@atbash/sdk 0.7.2-dev.0 → 0.9.0-dev.0

package/dist/browser.mjs

@@ -247,12 +247,12 @@ var require_bn = __commonJS({
         }
         this.strip();
       };
-      function parseBase(str, start, end, mul5) {
+      function parseBase(str, start, end, mul6) {
         var r2 = 0;
         var len = Math.min(str.length, end);
         for (var i = start; i < len; i++) {
           var c = str.charCodeAt(i) - 48;
-          r2 *= mul5;
+          r2 *= mul6;
           if (c >= 49) {
             r2 += c - 49 + 10;
           } else if (c >= 17) {
@@ -1663,7 +1663,7 @@ var require_bn = __commonJS({
         out.length = x.length + y.length;
         return out.strip();
       };
-      BN2.prototype.mul = function mul5(num) {
+      BN2.prototype.mul = function mul6(num) {
         var out = new BN2(null);
         out.words = new Array(this.length + num.length);
         return this.mulTo(num, out);
@@ -1916,7 +1916,7 @@ var require_bn = __commonJS({
       BN2.prototype.abs = function abs2() {
         return this.clone().iabs();
       };
-      BN2.prototype._ishlnsubmul = function _ishlnsubmul(num, mul5, shift) {
+      BN2.prototype._ishlnsubmul = function _ishlnsubmul(num, mul6, shift) {
         var len = num.length + shift;
         var i;
         this._expand(len);
@@ -1924,7 +1924,7 @@ var require_bn = __commonJS({
         var carry = 0;
         for (i = 0; i < num.length; i++) {
           w = (this.words[i + shift] | 0) + carry;
-          var right = (num.words[i] | 0) * mul5;
+          var right = (num.words[i] | 0) * mul6;
           w -= right & 67108863;
           carry = (w >> 26) - (right / 67108864 | 0);
           this.words[i + shift] = w & 67108863;
@@ -2686,7 +2686,7 @@ var require_bn = __commonJS({
         this._verify2(a, b);
         return this.imod(a.imul(b));
       };
-      Red.prototype.mul = function mul5(a, b) {
+      Red.prototype.mul = function mul6(a, b) {
         this._verify2(a, b);
         return this.imod(a.mul(b));
       };
@@ -2837,7 +2837,7 @@ var require_bn = __commonJS({
         }
         return res._forceRed(this);
       };
-      Mont.prototype.mul = function mul5(a, b) {
+      Mont.prototype.mul = function mul6(a, b) {
         if (a.isZero() || b.isZero()) return new BN2(0)._forceRed(this);
         var t = a.mul(b);
         var c = t.maskn(this.shift).mul(this.minv).imaskn(this.shift).mul(this.m);
@@ -3034,11 +3034,11 @@ var HashMD = class {
   length = 0;
   pos = 0;
   destroyed = false;
-  constructor(blockLen, outputLen, padOffset, isLE) {
+  constructor(blockLen, outputLen, padOffset, isLE2) {
     this.blockLen = blockLen;
     this.outputLen = outputLen;
     this.padOffset = padOffset;
-    this.isLE = isLE;
+    this.isLE = isLE2;
     this.buffer = new Uint8Array(blockLen);
     this.view = createView(this.buffer);
   }
@@ -3071,7 +3071,7 @@ var HashMD = class {
     aexists(this);
     aoutput(out, this);
     this.finished = true;
-    const { buffer: buffer2, view, blockLen, isLE } = this;
+    const { buffer: buffer2, view, blockLen, isLE: isLE2 } = this;
     let { pos } = this;
     buffer2[pos++] = 128;
     clean(this.buffer.subarray(pos));
@@ -3081,7 +3081,7 @@ var HashMD = class {
     }
     for (let i = pos; i < blockLen; i++)
       buffer2[i] = 0;
-    view.setBigUint64(blockLen - 8, BigInt(this.length * 8), isLE);
+    view.setBigUint64(blockLen - 8, BigInt(this.length * 8), isLE2);
     this.process(view, 0);
     const oview = createView(out);
     const len = this.outputLen;
@@ -3092,7 +3092,7 @@ var HashMD = class {
     if (outLen > state2.length)
       throw new Error("_sha2: outputLen bigger than state");
     for (let i = 0; i < outLen; i++)
-      oview.setUint32(4 * i, state2[i], isLE);
+      oview.setUint32(4 * i, state2[i], isLE2);
   }
   digest() {
     const { buffer: buffer2, outputLen } = this;
@@ -3786,18 +3786,18 @@ var _Field = class {
   }
   fromBytes(bytes, skipValidation = false) {
     abytes2(bytes);
-    const { _lengths: allowedLengths, BYTES, isLE, ORDER, _mod: modFromBytes } = this;
+    const { _lengths: allowedLengths, BYTES, isLE: isLE2, ORDER, _mod: modFromBytes } = this;
     if (allowedLengths) {
       if (bytes.length < 1 || !allowedLengths.includes(bytes.length) || bytes.length > BYTES) {
         throw new Error("Field.fromBytes: expected " + allowedLengths + " bytes, got " + bytes.length);
       }
       const padded = new Uint8Array(BYTES);
-      padded.set(bytes, isLE ? 0 : padded.length - bytes.length);
+      padded.set(bytes, isLE2 ? 0 : padded.length - bytes.length);
       bytes = padded;
     }
     if (bytes.length !== BYTES)
       throw new Error("Field.fromBytes: expected " + BYTES + " bytes, got " + bytes.length);
-    let scalar = isLE ? bytesToNumberLE(bytes) : bytesToNumberBE(bytes);
+    let scalar = isLE2 ? bytesToNumberLE(bytes) : bytesToNumberBE(bytes);
     if (modFromBytes)
       scalar = mod(scalar, ORDER);
     if (!skipValidation) {
@@ -3833,16 +3833,16 @@ function getMinHashLength(fieldOrder) {
   const length = getFieldBytesLength(fieldOrder);
   return length + Math.ceil(length / 2);
 }
-function mapHashToField(key3, fieldOrder, isLE = false) {
+function mapHashToField(key3, fieldOrder, isLE2 = false) {
   abytes2(key3);
   const len = key3.length;
   const fieldLen = getFieldBytesLength(fieldOrder);
   const minLen = Math.max(getMinHashLength(fieldOrder), 16);
   if (len < minLen || len > 1024)
     throw new Error("expected " + minLen + "-1024 bytes of input, got " + len);
-  const num = isLE ? bytesToNumberLE(key3) : bytesToNumberBE(key3);
+  const num = isLE2 ? bytesToNumberLE(key3) : bytesToNumberBE(key3);
   const reduced = mod(num, fieldOrder - _1n2) + _1n2;
-  return isLE ? numberToBytesLE(reduced, fieldLen) : numberToBytesBE(reduced, fieldLen);
+  return isLE2 ? numberToBytesLE(reduced, fieldLen) : numberToBytesBE(reduced, fieldLen);
 }
 
 // node_modules/@noble/curves/abstract/curve.js
@@ -4041,14 +4041,14 @@ function mulEndoUnsafe(Point2, point5, k1, k2) {
   }
   return { p1, p2 };
 }
-function createField(order, field, isLE) {
+function createField(order, field, isLE2) {
   if (field) {
     if (field.ORDER !== order)
       throw new Error("Field.ORDER must match order: Fp == p, Fn == n");
     validateField(field);
     return field;
   } else {
-    return Field(order, { isLE });
+    return Field(order, { isLE: isLE2 });
   }
 }
 function createCurveFields(type2, CURVE, curveOpts = {}, FpFnLE) {
@@ -4639,15 +4639,15 @@ function weierstrass(params, extraOpts = {}) {
       if (!Fn.isValidNot0(scalar))
         throw new RangeError("invalid scalar: out of range");
       let point5, fake;
-      const mul5 = (n) => wnaf.cached(this, n, (p) => normalizeZ(Point2, p));
+      const mul6 = (n) => wnaf.cached(this, n, (p) => normalizeZ(Point2, p));
       if (endo2) {
         const { k1neg, k1, k2neg, k2 } = splitEndoScalarN(scalar);
-        const { p: k1p, f: k1f } = mul5(k1);
-        const { p: k2p, f: k2f } = mul5(k2);
+        const { p: k1p, f: k1f } = mul6(k1);
+        const { p: k2p, f: k2f } = mul6(k2);
         fake = k1f.add(k2f);
         point5 = finishEndo(endo2.beta, k1p, k2p, k1neg, k2neg);
       } else {
-        const { p, f: f2 } = mul5(scalar);
+        const { p, f: f2 } = mul6(scalar);
         point5 = p;
         fake = f2;
       }
@@ -5241,14 +5241,14 @@ function fromByteArray(uint8) {
   return parts.join("");
 }
 var ieee754 = {};
-ieee754.read = function(buffer2, offset, isLE, mLen, nBytes) {
+ieee754.read = function(buffer2, offset, isLE2, mLen, nBytes) {
   var e, m;
   var eLen = nBytes * 8 - mLen - 1;
   var eMax = (1 << eLen) - 1;
   var eBias = eMax >> 1;
   var nBits = -7;
-  var i = isLE ? nBytes - 1 : 0;
-  var d = isLE ? -1 : 1;
+  var i = isLE2 ? nBytes - 1 : 0;
+  var d = isLE2 ? -1 : 1;
   var s2 = buffer2[offset + i];
   i += d;
   e = s2 & (1 << -nBits) - 1;
@@ -5271,14 +5271,14 @@ ieee754.read = function(buffer2, offset, isLE, mLen, nBytes) {
   }
   return (s2 ? -1 : 1) * m * Math.pow(2, e - mLen);
 };
-ieee754.write = function(buffer2, value, offset, isLE, mLen, nBytes) {
+ieee754.write = function(buffer2, value, offset, isLE2, mLen, nBytes) {
   var e, m, c;
   var eLen = nBytes * 8 - mLen - 1;
   var eMax = (1 << eLen) - 1;
   var eBias = eMax >> 1;
   var rt = mLen === 23 ? Math.pow(2, -24) - Math.pow(2, -77) : 0;
-  var i = isLE ? 0 : nBytes - 1;
-  var d = isLE ? 1 : -1;
+  var i = isLE2 ? 0 : nBytes - 1;
+  var d = isLE2 ? 1 : -1;
   var s2 = value < 0 || value === 0 && 1 / value < 0 ? 1 : 0;
   value = Math.abs(value);
   if (isNaN(value) || value === Infinity) {
@@ -6163,10 +6163,10 @@ ieee754.write = function(buffer2, value, offset, isLE, mLen, nBytes) {
     byteLength3 = byteLength3 >>> 0;
     if (!noAssert) checkOffset(offset, byteLength3, this.length);
     let val = this[offset];
-    let mul5 = 1;
+    let mul6 = 1;
     let i = 0;
-    while (++i < byteLength3 && (mul5 *= 256)) {
-      val += this[offset + i] * mul5;
+    while (++i < byteLength3 && (mul6 *= 256)) {
+      val += this[offset + i] * mul6;
     }
     return val;
   };
@@ -6177,9 +6177,9 @@ ieee754.write = function(buffer2, value, offset, isLE, mLen, nBytes) {
       checkOffset(offset, byteLength3, this.length);
     }
     let val = this[offset + --byteLength3];
-    let mul5 = 1;
-    while (byteLength3 > 0 && (mul5 *= 256)) {
-      val += this[offset + --byteLength3] * mul5;
+    let mul6 = 1;
+    while (byteLength3 > 0 && (mul6 *= 256)) {
+      val += this[offset + --byteLength3] * mul6;
     }
     return val;
   };
@@ -6237,13 +6237,13 @@ ieee754.write = function(buffer2, value, offset, isLE, mLen, nBytes) {
     byteLength3 = byteLength3 >>> 0;
     if (!noAssert) checkOffset(offset, byteLength3, this.length);
     let val = this[offset];
-    let mul5 = 1;
+    let mul6 = 1;
     let i = 0;
-    while (++i < byteLength3 && (mul5 *= 256)) {
-      val += this[offset + i] * mul5;
+    while (++i < byteLength3 && (mul6 *= 256)) {
+      val += this[offset + i] * mul6;
     }
-    mul5 *= 128;
-    if (val >= mul5) val -= Math.pow(2, 8 * byteLength3);
+    mul6 *= 128;
+    if (val >= mul6) val -= Math.pow(2, 8 * byteLength3);
     return val;
   };
   Buffer5.prototype.readIntBE = function readIntBE(offset, byteLength3, noAssert) {
@@ -6251,13 +6251,13 @@ ieee754.write = function(buffer2, value, offset, isLE, mLen, nBytes) {
     byteLength3 = byteLength3 >>> 0;
     if (!noAssert) checkOffset(offset, byteLength3, this.length);
     let i = byteLength3;
-    let mul5 = 1;
+    let mul6 = 1;
     let val = this[offset + --i];
-    while (i > 0 && (mul5 *= 256)) {
-      val += this[offset + --i] * mul5;
+    while (i > 0 && (mul6 *= 256)) {
+      val += this[offset + --i] * mul6;
     }
-    mul5 *= 128;
-    if (val >= mul5) val -= Math.pow(2, 8 * byteLength3);
+    mul6 *= 128;
+    if (val >= mul6) val -= Math.pow(2, 8 * byteLength3);
     return val;
   };
   Buffer5.prototype.readInt8 = function readInt8(offset, noAssert) {
@@ -6344,11 +6344,11 @@ ieee754.write = function(buffer2, value, offset, isLE, mLen, nBytes) {
       const maxBytes = Math.pow(2, 8 * byteLength3) - 1;
       checkInt(this, value, offset, byteLength3, maxBytes, 0);
     }
-    let mul5 = 1;
+    let mul6 = 1;
     let i = 0;
     this[offset] = value & 255;
-    while (++i < byteLength3 && (mul5 *= 256)) {
-      this[offset + i] = value / mul5 & 255;
+    while (++i < byteLength3 && (mul6 *= 256)) {
+      this[offset + i] = value / mul6 & 255;
     }
     return offset + byteLength3;
   };
@@ -6361,10 +6361,10 @@ ieee754.write = function(buffer2, value, offset, isLE, mLen, nBytes) {
       checkInt(this, value, offset, byteLength3, maxBytes, 0);
     }
     let i = byteLength3 - 1;
-    let mul5 = 1;
+    let mul6 = 1;
     this[offset + i] = value & 255;
-    while (--i >= 0 && (mul5 *= 256)) {
-      this[offset + i] = value / mul5 & 255;
+    while (--i >= 0 && (mul6 *= 256)) {
+      this[offset + i] = value / mul6 & 255;
     }
     return offset + byteLength3;
   };
@@ -6465,14 +6465,14 @@ ieee754.write = function(buffer2, value, offset, isLE, mLen, nBytes) {
       checkInt(this, value, offset, byteLength3, limit - 1, -limit);
     }
     let i = 0;
-    let mul5 = 1;
+    let mul6 = 1;
     let sub = 0;
     this[offset] = value & 255;
-    while (++i < byteLength3 && (mul5 *= 256)) {
+    while (++i < byteLength3 && (mul6 *= 256)) {
       if (value < 0 && sub === 0 && this[offset + i - 1] !== 0) {
         sub = 1;
       }
-      this[offset + i] = (value / mul5 >> 0) - sub & 255;
+      this[offset + i] = (value / mul6 >> 0) - sub & 255;
     }
     return offset + byteLength3;
   };
@@ -6484,14 +6484,14 @@ ieee754.write = function(buffer2, value, offset, isLE, mLen, nBytes) {
       checkInt(this, value, offset, byteLength3, limit - 1, -limit);
     }
     let i = byteLength3 - 1;
-    let mul5 = 1;
+    let mul6 = 1;
     let sub = 0;
     this[offset + i] = value & 255;
-    while (--i >= 0 && (mul5 *= 256)) {
+    while (--i >= 0 && (mul6 *= 256)) {
       if (value < 0 && sub === 0 && this[offset + i + 1] !== 0) {
         sub = 1;
       }
-      this[offset + i] = (value / mul5 >> 0) - sub & 255;
+      this[offset + i] = (value / mul6 >> 0) - sub & 255;
     }
     return offset + byteLength3;
   };
@@ -7228,12 +7228,12 @@ bn$1.exports;
       }
       this.strip();
     };
-    function parseBase(str, start, end, mul5) {
+    function parseBase(str, start, end, mul6) {
       var r2 = 0;
       var len = Math.min(str.length, end);
       for (var i = start; i < len; i++) {
         var c = str.charCodeAt(i) - 48;
-        r2 *= mul5;
+        r2 *= mul6;
         if (c >= 49) {
           r2 += c - 49 + 10;
         } else if (c >= 17) {
@@ -8640,7 +8640,7 @@ bn$1.exports;
       out.length = x.length + y.length;
       return out.strip();
     };
-    BN2.prototype.mul = function mul5(num) {
+    BN2.prototype.mul = function mul6(num) {
       var out = new BN2(null);
       out.words = new Array(this.length + num.length);
       return this.mulTo(num, out);
@@ -8886,7 +8886,7 @@ bn$1.exports;
     BN2.prototype.abs = function abs2() {
       return this.clone().iabs();
     };
-    BN2.prototype._ishlnsubmul = function _ishlnsubmul(num, mul5, shift) {
+    BN2.prototype._ishlnsubmul = function _ishlnsubmul(num, mul6, shift) {
       var len = num.length + shift;
       var i;
       this._expand(len);
@@ -8894,7 +8894,7 @@ bn$1.exports;
       var carry = 0;
       for (i = 0; i < num.length; i++) {
         w = (this.words[i + shift] | 0) + carry;
-        var right = (num.words[i] | 0) * mul5;
+        var right = (num.words[i] | 0) * mul6;
         w -= right & 67108863;
         carry = (w >> 26) - (right / 67108864 | 0);
         this.words[i + shift] = w & 67108863;
@@ -9654,7 +9654,7 @@ bn$1.exports;
       this._verify2(a, b);
       return this.imod(a.imul(b));
     };
-    Red.prototype.mul = function mul5(a, b) {
+    Red.prototype.mul = function mul6(a, b) {
       this._verify2(a, b);
       return this.imod(a.mul(b));
     };
@@ -9805,7 +9805,7 @@ bn$1.exports;
       }
       return res._forceRed(this);
     };
-    Mont.prototype.mul = function mul5(a, b) {
+    Mont.prototype.mul = function mul6(a, b) {
       if (a.isZero() || b.isZero()) return new BN2(0)._forceRed(this);
       var t = a.mul(b);
       var c = t.maskn(this.shift).mul(this.minv).imaskn(this.shift).mul(this.m);
@@ -21507,20 +21507,20 @@ function calcIv(self2, iv, ck) {
     self2._finID = Buffer$c.concat([iv, Buffer$c.from([0, 0, 0, 1])]);
     return Buffer$c.concat([iv, Buffer$c.from([0, 0, 0, 2])]);
   }
-  var ghash2 = new GHASH(ck);
+  var ghash3 = new GHASH(ck);
   var len = iv.length;
   var toPad = len % 16;
-  ghash2.update(iv);
+  ghash3.update(iv);
   if (toPad) {
     toPad = 16 - toPad;
-    ghash2.update(Buffer$c.alloc(toPad, 0));
+    ghash3.update(Buffer$c.alloc(toPad, 0));
   }
-  ghash2.update(Buffer$c.alloc(8, 0));
+  ghash3.update(Buffer$c.alloc(8, 0));
   var ivBits = len * 8;
   var tail = Buffer$c.alloc(8);
   tail.writeUIntBE(ivBits, 0, 8);
-  ghash2.update(tail);
-  self2._finID = ghash2.state;
+  ghash3.update(tail);
+  self2._finID = ghash3.state;
   var out = Buffer$c.from(self2._finID);
   incr32(out);
   return out;
@@ -22612,13 +22612,13 @@ bn.exports;
       }
       this._strip();
     };
-    function parseBase(str, start, end, mul5) {
+    function parseBase(str, start, end, mul6) {
       var r2 = 0;
       var b = 0;
       var len = Math.min(str.length, end);
       for (var i = start; i < len; i++) {
         var c = str.charCodeAt(i) - 48;
-        r2 *= mul5;
+        r2 *= mul6;
         if (c >= 49) {
           b = c - 49 + 10;
         } else if (c >= 17) {
@@ -22626,7 +22626,7 @@ bn.exports;
         } else {
           b = c;
         }
-        assert2(c >= 0 && b < mul5, "Invalid character");
+        assert2(c >= 0 && b < mul6, "Invalid character");
         r2 += b;
       }
       return r2;
@@ -23950,7 +23950,7 @@ bn.exports;
       }
       return res;
     };
-    BN2.prototype.mul = function mul5(num) {
+    BN2.prototype.mul = function mul6(num) {
       var out = new BN2(null);
       out.words = new Array(this.length + num.length);
       return this.mulTo(num, out);
@@ -24198,7 +24198,7 @@ bn.exports;
     BN2.prototype.abs = function abs2() {
       return this.clone().iabs();
     };
-    BN2.prototype._ishlnsubmul = function _ishlnsubmul(num, mul5, shift) {
+    BN2.prototype._ishlnsubmul = function _ishlnsubmul(num, mul6, shift) {
       var len = num.length + shift;
       var i;
       this._expand(len);
@@ -24206,7 +24206,7 @@ bn.exports;
       var carry = 0;
       for (i = 0; i < num.length; i++) {
         w = (this.words[i + shift] | 0) + carry;
-        var right = (num.words[i] | 0) * mul5;
+        var right = (num.words[i] | 0) * mul6;
         w -= right & 67108863;
         carry = (w >> 26) - (right / 67108864 | 0);
         this.words[i + shift] = w & 67108863;
@@ -24975,7 +24975,7 @@ bn.exports;
       this._verify2(a, b);
       return this.imod(a.imul(b));
     };
-    Red.prototype.mul = function mul5(a, b) {
+    Red.prototype.mul = function mul6(a, b) {
       this._verify2(a, b);
       return this.imod(a.mul(b));
     };
@@ -25126,7 +25126,7 @@ bn.exports;
       }
       return res._forceRed(this);
     };
-    Mont.prototype.mul = function mul5(a, b) {
+    Mont.prototype.mul = function mul6(a, b) {
       if (a.isZero() || b.isZero()) return new BN2(0)._forceRed(this);
       var t = a.mul(b);
       var c = t.maskn(this.shift).mul(this.minv).imaskn(this.shift).mul(this.m);
@@ -43292,8 +43292,8 @@ function loadAgent(privkey) {
   if (!isValidPrivateKey(privkey)) {
     throw new Error("invalid private key \u2014 must be 64 hex characters (secp256k1)");
   }
-  const clean2 = stripHex(privkey);
-  return { privkey: clean2, pubkey: derivePublicKey(clean2) };
+  const clean3 = stripHex(privkey);
+  return { privkey: clean3, pubkey: derivePublicKey(clean3) };
 }
 function signOp(opName, args, privkeyHex, blockchainRidHex) {
   if (!isValidPrivateKey(privkeyHex)) {
@@ -43440,6 +43440,712 @@ function chainForNetwork(network) {
   return network === "private" ? PRIVATE_CHAIN : PUBLIC_CHAIN;
 }
 
+// node_modules/@noble/hashes/hkdf.js
+function extract(hash3, ikm, salt) {
+  ahash(hash3);
+  if (salt === void 0)
+    salt = new Uint8Array(hash3.outputLen);
+  return hmac(hash3, salt, ikm);
+}
+var HKDF_COUNTER = /* @__PURE__ */ Uint8Array.of(0);
+var EMPTY_BUFFER = /* @__PURE__ */ Uint8Array.of();
+function expand2(hash3, prk, info2, length = 32) {
+  ahash(hash3);
+  anumber(length, "length");
+  abytes(prk, void 0, "prk");
+  const olen = hash3.outputLen;
+  if (prk.length < olen)
+    throw new Error('"prk" must be at least HashLen octets');
+  if (length > 255 * olen)
+    throw new Error("Length must be <= 255*HashLen");
+  const blocks = Math.ceil(length / olen);
+  if (info2 === void 0)
+    info2 = EMPTY_BUFFER;
+  else
+    abytes(info2, void 0, "info");
+  const okm = new Uint8Array(blocks * olen);
+  const HMAC = hmac.create(hash3, prk);
+  const HMACTmp = HMAC._cloneInto();
+  const T = new Uint8Array(HMAC.outputLen);
+  for (let counter = 0; counter < blocks; counter++) {
+    HKDF_COUNTER[0] = counter + 1;
+    HMACTmp.update(counter === 0 ? EMPTY_BUFFER : T).update(info2).update(HKDF_COUNTER).digestInto(T);
+    okm.set(T, olen * counter);
+    HMAC._cloneInto(HMACTmp);
+  }
+  HMAC.destroy();
+  HMACTmp.destroy();
+  clean(T, HKDF_COUNTER);
+  return okm.slice(0, length);
+}
+var hkdf = (hash3, ikm, salt, info2, length) => expand2(hash3, extract(hash3, ikm, salt), info2, length);
+
+// node_modules/@noble/ciphers/utils.js
+function isBytes3(a) {
+  return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array" && "BYTES_PER_ELEMENT" in a && a.BYTES_PER_ELEMENT === 1;
+}
+function abool2(b) {
+  if (typeof b !== "boolean")
+    throw new TypeError(`boolean expected, not ${b}`);
+}
+function anumber3(n) {
+  if (typeof n !== "number")
+    throw new TypeError("number expected, got " + typeof n);
+  if (!Number.isSafeInteger(n) || n < 0)
+    throw new RangeError("positive integer expected, got " + n);
+}
+function abytes3(value, length, title = "") {
+  const bytes = isBytes3(value);
+  const len = value?.length;
+  const needsLen = length !== void 0;
+  if (!bytes || needsLen && len !== length) {
+    const prefix = title && `"${title}" `;
+    const ofLen = needsLen ? ` of length ${length}` : "";
+    const got = bytes ? `length=${len}` : `type=${typeof value}`;
+    const message = prefix + "expected Uint8Array" + ofLen + ", got " + got;
+    if (!bytes)
+      throw new TypeError(message);
+    throw new RangeError(message);
+  }
+  return value;
+}
+function aexists2(instance, checkFinished = true) {
+  if (instance.destroyed)
+    throw new Error("Hash instance has been destroyed");
+  if (checkFinished && instance.finished)
+    throw new Error("Hash#digest() has already been called");
+}
+function aoutput2(out, instance, onlyAligned = false) {
+  abytes3(out, void 0, "output");
+  const min2 = instance.outputLen;
+  if (out.length < min2) {
+    throw new RangeError("digestInto() expects output buffer of length at least " + min2);
+  }
+  if (onlyAligned && !isAligned32(out))
+    throw new Error("invalid output, must be aligned");
+}
+function u8(arr) {
+  return new Uint8Array(arr.buffer, arr.byteOffset, arr.byteLength);
+}
+function u32(arr) {
+  return new Uint32Array(arr.buffer, arr.byteOffset, Math.floor(arr.byteLength / 4));
+}
+function clean2(...arrays) {
+  for (let i = 0; i < arrays.length; i++) {
+    arrays[i].fill(0);
+  }
+}
+function createView2(arr) {
+  return new DataView(arr.buffer, arr.byteOffset, arr.byteLength);
+}
+var isLE = /* @__PURE__ */ (() => new Uint8Array(new Uint32Array([287454020]).buffer)[0] === 68)();
+var byteSwap = (word) => word << 24 & 4278190080 | word << 8 & 16711680 | word >>> 8 & 65280 | word >>> 24 & 255;
+var swap8IfBE = isLE ? (n) => n : (n) => byteSwap(n) >>> 0;
+var byteSwap32 = (arr) => {
+  for (let i = 0; i < arr.length; i++)
+    arr[i] = byteSwap(arr[i]);
+  return arr;
+};
+var swap32IfBE = isLE ? (u) => u : byteSwap32;
+function equalBytes(a, b) {
+  if (a.length !== b.length)
+    return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++)
+    diff |= a[i] ^ b[i];
+  return diff === 0;
+}
+function wrapMacConstructor(keyLen, macCons, fromMsg) {
+  const mac = macCons;
+  const getArgs = fromMsg || (() => []);
+  const macC = (msg, key3) => mac(key3, ...getArgs(msg)).update(msg).digest();
+  const tmp = mac(new Uint8Array(keyLen), ...getArgs(new Uint8Array(0)));
+  macC.outputLen = tmp.outputLen;
+  macC.blockLen = tmp.blockLen;
+  macC.create = (key3, ...args) => mac(key3, ...args);
+  return macC;
+}
+var wrapCipher = /* @__NO_SIDE_EFFECTS__ */ (params, constructor) => {
+  function wrappedCipher(key3, ...args) {
+    abytes3(key3, void 0, "key");
+    if (params.nonceLength !== void 0) {
+      const nonce = args[0];
+      abytes3(nonce, params.varSizeNonce ? void 0 : params.nonceLength, "nonce");
+    }
+    const tagl = params.tagLength;
+    if (tagl && args[1] !== void 0)
+      abytes3(args[1], void 0, "AAD");
+    const cipher2 = constructor(key3, ...args);
+    const checkOutput = (fnLength, output) => {
+      if (output !== void 0) {
+        if (fnLength !== 2)
+          throw new Error("cipher output not supported");
+        abytes3(output, void 0, "output");
+      }
+    };
+    let called = false;
+    const wrCipher = {
+      encrypt(data, output) {
+        if (called)
+          throw new Error("cannot encrypt() twice with same key + nonce");
+        called = true;
+        abytes3(data);
+        checkOutput(cipher2.encrypt.length, output);
+        return cipher2.encrypt(data, output);
+      },
+      decrypt(data, output) {
+        abytes3(data);
+        if (tagl && data.length < tagl)
+          throw new Error('"ciphertext" expected length bigger than tagLength=' + tagl);
+        checkOutput(cipher2.decrypt.length, output);
+        return cipher2.decrypt(data, output);
+      }
+    };
+    return wrCipher;
+  }
+  Object.assign(wrappedCipher, params);
+  return wrappedCipher;
+};
+function getOutput(expectedLength, out, onlyAligned = true) {
+  if (out === void 0)
+    return new Uint8Array(expectedLength);
+  abytes3(out, void 0, "output");
+  if (out.length !== expectedLength)
+    throw new Error('"output" expected Uint8Array of length ' + expectedLength + ", got: " + out.length);
+  if (onlyAligned && !isAligned32(out))
+    throw new Error("invalid output, must be aligned");
+  return out;
+}
+function u64Lengths(dataLength, aadLength, isLE2) {
+  anumber3(dataLength);
+  anumber3(aadLength);
+  abool2(isLE2);
+  const num = new Uint8Array(16);
+  const view = createView2(num);
+  view.setBigUint64(0, BigInt(aadLength), isLE2);
+  view.setBigUint64(8, BigInt(dataLength), isLE2);
+  return num;
+}
+function isAligned32(bytes) {
+  return bytes.byteOffset % 4 === 0;
+}
+function copyBytes2(bytes) {
+  return Uint8Array.from(abytes3(bytes));
+}
+
+// node_modules/@noble/ciphers/_polyval.js
+var BLOCK_SIZE = 16;
+var ZEROS16 = /* @__PURE__ */ new Uint8Array(16);
+var ZEROS32 = /* @__PURE__ */ u32(ZEROS16);
+var POLY = 225;
+var mul22 = (s0, s1, s2, s3) => {
+  const hiBit = s3 & 1;
+  return {
+    s3: s2 << 31 | s3 >>> 1,
+    s2: s1 << 31 | s2 >>> 1,
+    s1: s0 << 31 | s1 >>> 1,
+    // NIST SP 800-38D §6.3 applies `V >> 1` and XORs R on carry. In this
+    // 4x32-bit split, R = 0xe1 || 0^120 lives in the top byte of s0.
+    s0: s0 >>> 1 ^ POLY << 24 & -(hiBit & 1)
+    // reduce % poly
+  };
+};
+var swapLE = (n) => (n >>> 0 & 255) << 24 | (n >>> 8 & 255) << 16 | (n >>> 16 & 255) << 8 | n >>> 24 & 255 | 0;
+var estimateWindow = (bytes) => {
+  if (bytes > 64 * 1024)
+    return 8;
+  if (bytes > 1024)
+    return 4;
+  return 2;
+};
+var GHASH2 = class {
+  blockLen = BLOCK_SIZE;
+  outputLen = BLOCK_SIZE;
+  s0 = 0;
+  s1 = 0;
+  s2 = 0;
+  s3 = 0;
+  finished = false;
+  destroyed = false;
+  t;
+  W;
+  windowSize;
+  // We select bits per window adaptively based on expectedLength
+  constructor(key3, expectedLength) {
+    abytes3(key3, 16, "key");
+    key3 = copyBytes2(key3);
+    const kView = createView2(key3);
+    let k0 = kView.getUint32(0, false);
+    let k1 = kView.getUint32(4, false);
+    let k2 = kView.getUint32(8, false);
+    let k3 = kView.getUint32(12, false);
+    const doubles = [];
+    for (let i = 0; i < 128; i++) {
+      doubles.push({ s0: swapLE(k0), s1: swapLE(k1), s2: swapLE(k2), s3: swapLE(k3) });
+      ({ s0: k0, s1: k1, s2: k2, s3: k3 } = mul22(k0, k1, k2, k3));
+    }
+    const W2 = estimateWindow(expectedLength || 1024);
+    if (![1, 2, 4, 8].includes(W2))
+      throw new Error("ghash: invalid window size, expected 2, 4 or 8");
+    this.W = W2;
+    const bits = 128;
+    const windows = bits / W2;
+    const windowSize = this.windowSize = 2 ** W2;
+    const items = [];
+    for (let w = 0; w < windows; w++) {
+      for (let byte = 0; byte < windowSize; byte++) {
+        let s0 = 0, s1 = 0, s2 = 0, s3 = 0;
+        for (let j = 0; j < W2; j++) {
+          const bit = byte >>> W2 - j - 1 & 1;
+          if (!bit)
+            continue;
+          const { s0: d0, s1: d1, s2: d2, s3: d3 } = doubles[W2 * w + j];
+          s0 ^= d0, s1 ^= d1, s2 ^= d2, s3 ^= d3;
+        }
+        items.push({ s0, s1, s2, s3 });
+      }
+    }
+    this.t = items;
+  }
+  _updateBlock(s0, s1, s2, s3) {
+    s0 ^= this.s0, s1 ^= this.s1, s2 ^= this.s2, s3 ^= this.s3;
+    const { W: W2, t, windowSize } = this;
+    let o0 = 0, o1 = 0, o2 = 0, o3 = 0;
+    const mask = (1 << W2) - 1;
+    let w = 0;
+    for (const num of [s0, s1, s2, s3]) {
+      for (let bytePos = 0; bytePos < 4; bytePos++) {
+        const byte = num >>> 8 * bytePos & 255;
+        for (let bitPos = 8 / W2 - 1; bitPos >= 0; bitPos--) {
+          const bit = byte >>> W2 * bitPos & mask;
+          const { s0: e0, s1: e1, s2: e2, s3: e3 } = t[w * windowSize + bit];
+          o0 ^= e0, o1 ^= e1, o2 ^= e2, o3 ^= e3;
+          w += 1;
+        }
+      }
+    }
+    this.s0 = o0;
+    this.s1 = o1;
+    this.s2 = o2;
+    this.s3 = o3;
+  }
+  update(data) {
+    aexists2(this);
+    abytes3(data);
+    data = copyBytes2(data);
+    const b32 = u32(data);
+    const blocks = Math.floor(data.length / BLOCK_SIZE);
+    const left = data.length % BLOCK_SIZE;
+    for (let i = 0; i < blocks; i++) {
+      this._updateBlock(swap8IfBE(b32[i * 4 + 0]), swap8IfBE(b32[i * 4 + 1]), swap8IfBE(b32[i * 4 + 2]), swap8IfBE(b32[i * 4 + 3]));
+    }
+    if (left) {
+      ZEROS16.set(data.subarray(blocks * BLOCK_SIZE));
+      this._updateBlock(swap8IfBE(ZEROS32[0]), swap8IfBE(ZEROS32[1]), swap8IfBE(ZEROS32[2]), swap8IfBE(ZEROS32[3]));
+      clean2(ZEROS32);
+    }
+    return this;
+  }
+  destroy() {
+    this.destroyed = true;
+    const { t } = this;
+    for (const elm of t) {
+      elm.s0 = 0, elm.s1 = 0, elm.s2 = 0, elm.s3 = 0;
+    }
+  }
+  digestInto(out) {
+    aexists2(this);
+    aoutput2(out, this, true);
+    this.finished = true;
+    const { s0, s1, s2, s3 } = this;
+    const o32 = u32(out);
+    o32[0] = s0;
+    o32[1] = s1;
+    o32[2] = s2;
+    o32[3] = s3;
+    swap32IfBE(o32);
+  }
+  digest() {
+    const res = new Uint8Array(BLOCK_SIZE);
+    this.digestInto(res);
+    this.destroy();
+    return res;
+  }
+};
+var ghash2 = /* @__PURE__ */ wrapMacConstructor(16, (key3, expectedLength) => new GHASH2(key3, expectedLength), (msg) => [msg.length]);
+
+// node_modules/@noble/ciphers/aes.js
+var BLOCK_SIZE2 = 16;
+var BLOCK_SIZE32 = 4;
+var EMPTY_BLOCK = /* @__PURE__ */ new Uint8Array(BLOCK_SIZE2);
+var POLY2 = 283;
+function validateKeyLength(key3) {
+  if (![16, 24, 32].includes(key3.length))
+    throw new Error('"aes key" expected Uint8Array of length 16/24/32, got length=' + key3.length);
+}
+function mul23(n) {
+  return n << 1 ^ POLY2 & -(n >> 7);
+}
+function mul5(a, b) {
+  let res = 0;
+  for (; b > 0; b >>= 1) {
+    res ^= a & -(b & 1);
+    a = mul23(a);
+  }
+  return res;
+}
+var sbox = /* @__PURE__ */ (() => {
+  const t = new Uint8Array(256);
+  for (let i = 0, x = 1; i < 256; i++, x ^= mul23(x))
+    t[i] = x;
+  const box = new Uint8Array(256);
+  box[0] = 99;
+  for (let i = 0; i < 255; i++) {
+    let x = t[255 - i];
+    x |= x << 8;
+    box[t[i]] = (x ^ x >> 4 ^ x >> 5 ^ x >> 6 ^ x >> 7 ^ 99) & 255;
+  }
+  clean2(t);
+  return box;
+})();
+var rotr32_8 = (n) => n << 24 | n >>> 8;
+var rotl32_8 = (n) => n << 8 | n >>> 24;
+function genTtable(sbox2, fn) {
+  if (sbox2.length !== 256)
+    throw new Error("Wrong sbox length");
+  const T0 = new Uint32Array(256).map((_, j) => fn(sbox2[j]));
+  const T1 = T0.map(rotl32_8);
+  const T2 = T1.map(rotl32_8);
+  const T3 = T2.map(rotl32_8);
+  const T01 = new Uint32Array(256 * 256);
+  const T23 = new Uint32Array(256 * 256);
+  const sbox22 = new Uint16Array(256 * 256);
+  for (let i = 0; i < 256; i++) {
+    for (let j = 0; j < 256; j++) {
+      const idx = i * 256 + j;
+      T01[idx] = T0[i] ^ T1[j];
+      T23[idx] = T2[i] ^ T3[j];
+      sbox22[idx] = sbox2[i] << 8 | sbox2[j];
+    }
+  }
+  return { sbox: sbox2, sbox2: sbox22, T0, T1, T2, T3, T01, T23 };
+}
+var tableEncoding = /* @__PURE__ */ genTtable(sbox, (s2) => mul5(s2, 3) << 24 | s2 << 16 | s2 << 8 | mul5(s2, 2));
+var xPowers = /* @__PURE__ */ (() => {
+  const p = new Uint8Array(16);
+  for (let i = 0, x = 1; i < 16; i++, x = mul23(x))
+    p[i] = x;
+  return p;
+})();
+function expandKeyLE(key3) {
+  abytes3(key3);
+  const len = key3.length;
+  validateKeyLength(key3);
+  const { sbox2 } = tableEncoding;
+  const toClean = [];
+  if (!isLE || !isAligned32(key3))
+    toClean.push(key3 = copyBytes2(key3));
+  const k32 = swap32IfBE(u32(key3));
+  const Nk = k32.length;
+  const subByte = (n) => applySbox(sbox2, n, n, n, n);
+  const xk = new Uint32Array(len + 28);
+  xk.set(k32);
+  for (let i = Nk; i < xk.length; i++) {
+    let t = xk[i - 1];
+    if (i % Nk === 0)
+      t = subByte(rotr32_8(t)) ^ xPowers[i / Nk - 1];
+    else if (Nk > 6 && i % Nk === 4)
+      t = subByte(t);
+    xk[i] = xk[i - Nk] ^ t;
+  }
+  clean2(...toClean);
+  return xk;
+}
+function apply0123(T01, T23, s0, s1, s2, s3) {
+  return T01[s0 << 8 & 65280 | s1 >>> 8 & 255] ^ T23[s2 >>> 8 & 65280 | s3 >>> 24 & 255];
+}
+function applySbox(sbox2, s0, s1, s2, s3) {
+  return sbox2[s0 & 255 | s1 & 65280] | sbox2[s2 >>> 16 & 255 | s3 >>> 16 & 65280] << 16;
+}
+function encrypt(xk, s0, s1, s2, s3) {
+  const { sbox2, T01, T23 } = tableEncoding;
+  let k = 0;
+  s0 ^= xk[k++], s1 ^= xk[k++], s2 ^= xk[k++], s3 ^= xk[k++];
+  const rounds = xk.length / 4 - 2;
+  for (let i = 0; i < rounds; i++) {
+    const t02 = xk[k++] ^ apply0123(T01, T23, s0, s1, s2, s3);
+    const t12 = xk[k++] ^ apply0123(T01, T23, s1, s2, s3, s0);
+    const t22 = xk[k++] ^ apply0123(T01, T23, s2, s3, s0, s1);
+    const t32 = xk[k++] ^ apply0123(T01, T23, s3, s0, s1, s2);
+    s0 = t02, s1 = t12, s2 = t22, s3 = t32;
+  }
+  const t0 = xk[k++] ^ applySbox(sbox2, s0, s1, s2, s3);
+  const t1 = xk[k++] ^ applySbox(sbox2, s1, s2, s3, s0);
+  const t2 = xk[k++] ^ applySbox(sbox2, s2, s3, s0, s1);
+  const t3 = xk[k++] ^ applySbox(sbox2, s3, s0, s1, s2);
+  return { s0: t0, s1: t1, s2: t2, s3: t3 };
+}
+function ctr32(xk, isLE2, nonce, src, dst) {
+  abytes3(nonce, BLOCK_SIZE2, "nonce");
+  abytes3(src);
+  dst = getOutput(src.length, dst);
+  const ctr2 = nonce;
+  const c32 = u32(ctr2);
+  const view = createView2(ctr2);
+  const src32 = u32(src);
+  const dst32 = u32(dst);
+  const ctrPos = isLE2 ? 0 : 12;
+  const srcLen = src.length;
+  let ctrNum = view.getUint32(ctrPos, isLE2);
+  let { s0, s1, s2, s3 } = encrypt(xk, swap8IfBE(c32[0]), swap8IfBE(c32[1]), swap8IfBE(c32[2]), swap8IfBE(c32[3]));
+  for (let i = 0; i + 4 <= src32.length; i += 4) {
+    dst32[i + 0] = src32[i + 0] ^ swap8IfBE(s0);
+    dst32[i + 1] = src32[i + 1] ^ swap8IfBE(s1);
+    dst32[i + 2] = src32[i + 2] ^ swap8IfBE(s2);
+    dst32[i + 3] = src32[i + 3] ^ swap8IfBE(s3);
+    ctrNum = ctrNum + 1 >>> 0;
+    view.setUint32(ctrPos, ctrNum, isLE2);
+    ({ s0, s1, s2, s3 } = encrypt(xk, swap8IfBE(c32[0]), swap8IfBE(c32[1]), swap8IfBE(c32[2]), swap8IfBE(c32[3])));
+  }
+  const start = BLOCK_SIZE2 * Math.floor(src32.length / BLOCK_SIZE32);
+  if (start < srcLen) {
+    const b32 = new Uint32Array([s0, s1, s2, s3]);
+    swap32IfBE(b32);
+    const buf = u8(b32);
+    for (let i = start, pos = 0; i < srcLen; i++, pos++)
+      dst[i] = src[i] ^ buf[pos];
+    clean2(b32);
+  }
+  return dst;
+}
+function computeTag(fn, isLE2, key3, data, AAD) {
+  const aadLength = AAD ? AAD.length : 0;
+  const h = fn.create(key3, data.length + aadLength);
+  if (AAD)
+    h.update(AAD);
+  const num = u64Lengths(8 * data.length, 8 * aadLength, isLE2);
+  h.update(data);
+  h.update(num);
+  const res = h.digest();
+  clean2(num);
+  return res;
+}
+var gcm = /* @__PURE__ */ wrapCipher({ blockSize: 16, nonceLength: 12, tagLength: 16, varSizeNonce: true }, function aesgcm(key3, nonce, AAD) {
+  if (nonce.length < 8)
+    throw new Error("aes/gcm: invalid nonce length");
+  const tagLength = 16;
+  function _computeTag(authKey, tagMask, data) {
+    const tag = computeTag(ghash2, false, authKey, data, AAD);
+    for (let i = 0; i < tagMask.length; i++)
+      tag[i] ^= tagMask[i];
+    return tag;
+  }
+  function deriveKeys2() {
+    const xk = expandKeyLE(key3);
+    const authKey = EMPTY_BLOCK.slice();
+    const counter = EMPTY_BLOCK.slice();
+    ctr32(xk, false, counter, counter, authKey);
+    if (nonce.length === 12) {
+      counter.set(nonce);
+    } else {
+      const nonceLen = EMPTY_BLOCK.slice();
+      const view = createView2(nonceLen);
+      view.setBigUint64(8, BigInt(nonce.length * 8), false);
+      const g = ghash2.create(authKey).update(nonce).update(nonceLen);
+      g.digestInto(counter);
+      g.destroy();
+    }
+    const tagMask = ctr32(xk, false, counter, EMPTY_BLOCK);
+    return { xk, authKey, counter, tagMask };
+  }
+  return {
+    encrypt(plaintext) {
+      const { xk, authKey, counter, tagMask } = deriveKeys2();
+      const out = new Uint8Array(plaintext.length + tagLength);
+      const toClean = [xk, authKey, counter, tagMask];
+      if (!isAligned32(plaintext))
+        toClean.push(plaintext = copyBytes2(plaintext));
+      ctr32(xk, false, counter, plaintext, out.subarray(0, plaintext.length));
+      const tag = _computeTag(authKey, tagMask, out.subarray(0, out.length - tagLength));
+      toClean.push(tag);
+      out.set(tag, plaintext.length);
+      clean2(...toClean);
+      return out;
+    },
+    decrypt(ciphertext) {
+      const { xk, authKey, counter, tagMask } = deriveKeys2();
+      const toClean = [xk, authKey, tagMask, counter];
+      if (!isAligned32(ciphertext))
+        toClean.push(ciphertext = copyBytes2(ciphertext));
+      const data = ciphertext.subarray(0, -tagLength);
+      const passedTag = ciphertext.subarray(-tagLength);
+      const tag = _computeTag(authKey, tagMask, data);
+      toClean.push(tag);
+      if (!equalBytes(tag, passedTag)) {
+        clean2(...toClean);
+        throw new Error("aes/gcm: invalid ghash tag");
+      }
+      const out = ctr32(xk, false, counter, data);
+      clean2(...toClean);
+      return out;
+    }
+  };
+});
+
+// src-ts/crypto/ecies.ts
+var FORMAT_VERSION = 1;
+var EPH_PUBKEY_LEN = 33;
+var NONCE_LEN = 12;
+var GCM_TAG_LEN = 16;
+var HEADER_LEN = 1 + EPH_PUBKEY_LEN + NONCE_LEN;
+var EciesDomain = {
+  toolCall: "atbash:chain-encryption:v1:toolcall",
+  verdict: "atbash:chain-encryption:v1:verdict",
+  note: "atbash:chain-encryption:v1:note",
+  policy: "atbash:chain-encryption:v1:policy",
+  raw: "atbash:chain-encryption:v1:raw"
+};
+function deriveKey(sharedPoint, ephPubKey, domain) {
+  const sharedX = sharedPoint.slice(1);
+  return hkdf(sha256, sharedX, ephPubKey, new TextEncoder().encode(domain), 32);
+}
+function normalizeHex(hex) {
+  return hex.trim().replace(/^0x/i, "").toLowerCase();
+}
+function encryptForOrg(plaintext, orgPubKeyHex, aad, domain = EciesDomain.raw) {
+  const orgPubKey = hexToBytes2(normalizeHex(orgPubKeyHex));
+  if (orgPubKey.length !== EPH_PUBKEY_LEN) {
+    throw new Error(
+      `Invalid org public key: expected ${EPH_PUBKEY_LEN} bytes (compressed secp256k1), got ${orgPubKey.length}`
+    );
+  }
+  const ephPrivKey = secp256k1.utils.randomSecretKey();
+  const ephPubKey = secp256k1.getPublicKey(ephPrivKey, true);
+  const key3 = deriveKey(secp256k1.getSharedSecret(ephPrivKey, orgPubKey, true), ephPubKey, domain);
+  const nonce = new Uint8Array(NONCE_LEN);
+  crypto.getRandomValues(nonce);
+  const aadBytes = new TextEncoder().encode(`${domain}|${aad}`);
+  const sealed = gcm(key3, nonce, aadBytes).encrypt(
+    new TextEncoder().encode(plaintext)
+  );
+  const payload = new Uint8Array(HEADER_LEN + sealed.length);
+  payload[0] = FORMAT_VERSION;
+  payload.set(ephPubKey, 1);
+  payload.set(nonce, 1 + EPH_PUBKEY_LEN);
+  payload.set(sealed, HEADER_LEN);
+  return payload;
+}
+function decryptForOrg(payload, orgPrivKeyHex, aad, domain = EciesDomain.raw) {
+  if (payload.length < HEADER_LEN + GCM_TAG_LEN) {
+    throw new Error("Malformed encrypted payload: too short");
+  }
+  const version2 = payload[0];
+  if (version2 !== FORMAT_VERSION) {
+    throw new Error(
+      `Unsupported encrypted payload version: ${version2} (expected ${FORMAT_VERSION})`
+    );
+  }
+  const ephPubKey = payload.subarray(1, 1 + EPH_PUBKEY_LEN);
+  const nonce = payload.subarray(1 + EPH_PUBKEY_LEN, HEADER_LEN);
+  const sealed = payload.subarray(HEADER_LEN);
+  const orgPrivKey = hexToBytes2(normalizeHex(orgPrivKeyHex));
+  const key3 = deriveKey(secp256k1.getSharedSecret(orgPrivKey, ephPubKey, true), ephPubKey, domain);
+  const aadBytes = new TextEncoder().encode(`${domain}|${aad}`);
+  const opened = gcm(key3, nonce, aadBytes).decrypt(sealed);
+  return new TextDecoder().decode(opened);
+}
+function encryptedLength(plaintextByteLength) {
+  return HEADER_LEN + plaintextByteLength + GCM_TAG_LEN;
+}
+
+// src-ts/encrypted-toolcall.ts
+var { Buffer: PolyBuffer, gtx: pcgtx2 } = index;
+var MERKLE_HASH_VERSION2 = 2;
+function claimHashHex(toolName, action, context, toolArgsJson) {
+  const canonical = JSON.stringify([
+    toolName.trim(),
+    normalizeActionForHash(action),
+    context.trim(),
+    toolArgsJson.trim()
+  ]);
+  return bytesToHex2(sha256(new TextEncoder().encode(canonical)));
+}
+function normalizeActionForHash(action) {
+  action = action.trim();
+  try {
+    const parsed = JSON.parse(action);
+    if (parsed && typeof parsed === "object" && "args" in parsed) {
+      const obj2 = parsed;
+      const dynamicKeys = [
+        "session_id",
+        "task_id",
+        "tool_call_id",
+        "turn_id",
+        "api_request_id"
+      ];
+      if (dynamicKeys.some((k) => k in obj2)) {
+        return JSON.stringify({ tool_name: obj2.tool_name, args: obj2.args });
+      }
+    }
+  } catch {
+  }
+  return action;
+}
+function signOpWithBytes(opName, args, privkeyHex, blockchainRidHex) {
+  const priv2 = hexToBytes2(privkeyHex.trim().replace(/^0x/i, "").toLowerCase());
+  if (priv2.length !== 32) {
+    throw new Error("invalid private key");
+  }
+  const ridBytes = hexToBytes2(
+    blockchainRidHex.trim().replace(/^0x/i, "").toLowerCase()
+  );
+  if (ridBytes.length !== 32) {
+    throw new Error("invalid blockchain rid \u2014 must be 32 bytes hex");
+  }
+  const pub2 = secp256k1.getPublicKey(priv2, true);
+  const encodedArgs = args.map(
+    (a) => typeof a === "string" ? a : PolyBuffer.from(a)
+  );
+  let g = pcgtx2.emptyGtx(PolyBuffer.from(ridBytes));
+  g = pcgtx2.addTransactionToGtx(opName, encodedArgs, g);
+  pcgtx2.addSignerToGtx(PolyBuffer.from(pub2), g);
+  const digest9 = pcgtx2.getDigestToSign(g, MERKLE_HASH_VERSION2);
+  const signature2 = secp256k1.sign(digest9, priv2, { prehash: false });
+  g = pcgtx2.addSignature(PolyBuffer.from(pub2), PolyBuffer.from(signature2), g);
+  return pcgtx2.serialize(g).toString("hex");
+}
+function signEncryptedToolCall(toolCallId, action, context, toolName, toolArgsJson, orgEncryptionPubKey, privkeyHex, blockchainRidHex) {
+  const plaintext = {
+    tool_name: toolName,
+    action,
+    context,
+    tool_args_json: toolArgsJson
+  };
+  const contentCipher = encryptForOrg(
+    JSON.stringify(plaintext),
+    orgEncryptionPubKey,
+    toolCallId,
+    EciesDomain.toolCall
+  );
+  const actionHash = bytesToHex2(
+    sha256(new TextEncoder().encode(normalizeActionForHash(action)))
+  );
+  return signOpWithBytes(
+    "log_encrypted_tool_call",
+    [
+      toolCallId,
+      toolName,
+      contentCipher,
+      actionHash,
+      // Empty = "the org's current key"; the chain resolves it.
+      PolyBuffer.from(new Uint8Array(0)),
+      claimHashHex(toolName, action, context, toolArgsJson)
+    ],
+    privkeyHex,
+    blockchainRidHex
+  );
+}
+
 // src-ts/endpoint.ts
 var ALLOWED_JUDGE_HOSTS = /* @__PURE__ */ new Set([
   "atbash.ai",
@@ -43643,6 +44349,8 @@ var Atbash = class _Atbash {
   orgName;
   /** Default judge response-signing pubkey, if configured (see fromConfig). */
   verifyPubKey;
+  /** Default org encryption key — see {@link AtbashOptions.orgEncryptionPubKey}. */
+  orgEncryptionPubKey;
   /** When true (default), `auditToolCall` denies on any error. */
   failClosed;
   logger;
@@ -43665,6 +44373,7 @@ var Atbash = class _Atbash {
     this.blockchainRid = options.blockchainRid ?? native.DEFAULT_BLOCKCHAIN_RID;
     this.orgName = options.orgName;
     this.verifyPubKey = options.verifyPubKey;
+    this.orgEncryptionPubKey = options.orgEncryptionPubKey;
     this.failClosed = options.failClosed !== false;
     this.logger = options.logger ?? {};
     this.http = new HttpClient(this.endpoint, options.timeoutMs ?? 3e4);
@@ -43758,8 +44467,18 @@ var Atbash = class _Atbash {
     }
     const toolCallId = generateToolCallId();
     const brid = this.bridFromChainOpts(options.chainOpts);
+    const orgKey = options.orgEncryptionPubKey ?? this.orgEncryptionPubKey;
     try {
-      const signedHex = native.signLogToolCall(
+      const signedHex = orgKey ? signEncryptedToolCall(
+        toolCallId,
+        action,
+        context,
+        options.toolName ?? "",
+        options.toolArgsJson ?? "",
+        orgKey,
+        this.auth.privkey,
+        brid
+      ) : native.signLogToolCall(
         toolCallId,
         action,
         context,
@@ -44519,24 +45238,24 @@ function verifyJudgeResponseSignature(bodyBytes, signatureHex, pubKeyHex) {
 var { Buffer: Buffer4 } = index;
 var HKDF_INFO = new TextEncoder().encode("atbash:memory-encryption");
 var KEY_LEN = 32;
-var NONCE_LEN = 12;
+var NONCE_LEN2 = 12;
 function stripHex2(s2) {
   return s2.trim().replace(/^0x/i, "").toLowerCase();
 }
 function hexToU8(hex) {
-  const clean2 = stripHex2(hex);
-  if (!/^[0-9a-f]+$/.test(clean2) || clean2.length % 2 !== 0) {
+  const clean3 = stripHex2(hex);
+  if (!/^[0-9a-f]+$/.test(clean3) || clean3.length % 2 !== 0) {
     throw new Error("invalid hex");
   }
-  const out = new Uint8Array(clean2.length / 2);
+  const out = new Uint8Array(clean3.length / 2);
   for (let i = 0; i < out.length; i++) {
-    out[i] = parseInt(clean2.slice(i * 2, i * 2 + 2), 16);
+    out[i] = parseInt(clean3.slice(i * 2, i * 2 + 2), 16);
   }
   return out;
 }
-function toArrayBuffer(u8) {
-  const ab = new ArrayBuffer(u8.byteLength);
-  new Uint8Array(ab).set(u8);
+function toArrayBuffer(u82) {
+  const ab = new ArrayBuffer(u82.byteLength);
+  new Uint8Array(ab).set(u82);
   return ab;
 }
 async function deriveRawKeyBytes(privkeyHex) {
@@ -44563,7 +45282,7 @@ async function encryptMemoryContent2(plaintext, key3) {
   if (key3.byteLength !== KEY_LEN) {
     throw new Error(`encryptMemoryContent: key must be ${KEY_LEN} bytes`);
   }
-  const nonce = new Uint8Array(NONCE_LEN);
+  const nonce = new Uint8Array(NONCE_LEN2);
   crypto.getRandomValues(nonce);
   const aesKey = await importAesKey(new Uint8Array(key3));
   const cipherBuf = await crypto.subtle.encrypt(
@@ -44577,8 +45296,8 @@ async function decryptMemoryContent2(ciphertext, nonce, key3) {
   if (key3.byteLength !== KEY_LEN) {
     throw new Error(`decryptMemoryContent: key must be ${KEY_LEN} bytes`);
   }
-  if (nonce.byteLength !== NONCE_LEN) {
-    throw new Error(`decryptMemoryContent: nonce must be ${NONCE_LEN} bytes`);
+  if (nonce.byteLength !== NONCE_LEN2) {
+    throw new Error(`decryptMemoryContent: nonce must be ${NONCE_LEN2} bytes`);
   }
   const aesKey = await importAesKey(new Uint8Array(key3));
   const plainBuf = await crypto.subtle.decrypt(
@@ -44716,9 +45435,9 @@ async function scanMemoryBatch(entries, auth, opts) {
 }
 
 // src-ts/memory/chain.ts
-var { createClient, encryption: encryption2, newSignatureProvider: newSignatureProvider2, Buffer: PolyBuffer } = index;
+var { createClient, encryption: encryption2, newSignatureProvider: newSignatureProvider2, Buffer: PolyBuffer2 } = index;
 function toGtxBytes(bytes) {
-  return PolyBuffer.from(new Uint8Array(bytes));
+  return PolyBuffer2.from(new Uint8Array(bytes));
 }
 async function resolveChainOptsForOrg(opts, auth) {
   if (opts?.orgName && !opts.chainOpts?.blockchainRid && auth) {
@@ -45277,10 +45996,12 @@ export {
   DEFAULT_MEMORY_PATH_PATTERNS,
   DEFAULT_MEMORY_READ_TOOL_NAMES,
   DEFAULT_MEMORY_WRITE_TOOL_NAMES,
+  EciesDomain,
   MemoryGuardManager,
   MemoryIntegrityError,
   PointerStore,
   SignatureVerificationError,
+  claimHashHex,
   classifyMemoryRead,
   classifyMemoryWrite,
   commitMemoryVersion,
@@ -45289,13 +46010,16 @@ export {
   createFileLogger,
   createMemoryGuardManager,
   createMemorySnapshot2 as createMemorySnapshot,
+  decryptForOrg,
   decryptMemoryContent2 as decryptMemoryContent,
   defaultPluginLogPath,
   defaultPointerPath,
   deriveMemoryKey2 as deriveMemoryKey,
   derivePublicKey2 as derivePublicKey,
   diffMemorySnapshots2 as diffMemorySnapshots,
+  encryptForOrg,
   encryptMemoryContent2 as encryptMemoryContent,
+  encryptedLength,
   flushTelemetry,
   generateKeypair2 as generateKeypair,
   getActiveMemory,
@@ -45311,6 +46035,7 @@ export {
   loadAgent2 as loadAgent,
   loadAgentFromFile,
   loadUserConfig,
+  normalizeActionForHash,
   normalizeForMatching2 as normalizeForMatching,
   normalizeStatus,
   normalizeVerdict,
@@ -45327,6 +46052,7 @@ export {
   scanMemoryBatch,
   setupTelemetry,
   shutdownTelemetry,
+  signEncryptedToolCall,
   signJudgeAction2 as signJudgeAction,
   signLogToolCall2 as signLogToolCall,
   syncLocalMemory,
@@ -45352,5 +46078,8 @@ postchain-client/built/esm/index.js:
    * @license  MIT
    *)
   (*! safe-buffer. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> *)
+
+@noble/ciphers/utils.js:
+  (*! noble-ciphers - MIT License (c) 2023 Paul Miller (paulmillr.com) *)
 */
 //# sourceMappingURL=browser.mjs.map