@cardanowall/sdk-ts 0.2.0 → 0.4.0

package/dist/client/index.js

@@ -3,21 +3,21 @@ import { sortCoreDeterministic } from 'cbor2/sorts';
 import { blake2b } from '@noble/hashes/blake2.js';
 import * as ed from '@noble/ed25519';
 import { sha512, sha256 as sha256$1 } from '@noble/hashes/sha2.js';
-import 'hash-wasm';
+import { createSHA256 } from 'hash-wasm';
 import { z } from 'zod';
 import { randomBytes as randomBytes$1 } from '@noble/ciphers/utils.js';
-import { hmac } from '@noble/hashes/hmac.js';
-import { xchacha20poly1305, chacha20poly1305 } from '@noble/ciphers/chacha.js';
-import { hkdf } from '@noble/hashes/hkdf.js';
+import { chacha20poly1305 } from '@noble/ciphers/chacha.js';
 import '@noble/curves/abstract/edwards.js';
 import '@noble/curves/abstract/montgomery.js';
 import '@noble/curves/abstract/weierstrass.js';
 import { x25519 } from '@noble/curves/ed25519.js';
 import '@noble/curves/nist.js';
 import { concatBytes, asciiToBytes, bytesToNumberLE, bytesToNumberBE } from '@noble/curves/utils.js';
+import { hkdf } from '@noble/hashes/hkdf.js';
 import { sha3_256, shake256, sha3_512, shake128 } from '@noble/hashes/sha3.js';
 import { anumber, abytes, randomBytes as randomBytes$2, u32, swap32IfBE } from '@noble/hashes/utils.js';
 import { FFTCore, reverseBits } from '@noble/curves/abstract/fft.js';
+import { hmac } from '@noble/hashes/hmac.js';
 
 // ../crypto-core/dist/cbor.js
 function encodeCanonicalCbor(value) {
@@ -81,6 +81,14 @@ function encodeCoseSign1(args) {
 function sha256(input) {
   return sha256$1(input);
 }
+async function sha256Stream(source) {
+  const hasher = await createSHA256();
+  hasher.init();
+  for await (const chunk of source) {
+    hasher.update(chunk);
+  }
+  return hasher.digest("binary");
+}
 function blake2b256(input) {
   return blake2b(input, { dkLen: 32 });
 }
@@ -136,1538 +144,2082 @@ function mthRecursive(leaves, start, end) {
   const right = mthRecursive(leaves, start + k, end);
   return hashNode(left, right);
 }
-var ChunkedBytesArraySchema = z.array(
-  z.instanceof(Uint8Array).refine((b) => b.length >= 1 && b.length <= 64, {
-    params: { code: "CHUNK_TOO_LARGE" }
-  })
-).min(1);
-var UTF8_ENCODER = new TextEncoder();
-var UriChunkArraySchema = z.array(
-  z.string().refine(
-    (s) => {
-      const n = UTF8_ENCODER.encode(s).length;
-      return n >= 1 && n <= 64;
-    },
-    { params: { code: "CHUNK_TOO_LARGE" } }
-  )
-).min(1);
+function textKeyedMap(inner) {
+  return z.custom((value) => !(value instanceof Uint8Array), {
+    message: "CBOR byte string present where a text-keyed map is required"
+  }).pipe(inner);
+}
 var HashDigestSchema = z.instanceof(Uint8Array);
 var HashesMapSchema = z.record(z.string(), HashDigestSchema);
-var MerkleCommitSchema = z.object({
-  alg: z.string(),
-  root: z.instanceof(Uint8Array),
-  leaf_count: z.number().int().min(1),
-  uris: z.array(UriChunkArraySchema).min(1).optional()
-}).strict();
-var SlotSchema = z.object({
-  epk: z.instanceof(Uint8Array).optional(),
-  kem_ct: ChunkedBytesArraySchema.optional(),
-  wrap: z.instanceof(Uint8Array).optional()
-});
-z.object({
-  m: z.number().int(),
-  t: z.number().int(),
-  p: z.number().int()
-}).strict();
-var PassphraseBlockSchema = z.object({
-  alg: z.string(),
-  salt: z.instanceof(Uint8Array).superRefine((bytes, ctx) => {
-    if (bytes.length < 16) {
-      ctx.addIssue({
-        code: "custom",
-        path: [],
-        message: `passphrase.salt length ${bytes.length} < 16`,
-        params: { code: "ENC_PASSPHRASE_SALT_TOO_SHORT" }
-      });
-    } else if (bytes.length > 64) {
-      ctx.addIssue({
-        code: "custom",
-        path: [],
-        message: `passphrase.salt length ${bytes.length} > 64`,
-        params: { code: "ENC_PASSPHRASE_SALT_TOO_LONG" }
-      });
-    }
-  }),
-  params: z.record(z.string(), z.unknown())
-}).strict();
-z.object({
-  scheme: z.unknown(),
-  aead: z.string(),
-  kem: z.string().optional(),
-  nonce: z.instanceof(Uint8Array),
-  slots: z.array(SlotSchema).optional(),
-  slots_mac: z.instanceof(Uint8Array).refine((b) => b.length === 32, {
-    params: { code: "ENC_SLOTS_MAC_INVALID_LENGTH" }
-  }).optional(),
-  passphrase: PassphraseBlockSchema.optional()
-}).strict();
-var ItemEntrySchema = z.object({
-  hashes: HashesMapSchema,
-  uris: z.array(UriChunkArraySchema).min(1).optional(),
-  // Captured as `unknown` so the validator can run the
-  // `ENC_REQUIRES_CONTENT_HASH` pre-check ahead of any inner-shape errors
-  // and surface the most informative code first.
-  enc: z.unknown().optional()
-}).strict();
-var SigEntrySchema = z.object({
-  cose_key: ChunkedBytesArraySchema.optional(),
-  cose_sign1: ChunkedBytesArraySchema
-}).strict();
+var UriSchema = z.string();
+var MerkleCommitSchema = textKeyedMap(
+  z.object({
+    alg: z.string(),
+    root: z.instanceof(Uint8Array),
+    leaf_count: z.union([z.number().int(), z.bigint()]),
+    uris: z.array(UriSchema).optional()
+  }).strict()
+);
+var SlotSchema = textKeyedMap(
+  z.object({
+    epk: z.instanceof(Uint8Array).optional(),
+    kem_ct: z.instanceof(Uint8Array).optional(),
+    wrap: z.instanceof(Uint8Array).optional()
+  })
+);
+textKeyedMap(
+  z.object({
+    m: z.union([z.number().int(), z.bigint()]),
+    t: z.union([z.number().int(), z.bigint()]),
+    p: z.union([z.number().int(), z.bigint()])
+  }).strict()
+);
+var PassphraseBlockSchema = textKeyedMap(
+  z.object({
+    alg: z.string(),
+    salt: z.instanceof(Uint8Array).superRefine((bytes, ctx) => {
+      if (bytes.length < 16) {
+        ctx.addIssue({
+          code: "custom",
+          path: [],
+          message: `passphrase.salt length ${bytes.length} < 16`,
+          params: { code: "ENC_PASSPHRASE_SALT_TOO_SHORT" }
+        });
+      } else if (bytes.length > 64) {
+        ctx.addIssue({
+          code: "custom",
+          path: [],
+          message: `passphrase.salt length ${bytes.length} > 64`,
+          params: { code: "ENC_PASSPHRASE_SALT_TOO_LONG" }
+        });
+      }
+    }),
+    params: z.record(z.string(), z.unknown())
+  }).strict()
+);
+var EncScheme1Schema = textKeyedMap(
+  z.object({
+    scheme: z.literal(1),
+    aead: z.string(),
+    kem: z.string().optional(),
+    nonce: z.instanceof(Uint8Array),
+    slots: z.array(SlotSchema).optional(),
+    slots_mac: z.instanceof(Uint8Array).refine((b) => b.length === 32, {
+      params: { code: "ENC_SLOTS_MAC_INVALID_LENGTH" }
+    }).optional(),
+    passphrase: PassphraseBlockSchema.optional()
+  }).strict()
+);
+var EncOpaqueSchema = textKeyedMap(
+  z.looseObject({
+    scheme: z.union([z.number().int().nonnegative(), z.bigint().nonnegative()])
+  })
+);
+z.union([EncScheme1Schema, EncOpaqueSchema]);
+var ItemEntrySchema = textKeyedMap(
+  z.object({
+    hashes: HashesMapSchema,
+    uris: z.array(UriSchema).optional(),
+    // Captured as `unknown`: the envelope is a union whose disposition
+    // (typed scheme-1 vs opaque) depends on identifier support, so the
+    // validator's domain pass — not this schema — narrows it.
+    enc: z.unknown().optional()
+  }).strict()
+);
+var SigEntrySchema = textKeyedMap(
+  z.object({
+    cose_key: z.instanceof(Uint8Array).optional(),
+    cose_sign1: z.instanceof(Uint8Array)
+  }).strict()
+);
 var SupersedesSchema = z.instanceof(Uint8Array).refine((b) => b.length === 32, {
   params: { code: "SUPERSEDES_TX_INVALID_LENGTH" }
 });
 var VersionLiteralSchema = z.literal(1);
-z.looseObject({
-  v: VersionLiteralSchema,
-  items: z.array(ItemEntrySchema).optional(),
-  merkle: z.array(MerkleCommitSchema).optional(),
-  supersedes: SupersedesSchema.optional(),
-  sigs: z.array(SigEntrySchema).optional(),
-  crit: z.array(z.string()).optional()
-});
+textKeyedMap(
+  z.looseObject({
+    v: VersionLiteralSchema,
+    items: z.array(ItemEntrySchema).optional(),
+    merkle: z.array(MerkleCommitSchema).optional(),
+    supersedes: SupersedesSchema.optional(),
+    sigs: z.array(SigEntrySchema).optional(),
+    crit: z.array(z.string()).optional()
+  })
+);
 
 // ../poe-standard/src/encoder.ts
 function encodePoeRecord(record) {
-  return encodeCanonicalCbor(recordToCbor(record));
-}
-function encodeRecordBodyForSigning(record) {
-  const body = recordToCborInternal(
+  return encodeCanonicalCbor(toCborValue(
     record,
     /* includeSigs */
-    false
-  );
-  return encodeCanonicalCbor(body);
+    true
+  ));
 }
-function recordToCbor(record) {
-  return recordToCborInternal(
+function encodeRecordBodyForSigning(record) {
+  return encodeCanonicalCbor(toCborValue(
     record,
     /* includeSigs */
-    true
-  );
+    false
+  ));
 }
-function recordToCborInternal(record, includeSigs) {
-  const out = { v: record.v };
-  if (record.items !== void 0) out["items"] = record.items.map(itemToCbor);
-  if (record.merkle !== void 0) out["merkle"] = record.merkle.map(merkleToCbor);
-  if (record.supersedes !== void 0) out["supersedes"] = record.supersedes;
-  if (includeSigs && record.sigs !== void 0) out["sigs"] = record.sigs.map(sigEntryToCbor);
-  if (record.crit !== void 0) out["crit"] = record.crit.slice();
-  for (const [k, v] of Object.entries(record)) {
-    if (k === "v" || k === "items" || k === "merkle" || k === "supersedes" || k === "sigs" || k === "crit") {
-      continue;
-    }
-    out[k] = v;
+function toCborValue(record, includeSigs) {
+  const out = {};
+  for (const [key, value] of Object.entries(record)) {
+    if (value === void 0) continue;
+    if (!includeSigs && key === "sigs") continue;
+    out[key] = stripUndefined(value);
   }
   return out;
 }
-function itemToCbor(item) {
-  const out = { hashes: hashesToCbor(item.hashes) };
-  if (item.uris !== void 0) {
-    out["uris"] = item.uris.map((chunks) => chunks.slice());
+function stripUndefined(value) {
+  if (value === null || typeof value !== "object" || value instanceof Uint8Array) {
+    return value;
   }
-  if (item.enc !== void 0) {
-    out["enc"] = envelopeToCbor(item.enc);
+  if (Array.isArray(value)) {
+    return value.map((element) => stripUndefined(element));
+  }
+  if (value instanceof Map) {
+    const out2 = /* @__PURE__ */ new Map();
+    for (const [k, v] of value) {
+      if (v === void 0) continue;
+      out2.set(k, stripUndefined(v));
+    }
+    return out2;
   }
-  return out;
-}
-function hashesToCbor(hashes2) {
   const out = {};
-  for (const [alg, digest] of Object.entries(hashes2)) {
-    out[alg] = digest;
+  for (const [k, v] of Object.entries(value)) {
+    if (v === void 0) continue;
+    out[k] = stripUndefined(v);
   }
   return out;
 }
-function merkleToCbor(commit) {
-  const out = {
-    alg: commit.alg,
-    root: commit.root,
-    leaf_count: commit.leaf_count
-  };
-  if (commit.uris !== void 0) {
-    out["uris"] = commit.uris.map((chunks) => chunks.slice());
-  }
-  return out;
+
+// ../poe-standard/src/error-codes.ts
+var ERROR_CODES = [
+  "MALFORMED_CBOR",
+  "SCHEMA_TYPE_MISMATCH",
+  "SCHEMA_MISSING_REQUIRED",
+  "SCHEMA_UNKNOWN_FIELD",
+  "SCHEMA_INVALID_LITERAL",
+  "SCHEMA_EMPTY_RECORD",
+  "HASH_DIGEST_LENGTH_MISMATCH",
+  "UNSUPPORTED_HASH_ALG",
+  "UNSUPPORTED_MERKLE_COMMIT_ALG",
+  "SCHEMA_MERKLE_LEAF_COUNT_INVALID",
+  "INVALID_URI",
+  "CHUNK_TOO_LARGE",
+  "UNAUTHENTICATED_CIPHER_FORBIDDEN",
+  "UNSUPPORTED_AEAD_ALG",
+  "NONCE_LENGTH_MISMATCH",
+  "UNSUPPORTED_ENVELOPE_SCHEME",
+  "ENC_UNSUPPORTED",
+  "ENC_SLOTS_EMPTY",
+  "ENC_SLOT_INVALID_SHAPE",
+  "UNSUPPORTED_KEM_ALG",
+  "ENC_KEM_REQUIRED",
+  "KEM_EPK_LENGTH_MISMATCH",
+  "KEM_CT_LENGTH_MISMATCH",
+  "WRAP_LENGTH_MISMATCH",
+  "ENC_SLOTS_MAC_INVALID_LENGTH",
+  "ENC_SLOTS_MAC_REQUIRED",
+  "ENC_SLOTS_REQUIRED",
+  "ENC_SLOTS_DUPLICATE_KEM_MATERIAL",
+  "ENC_SLOTS_TOO_MANY",
+  "ENC_ENVELOPE_TOO_LARGE",
+  "ENC_EXCLUSIVITY_VIOLATION",
+  "ENC_NO_KEY_PATH",
+  "ENC_REQUIRES_CONTENT_HASH",
+  "ENC_PASSPHRASE_ALG_UNSUPPORTED",
+  "ENC_PASSPHRASE_SALT_TOO_SHORT",
+  "ENC_PASSPHRASE_SALT_TOO_LONG",
+  "ENC_PASSPHRASE_ARGON2_PARAMS_TOO_LOW",
+  "ENC_PASSPHRASE_PARAMS_EXCEED_POLICY",
+  "MALFORMED_SIG_COSE_SIGN1",
+  "SIGNATURE_UNSUPPORTED",
+  "SIG_ENTRY_INVALID_SHAPE",
+  "SIG_ENTRY_KID_COSE_KEY_CONFLICT",
+  "SIG_PRIVATE_KEY_LEAKED",
+  "SUPERSEDES_TX_INVALID_LENGTH",
+  "EXTENSION_UNSUPPORTED_CRITICAL",
+  "CRIT_SHAPE_INVALID",
+  "TX_NOT_FOUND",
+  "PROVIDER_UNAVAILABLE",
+  "TX_INTEGRITY_MISMATCH",
+  "METADATA_NOT_FOUND",
+  "INSUFFICIENT_CONFIRMATIONS",
+  "SIGNATURE_INVALID",
+  "SIGNER_KEY_UNRESOLVED",
+  "WALLET_ADDRESS_MISMATCH",
+  "URI_TARGET_FORBIDDEN",
+  "URI_INTEGRITY_MISMATCH",
+  "URI_PROVIDER_INTEGRITY_MISMATCH",
+  "URI_FETCH_FAILED",
+  "CONTENT_UNAVAILABLE",
+  "CONTENT_FETCH_LIMIT_EXCEEDED",
+  "CIPHERTEXT_UNAVAILABLE",
+  "SERVICE_INDEPENDENCE_VIOLATION",
+  "WRONG_DECRYPTION_INPUT_SHAPE",
+  "WRONG_RECIPIENT_KEY",
+  "TAMPERED_HEADER",
+  "TAMPERED_CIPHERTEXT",
+  "KDF_DERIVATION_FAILED",
+  "ENC_PASSPHRASE_UNNORMALIZABLE",
+  "ENC_PASSPHRASE_EMPTY",
+  "SCHEMA_MERKLE_LEAF_COUNT_MISMATCH",
+  "SCHEMA_MERKLE_LEAVES_FORMAT_UNSUPPORTED",
+  "SCHEMA_MERKLE_LEAVES_MALFORMED",
+  "MERKLE_ROOT_MISMATCH",
+  "MERKLE_LEAVES_UNAVAILABLE",
+  "MERKLE_UNSUPPORTED",
+  "OUT_OF_PROFILE_SKIPPED"
+];
+var ERROR_CODE_PART = Object.freeze({
+  MALFORMED_CBOR: "A",
+  SCHEMA_TYPE_MISMATCH: "A",
+  SCHEMA_MISSING_REQUIRED: "A",
+  SCHEMA_UNKNOWN_FIELD: "A",
+  SCHEMA_INVALID_LITERAL: "A",
+  SCHEMA_EMPTY_RECORD: "A",
+  HASH_DIGEST_LENGTH_MISMATCH: "A",
+  UNSUPPORTED_HASH_ALG: "A",
+  UNSUPPORTED_MERKLE_COMMIT_ALG: "A",
+  SCHEMA_MERKLE_LEAF_COUNT_INVALID: "A",
+  INVALID_URI: "A",
+  CHUNK_TOO_LARGE: "carriage",
+  UNAUTHENTICATED_CIPHER_FORBIDDEN: "A",
+  UNSUPPORTED_AEAD_ALG: "A",
+  NONCE_LENGTH_MISMATCH: "A",
+  UNSUPPORTED_ENVELOPE_SCHEME: "A",
+  ENC_UNSUPPORTED: "A",
+  ENC_SLOTS_EMPTY: "A",
+  ENC_SLOT_INVALID_SHAPE: "A",
+  UNSUPPORTED_KEM_ALG: "A",
+  ENC_KEM_REQUIRED: "A",
+  KEM_EPK_LENGTH_MISMATCH: "A",
+  KEM_CT_LENGTH_MISMATCH: "A",
+  WRAP_LENGTH_MISMATCH: "A",
+  ENC_SLOTS_MAC_INVALID_LENGTH: "A",
+  ENC_SLOTS_MAC_REQUIRED: "A",
+  ENC_SLOTS_REQUIRED: "A",
+  ENC_SLOTS_DUPLICATE_KEM_MATERIAL: "A",
+  ENC_SLOTS_TOO_MANY: "A",
+  ENC_ENVELOPE_TOO_LARGE: "A",
+  ENC_EXCLUSIVITY_VIOLATION: "A",
+  ENC_NO_KEY_PATH: "A",
+  ENC_REQUIRES_CONTENT_HASH: "A",
+  ENC_PASSPHRASE_ALG_UNSUPPORTED: "A",
+  ENC_PASSPHRASE_SALT_TOO_SHORT: "A",
+  ENC_PASSPHRASE_SALT_TOO_LONG: "A",
+  ENC_PASSPHRASE_ARGON2_PARAMS_TOO_LOW: "A",
+  ENC_PASSPHRASE_PARAMS_EXCEED_POLICY: "A",
+  MALFORMED_SIG_COSE_SIGN1: "A",
+  SIGNATURE_UNSUPPORTED: "A",
+  SIG_ENTRY_INVALID_SHAPE: "A",
+  SIG_ENTRY_KID_COSE_KEY_CONFLICT: "A",
+  SIG_PRIVATE_KEY_LEAKED: "A",
+  SUPERSEDES_TX_INVALID_LENGTH: "A",
+  EXTENSION_UNSUPPORTED_CRITICAL: "A",
+  CRIT_SHAPE_INVALID: "A",
+  TX_NOT_FOUND: "B",
+  PROVIDER_UNAVAILABLE: "B",
+  TX_INTEGRITY_MISMATCH: "B",
+  METADATA_NOT_FOUND: "B",
+  INSUFFICIENT_CONFIRMATIONS: "B",
+  SIGNATURE_INVALID: "B",
+  SIGNER_KEY_UNRESOLVED: "B",
+  WALLET_ADDRESS_MISMATCH: "B",
+  URI_TARGET_FORBIDDEN: "B",
+  URI_INTEGRITY_MISMATCH: "B",
+  URI_PROVIDER_INTEGRITY_MISMATCH: "B",
+  URI_FETCH_FAILED: "B",
+  CONTENT_UNAVAILABLE: "B",
+  CONTENT_FETCH_LIMIT_EXCEEDED: "B",
+  CIPHERTEXT_UNAVAILABLE: "B",
+  SERVICE_INDEPENDENCE_VIOLATION: "B",
+  WRONG_DECRYPTION_INPUT_SHAPE: "B",
+  WRONG_RECIPIENT_KEY: "B",
+  TAMPERED_HEADER: "B",
+  TAMPERED_CIPHERTEXT: "B",
+  KDF_DERIVATION_FAILED: "B",
+  ENC_PASSPHRASE_UNNORMALIZABLE: "B",
+  ENC_PASSPHRASE_EMPTY: "B",
+  SCHEMA_MERKLE_LEAF_COUNT_MISMATCH: "B",
+  SCHEMA_MERKLE_LEAVES_FORMAT_UNSUPPORTED: "B",
+  SCHEMA_MERKLE_LEAVES_MALFORMED: "B",
+  MERKLE_ROOT_MISMATCH: "B",
+  MERKLE_LEAVES_UNAVAILABLE: "B",
+  MERKLE_UNSUPPORTED: "B",
+  OUT_OF_PROFILE_SKIPPED: "B"
+});
+Object.freeze(
+  ERROR_CODES.filter((code) => ERROR_CODE_PART[code] === "A")
+);
+Object.freeze(
+  ERROR_CODES.filter((code) => ERROR_CODE_PART[code] === "carriage")
+);
+Object.freeze(
+  ERROR_CODES.filter((code) => ERROR_CODE_PART[code] === "B")
+);
+new Map(
+  ERROR_CODES.map((code, index) => [code, index])
+);
+var abytesDoc = abytes;
+var randomBytes = randomBytes$2;
+function equalBytes(a, b) {
+  if (a.length !== b.length)
+    return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++)
+    diff |= a[i] ^ b[i];
+  return diff === 0;
 }
-function envelopeToCbor(enc) {
-  const out = {
-    scheme: enc.scheme,
-    aead: enc.aead,
-    nonce: enc.nonce
-  };
-  if (enc.kem !== void 0) out["kem"] = enc.kem;
-  if (enc.slots !== void 0) out["slots"] = enc.slots.map(slotToCbor);
-  if (enc.slots_mac !== void 0) out["slots_mac"] = enc.slots_mac;
-  if (enc.passphrase !== void 0) out["passphrase"] = passphraseToCbor(enc.passphrase);
-  return out;
+function copyBytes(bytes) {
+  return Uint8Array.from(abytes(bytes));
 }
-function slotToCbor(slot) {
-  if (slot.kem_ct !== void 0) {
-    return { kem_ct: slot.kem_ct.map((c) => c), wrap: slot.wrap };
-  }
-  return { epk: slot.epk, wrap: slot.wrap };
+function splitCoder(label, ...lengths) {
+  const getLength = (c) => typeof c === "number" ? c : c.bytesLen;
+  const bytesLen = lengths.reduce((sum, a) => sum + getLength(a), 0);
+  return {
+    bytesLen,
+    encode: (bufs) => {
+      const res = new Uint8Array(bytesLen);
+      for (let i = 0, pos = 0; i < lengths.length; i++) {
+        const c = lengths[i];
+        const l = getLength(c);
+        const b = typeof c === "number" ? bufs[i] : c.encode(bufs[i]);
+        abytes(b, l, label);
+        res.set(b, pos);
+        if (typeof c !== "number")
+          b.fill(0);
+        pos += l;
+      }
+      return res;
+    },
+    decode: (buf) => {
+      abytes(buf, bytesLen, label);
+      const res = [];
+      for (const c of lengths) {
+        const l = getLength(c);
+        const b = buf.subarray(0, l);
+        res.push(typeof c === "number" ? b : c.decode(b));
+        buf = buf.subarray(l);
+      }
+      return res;
+    }
+  };
 }
-function passphraseToCbor(pp) {
+function vecCoder(c, vecLen) {
+  const coder = c;
+  const bytesLen = vecLen * coder.bytesLen;
   return {
-    alg: pp.alg,
-    salt: pp.salt,
-    params: pp.params
+    bytesLen,
+    encode: (u) => {
+      if (u.length !== vecLen)
+        throw new RangeError(`vecCoder.encode: wrong length=${u.length}. Expected: ${vecLen}`);
+      const res = new Uint8Array(bytesLen);
+      for (let i = 0, pos = 0; i < u.length; i++) {
+        const b = coder.encode(u[i]);
+        res.set(b, pos);
+        b.fill(0);
+        pos += b.length;
+      }
+      return res;
+    },
+    decode: (a) => {
+      abytes(a, bytesLen);
+      const r = [];
+      for (let i = 0; i < a.length; i += coder.bytesLen)
+        r.push(coder.decode(a.subarray(i, i + coder.bytesLen)));
+      return r;
+    }
   };
 }
-function sigEntryToCbor(entry) {
-  const out = { cose_sign1: entry.cose_sign1.map((b) => b) };
-  if (entry.cose_key !== void 0) {
-    out["cose_key"] = entry.cose_key.map((b) => b);
+function cleanBytes(...list) {
+  for (const t of list) {
+    if (Array.isArray(t))
+      for (const b of t)
+        b.fill(0);
+    else
+      t.fill(0);
   }
-  return out;
 }
-
-// ../poe-standard/src/chunked.ts
-var CHUNK_MAX_BYTES = 64;
-var UTF8_ENCODER2 = new TextEncoder();
-function chunkBytes(value) {
-  if (value.length === 0) return [new Uint8Array(0)];
-  const chunks = [];
-  for (let i = 0; i < value.length; i += CHUNK_MAX_BYTES) {
-    chunks.push(value.subarray(i, Math.min(i + CHUNK_MAX_BYTES, value.length)));
-  }
-  return chunks;
-}
-function chunkUri(uri) {
-  const bytes = UTF8_ENCODER2.encode(uri);
-  if (bytes.length === 0) return [""];
-  if (bytes.length <= CHUNK_MAX_BYTES) return [uri];
-  const decoder = new TextDecoder("utf-8", { fatal: true });
-  const chunks = [];
-  let cursor = 0;
-  while (cursor < bytes.length) {
-    let end = Math.min(cursor + CHUNK_MAX_BYTES, bytes.length);
-    while (end < bytes.length && (bytes[end] & 192) === 128) end--;
-    chunks.push(decoder.decode(bytes.subarray(cursor, end)));
-    cursor = end;
-  }
-  return chunks;
+function getMask(bits) {
+  if (!Number.isSafeInteger(bits) || bits < 0 || bits > 32)
+    throw new RangeError(`expected bits in [0..32], got ${bits}`);
+  return bits === 32 ? 4294967295 : ~(-1 << bits) >>> 0;
 }
 
-// src/client/off-host-sign.ts
-var EMPTY_BYTES2 = new Uint8Array(0);
-var ED25519_PUBLIC_KEY_LENGTH = 32;
-var ED25519_SIGNATURE_LENGTH = 64;
-var OffHostSignError = class extends Error {
-  code;
-  constructor(code, message) {
-    super(message);
-    this.name = "OffHostSignError";
-    this.code = code;
+// ../../node_modules/.pnpm/@noble+post-quantum@0.6.1/node_modules/@noble/post-quantum/_crystals.js
+var genCrystals = (opts2) => {
+  const { newPoly, N: N2, Q: Q2, F: F2, ROOT_OF_UNITY: ROOT_OF_UNITY2, brvBits} = opts2;
+  const mod = (a, modulo = Q2) => {
+    const result = a % modulo | 0;
+    return (result >= 0 ? result | 0 : modulo + result | 0) | 0;
+  };
+  const smod = (a, modulo = Q2) => {
+    const r = mod(a, modulo) | 0;
+    return (r > modulo >> 1 ? r - modulo | 0 : r) | 0;
+  };
+  function getZettas() {
+    const out = newPoly(N2);
+    for (let i = 0; i < N2; i++) {
+      const b = reverseBits(i, brvBits);
+      const p = BigInt(ROOT_OF_UNITY2) ** BigInt(b) % BigInt(Q2);
+      out[i] = Number(p) | 0;
+    }
+    return out;
   }
+  const nttZetas = getZettas();
+  const field = {
+    add: (a, b) => mod((a | 0) + (b | 0)) | 0,
+    sub: (a, b) => mod((a | 0) - (b | 0)) | 0,
+    mul: (a, b) => mod((a | 0) * (b | 0)) | 0,
+    inv: (_a) => {
+      throw new Error("not implemented");
+    }
+  };
+  const nttOpts = {
+    N: N2,
+    roots: nttZetas,
+    invertButterflies: true,
+    skipStages: 1 ,
+    brp: false
+  };
+  const dif = FFTCore(field, { dit: false, ...nttOpts });
+  const dit = FFTCore(field, { dit: true, ...nttOpts });
+  const NTT = {
+    encode: (r) => {
+      return dif(r);
+    },
+    decode: (r) => {
+      dit(r);
+      for (let i = 0; i < r.length; i++)
+        r[i] = mod(F2 * r[i]);
+      return r;
+    }
+  };
+  const bitsCoder = (d, c) => {
+    const mask = getMask(d);
+    const bytesLen = d * (N2 / 8);
+    return {
+      bytesLen,
+      encode: (poly_) => {
+        const poly = poly_;
+        const r = new Uint8Array(bytesLen);
+        for (let i = 0, buf = 0, bufLen = 0, pos = 0; i < poly.length; i++) {
+          buf |= (c.encode(poly[i]) & mask) << bufLen;
+          bufLen += d;
+          for (; bufLen >= 8; bufLen -= 8, buf >>= 8)
+            r[pos++] = buf & getMask(bufLen);
+        }
+        return r;
+      },
+      decode: (bytes) => {
+        const r = newPoly(N2);
+        for (let i = 0, buf = 0, bufLen = 0, pos = 0; i < bytes.length; i++) {
+          buf |= bytes[i] << bufLen;
+          bufLen += 8;
+          for (; bufLen >= d; bufLen -= d, buf >>= d)
+            r[pos++] = c.decode(buf & mask);
+        }
+        return r;
+      }
+    };
+  };
+  return {
+    mod,
+    smod,
+    nttZetas,
+    NTT: {
+      encode: (r) => NTT.encode(r),
+      decode: (r) => NTT.decode(r)
+    },
+    bitsCoder
+  };
 };
-function buildToSign(record) {
-  const body = encodeRecordBodyForSigning(record);
-  const out = new Uint8Array(CARDANO_POE_SIG_DOMAIN_PREFIX_BYTES.length + body.length);
-  out.set(CARDANO_POE_SIG_DOMAIN_PREFIX_BYTES, 0);
-  out.set(body, CARDANO_POE_SIG_DOMAIN_PREFIX_BYTES.length);
-  return out;
-}
-function encodePath1ProtectedHeader(signerPubkey) {
-  const protectedHeader = /* @__PURE__ */ new Map([
-    [1, -8],
-    [4, signerPubkey]
-  ]);
-  const protectedHeaderBytes = encodeCanonicalCbor(protectedHeader);
-  return { protectedHeader, protectedHeaderBytes };
-}
-function prepareSigStructure(args) {
-  if (args.signerPubkey.length !== ED25519_PUBLIC_KEY_LENGTH) {
-    throw new OffHostSignError(
-      "INVALID_PUBKEY_LENGTH",
-      `signerPubkey must be 32 bytes (Ed25519 raw public key), got ${args.signerPubkey.length}`
-    );
-  }
-  const { protectedHeaderBytes } = encodePath1ProtectedHeader(args.signerPubkey);
-  const recordBodyCbor = encodeRecordBodyForSigning(args.record);
-  const sigStructureBytes = buildLabel309SigStructure({
-    bodyProtectedBytes: protectedHeaderBytes,
-    recordBodyCbor
-  });
-  return { sigStructureBytes, protectedHeaderBytes };
+var createXofShake = (shake) => (seed, blockLen) => {
+  if (!blockLen)
+    blockLen = shake.blockLen;
+  const _seed = new Uint8Array(seed.length + 2);
+  _seed.set(seed);
+  const seedLen = seed.length;
+  const buf = new Uint8Array(blockLen);
+  let h = shake.create({});
+  let calls = 0;
+  let xofs = 0;
+  return {
+    stats: () => ({ calls, xofs }),
+    get: (x, y) => {
+      _seed[seedLen + 0] = x;
+      _seed[seedLen + 1] = y;
+      h.destroy();
+      h = shake.create({}).update(_seed);
+      calls++;
+      return () => {
+        xofs++;
+        return h.xofInto(buf);
+      };
+    },
+    clean: () => {
+      h.destroy();
+      cleanBytes(buf, _seed);
+    }
+  };
+};
+var XOF128 = /* @__PURE__ */ createXofShake(shake128);
+
+// ../../node_modules/.pnpm/@noble+post-quantum@0.6.1/node_modules/@noble/post-quantum/ml-kem.js
+var N = 256;
+var Q = 3329;
+var F = 3303;
+var ROOT_OF_UNITY = 17;
+var crystals = /* @__PURE__ */ genCrystals({
+  N,
+  Q,
+  F,
+  ROOT_OF_UNITY,
+  newPoly: (n) => new Uint16Array(n),
+  brvBits: 7});
+var PARAMS = /* @__PURE__ */ (() => Object.freeze({
+  512: Object.freeze({ N, Q, K: 2, ETA1: 3, ETA2: 2, du: 10, dv: 4, RBGstrength: 128 }),
+  768: Object.freeze({ N, Q, K: 3, ETA1: 2, ETA2: 2, du: 10, dv: 4, RBGstrength: 192 }),
+  1024: Object.freeze({ N, Q, K: 4, ETA1: 2, ETA2: 2, du: 11, dv: 5, RBGstrength: 256 })
+}))();
+var compress = (d) => {
+  if (d >= 12)
+    return { encode: (i) => i, decode: (i) => i >= Q ? i - Q : i };
+  const a = 2 ** (d - 1);
+  return {
+    // This only matches standalone Compress_d after bitsCoder masks the result into Z_(2^d).
+    encode: (i) => ((i << d) + Q / 2) / Q,
+    // const decompress = (i: number) => round((Q / 2 ** d) * i);
+    decode: (i) => i * Q + a >>> d
+  };
+};
+var byteCoder = (d) => crystals.bitsCoder(d, { encode: (i) => i, decode: (i) => i >= Q ? i - Q : i } );
+var polyCoder = (d) => d === 12 ? byteCoder(12) : crystals.bitsCoder(d, compress(d));
+function polyAdd(a_, b_) {
+  const a = a_;
+  const b = b_;
+  for (let i = 0; i < N; i++)
+    a[i] = crystals.mod(a[i] + b[i]);
 }
-function assembleCoseSign1(args) {
-  if (args.signerPubkey.length !== ED25519_PUBLIC_KEY_LENGTH) {
-    throw new OffHostSignError(
-      "INVALID_PUBKEY_LENGTH",
-      `signerPubkey must be 32 bytes (Ed25519 raw public key), got ${args.signerPubkey.length}`
-    );
-  }
-  if (args.signature.length !== ED25519_SIGNATURE_LENGTH) {
-    throw new OffHostSignError(
-      "INVALID_SIGNATURE_LENGTH",
-      `signature must be 64 bytes (Ed25519 raw signature), got ${args.signature.length}`
-    );
-  }
-  const { protectedHeader } = encodePath1ProtectedHeader(args.signerPubkey);
-  const coseSign1Bytes = encodeCoseSign1({
-    protectedHeader,
-    unprotectedHeader: /* @__PURE__ */ new Map(),
-    payload: null,
-    signature: args.signature
-  });
-  const chunks = chunkBytes(coseSign1Bytes);
-  const sigEntry = { cose_sign1: chunks };
-  return { coseSign1Bytes, sigEntry };
+function polySub(a_, b_) {
+  const a = a_;
+  const b = b_;
+  for (let i = 0; i < N; i++)
+    a[i] = crystals.mod(a[i] - b[i]);
 }
-function prepareSigStructureHashed(args) {
-  if (args.signerPubkey.length !== ED25519_PUBLIC_KEY_LENGTH) {
-    throw new OffHostSignError(
-      "INVALID_PUBKEY_LENGTH",
-      `signerPubkey must be 32 bytes (Ed25519 raw public key), got ${args.signerPubkey.length}`
-    );
-  }
-  const { protectedHeaderBytes } = encodePath1ProtectedHeader(args.signerPubkey);
-  const toSign = buildToSign(args.record);
-  const toSignHashBytes = blake2b224(toSign);
-  const sigStructureBytes = buildSigStructure({
-    context: "Signature1",
-    bodyProtectedBytes: protectedHeaderBytes,
-    externalAad: EMPTY_BYTES2,
-    payload: toSignHashBytes
-  });
-  return { sigStructureBytes, protectedHeaderBytes, toSignHashBytes };
+function BaseCaseMultiply(a0, a1, b0, b1, zeta) {
+  const c0 = crystals.mod(a1 * b1 * zeta + a0 * b0);
+  const c1 = crystals.mod(a0 * b1 + a1 * b0);
+  return { c0, c1 };
 }
-function assembleCoseSign1Hashed(args) {
-  if (args.signerPubkey.length !== ED25519_PUBLIC_KEY_LENGTH) {
-    throw new OffHostSignError(
-      "INVALID_PUBKEY_LENGTH",
-      `signerPubkey must be 32 bytes (Ed25519 raw public key), got ${args.signerPubkey.length}`
-    );
-  }
-  if (args.signature.length !== ED25519_SIGNATURE_LENGTH) {
-    throw new OffHostSignError(
-      "INVALID_SIGNATURE_LENGTH",
-      `signature must be 64 bytes (Ed25519 raw signature), got ${args.signature.length}`
-    );
+function MultiplyNTTs(f_, g_) {
+  const f = f_;
+  const g = g_;
+  for (let i = 0; i < N / 2; i++) {
+    let z3 = crystals.nttZetas[64 + (i >> 1)];
+    if (i & 1)
+      z3 = -z3;
+    const { c0, c1 } = BaseCaseMultiply(f[2 * i + 0], f[2 * i + 1], g[2 * i + 0], g[2 * i + 1], z3);
+    f[2 * i + 0] = c0;
+    f[2 * i + 1] = c1;
   }
-  const { protectedHeader } = encodePath1ProtectedHeader(args.signerPubkey);
-  const unprotectedHeader = /* @__PURE__ */ new Map([["hashed", true]]);
-  const coseSign1Bytes = encodeCoseSign1({
-    protectedHeader,
-    unprotectedHeader,
-    payload: null,
-    signature: args.signature
-  });
-  const chunks = chunkBytes(coseSign1Bytes);
-  const sigEntry = { cose_sign1: chunks };
-  return { coseSign1Bytes, sigEntry };
+  return f;
 }
-
-// src/client/http-error.ts
-var CANONICAL_PROBLEM_KEYS = /* @__PURE__ */ new Set([
-  "type",
-  "title",
-  "status",
-  "detail",
-  "code",
-  "trace_id",
-  "errors",
-  "instance"
-]);
-function extractProblemExtensions(problem) {
-  const out = {};
-  for (const [key, value] of Object.entries(problem)) {
-    if (!CANONICAL_PROBLEM_KEYS.has(key)) {
-      out[key] = value;
+function SampleNTT(xof_) {
+  const xof = xof_;
+  const r = new Uint16Array(N);
+  for (let j = 0; j < N; ) {
+    const b = xof();
+    if (b.length % 3)
+      throw new Error("SampleNTT: unaligned block");
+    for (let i = 0; j < N && i + 3 <= b.length; i += 3) {
+      const d1 = (b[i + 0] >> 0 | b[i + 1] << 8) & 4095;
+      const d2 = (b[i + 1] >> 4 | b[i + 2] << 4) & 4095;
+      if (d1 < Q)
+        r[j++] = d1;
+      if (j < N && d2 < Q)
+        r[j++] = d2;
     }
   }
-  return out;
+  return r;
 }
-var Label309HttpError = class extends Error {
-  problem;
-  code;
-  httpStatus;
-  title;
-  detail;
-  type;
-  traceId;
-  instance;
-  errors;
-  extensions;
-  requestId;
-  retryAfterSeconds;
-  constructor(init) {
-    super(init.problem.detail || `${init.problem.title} (HTTP ${init.problem.status})`);
-    this.name = "Label309HttpError";
-    this.problem = init.problem;
-    this.code = init.problem.code;
-    this.httpStatus = init.problem.status;
-    this.title = init.problem.title;
-    this.detail = init.problem.detail;
-    this.type = init.problem.type;
-    this.traceId = init.problem.trace_id;
-    this.instance = init.problem.instance;
-    this.errors = init.problem.errors;
-    this.extensions = init.extensions ?? extractProblemExtensions(init.problem);
-    this.requestId = init.requestId ?? init.problem.trace_id;
-    this.retryAfterSeconds = init.retryAfterSeconds;
-  }
-};
-
-// src/client/batch-empty-error.ts
-var BatchEmptyError = class extends Label309HttpError {
-  constructor(init) {
-    super(init);
-    this.name = "BatchEmptyError";
+var sampleCBDBytes = (buf, eta) => {
+  const r = new Uint16Array(N);
+  const b32 = u32(buf);
+  swap32IfBE(b32);
+  let len = 0;
+  for (let i = 0, p = 0, bb = 0, t0 = 0; i < b32.length; i++) {
+    let b = b32[i];
+    for (let j = 0; j < 32; j++) {
+      bb += b & 1;
+      b >>= 1;
+      len += 1;
+      if (len === eta) {
+        t0 = bb;
+        bb = 0;
+      } else if (len === 2 * eta) {
+        r[p++] = crystals.mod(t0 - bb);
+        bb = 0;
+        len = 0;
+      }
+    }
   }
+  swap32IfBE(b32);
+  if (len)
+    throw new Error(`sampleCBD: leftover bits: ${len}`);
+  return r;
 };
-
-// src/client/batch-too-large-error.ts
-function readInt(value) {
-  return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+function sampleCBD(PRF_, seed, nonce, eta) {
+  const PRF = PRF_;
+  return sampleCBDBytes(PRF(eta * N / 4, seed, nonce), eta);
 }
-var BatchTooLargeError = class extends Label309HttpError {
-  max;
-  got;
-  constructor(init) {
-    super(init);
-    this.name = "BatchTooLargeError";
-    this.max = readInt(this.extensions["max"]);
-    this.got = readInt(this.extensions["got"]);
-  }
-};
-
-// src/client/forbidden-error.ts
-var ForbiddenError = class extends Label309HttpError {
-  constructor(init) {
-    super(init);
-    this.name = "ForbiddenError";
-  }
+var genKPKE = (opts_) => {
+  const opts2 = opts_;
+  const { K, PRF, XOF, HASH512, ETA1, ETA2, du, dv } = opts2;
+  const poly1 = polyCoder(1);
+  const polyV = polyCoder(dv);
+  const polyU = polyCoder(du);
+  const publicCoder = splitCoder("publicKey", vecCoder(polyCoder(12), K), 32);
+  const secretCoder = vecCoder(polyCoder(12), K);
+  const cipherCoder = splitCoder("ciphertext", vecCoder(polyU, K), polyV);
+  const seedCoder = splitCoder("seed", 32, 32);
+  return {
+    secretCoder,
+    lengths: {
+      secretKey: secretCoder.bytesLen,
+      publicKey: publicCoder.bytesLen,
+      cipherText: cipherCoder.bytesLen
+    },
+    keygen: (seed) => {
+      abytesDoc(seed, 32, "seed");
+      const seedDst = new Uint8Array(33);
+      seedDst.set(seed);
+      seedDst[32] = K;
+      const seedHash = HASH512(seedDst);
+      const [rho, sigma] = seedCoder.decode(seedHash);
+      const sHat = [];
+      const tHat = [];
+      for (let i = 0; i < K; i++)
+        sHat.push(crystals.NTT.encode(sampleCBD(PRF, sigma, i, ETA1)));
+      const x = XOF(rho);
+      for (let i = 0; i < K; i++) {
+        const e = crystals.NTT.encode(sampleCBD(PRF, sigma, K + i, ETA1));
+        for (let j = 0; j < K; j++) {
+          const aji = SampleNTT(x.get(j, i));
+          polyAdd(e, MultiplyNTTs(aji, sHat[j]));
+        }
+        tHat.push(e);
+      }
+      x.clean();
+      const res = {
+        publicKey: publicCoder.encode([tHat, rho]),
+        secretKey: secretCoder.encode(sHat)
+      };
+      cleanBytes(rho, sigma, sHat, tHat, seedDst, seedHash);
+      return res;
+    },
+    encrypt: (publicKey, msg, seed) => {
+      const [tHat, rho] = publicCoder.decode(publicKey);
+      const rHat = [];
+      for (let i = 0; i < K; i++)
+        rHat.push(crystals.NTT.encode(sampleCBD(PRF, seed, i, ETA1)));
+      const x = XOF(rho);
+      const tmp2 = new Uint16Array(N);
+      const u = [];
+      for (let i = 0; i < K; i++) {
+        const e1 = sampleCBD(PRF, seed, K + i, ETA2);
+        const tmp = new Uint16Array(N);
+        for (let j = 0; j < K; j++) {
+          const aij = SampleNTT(x.get(i, j));
+          polyAdd(tmp, MultiplyNTTs(aij, rHat[j]));
+        }
+        polyAdd(e1, crystals.NTT.decode(tmp));
+        u.push(e1);
+        polyAdd(tmp2, MultiplyNTTs(tHat[i], rHat[i]));
+        cleanBytes(tmp);
+      }
+      x.clean();
+      const e2 = sampleCBD(PRF, seed, 2 * K, ETA2);
+      polyAdd(e2, crystals.NTT.decode(tmp2));
+      const v = poly1.decode(msg);
+      polyAdd(v, e2);
+      cleanBytes(tHat, rHat, tmp2, e2);
+      return cipherCoder.encode([u, v]);
+    },
+    decrypt: (cipherText, privateKey) => {
+      const [u, v] = cipherCoder.decode(cipherText);
+      const sk = secretCoder.decode(privateKey);
+      const tmp = new Uint16Array(N);
+      for (let i = 0; i < K; i++)
+        polyAdd(tmp, MultiplyNTTs(sk[i], crystals.NTT.encode(u[i])));
+      polySub(v, crystals.NTT.decode(tmp));
+      cleanBytes(tmp, sk, u);
+      return poly1.encode(v);
+    }
+  };
 };
+function createKyber(opts2) {
+  const rawOpts = opts2;
+  const KPKE = genKPKE(rawOpts);
+  const { HASH256, HASH512, KDF } = rawOpts;
+  const { secretCoder: KPKESecretCoder, lengths } = KPKE;
+  const secretCoder = splitCoder("secretKey", lengths.secretKey, lengths.publicKey, 32, 32);
+  const msgLen = 32;
+  const seedLen = 64;
+  const kemLengths = Object.freeze({
+    ...lengths,
+    seed: 64,
+    msg: msgLen,
+    msgRand: msgLen,
+    secretKey: secretCoder.bytesLen
+  });
+  return Object.freeze({
+    info: Object.freeze({ type: "ml-kem" }),
+    lengths: kemLengths,
+    keygen: (seed = randomBytes(seedLen)) => {
+      abytesDoc(seed, seedLen, "seed");
+      const { publicKey, secretKey: sk } = KPKE.keygen(seed.subarray(0, 32));
+      const publicKeyHash = HASH256(publicKey);
+      const secretKey = secretCoder.encode([sk, publicKey, publicKeyHash, seed.subarray(32)]);
+      cleanBytes(sk, publicKeyHash);
+      return {
+        publicKey,
+        secretKey
+      };
+    },
+    getPublicKey: (secretKey) => {
+      const [_sk, publicKey, _publicKeyHash, _z] = secretCoder.decode(secretKey);
+      return Uint8Array.from(publicKey);
+    },
+    encapsulate: (publicKey, msg = randomBytes(msgLen)) => {
+      abytesDoc(publicKey, lengths.publicKey, "publicKey");
+      abytesDoc(msg, msgLen, "message");
+      const eke = publicKey.subarray(0, 384 * opts2.K);
+      const ek = KPKESecretCoder.encode(KPKESecretCoder.decode(copyBytes(eke)));
+      if (!equalBytes(ek, eke)) {
+        cleanBytes(ek);
+        throw new Error("ML-KEM.encapsulate: wrong publicKey modulus");
+      }
+      cleanBytes(ek);
+      const kr = HASH512.create().update(msg).update(HASH256(publicKey)).digest();
+      const cipherText = KPKE.encrypt(publicKey, msg, kr.subarray(32, 64));
+      cleanBytes(kr.subarray(32));
+      return {
+        cipherText,
+        sharedSecret: kr.subarray(0, 32)
+      };
+    },
+    decapsulate: (cipherText, secretKey) => {
+      abytesDoc(secretKey, secretCoder.bytesLen, "secretKey");
+      abytesDoc(cipherText, lengths.cipherText, "cipherText");
+      const k768 = secretCoder.bytesLen - 96;
+      const start = k768 + 32;
+      const test = HASH256(secretKey.subarray(k768 / 2, start));
+      if (!equalBytes(test, secretKey.subarray(start, start + 32)))
+        throw new Error("invalid secretKey: hash check failed");
+      const [sk, publicKey, publicKeyHash, z3] = secretCoder.decode(secretKey);
+      const msg = KPKE.decrypt(cipherText, sk);
+      const kr = HASH512.create().update(msg).update(publicKeyHash).digest();
+      const Khat = kr.subarray(0, 32);
+      const cipherText2 = KPKE.encrypt(publicKey, msg, kr.subarray(32, 64));
+      const isValid = equalBytes(cipherText, cipherText2);
+      const Kbar = KDF.create({ dkLen: 32 }).update(z3).update(cipherText).digest();
+      cleanBytes(msg, cipherText2, !isValid ? Khat : Kbar);
+      return isValid ? Khat : Kbar;
+    }
+  });
+}
+function shakePRF(dkLen, key, nonce) {
+  return shake256.create({ dkLen }).update(key).update(new Uint8Array([nonce])).digest();
+}
+var opts = /* @__PURE__ */ (() => ({
+  HASH256: sha3_256,
+  HASH512: sha3_512,
+  KDF: shake256,
+  XOF: XOF128,
+  PRF: shakePRF
+}))();
+var mk = (params) => createKyber({
+  ...opts,
+  ...params
+});
+var ml_kem768 = /* @__PURE__ */ (() => mk(PARAMS[768]))();
 
-// src/client/idempotency-conflict-error.ts
-var IdempotencyConflictError = class extends Label309HttpError {
-  constructor(init) {
-    super(init);
-    this.name = "IdempotencyConflictError";
+// ../../node_modules/.pnpm/@noble+post-quantum@0.6.1/node_modules/@noble/post-quantum/hybrid.js
+function ecKeygen(curve, allowZeroKey = false) {
+  const lengths = curve.lengths;
+  let keygen = curve.keygen;
+  if (allowZeroKey) {
+    if (!("getSharedSecret" in curve && "sign" in curve && "verify" in curve))
+      throw new Error("allowZeroKey requires a Weierstrass curve");
+    const wCurve = curve;
+    const Fn = wCurve.Point.Fn;
+    keygen = (seed = randomBytes(lengths.seed)) => {
+      abytes(seed, lengths.seed, "seed");
+      const seedScalar = Fn.isLE ? bytesToNumberLE(seed) : bytesToNumberBE(seed);
+      const secretKey = Fn.toBytes(Fn.create(seedScalar));
+      return {
+        secretKey,
+        publicKey: curve.getPublicKey(secretKey)
+      };
+    };
   }
-};
-
-// src/client/insufficient-funds-error.ts
-function readBigIntString(value) {
-  if (typeof value !== "string") return void 0;
-  if (!/^-?[0-9]+$/.test(value)) return void 0;
-  try {
-    return BigInt(value);
-  } catch {
-    return void 0;
+  return {
+    lengths: { secretKey: lengths.secretKey, publicKey: lengths.publicKey, seed: lengths.seed },
+    keygen: (seed) => keygen(seed),
+    getPublicKey: (secretKey) => curve.getPublicKey(secretKey)
+  };
+}
+function ecdhKem(curve, allowZeroKey = false) {
+  const kg = ecKeygen(curve, allowZeroKey);
+  if (!curve.getSharedSecret)
+    throw new Error("wrong curve");
+  return {
+    lengths: { ...kg.lengths, msg: kg.lengths.seed, cipherText: kg.lengths.publicKey },
+    keygen: kg.keygen,
+    getPublicKey: kg.getPublicKey,
+    encapsulate(publicKey, rand = randomBytes(curve.lengths.seed)) {
+      const seed = copyBytes(rand);
+      let ek = void 0;
+      try {
+        ek = this.keygen(seed).secretKey;
+        const sharedSecret = this.decapsulate(publicKey, ek);
+        const cipherText = curve.getPublicKey(ek);
+        return { sharedSecret, cipherText };
+      } finally {
+        cleanBytes(seed);
+        if (ek)
+          cleanBytes(ek);
+      }
+    },
+    decapsulate(cipherText, secretKey) {
+      const res = curve.getSharedSecret(secretKey, cipherText);
+      return curve.lengths.publicKeyHasPrefix ? res.subarray(1) : res;
+    }
+  };
+}
+function splitLengths(lst, name) {
+  return splitCoder(name, ...lst.map((i) => {
+    if (typeof i.lengths[name] !== "number")
+      throw new Error("wrong length: " + name);
+    return i.lengths[name];
+  }));
+}
+function expandSeedXof(xof) {
+  return ((seed, seedLen) => xof(seed, { dkLen: seedLen }));
+}
+function combineKeys(realSeedLen, expandSeed_, ...ck_) {
+  const expandSeed = expandSeed_;
+  const ck = ck_;
+  const seedCoder = splitLengths(ck, "seed");
+  const pkCoder = splitLengths(ck, "publicKey");
+  anumber(realSeedLen);
+  function expandDecapsulationKey(seed) {
+    abytes(seed, realSeedLen);
+    const expandedRaw = expandSeed(seed, seedCoder.bytesLen);
+    const expandedSeed = expandedRaw.buffer === seed.buffer ? copyBytes(expandedRaw) : expandedRaw;
+    const expanded = [];
+    const keySecret = [];
+    const secretKey = [];
+    const publicKey = [];
+    let ok = false;
+    try {
+      for (const part of seedCoder.decode(expandedSeed))
+        expanded.push(copyBytes(part));
+      for (let i = 0; i < ck.length; i++) {
+        const keys = ck[i].keygen(expanded[i]);
+        keySecret.push(keys.secretKey);
+        secretKey.push(copyBytes(keys.secretKey));
+        publicKey.push(keys.publicKey);
+      }
+      ok = true;
+      return { secretKey, publicKey };
+    } finally {
+      cleanBytes(expandedSeed, expanded, keySecret);
+      if (!ok)
+        cleanBytes(secretKey);
+    }
   }
+  return {
+    info: { lengths: { seed: realSeedLen, publicKey: pkCoder.bytesLen, secretKey: realSeedLen } },
+    getPublicKey(secretKey) {
+      return this.keygen(secretKey).publicKey;
+    },
+    keygen(seed = randomBytes(realSeedLen)) {
+      const { publicKey: pk, secretKey } = expandDecapsulationKey(seed);
+      try {
+        const publicKey = pkCoder.encode(pk);
+        return { secretKey: seed, publicKey };
+      } finally {
+        cleanBytes(pk);
+        cleanBytes(secretKey);
+      }
+    },
+    expandDecapsulationKey,
+    realSeedLen
+  };
 }
-function readString(value) {
-  return typeof value === "string" ? value : void 0;
+function combineKEMS(realSeedLen, realMsgLen, expandSeed, combiner, ...kems) {
+  const rawCombiner = combiner;
+  const rawKems = kems;
+  const keys = combineKeys(realSeedLen, expandSeed, ...rawKems);
+  const ctCoder = splitLengths(rawKems, "cipherText");
+  const pkCoder = splitLengths(rawKems, "publicKey");
+  const msgCoder = splitLengths(rawKems, "msg");
+  anumber(realMsgLen);
+  const lengths = Object.freeze({
+    ...keys.info.lengths,
+    msg: realMsgLen,
+    msgRand: msgCoder.bytesLen,
+    cipherText: ctCoder.bytesLen
+  });
+  return Object.freeze({
+    lengths,
+    getPublicKey: keys.getPublicKey,
+    keygen: keys.keygen,
+    encapsulate(pk, randomness = randomBytes(msgCoder.bytesLen)) {
+      const pks = pkCoder.decode(pk);
+      const rand = msgCoder.decode(randomness);
+      const sharedSecret = [];
+      const cipherText = [];
+      try {
+        for (let i = 0; i < rawKems.length; i++) {
+          const enc = rawKems[i].encapsulate(pks[i], rand[i]);
+          sharedSecret.push(enc.sharedSecret);
+          cipherText.push(enc.cipherText);
+        }
+        return {
+          // Detach the combiner result before cleanup: a caller-provided combiner may alias one of
+          // the child sharedSecret buffers, and those child buffers are zeroized immediately below.
+          sharedSecret: copyBytes(rawCombiner(pks, cipherText, sharedSecret)),
+          cipherText: ctCoder.encode(cipherText)
+        };
+      } finally {
+        cleanBytes(sharedSecret, cipherText);
+      }
+    },
+    decapsulate(ct, seed) {
+      const cts = ctCoder.decode(ct);
+      const { publicKey, secretKey } = keys.expandDecapsulationKey(seed);
+      const sharedSecret = rawKems.map((i, j) => i.decapsulate(cts[j], secretKey[j]));
+      try {
+        return copyBytes(rawCombiner(publicKey, cts, sharedSecret));
+      } finally {
+        cleanBytes(secretKey, sharedSecret);
+      }
+    }
+  });
 }
-var InsufficientFundsError = class extends Label309HttpError {
-  balanceUsdMicros;
-  requiredUsdMicros;
-  topUpUrl;
-  constructor(init) {
-    super(init);
-    this.name = "InsufficientFundsError";
-    this.balanceUsdMicros = readBigIntString(this.extensions["balance_usd_micros"]);
-    this.requiredUsdMicros = readBigIntString(this.extensions["required_usd_micros"]);
-    this.topUpUrl = readString(this.extensions["top_up_url"]);
-  }
-};
-
-// src/client/insufficient-scope-error.ts
-function readScopeArray(value) {
-  if (!Array.isArray(value)) return [];
-  return value.filter((entry) => typeof entry === "string");
+var x25519kem = /* @__PURE__ */ ecdhKem(x25519);
+var ml_kem768_x25519 = /* @__PURE__ */ (() => combineKEMS(
+  32,
+  32,
+  expandSeedXof(shake256),
+  // Awesome label, so much escaping hell in a single line.
+  (pk, ct, ss) => sha3_256(concatBytes(ss[0], ss[1], ct[1], pk[1], asciiToBytes("\\.//^\\"))),
+  ml_kem768,
+  x25519kem
+))();
+var XWing = /* @__PURE__ */ (() => ml_kem768_x25519)();
+function chacha20Poly1305Encrypt(opts2) {
+  return chacha20poly1305(opts2.key, opts2.nonce, opts2.aad).encrypt(opts2.plaintext);
 }
-var InsufficientScopeError = class extends Label309HttpError {
-  requiredScopes;
-  grantedScopes;
-  constructor(init) {
-    super(init);
-    this.name = "InsufficientScopeError";
-    this.requiredScopes = readScopeArray(this.extensions["required"]);
-    this.grantedScopes = readScopeArray(this.extensions["granted"]);
-  }
-  /** Convenience for the single-scope case; first entry of `requiredScopes`. */
-  get requiredScope() {
-    return this.requiredScopes[0];
-  }
-};
-
-// src/client/internal-server-error.ts
-var InternalServerError = class extends Label309HttpError {
-  constructor(init) {
-    super(init);
-    this.name = "InternalServerError";
-  }
-};
-
-// src/client/invalid-body-error.ts
-var InvalidBodyError = class extends Label309HttpError {
-  constructor(init) {
-    super(init);
-    this.name = "InvalidBodyError";
-  }
-};
-
-// src/client/malformed-cbor-error.ts
-var MalformedCborError = class extends Label309HttpError {
-  constructor(init) {
-    super(init);
-    this.name = "MalformedCborError";
+var MLKEM768X25519_PUBLIC_KEY_LENGTH = 1216;
+var MLKEM768X25519_ENC_LENGTH = 1120;
+var MLKEM768X25519_ESEED_LENGTH = 64;
+function mlkem768x25519Encapsulate(opts2) {
+  if (opts2.publicKey.length !== MLKEM768X25519_PUBLIC_KEY_LENGTH) {
+    throw new Error(
+      `mlkem768x25519 public key must be ${MLKEM768X25519_PUBLIC_KEY_LENGTH} bytes, got ${opts2.publicKey.length}`
+    );
   }
-};
-
-// src/client/not-found-error.ts
-var NotFoundError = class extends Label309HttpError {
-  constructor(init) {
-    super(init);
-    this.name = "NotFoundError";
+  if (opts2.eseed !== void 0 && opts2.eseed.length !== MLKEM768X25519_ESEED_LENGTH) {
+    throw new Error(
+      `mlkem768x25519 eseed must be ${MLKEM768X25519_ESEED_LENGTH} bytes, got ${opts2.eseed.length}`
+    );
   }
-};
-
-// src/client/quote-already-consumed-error.ts
-function readString2(value) {
-  return typeof value === "string" ? value : void 0;
+  const { cipherText, sharedSecret } = XWing.encapsulate(opts2.publicKey, opts2.eseed);
+  return { enc: cipherText, ss: sharedSecret };
 }
-var QuoteAlreadyConsumedError = class extends Label309HttpError {
-  quoteId;
-  constructor(init) {
-    super(init);
-    this.name = "QuoteAlreadyConsumedError";
-    this.quoteId = readString2(this.extensions["quote_id"]);
+var X25519LowOrderPointError = class extends Error {
+  code = "X25519_LOW_ORDER_POINT";
+  constructor(options) {
+    super("x25519 ECDH rejected: peer public key is a small-order point", options);
+    this.name = "X25519LowOrderPointError";
   }
 };
-
-// src/client/quote-expired-error.ts
-function readString3(value) {
-  return typeof value === "string" ? value : void 0;
+var NOBLE_LOW_ORDER_MESSAGE = "invalid private or public key received";
+function x25519PublicKey(opts2) {
+  return x25519.getPublicKey(opts2.secretKey);
 }
-var QuoteExpiredError = class extends Label309HttpError {
-  quoteId;
-  constructor(init) {
-    super(init);
-    this.name = "QuoteExpiredError";
-    this.quoteId = readString3(this.extensions["quote_id"]);
+function x25519Ecdh(opts2) {
+  try {
+    return x25519.getSharedSecret(opts2.secretKey, opts2.theirPublicKey);
+  } catch (e) {
+    if (e instanceof Error && e.message === NOBLE_LOW_ORDER_MESSAGE) {
+      throw new X25519LowOrderPointError({ cause: e });
+    }
+    throw e;
   }
-};
-
-// src/client/quote-not-found-error.ts
-function readString4(value) {
-  return typeof value === "string" ? value : void 0;
 }
-var QuoteNotFoundError = class extends Label309HttpError {
-  quoteId;
-  constructor(init) {
-    super(init);
-    this.name = "QuoteNotFoundError";
-    this.quoteId = readString4(this.extensions["quote_id"]);
-  }
-};
-
-// src/client/rate-limited-error.ts
-var RateLimitedError = class extends Label309HttpError {
-  constructor(init) {
-    super(init);
-    this.name = "RateLimitedError";
+function hkdfSha256(opts2) {
+  return hkdf(sha256$1, opts2.ikm, opts2.salt, opts2.info, opts2.length);
+}
+var EciesSealedPoeError = class extends Error {
+  code;
+  constructor(code, message, options) {
+    super(message, options);
+    this.name = "EciesSealedPoeError";
+    this.code = code;
   }
 };
-
-// src/client/record-not-found-error.ts
-var RecordNotFoundError = class extends Label309HttpError {
-  constructor(init) {
-    super(init);
-    this.name = "RecordNotFoundError";
+var CHUNK_SIZE = 65536;
+var TAG_SIZE = 16;
+var NONCE_LENGTH = 12;
+var COUNTER_LENGTH = 11;
+var PAYLOAD_KEY_LENGTH = 32;
+var EMPTY_AAD = new Uint8Array(0);
+var ChunkNonce = class {
+  nonce = new Uint8Array(NONCE_LENGTH);
+  finished = false;
+  next(final) {
+    if (this.finished) {
+      throw new Error("STREAM: no chunks may follow the final chunk");
+    }
+    if (final) {
+      this.finished = true;
+      this.nonce[COUNTER_LENGTH] = 1;
+    }
+    const out = this.nonce.slice();
+    this.increment();
+    return out;
   }
-};
-
-// src/client/service-unavailable-error.ts
-var ServiceUnavailableError = class extends Label309HttpError {
-  constructor(init) {
-    super(init);
-    this.name = "ServiceUnavailableError";
+  get done() {
+    return this.finished;
   }
-};
-
-// src/client/unauthorized-error.ts
-var UnauthorizedError = class extends Label309HttpError {
-  constructor(init) {
-    super(init);
-    this.name = "UnauthorizedError";
+  increment() {
+    for (let i = COUNTER_LENGTH - 1; i >= 0; i--) {
+      const v = this.nonce[i] + 1 & 255;
+      this.nonce[i] = v;
+      if (v !== 0) return;
+    }
+    throw new Error("STREAM: chunk counter overflow");
   }
 };
-
-// src/client/validation-failed-error.ts
-var ValidationFailedError = class extends Label309HttpError {
-  constructor(init) {
-    super(init);
-    this.name = "ValidationFailedError";
+function assertPayloadKey(payloadKey) {
+  if (payloadKey.length !== PAYLOAD_KEY_LENGTH) {
+    throw new Error(
+      `STREAM: payloadKey MUST be exactly ${PAYLOAD_KEY_LENGTH} bytes, got ${payloadKey.length}`
+    );
   }
-};
-
-// src/client/parse-http-error.ts
-function asString(value) {
-  return typeof value === "string" ? value : void 0;
-}
-function asNumber(value) {
-  return typeof value === "number" && Number.isFinite(value) ? value : void 0;
 }
-function asProblemErrorEntries(value) {
-  if (!Array.isArray(value)) return void 0;
-  const out = [];
-  for (const entry of value) {
-    if (entry === null || typeof entry !== "object") continue;
-    const e = entry;
-    out.push({
-      field: typeof e["field"] === "string" ? e["field"] : "",
-      code: typeof e["code"] === "string" ? e["code"] : "",
-      detail: typeof e["detail"] === "string" ? e["detail"] : ""
+var StreamSealer = class {
+  payloadKey;
+  nonce = new ChunkNonce();
+  chunkIndex = 0;
+  constructor(payloadKey) {
+    assertPayloadKey(payloadKey);
+    this.payloadKey = payloadKey;
+  }
+  sealChunk(plaintext, final) {
+    if (!final && plaintext.length !== CHUNK_SIZE) {
+      throw new Error(
+        `STREAM: non-final chunk MUST carry exactly ${CHUNK_SIZE} plaintext bytes, got ${plaintext.length}`
+      );
+    }
+    if (final && plaintext.length > CHUNK_SIZE) {
+      throw new Error(
+        `STREAM: final chunk MUST carry at most ${CHUNK_SIZE} plaintext bytes, got ${plaintext.length}`
+      );
+    }
+    if (final && plaintext.length === 0 && this.chunkIndex > 0) {
+      throw new Error(
+        "STREAM: a zero-length final chunk is admissible only for an empty plaintext"
+      );
+    }
+    const sealed = chacha20Poly1305Encrypt({
+      key: this.payloadKey,
+      nonce: this.nonce.next(final),
+      aad: EMPTY_AAD,
+      plaintext
     });
+    this.chunkIndex += 1;
+    return sealed;
+  }
+};
+function streamSeal(args) {
+  const { plaintext } = args;
+  const sealer = new StreamSealer(args.payloadKey);
+  const chunkCount = Math.max(1, Math.ceil(plaintext.length / CHUNK_SIZE));
+  const out = new Uint8Array(plaintext.length + chunkCount * TAG_SIZE);
+  let offset = 0;
+  for (let i = 0; i < chunkCount; i++) {
+    const final = i === chunkCount - 1;
+    const chunk = plaintext.subarray(
+      i * CHUNK_SIZE,
+      Math.min((i + 1) * CHUNK_SIZE, plaintext.length)
+    );
+    const sealed = sealer.sealChunk(chunk, final);
+    out.set(sealed, offset);
+    offset += sealed.length;
   }
   return out;
 }
-function synthesiseProblem(httpStatus, requestId) {
-  const code = `http-${httpStatus}`;
-  return {
-    type: `about:blank`,
-    title: `HTTP ${httpStatus}`,
-    status: httpStatus,
-    detail: `Server returned HTTP ${httpStatus} without a problem+json body.`,
-    code,
-    trace_id: requestId ?? ""
-  };
+function encodeCanonicalCbor3(value) {
+  return encode(value, {
+    cde: true,
+    collapseBigInts: true,
+    rejectDuplicateKeys: true,
+    sortKeys: sortCoreDeterministic
+  });
 }
-function toProblemDetails(httpStatus, body, requestId) {
-  if (body === null || typeof body !== "object") {
-    return synthesiseProblem(httpStatus, requestId);
-  }
-  const b = body;
-  const code = asString(b["code"]);
-  const status = asNumber(b["status"]) ?? httpStatus;
-  const title = asString(b["title"]);
-  if (code === void 0 && title === void 0) {
-    return synthesiseProblem(httpStatus, requestId);
-  }
-  const errors = asProblemErrorEntries(b["errors"]);
-  const base = {
-    ...b,
-    // RFC 7807 §4.2: `about:blank` is the default when no type URI is supplied.
-    // The client is gateway-agnostic, so it must not invent a vendor-specific
-    // problem-type namespace; the machine-readable discriminator is `code`.
-    type: asString(b["type"]) ?? "about:blank",
-    title: title ?? `HTTP ${status}`,
-    status,
-    detail: asString(b["detail"]) ?? "",
-    code: code ?? `http-${status}`,
-    trace_id: asString(b["trace_id"]) ?? requestId ?? ""
-  };
-  if (errors !== void 0) base["errors"] = errors;
-  return base;
+var CARDANO_POE_ITEM_HASHES_PREFIX = new TextEncoder().encode(
+  "cardano-poe-item-hashes-v1"
+);
+var CARDANO_POE_SLOTS_TRANSCRIPT_PREFIX = new TextEncoder().encode(
+  "cardano-poe-slots-transcript-v1"
+);
+var CARDANO_POE_PASSPHRASE_TRANSCRIPT_PREFIX = new TextEncoder().encode(
+  "cardano-poe-passphrase-transcript-v1"
+);
+var CARDANO_POE_HKDF_INFO_SLOTS_MAC = new TextEncoder().encode(
+  "cardano-poe-slots-mac-v1"
+);
+var CARDANO_POE_HKDF_INFO_PASSPHRASE_MAC = new TextEncoder().encode(
+  "cardano-poe-passphrase-mac-v1"
+);
+var CARDANO_POE_HKDF_INFO_PAYLOAD = new TextEncoder().encode(
+  "cardano-poe-payload-v1"
+);
+var CARDANO_POE_HKDF_INFO_PAYLOAD_PASSPHRASE = new TextEncoder().encode(
+  "cardano-poe-payload-passphrase-v1"
+);
+var CARDANO_POE_X25519_KEK_SALT_PREFIX = new TextEncoder().encode(
+  "cardano-poe-x25519-kek-salt-v1"
+);
+var CARDANO_POE_XWING_KEK_SALT_PREFIX = new TextEncoder().encode(
+  "cardano-poe-xwing-kek-salt-v1"
+);
+if (CARDANO_POE_ITEM_HASHES_PREFIX.length !== 26) {
+  throw new Error("CARDANO_POE_ITEM_HASHES_PREFIX byte-length invariant violated (expected 26)");
 }
-function parseHttpError(args) {
-  const problem = toProblemDetails(args.httpStatus, args.body, args.requestId);
-  const extensions = extractProblemExtensions(problem);
-  const init = {
-    problem,
-    extensions,
-    requestId: args.requestId,
-    retryAfterSeconds: args.retryAfterSeconds
-  };
-  switch (problem.code) {
-    case "unauthorized":
-      return new UnauthorizedError(init);
-    case "forbidden":
-    case "csrf-invalid":
-      return new ForbiddenError(init);
-    case "insufficient-scope":
-      return new InsufficientScopeError(init);
-    case "insufficient-funds":
-      return new InsufficientFundsError(init);
-    case "quote-expired":
-      return new QuoteExpiredError(init);
-    case "quote-not-found":
-      return new QuoteNotFoundError(init);
-    case "quote-already-consumed":
-      return new QuoteAlreadyConsumedError(init);
-    case "not-found":
-      return new NotFoundError(init);
-    case "record-not-found":
-      return new RecordNotFoundError(init);
-    case "idempotency-key-conflict":
-      return new IdempotencyConflictError(init);
-    case "rate-limited":
-      return new RateLimitedError(init);
-    case "validation-failed":
-      return new ValidationFailedError(init);
-    case "invalid-body":
-      return new InvalidBodyError(init);
-    case "malformed-cbor":
-      return new MalformedCborError(init);
-    case "batch-too-large":
-      return new BatchTooLargeError(init);
-    case "batch-empty":
-      return new BatchEmptyError(init);
-    case "internal-error":
-      return new InternalServerError(init);
-    // A gateway that prices on a live FX oracle may surface a transient
-    // `fx-stale` pricing outage; to a vendor-neutral client that is just a
-    // temporary inability to serve, i.e. a service-unavailable condition.
-    case "service-unavailable":
-    case "fx-stale":
-      return new ServiceUnavailableError(init);
-    default:
-      return new Label309HttpError(init);
-  }
+if (CARDANO_POE_SLOTS_TRANSCRIPT_PREFIX.length !== 31) {
+  throw new Error(
+    "CARDANO_POE_SLOTS_TRANSCRIPT_PREFIX byte-length invariant violated (expected 31)"
+  );
 }
-
-// src/client/http-helpers.ts
-async function readJson(response) {
-  const text = await response.text();
-  if (text.length === 0) return null;
-  try {
-    return JSON.parse(text);
-  } catch {
-    return null;
+if (CARDANO_POE_PASSPHRASE_TRANSCRIPT_PREFIX.length !== 36) {
+  throw new Error(
+    "CARDANO_POE_PASSPHRASE_TRANSCRIPT_PREFIX byte-length invariant violated (expected 36)"
+  );
+}
+if (CARDANO_POE_HKDF_INFO_SLOTS_MAC.length !== 24) {
+  throw new Error("CARDANO_POE_HKDF_INFO_SLOTS_MAC byte-length invariant violated (expected 24)");
+}
+if (CARDANO_POE_HKDF_INFO_PASSPHRASE_MAC.length !== 29) {
+  throw new Error(
+    "CARDANO_POE_HKDF_INFO_PASSPHRASE_MAC byte-length invariant violated (expected 29)"
+  );
+}
+if (CARDANO_POE_HKDF_INFO_PAYLOAD.length !== 22) {
+  throw new Error("CARDANO_POE_HKDF_INFO_PAYLOAD byte-length invariant violated (expected 22)");
+}
+if (CARDANO_POE_HKDF_INFO_PAYLOAD_PASSPHRASE.length !== 33) {
+  throw new Error(
+    "CARDANO_POE_HKDF_INFO_PAYLOAD_PASSPHRASE byte-length invariant violated (expected 33)"
+  );
+}
+if (CARDANO_POE_X25519_KEK_SALT_PREFIX.length !== 30) {
+  throw new Error(
+    "CARDANO_POE_X25519_KEK_SALT_PREFIX byte-length invariant violated (expected 30)"
+  );
+}
+if (CARDANO_POE_XWING_KEK_SALT_PREFIX.length !== 29) {
+  throw new Error("CARDANO_POE_XWING_KEK_SALT_PREFIX byte-length invariant violated (expected 29)");
+}
+var EMPTY_SALT = new Uint8Array(0);
+function labelledSha256(prefix, ...parts) {
+  let total = prefix.length;
+  for (const p of parts) total += p.length;
+  const message = new Uint8Array(total);
+  message.set(prefix, 0);
+  let offset = prefix.length;
+  for (const p of parts) {
+    message.set(p, offset);
+    offset += p.length;
+  }
+  return sha256$1(message);
+}
+function itemHashesHash(hashes2) {
+  if (Object.keys(hashes2).length === 0) {
+    throw new EciesSealedPoeError(
+      "ENC_REQUIRES_CONTENT_HASH",
+      "hashes MUST carry at least one content-hash entry"
+    );
   }
+  return labelledSha256(CARDANO_POE_ITEM_HASHES_PREFIX, encodeCanonicalCbor3(hashes2));
 }
-function parseRetryAfter(header) {
-  if (header === null) return void 0;
-  const parsed = Number(header);
-  return Number.isFinite(parsed) ? parsed : void 0;
+function computeSlotsHash(args) {
+  const slots = args.kem === "x25519" ? args.slots.map((s) => ({ epk: s.epk, wrap: s.wrap })) : args.slots.map((s) => ({
+    kem_ct: s.kem_ct,
+    wrap: s.wrap
+  }));
+  const transcript = {
+    scheme: 1,
+    path: "slots",
+    aead: args.aead,
+    kem: args.kem,
+    nonce: args.nonce,
+    slots,
+    hashes_hash: args.hashesHash
+  };
+  return labelledSha256(CARDANO_POE_SLOTS_TRANSCRIPT_PREFIX, encodeCanonicalCbor3(transcript));
 }
-async function throwIfNotOk(response) {
-  if (response.ok) return;
-  const body = await readJson(response);
-  const requestId = response.headers.get("x-request-id") ?? void 0;
-  const retryAfterSeconds = parseRetryAfter(response.headers.get("retry-after"));
-  throw parseHttpError({ httpStatus: response.status, body, requestId, retryAfterSeconds });
+function computeSlotsMac(args) {
+  const macKey = hkdfSha256({
+    ikm: args.cek,
+    salt: EMPTY_SALT,
+    info: CARDANO_POE_HKDF_INFO_SLOTS_MAC,
+    length: 32
+  });
+  return hmac(sha256$1, macKey, args.slotsHash);
 }
-
-// src/client/account.ts
-function buildHeaders(apiKey) {
-  const headers = new Headers({
-    "content-type": "application/json",
-    accept: "application/json"
+function slotsPayloadKey(args) {
+  return hkdfSha256({
+    ikm: args.cek,
+    salt: args.nonce,
+    info: CARDANO_POE_HKDF_INFO_PAYLOAD,
+    length: 32
   });
-  if (apiKey !== void 0) headers.set("authorization", `Bearer ${apiKey}`);
-  return headers;
 }
-var AccountNamespace = class {
-  config;
-  constructor(config) {
-    this.config = config;
-  }
-  /**
-   * Fetch the caller's current prepaid USD balance.
-   *
-   * Returns `{ balanceUsdMicros }`, the gateway's `balance_usd_micros` field
-   * (USD micro-cents as a decimal string). The string is preserved verbatim —
-   * never parsed into a number — so no precision is lost. An account with no
-   * ledger activity yet reads `"0"`.
-   *
-   * Requires authentication: 401 (UnauthorizedError) when anonymous, 403
-   * (InsufficientScopeError) when the Bearer key lacks the `account:read`
-   * scope.
-   */
-  async balance() {
-    const response = await this.config.fetch(`${this.config.baseUrl}/api/v1/account/balance`, {
-      method: "GET",
-      headers: buildHeaders(this.config.apiKey)
-    });
-    await throwIfNotOk(response);
-    const body = await readJson(response);
-    return { balanceUsdMicros: body.balance_usd_micros };
-  }
-};
-
-// src/client/invalid-client-config-error.ts
-var InvalidClientConfigError = class extends Error {
-  code = "INVALID_CLIENT_CONFIG";
-  constructor(message) {
-    super(message);
-    this.name = "InvalidClientConfigError";
+function x25519KekSalt(args) {
+  return labelledSha256(CARDANO_POE_X25519_KEK_SALT_PREFIX, args.nonce, args.epk, args.pubR);
+}
+function xwingKekSalt(args) {
+  return labelledSha256(CARDANO_POE_XWING_KEK_SALT_PREFIX, args.nonce, args.kemCt, args.pubR);
+}
+var SEALED_POE_AEAD = "chacha20-poly1305-stream64k";
+var CARDANO_POE_HKDF_INFO_KEK = new TextEncoder().encode("cardano-poe-kek-v1");
+var CARDANO_POE_HKDF_INFO_KEK_MLKEM768X25519 = new TextEncoder().encode(
+  "cardano-poe-kek-mlkem768x25519-v1"
+);
+var ZERO_NONCE_12 = new Uint8Array(12);
+var X25519_PUBLIC_KEY_LENGTH = 32;
+var X25519_SECRET_KEY_LENGTH = 32;
+var CEK_LENGTH = 32;
+var NONCE_LENGTH2 = 24;
+var WRAP_LENGTH = 48;
+var SLOTS_MAC_LENGTH = 32;
+if (CARDANO_POE_HKDF_INFO_KEK.length !== 18) {
+  throw new Error("CARDANO_POE_HKDF_INFO_KEK byte-length invariant violated (expected 18)");
+}
+if (CARDANO_POE_HKDF_INFO_KEK_MLKEM768X25519.length !== 33) {
+  throw new Error(
+    "CARDANO_POE_HKDF_INFO_KEK_MLKEM768X25519 byte-length invariant violated (expected 33)"
+  );
+}
+if (ZERO_NONCE_12.length !== 12) {
+  throw new Error("ZERO_NONCE_12 byte-length invariant violated (expected 12)");
+}
+function uniformIndexBelow(m) {
+  const limit = 4294967296 - 4294967296 % m;
+  const buf = new Uint32Array(1);
+  let x;
+  do {
+    crypto.getRandomValues(buf);
+    x = buf[0];
+  } while (x >= limit);
+  return x % m;
+}
+function csprngShuffle(arr) {
+  for (let i = arr.length - 1; i > 0; i--) {
+    const j = uniformIndexBelow(i + 1);
+    const tmp = arr[i];
+    arr[i] = arr[j];
+    arr[j] = tmp;
   }
-};
-
-// src/hex.ts
-function bytesToHex(bytes) {
-  return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
 }
-function encodeCanonicalCbor3(value) {
-  return encode(value, {
-    cde: true,
-    collapseBigInts: true,
-    rejectDuplicateKeys: true,
-    sortKeys: sortCoreDeterministic
+function wrapSlotX25519(args) {
+  const privEph = args.privEph ?? randomBytes$1(X25519_SECRET_KEY_LENGTH);
+  if (privEph.length !== X25519_SECRET_KEY_LENGTH) {
+    throw new EciesSealedPoeError(
+      "INVALID_EPHEMERAL_SECRET_LENGTH",
+      `ephemeralSecrets[${args.slotIdx}] MUST be exactly ${X25519_SECRET_KEY_LENGTH} bytes, got ${privEph.length}`
+    );
+  }
+  const epk = x25519PublicKey({ secretKey: privEph });
+  const shared = x25519Ecdh({ secretKey: privEph, theirPublicKey: args.pubR });
+  const kek = hkdfSha256({
+    ikm: shared,
+    salt: x25519KekSalt({ nonce: args.nonce, epk, pubR: args.pubR }),
+    info: CARDANO_POE_HKDF_INFO_KEK,
+    length: 32
+  });
+  const wrap = chacha20Poly1305Encrypt({
+    key: kek,
+    nonce: ZERO_NONCE_12,
+    aad: CARDANO_POE_HKDF_INFO_KEK,
+    plaintext: args.cek
   });
+  if (wrap.length !== WRAP_LENGTH) {
+    throw new Error(`internal: wrap.length=${wrap.length}, expected ${WRAP_LENGTH}`);
+  }
+  return { epk, wrap };
 }
-var LEAVES_LIST_FORMAT_V1 = "cardano-poe-merkle-leaves-v1";
-var TREE_ALG_RFC9162 = "rfc9162-sha256";
-var DIGEST_LENGTH2 = 32;
-var MerkleLeavesListError = class extends Error {
-  code;
-  constructor(code, message) {
-    super(message ? `${code}: ${message}` : code);
-    this.code = code;
-    this.name = "MerkleLeavesListError";
+function wrapSlotMlkem768X25519(args) {
+  const { enc, ss } = mlkem768x25519Encapsulate({
+    publicKey: args.pubR,
+    ...args.eseed !== void 0 ? { eseed: args.eseed } : {}
+  });
+  if (enc.length !== MLKEM768X25519_ENC_LENGTH) {
+    throw new Error(`internal: enc.length=${enc.length}, expected ${MLKEM768X25519_ENC_LENGTH}`);
   }
-};
-function encodeLeavesList(args) {
-  if (!(args.root instanceof Uint8Array) || args.root.length !== DIGEST_LENGTH2) {
-    throw new MerkleLeavesListError(
-      "SCHEMA_MERKLE_LEAVES_MALFORMED",
-      `root must be a Uint8Array(${DIGEST_LENGTH2})`
-    );
+  const kek = hkdfSha256({
+    ikm: ss,
+    salt: xwingKekSalt({ nonce: args.nonce, kemCt: enc, pubR: args.pubR }),
+    info: CARDANO_POE_HKDF_INFO_KEK_MLKEM768X25519,
+    length: 32
+  });
+  const wrap = chacha20Poly1305Encrypt({
+    key: kek,
+    nonce: ZERO_NONCE_12,
+    aad: CARDANO_POE_HKDF_INFO_KEK_MLKEM768X25519,
+    plaintext: args.cek
+  });
+  if (wrap.length !== WRAP_LENGTH) {
+    throw new Error(`internal: wrap.length=${wrap.length}, expected ${WRAP_LENGTH}`);
   }
-  if (args.leaves.length < 1) {
-    throw new MerkleLeavesListError(
-      "SCHEMA_MERKLE_LEAVES_MALFORMED",
-      "leaves array must be non-empty"
+  return { kem_ct: enc, wrap };
+}
+function eciesSealedPoeWrap(args) {
+  const { plaintext, recipientPublicKeys } = args;
+  const kem = args.kem ?? "x25519";
+  const n = recipientPublicKeys.length;
+  const hashesHash = itemHashesHash(args.hashes);
+  if (n < 1) {
+    throw new EciesSealedPoeError(
+      "ENC_SLOTS_EMPTY",
+      `recipientPublicKeys.length=${n} must be >= 1`
     );
   }
-  const leavesCopy = [];
-  for (let i = 0; i < args.leaves.length; i++) {
-    const leaf = args.leaves[i];
-    if (!(leaf instanceof Uint8Array) || leaf.length !== DIGEST_LENGTH2) {
-      throw new MerkleLeavesListError(
-        "SCHEMA_MERKLE_LEAVES_MALFORMED",
-        `leaves[${i}] must be a Uint8Array(${DIGEST_LENGTH2})`
+  const expectedPubLen = kem === "x25519" ? X25519_PUBLIC_KEY_LENGTH : MLKEM768X25519_PUBLIC_KEY_LENGTH;
+  for (let i = 0; i < n; i++) {
+    const pub = recipientPublicKeys[i];
+    if (pub === void 0 || pub.length !== expectedPubLen) {
+      throw new EciesSealedPoeError(
+        "KEM_EPK_LENGTH_MISMATCH",
+        `recipientPublicKeys[${i}] MUST be exactly ${expectedPubLen} bytes for kem='${kem}'`
       );
     }
-    leavesCopy.push(leaf);
   }
-  if (args.leafAlg !== void 0 && typeof args.leafAlg !== "string") {
-    throw new MerkleLeavesListError(
-      "SCHEMA_MERKLE_LEAVES_MALFORMED",
-      "leaf_alg must be a string when present"
+  if (kem === "x25519") {
+    if (args.eseeds !== void 0) {
+      throw new EciesSealedPoeError(
+        "EPHEMERAL_SECRETS_COUNT_MISMATCH",
+        "eseeds is an X-Wing (mlkem768x25519) override and MUST NOT be supplied for kem='x25519'"
+      );
+    }
+    if (args.ephemeralSecrets !== void 0 && args.ephemeralSecrets.length !== n) {
+      throw new EciesSealedPoeError(
+        "EPHEMERAL_SECRETS_COUNT_MISMATCH",
+        `ephemeralSecrets.length=${args.ephemeralSecrets.length} must match recipientPublicKeys.length=${n}`
+      );
+    }
+  } else {
+    if (args.ephemeralSecrets !== void 0) {
+      throw new EciesSealedPoeError(
+        "EPHEMERAL_SECRETS_COUNT_MISMATCH",
+        "ephemeralSecrets is an X25519 override and MUST NOT be supplied for kem='mlkem768x25519'"
+      );
+    }
+    if (args.eseeds !== void 0) {
+      if (args.eseeds.length !== n) {
+        throw new EciesSealedPoeError(
+          "EPHEMERAL_SECRETS_COUNT_MISMATCH",
+          `eseeds.length=${args.eseeds.length} must match recipientPublicKeys.length=${n}`
+        );
+      }
+      for (let i = 0; i < n; i++) {
+        const eseed = args.eseeds[i];
+        if (eseed.length !== MLKEM768X25519_ESEED_LENGTH) {
+          throw new EciesSealedPoeError(
+            "INVALID_EPHEMERAL_SECRET_LENGTH",
+            `eseeds[${i}] MUST be exactly ${MLKEM768X25519_ESEED_LENGTH} bytes, got ${eseed.length}`
+          );
+        }
+      }
+    }
+  }
+  const cek = args.cek ?? randomBytes$1(CEK_LENGTH);
+  const nonce = args.nonce ?? randomBytes$1(NONCE_LENGTH2);
+  if (cek.length !== CEK_LENGTH) {
+    throw new EciesSealedPoeError(
+      "INVALID_CEK_LENGTH",
+      `cek MUST be exactly ${CEK_LENGTH} bytes, got ${cek.length}`
     );
   }
-  const map = {
-    format: LEAVES_LIST_FORMAT_V1,
-    tree_alg: TREE_ALG_RFC9162,
-    root: args.root,
-    leaves: leavesCopy,
-    leaf_count: leavesCopy.length
-  };
-  if (args.leafAlg !== void 0) {
-    map["leaf_alg"] = args.leafAlg;
+  if (nonce.length !== NONCE_LENGTH2) {
+    throw new EciesSealedPoeError(
+      "NONCE_LENGTH_MISMATCH",
+      `nonce MUST be exactly ${NONCE_LENGTH2} bytes, got ${nonce.length}`
+    );
   }
-  return encodeCanonicalCbor3(map);
-}
-var abytesDoc = abytes;
-var randomBytes = randomBytes$2;
-function equalBytes(a, b) {
-  if (a.length !== b.length)
-    return false;
-  let diff = 0;
-  for (let i = 0; i < a.length; i++)
-    diff |= a[i] ^ b[i];
-  return diff === 0;
-}
-function copyBytes(bytes) {
-  return Uint8Array.from(abytes(bytes));
-}
-function splitCoder(label, ...lengths) {
-  const getLength = (c) => typeof c === "number" ? c : c.bytesLen;
-  const bytesLen = lengths.reduce((sum, a) => sum + getLength(a), 0);
-  return {
-    bytesLen,
-    encode: (bufs) => {
-      const res = new Uint8Array(bytesLen);
-      for (let i = 0, pos = 0; i < lengths.length; i++) {
-        const c = lengths[i];
-        const l = getLength(c);
-        const b = typeof c === "number" ? bufs[i] : c.encode(bufs[i]);
-        abytes(b, l, label);
-        res.set(b, pos);
-        if (typeof c !== "number")
-          b.fill(0);
-        pos += l;
-      }
-      return res;
-    },
-    decode: (buf) => {
-      abytes(buf, bytesLen, label);
-      const res = [];
-      for (const c of lengths) {
-        const l = getLength(c);
-        const b = buf.subarray(0, l);
-        res.push(typeof c === "number" ? b : c.decode(b));
-        buf = buf.subarray(l);
-      }
-      return res;
+  let envelope;
+  if (kem === "x25519") {
+    const slots = [];
+    for (let i = 0; i < n; i++) {
+      slots.push(
+        wrapSlotX25519({
+          pubR: recipientPublicKeys[i],
+          privEph: args.ephemeralSecrets ? args.ephemeralSecrets[i] : void 0,
+          cek,
+          nonce,
+          slotIdx: i
+        })
+      );
     }
-  };
-}
-function vecCoder(c, vecLen) {
-  const coder = c;
-  const bytesLen = vecLen * coder.bytesLen;
-  return {
-    bytesLen,
-    encode: (u) => {
-      if (u.length !== vecLen)
-        throw new RangeError(`vecCoder.encode: wrong length=${u.length}. Expected: ${vecLen}`);
-      const res = new Uint8Array(bytesLen);
-      for (let i = 0, pos = 0; i < u.length; i++) {
-        const b = coder.encode(u[i]);
-        res.set(b, pos);
-        b.fill(0);
-        pos += b.length;
-      }
-      return res;
-    },
-    decode: (a) => {
-      abytes(a, bytesLen);
-      const r = [];
-      for (let i = 0; i < a.length; i += coder.bytesLen)
-        r.push(coder.decode(a.subarray(i, i + coder.bytesLen)));
-      return r;
+    if (args.skipShuffle !== true) {
+      csprngShuffle(slots);
+    }
+    const slotsHash = computeSlotsHash({
+      aead: SEALED_POE_AEAD,
+      kem: "x25519",
+      nonce,
+      slots,
+      hashesHash
+    });
+    envelope = {
+      scheme: 1,
+      aead: SEALED_POE_AEAD,
+      kem: "x25519",
+      nonce,
+      slots,
+      slots_mac: sizedSlotsMac(cek, slotsHash)
+    };
+  } else {
+    const slots = [];
+    for (let i = 0; i < n; i++) {
+      slots.push(
+        wrapSlotMlkem768X25519({
+          pubR: recipientPublicKeys[i],
+          eseed: args.eseeds ? args.eseeds[i] : void 0,
+          cek,
+          nonce
+        })
+      );
     }
-  };
-}
-function cleanBytes(...list) {
-  for (const t of list) {
-    if (Array.isArray(t))
-      for (const b of t)
-        b.fill(0);
-    else
-      t.fill(0);
+    if (args.skipShuffle !== true) {
+      csprngShuffle(slots);
+    }
+    const slotsHash = computeSlotsHash({
+      aead: SEALED_POE_AEAD,
+      kem: "mlkem768x25519",
+      nonce,
+      slots,
+      hashesHash
+    });
+    envelope = {
+      scheme: 1,
+      aead: SEALED_POE_AEAD,
+      kem: "mlkem768x25519",
+      nonce,
+      slots,
+      slots_mac: sizedSlotsMac(cek, slotsHash)
+    };
   }
+  const ciphertext = streamSeal({
+    payloadKey: slotsPayloadKey({ cek, nonce }),
+    plaintext
+  });
+  return { envelope, ciphertext };
 }
-function getMask(bits) {
-  if (!Number.isSafeInteger(bits) || bits < 0 || bits > 32)
-    throw new RangeError(`expected bits in [0..32], got ${bits}`);
-  return bits === 32 ? 4294967295 : ~(-1 << bits) >>> 0;
+function sizedSlotsMac(cek, slotsHash) {
+  const slotsMac = computeSlotsMac({ cek, slotsHash });
+  if (slotsMac.length !== SLOTS_MAC_LENGTH) {
+    throw new Error(`internal: slots_mac.length=${slotsMac.length}, expected ${SLOTS_MAC_LENGTH}`);
+  }
+  return slotsMac;
 }
+new TextEncoder();
+new TextEncoder();
 
-// ../../node_modules/.pnpm/@noble+post-quantum@0.6.1/node_modules/@noble/post-quantum/_crystals.js
-var genCrystals = (opts2) => {
-  const { newPoly, N: N2, Q: Q2, F: F2, ROOT_OF_UNITY: ROOT_OF_UNITY2, brvBits} = opts2;
-  const mod = (a, modulo = Q2) => {
-    const result = a % modulo | 0;
-    return (result >= 0 ? result | 0 : modulo + result | 0) | 0;
-  };
-  const smod = (a, modulo = Q2) => {
-    const r = mod(a, modulo) | 0;
-    return (r > modulo >> 1 ? r - modulo | 0 : r) | 0;
-  };
-  function getZettas() {
-    const out = newPoly(N2);
-    for (let i = 0; i < N2; i++) {
-      const b = reverseBits(i, brvBits);
-      const p = BigInt(ROOT_OF_UNITY2) ** BigInt(b) % BigInt(Q2);
-      out[i] = Number(p) | 0;
-    }
-    return out;
+// src/client/off-host-sign.ts
+var EMPTY_BYTES2 = new Uint8Array(0);
+var ED25519_PUBLIC_KEY_LENGTH = 32;
+var ED25519_SIGNATURE_LENGTH = 64;
+function cloneToOwnedBuffer(src) {
+  const out = new Uint8Array(new ArrayBuffer(src.length));
+  out.set(src);
+  return out;
+}
+var OffHostSignError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "OffHostSignError";
+    this.code = code;
   }
-  const nttZetas = getZettas();
-  const field = {
-    add: (a, b) => mod((a | 0) + (b | 0)) | 0,
-    sub: (a, b) => mod((a | 0) - (b | 0)) | 0,
-    mul: (a, b) => mod((a | 0) * (b | 0)) | 0,
-    inv: (_a) => {
-      throw new Error("not implemented");
-    }
-  };
-  const nttOpts = {
-    N: N2,
-    roots: nttZetas,
-    invertButterflies: true,
-    skipStages: 1 ,
-    brp: false
-  };
-  const dif = FFTCore(field, { dit: false, ...nttOpts });
-  const dit = FFTCore(field, { dit: true, ...nttOpts });
-  const NTT = {
-    encode: (r) => {
-      return dif(r);
-    },
-    decode: (r) => {
-      dit(r);
-      for (let i = 0; i < r.length; i++)
-        r[i] = mod(F2 * r[i]);
-      return r;
-    }
-  };
-  const bitsCoder = (d, c) => {
-    const mask = getMask(d);
-    const bytesLen = d * (N2 / 8);
-    return {
-      bytesLen,
-      encode: (poly_) => {
-        const poly = poly_;
-        const r = new Uint8Array(bytesLen);
-        for (let i = 0, buf = 0, bufLen = 0, pos = 0; i < poly.length; i++) {
-          buf |= (c.encode(poly[i]) & mask) << bufLen;
-          bufLen += d;
-          for (; bufLen >= 8; bufLen -= 8, buf >>= 8)
-            r[pos++] = buf & getMask(bufLen);
-        }
-        return r;
-      },
-      decode: (bytes) => {
-        const r = newPoly(N2);
-        for (let i = 0, buf = 0, bufLen = 0, pos = 0; i < bytes.length; i++) {
-          buf |= bytes[i] << bufLen;
-          bufLen += 8;
-          for (; bufLen >= d; bufLen -= d, buf >>= d)
-            r[pos++] = c.decode(buf & mask);
-        }
-        return r;
-      }
-    };
-  };
-  return {
-    mod,
-    smod,
-    nttZetas,
-    NTT: {
-      encode: (r) => NTT.encode(r),
-      decode: (r) => NTT.decode(r)
-    },
-    bitsCoder
-  };
 };
-var createXofShake = (shake) => (seed, blockLen) => {
-  if (!blockLen)
-    blockLen = shake.blockLen;
-  const _seed = new Uint8Array(seed.length + 2);
-  _seed.set(seed);
-  const seedLen = seed.length;
-  const buf = new Uint8Array(blockLen);
-  let h = shake.create({});
-  let calls = 0;
-  let xofs = 0;
-  return {
-    stats: () => ({ calls, xofs }),
-    get: (x, y) => {
-      _seed[seedLen + 0] = x;
-      _seed[seedLen + 1] = y;
-      h.destroy();
-      h = shake.create({}).update(_seed);
-      calls++;
-      return () => {
-        xofs++;
-        return h.xofInto(buf);
-      };
-    },
-    clean: () => {
-      h.destroy();
-      cleanBytes(buf, _seed);
+function buildToSign(record) {
+  const body = encodeRecordBodyForSigning(record);
+  const out = new Uint8Array(CARDANO_POE_SIG_DOMAIN_PREFIX_BYTES.length + body.length);
+  out.set(CARDANO_POE_SIG_DOMAIN_PREFIX_BYTES, 0);
+  out.set(body, CARDANO_POE_SIG_DOMAIN_PREFIX_BYTES.length);
+  return out;
+}
+function encodePath1ProtectedHeader(signerPubkey) {
+  const protectedHeader = /* @__PURE__ */ new Map([
+    [1, -8],
+    [4, signerPubkey]
+  ]);
+  const protectedHeaderBytes = encodeCanonicalCbor(protectedHeader);
+  return { protectedHeader, protectedHeaderBytes };
+}
+function prepareSigStructure(args) {
+  if (args.signerPubkey.length !== ED25519_PUBLIC_KEY_LENGTH) {
+    throw new OffHostSignError(
+      "INVALID_PUBKEY_LENGTH",
+      `signerPubkey must be 32 bytes (Ed25519 raw public key), got ${args.signerPubkey.length}`
+    );
+  }
+  const { protectedHeaderBytes } = encodePath1ProtectedHeader(args.signerPubkey);
+  const recordBodyCbor = encodeRecordBodyForSigning(args.record);
+  const sigStructureBytes = buildLabel309SigStructure({
+    bodyProtectedBytes: protectedHeaderBytes,
+    recordBodyCbor
+  });
+  return { sigStructureBytes, protectedHeaderBytes };
+}
+function assembleCoseSign1(args) {
+  if (args.signerPubkey.length !== ED25519_PUBLIC_KEY_LENGTH) {
+    throw new OffHostSignError(
+      "INVALID_PUBKEY_LENGTH",
+      `signerPubkey must be 32 bytes (Ed25519 raw public key), got ${args.signerPubkey.length}`
+    );
+  }
+  if (args.signature.length !== ED25519_SIGNATURE_LENGTH) {
+    throw new OffHostSignError(
+      "INVALID_SIGNATURE_LENGTH",
+      `signature must be 64 bytes (Ed25519 raw signature), got ${args.signature.length}`
+    );
+  }
+  const { protectedHeader } = encodePath1ProtectedHeader(args.signerPubkey);
+  const coseSign1Bytes = encodeCoseSign1({
+    protectedHeader,
+    unprotectedHeader: /* @__PURE__ */ new Map(),
+    payload: null,
+    signature: args.signature
+  });
+  const sigEntry = { cose_sign1: cloneToOwnedBuffer(coseSign1Bytes) };
+  return { coseSign1Bytes, sigEntry };
+}
+function prepareSigStructureHashed(args) {
+  if (args.signerPubkey.length !== ED25519_PUBLIC_KEY_LENGTH) {
+    throw new OffHostSignError(
+      "INVALID_PUBKEY_LENGTH",
+      `signerPubkey must be 32 bytes (Ed25519 raw public key), got ${args.signerPubkey.length}`
+    );
+  }
+  const { protectedHeaderBytes } = encodePath1ProtectedHeader(args.signerPubkey);
+  const toSign = buildToSign(args.record);
+  const toSignHashBytes = blake2b224(toSign);
+  const sigStructureBytes = buildSigStructure({
+    context: "Signature1",
+    bodyProtectedBytes: protectedHeaderBytes,
+    externalAad: EMPTY_BYTES2,
+    payload: toSignHashBytes
+  });
+  return { sigStructureBytes, protectedHeaderBytes, toSignHashBytes };
+}
+function assembleCoseSign1Hashed(args) {
+  if (args.signerPubkey.length !== ED25519_PUBLIC_KEY_LENGTH) {
+    throw new OffHostSignError(
+      "INVALID_PUBKEY_LENGTH",
+      `signerPubkey must be 32 bytes (Ed25519 raw public key), got ${args.signerPubkey.length}`
+    );
+  }
+  if (args.signature.length !== ED25519_SIGNATURE_LENGTH) {
+    throw new OffHostSignError(
+      "INVALID_SIGNATURE_LENGTH",
+      `signature must be 64 bytes (Ed25519 raw signature), got ${args.signature.length}`
+    );
+  }
+  const { protectedHeader } = encodePath1ProtectedHeader(args.signerPubkey);
+  const unprotectedHeader = /* @__PURE__ */ new Map([["hashed", true]]);
+  const coseSign1Bytes = encodeCoseSign1({
+    protectedHeader,
+    unprotectedHeader,
+    payload: null,
+    signature: args.signature
+  });
+  const sigEntry = { cose_sign1: cloneToOwnedBuffer(coseSign1Bytes) };
+  return { coseSign1Bytes, sigEntry };
+}
+
+// src/client/http-error.ts
+var CANONICAL_PROBLEM_KEYS = /* @__PURE__ */ new Set([
+  "type",
+  "title",
+  "status",
+  "detail",
+  "code",
+  "trace_id",
+  "errors",
+  "instance"
+]);
+function extractProblemExtensions(problem) {
+  const out = {};
+  for (const [key, value] of Object.entries(problem)) {
+    if (!CANONICAL_PROBLEM_KEYS.has(key)) {
+      out[key] = value;
     }
-  };
+  }
+  return out;
+}
+var Label309HttpError = class extends Error {
+  problem;
+  code;
+  httpStatus;
+  title;
+  detail;
+  type;
+  traceId;
+  instance;
+  errors;
+  extensions;
+  requestId;
+  retryAfterSeconds;
+  constructor(init) {
+    super(init.problem.detail || `${init.problem.title} (HTTP ${init.problem.status})`);
+    this.name = "Label309HttpError";
+    this.problem = init.problem;
+    this.code = init.problem.code;
+    this.httpStatus = init.problem.status;
+    this.title = init.problem.title;
+    this.detail = init.problem.detail;
+    this.type = init.problem.type;
+    this.traceId = init.problem.trace_id;
+    this.instance = init.problem.instance;
+    this.errors = init.problem.errors;
+    this.extensions = init.extensions ?? extractProblemExtensions(init.problem);
+    this.requestId = init.requestId ?? init.problem.trace_id;
+    this.retryAfterSeconds = init.retryAfterSeconds;
+  }
 };
-var XOF128 = /* @__PURE__ */ createXofShake(shake128);
 
-// ../../node_modules/.pnpm/@noble+post-quantum@0.6.1/node_modules/@noble/post-quantum/ml-kem.js
-var N = 256;
-var Q = 3329;
-var F = 3303;
-var ROOT_OF_UNITY = 17;
-var crystals = /* @__PURE__ */ genCrystals({
-  N,
-  Q,
-  F,
-  ROOT_OF_UNITY,
-  newPoly: (n) => new Uint16Array(n),
-  brvBits: 7});
-var PARAMS = /* @__PURE__ */ (() => Object.freeze({
-  512: Object.freeze({ N, Q, K: 2, ETA1: 3, ETA2: 2, du: 10, dv: 4, RBGstrength: 128 }),
-  768: Object.freeze({ N, Q, K: 3, ETA1: 2, ETA2: 2, du: 10, dv: 4, RBGstrength: 192 }),
-  1024: Object.freeze({ N, Q, K: 4, ETA1: 2, ETA2: 2, du: 11, dv: 5, RBGstrength: 256 })
-}))();
-var compress = (d) => {
-  if (d >= 12)
-    return { encode: (i) => i, decode: (i) => i >= Q ? i - Q : i };
-  const a = 2 ** (d - 1);
-  return {
-    // This only matches standalone Compress_d after bitsCoder masks the result into Z_(2^d).
-    encode: (i) => ((i << d) + Q / 2) / Q,
-    // const decompress = (i: number) => round((Q / 2 ** d) * i);
-    decode: (i) => i * Q + a >>> d
-  };
+// src/client/batch-empty-error.ts
+var BatchEmptyError = class extends Label309HttpError {
+  constructor(init) {
+    super(init);
+    this.name = "BatchEmptyError";
+  }
 };
-var byteCoder = (d) => crystals.bitsCoder(d, { encode: (i) => i, decode: (i) => i >= Q ? i - Q : i } );
-var polyCoder = (d) => d === 12 ? byteCoder(12) : crystals.bitsCoder(d, compress(d));
-function polyAdd(a_, b_) {
-  const a = a_;
-  const b = b_;
-  for (let i = 0; i < N; i++)
-    a[i] = crystals.mod(a[i] + b[i]);
+
+// src/client/batch-too-large-error.ts
+function readInt(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : void 0;
 }
-function polySub(a_, b_) {
-  const a = a_;
-  const b = b_;
-  for (let i = 0; i < N; i++)
-    a[i] = crystals.mod(a[i] - b[i]);
+var BatchTooLargeError = class extends Label309HttpError {
+  max;
+  got;
+  constructor(init) {
+    super(init);
+    this.name = "BatchTooLargeError";
+    this.max = readInt(this.extensions["max"]);
+    this.got = readInt(this.extensions["got"]);
+  }
+};
+
+// src/client/forbidden-error.ts
+var ForbiddenError = class extends Label309HttpError {
+  constructor(init) {
+    super(init);
+    this.name = "ForbiddenError";
+  }
+};
+
+// src/client/idempotency-conflict-error.ts
+var IdempotencyConflictError = class extends Label309HttpError {
+  constructor(init) {
+    super(init);
+    this.name = "IdempotencyConflictError";
+  }
+};
+
+// src/client/insufficient-funds-error.ts
+function readBigIntString(value) {
+  if (typeof value !== "string") return void 0;
+  if (!/^-?[0-9]+$/.test(value)) return void 0;
+  try {
+    return BigInt(value);
+  } catch {
+    return void 0;
+  }
 }
-function BaseCaseMultiply(a0, a1, b0, b1, zeta) {
-  const c0 = crystals.mod(a1 * b1 * zeta + a0 * b0);
-  const c1 = crystals.mod(a0 * b1 + a1 * b0);
-  return { c0, c1 };
+function readString(value) {
+  return typeof value === "string" ? value : void 0;
 }
-function MultiplyNTTs(f_, g_) {
-  const f = f_;
-  const g = g_;
-  for (let i = 0; i < N / 2; i++) {
-    let z3 = crystals.nttZetas[64 + (i >> 1)];
-    if (i & 1)
-      z3 = -z3;
-    const { c0, c1 } = BaseCaseMultiply(f[2 * i + 0], f[2 * i + 1], g[2 * i + 0], g[2 * i + 1], z3);
-    f[2 * i + 0] = c0;
-    f[2 * i + 1] = c1;
+var InsufficientFundsError = class extends Label309HttpError {
+  balanceUsdMicros;
+  requiredUsdMicros;
+  topUpUrl;
+  constructor(init) {
+    super(init);
+    this.name = "InsufficientFundsError";
+    this.balanceUsdMicros = readBigIntString(this.extensions["balance_usd_micros"]);
+    this.requiredUsdMicros = readBigIntString(this.extensions["required_usd_micros"]);
+    this.topUpUrl = readString(this.extensions["top_up_url"]);
   }
-  return f;
+};
+
+// src/client/insufficient-scope-error.ts
+function readScopeArray(value) {
+  if (!Array.isArray(value)) return [];
+  return value.filter((entry) => typeof entry === "string");
 }
-function SampleNTT(xof_) {
-  const xof = xof_;
-  const r = new Uint16Array(N);
-  for (let j = 0; j < N; ) {
-    const b = xof();
-    if (b.length % 3)
-      throw new Error("SampleNTT: unaligned block");
-    for (let i = 0; j < N && i + 3 <= b.length; i += 3) {
-      const d1 = (b[i + 0] >> 0 | b[i + 1] << 8) & 4095;
-      const d2 = (b[i + 1] >> 4 | b[i + 2] << 4) & 4095;
-      if (d1 < Q)
-        r[j++] = d1;
-      if (j < N && d2 < Q)
-        r[j++] = d2;
-    }
+var InsufficientScopeError = class extends Label309HttpError {
+  requiredScopes;
+  grantedScopes;
+  constructor(init) {
+    super(init);
+    this.name = "InsufficientScopeError";
+    this.requiredScopes = readScopeArray(this.extensions["required"]);
+    this.grantedScopes = readScopeArray(this.extensions["granted"]);
   }
-  return r;
+  /** Convenience for the single-scope case; first entry of `requiredScopes`. */
+  get requiredScope() {
+    return this.requiredScopes[0];
+  }
+};
+
+// src/client/internal-server-error.ts
+var InternalServerError = class extends Label309HttpError {
+  constructor(init) {
+    super(init);
+    this.name = "InternalServerError";
+  }
+};
+
+// src/client/invalid-body-error.ts
+var InvalidBodyError = class extends Label309HttpError {
+  constructor(init) {
+    super(init);
+    this.name = "InvalidBodyError";
+  }
+};
+
+// src/client/malformed-cbor-error.ts
+var MalformedCborError = class extends Label309HttpError {
+  constructor(init) {
+    super(init);
+    this.name = "MalformedCborError";
+  }
+};
+
+// src/client/not-found-error.ts
+var NotFoundError = class extends Label309HttpError {
+  constructor(init) {
+    super(init);
+    this.name = "NotFoundError";
+  }
+};
+
+// src/client/quote-already-consumed-error.ts
+function readString2(value) {
+  return typeof value === "string" ? value : void 0;
 }
-var sampleCBDBytes = (buf, eta) => {
-  const r = new Uint16Array(N);
-  const b32 = u32(buf);
-  swap32IfBE(b32);
-  let len = 0;
-  for (let i = 0, p = 0, bb = 0, t0 = 0; i < b32.length; i++) {
-    let b = b32[i];
-    for (let j = 0; j < 32; j++) {
-      bb += b & 1;
-      b >>= 1;
-      len += 1;
-      if (len === eta) {
-        t0 = bb;
-        bb = 0;
-      } else if (len === 2 * eta) {
-        r[p++] = crystals.mod(t0 - bb);
-        bb = 0;
-        len = 0;
-      }
-    }
+var QuoteAlreadyConsumedError = class extends Label309HttpError {
+  quoteId;
+  constructor(init) {
+    super(init);
+    this.name = "QuoteAlreadyConsumedError";
+    this.quoteId = readString2(this.extensions["quote_id"]);
   }
-  swap32IfBE(b32);
-  if (len)
-    throw new Error(`sampleCBD: leftover bits: ${len}`);
-  return r;
 };
-function sampleCBD(PRF_, seed, nonce, eta) {
-  const PRF = PRF_;
-  return sampleCBDBytes(PRF(eta * N / 4, seed, nonce), eta);
+
+// src/client/quote-expired-error.ts
+function readString3(value) {
+  return typeof value === "string" ? value : void 0;
 }
-var genKPKE = (opts_) => {
-  const opts2 = opts_;
-  const { K, PRF, XOF, HASH512, ETA1, ETA2, du, dv } = opts2;
-  const poly1 = polyCoder(1);
-  const polyV = polyCoder(dv);
-  const polyU = polyCoder(du);
-  const publicCoder = splitCoder("publicKey", vecCoder(polyCoder(12), K), 32);
-  const secretCoder = vecCoder(polyCoder(12), K);
-  const cipherCoder = splitCoder("ciphertext", vecCoder(polyU, K), polyV);
-  const seedCoder = splitCoder("seed", 32, 32);
-  return {
-    secretCoder,
-    lengths: {
-      secretKey: secretCoder.bytesLen,
-      publicKey: publicCoder.bytesLen,
-      cipherText: cipherCoder.bytesLen
-    },
-    keygen: (seed) => {
-      abytesDoc(seed, 32, "seed");
-      const seedDst = new Uint8Array(33);
-      seedDst.set(seed);
-      seedDst[32] = K;
-      const seedHash = HASH512(seedDst);
-      const [rho, sigma] = seedCoder.decode(seedHash);
-      const sHat = [];
-      const tHat = [];
-      for (let i = 0; i < K; i++)
-        sHat.push(crystals.NTT.encode(sampleCBD(PRF, sigma, i, ETA1)));
-      const x = XOF(rho);
-      for (let i = 0; i < K; i++) {
-        const e = crystals.NTT.encode(sampleCBD(PRF, sigma, K + i, ETA1));
-        for (let j = 0; j < K; j++) {
-          const aji = SampleNTT(x.get(j, i));
-          polyAdd(e, MultiplyNTTs(aji, sHat[j]));
-        }
-        tHat.push(e);
-      }
-      x.clean();
-      const res = {
-        publicKey: publicCoder.encode([tHat, rho]),
-        secretKey: secretCoder.encode(sHat)
-      };
-      cleanBytes(rho, sigma, sHat, tHat, seedDst, seedHash);
-      return res;
-    },
-    encrypt: (publicKey, msg, seed) => {
-      const [tHat, rho] = publicCoder.decode(publicKey);
-      const rHat = [];
-      for (let i = 0; i < K; i++)
-        rHat.push(crystals.NTT.encode(sampleCBD(PRF, seed, i, ETA1)));
-      const x = XOF(rho);
-      const tmp2 = new Uint16Array(N);
-      const u = [];
-      for (let i = 0; i < K; i++) {
-        const e1 = sampleCBD(PRF, seed, K + i, ETA2);
-        const tmp = new Uint16Array(N);
-        for (let j = 0; j < K; j++) {
-          const aij = SampleNTT(x.get(i, j));
-          polyAdd(tmp, MultiplyNTTs(aij, rHat[j]));
-        }
-        polyAdd(e1, crystals.NTT.decode(tmp));
-        u.push(e1);
-        polyAdd(tmp2, MultiplyNTTs(tHat[i], rHat[i]));
-        cleanBytes(tmp);
-      }
-      x.clean();
-      const e2 = sampleCBD(PRF, seed, 2 * K, ETA2);
-      polyAdd(e2, crystals.NTT.decode(tmp2));
-      const v = poly1.decode(msg);
-      polyAdd(v, e2);
-      cleanBytes(tHat, rHat, tmp2, e2);
-      return cipherCoder.encode([u, v]);
-    },
-    decrypt: (cipherText, privateKey) => {
-      const [u, v] = cipherCoder.decode(cipherText);
-      const sk = secretCoder.decode(privateKey);
-      const tmp = new Uint16Array(N);
-      for (let i = 0; i < K; i++)
-        polyAdd(tmp, MultiplyNTTs(sk[i], crystals.NTT.encode(u[i])));
-      polySub(v, crystals.NTT.decode(tmp));
-      cleanBytes(tmp, sk, u);
-      return poly1.encode(v);
-    }
-  };
+var QuoteExpiredError = class extends Label309HttpError {
+  quoteId;
+  constructor(init) {
+    super(init);
+    this.name = "QuoteExpiredError";
+    this.quoteId = readString3(this.extensions["quote_id"]);
+  }
 };
-function createKyber(opts2) {
-  const rawOpts = opts2;
-  const KPKE = genKPKE(rawOpts);
-  const { HASH256, HASH512, KDF } = rawOpts;
-  const { secretCoder: KPKESecretCoder, lengths } = KPKE;
-  const secretCoder = splitCoder("secretKey", lengths.secretKey, lengths.publicKey, 32, 32);
-  const msgLen = 32;
-  const seedLen = 64;
-  const kemLengths = Object.freeze({
-    ...lengths,
-    seed: 64,
-    msg: msgLen,
-    msgRand: msgLen,
-    secretKey: secretCoder.bytesLen
-  });
-  return Object.freeze({
-    info: Object.freeze({ type: "ml-kem" }),
-    lengths: kemLengths,
-    keygen: (seed = randomBytes(seedLen)) => {
-      abytesDoc(seed, seedLen, "seed");
-      const { publicKey, secretKey: sk } = KPKE.keygen(seed.subarray(0, 32));
-      const publicKeyHash = HASH256(publicKey);
-      const secretKey = secretCoder.encode([sk, publicKey, publicKeyHash, seed.subarray(32)]);
-      cleanBytes(sk, publicKeyHash);
-      return {
-        publicKey,
-        secretKey
-      };
-    },
-    getPublicKey: (secretKey) => {
-      const [_sk, publicKey, _publicKeyHash, _z] = secretCoder.decode(secretKey);
-      return Uint8Array.from(publicKey);
-    },
-    encapsulate: (publicKey, msg = randomBytes(msgLen)) => {
-      abytesDoc(publicKey, lengths.publicKey, "publicKey");
-      abytesDoc(msg, msgLen, "message");
-      const eke = publicKey.subarray(0, 384 * opts2.K);
-      const ek = KPKESecretCoder.encode(KPKESecretCoder.decode(copyBytes(eke)));
-      if (!equalBytes(ek, eke)) {
-        cleanBytes(ek);
-        throw new Error("ML-KEM.encapsulate: wrong publicKey modulus");
-      }
-      cleanBytes(ek);
-      const kr = HASH512.create().update(msg).update(HASH256(publicKey)).digest();
-      const cipherText = KPKE.encrypt(publicKey, msg, kr.subarray(32, 64));
-      cleanBytes(kr.subarray(32));
-      return {
-        cipherText,
-        sharedSecret: kr.subarray(0, 32)
-      };
-    },
-    decapsulate: (cipherText, secretKey) => {
-      abytesDoc(secretKey, secretCoder.bytesLen, "secretKey");
-      abytesDoc(cipherText, lengths.cipherText, "cipherText");
-      const k768 = secretCoder.bytesLen - 96;
-      const start = k768 + 32;
-      const test = HASH256(secretKey.subarray(k768 / 2, start));
-      if (!equalBytes(test, secretKey.subarray(start, start + 32)))
-        throw new Error("invalid secretKey: hash check failed");
-      const [sk, publicKey, publicKeyHash, z3] = secretCoder.decode(secretKey);
-      const msg = KPKE.decrypt(cipherText, sk);
-      const kr = HASH512.create().update(msg).update(publicKeyHash).digest();
-      const Khat = kr.subarray(0, 32);
-      const cipherText2 = KPKE.encrypt(publicKey, msg, kr.subarray(32, 64));
-      const isValid = equalBytes(cipherText, cipherText2);
-      const Kbar = KDF.create({ dkLen: 32 }).update(z3).update(cipherText).digest();
-      cleanBytes(msg, cipherText2, !isValid ? Khat : Kbar);
-      return isValid ? Khat : Kbar;
-    }
-  });
-}
-function shakePRF(dkLen, key, nonce) {
-  return shake256.create({ dkLen }).update(key).update(new Uint8Array([nonce])).digest();
+
+// src/client/quote-not-found-error.ts
+function readString4(value) {
+  return typeof value === "string" ? value : void 0;
 }
-var opts = /* @__PURE__ */ (() => ({
-  HASH256: sha3_256,
-  HASH512: sha3_512,
-  KDF: shake256,
-  XOF: XOF128,
-  PRF: shakePRF
-}))();
-var mk = (params) => createKyber({
-  ...opts,
-  ...params
-});
-var ml_kem768 = /* @__PURE__ */ (() => mk(PARAMS[768]))();
+var QuoteNotFoundError = class extends Label309HttpError {
+  quoteId;
+  constructor(init) {
+    super(init);
+    this.name = "QuoteNotFoundError";
+    this.quoteId = readString4(this.extensions["quote_id"]);
+  }
+};
 
-// ../../node_modules/.pnpm/@noble+post-quantum@0.6.1/node_modules/@noble/post-quantum/hybrid.js
-function ecKeygen(curve, allowZeroKey = false) {
-  const lengths = curve.lengths;
-  let keygen = curve.keygen;
-  if (allowZeroKey) {
-    if (!("getSharedSecret" in curve && "sign" in curve && "verify" in curve))
-      throw new Error("allowZeroKey requires a Weierstrass curve");
-    const wCurve = curve;
-    const Fn = wCurve.Point.Fn;
-    keygen = (seed = randomBytes(lengths.seed)) => {
-      abytes(seed, lengths.seed, "seed");
-      const seedScalar = Fn.isLE ? bytesToNumberLE(seed) : bytesToNumberBE(seed);
-      const secretKey = Fn.toBytes(Fn.create(seedScalar));
-      return {
-        secretKey,
-        publicKey: curve.getPublicKey(secretKey)
-      };
-    };
+// src/client/rate-limited-error.ts
+var RateLimitedError = class extends Label309HttpError {
+  constructor(init) {
+    super(init);
+    this.name = "RateLimitedError";
+  }
+};
+
+// src/client/record-not-found-error.ts
+var RecordNotFoundError = class extends Label309HttpError {
+  constructor(init) {
+    super(init);
+    this.name = "RecordNotFoundError";
+  }
+};
+
+// src/client/service-unavailable-error.ts
+var ServiceUnavailableError = class extends Label309HttpError {
+  constructor(init) {
+    super(init);
+    this.name = "ServiceUnavailableError";
+  }
+};
+
+// src/client/unauthorized-error.ts
+var UnauthorizedError = class extends Label309HttpError {
+  constructor(init) {
+    super(init);
+    this.name = "UnauthorizedError";
+  }
+};
+
+// src/client/validation-failed-error.ts
+var ValidationFailedError = class extends Label309HttpError {
+  constructor(init) {
+    super(init);
+    this.name = "ValidationFailedError";
+  }
+};
+
+// src/client/parse-http-error.ts
+function asString(value) {
+  return typeof value === "string" ? value : void 0;
+}
+function asNumber(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+}
+function asProblemErrorEntries(value) {
+  if (!Array.isArray(value)) return void 0;
+  const out = [];
+  for (const entry of value) {
+    if (entry === null || typeof entry !== "object") continue;
+    const e = entry;
+    out.push({
+      field: typeof e["field"] === "string" ? e["field"] : "",
+      code: typeof e["code"] === "string" ? e["code"] : "",
+      detail: typeof e["detail"] === "string" ? e["detail"] : ""
+    });
   }
-  return {
-    lengths: { secretKey: lengths.secretKey, publicKey: lengths.publicKey, seed: lengths.seed },
-    keygen: (seed) => keygen(seed),
-    getPublicKey: (secretKey) => curve.getPublicKey(secretKey)
-  };
+  return out;
 }
-function ecdhKem(curve, allowZeroKey = false) {
-  const kg = ecKeygen(curve, allowZeroKey);
-  if (!curve.getSharedSecret)
-    throw new Error("wrong curve");
+function synthesiseProblem(httpStatus, requestId) {
+  const code = `http-${httpStatus}`;
   return {
-    lengths: { ...kg.lengths, msg: kg.lengths.seed, cipherText: kg.lengths.publicKey },
-    keygen: kg.keygen,
-    getPublicKey: kg.getPublicKey,
-    encapsulate(publicKey, rand = randomBytes(curve.lengths.seed)) {
-      const seed = copyBytes(rand);
-      let ek = void 0;
-      try {
-        ek = this.keygen(seed).secretKey;
-        const sharedSecret = this.decapsulate(publicKey, ek);
-        const cipherText = curve.getPublicKey(ek);
-        return { sharedSecret, cipherText };
-      } finally {
-        cleanBytes(seed);
-        if (ek)
-          cleanBytes(ek);
-      }
-    },
-    decapsulate(cipherText, secretKey) {
-      const res = curve.getSharedSecret(secretKey, cipherText);
-      return curve.lengths.publicKeyHasPrefix ? res.subarray(1) : res;
-    }
+    type: `about:blank`,
+    title: `HTTP ${httpStatus}`,
+    status: httpStatus,
+    detail: `Server returned HTTP ${httpStatus} without a problem+json body.`,
+    code,
+    trace_id: requestId ?? ""
   };
 }
-function splitLengths(lst, name) {
-  return splitCoder(name, ...lst.map((i) => {
-    if (typeof i.lengths[name] !== "number")
-      throw new Error("wrong length: " + name);
-    return i.lengths[name];
-  }));
-}
-function expandSeedXof(xof) {
-  return ((seed, seedLen) => xof(seed, { dkLen: seedLen }));
-}
-function combineKeys(realSeedLen, expandSeed_, ...ck_) {
-  const expandSeed = expandSeed_;
-  const ck = ck_;
-  const seedCoder = splitLengths(ck, "seed");
-  const pkCoder = splitLengths(ck, "publicKey");
-  anumber(realSeedLen);
-  function expandDecapsulationKey(seed) {
-    abytes(seed, realSeedLen);
-    const expandedRaw = expandSeed(seed, seedCoder.bytesLen);
-    const expandedSeed = expandedRaw.buffer === seed.buffer ? copyBytes(expandedRaw) : expandedRaw;
-    const expanded = [];
-    const keySecret = [];
-    const secretKey = [];
-    const publicKey = [];
-    let ok = false;
-    try {
-      for (const part of seedCoder.decode(expandedSeed))
-        expanded.push(copyBytes(part));
-      for (let i = 0; i < ck.length; i++) {
-        const keys = ck[i].keygen(expanded[i]);
-        keySecret.push(keys.secretKey);
-        secretKey.push(copyBytes(keys.secretKey));
-        publicKey.push(keys.publicKey);
-      }
-      ok = true;
-      return { secretKey, publicKey };
-    } finally {
-      cleanBytes(expandedSeed, expanded, keySecret);
-      if (!ok)
-        cleanBytes(secretKey);
-    }
+function toProblemDetails(httpStatus, body, requestId) {
+  if (body === null || typeof body !== "object") {
+    return synthesiseProblem(httpStatus, requestId);
   }
-  return {
-    info: { lengths: { seed: realSeedLen, publicKey: pkCoder.bytesLen, secretKey: realSeedLen } },
-    getPublicKey(secretKey) {
-      return this.keygen(secretKey).publicKey;
-    },
-    keygen(seed = randomBytes(realSeedLen)) {
-      const { publicKey: pk, secretKey } = expandDecapsulationKey(seed);
-      try {
-        const publicKey = pkCoder.encode(pk);
-        return { secretKey: seed, publicKey };
-      } finally {
-        cleanBytes(pk);
-        cleanBytes(secretKey);
-      }
-    },
-    expandDecapsulationKey,
-    realSeedLen
+  const b = body;
+  const code = asString(b["code"]);
+  const status = asNumber(b["status"]) ?? httpStatus;
+  const title = asString(b["title"]);
+  if (code === void 0 && title === void 0) {
+    return synthesiseProblem(httpStatus, requestId);
+  }
+  const errors = asProblemErrorEntries(b["errors"]);
+  const base = {
+    ...b,
+    // RFC 7807 §4.2: `about:blank` is the default when no type URI is supplied.
+    // The client is gateway-agnostic, so it must not invent a vendor-specific
+    // problem-type namespace; the machine-readable discriminator is `code`.
+    type: asString(b["type"]) ?? "about:blank",
+    title: title ?? `HTTP ${status}`,
+    status,
+    detail: asString(b["detail"]) ?? "",
+    code: code ?? `http-${status}`,
+    trace_id: asString(b["trace_id"]) ?? requestId ?? ""
   };
+  if (errors !== void 0) base["errors"] = errors;
+  return base;
 }
-function combineKEMS(realSeedLen, realMsgLen, expandSeed, combiner, ...kems) {
-  const rawCombiner = combiner;
-  const rawKems = kems;
-  const keys = combineKeys(realSeedLen, expandSeed, ...rawKems);
-  const ctCoder = splitLengths(rawKems, "cipherText");
-  const pkCoder = splitLengths(rawKems, "publicKey");
-  const msgCoder = splitLengths(rawKems, "msg");
-  anumber(realMsgLen);
-  const lengths = Object.freeze({
-    ...keys.info.lengths,
-    msg: realMsgLen,
-    msgRand: msgCoder.bytesLen,
-    cipherText: ctCoder.bytesLen
-  });
-  return Object.freeze({
-    lengths,
-    getPublicKey: keys.getPublicKey,
-    keygen: keys.keygen,
-    encapsulate(pk, randomness = randomBytes(msgCoder.bytesLen)) {
-      const pks = pkCoder.decode(pk);
-      const rand = msgCoder.decode(randomness);
-      const sharedSecret = [];
-      const cipherText = [];
-      try {
-        for (let i = 0; i < rawKems.length; i++) {
-          const enc = rawKems[i].encapsulate(pks[i], rand[i]);
-          sharedSecret.push(enc.sharedSecret);
-          cipherText.push(enc.cipherText);
-        }
-        return {
-          // Detach the combiner result before cleanup: a caller-provided combiner may alias one of
-          // the child sharedSecret buffers, and those child buffers are zeroized immediately below.
-          sharedSecret: copyBytes(rawCombiner(pks, cipherText, sharedSecret)),
-          cipherText: ctCoder.encode(cipherText)
-        };
-      } finally {
-        cleanBytes(sharedSecret, cipherText);
-      }
-    },
-    decapsulate(ct, seed) {
-      const cts = ctCoder.decode(ct);
-      const { publicKey, secretKey } = keys.expandDecapsulationKey(seed);
-      const sharedSecret = rawKems.map((i, j) => i.decapsulate(cts[j], secretKey[j]));
-      try {
-        return copyBytes(rawCombiner(publicKey, cts, sharedSecret));
-      } finally {
-        cleanBytes(secretKey, sharedSecret);
-      }
-    }
-  });
+function parseHttpError(args) {
+  const problem = toProblemDetails(args.httpStatus, args.body, args.requestId);
+  const extensions = extractProblemExtensions(problem);
+  const init = {
+    problem,
+    extensions,
+    requestId: args.requestId,
+    retryAfterSeconds: args.retryAfterSeconds
+  };
+  switch (problem.code) {
+    case "unauthorized":
+      return new UnauthorizedError(init);
+    case "forbidden":
+    case "csrf-invalid":
+      return new ForbiddenError(init);
+    case "insufficient-scope":
+      return new InsufficientScopeError(init);
+    // The three 402 funding/affordability failures are one condition to a
+    // caller: the account cannot fund the operation. `insufficient-funds` is the
+    // balance shortfall; `insufficient-storage-credit` is the storage funding
+    // source being out of credit; `no-funding-grant` is the absence of any
+    // funding source entitling the account beyond the free window. All three
+    // surface as the same funding error so a caller routes the user to top up
+    // without branching on the code.
+    case "insufficient-funds":
+    case "insufficient-storage-credit":
+    case "no-funding-grant":
+      return new InsufficientFundsError(init);
+    case "quote-expired":
+      return new QuoteExpiredError(init);
+    case "quote-not-found":
+      return new QuoteNotFoundError(init);
+    case "quote-already-consumed":
+      return new QuoteAlreadyConsumedError(init);
+    case "not-found":
+      return new NotFoundError(init);
+    case "record-not-found":
+      return new RecordNotFoundError(init);
+    case "idempotency-key-conflict":
+      return new IdempotencyConflictError(init);
+    case "rate-limited":
+      return new RateLimitedError(init);
+    case "validation-failed":
+      return new ValidationFailedError(init);
+    case "invalid-body":
+      return new InvalidBodyError(init);
+    case "malformed-cbor":
+      return new MalformedCborError(init);
+    case "batch-too-large":
+      return new BatchTooLargeError(init);
+    case "batch-empty":
+      return new BatchEmptyError(init);
+    case "internal-error":
+      return new InternalServerError(init);
+    // A gateway that prices on a live FX oracle may surface a transient
+    // `fx-stale` pricing outage; to a vendor-neutral client that is just a
+    // temporary inability to serve, i.e. a service-unavailable condition.
+    case "service-unavailable":
+    case "fx-stale":
+      return new ServiceUnavailableError(init);
+    default:
+      return new Label309HttpError(init);
+  }
+}
+
+// src/client/http-helpers.ts
+async function readJson(response) {
+  const text = await response.text();
+  if (text.length === 0) return null;
+  try {
+    return JSON.parse(text);
+  } catch {
+    return null;
+  }
 }
-var x25519kem = /* @__PURE__ */ ecdhKem(x25519);
-var ml_kem768_x25519 = /* @__PURE__ */ (() => combineKEMS(
-  32,
-  32,
-  expandSeedXof(shake256),
-  // Awesome label, so much escaping hell in a single line.
-  (pk, ct, ss) => sha3_256(concatBytes(ss[0], ss[1], ct[1], pk[1], asciiToBytes("\\.//^\\"))),
-  ml_kem768,
-  x25519kem
-))();
-var XWing = /* @__PURE__ */ (() => ml_kem768_x25519)();
-function chacha20Poly1305Encrypt(opts2) {
-  return chacha20poly1305(opts2.key, opts2.nonce, opts2.aad).encrypt(opts2.plaintext);
+function parseRetryAfter(header) {
+  if (header === null) return void 0;
+  const parsed = Number(header);
+  return Number.isFinite(parsed) ? parsed : void 0;
 }
-function xchacha20Poly1305Encrypt(opts2) {
-  return xchacha20poly1305(opts2.key, opts2.nonce, opts2.aad).encrypt(opts2.plaintext);
+async function throwIfNotOk(response) {
+  if (response.ok) return;
+  const body = await readJson(response);
+  const requestId = response.headers.get("x-request-id") ?? void 0;
+  const retryAfterSeconds = parseRetryAfter(response.headers.get("retry-after"));
+  throw parseHttpError({ httpStatus: response.status, body, requestId, retryAfterSeconds });
 }
-function hkdfSha256(opts2) {
-  return hkdf(sha256$1, opts2.ikm, opts2.salt, opts2.info, opts2.length);
+
+// src/client/account.ts
+function buildHeaders(apiKey) {
+  const headers = new Headers({
+    "content-type": "application/json",
+    accept: "application/json"
+  });
+  if (apiKey !== void 0) headers.set("authorization", `Bearer ${apiKey}`);
+  return headers;
 }
-var MLKEM768X25519_PUBLIC_KEY_LENGTH = 1216;
-var MLKEM768X25519_ENC_LENGTH = 1120;
-var MLKEM768X25519_ESEED_LENGTH = 64;
-function mlkem768x25519Encapsulate(opts2) {
-  if (opts2.publicKey.length !== MLKEM768X25519_PUBLIC_KEY_LENGTH) {
-    throw new Error(
-      `mlkem768x25519 public key must be ${MLKEM768X25519_PUBLIC_KEY_LENGTH} bytes, got ${opts2.publicKey.length}`
-    );
+var AccountNamespace = class {
+  config;
+  constructor(config) {
+    this.config = config;
   }
-  if (opts2.eseed !== void 0 && opts2.eseed.length !== MLKEM768X25519_ESEED_LENGTH) {
-    throw new Error(
-      `mlkem768x25519 eseed must be ${MLKEM768X25519_ESEED_LENGTH} bytes, got ${opts2.eseed.length}`
-    );
+  /**
+   * Fetch the caller's current prepaid USD balance.
+   *
+   * Returns `{ balanceUsdMicros }`, the gateway's `balance_usd_micros` field
+   * (USD micro-cents as a decimal string). The string is preserved verbatim —
+   * never parsed into a number — so no precision is lost. An account with no
+   * ledger activity yet reads `"0"`.
+   *
+   * Requires authentication: 401 (UnauthorizedError) when anonymous, 403
+   * (InsufficientScopeError) when the Bearer key lacks the `account:read`
+   * scope.
+   */
+  async balance() {
+    const response = await this.config.fetch(`${this.config.baseUrl}/api/v1/account/balance`, {
+      method: "GET",
+      headers: buildHeaders(this.config.apiKey)
+    });
+    await throwIfNotOk(response);
+    const body = await readJson(response);
+    return { balanceUsdMicros: body.balance_usd_micros };
   }
-  const { cipherText, sharedSecret } = XWing.encapsulate(opts2.publicKey, opts2.eseed);
-  return { enc: cipherText, ss: sharedSecret };
-}
-var X25519LowOrderPointError = class extends Error {
-  code = "X25519_LOW_ORDER_POINT";
-  constructor(options) {
-    super("x25519 ECDH rejected: peer public key is a small-order point", options);
-    this.name = "X25519LowOrderPointError";
+};
+
+// src/client/invalid-client-config-error.ts
+var InvalidClientConfigError = class extends Error {
+  code = "INVALID_CLIENT_CONFIG";
+  constructor(message) {
+    super(message);
+    this.name = "InvalidClientConfigError";
   }
 };
-var NOBLE_LOW_ORDER_MESSAGE = "invalid private or public key received";
-function x25519PublicKey(opts2) {
-  return x25519.getPublicKey(opts2.secretKey);
+
+// src/hex.ts
+function bytesToHex(bytes) {
+  return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
 }
-function x25519Ecdh(opts2) {
-  try {
-    return x25519.getSharedSecret(opts2.secretKey, opts2.theirPublicKey);
-  } catch (e) {
-    if (e instanceof Error && e.message === NOBLE_LOW_ORDER_MESSAGE) {
-      throw new X25519LowOrderPointError({ cause: e });
-    }
-    throw e;
+
+// src/client/partial-upload-error.ts
+var PartialUploadError = class extends Error {
+  response;
+  failed;
+  constructor(response) {
+    const failed = response.uploads.filter((u) => u.ok === false);
+    super(
+      `${failed.length} of ${response.uploads.length} upload(s) failed: ${failed.map((f) => `[${f.idx}] ${f.error.code} \u2014 ${f.error.detail}`).join("; ")}`
+    );
+    this.name = "PartialUploadError";
+    this.response = response;
+    this.failed = failed;
   }
-}
-var EciesSealedPoeError = class extends Error {
-  code;
-  constructor(code, message, options) {
-    super(message, options);
-    this.name = "EciesSealedPoeError";
-    this.code = code;
+  /** Convenience: the `idx` of every failed entry, in input order. */
+  get failedIndices() {
+    return this.failed.map((f) => f.idx);
   }
 };
 function encodeCanonicalCbor4(value) {
@@ -1678,318 +2230,547 @@ function encodeCanonicalCbor4(value) {
     sortKeys: sortCoreDeterministic
   });
 }
-var CHUNK_MAX_BYTES2 = 64;
-function chunkKemCt(value) {
-  if (value.length === 0) {
-    throw new Error("chunkKemCt: refusing to chunk an empty byte string");
+var LEAVES_LIST_FORMAT_V1 = "cardano-poe-merkle-leaves-v1";
+var TREE_ALG_RFC9162 = "rfc9162-sha256";
+var DIGEST_LENGTH2 = 32;
+var MerkleLeavesListError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message ? `${code}: ${message}` : code);
+    this.code = code;
+    this.name = "MerkleLeavesListError";
+  }
+};
+function encodeLeavesList(args) {
+  if (!(args.root instanceof Uint8Array) || args.root.length !== DIGEST_LENGTH2) {
+    throw new MerkleLeavesListError(
+      "SCHEMA_MERKLE_LEAVES_MALFORMED",
+      `root must be a Uint8Array(${DIGEST_LENGTH2})`
+    );
+  }
+  if (args.leaves.length < 1) {
+    throw new MerkleLeavesListError(
+      "SCHEMA_MERKLE_LEAVES_MALFORMED",
+      "leaves array must be non-empty"
+    );
+  }
+  const leavesCopy = [];
+  for (let i = 0; i < args.leaves.length; i++) {
+    const leaf = args.leaves[i];
+    if (!(leaf instanceof Uint8Array) || leaf.length !== DIGEST_LENGTH2) {
+      throw new MerkleLeavesListError(
+        "SCHEMA_MERKLE_LEAVES_MALFORMED",
+        `leaves[${i}] must be a Uint8Array(${DIGEST_LENGTH2})`
+      );
+    }
+    leavesCopy.push(leaf);
+  }
+  if (args.leafAlg !== void 0 && typeof args.leafAlg !== "string") {
+    throw new MerkleLeavesListError(
+      "SCHEMA_MERKLE_LEAVES_MALFORMED",
+      "leaf_alg must be a string when present"
+    );
   }
-  const chunks = [];
-  for (let i = 0; i < value.length; i += CHUNK_MAX_BYTES2) {
-    chunks.push(value.subarray(i, Math.min(i + CHUNK_MAX_BYTES2, value.length)));
+  const map = {
+    format: LEAVES_LIST_FORMAT_V1,
+    tree_alg: TREE_ALG_RFC9162,
+    root: args.root,
+    leaves: leavesCopy,
+    leaf_count: leavesCopy.length
+  };
+  if (args.leafAlg !== void 0) {
+    map["leaf_alg"] = args.leafAlg;
   }
-  return chunks;
+  return encodeCanonicalCbor4(map);
 }
-function joinKemCt(chunks) {
-  let total = 0;
-  for (const c of chunks) total += c.length;
-  const out = new Uint8Array(total);
-  let offset = 0;
-  for (const c of chunks) {
-    out.set(c, offset);
-    offset += c.length;
+
+// src/client/resumable-source.ts
+var openHandlePromise;
+async function loadOpen() {
+  if (openHandlePromise === void 0) {
+    openHandlePromise = import('fs/promises').then((fs) => fs.open);
   }
-  return out;
+  return openHandlePromise;
 }
-function slotsToMacCbor(slots, kem) {
-  let value;
-  if (kem === "x25519") {
-    value = slots.map((s) => ({ epk: s.epk, wrap: s.wrap }));
-  } else {
-    value = slots.map((s) => ({
-      // Canonicalize the chunk boundaries before the MAC commits to them:
-      // reassemble the logical ciphertext and re-split into canonical ≤ 64-byte
-      // chunks. The on-wire `kem_ct` array is a transport detail (the Cardano
-      // ledger's 64-byte metadatum cap), and a hostile or non-canonical chunking
-      // ([1, 63, …] instead of [64, …]) reassembles to the SAME bytes — so the
-      // MAC must be invariant to it. Committing to the verbatim wire chunks would
-      // let an attacker re-chunk an honest envelope and break the slots_mac match
-      // for an honest recipient. Honest (already-64B-chunked) records are
-      // unchanged; a real byte flip still changes the reassembled bytes and is
-      // still rejected.
-      kem_ct: chunkKemCt(joinKemCt(s.kem_ct)),
-      wrap: s.wrap
-    }));
-  }
-  return encodeCanonicalCbor4(value);
+var HASH_STREAM_CHUNK_BYTES = 1024 * 1024;
+function isResumableSource(value) {
+  return typeof value === "object" && value !== null && typeof value.size === "number" && typeof value.slice === "function" && typeof value.stream === "function" && // A Blob/File shares all three members but exposes `.arrayBuffer`; exclude it
+  // here so the adapter contract is unambiguous regardless of check order. A
+  // Blob is handled by its own branch, which adapts `.slice`/`.stream` to bytes.
+  typeof value.arrayBuffer !== "function";
 }
-var CARDANO_POE_HKDF_INFO_KEK = new TextEncoder().encode("cardano-poe-kek-v1");
-var CARDANO_POE_HKDF_INFO_KEK_MLKEM768X25519 = new TextEncoder().encode(
-  "cardano-poe-kek-mlkem768x25519-v1"
-);
-var CARDANO_POE_HKDF_INFO_SLOTS_MAC = new TextEncoder().encode(
-  "cardano-poe-slots-mac-v1"
-);
-var ZERO_NONCE_12 = new Uint8Array(12);
-var EMPTY_SALT = new Uint8Array(0);
-var X25519_PUBLIC_KEY_LENGTH = 32;
-var X25519_SECRET_KEY_LENGTH = 32;
-var CEK_LENGTH = 32;
-var NONCE_LENGTH = 24;
-var WRAP_LENGTH = 48;
-var SLOTS_MAC_LENGTH = 32;
-if (CARDANO_POE_HKDF_INFO_KEK.length !== 18) {
-  throw new Error("CARDANO_POE_HKDF_INFO_KEK byte-length invariant violated (expected 18)");
+function isBlobLike(value) {
+  return typeof value === "object" && value !== null && typeof value.size === "number" && typeof value.slice === "function" && typeof value.arrayBuffer === "function";
 }
-if (CARDANO_POE_HKDF_INFO_KEK_MLKEM768X25519.length !== 33) {
-  throw new Error(
-    "CARDANO_POE_HKDF_INFO_KEK_MLKEM768X25519 byte-length invariant violated (expected 33)"
+async function blobSlice(blob, start, end) {
+  return new Uint8Array(await blob.slice(start, end).arrayBuffer());
+}
+async function* blobStream(blob) {
+  const reader = blob.stream().getReader();
+  try {
+    for (; ; ) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      if (value) yield value;
+    }
+  } finally {
+    reader.releaseLock();
+  }
+}
+function fromBlob(blob) {
+  return {
+    size: blob.size,
+    slice: (start, end) => blobSlice(blob, start, end),
+    stream: () => blobStream(blob)
+  };
+}
+function fromBytes(bytes) {
+  return {
+    size: bytes.byteLength,
+    slice: (start, end) => bytes.subarray(start, end),
+    stream: async function* () {
+      for (let offset = 0; offset < bytes.byteLength; offset += HASH_STREAM_CHUNK_BYTES) {
+        yield bytes.subarray(offset, Math.min(offset + HASH_STREAM_CHUNK_BYTES, bytes.byteLength));
+      }
+    }
+  };
+}
+async function fromPath(path) {
+  const open = await loadOpen();
+  const sliceAt = async (start, end) => {
+    const length = end - start;
+    if (length <= 0) return new Uint8Array(0);
+    const handle = await open(path, "r");
+    try {
+      const buffer = new Uint8Array(length);
+      let filled = 0;
+      while (filled < length) {
+        const { bytesRead } = await handle.read(buffer, filled, length - filled, start + filled);
+        if (bytesRead === 0) break;
+        filled += bytesRead;
+      }
+      return filled === length ? buffer : buffer.subarray(0, filled);
+    } finally {
+      await handle.close();
+    }
+  };
+  const streamFile = async function* () {
+    const handle = await open(path, "r");
+    try {
+      const buffer = new Uint8Array(HASH_STREAM_CHUNK_BYTES);
+      let position = 0;
+      for (; ; ) {
+        const { bytesRead } = await handle.read(buffer, 0, buffer.length, position);
+        if (bytesRead === 0) break;
+        position += bytesRead;
+        yield buffer.slice(0, bytesRead);
+      }
+    } finally {
+      await handle.close();
+    }
+  };
+  const { size } = await statSize(path);
+  return { size, slice: sliceAt, stream: streamFile };
+}
+async function statSize(path) {
+  const open = await loadOpen();
+  const handle = await open(path, "r");
+  try {
+    const stats = await handle.stat();
+    return { size: stats.size };
+  } finally {
+    await handle.close();
+  }
+}
+async function toResumableSource(input) {
+  if (typeof input === "string") return fromPath(input);
+  if (input instanceof Uint8Array) return fromBytes(input);
+  if (isBlobLike(input)) return fromBlob(input);
+  if (isResumableSource(input)) return input;
+  throw new TypeError(
+    "uploadResumable: unsupported source. Pass a Blob/File, a Uint8Array, a filesystem path string, or a ResumableSource."
   );
 }
-if (CARDANO_POE_HKDF_INFO_SLOTS_MAC.length !== 24) {
-  throw new Error("CARDANO_POE_HKDF_INFO_SLOTS_MAC byte-length invariant violated (expected 24)");
+
+// src/client/resumable-upload.ts
+var DEFAULT_RESUMABLE_THRESHOLD_BYTES = 50331648;
+var DEFAULT_RESUMABLE_CHUNK_BYTES = 50331648;
+var DEFAULT_PARALLELISM = 4;
+var DEFAULT_MAX_CHUNK_RETRIES = 4;
+var DEFAULT_CONTENT_TYPE = "application/octet-stream";
+var DEFAULT_TARGET = "arweave";
+var ATTEMPT_POLL_INTERVAL_MS = 1e3;
+var ATTEMPT_POLL_MAX_ATTEMPTS = 600;
+function bytesToHex2(bytes) {
+  return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
 }
-if (ZERO_NONCE_12.length !== 12) {
-  throw new Error("ZERO_NONCE_12 byte-length invariant violated (expected 12)");
+var B64_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+function bytesToBase64(bytes) {
+  let out = "";
+  let i = 0;
+  for (; i + 2 < bytes.length; i += 3) {
+    const n = bytes[i] << 16 | bytes[i + 1] << 8 | bytes[i + 2];
+    out += B64_ALPHABET[n >> 18 & 63] + B64_ALPHABET[n >> 12 & 63] + B64_ALPHABET[n >> 6 & 63] + B64_ALPHABET[n & 63];
+  }
+  const rem = bytes.length - i;
+  if (rem === 1) {
+    const n = bytes[i] << 16;
+    out += B64_ALPHABET[n >> 18 & 63] + B64_ALPHABET[n >> 12 & 63] + "==";
+  } else if (rem === 2) {
+    const n = bytes[i] << 16 | bytes[i + 1] << 8;
+    out += B64_ALPHABET[n >> 18 & 63] + B64_ALPHABET[n >> 12 & 63] + B64_ALPHABET[n >> 6 & 63] + "=";
+  }
+  return out;
+}
+function jsonHeaders(config, idempotencyKey) {
+  const headers = new Headers({ "content-type": "application/json", accept: "application/json" });
+  if (config.apiKey !== void 0) headers.set("authorization", `Bearer ${config.apiKey}`);
+  if (idempotencyKey !== void 0) headers.set("idempotency-key", idempotencyKey);
+  return headers;
+}
+function octetHeaders(config, length, digestBase64) {
+  const headers = new Headers({
+    "content-type": "application/octet-stream",
+    accept: "application/json",
+    "content-length": String(length),
+    digest: `sha-256=${digestBase64}`
+  });
+  if (config.apiKey !== void 0) headers.set("authorization", `Bearer ${config.apiKey}`);
+  return headers;
+}
+var SESSIONS_PATH = "/api/v1/poe/uploads/sessions";
+function chunkRange(index, chunkBytes, totalBytes) {
+  const start = index * chunkBytes;
+  return [start, Math.min(start + chunkBytes, totalBytes)];
 }
-function concat(a, b) {
-  const out = new Uint8Array(a.length + b.length);
-  out.set(a, 0);
-  out.set(b, a.length);
+function missingIndices(received, chunkCount) {
+  const have = new Set(received);
+  const out = [];
+  for (let i = 0; i < chunkCount; i++) if (!have.has(i)) out.push(i);
   return out;
 }
-function uniformIndexBelow(m) {
-  const limit = 4294967296 - 4294967296 % m;
-  const buf = new Uint32Array(1);
-  let x;
-  do {
-    crypto.getRandomValues(buf);
-    x = buf[0];
-  } while (x >= limit);
-  return x % m;
+function serverMissing(status) {
+  if (Array.isArray(status.missing)) return status.missing;
+  return missingIndices(status.received, status.chunk_count);
+}
+async function hashWholeFile(source) {
+  return bytesToHex2(await sha256Stream(source.stream()));
+}
+async function createSession(config, body, signal) {
+  const response = await config.fetch(`${config.baseUrl}${SESSIONS_PATH}`, {
+    method: "POST",
+    headers: jsonHeaders(config),
+    body: JSON.stringify(body),
+    ...signal ? { signal } : {}
+  });
+  await throwIfNotOk(response);
+  return await readJson(response);
+}
+async function getSessionStatus(config, sessionId, signal) {
+  const response = await config.fetch(
+    `${config.baseUrl}${SESSIONS_PATH}/${encodeURIComponent(sessionId)}`,
+    {
+      method: "GET",
+      headers: jsonHeaders(config),
+      ...signal ? { signal } : {}
+    }
+  );
+  await throwIfNotOk(response);
+  return await readJson(response);
+}
+async function putChunk(config, sessionId, index, bytes, signal) {
+  const digest = bytesToBase64(sha256(bytes));
+  const response = await config.fetch(
+    `${config.baseUrl}${SESSIONS_PATH}/${encodeURIComponent(sessionId)}/chunks/${index}`,
+    {
+      method: "PUT",
+      headers: octetHeaders(config, bytes.byteLength, digest),
+      // A Blob body streams without copying; a matching-digest re-PUT is an
+      // idempotent 200 server-side, so a retried chunk is always safe.
+      body: new Blob([bytes], { type: "application/octet-stream" }),
+      ...signal ? { signal } : {}
+    }
+  );
+  await throwIfNotOk(response);
+  return await readJson(response);
 }
-function csprngShuffle(arr) {
-  for (let i = arr.length - 1; i > 0; i--) {
-    const j = uniformIndexBelow(i + 1);
-    const tmp = arr[i];
-    arr[i] = arr[j];
-    arr[j] = tmp;
-  }
+async function completeSession(config, sessionId, idempotencyKey, signal) {
+  const response = await config.fetch(
+    `${config.baseUrl}${SESSIONS_PATH}/${encodeURIComponent(sessionId)}/complete`,
+    {
+      method: "POST",
+      headers: jsonHeaders(config, idempotencyKey),
+      ...signal ? { signal } : {}
+    }
+  );
+  await throwIfNotOk(response);
+  return await readJson(response);
 }
-function wrapSlotX25519(args) {
-  const privEph = args.privEph ?? randomBytes$1(X25519_SECRET_KEY_LENGTH);
-  if (privEph.length !== X25519_SECRET_KEY_LENGTH) {
-    throw new EciesSealedPoeError(
-      "INVALID_EPHEMERAL_SECRET_LENGTH",
-      `ephemeralSecrets[${args.slotIdx}] MUST be exactly ${X25519_SECRET_KEY_LENGTH} bytes, got ${privEph.length}`
+async function pollAttempt(config, attemptId, signal) {
+  for (let attempt = 0; attempt < ATTEMPT_POLL_MAX_ATTEMPTS; attempt++) {
+    const response = await config.fetch(
+      `${config.baseUrl}/api/v1/poe/uploads/attempts/${encodeURIComponent(attemptId)}`,
+      {
+        method: "GET",
+        headers: jsonHeaders(config),
+        ...signal ? { signal } : {}
+      }
     );
+    await throwIfNotOk(response);
+    const status = await readJson(response);
+    if (status.state !== "reserved") return status;
+    await delay(ATTEMPT_POLL_INTERVAL_MS, signal);
   }
-  const epk = x25519PublicKey({ secretKey: privEph });
-  const shared = x25519Ecdh({ secretKey: privEph, theirPublicKey: args.pubR });
-  const kek = hkdfSha256({
-    ikm: shared,
-    salt: concat(epk, args.pubR),
-    info: CARDANO_POE_HKDF_INFO_KEK,
-    length: 32
-  });
-  const wrap = chacha20Poly1305Encrypt({
-    key: kek,
-    nonce: ZERO_NONCE_12,
-    aad: CARDANO_POE_HKDF_INFO_KEK,
-    plaintext: args.cek
-  });
-  if (wrap.length !== WRAP_LENGTH) {
-    throw new Error(`internal: wrap.length=${wrap.length}, expected ${WRAP_LENGTH}`);
-  }
-  return { epk, wrap };
+  throw new ResumableUploadError(
+    "ATTEMPT_POLL_TIMEOUT",
+    `upload attempt ${attemptId} did not reach a terminal state in time`
+  );
 }
-function wrapSlotMlkem768X25519(args) {
-  const { enc, ss } = mlkem768x25519Encapsulate({
-    publicKey: args.pubR,
-    ...args.eseed !== void 0 ? { eseed: args.eseed } : {}
-  });
-  if (enc.length !== MLKEM768X25519_ENC_LENGTH) {
-    throw new Error(`internal: enc.length=${enc.length}, expected ${MLKEM768X25519_ENC_LENGTH}`);
-  }
-  const kek = hkdfSha256({
-    ikm: ss,
-    salt: EMPTY_SALT,
-    info: CARDANO_POE_HKDF_INFO_KEK_MLKEM768X25519,
-    length: 32
-  });
-  const wrap = chacha20Poly1305Encrypt({
-    key: kek,
-    nonce: ZERO_NONCE_12,
-    aad: CARDANO_POE_HKDF_INFO_KEK_MLKEM768X25519,
-    plaintext: args.cek
+function delay(ms, signal) {
+  return new Promise((resolve, reject) => {
+    if (signal?.aborted) {
+      reject(signalReason(signal));
+      return;
+    }
+    const timer = setTimeout(() => {
+      signal?.removeEventListener("abort", onAbort);
+      resolve();
+    }, ms);
+    const onAbort = () => {
+      clearTimeout(timer);
+      reject(signalReason(signal));
+    };
+    signal?.addEventListener("abort", onAbort, { once: true });
   });
-  if (wrap.length !== WRAP_LENGTH) {
-    throw new Error(`internal: wrap.length=${wrap.length}, expected ${WRAP_LENGTH}`);
-  }
-  return { kem_ct: chunkKemCt(enc), wrap };
 }
-function eciesSealedPoeWrap(args) {
-  const { plaintext, recipientPublicKeys } = args;
-  const kem = args.kem ?? "x25519";
-  const n = recipientPublicKeys.length;
-  if (n < 1) {
-    throw new EciesSealedPoeError(
-      "ENC_SLOTS_EMPTY",
-      `recipientPublicKeys.length=${n} must be >= 1`
+function signalReason(signal) {
+  const reason = signal?.reason;
+  return reason instanceof Error ? reason : new ResumableUploadError("ABORTED", "upload aborted");
+}
+var ResumableUploadError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "ResumableUploadError";
+    this.code = code;
+  }
+};
+async function uploadChunks(config, sessionId, source, chunkBytes, totalBytes, missing, parallelism, maxRetries, signal) {
+  let cursor = 0;
+  const workers = [];
+  const lanes = Math.max(1, Math.min(parallelism, missing.length || 1));
+  for (let lane = 0; lane < lanes; lane++) {
+    workers.push(
+      (async () => {
+        for (; ; ) {
+          if (signal?.aborted) throw signalReason(signal);
+          const next = cursor++;
+          if (next >= missing.length) return;
+          const index = missing[next];
+          const [start, end] = chunkRange(index, chunkBytes, totalBytes);
+          const bytes = await source.slice(start, end);
+          await putChunkWithRetry(config, sessionId, index, bytes, maxRetries, signal);
+        }
+      })()
     );
   }
-  const expectedPubLen = kem === "x25519" ? X25519_PUBLIC_KEY_LENGTH : MLKEM768X25519_PUBLIC_KEY_LENGTH;
-  for (let i = 0; i < n; i++) {
-    const pub = recipientPublicKeys[i];
-    if (pub === void 0 || pub.length !== expectedPubLen) {
-      throw new EciesSealedPoeError(
-        "KEM_EPK_LENGTH_MISMATCH",
-        `recipientPublicKeys[${i}] MUST be exactly ${expectedPubLen} bytes for kem='${kem}'`
-      );
+  await Promise.all(workers);
+}
+async function putChunkWithRetry(config, sessionId, index, bytes, maxRetries, signal) {
+  let lastError;
+  for (let attempt = 0; attempt <= maxRetries; attempt++) {
+    if (signal?.aborted) throw signalReason(signal);
+    try {
+      await putChunk(config, sessionId, index, bytes, signal);
+      return;
+    } catch (err) {
+      if (signal?.aborted) throw signalReason(signal);
+      if (isTerminalChunkError(err)) throw err;
+      lastError = err;
+      if (attempt < maxRetries) {
+        await delay(Math.min(250 * 2 ** attempt, 8e3), signal);
+      }
     }
   }
-  if (kem === "x25519") {
-    if (args.eseeds !== void 0) {
-      throw new EciesSealedPoeError(
-        "EPHEMERAL_SECRETS_COUNT_MISMATCH",
-        "eseeds is an X-Wing (mlkem768x25519) override and MUST NOT be supplied for kem='x25519'"
-      );
+  throw new ResumableUploadError(
+    "CHUNK_UPLOAD_FAILED",
+    `chunk ${index} failed after ${maxRetries + 1} attempt(s): ${lastError instanceof Error ? lastError.message : String(lastError)}`
+  );
+}
+async function uploadResumable(config, singleShot, input) {
+  const source = await toResumableSource(input.source);
+  const target = input.target ?? DEFAULT_TARGET;
+  const threshold = input.threshold ?? DEFAULT_RESUMABLE_THRESHOLD_BYTES;
+  const totalBytes = source.size;
+  if (totalBytes <= threshold && input.sessionId === void 0) {
+    const bytes = await source.slice(0, totalBytes);
+    const result = await singleShot({
+      target,
+      bytes,
+      ...input.idempotencyKey !== void 0 ? { idempotencyKey: input.idempotencyKey } : {},
+      ...input.signal ? { signal: input.signal } : {}
+    });
+    return {
+      uri: result.uri,
+      sha256: result.sha256,
+      bytes: result.bytes,
+      deduplicated: false,
+      mode: "single-shot"
+    };
+  }
+  return runSession(config, source, target, totalBytes, input);
+}
+async function runSession(config, source, target, totalBytes, input) {
+  const signal = input.signal;
+  let sessionId;
+  let chunkBytes;
+  let missing;
+  let declaredSha256;
+  let gridTotalBytes;
+  if (input.sessionId !== void 0) {
+    const status = await getSessionStatus(config, input.sessionId, signal);
+    if (status.state === "completed" && status.uri !== null) {
+      return {
+        uri: status.uri,
+        sha256: status.sha256,
+        bytes: status.total_bytes,
+        deduplicated: false,
+        mode: "chunked"
+      };
     }
-    if (args.ephemeralSecrets !== void 0 && args.ephemeralSecrets.length !== n) {
-      throw new EciesSealedPoeError(
-        "EPHEMERAL_SECRETS_COUNT_MISMATCH",
-        `ephemeralSecrets.length=${args.ephemeralSecrets.length} must match recipientPublicKeys.length=${n}`
+    if (status.state === "failed" || status.state === "expired") {
+      throw new ResumableUploadError(
+        "SESSION_FAILED",
+        `cannot resume session ${input.sessionId} in state '${status.state}'`
       );
     }
+    sessionId = status.session_id;
+    declaredSha256 = status.sha256;
+    chunkBytes = status.chunk_bytes;
+    gridTotalBytes = status.total_bytes;
+    missing = serverMissing(status);
   } else {
-    if (args.ephemeralSecrets !== void 0) {
-      throw new EciesSealedPoeError(
-        "EPHEMERAL_SECRETS_COUNT_MISMATCH",
-        "ephemeralSecrets is an X25519 override and MUST NOT be supplied for kem='mlkem768x25519'"
-      );
+    declaredSha256 = await hashWholeFile(source);
+    const requestedChunkBytes = input.chunkBytes ?? DEFAULT_RESUMABLE_CHUNK_BYTES;
+    const created = await createSession(
+      config,
+      {
+        target,
+        sha256: declaredSha256,
+        total_bytes: totalBytes,
+        chunk_bytes: requestedChunkBytes,
+        content_type: input.contentType ?? DEFAULT_CONTENT_TYPE
+      },
+      signal
+    );
+    if ("deduplicated" in created) {
+      return {
+        uri: created.uri,
+        sha256: created.sha256,
+        bytes: created.bytes,
+        deduplicated: true,
+        mode: "chunked"
+      };
     }
-    if (args.eseeds !== void 0) {
-      if (args.eseeds.length !== n) {
-        throw new EciesSealedPoeError(
-          "EPHEMERAL_SECRETS_COUNT_MISMATCH",
-          `eseeds.length=${args.eseeds.length} must match recipientPublicKeys.length=${n}`
-        );
+    sessionId = created.session_id;
+    chunkBytes = created.chunk_bytes;
+    gridTotalBytes = totalBytes;
+    missing = missingIndices(created.received, created.chunk_count);
+  }
+  if (missing.length > 0) {
+    await uploadChunks(
+      config,
+      sessionId,
+      source,
+      chunkBytes,
+      gridTotalBytes,
+      missing,
+      input.parallelism ?? DEFAULT_PARALLELISM,
+      input.maxChunkRetries ?? DEFAULT_MAX_CHUNK_RETRIES,
+      signal
+    );
+  }
+  return finishSession(config, sessionId, declaredSha256, input);
+}
+async function finishSession(config, sessionId, declaredSha256, input) {
+  const signal = input.signal;
+  const idempotencyKey = input.idempotencyKey ?? `resumable-${declaredSha256}`;
+  const COMPLETE_RETRIES = 2;
+  for (let attempt = 0; attempt <= COMPLETE_RETRIES; attempt++) {
+    try {
+      const completion = await completeSession(config, sessionId, idempotencyKey, signal);
+      if ("ok" in completion) {
+        return {
+          uri: completion.uri,
+          sha256: completion.sha256,
+          bytes: completion.bytes,
+          // The server sends the number 0 for a dedup-on-commit (the bytes were
+          // already stored, so nothing was charged); compare numerically.
+          deduplicated: completion.charged_usd_micros === 0,
+          mode: "chunked"
+        };
       }
-      for (let i = 0; i < n; i++) {
-        const eseed = args.eseeds[i];
-        if (eseed.length !== MLKEM768X25519_ESEED_LENGTH) {
-          throw new EciesSealedPoeError(
-            "INVALID_EPHEMERAL_SECRET_LENGTH",
-            `eseeds[${i}] MUST be exactly ${MLKEM768X25519_ESEED_LENGTH} bytes, got ${eseed.length}`
-          );
-        }
+      return resolveAccepted(config, completion.attempt_id, signal);
+    } catch (err) {
+      if (attempt < COMPLETE_RETRIES && isIncompleteUpload(err)) {
+        const status = await getSessionStatus(config, sessionId, signal);
+        const stillMissing = serverMissing(status);
+        if (stillMissing.length === 0) continue;
+        await uploadChunks(
+          config,
+          sessionId,
+          await toResumableSource(input.source),
+          status.chunk_bytes,
+          // Re-bound the resend grid against the server's declared total too, so a
+          // source that grew during the upload cannot over-read the final chunk.
+          status.total_bytes,
+          stillMissing,
+          input.parallelism ?? DEFAULT_PARALLELISM,
+          input.maxChunkRetries ?? DEFAULT_MAX_CHUNK_RETRIES,
+          signal
+        );
+        continue;
       }
+      throw err;
     }
   }
-  const cek = args.cek ?? randomBytes$1(CEK_LENGTH);
-  const nonce = args.nonce ?? randomBytes$1(NONCE_LENGTH);
-  if (cek.length !== CEK_LENGTH) {
-    throw new EciesSealedPoeError(
-      "INVALID_CEK_LENGTH",
-      `cek MUST be exactly ${CEK_LENGTH} bytes, got ${cek.length}`
+  throw new ResumableUploadError(
+    "SESSION_FAILED",
+    `session ${sessionId} could not be completed after resending missing chunks`
+  );
+}
+async function resolveAccepted(config, attemptId, signal) {
+  const status = await pollAttempt(config, attemptId, signal);
+  if (status.state === "released") {
+    throw new ResumableUploadError(
+      "ATTEMPT_FAILED",
+      `upload attempt ${attemptId} was released: ${status.reason}`
     );
   }
-  if (nonce.length !== NONCE_LENGTH) {
-    throw new EciesSealedPoeError(
-      "NONCE_LENGTH_MISMATCH",
-      `nonce MUST be exactly ${NONCE_LENGTH} bytes, got ${nonce.length}`
+  if (status.uri.length === 0) {
+    throw new ResumableUploadError(
+      "ATTEMPT_FAILED",
+      `upload attempt ${attemptId} committed without a uri`
     );
   }
-  let envelope;
-  if (kem === "x25519") {
-    const slots = [];
-    for (let i = 0; i < n; i++) {
-      slots.push(
-        wrapSlotX25519({
-          pubR: recipientPublicKeys[i],
-          privEph: args.ephemeralSecrets ? args.ephemeralSecrets[i] : void 0,
-          cek,
-          slotIdx: i
-        })
-      );
-    }
-    if (args.skipShuffle !== true) {
-      csprngShuffle(slots);
-    }
-    const slotsMac = computeSlotsMac(cek, slots, "x25519");
-    envelope = {
-      scheme: 1,
-      aead: "xchacha20-poly1305",
-      kem: "x25519",
-      nonce,
-      slots,
-      slots_mac: slotsMac
-    };
-  } else {
-    const slots = [];
-    for (let i = 0; i < n; i++) {
-      slots.push(
-        wrapSlotMlkem768X25519({
-          pubR: recipientPublicKeys[i],
-          eseed: args.eseeds ? args.eseeds[i] : void 0,
-          cek
-        })
-      );
-    }
-    if (args.skipShuffle !== true) {
-      csprngShuffle(slots);
-    }
-    const slotsMac = computeSlotsMac(cek, slots, "mlkem768x25519");
-    envelope = {
-      scheme: 1,
-      aead: "xchacha20-poly1305",
-      kem: "mlkem768x25519",
-      nonce,
-      slots,
-      slots_mac: slotsMac
-    };
-  }
-  const adContent = concat(nonce, envelope.slots_mac);
-  const ciphertext = xchacha20Poly1305Encrypt({
-    key: cek,
-    nonce,
-    aad: adContent,
-    plaintext
-  });
-  return { envelope, ciphertext };
+  return {
+    uri: status.uri,
+    sha256: status.sha256,
+    bytes: status.bytes,
+    // A committed attempt that charged nothing deduped against bytes already
+    // stored for this account on this backend.
+    deduplicated: status.charged_usd_micros === 0,
+    mode: "chunked"
+  };
 }
-function computeSlotsMac(cek, slots, kem) {
-  const hmacKey = hkdfSha256({
-    ikm: cek,
-    salt: EMPTY_SALT,
-    info: CARDANO_POE_HKDF_INFO_SLOTS_MAC,
-    length: 32
-  });
-  const slotsCbor = slotsToMacCbor(slots, kem);
-  const slotsMac = hmac(sha256$1, hmacKey, slotsCbor);
-  if (slotsMac.length !== SLOTS_MAC_LENGTH) {
-    throw new Error(`internal: slots_mac.length=${slotsMac.length}, expected ${SLOTS_MAC_LENGTH}`);
-  }
-  return slotsMac;
+function isTerminalChunkError(err) {
+  if (!(err instanceof Label309HttpError)) return false;
+  const status = err.httpStatus;
+  return status >= 400 && status < 500 && status !== 408 && status !== 429;
+}
+function isIncompleteUpload(err) {
+  return typeof err === "object" && err !== null && "code" in err && err.code === "incomplete-upload";
 }
-
-// src/client/partial-upload-error.ts
-var PartialUploadError = class extends Error {
-  response;
-  failed;
-  constructor(response) {
-    const failed = response.uploads.filter((u) => u.ok === false);
-    super(
-      `${failed.length} of ${response.uploads.length} upload(s) failed: ${failed.map((f) => `[${f.idx}] ${f.error.code} \u2014 ${f.error.detail}`).join("; ")}`
-    );
-    this.name = "PartialUploadError";
-    this.response = response;
-    this.failed = failed;
-  }
-  /** Convenience: the `idx` of every failed entry, in input order. */
-  get failedIndices() {
-    return this.failed.map((f) => f.idx);
-  }
-};
 
 // src/client/publish.ts
 var ED25519_PUBLIC_KEY_LENGTH2 = 32;
@@ -2006,7 +2787,7 @@ var PublishError = class extends Error {
     this.code = code;
   }
 };
-function bytesToHex2(bytes) {
+function bytesToHex3(bytes) {
   return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
 }
 function hexToBytes(hex) {
@@ -2027,14 +2808,14 @@ function toBytes(content) {
   if (typeof content === "string") return new TextEncoder().encode(content);
   return content;
 }
-function cloneToOwnedBuffer(src) {
+function cloneToOwnedBuffer2(src) {
   const out = new Uint8Array(new ArrayBuffer(src.length));
   out.set(src);
   return out;
 }
 function hashContent(bytes, alg) {
-  if (alg === "sha2-256") return cloneToOwnedBuffer(sha256(bytes));
-  if (alg === "blake2b-256") return cloneToOwnedBuffer(blake2b256(bytes));
+  if (alg === "sha2-256") return cloneToOwnedBuffer2(sha256(bytes));
+  if (alg === "blake2b-256") return cloneToOwnedBuffer2(blake2b256(bytes));
   throw new PublishError(
     "UNSUPPORTED_HASH_ALG",
     `hashAlg must be 'sha2-256' or 'blake2b-256', got '${alg}'`
@@ -2118,29 +2899,45 @@ async function postPublish(config, recordBytesHex, quoteId, idempotencyKey) {
   const parsed = await readJson2(response);
   return { ...parsed, dedup_hit: response.status === 200 };
 }
-async function postUploads(config, blobs, idempotencyKey) {
+var singleShotUpload = (config) => async ({ target, bytes, idempotencyKey, signal }) => {
   const form = new FormData();
-  form.append("target", STORAGE_TARGET_ARWEAVE);
-  for (let idx = 0; idx < blobs.length; idx++) {
-    const bytes = blobs[idx];
-    form.append(
-      `file_${idx}`,
-      new Blob([bytes], { type: "application/octet-stream" }),
-      `file_${idx}.bin`
-    );
-  }
+  form.append("target", target);
+  form.append(
+    "file_0",
+    new Blob([bytes], { type: "application/octet-stream" }),
+    "file_0.bin"
+  );
   const response = await config.fetch(`${config.baseUrl}/api/v1/poe/uploads`, {
     method: "POST",
     headers: buildMultipartHeaders(config.apiKey, idempotencyKey),
-    body: form
+    body: form,
+    ...signal ? { signal } : {}
   });
   await throwIfNotOk2(response);
   const result = await readJson2(response);
-  const anyFailed = result.uploads.some((u) => u.ok === false);
-  if (anyFailed) {
+  const entry = result.uploads[0];
+  if (entry === void 0 || entry.ok === false) {
     throw new PartialUploadError(result);
   }
-  return result;
+  const ok = entry;
+  return { uri: ok.uri, sha256: ok.sha256, bytes: ok.bytes };
+};
+async function uploadBlob(config, bytes, idempotencyKey) {
+  const target = STORAGE_TARGET_ARWEAVE;
+  if (bytes.byteLength <= DEFAULT_RESUMABLE_THRESHOLD_BYTES) {
+    const single = await singleShotUpload(config)({
+      target,
+      bytes,
+      ...idempotencyKey !== void 0 ? { idempotencyKey } : {}
+    });
+    return single.uri;
+  }
+  const result = await uploadResumable(config, singleShotUpload(config), {
+    target,
+    source: bytes,
+    ...idempotencyKey !== void 0 ? { idempotencyKey } : {}
+  });
+  return result.uri;
 }
 async function publishContent(config, input) {
   if (input.signer !== void 0) assertSigner(input.signer);
@@ -2152,7 +2949,7 @@ async function publishContent(config, input) {
     items: [{ hashes: { [hashAlg]: digest } }]
   };
   const recordBytes = await encodeRecord(record, input.signer);
-  return postPublish(config, bytesToHex2(recordBytes), input.quoteId, input.idempotencyKey);
+  return postPublish(config, bytesToHex3(recordBytes), input.quoteId, input.idempotencyKey);
 }
 var DIGEST_BYTE_LENGTH = {
   "sha2-256": 32,
@@ -2184,14 +2981,14 @@ async function publishPrehashed(config, input) {
         `hashes[${alg}] must be a ${expected}-byte digest (got ${bytes.length} bytes)`
       );
     }
-    decoded[alg] = cloneToOwnedBuffer(bytes);
+    decoded[alg] = cloneToOwnedBuffer2(bytes);
   }
   const record = {
     v: 1,
     items: [{ hashes: decoded }]
   };
   const recordBytes = await encodeRecord(record, input.signer);
-  return postPublish(config, bytesToHex2(recordBytes), input.quoteId, input.idempotencyKey);
+  return postPublish(config, bytesToHex3(recordBytes), input.quoteId, input.idempotencyKey);
 }
 async function publishSealed(config, input) {
   if (input.signer !== void 0) assertSigner(input.signer);
@@ -2215,41 +3012,42 @@ async function publishSealed(config, input) {
   const hashAlg = input.hashAlg ?? "sha2-256";
   const plaintext = toBytes(input.content);
   const plaintextDigest = hashContent(plaintext, hashAlg);
+  const hashes2 = { [hashAlg]: plaintextDigest };
   const sealed = eciesSealedPoeWrap({
     plaintext,
+    hashes: hashes2,
     recipientPublicKeys: input.recipients.map((r) => r),
     kem
   });
-  const uploadsResp = await postUploads(config, [sealed.ciphertext], input.idempotencyKey);
-  const uri = uploadsResp.uploads[0].uri;
+  const uri = await uploadBlob(config, sealed.ciphertext, input.idempotencyKey);
   const env = sealed.envelope;
   const slots = env.kem === "mlkem768x25519" ? env.slots.map((s) => ({
-    kem_ct: s.kem_ct.map((c) => cloneToOwnedBuffer(c)),
-    wrap: cloneToOwnedBuffer(s.wrap)
+    kem_ct: cloneToOwnedBuffer2(s.kem_ct),
+    wrap: cloneToOwnedBuffer2(s.wrap)
   })) : env.slots.map((s) => ({
-    epk: cloneToOwnedBuffer(s.epk),
-    wrap: cloneToOwnedBuffer(s.wrap)
+    epk: cloneToOwnedBuffer2(s.epk),
+    wrap: cloneToOwnedBuffer2(s.wrap)
   }));
   const envelope = {
     scheme: 1,
     aead: env.aead,
     kem: env.kem,
-    nonce: cloneToOwnedBuffer(env.nonce),
+    nonce: cloneToOwnedBuffer2(env.nonce),
     slots,
-    slots_mac: cloneToOwnedBuffer(env.slots_mac)
+    slots_mac: cloneToOwnedBuffer2(env.slots_mac)
   };
   const record = {
     v: 1,
     items: [
       {
-        hashes: { [hashAlg]: plaintextDigest },
-        uris: [chunkUri(uri)],
+        hashes: hashes2,
+        uris: [uri],
         enc: envelope
       }
     ]
   };
   const recordBytes = await encodeRecord(record, input.signer);
-  return postPublish(config, bytesToHex2(recordBytes), input.quoteId, input.idempotencyKey);
+  return postPublish(config, bytesToHex3(recordBytes), input.quoteId, input.idempotencyKey);
 }
 async function publishMerkle(config, input) {
   if (input.signer !== void 0) assertSigner(input.signer);
@@ -2272,21 +3070,20 @@ async function publishMerkle(config, input) {
     }
     return bytes;
   });
-  const root = cloneToOwnedBuffer(merkleSha2256Root(leaves));
+  const root = cloneToOwnedBuffer2(merkleSha2256Root(leaves));
   const leavesListCbor = encodeLeavesList({ leaves, root });
-  const uploadsResp = await postUploads(config, [leavesListCbor], input.idempotencyKey);
-  const uri = uploadsResp.uploads[0].uri;
+  const uri = await uploadBlob(config, leavesListCbor, input.idempotencyKey);
   const merkleEntry = {
     alg: MERKLE_ALG_ID,
     root,
     leaf_count: leaves.length,
-    uris: [chunkUri(uri)]
+    uris: [uri]
   };
   const record = { v: 1, merkle: [merkleEntry] };
   const recordBytes = await encodeRecord(record, input.signer);
   const published = await postPublish(
     config,
-    bytesToHex2(recordBytes),
+    bytesToHex3(recordBytes),
     input.quoteId,
     input.idempotencyKey
   );
@@ -2294,7 +3091,7 @@ async function publishMerkle(config, input) {
     id: published.id,
     tx_hash: published.tx_hash,
     status: published.status,
-    root: bytesToHex2(root),
+    root: bytesToHex3(root),
     leaf_count: leaves.length,
     ar_uri: uri,
     balance_after_usd_micros: published.balance_after_usd_micros
@@ -2389,6 +3186,65 @@ var PoeNamespace = class {
     await throwIfNotOk(response);
     return await readJson(response);
   }
+  /**
+   * Upload a single file of any size, choosing the ingress path by size.
+   *
+   * A file at or below `threshold` (default ~48 MiB) is sent with the unchanged
+   * single-shot `uploads()` multipart call. A larger file is uploaded as a
+   * resumable, content-addressed session: the helper streams the whole-file
+   * SHA-256 once (never buffering a multi-GB file), creates a session, PUTs each
+   * chunk (several in parallel, retrying a failed chunk), then completes —
+   * polling the shared attempt endpoint when completion is accepted
+   * asynchronously. Both paths converge on one `ar://` URI.
+   *
+   * The chunk size is the server's authoritative `chunk_bytes` from the create
+   * response, clamped to its `max_chunk_bytes` ceiling; the client's `chunkBytes`
+   * is only a request. A create-time dedup hit returns the existing URI without
+   * uploading; a `402` funding error is surfaced as a typed error.
+   *
+   * The `source` works in both runtimes: a `Blob`/`File` in the browser, a
+   * `Uint8Array`, a filesystem path string, or a pre-adapted `ResumableSource`
+   * on the server. To resume an interrupted upload, pass the prior `sessionId`;
+   * the helper GETs its status and uploads only the missing chunks.
+   */
+  async uploadResumable(input) {
+    return uploadResumable(this.config, this.singleShotUpload, input);
+  }
+  /**
+   * Upload exactly one blob via the single-shot multipart route and resolve its
+   * `ar://` URI. Backs the small-file branch of `uploadResumable`; it shares the
+   * `uploads()` wire shape but takes one blob and an optional abort signal, and
+   * surfaces a per-file failure as a `PartialUploadError` (the resumable helper
+   * promises a single resolved URI, unlike the raw `uploads()` passthrough).
+   */
+  singleShotUpload = async ({
+    target,
+    bytes,
+    idempotencyKey,
+    signal
+  }) => {
+    const form = new FormData();
+    form.append("target", target);
+    form.append(
+      "file_0",
+      new Blob([bytes], { type: "application/octet-stream" }),
+      "file_0.bin"
+    );
+    const response = await this.config.fetch(`${this.config.baseUrl}/api/v1/poe/uploads`, {
+      method: "POST",
+      headers: buildMultipartHeaders2({ apiKey: this.config.apiKey, idempotencyKey }),
+      body: form,
+      ...signal ? { signal } : {}
+    });
+    await throwIfNotOk(response);
+    const result = await readJson(response);
+    const entry = result.uploads[0];
+    if (entry === void 0 || entry.ok === false) {
+      throw new PartialUploadError(result);
+    }
+    const ok = entry;
+    return { uri: ok.uri, sha256: ok.sha256, bytes: ok.bytes };
+  };
   /**
    * Submit a single finalised canonical-CBOR record to Cardano. Caller is
    * responsible for constructing the record bytes (use `publishContent` /
@@ -2636,6 +3492,6 @@ var Label309Client = class {
   (*! noble-post-quantum - MIT License (c) 2024 Paul Miller (paulmillr.com) *)
 */
 
-export { AccountNamespace, BatchEmptyError, BatchTooLargeError, ForbiddenError, IdempotencyConflictError, InsufficientFundsError, InsufficientScopeError, InternalServerError, InvalidBodyError, InvalidClientConfigError, Label309Client, Label309HttpError, MalformedCborError, NotFoundError, OffHostSignError, PartialUploadError, PoeNamespace, PublishError, QuoteAlreadyConsumedError, QuoteExpiredError, QuoteNotFoundError, RateLimitedError, RecordNotFoundError, RecordsNamespace, ServiceUnavailableError, UnauthorizedError, ValidationFailedError, assembleCoseSign1, assembleCoseSign1Hashed, buildToSign, parseHttpError, prepareSigStructure, prepareSigStructureHashed };
+export { AccountNamespace, BatchEmptyError, BatchTooLargeError, DEFAULT_RESUMABLE_CHUNK_BYTES, DEFAULT_RESUMABLE_THRESHOLD_BYTES, ForbiddenError, IdempotencyConflictError, InsufficientFundsError, InsufficientScopeError, InternalServerError, InvalidBodyError, InvalidClientConfigError, Label309Client, Label309HttpError, MalformedCborError, NotFoundError, OffHostSignError, PartialUploadError, PoeNamespace, PublishError, QuoteAlreadyConsumedError, QuoteExpiredError, QuoteNotFoundError, RateLimitedError, RecordNotFoundError, RecordsNamespace, ResumableUploadError, ServiceUnavailableError, UnauthorizedError, ValidationFailedError, assembleCoseSign1, assembleCoseSign1Hashed, buildToSign, parseHttpError, prepareSigStructure, prepareSigStructureHashed, toResumableSource };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map