@glyphteck/veyl 0.76.0 → 0.77.1

package/docs/api.md

@@ -46,16 +46,12 @@ const auth = openAuth({
   cloud,
   origin: () => window.location.origin,
   ceremony: {
-    create: async (options) => encodeCredential(
-      await navigator.credentials.create({
-        publicKey: decodePublicKeyOptions(options),
-      }),
-    ),
-    get: async (options) => encodeCredential(
-      await navigator.credentials.get({
-        publicKey: decodePublicKeyOptions(options),
-      }),
-    ),
+    create: (options) => navigator.credentials.create({
+      publicKey: decodePublicKeyOptions(options),
+    }),
+    get: (options) => navigator.credentials.get({
+      publicKey: decodePublicKeyOptions(options),
+    }),
   },
 });
 
@@ -78,7 +74,7 @@ unsubscribeAuth();
 await auth.logout();
 ```
 
-`openAuth()` owns the shared register, login, token, one-use link, passkey inventory, verified deletion, session observation, and sign-out choreography. `activateToken()` is the generic in-memory account-session activation boundary for a custom token returned by a token-only login, registration, or passkey-link flow; it is not nested under passkey links because those flows share the same isolated auth-slot operation. Never persist that token. The `cloud` input is a transport rather than a Firebase dependency. A platform supplies only the local credential ceremony: browser WebAuthn on web, `react-native-passkeys` on iOS, or a browser-assisted port in the Node runtime. Browser adapters must decode the server's binary options before the ceremony and return a JSON-safe credential afterward, as the placeholder helpers above indicate. Errors are normalized at this boundary so every client receives the same recoverable registration and login outcomes. The platform still owns when to prompt, how to present the prompt, navigation, local credential storage, and UI feedback.
+`openAuth()` owns the shared register, login, token, one-use link, passkey inventory, verified deletion, session observation, and sign-out choreography. `activateToken()` is the generic in-memory account-session activation boundary for a custom token returned by a token-only login, registration, or passkey-link flow; it is not nested under passkey links because those flows share the same isolated auth-slot operation. Never persist that token. The `cloud` input is a transport rather than a Firebase dependency. A platform supplies only the local credential ceremony: browser WebAuthn on web, `react-native-passkeys` on iOS, or a browser-assisted port in the Node runtime. browser adapters decode binary options and return the native credential object; ios returns its library's credential json. the shared owner extracts an explicit allowlist of authentication proof fields before any transport call. never serialize a raw browser credential with `toJSON()` or `JSON.stringify()`: extension results can contain encryption secrets. Errors are normalized at this boundary so every client receives the same recoverable registration and login outcomes. The platform still owns when to prompt, how to present the prompt, navigation, local credential storage, and UI feedback.
 
 ## Account profiles
 
@@ -140,8 +136,7 @@ const publicRequest = await account.payment.createRequest({ amountSats: 1250 });
 console.log(publicRequest.link);
 await account.profile.clearAvatar();
 
-await account.support.feedback('message', {
-  type: 'other',
+await account.support.submit('message', {
   platform: 'web',
   route: '/settings',
   appVersion,
@@ -414,7 +409,9 @@ const parsed = veyl.invite.read(created.link);
 
 ## Wallet
 
-All amounts are integer sats.
+bitcoin amounts are integer sats. `send` and `request` also accept an exact integer string or bigint of token base units when `tokenIdentifier` is supplied. the network-specific asset registry validates the identifier, issuer, and decimals; token values are never converted through btc or a floating-point number.
+
+structured `wallet_send` and `wallet_request` commands use `{ peer, amount, tokenIdentifier? }`, with `amount` as an integer string. `wallet_pay_request` derives the asset and full amount from the request.
 
 ```js
 await veyl.wallet.balance();
@@ -436,6 +433,27 @@ await veyl.wallet.search('@alice', { count: 50 });
 
 Wallet boot, signing, balance, transaction aggregation, peer attribution, claim, payment-request validation, and wallet mutation serialization are shared. `raw: true` adds JSON-safe SDK detail only where supported.
 
+the regtest prototype asset is usd veyl (`USDV`), with six decimals and a fixed test valuation of exactly one usd per token. the one-million-token supply is held by `@faucet`. no mainnet stablecoin is enabled.
+
+```js
+const balance = await veyl.wallet.balance();
+const usdv = balance.tokens.find(asset => asset.ticker === 'USDV');
+// the registry has already verified this record; use its identifier for actions.
+const request = await veyl.wallet.request('@faucet', '1250000', {
+  tokenIdentifier: usdv.tokenIdentifier, // 1.25 usdv, expressed in base units
+});
+await veyl.wallet.send('@alice', '1000000', { tokenIdentifier: usdv.tokenIdentifier });
+const page = await veyl.wallet.transactions({ tokenIdentifier: usdv.tokenIdentifier, count: 50 });
+```
+
+`balance.tokens` reports `ownedUnits`, `availableUnits`, `unavailableUnits`, formatted `amount`, `usdPrice`, and `usdValue`. null quantities mean unavailable rather than zero; inspect `tokenBalancesReady` and `tokenBalanceError`. only usdv has the fixed test valuation. values have no mainnet backing or redemption rights.
+
+token history uses `cursor` and `direction` (`PREVIOUS` for newest-first pages), returning `{ transfers, page }`; it rejects btc-style offsets. rows carry exact `amountUnits`, asset, direction, status, timestamp, and counterparties. the recent page is encrypted in the existing vault cache and scoped to wallet identity/network. token amounts are excluded from btc-only charts and aggregates. pay a token request with the ordinary `wallet.pay(requestId)` command; its encrypted asset identity determines which balance is spent and must match the confirmation.
+
+token requests use message type `tokenreq`, and their encrypted settlement actions use `tokenreqpay`. bitcoin retains `req` and `reqpay`. sdk token request events carry `tokenIdentifier`, `amountUnits`, `paidAmountUnits`, and `remainingAmountUnits` without an `amountSats` field. ios `0.76.0 (26)` ignores the new token message types; its bitcoin wallet remains usable, but it cannot display or pay token requests. never place token base units in a bitcoin request payload.
+
+the current request renderer and payment review preserve token identity on web and ios. the web cash selector chooses the payment asset independently of display currency: showing a token amount in btc never authorizes spending bitcoin. token invoices/qr and stablecoin swaps remain separate product work. the approved ios build's limitations are described above.
+
 ## Lightning and withdrawal
 
 ```js
@@ -473,12 +491,15 @@ Rows combine pending links and verified passkeys, mark the passkey currently aut
 ## Support
 
 ```js
-await veyl.support.feedback('message', { type: 'other', context: 'agent' });
-await veyl.support.bug('description');
+const ticket = await veyl.support.submit('description', {
+  id: 'stable_submission_id', // reuse this id for retries of the same draft
+  attachments: [{ name: 'screenshot.png', mimeType: 'image/png', bytes }],
+});
+console.log(ticket.id);
 await veyl.support.report('@alice', { messageId, note: 'context' });
 ```
 
-These methods use the same account-scoped validation, encrypted-message lookup, report metadata, evidence reservation, and backend submission owner as web/iOS. When `messageId` selects an attachment, the runtime reads and uploads the attachment as report evidence before submitting because attachment reports are invalid without their evidence path. Automated tests should not submit fake reports or support messages to shared environments.
+Support submissions use the same ticket owner as web/iOS. The agent classifies them after submission. A ticket accepts up to 4,000 characters and three files of up to 5 MiB each (PNG, JPEG, WebP, GIF, PDF or UTF-8 text). Attachments are deliberately shared with the operator for support. Abuse reports separately use account-scoped encrypted-message lookup, report metadata and evidence reservation. When `messageId` selects an attachment, the runtime reads and uploads the attachment as report evidence before submitting because attachment reports are invalid without their evidence path. Automated tests should not submit fake reports or support messages to shared environments.
 
 ## Live events
 

package/docs/cli.md

@@ -135,8 +135,8 @@ Amounts are integer sats.
 veyl wallet balance
 veyl wallet address
 veyl wallet claim [--count 100]
-veyl wallet send @alice 10 [--operation-id AGENT_JOB_ID]
-veyl wallet request @alice 10
+veyl wallet send @alice 10 [--operation-id AGENT_JOB_ID] [--token-identifier id]
+veyl wallet request @alice 10 [--token-identifier id]
 veyl wallet pay-request REQUEST_ID [--operation-id AGENT_JOB_ID]
 veyl wallet pay-invoice INVOICE [--amount SATS] [--operation-id AGENT_JOB_ID]
 veyl wallet transactions [--count 50] [--offset 0]
@@ -179,8 +179,7 @@ veyl passkeys list
 veyl passkeys link [--web-url ORIGIN]
 veyl passkeys delete ID [--web-url ORIGIN]
 
-veyl support feedback "message" [--context TEXT]
-veyl support bug "message"
+veyl support submit "message"
 veyl support report @alice [MESSAGE_ID] [--note TEXT] [--no-attachment]
 ```
 

package/docs/validation.md

@@ -18,7 +18,7 @@ The Node SDK composes the same framework-free owners as web and iOS:
 | Public invites | `core/invite.js` | direct Veyl URL strings |
 | Passkeys | shared passkey eligibility and normal backend link/passkey owners | browser URL for WebAuthn verification |
 | Settings/cache | shared settings normalization and vault-encrypted cache | JSON patches and byte counts |
-| Support | shared feedback, bug, report, and evidence builders | terminal text and existing message attachment |
+| Support | shared ticket, report, and evidence builders | terminal text and existing message attachment |
 
 The obsolete direct-cloud `createAccountSessionActions` implementation was removed during this pass. There is now one live product path: the SDK adapts inputs around the same chat, wallet, peer, user, vault, cache, search, and cloud owners used by the interactive clients.
 
@@ -51,7 +51,7 @@ API version 4 keeps `open()` as the public SDK composition root and adds stable-
 | Withdrawal | 3 / 3 | shared wallet session, fee normalization, and generic payment-intent/L1 review owner |
 | Invite | 2 / 2 | `core/invite.js`; direct URL strings only |
 | Passkeys | 3 / 2 | shared passkey eligibility plus the normal cloud passkey owners; bearer-link creation is one-shot only and WebAuthn stays browser-assisted |
-| Support | 3 / 3 | shared feedback, bug, report, message lookup, and evidence builders |
+| Support | 2 / 2 | shared ticket, report, message lookup, and evidence builders |
 | Session | 4 / 0 | local process/socket lifecycle around the same account runtime |
 | Docs | 1 / 0 | local stdio MCP exposing allowlisted packaged Markdown resources only |
 
@@ -76,7 +76,7 @@ API version 4 keeps `open()` as the public SDK composition root and adds stable-
 | Withdrawal quote/prepare/confirm | yes | a live 3,000-sat cooperative exit paid a 2,190-sat medium fee and funded the receiver's static address with 810 sats; the run exposed and fixed CLI re-quoting at confirm, and post-fee dust now rejects before spend |
 | Invite create/read | yes | all four shared invite kinds round-trip as direct URL strings; invalid kinds and amounts reject |
 | Passkey list/link/delete | yes | pending link create/delete exercised; list marks current credential and shared deletion eligibility |
-| Feedback/bug/report | yes | report-without-evidence succeeded live; feedback, bug, and reporting now share one SDK account owner and remaining cross-client checks are in the root manual queue |
+| Tickets/reports | yes | report-without-evidence succeeded live; ticket submission and reporting share one SDK account owner and remaining cross-client checks are in the root manual queue |
 | Docs discovery | yes | focused tests prove the stdio MCP advertises only documentation resources, reads only allowlisted packaged Markdown, and rejects action tool calls without loading a Veyl client |
 
 ## Edge cases exercised

package/examples/bot-fleet/policy.js

@@ -99,6 +99,10 @@ function isFleetGeneratedMessage(event) {
 }
 
 function requestAmount(event) {
+    if (event?.message?.tokenIdentifier != null) {
+        tokenAsset(event.message.tokenIdentifier, event.message.network);
+        return tokenUnits(event.message.amountUnits).toString();
+    }
     const amount = Number(event?.message?.amountSats);
     return Number.isSafeInteger(amount) && amount > 0 ? amount : null;
 }
@@ -215,7 +219,9 @@ async function sendUnderfunded(
         () => sendToEventChat(
             client,
             event,
-            `i only have ${availableSats} sats`,
+            event.message.tokenIdentifier
+                ? `i only have ${formatTokenAmount(String(availableSats), tokenAsset(event.message.tokenIdentifier, event.message.network))} ${tokenAsset(event.message.tokenIdentifier, event.message.network).ticker.toLowerCase()}`
+                : `i only have ${availableSats} sats`,
             { cid: botActionCid(event, 'funds-balance', account) }
         )
     );
@@ -267,7 +273,7 @@ async function mirrorEcho(journal, account, client, event) {
             () => mirrorReaction(account, client, event)
         );
     }
-    if (event.message.type === 'req') {
+    if (['req', 'tokenreq'].includes(event.message.type)) {
         if (event.chat?.lineage && event.chat.lineage !== 'direct') return null;
         const amountSats = requestAmount(event);
         if (!amountSats) return null;
@@ -279,6 +285,7 @@ async function mirrorEcho(journal, account, client, event) {
             { replaySafe: true },
             () => client.wallet.request(event.peer, amountSats, {
                 cid: botActionCid(event, 'echo-request', account),
+                tokenIdentifier: event.message.tokenIdentifier,
             })
         );
     }
@@ -335,13 +342,16 @@ async function serveFaucet(journal, account, client, event) {
             );
         }
         const balance = await client.wallet.balance();
-        if (balance.availableSats < amountSats) {
+        const tokenBalance = event.message.tokenIdentifier ? balance.tokens?.find((asset) => asset.tokenIdentifier === event.message.tokenIdentifier) : null;
+        if (event.message.tokenIdentifier && (balance.tokenBalancesReady !== true || tokenBalance?.availableUnits == null)) throw new Error('faucet token balance unavailable');
+        const available = event.message.tokenIdentifier ? tokenUnits(tokenBalance.availableUnits, { allowZero: true }) : BigInt(balance.availableSats);
+        if (available < BigInt(amountSats)) {
             await sendUnderfunded(
                 journal,
                 account,
                 client,
                 event,
-                balance.availableSats
+                available.toString()
             );
             return { paid: false, reason: 'insufficient-funds' };
         }
@@ -368,6 +378,7 @@ async function serveFaucet(journal, account, client, event) {
         { replaySafe: true },
         () => client.wallet.request(event.peer, amountSats, {
             cid: botActionCid(event, 'faucet-request', account),
+            tokenIdentifier: event.message.tokenIdentifier,
         })
     );
     return { paid: true, payment: paid };
@@ -664,7 +675,7 @@ export function createBotFleetPolicy(options = {}) {
             ) {
                 if (
                     roles.has('faucet') &&
-                    event.message.type === 'req'
+                    ['req', 'tokenreq'].includes(event.message.type)
                 ) {
                     result = await serveFaucet(
                         journal,
@@ -689,3 +700,4 @@ export function createBotFleetPolicy(options = {}) {
         },
     });
 }
+import { formatTokenAmount, tokenAsset, tokenUnits } from '@veyl/core/wallet/assets';

package/package.json

@@ -54,5 +54,5 @@
         "start": "node src/cli.js",
         "lint": "eslint src --quiet"
     },
-    "version": "0.76.0"
+    "version": "0.77.1"
 }