(H0, 1024))), i + 256);
+  let h;
+  let H0;
+  let succeeded = false;
+  const rememberOwned = (input, bytes) => {
+    if (typeof input === "string")
+      ownedInputs.push(bytes);
+    return bytes;
+  };
+  try {
+    const passwordBytes = rememberOwned(password, kdfInputToBytes(password, "password"));
+    const saltBytes = rememberOwned(salt, kdfInputToBytes(salt, "salt"));
+    if (!isU32(passwordBytes.length))
+      throw new Error('"password" must be less of length 1..4Gb');
+    if (!isU32(saltBytes.length) || saltBytes.length < 8)
+      throw new Error('"salt" must be of length 8..4Gb');
+    if (!Object.values(AT).includes(type))
+      throw new Error('"type" was invalid');
+    let { p, dkLen, m, t, version, key, personalization, maxmem, onProgress, asyncTick } = argon2Opts(opts);
+    const keyInput = key;
+    key = rememberOwned(keyInput, abytesOrZero(keyInput, "key"));
+    const personalizationInput = personalization;
+    personalization = rememberOwned(personalizationInput, abytesOrZero(personalizationInput, "personalization"));
+    h = blake2b.create();
+    for (let item of [p, dkLen, m, t, version, type]) {
+      BUF[0] = swap8IfBE(item);
+      h.update(BUF8);
+    }
+    for (let i of [passwordBytes, saltBytes, key, personalization]) {
+      BUF[0] = swap8IfBE(i.length);
+      h.update(BUF8).update(i);
+    }
+    H0 = new Uint32Array(18);
+    h.digestInto(u8(H0));
+    succeeded = true;
+    return { H0, p, dkLen, m, t, version, maxmem, onProgress, asyncTick };
+  } finally {
+    if (h)
+      h.destroy();
+    clean(BUF, ...ownedInputs);
+    if (!succeeded && H0)
+      clean(H0);
   }
-  let perBlock = () => {};
-  if (onProgress) {
-    const totalBlock = t * ARGON2_SYNC_POINTS * p * segmentLen - 2 * p;
-    const callbackPer = Math.max(Math.floor(totalBlock / 1e4), 1);
-    let blockCnt = 0;
-    perBlock = () => {
-      blockCnt++;
-      if (onProgress && (!(blockCnt % callbackPer) || blockCnt === totalBlock))
-        onProgress(blockCnt / totalBlock);
-    };
+}
+function argon2Init(password, salt, type, opts) {
+  const { H0, p, dkLen, m, t, version, maxmem, onProgress, asyncTick } = argon2InitialHash(password, salt, type, opts);
+  try {
+    const lanes = p;
+    const mP = 4 * p * Math.floor(m / (ARGON2_SYNC_POINTS * p));
+    const laneLen = Math.floor(mP / p);
+    const segmentLen = Math.floor(laneLen / ARGON2_SYNC_POINTS);
+    const memUsed = mP * 1024;
+    if (!isU32(maxmem))
+      throw new Error('"maxmem" expected <2**32, got ' + maxmem);
+    if (memUsed > maxmem)
+      throw new Error('"maxmem" limit was hit: memUsed(mP*1024)=' + memUsed + ", maxmem=" + maxmem);
+    const B = new Uint32Array(memUsed / 4);
+    for (let l = 0;l < p; l++) {
+      const i = 256 * laneLen * l;
+      H0[17] = swap8IfBE(l);
+      H0[16] = swap8IfBE(0);
+      B.set(swap32IfBE(u32(Hp(H0, 1024))), i);
+      H0[16] = swap8IfBE(1);
+      B.set(swap32IfBE(u32(Hp(H0, 1024))), i + 256);
+    }
+    let perBlock = () => {};
+    if (onProgress) {
+      const totalBlock = t * ARGON2_SYNC_POINTS * p * segmentLen - 2 * p;
+      const callbackPer = Math.max(Math.floor(totalBlock / 1e4), 1);
+      let blockCnt = 0;
+      perBlock = () => {
+        blockCnt++;
+        if (onProgress && (!(blockCnt % callbackPer) || blockCnt === totalBlock))
+          onProgress(blockCnt / totalBlock);
+      };
+    }
+    return { type, mP, p, t, version, B, laneLen, lanes, segmentLen, dkLen, perBlock, asyncTick };
+  } finally {
+    clean(H0);
   }
-  clean(BUF, H0);
-  return { type, mP, p, t, version, B, laneLen, lanes, segmentLen, dkLen, perBlock, asyncTick };
 }
 function argon2Output(B, p, laneLen, dkLen) {
   const B_final = new Uint32Array(256);
@@ -1242,9 +1274,8 @@ function argon2Output(B, p, laneLen, dkLen) {
   clean(B, B_final);
   return res;
 }
-function* argon2Blocks(ctx) {
+function* argon2Blocks(ctx, address) {
   const { type, mP, p, t, version, B, laneLen, lanes, segmentLen, perBlock } = ctx;
-  const address = new Uint32Array(3 * 256);
   address[256 + 6] = mP;
   address[256 + 8] = t;
   address[256 + 10] = type;
@@ -1298,11 +1329,11 @@ function* argon2Blocks(ctx) {
 }
 function argon2(type, password, salt, opts) {
   const ctx = argon2Init(password, salt, type, opts);
-  const blocks = argon2Blocks(ctx);
+  const blocks = argon2Blocks(ctx, new Uint32Array(3 * 256));
   while (!blocks.next().done) {}
   return argon2Output(ctx.B, ctx.p, ctx.laneLen, ctx.dkLen);
 }
-var argon2id = (password, salt, opts) => argon2(AT.Argon2id, password, salt, opts);
+var argon2id = (password, salt, opts = {}) => argon2(AT.Argon2id, password, salt, opts);
 
 // src/runtime/kdf-worker-thread.js
 if (!parentPort)

package/docs/agents.md

@@ -2,7 +2,7 @@
 
 Use the JavaScript API for a long-running agent and the canonical CLI for one-off shell work. A local read-only MCP resource server can help an MCP-capable host discover the installed SDK documentation, but it cannot operate Veyl.
 
-The SDK is not a privileged backend. It authenticates, decrypts the vault, signs wallet operations, encrypts/signs chat actions, and maintains encrypted local cache state exactly like web and iOS. Machine credentials and passkeys are authentication capabilities, not human-or-bot classifications. Third-party agents use ordinary public profiles; only namespace-authorized Glyphteck services carry the managed bot marker.
+The SDK is not a privileged backend. It authenticates, decrypts the vault, signs wallet operations, encrypts/signs chat actions, and maintains encrypted local cache state exactly like web and iOS. A public profile is `sdk` while it is machine-only and becomes `app` if a passkey is linked. That describes its available client surface, not whether a person or agent operates it.
 
 ## Setup
 
@@ -101,7 +101,7 @@ Agents should correct normal validation errors from their messages. They should
 - preserve `operationId`;
 - do not blindly repeat a Spark send, request payment, external invoice payment, or withdrawal;
 - reconcile public wallet history or application state first;
-- retry Lightning only when `retryable === true`, using the exact same `idempotencyKey`.
+- retry Lightning only when `retryable === true`, using `operationId` as the exact same `transferId`.
 
 This is intentionally a small contract for the one class of error where automatic self-correction can lose money. Veyl does not maintain a large error taxonomy for ordinary mistakes.
 

package/docs/api.md

@@ -25,6 +25,16 @@ The auth and account compositions consume explicit runtime ports and have no dir
 
 Most product methods ensure login and vault unlock when saved account and vault keys are available. Long-running callers should explicitly login/unlock once and call `close()` when finished.
 
+### Local access and connectivity
+
+The shared account owner separates `localReady`, `online`, and `connection` in its snapshot. `localReady` means the exact locally signed-in account has enough encrypted bootstrap data for vault unlock; it is not server authorization. Unlock opens encrypted cached chats and wallet history without waiting for cloud services. Cached balance is display-only and must be labeled last known. `online` becomes true after cloud reads and online proof succeed; reconnect attaches services to the same unlocked session. Text sends wait up to 30 seconds for connectivity, then remain encrypted on-device as failed attempts for manual retry; reactions expire without a retry row. Avatar changes wait only for the current session, as described below. These are domain-owned pending operations, not a general cloud mutation queue. Live wallet readiness remains mandatory for payments.
+
+Custom platform hosts may provide `bootstrapStorage.read(uid)`, `write(uid, snapshot)`, and `remove(uid)` to `openAccount`, and call `setInternetAvailable(false | true | null)` with platform reachability. Encrypt bootstrap data under the account/environment-bound install key; never put decrypted private content there. Standard web, iOS and Node adapters supply encrypted storage. Logout or observed revocation removes it.
+
+Node authentication is currently process-local: a fresh SDK/CLI process still needs the network to authenticate, even with saved credentials. Cached access supports an already-authenticated long-running SDK process; saved username/profile metadata cannot establish an offline session. Web and iOS can restore their platform-persisted signed-in auth slots.
+
+`connection.unavailable` is the shared offline-display signal, separate from account readiness in `connection.status`. Ordinary startup, local service initialization, and brief cache refreshes do not mean offline. Explicit device/cloud blocking and network errors report unavailability immediately; silent required server reads use the existing 15-second deadline. The cloud transport's `availability` port reports `false` when explicitly blocked and `null` when unknown, never treating an allowed test phase as proof of a server connection.
+
 ## Graphical auth owner
 
 ```js
@@ -158,7 +168,9 @@ await account.close();
 
 `openAccount()` owns authenticated user observation, username and avatar publication, vault observation and creation, vault unlock/lock, encrypted settings/network selection, presence, late wallet readiness, public Bitcoin data, support/report commands, chat and peer/profile composition, account switching, and secret-bearing session teardown. Focused-chat presence is separately owned by the chat session's encrypted ephemeral live transport. The account snapshot exposes `user`, `vault`, `vaultReady`, `vaultError`, `session`, `wallet`, `walletError`, `network`, and `lockState`; `vaultReady` becomes true only after the backend authorizes and confirms the current vault snapshot, while a cached snapshot may warm `vault` without authorizing a guarded route. Stable domain owners such as `bitcoin` and `support` live directly on the returned account owner. Graphical password-change flows call `verifyVaultPasswordForChange(currentPassword)` before revealing the new-password step, then call the atomic `changeVaultPassword({ currentPassword, newPassword })` command. Both are account-bound local decryptions; the first immediately clears its temporary seed, while the second preserves and verifies the existing Vault Signature identity before replacing the authoritative ciphertext.
 
-`account.profile` owns the server mutation after a platform has prepared avatar bytes or collected a username. Browser canvas work and native image manipulation remain platform-local; both then call the same `setAvatar`, `clearAvatar`, or `setUsername` command. Successful avatar commands update the shared user owner before returning.
+`account.profile` owns the server mutation after a platform has prepared avatar bytes or collected a username. Browser canvas work and native image manipulation remain platform-local; both then call the same `setAvatar`, `clearAvatar`, or `setUsername` command. Avatar selection/removal previews immediately through the shared user snapshot, waits while offline, and publishes once authenticated profile reads recover. Only the latest selection is retained, in memory for this session; lock/close discards unsent work and rejects its promise with `cancelled`. The promise resolves after server acknowledgment and the confirmed bytes/version enter the ordinary avatar cache. No pending avatar is persisted or compared through extra server reads. Username changes still require connectivity.
+
+`account.bitcoin` restores the last observed public USD price from `bitcoinPriceStorage` (`read()` / `write({ price, updatedAt })`). The platform port is shared across accounts within the same installation and realm. The snapshot exposes `priceUpdatedAt` and `priceFromCache`; a null observation time means the configured $80,000 default, never a fetched rate. Cache hydration restores price only, not fee estimates or server/wallet readiness. The existing cloud listener refreshes the saved rate without additional requests. Confirmed self/peer avatar bytes similarly hydrate from their exact cached version independently of cloud readiness.
 
 `account.peers` is the shared peer-directory owner used by Node, web, and iOS. `openAccount()` supplies its chat, wallet, blocked-user, and encrypted-cache sources directly, including missing-profile chat cleanup. Graphical adapters only subscribe to the same snapshot and profile selectors already defined by core. `openSearch('profiles')` creates profile-only search; web may also use `openSearch('mainmenu')` for its combined local-action and remote-profile menu. Active searches track peer and blocked-user changes and release those subscriptions when cleared or closed.
 
@@ -193,7 +205,7 @@ try {
 }
 ```
 
-An unknown Spark send, payment-request payment, invoice payment, or withdrawal outcome has `retryable: false`. Reconcile wallet transactions or the named operation before deciding what to do; blindly repeating it can spend twice. An unknown Lightning payment is retryable only when the same caller-supplied `idempotencyKey` will be reused. Direct CLI errors and persistent-session transport preserve these fields instead of reducing them to an error string.
+An unknown Spark send, payment-request payment, invoice payment, or withdrawal outcome has `retryable: false`. Reconcile wallet transactions or the named operation before deciding what to do; blindly repeating it can spend twice. An unknown Lightning payment is retryable only when the same `transferId` will be reused. Veyl creates that UUID before the first attempt and returns it as `operationId` on an uncertain outcome. Direct CLI errors and persistent-session transport preserve these fields instead of reducing them to an error string.
 
 ## Account
 
@@ -214,7 +226,7 @@ await veyl.account.logoutAll();
 await veyl.account.delete({ confirm: true });
 ```
 
-- `create` makes an ordinary account authenticated by a local machine credential and returns its account key directly. Authentication does not assign a public bot label.
+- `create` makes an account authenticated by a local machine credential, publishes its account type as `sdk`, and returns its account key directly.
 - `createPasskey({ username, webUrl, onUrl })` creates a normal passkey account through a browser-assisted WebAuthn flow, installs a local machine credential for future CLI sessions, and returns that account key directly.
 - `login({ username?, key?, saveKey? })` authenticates with an account key. The key can instead come from `open({ accountKey })` or `VEYL_ACCOUNT_KEY`.
 - `loginPasskey({ username?, webUrl?, onUrl? })` authenticates through the browser-assisted passkey flow.
@@ -225,7 +237,7 @@ await veyl.account.delete({ confirm: true });
 - `logoutAll` revokes every product session generation, tears down this runtime locally, and stops a persistent CLI owner after its in-flight work drains.
 - `delete({ confirm: true, key? })` drains decryptable inbox state, marks all discoverable chats deleted, destroys the complete account/network encrypted cache scope, proves vault possession inside the same destructive operation, deletes identifiable account data, removes the local profile, and stops a persistent CLI owner after its in-flight work drains. `key` is required only when the runtime has no saved vault key.
 
-Account summaries report identity, network, local credential/vault availability, public wallet/chat keys, auth kind, an explicit managed-bot marker when assigned by Glyphteck's owner namespace, and current signed-in/unlocked state. Account and vault keys are never included in summaries.
+Account summaries report identity, network, local credential/vault availability, public wallet/chat keys, auth kind, public `app` or `sdk` account type, and current signed-in/unlocked state. Linking a passkey promotes the type to `app`; account and vault keys are never included in summaries.
 
 ## Vault
 
@@ -242,6 +254,9 @@ Vault creation returns the vault key directly. That key unlocks the vault and ev
 
 ```js
 await veyl.profile.show();
+await veyl.profile.getPresence({ timeoutMs: 15_000 });
+await veyl.profile.setPresenceVisibility('private'); // appear offline on every account device
+await veyl.profile.setPresenceVisibility('public'); // share online status and last active
 await veyl.profile.uploadAvatar(webpBytes);
 await veyl.profile.deleteAvatar();
 await veyl.profile.setChatAdmission({
@@ -257,10 +272,12 @@ await veyl.cache.show();
 await veyl.cache.clear();
 ```
 
-`uploadAvatar` accepts prepared WebP bytes and uses the shared profile/avatar backend owner. `setChatAdmission` publishes a public `direct` mode (`open`, `requests`, or `closed`), a `groups` mode (`open` or `closed`), and a fixed-size padded set of private pair-capability commitments for up to eight allowed direct peers. Allowed peers may be usernames or public chat keys; their identities are resolved locally and are not published in the policy. Missing policies remain open for ordinary accounts, while malformed present policies fail closed. Existing chats retain their private routes.
+`uploadAvatar` accepts prepared WebP bytes and uses the shared profile/avatar backend owner. `setChatAdmission` publishes a public `direct` mode (`open`, `requests`, or `closed`), a `groups` mode (`open` or `closed`), and a fixed-size padded set of private pair-capability commitments for up to eight allowed direct peers. Allowed peers may be usernames or public chat keys; their identities are resolved locally and are not published in the policy. Missing policies remain open for ordinary accounts, while malformed present policies fail closed. Existing membership does not bypass a closed policy: disallowed chats are hidden and unavailable for admission-controlled actions, but policy changes never delete a direct or leave a group. `groups: closed` also prevents new group membership.
 
 Settings use the shared normalization and encrypted settings document. Changing `walletNetwork` locks the current vault so the next unlock boots the selected network. Cache methods operate on the same vault-encrypted display and media cache as the other clients.
 
+Presence visibility is an independent account-wide relay policy, not an encrypted settings field. `getPresence` waits for the acknowledged policy and returns `{ visibility, pending, error, availability, status, lastActiveAt }`. `setPresenceVisibility` accepts only `public` or `private` and resolves after the shared presence owner confirms the revisioned change; connection, conflict, and timeout errors reject explicitly. An unloaded policy never implies public visibility. The matching CLI commands are `veyl profile presence` and `veyl profile presence-set <public|private>`.
+
 ## Peers
 
 ```js
@@ -272,7 +289,9 @@ await veyl.peers.block('@alice');
 await veyl.peers.unblock('@alice');
 ```
 
-Peer resolution accepts `@username`, username, chat public key, or wallet public key when the operation supports it. Blocking self is rejected. Peer/profile results are public projections and do not expose local cache internals. `peers.show` authoritatively refreshes a cached identity; a confirmed missing profile evicts it and deletes loaded chats through the shared missing-peer owner. Normal chat/wallet actions keep the shared cached fast path, while their server-side operations still validate the authoritative route they mutate.
+Peer resolution accepts `@username`, username, chat public key, or wallet public key when the operation supports it. Blocking self is rejected. A block independently submits a narrow user report, retires every private chat route containing that peer, and returns `reported` separately from `blocked`; report failure never prevents the block. Peer/profile results are public projections and do not expose local cache internals. `peers.show` authoritatively refreshes a cached identity; a confirmed missing profile evicts it and deletes loaded chats through the shared missing-peer owner. Normal chat/wallet actions keep the shared cached fast path, while their server-side operations still validate the authoritative route they mutate.
+
+Profile and peer results include `presence: { availability, status, lastActiveAt }`; `active` is derived only from `availability === 'online'`, never from a stored profile flag. Availability is `unknown`, `online`, or `offline`; unknown/private/unobserved peers must not be presented as confirmed offline. Last-active timestamps are coarse buckets, not exact interaction times. Presence reflects the current bounded observation set; `@active` / `@online` search filters observed local peers rather than querying a global directory of online users.
 
 ## Chat
 
@@ -326,7 +345,7 @@ await veyl.chat.react('@alice', sent.message.id, '+1');
 await veyl.chat.unreact('@alice', sent.message.id);
 await veyl.chat.save('@alice', sent.message.id);
 await veyl.chat.unsave('@alice', sent.message.id);
-await veyl.chat.update('@alice', sent.message.id, 'edited');
+await veyl.chat.update('@alice', sent.message.id, 'edited'); // own text, strictly within 10 minutes
 await veyl.chat.delete('@alice', sent.message.id);
 await veyl.chat.retention('@alice', '24h');
 await veyl.chat.deleteChat('@alice', { cleanup: true });
@@ -419,7 +438,7 @@ await veyl.lightning.quote(invoice.encodedInvoice, { amountSats: 10 });
 await veyl.lightning.pay(invoice.encodedInvoice, {
   amountSats: 10,
   maxFeeSats: 5,
-  idempotencyKey: 'order-123',
+  transferId: '019c0000-0000-7000-8000-000000000001',
 });
 await veyl.lightning.receive(receiveId);
 await veyl.lightning.send(sendId);
@@ -552,7 +571,7 @@ Losing the root loses every derived account. Back it up as carefully as a wallet
 
 An existing account cannot retroactively acquire a derived master seed. Adopting one requires a one-time authenticated handoff that installs its root-derived account key and encrypts the existing master seed under its root-derived vault key without changing wallet/chat material.
 
-The Glyphteck namespace seed is separate from a fleet root. `veyl namespace init` creates that owner-only local key once. When its default file exists under the fleet `homeDir`, provisioning automatically signs a short-lived claim bound to the exact derived machine credential so a reserved canonical username can use the normal public account-creation transaction. The seed is never stored in the manifest or an account profile. Other fleet operators do not have this key and cannot claim the reserved namespace.
+The Veyl namespace seed is separate from a fleet root. `veyl namespace init` creates that owner-only local key once. When its default file exists under the fleet `homeDir`, provisioning automatically signs a short-lived claim bound to the exact derived machine credential so a reserved canonical username can use the normal public account-creation transaction. The seed is never stored in the manifest or an account profile. Other fleet operators do not have this key and cannot claim the reserved namespace.
 
 The owner opens one ordinary public client per enabled ready profile, runs account boots with bounded concurrency, tags events with their manifest account, preserves per-account policy order, fails visibly on backlog overflow, and closes every client on stop. An owner-only PID lock prevents two local processes from operating the fleet. It reclaims a dead same-host PID after a crash but never signals or replaces a healthy owner. Shared owners still control chat ordering, wallet serialization, encryption, cache, and account revocation.