@dstorage-tech/dstorage-sdk 0.0.6 → 0.0.8

package/dist/index.js

@@ -33,2062 +33,6 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
-// ../../node_modules/@scure/bip39/wordlists/english.js
-var wordlist;
-var init_english = __esm({
-  "../../node_modules/@scure/bip39/wordlists/english.js"() {
-    "use strict";
-    wordlist = `abandon
-ability
-able
-about
-above
-absent
-absorb
-abstract
-absurd
-abuse
-access
-accident
-account
-accuse
-achieve
-acid
-acoustic
-acquire
-across
-act
-action
-actor
-actress
-actual
-adapt
-add
-addict
-address
-adjust
-admit
-adult
-advance
-advice
-aerobic
-affair
-afford
-afraid
-again
-age
-agent
-agree
-ahead
-aim
-air
-airport
-aisle
-alarm
-album
-alcohol
-alert
-alien
-all
-alley
-allow
-almost
-alone
-alpha
-already
-also
-alter
-always
-amateur
-amazing
-among
-amount
-amused
-analyst
-anchor
-ancient
-anger
-angle
-angry
-animal
-ankle
-announce
-annual
-another
-answer
-antenna
-antique
-anxiety
-any
-apart
-apology
-appear
-apple
-approve
-april
-arch
-arctic
-area
-arena
-argue
-arm
-armed
-armor
-army
-around
-arrange
-arrest
-arrive
-arrow
-art
-artefact
-artist
-artwork
-ask
-aspect
-assault
-asset
-assist
-assume
-asthma
-athlete
-atom
-attack
-attend
-attitude
-attract
-auction
-audit
-august
-aunt
-author
-auto
-autumn
-average
-avocado
-avoid
-awake
-aware
-away
-awesome
-awful
-awkward
-axis
-baby
-bachelor
-bacon
-badge
-bag
-balance
-balcony
-ball
-bamboo
-banana
-banner
-bar
-barely
-bargain
-barrel
-base
-basic
-basket
-battle
-beach
-bean
-beauty
-because
-become
-beef
-before
-begin
-behave
-behind
-believe
-below
-belt
-bench
-benefit
-best
-betray
-better
-between
-beyond
-bicycle
-bid
-bike
-bind
-biology
-bird
-birth
-bitter
-black
-blade
-blame
-blanket
-blast
-bleak
-bless
-blind
-blood
-blossom
-blouse
-blue
-blur
-blush
-board
-boat
-body
-boil
-bomb
-bone
-bonus
-book
-boost
-border
-boring
-borrow
-boss
-bottom
-bounce
-box
-boy
-bracket
-brain
-brand
-brass
-brave
-bread
-breeze
-brick
-bridge
-brief
-bright
-bring
-brisk
-broccoli
-broken
-bronze
-broom
-brother
-brown
-brush
-bubble
-buddy
-budget
-buffalo
-build
-bulb
-bulk
-bullet
-bundle
-bunker
-burden
-burger
-burst
-bus
-business
-busy
-butter
-buyer
-buzz
-cabbage
-cabin
-cable
-cactus
-cage
-cake
-call
-calm
-camera
-camp
-can
-canal
-cancel
-candy
-cannon
-canoe
-canvas
-canyon
-capable
-capital
-captain
-car
-carbon
-card
-cargo
-carpet
-carry
-cart
-case
-cash
-casino
-castle
-casual
-cat
-catalog
-catch
-category
-cattle
-caught
-cause
-caution
-cave
-ceiling
-celery
-cement
-census
-century
-cereal
-certain
-chair
-chalk
-champion
-change
-chaos
-chapter
-charge
-chase
-chat
-cheap
-check
-cheese
-chef
-cherry
-chest
-chicken
-chief
-child
-chimney
-choice
-choose
-chronic
-chuckle
-chunk
-churn
-cigar
-cinnamon
-circle
-citizen
-city
-civil
-claim
-clap
-clarify
-claw
-clay
-clean
-clerk
-clever
-click
-client
-cliff
-climb
-clinic
-clip
-clock
-clog
-close
-cloth
-cloud
-clown
-club
-clump
-cluster
-clutch
-coach
-coast
-coconut
-code
-coffee
-coil
-coin
-collect
-color
-column
-combine
-come
-comfort
-comic
-common
-company
-concert
-conduct
-confirm
-congress
-connect
-consider
-control
-convince
-cook
-cool
-copper
-copy
-coral
-core
-corn
-correct
-cost
-cotton
-couch
-country
-couple
-course
-cousin
-cover
-coyote
-crack
-cradle
-craft
-cram
-crane
-crash
-crater
-crawl
-crazy
-cream
-credit
-creek
-crew
-cricket
-crime
-crisp
-critic
-crop
-cross
-crouch
-crowd
-crucial
-cruel
-cruise
-crumble
-crunch
-crush
-cry
-crystal
-cube
-culture
-cup
-cupboard
-curious
-current
-curtain
-curve
-cushion
-custom
-cute
-cycle
-dad
-damage
-damp
-dance
-danger
-daring
-dash
-daughter
-dawn
-day
-deal
-debate
-debris
-decade
-december
-decide
-decline
-decorate
-decrease
-deer
-defense
-define
-defy
-degree
-delay
-deliver
-demand
-demise
-denial
-dentist
-deny
-depart
-depend
-deposit
-depth
-deputy
-derive
-describe
-desert
-design
-desk
-despair
-destroy
-detail
-detect
-develop
-device
-devote
-diagram
-dial
-diamond
-diary
-dice
-diesel
-diet
-differ
-digital
-dignity
-dilemma
-dinner
-dinosaur
-direct
-dirt
-disagree
-discover
-disease
-dish
-dismiss
-disorder
-display
-distance
-divert
-divide
-divorce
-dizzy
-doctor
-document
-dog
-doll
-dolphin
-domain
-donate
-donkey
-donor
-door
-dose
-double
-dove
-draft
-dragon
-drama
-drastic
-draw
-dream
-dress
-drift
-drill
-drink
-drip
-drive
-drop
-drum
-dry
-duck
-dumb
-dune
-during
-dust
-dutch
-duty
-dwarf
-dynamic
-eager
-eagle
-early
-earn
-earth
-easily
-east
-easy
-echo
-ecology
-economy
-edge
-edit
-educate
-effort
-egg
-eight
-either
-elbow
-elder
-electric
-elegant
-element
-elephant
-elevator
-elite
-else
-embark
-embody
-embrace
-emerge
-emotion
-employ
-empower
-empty
-enable
-enact
-end
-endless
-endorse
-enemy
-energy
-enforce
-engage
-engine
-enhance
-enjoy
-enlist
-enough
-enrich
-enroll
-ensure
-enter
-entire
-entry
-envelope
-episode
-equal
-equip
-era
-erase
-erode
-erosion
-error
-erupt
-escape
-essay
-essence
-estate
-eternal
-ethics
-evidence
-evil
-evoke
-evolve
-exact
-example
-excess
-exchange
-excite
-exclude
-excuse
-execute
-exercise
-exhaust
-exhibit
-exile
-exist
-exit
-exotic
-expand
-expect
-expire
-explain
-expose
-express
-extend
-extra
-eye
-eyebrow
-fabric
-face
-faculty
-fade
-faint
-faith
-fall
-false
-fame
-family
-famous
-fan
-fancy
-fantasy
-farm
-fashion
-fat
-fatal
-father
-fatigue
-fault
-favorite
-feature
-february
-federal
-fee
-feed
-feel
-female
-fence
-festival
-fetch
-fever
-few
-fiber
-fiction
-field
-figure
-file
-film
-filter
-final
-find
-fine
-finger
-finish
-fire
-firm
-first
-fiscal
-fish
-fit
-fitness
-fix
-flag
-flame
-flash
-flat
-flavor
-flee
-flight
-flip
-float
-flock
-floor
-flower
-fluid
-flush
-fly
-foam
-focus
-fog
-foil
-fold
-follow
-food
-foot
-force
-forest
-forget
-fork
-fortune
-forum
-forward
-fossil
-foster
-found
-fox
-fragile
-frame
-frequent
-fresh
-friend
-fringe
-frog
-front
-frost
-frown
-frozen
-fruit
-fuel
-fun
-funny
-furnace
-fury
-future
-gadget
-gain
-galaxy
-gallery
-game
-gap
-garage
-garbage
-garden
-garlic
-garment
-gas
-gasp
-gate
-gather
-gauge
-gaze
-general
-genius
-genre
-gentle
-genuine
-gesture
-ghost
-giant
-gift
-giggle
-ginger
-giraffe
-girl
-give
-glad
-glance
-glare
-glass
-glide
-glimpse
-globe
-gloom
-glory
-glove
-glow
-glue
-goat
-goddess
-gold
-good
-goose
-gorilla
-gospel
-gossip
-govern
-gown
-grab
-grace
-grain
-grant
-grape
-grass
-gravity
-great
-green
-grid
-grief
-grit
-grocery
-group
-grow
-grunt
-guard
-guess
-guide
-guilt
-guitar
-gun
-gym
-habit
-hair
-half
-hammer
-hamster
-hand
-happy
-harbor
-hard
-harsh
-harvest
-hat
-have
-hawk
-hazard
-head
-health
-heart
-heavy
-hedgehog
-height
-hello
-helmet
-help
-hen
-hero
-hidden
-high
-hill
-hint
-hip
-hire
-history
-hobby
-hockey
-hold
-hole
-holiday
-hollow
-home
-honey
-hood
-hope
-horn
-horror
-horse
-hospital
-host
-hotel
-hour
-hover
-hub
-huge
-human
-humble
-humor
-hundred
-hungry
-hunt
-hurdle
-hurry
-hurt
-husband
-hybrid
-ice
-icon
-idea
-identify
-idle
-ignore
-ill
-illegal
-illness
-image
-imitate
-immense
-immune
-impact
-impose
-improve
-impulse
-inch
-include
-income
-increase
-index
-indicate
-indoor
-industry
-infant
-inflict
-inform
-inhale
-inherit
-initial
-inject
-injury
-inmate
-inner
-innocent
-input
-inquiry
-insane
-insect
-inside
-inspire
-install
-intact
-interest
-into
-invest
-invite
-involve
-iron
-island
-isolate
-issue
-item
-ivory
-jacket
-jaguar
-jar
-jazz
-jealous
-jeans
-jelly
-jewel
-job
-join
-joke
-journey
-joy
-judge
-juice
-jump
-jungle
-junior
-junk
-just
-kangaroo
-keen
-keep
-ketchup
-key
-kick
-kid
-kidney
-kind
-kingdom
-kiss
-kit
-kitchen
-kite
-kitten
-kiwi
-knee
-knife
-knock
-know
-lab
-label
-labor
-ladder
-lady
-lake
-lamp
-language
-laptop
-large
-later
-latin
-laugh
-laundry
-lava
-law
-lawn
-lawsuit
-layer
-lazy
-leader
-leaf
-learn
-leave
-lecture
-left
-leg
-legal
-legend
-leisure
-lemon
-lend
-length
-lens
-leopard
-lesson
-letter
-level
-liar
-liberty
-library
-license
-life
-lift
-light
-like
-limb
-limit
-link
-lion
-liquid
-list
-little
-live
-lizard
-load
-loan
-lobster
-local
-lock
-logic
-lonely
-long
-loop
-lottery
-loud
-lounge
-love
-loyal
-lucky
-luggage
-lumber
-lunar
-lunch
-luxury
-lyrics
-machine
-mad
-magic
-magnet
-maid
-mail
-main
-major
-make
-mammal
-man
-manage
-mandate
-mango
-mansion
-manual
-maple
-marble
-march
-margin
-marine
-market
-marriage
-mask
-mass
-master
-match
-material
-math
-matrix
-matter
-maximum
-maze
-meadow
-mean
-measure
-meat
-mechanic
-medal
-media
-melody
-melt
-member
-memory
-mention
-menu
-mercy
-merge
-merit
-merry
-mesh
-message
-metal
-method
-middle
-midnight
-milk
-million
-mimic
-mind
-minimum
-minor
-minute
-miracle
-mirror
-misery
-miss
-mistake
-mix
-mixed
-mixture
-mobile
-model
-modify
-mom
-moment
-monitor
-monkey
-monster
-month
-moon
-moral
-more
-morning
-mosquito
-mother
-motion
-motor
-mountain
-mouse
-move
-movie
-much
-muffin
-mule
-multiply
-muscle
-museum
-mushroom
-music
-must
-mutual
-myself
-mystery
-myth
-naive
-name
-napkin
-narrow
-nasty
-nation
-nature
-near
-neck
-need
-negative
-neglect
-neither
-nephew
-nerve
-nest
-net
-network
-neutral
-never
-news
-next
-nice
-night
-noble
-noise
-nominee
-noodle
-normal
-north
-nose
-notable
-note
-nothing
-notice
-novel
-now
-nuclear
-number
-nurse
-nut
-oak
-obey
-object
-oblige
-obscure
-observe
-obtain
-obvious
-occur
-ocean
-october
-odor
-off
-offer
-office
-often
-oil
-okay
-old
-olive
-olympic
-omit
-once
-one
-onion
-online
-only
-open
-opera
-opinion
-oppose
-option
-orange
-orbit
-orchard
-order
-ordinary
-organ
-orient
-original
-orphan
-ostrich
-other
-outdoor
-outer
-output
-outside
-oval
-oven
-over
-own
-owner
-oxygen
-oyster
-ozone
-pact
-paddle
-page
-pair
-palace
-palm
-panda
-panel
-panic
-panther
-paper
-parade
-parent
-park
-parrot
-party
-pass
-patch
-path
-patient
-patrol
-pattern
-pause
-pave
-payment
-peace
-peanut
-pear
-peasant
-pelican
-pen
-penalty
-pencil
-people
-pepper
-perfect
-permit
-person
-pet
-phone
-photo
-phrase
-physical
-piano
-picnic
-picture
-piece
-pig
-pigeon
-pill
-pilot
-pink
-pioneer
-pipe
-pistol
-pitch
-pizza
-place
-planet
-plastic
-plate
-play
-please
-pledge
-pluck
-plug
-plunge
-poem
-poet
-point
-polar
-pole
-police
-pond
-pony
-pool
-popular
-portion
-position
-possible
-post
-potato
-pottery
-poverty
-powder
-power
-practice
-praise
-predict
-prefer
-prepare
-present
-pretty
-prevent
-price
-pride
-primary
-print
-priority
-prison
-private
-prize
-problem
-process
-produce
-profit
-program
-project
-promote
-proof
-property
-prosper
-protect
-proud
-provide
-public
-pudding
-pull
-pulp
-pulse
-pumpkin
-punch
-pupil
-puppy
-purchase
-purity
-purpose
-purse
-push
-put
-puzzle
-pyramid
-quality
-quantum
-quarter
-question
-quick
-quit
-quiz
-quote
-rabbit
-raccoon
-race
-rack
-radar
-radio
-rail
-rain
-raise
-rally
-ramp
-ranch
-random
-range
-rapid
-rare
-rate
-rather
-raven
-raw
-razor
-ready
-real
-reason
-rebel
-rebuild
-recall
-receive
-recipe
-record
-recycle
-reduce
-reflect
-reform
-refuse
-region
-regret
-regular
-reject
-relax
-release
-relief
-rely
-remain
-remember
-remind
-remove
-render
-renew
-rent
-reopen
-repair
-repeat
-replace
-report
-require
-rescue
-resemble
-resist
-resource
-response
-result
-retire
-retreat
-return
-reunion
-reveal
-review
-reward
-rhythm
-rib
-ribbon
-rice
-rich
-ride
-ridge
-rifle
-right
-rigid
-ring
-riot
-ripple
-risk
-ritual
-rival
-river
-road
-roast
-robot
-robust
-rocket
-romance
-roof
-rookie
-room
-rose
-rotate
-rough
-round
-route
-royal
-rubber
-rude
-rug
-rule
-run
-runway
-rural
-sad
-saddle
-sadness
-safe
-sail
-salad
-salmon
-salon
-salt
-salute
-same
-sample
-sand
-satisfy
-satoshi
-sauce
-sausage
-save
-say
-scale
-scan
-scare
-scatter
-scene
-scheme
-school
-science
-scissors
-scorpion
-scout
-scrap
-screen
-script
-scrub
-sea
-search
-season
-seat
-second
-secret
-section
-security
-seed
-seek
-segment
-select
-sell
-seminar
-senior
-sense
-sentence
-series
-service
-session
-settle
-setup
-seven
-shadow
-shaft
-shallow
-share
-shed
-shell
-sheriff
-shield
-shift
-shine
-ship
-shiver
-shock
-shoe
-shoot
-shop
-short
-shoulder
-shove
-shrimp
-shrug
-shuffle
-shy
-sibling
-sick
-side
-siege
-sight
-sign
-silent
-silk
-silly
-silver
-similar
-simple
-since
-sing
-siren
-sister
-situate
-six
-size
-skate
-sketch
-ski
-skill
-skin
-skirt
-skull
-slab
-slam
-sleep
-slender
-slice
-slide
-slight
-slim
-slogan
-slot
-slow
-slush
-small
-smart
-smile
-smoke
-smooth
-snack
-snake
-snap
-sniff
-snow
-soap
-soccer
-social
-sock
-soda
-soft
-solar
-soldier
-solid
-solution
-solve
-someone
-song
-soon
-sorry
-sort
-soul
-sound
-soup
-source
-south
-space
-spare
-spatial
-spawn
-speak
-special
-speed
-spell
-spend
-sphere
-spice
-spider
-spike
-spin
-spirit
-split
-spoil
-sponsor
-spoon
-sport
-spot
-spray
-spread
-spring
-spy
-square
-squeeze
-squirrel
-stable
-stadium
-staff
-stage
-stairs
-stamp
-stand
-start
-state
-stay
-steak
-steel
-stem
-step
-stereo
-stick
-still
-sting
-stock
-stomach
-stone
-stool
-story
-stove
-strategy
-street
-strike
-strong
-struggle
-student
-stuff
-stumble
-style
-subject
-submit
-subway
-success
-such
-sudden
-suffer
-sugar
-suggest
-suit
-summer
-sun
-sunny
-sunset
-super
-supply
-supreme
-sure
-surface
-surge
-surprise
-surround
-survey
-suspect
-sustain
-swallow
-swamp
-swap
-swarm
-swear
-sweet
-swift
-swim
-swing
-switch
-sword
-symbol
-symptom
-syrup
-system
-table
-tackle
-tag
-tail
-talent
-talk
-tank
-tape
-target
-task
-taste
-tattoo
-taxi
-teach
-team
-tell
-ten
-tenant
-tennis
-tent
-term
-test
-text
-thank
-that
-theme
-then
-theory
-there
-they
-thing
-this
-thought
-three
-thrive
-throw
-thumb
-thunder
-ticket
-tide
-tiger
-tilt
-timber
-time
-tiny
-tip
-tired
-tissue
-title
-toast
-tobacco
-today
-toddler
-toe
-together
-toilet
-token
-tomato
-tomorrow
-tone
-tongue
-tonight
-tool
-tooth
-top
-topic
-topple
-torch
-tornado
-tortoise
-toss
-total
-tourist
-toward
-tower
-town
-toy
-track
-trade
-traffic
-tragic
-train
-transfer
-trap
-trash
-travel
-tray
-treat
-tree
-trend
-trial
-tribe
-trick
-trigger
-trim
-trip
-trophy
-trouble
-truck
-true
-truly
-trumpet
-trust
-truth
-try
-tube
-tuition
-tumble
-tuna
-tunnel
-turkey
-turn
-turtle
-twelve
-twenty
-twice
-twin
-twist
-two
-type
-typical
-ugly
-umbrella
-unable
-unaware
-uncle
-uncover
-under
-undo
-unfair
-unfold
-unhappy
-uniform
-unique
-unit
-universe
-unknown
-unlock
-until
-unusual
-unveil
-update
-upgrade
-uphold
-upon
-upper
-upset
-urban
-urge
-usage
-use
-used
-useful
-useless
-usual
-utility
-vacant
-vacuum
-vague
-valid
-valley
-valve
-van
-vanish
-vapor
-various
-vast
-vault
-vehicle
-velvet
-vendor
-venture
-venue
-verb
-verify
-version
-very
-vessel
-veteran
-viable
-vibrant
-vicious
-victory
-video
-view
-village
-vintage
-violin
-virtual
-virus
-visa
-visit
-visual
-vital
-vivid
-vocal
-voice
-void
-volcano
-volume
-vote
-voyage
-wage
-wagon
-wait
-walk
-wall
-walnut
-want
-warfare
-warm
-warrior
-wash
-wasp
-waste
-water
-wave
-way
-wealth
-weapon
-wear
-weasel
-weather
-web
-wedding
-weekend
-weird
-welcome
-west
-wet
-whale
-what
-wheat
-wheel
-when
-where
-whip
-whisper
-wide
-width
-wife
-wild
-will
-win
-window
-wine
-wing
-wink
-winner
-winter
-wire
-wisdom
-wise
-wish
-witness
-wolf
-woman
-wonder
-wood
-wool
-word
-work
-world
-worry
-worth
-wrap
-wreck
-wrestle
-wrist
-write
-wrong
-yard
-year
-yellow
-you
-young
-youth
-zebra
-zero
-zone
-zoo`.split("\n");
-  }
-});
-
 // ../crypto/dist/index.mjs
 var dist_exports = {};
 __export(dist_exports, {
@@ -2118,6 +62,7 @@ __export(dist_exports, {
   mlkemUnwrapDek: () => mlkemUnwrapDek,
   mlkemWrapDek: () => mlkemWrapDek,
   parseKeyEnvelope: () => parseKeyEnvelope,
+  readResponseTextWithLimit: () => readResponseTextWithLimit,
   serializeKeyEnvelope: () => serializeKeyEnvelope,
   serializeXChaChaPayload: () => serializeXChaChaPayload,
   unwrapKey: () => unwrapKey,
@@ -2130,7 +75,7 @@ function base64urlToBytes(b64url) {
   if (!/^[A-Za-z0-9_-]*$/.test(b64url)) {
     throw new DStorageError(
       CryptoErrorCode.BASE64URL_INVALID,
-      `[dStorage/crypto] malformed base64url input \u2014 unexpected characters in "${b64url.slice(0, 32)}${b64url.length > 32 ? "\u2026" : ""}"`
+      `[dStorage/crypto] malformed base64url input \u2014 unexpected characters (length: ${b64url.length})`
     );
   }
   const b64 = b64url.replace(/-/g, "+").replace(/_/g, "/");
@@ -2488,11 +433,60 @@ async function computeBlake3Hex(bytes) {
     ""
   );
 }
-var import_chacha, import_ml_kem, import_blake3, DStorageError, CryptoErrorCode, ENGLISH_WORD_SET, KeyDeriver, STORAGE_ID_AAD, XCHACHA_STORAGE_ID_BYTES, XChaChaScheme, OWNER_SECRET_DOMAIN, DEFAULT_VARIANT, MLKEM_ALGO_SUFFIX;
+async function readResponseTextWithLimit(res, opts) {
+  const contentLength = res.headers?.get?.("content-length");
+  if (contentLength) {
+    const len = Number(contentLength);
+    if (Number.isFinite(len) && len > opts.maxBytes) {
+      throw new DStorageError(
+        opts.code,
+        `${opts.component} failed: response Content-Length (${len} bytes) exceeds the maximum allowed size of ${opts.maxBytes} bytes.`
+      );
+    }
+  }
+  if (!res.body) {
+    const text = await res.text();
+    if (text.length > opts.maxBytes) {
+      throw new DStorageError(
+        opts.code,
+        `${opts.component} failed: response body exceeds the maximum allowed size of ${opts.maxBytes} bytes.`
+      );
+    }
+    return text;
+  }
+  const reader = res.body.getReader();
+  const chunks = [];
+  let total = 0;
+  try {
+    for (; ; ) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      total += value.byteLength;
+      if (total > opts.maxBytes) {
+        throw new DStorageError(
+          opts.code,
+          `${opts.component} failed: response body exceeds the maximum allowed size of ${opts.maxBytes} bytes.`
+        );
+      }
+      chunks.push(value);
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  const combined = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    combined.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return new TextDecoder().decode(combined);
+}
+var import_english, import_bip39, import_chacha, import_ml_kem, import_blake3, DStorageError, CryptoErrorCode, KeyDeriver, STORAGE_ID_AAD, XCHACHA_STORAGE_ID_BYTES, XChaChaScheme, OWNER_SECRET_DOMAIN, DEFAULT_VARIANT, MLKEM_ALGO_SUFFIX;
 var init_dist = __esm({
   "../crypto/dist/index.mjs"() {
     "use strict";
-    init_english();
+    import_english = require("@scure/bip39/wordlists/english.js");
+    import_bip39 = require("@scure/bip39");
     import_chacha = require("@noble/ciphers/chacha.js");
     import_ml_kem = require("@noble/post-quantum/ml-kem.js");
     import_blake3 = require("@noble/hashes/blake3");
@@ -2527,7 +521,6 @@ var init_dist = __esm({
       MLKEM_UNKNOWN_ALGORITHM: 12017,
       MLKEM_UNKNOWN_VARIANT: 12018
     };
-    ENGLISH_WORD_SET = new Set(wordlist);
     KeyDeriver = class {
       constructor(input) {
         if (!input.mnemonic && !input.seedHex) {
@@ -2566,11 +559,10 @@ var init_dist = __esm({
           }
           return bytes;
         }
-        const words = this.input.mnemonic.trim().split(/\s+/);
-        if (!words.every((w) => ENGLISH_WORD_SET.has(w))) {
+        if (!(0, import_bip39.validateMnemonic)(this.input.mnemonic, import_english.wordlist)) {
           throw new DStorageError(
             CryptoErrorCode.MNEMONIC_INVALID,
-            "[dStorage/crypto] Invalid BIP-39 mnemonic phrase."
+            "[dStorage/crypto] Invalid BIP-39 mnemonic phrase. Unrecognized word or failed checksum."
           );
         }
         return mnemonicToSeed(this.input.mnemonic);
@@ -2642,10 +634,10 @@ var init_dist = __esm({
   }
 });
 
-// ../encryption/dist/chunk-WBLC4ONG.mjs
+// ../encryption/dist/chunk-AGSZ3S6J.mjs
 var EncryptionErrorCode;
-var init_chunk_WBLC4ONG = __esm({
-  "../encryption/dist/chunk-WBLC4ONG.mjs"() {
+var init_chunk_AGSZ3S6J = __esm({
+  "../encryption/dist/chunk-AGSZ3S6J.mjs"() {
     "use strict";
     EncryptionErrorCode = {
       KEYPAIR_MISSING_SECRET_KEY: 13001,
@@ -2657,17 +649,19 @@ var init_chunk_WBLC4ONG = __esm({
       PASSWORD_TOO_FEW_DISTINCT: 13007,
       PASSWORD_SEQUENTIAL_RUN: 13008,
       PASSWORD_KEYBOARD_WALK: 13009,
-      PASSWORD_ENTROPY_TOO_LOW: 13010
+      PASSWORD_ENTROPY_TOO_LOW: 13010,
+      PASSWORD_SCRYPT_N_TOO_LOW: 13011,
+      PASSWORD_SCRYPT_N_NOT_POWER_OF_TWO: 13012
     };
   }
 });
 
-// ../encryption/dist/chunk-SW62VRE3.mjs
+// ../encryption/dist/chunk-SOX5GKK4.mjs
 var MnemonicEncryptionAdapter;
-var init_chunk_SW62VRE3 = __esm({
-  "../encryption/dist/chunk-SW62VRE3.mjs"() {
+var init_chunk_SOX5GKK4 = __esm({
+  "../encryption/dist/chunk-SOX5GKK4.mjs"() {
     "use strict";
-    init_chunk_WBLC4ONG();
+    init_chunk_AGSZ3S6J();
     init_dist();
     init_dist();
     MnemonicEncryptionAdapter = class {
@@ -2733,7 +727,7 @@ var init_chunk_SW62VRE3 = __esm({
        * @param variant  ML-KEM variant. Default: "mlkem768".
        */
       async intoKeypairEncryptionAdapter(context, variant) {
-        const { KeypairEncryptionAdapter: KeypairEncryptionAdapter2 } = await Promise.resolve().then(() => (init_KeypairEncryptionAdapter_XUKCLRFU(), KeypairEncryptionAdapter_XUKCLRFU_exports));
+        const { KeypairEncryptionAdapter: KeypairEncryptionAdapter2 } = await Promise.resolve().then(() => (init_KeypairEncryptionAdapter_EOBRCIGP(), KeypairEncryptionAdapter_EOBRCIGP_exports));
         const { mlkemGenerateKeypairFromSeed: mlkemGenerateKeypairFromSeed2 } = await Promise.resolve().then(() => (init_dist(), dist_exports));
         const kekMaterial = await this.kekMaterialPromise;
         const mlkemBits = await globalThis.crypto.subtle.deriveBits(
@@ -2759,38 +753,38 @@ var init_chunk_SW62VRE3 = __esm({
   }
 });
 
-// ../encryption/dist/MnemonicEncryptionAdapter-RCHUETBP.mjs
-var MnemonicEncryptionAdapter_RCHUETBP_exports = {};
-__export(MnemonicEncryptionAdapter_RCHUETBP_exports, {
+// ../encryption/dist/MnemonicEncryptionAdapter-S56YG63Q.mjs
+var MnemonicEncryptionAdapter_S56YG63Q_exports = {};
+__export(MnemonicEncryptionAdapter_S56YG63Q_exports, {
   MnemonicEncryptionAdapter: () => MnemonicEncryptionAdapter
 });
-var init_MnemonicEncryptionAdapter_RCHUETBP = __esm({
-  "../encryption/dist/MnemonicEncryptionAdapter-RCHUETBP.mjs"() {
+var init_MnemonicEncryptionAdapter_S56YG63Q = __esm({
+  "../encryption/dist/MnemonicEncryptionAdapter-S56YG63Q.mjs"() {
     "use strict";
-    init_chunk_SW62VRE3();
+    init_chunk_SOX5GKK4();
   }
 });
 
-// ../encryption/dist/PasswordEncryptionAdapter-ECHND672.mjs
-var PasswordEncryptionAdapter_ECHND672_exports = {};
-__export(PasswordEncryptionAdapter_ECHND672_exports, {
+// ../encryption/dist/PasswordEncryptionAdapter-B2UG7MWB.mjs
+var PasswordEncryptionAdapter_B2UG7MWB_exports = {};
+__export(PasswordEncryptionAdapter_B2UG7MWB_exports, {
   KDF_PRESETS: () => KDF_PRESETS,
   PasswordEncryptionAdapter: () => PasswordEncryptionAdapter,
   generatePqsPassword: () => generatePqsPassword
 });
-var init_PasswordEncryptionAdapter_ECHND672 = __esm({
-  "../encryption/dist/PasswordEncryptionAdapter-ECHND672.mjs"() {
+var init_PasswordEncryptionAdapter_B2UG7MWB = __esm({
+  "../encryption/dist/PasswordEncryptionAdapter-B2UG7MWB.mjs"() {
     "use strict";
-    init_chunk_6IHXTW2Y();
+    init_chunk_ENX7VXEV();
   }
 });
 
-// ../encryption/dist/chunk-NAJYQ4J6.mjs
+// ../encryption/dist/chunk-A7BIR2QB.mjs
 var KeypairEncryptionAdapter;
-var init_chunk_NAJYQ4J6 = __esm({
-  "../encryption/dist/chunk-NAJYQ4J6.mjs"() {
+var init_chunk_A7BIR2QB = __esm({
+  "../encryption/dist/chunk-A7BIR2QB.mjs"() {
     "use strict";
-    init_chunk_WBLC4ONG();
+    init_chunk_AGSZ3S6J();
     init_dist();
     init_dist();
     KeypairEncryptionAdapter = class _KeypairEncryptionAdapter {
@@ -2848,7 +842,7 @@ var init_chunk_NAJYQ4J6 = __esm({
        * @param variant  Default: "mlkem768"
        */
       static async fromMnemonic(input, context, variant = "mlkem768") {
-        const { MnemonicEncryptionAdapter: MnemonicEncryptionAdapter2 } = await Promise.resolve().then(() => (init_MnemonicEncryptionAdapter_RCHUETBP(), MnemonicEncryptionAdapter_RCHUETBP_exports));
+        const { MnemonicEncryptionAdapter: MnemonicEncryptionAdapter2 } = await Promise.resolve().then(() => (init_MnemonicEncryptionAdapter_S56YG63Q(), MnemonicEncryptionAdapter_S56YG63Q_exports));
         const ms = new MnemonicEncryptionAdapter2(input);
         return ms.intoKeypairEncryptionAdapter(context, variant);
       }
@@ -2868,7 +862,7 @@ var init_chunk_NAJYQ4J6 = __esm({
        * @param params    Optional custom scrypt params
        */
       static async fromPassword(password, salt, context, variant = "mlkem768", params) {
-        const { PasswordEncryptionAdapter: PasswordEncryptionAdapter2 } = await Promise.resolve().then(() => (init_PasswordEncryptionAdapter_ECHND672(), PasswordEncryptionAdapter_ECHND672_exports));
+        const { PasswordEncryptionAdapter: PasswordEncryptionAdapter2 } = await Promise.resolve().then(() => (init_PasswordEncryptionAdapter_B2UG7MWB(), PasswordEncryptionAdapter_B2UG7MWB_exports));
         const ps = new PasswordEncryptionAdapter2({
           password,
           salt,
@@ -2902,19 +896,19 @@ var init_chunk_NAJYQ4J6 = __esm({
   }
 });
 
-// ../encryption/dist/KeypairEncryptionAdapter-XUKCLRFU.mjs
-var KeypairEncryptionAdapter_XUKCLRFU_exports = {};
-__export(KeypairEncryptionAdapter_XUKCLRFU_exports, {
+// ../encryption/dist/KeypairEncryptionAdapter-EOBRCIGP.mjs
+var KeypairEncryptionAdapter_EOBRCIGP_exports = {};
+__export(KeypairEncryptionAdapter_EOBRCIGP_exports, {
   KeypairEncryptionAdapter: () => KeypairEncryptionAdapter
 });
-var init_KeypairEncryptionAdapter_XUKCLRFU = __esm({
-  "../encryption/dist/KeypairEncryptionAdapter-XUKCLRFU.mjs"() {
+var init_KeypairEncryptionAdapter_EOBRCIGP = __esm({
+  "../encryption/dist/KeypairEncryptionAdapter-EOBRCIGP.mjs"() {
     "use strict";
-    init_chunk_NAJYQ4J6();
+    init_chunk_A7BIR2QB();
   }
 });
 
-// ../encryption/dist/chunk-6IHXTW2Y.mjs
+// ../encryption/dist/chunk-ENX7VXEV.mjs
 function resolveSalt(salt) {
   const bytes = typeof salt === "string" ? new TextEncoder().encode(salt) : salt;
   if (bytes.length === 0) {
@@ -2925,7 +919,22 @@ function resolveSalt(salt) {
   }
   return bytes;
 }
+function assertScryptCost(N) {
+  if (!Number.isInteger(N) || N < 2 || (N & N - 1) !== 0) {
+    throw new DStorageError(
+      EncryptionErrorCode.PASSWORD_SCRYPT_N_NOT_POWER_OF_TWO,
+      `[dStorage] PasswordEncryptionAdapter: scrypt N must be a power of two >= 2 (got ${N}).`
+    );
+  }
+  if (N < MIN_SCRYPT_N) {
+    throw new DStorageError(
+      EncryptionErrorCode.PASSWORD_SCRYPT_N_TOO_LOW,
+      `[dStorage] PasswordEncryptionAdapter: scrypt N=${N} is below the minimum cost floor of ${MIN_SCRYPT_N} (OWASP 2024 minimum, 32 MB memory-hard). A lower N makes the KDF cheap enough to brute-force offline. Use a preset ("v1" or "v1-lite") or a custom N >= 32768.`
+    );
+  }
+}
 function resolveParams(preset, params) {
+  let resolved;
   if (preset !== void 0) {
     if (!(preset in KDF_PRESETS)) {
       throw new DStorageError(
@@ -2933,13 +942,16 @@ function resolveParams(preset, params) {
         `[dStorage] PasswordEncryptionAdapter: unknown preset "${preset}". Valid presets: ${Object.keys(KDF_PRESETS).join(", ")}.`
       );
     }
-    return KDF_PRESETS[preset];
+    resolved = KDF_PRESETS[preset];
+  } else {
+    resolved = {
+      N: params?.N ?? KDF_PRESETS["v1"].N,
+      r: params?.r ?? KDF_PRESETS["v1"].r,
+      p: params?.p ?? KDF_PRESETS["v1"].p
+    };
   }
-  return {
-    N: params?.N ?? KDF_PRESETS["v1"].N,
-    r: params?.r ?? KDF_PRESETS["v1"].r,
-    p: params?.p ?? KDF_PRESETS["v1"].p
-  };
+  assertScryptCost(resolved.N);
+  return resolved;
 }
 function estimateEntropyBits(password) {
   let pool = 0;
@@ -3022,11 +1034,11 @@ function validatePassword(password, minLength, minEntropyBits, additionalValidat
     }
   }
 }
-var import_scrypt, KDF_PRESETS, PasswordEncryptionAdapter, KEYBOARD_ROWS;
-var init_chunk_6IHXTW2Y = __esm({
-  "../encryption/dist/chunk-6IHXTW2Y.mjs"() {
+var import_scrypt, KDF_PRESETS, PasswordEncryptionAdapter, MIN_SCRYPT_N, KEYBOARD_ROWS;
+var init_chunk_ENX7VXEV = __esm({
+  "../encryption/dist/chunk-ENX7VXEV.mjs"() {
     "use strict";
-    init_chunk_WBLC4ONG();
+    init_chunk_AGSZ3S6J();
     import_scrypt = require("@noble/hashes/scrypt.js");
     init_dist();
     KDF_PRESETS = {
@@ -3156,7 +1168,7 @@ var init_chunk_6IHXTW2Y = __esm({
        * @param variant  ML-KEM variant. Default: "mlkem768".
        */
       async intoKeypairEncryptionAdapter(context, variant) {
-        const { KeypairEncryptionAdapter: KeypairEncryptionAdapter2 } = await Promise.resolve().then(() => (init_KeypairEncryptionAdapter_XUKCLRFU(), KeypairEncryptionAdapter_XUKCLRFU_exports));
+        const { KeypairEncryptionAdapter: KeypairEncryptionAdapter2 } = await Promise.resolve().then(() => (init_KeypairEncryptionAdapter_EOBRCIGP(), KeypairEncryptionAdapter_EOBRCIGP_exports));
         const { mlkemGenerateKeypairFromSeed: mlkemGenerateKeypairFromSeed2 } = await Promise.resolve().then(() => (init_dist(), dist_exports));
         const kekMaterial = await this.kekMaterialPromise;
         const mlkemBits = await globalThis.crypto.subtle.deriveBits(
@@ -3179,14 +1191,15 @@ var init_chunk_6IHXTW2Y = __esm({
         }
       }
     };
+    MIN_SCRYPT_N = 32768;
     KEYBOARD_ROWS = ["qwertyuiop", "asdfghjkl", "zxcvbnm", "1234567890"];
   }
 });
 
-// ../chain/dist/chunk-AGLD4HA4.mjs
+// ../chain/dist/chunk-XMWGGIPS.mjs
 var ChainErrorCode;
-var init_chunk_AGLD4HA4 = __esm({
-  "../chain/dist/chunk-AGLD4HA4.mjs"() {
+var init_chunk_XMWGGIPS = __esm({
+  "../chain/dist/chunk-XMWGGIPS.mjs"() {
     "use strict";
     ChainErrorCode = {
       // mock.ts — 11001-11009
@@ -3210,6 +1223,8 @@ var init_chunk_AGLD4HA4 = __esm({
       GATEWAY_LIST_NOT_ARRAY: 11212,
       GATEWAY_REMOVE_FAILED: 11213,
       GATEWAY_REMOVE_HTTP_ERROR: 11214,
+      GATEWAY_READ_RESPONSE_TOO_LARGE: 11215,
+      GATEWAY_LIST_RESPONSE_TOO_LARGE: 11216,
       // contract-api.ts — 11401-11409
       CONTRACT_UNSUPPORTED_VERSION: 11401,
       CONTRACT_CIRCUIT_RESULT_MISSING: 11402,
@@ -14138,9 +12153,9 @@ var init_in_memory_private_state_NGOP37V7 = __esm({
   }
 });
 
-// ../chain/dist/contract-api-TJ7JPHZA.mjs
-var contract_api_TJ7JPHZA_exports = {};
-__export(contract_api_TJ7JPHZA_exports, {
+// ../chain/dist/contract-api-NUY4UEKE.mjs
+var contract_api_NUY4UEKE_exports = {};
+__export(contract_api_NUY4UEKE_exports, {
   DataRegistryAPI: () => DataRegistryAPI,
   SUPPORTED_CONTRACT_VERSION: () => SUPPORTED_CONTRACT_VERSION,
   dataRegistryPrivateStateKey: () => dataRegistryPrivateStateKey,
@@ -14156,10 +12171,10 @@ function validateContractVersion(version, contractAddress) {
   }
 }
 var import_midnight_js_contracts, import_rxjs, import_midnight_js_utils, dataRegistryPrivateStateKey, SUPPORTED_CONTRACT_VERSION, DataRegistryAPI, randomBytes;
-var init_contract_api_TJ7JPHZA = __esm({
-  "../chain/dist/contract-api-TJ7JPHZA.mjs"() {
+var init_contract_api_NUY4UEKE = __esm({
+  "../chain/dist/contract-api-NUY4UEKE.mjs"() {
     "use strict";
-    init_chunk_AGLD4HA4();
+    init_chunk_XMWGGIPS();
     init_chunk_I3XXA2G7();
     import_midnight_js_contracts = require("@midnight-ntwrk/midnight-js-contracts");
     import_rxjs = __toESM(require_cjs(), 1);
@@ -14470,6 +12485,7 @@ __export(index_publish_exports, {
   mlkemUnwrapDek: () => mlkemUnwrapDek,
   mlkemWrapDek: () => mlkemWrapDek,
   parseKeyEnvelope: () => parseKeyEnvelope,
+  readResponseTextWithLimit: () => readResponseTextWithLimit,
   serializeKeyEnvelope: () => serializeKeyEnvelope,
   serializeXChaChaPayload: () => serializeXChaChaPayload,
   unwrapKey: () => unwrapKey,
@@ -14527,6 +12543,7 @@ var CoreErrorCode = {
   STORAGE_ADAPTER_MISMATCH: 10052,
   RETRIEVE_BY_REF_ID_ENVELOPE_EMPTY: 10053,
   CONTENT_HASH_MISMATCH: 10054,
+  METADATA_PARSE_FAILED: 10055,
   // listReferences — 10060-10069
   LIST_REFS_REQUIRES_CHAIN: 10060,
   LIST_REFS_NOT_SUPPORTED: 10061,
@@ -14540,6 +12557,7 @@ var CoreErrorCode = {
   DECRYPT_CHUNK_FAILED: 10093,
   CHUNK_OVERFLOWS_TOTAL_SIZE: 10094,
   REASSEMBLY_SIZE_MISMATCH: 10095,
+  MANIFEST_PARSE_FAILED: 10096,
   // init state — 10100-10109
   NOT_INITIALIZED: 10100,
   // generic catch-all — 10999
@@ -14562,7 +12580,7 @@ function isStorePartialError(err) {
 // package.json
 var package_default = {
   name: "@dstorage-tech/dstorage-sdk",
-  version: "0.0.6",
+  version: "0.0.8",
   description: "Privacy-first decentralized storage SDK with pluggable adapters",
   license: "MIT",
   homepage: "https://dstorage.pro",
@@ -14638,10 +12656,11 @@ var package_default = {
     "@midnight-ntwrk/midnight-js-protocol": "4.1.1",
     "@midnight-ntwrk/midnight-js-types": "4.1.1",
     "@midnight-ntwrk/midnight-js-utils": "4.1.1",
-    "@midnight-ntwrk/wallet-sdk": "1.1.0",
+    "@midnight-ntwrk/wallet-sdk": "1.2.0",
     "@noble/ciphers": "^2.2.0",
     "@noble/hashes": "^1.5.0",
     "@noble/post-quantum": "^0.6.1",
+    "@scure/bip39": "^2.0.1",
     arweave: "^1.15.7"
   },
   devDependencies: {
@@ -14716,6 +12735,9 @@ var DStorage = class {
   }
   /** Tear down active state and clear all in-memory key material. */
   destroy() {
+    for (const provider of this._encryptionProviders) {
+      provider.destroy?.();
+    }
     this.wallet = null;
     this._encryptionProviders = [];
     this._initialized = false;
@@ -14815,20 +12837,24 @@ var DStorage = class {
             );
           }
           const ownerSeed = generateDek();
-          const ownerSeedWrappers = await Promise.all(
-            this._encryptionProviders.map(async (provider) => ({
-              wrapKeyName: provider.name,
-              ...await provider.wrapDek(ownerSeed)
-            }))
-          );
-          keyEnvelope = serializeKeyEnvelope(
-            buildKeyEnvelope(ownerSeedWrappers)
-          );
-          ownerSecret = await deriveOwnerSecret(
-            ownerSeed,
-            new TextEncoder().encode(storageResult.id),
-            "dstorage:owner-secret:public:v1"
-          );
+          try {
+            const ownerSeedWrappers = await Promise.all(
+              this._encryptionProviders.map(async (provider) => ({
+                wrapKeyName: provider.name,
+                ...await provider.wrapDek(ownerSeed)
+              }))
+            );
+            keyEnvelope = serializeKeyEnvelope(
+              buildKeyEnvelope(ownerSeedWrappers)
+            );
+            ownerSecret = await deriveOwnerSecret(
+              ownerSeed,
+              new TextEncoder().encode(storageResult.id),
+              "dstorage:owner-secret:public:v1"
+            );
+          } finally {
+            ownerSeed.fill(0);
+          }
         }
         onChainStorageId = storageResult.id;
       } else {
@@ -14901,6 +12927,8 @@ var DStorage = class {
           };
         } catch {
           throw new StorePartialError(storeRecovery);
+        } finally {
+          dek?.fill(0);
         }
       }
       this.logger?.log(
@@ -15261,7 +13289,10 @@ var DStorage = class {
   async retrieveByStorageId(storageId, dekScheme, contentHash) {
     try {
       this.assertConnected();
-      const { bytes: rawBytes, tags } = await this.config.storageAdapter.retrieve(storageId);
+      const { bytes: rawBytes, tags } = await this.config.storageAdapter.retrieve(
+        storageId,
+        contentHash !== void 0 ? { expectedContentHash: contentHash } : void 0
+      );
       if (contentHash) {
         const computed = await computeBlake3Hex(rawBytes);
         if (computed !== contentHash) {
@@ -15402,9 +13433,16 @@ var DStorage = class {
       } catch {
       }
       if (manifestBytes !== null) {
-        const parsed = JSON.parse(
-          new TextDecoder().decode(manifestBytes)
-        );
+        let parsed;
+        try {
+          parsed = JSON.parse(new TextDecoder().decode(manifestBytes));
+        } catch (err) {
+          throw new DStorageError(
+            CoreErrorCode.MANIFEST_PARSE_FAILED,
+            `[dStorage] Payload authenticated as manifest but is not valid JSON: ${err}`,
+            { cause: err }
+          );
+        }
         if (!isManifest(parsed)) {
           throw new DStorageError(
             CoreErrorCode.MANIFEST_INVALID_STRUCTURE,
@@ -15528,7 +13566,15 @@ var DStorage = class {
           base64urlToBytes(ref.encryptedMetadata),
           METADATA_AAD
         );
-        metadata = JSON.parse(new TextDecoder().decode(raw));
+        try {
+          metadata = JSON.parse(new TextDecoder().decode(raw));
+        } catch (err) {
+          throw new DStorageError(
+            CoreErrorCode.METADATA_PARSE_FAILED,
+            `[dStorage] Decrypted metadata is not valid JSON: ${err}`,
+            { cause: err }
+          );
+        }
       }
       return { bytes: contentBytes, tags: contentTags, metadata };
     } catch (err) {
@@ -15873,12 +13919,17 @@ var DStorage = class {
         };
       } catch {
         throw new StorePartialError(storeRecovery);
+      } finally {
+        chunkDek?.fill(0);
+        ownerSeed?.fill(0);
       }
     }
     this.logger?.log(
       "dStorage",
       `Chunked upload complete (storage-only) \u2192 ${totalChunks} chunks + manifest, storageId: ${manifestResult.id}`
     );
+    chunkDek?.fill(0);
+    ownerSeed?.fill(0);
     return {
       storageId: manifestResult.id,
       storageProvider: manifestResult.provider,
@@ -15971,15 +14022,15 @@ var DStorage = class {
 init_dist();
 
 // ../encryption/dist/index.mjs
-init_chunk_6IHXTW2Y();
-init_chunk_NAJYQ4J6();
-init_chunk_SW62VRE3();
-init_chunk_WBLC4ONG();
+init_chunk_ENX7VXEV();
+init_chunk_A7BIR2QB();
+init_chunk_SOX5GKK4();
+init_chunk_AGSZ3S6J();
 
 // src/index.publish.ts
 init_dist();
 
-// ../storage/dist/chunk-URI7FNOW.mjs
+// ../storage/dist/chunk-3LIX4E3N.mjs
 var StorageErrorCode = {
   // adapters/mock.ts (15000–15049)
   MOCK_AUTH_TOKEN_REQUIRED: 15001,
@@ -16018,7 +14069,8 @@ var StorageErrorCode = {
   ARWEAVE_BUNDLER_INVALID_AUTH_TOKEN_FORMAT: 15411,
   ARWEAVE_BUNDLER_INVALID_AUTH_TOKEN_KEY: 15412,
   ARWEAVE_BUNDLER_NO_TX_ID_RETURNED: 15413,
-  ARWEAVE_BUNDLER_UPLOAD_FAILED: 15414
+  ARWEAVE_BUNDLER_UPLOAD_FAILED: 15414,
+  ARWEAVE_BUNDLER_METADATA_TOO_LARGE: 15415
 };
 
 // ../payment/dist/chunk-IVL4WQ5Y.mjs
@@ -16689,7 +14741,7 @@ var ManagedPaymentAdapter = class _ManagedPaymentAdapter extends ArweavePaymentA
   }
 };
 
-// ../storage/dist/chunk-BIT7XMIA.mjs
+// ../storage/dist/chunk-AE5AGNHP.mjs
 init_dist();
 var memoryStore = /* @__PURE__ */ new Map();
 function bytesToBase64url2(bytes) {
@@ -16972,7 +15024,7 @@ var ArweaveStorageAdapter = class {
     };
   }
   // ── retrieve ───────────────────────────────────────────────────────────────────
-  async retrieve(id) {
+  async retrieve(id, options) {
     if (!/^[A-Za-z0-9_-]{43}$/.test(id)) {
       throw new DStorageError(
         StorageErrorCode.ARWEAVE_INVALID_TX_ID,
@@ -17036,14 +15088,15 @@ Check status at: https://viewblock.io/arweave/tx/${id}`
       );
     }
     if (!this.skipIntegrityCheck) {
-      if (!storedHash) {
+      const anchorHash = options?.expectedContentHash;
+      if (!anchorHash && !storedHash) {
         throw new DStorageError(
           StorageErrorCode.ARWEAVE_HASH_TAG_MISSING,
-          `[dStorage/arweave] ${CONTENT_HASH_TAG2} tag not found for txId: ${id}.
+          `[dStorage/arweave] Cannot verify content integrity for txId: ${id} \u2014 no expectedContentHash anchor was provided and the ${CONTENT_HASH_TAG2} tag was not found.
 Set skipIntegrityCheck: true to bypass integrity checking for fully trusted gateways.`
         );
       }
-      await assertContentHash(id, bytes, storedHash, "arweave");
+      await assertContentHash(id, bytes, anchorHash ?? storedHash, "arweave");
     }
     this.logger?.log("dStorage/arweave", `Retrieved txId: ${id}`);
     return { bytes, tags };
@@ -17167,14 +15220,19 @@ async function getTurboFactory() {
   return TurboFactory;
 }
 var ARWEAVE_GATEWAY_URL = "https://turbo-gateway.com";
+var DEFAULT_REQUEST_TIMEOUT_MS = 3e4;
+var DEFAULT_MAX_METADATA_RESPONSE_BYTES = 1024 * 1024;
+var DEFAULT_MAX_RETRIEVE_SIZE_BYTES = 256 * 1024 * 1024;
 var ArweaveBundlerStorageAdapter = class _ArweaveBundlerStorageAdapter {
   constructor(config = {}) {
     this.name = "arweave_bundler";
     this.providerName = "Arweave (Bundler)";
     this.signingServerUrl = config.signingServerUrl ? config.signingServerUrl.replace(/\/$/, "") : null;
     this.gateway = config.gateway ?? ARWEAVE_GATEWAY_URL;
-    this.maxRetrieveSizeBytes = config.maxRetrieveSizeBytes ?? 256 * 1024 * 1024;
+    this.maxRetrieveSizeBytes = config.maxRetrieveSizeBytes ?? DEFAULT_MAX_RETRIEVE_SIZE_BYTES;
     this.skipIntegrityCheck = config.skipIntegrityCheck ?? false;
+    this.requestTimeoutMs = config.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
+    this.maxMetadataResponseBytes = config.maxMetadataResponseBytes ?? DEFAULT_MAX_METADATA_RESPONSE_BYTES;
     this.logger = config.logger;
     if (config.signingServerUrl) {
       if (!config.authToken?.trim()) {
@@ -17225,8 +15283,13 @@ var ArweaveBundlerStorageAdapter = class _ArweaveBundlerStorageAdapter {
     );
     return { id: txId, provider: this.name, url, uploadedAt: Date.now() };
   }
+  /** Adds an AbortSignal.timeout() to a fetch init object (when requestTimeoutMs > 0). */
+  _withTimeout(init = {}) {
+    const signal = this.requestTimeoutMs > 0 ? AbortSignal.timeout(this.requestTimeoutMs) : void 0;
+    return { ...init, ...signal !== void 0 ? { signal } : {} };
+  }
   // ── retrieve ───────────────────────────────────────────────────────────────────
-  async retrieve(id) {
+  async retrieve(id, options) {
     if (!/^[A-Za-z0-9_-]{43}$/.test(id)) {
       throw new DStorageError(
         StorageErrorCode.ARWEAVE_BUNDLER_INVALID_TX_ID,
@@ -17236,29 +15299,37 @@ var ArweaveBundlerStorageAdapter = class _ArweaveBundlerStorageAdapter {
     let storedHash;
     const tags = {};
     if (!this.skipIntegrityCheck) {
-      const metaResp = await fetch(`${this.gateway}/tx/${id}`);
+      const metaResp = await fetch(
+        `${this.gateway}/tx/${id}`,
+        this._withTimeout()
+      );
       if (!metaResp.ok) {
         throw new DStorageError(
           StorageErrorCode.ARWEAVE_BUNDLER_TX_METADATA_FAILED,
           `[dStorage/arweave-bundler] Could not fetch transaction metadata for txId: ${id} \u2014 content hash cannot be verified. Set skipIntegrityCheck: true to bypass integrity checking for fully trusted gateways.`
         );
       }
-      const tx = await metaResp.json();
+      const metaText = await readResponseTextWithLimit(metaResp, {
+        maxBytes: this.maxMetadataResponseBytes,
+        code: StorageErrorCode.ARWEAVE_BUNDLER_METADATA_TOO_LARGE,
+        component: `[dStorage/arweave-bundler] retrieve(${id}) metadata`
+      });
+      const tx = JSON.parse(metaText);
       for (const tag of tx.tags ?? []) {
         const name = new TextDecoder().decode(_base64urlToBytes(tag.name));
         const value = new TextDecoder().decode(_base64urlToBytes(tag.value));
         tags[name] = value;
         if (name === CONTENT_HASH_TAG2) storedHash = value;
       }
-      if (!storedHash) {
+      if (!options?.expectedContentHash && !storedHash) {
         throw new DStorageError(
           StorageErrorCode.ARWEAVE_BUNDLER_HASH_TAG_MISSING,
-          `[dStorage/arweave-bundler] ${CONTENT_HASH_TAG2} tag not found for txId: ${id}.
+          `[dStorage/arweave-bundler] Cannot verify content integrity for txId: ${id} \u2014 no expectedContentHash anchor was provided and the ${CONTENT_HASH_TAG2} tag was not found.
 Set skipIntegrityCheck: true to bypass integrity checking for fully trusted gateways.`
         );
       }
     }
-    const resp = await fetch(`${this.gateway}/${id}`);
+    const resp = await fetch(`${this.gateway}/${id}`, this._withTimeout());
     if (!resp.ok) {
       throw new DStorageError(
         StorageErrorCode.ARWEAVE_BUNDLER_RETRIEVE_HTTP_ERROR,
@@ -17283,8 +15354,14 @@ Check: https://viewblock.io/arweave/tx/${id}`
         `[dStorage/arweave-bundler] Downloaded ${bytes.byteLength} bytes for txId: ${id}, which exceeds the configured limit of ${this.maxRetrieveSizeBytes} bytes.`
       );
     }
-    if (!this.skipIntegrityCheck && storedHash) {
-      await assertContentHash(id, bytes, storedHash, "arweave-bundler");
+    const anchorHash = options?.expectedContentHash;
+    if (!this.skipIntegrityCheck && (anchorHash || storedHash)) {
+      await assertContentHash(
+        id,
+        bytes,
+        anchorHash ?? storedHash,
+        "arweave-bundler"
+      );
     }
     this.logger?.log("dStorage/arweave-bundler", `Retrieved txId: ${id}`);
     return { bytes, tags };
@@ -17731,8 +15808,8 @@ var ArweaveLocalError = class extends Error {
   }
 };
 
-// ../chain/dist/chunk-BK2EFMQI.mjs
-init_chunk_AGLD4HA4();
+// ../chain/dist/chunk-5EPK5N7O.mjs
+init_chunk_XMWGGIPS();
 init_dist();
 var refs = /* @__PURE__ */ new Map();
 var commitments = /* @__PURE__ */ new Map();
@@ -17894,7 +15971,7 @@ var MockChainAdapter = class {
 };
 
 // ../chain/dist/index.mjs
-init_chunk_AGLD4HA4();
+init_chunk_XMWGGIPS();
 init_dist();
 init_dist();
 init_dist();
@@ -18102,6 +16179,8 @@ var MidnightSimulatorChainAdapter = class {
   }
 };
 var COMPONENT = "[dStorage/http-gateway-chain]";
+var DEFAULT_REQUEST_TIMEOUT_MS2 = 3e4;
+var DEFAULT_MAX_RESPONSE_BYTES = 10 * 1024 * 1024;
 function generateRefId2() {
   const id = typeof crypto !== "undefined" && typeof crypto.randomUUID === "function" ? crypto.randomUUID() : `${Date.now()}-${Math.random().toString(36).slice(2)}`;
   return `ref_${id}`;
@@ -18117,6 +16196,13 @@ var HttpGatewayChainAdapter = class {
     this.readUrl = `${config.baseUrl}${config.readPath}`;
     this.listUrl = `${config.baseUrl}${config.listPath}`;
     this.deleteUrl = `${config.baseUrl}${config.deletePath}`;
+    this.requestTimeoutMs = config.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS2;
+    this.maxResponseBytes = config.maxResponseBytes ?? DEFAULT_MAX_RESPONSE_BYTES;
+  }
+  /** Adds an AbortSignal.timeout() to a fetch init object (when requestTimeoutMs > 0). */
+  _withTimeout(init) {
+    const signal = this.requestTimeoutMs > 0 ? AbortSignal.timeout(this.requestTimeoutMs) : void 0;
+    return { ...init, ...signal !== void 0 ? { signal } : {} };
   }
   async writeReference(ref) {
     const { ownerSecret: _omit, ...payload } = ref;
@@ -18124,11 +16210,17 @@ var HttpGatewayChainAdapter = class {
     const url = `${this.writeUrl}/${encodeURIComponent(refId)}`;
     let res;
     try {
-      res = await this.fetchFn(url, {
-        method: "POST",
-        headers: { "Content-Type": "application/json", ...this.extraHeaders },
-        body: JSON.stringify(payload)
-      });
+      res = await this.fetchFn(
+        url,
+        this._withTimeout({
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json",
+            ...this.extraHeaders
+          },
+          body: JSON.stringify(payload)
+        })
+      );
     } catch (err) {
       throw new DStorageError(
         ChainErrorCode.GATEWAY_WRITE_FAILED,
@@ -18154,11 +16246,17 @@ var HttpGatewayChainAdapter = class {
     const url = `${this.writeUrl}/${encodeURIComponent(refId)}`;
     let res;
     try {
-      res = await this.fetchFn(url, {
-        method: "POST",
-        headers: { "Content-Type": "application/json", ...this.extraHeaders },
-        body: JSON.stringify(update)
-      });
+      res = await this.fetchFn(
+        url,
+        this._withTimeout({
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json",
+            ...this.extraHeaders
+          },
+          body: JSON.stringify(update)
+        })
+      );
     } catch (err) {
       throw new DStorageError(
         ChainErrorCode.GATEWAY_UPDATE_FAILED,
@@ -18179,7 +16277,10 @@ var HttpGatewayChainAdapter = class {
     const url = `${this.readUrl}/${encodeURIComponent(refId)}`;
     let res;
     try {
-      res = await this.fetchFn(url, { headers: { ...this.extraHeaders } });
+      res = await this.fetchFn(
+        url,
+        this._withTimeout({ headers: { ...this.extraHeaders } })
+      );
     } catch (err) {
       throw new DStorageError(
         ChainErrorCode.GATEWAY_READ_FAILED,
@@ -18194,9 +16295,14 @@ var HttpGatewayChainAdapter = class {
         { httpStatus: res.status }
       );
     }
+    const text = await readResponseTextWithLimit(res, {
+      maxBytes: this.maxResponseBytes,
+      code: ChainErrorCode.GATEWAY_READ_RESPONSE_TOO_LARGE,
+      component: `${COMPONENT} readReference`
+    });
     let data;
     try {
-      data = await res.json();
+      data = JSON.parse(text);
     } catch {
       throw new DStorageError(
         ChainErrorCode.GATEWAY_READ_INVALID_JSON,
@@ -18215,9 +16321,10 @@ var HttpGatewayChainAdapter = class {
   async listReferences() {
     let res;
     try {
-      res = await this.fetchFn(this.listUrl, {
-        headers: { ...this.extraHeaders }
-      });
+      res = await this.fetchFn(
+        this.listUrl,
+        this._withTimeout({ headers: { ...this.extraHeaders } })
+      );
     } catch (err) {
       throw new DStorageError(
         ChainErrorCode.GATEWAY_LIST_FAILED,
@@ -18232,9 +16339,14 @@ var HttpGatewayChainAdapter = class {
         { httpStatus: res.status }
       );
     }
+    const text = await readResponseTextWithLimit(res, {
+      maxBytes: this.maxResponseBytes,
+      code: ChainErrorCode.GATEWAY_LIST_RESPONSE_TOO_LARGE,
+      component: `${COMPONENT} listReferences`
+    });
     let data;
     try {
-      data = await res.json();
+      data = JSON.parse(text);
     } catch {
       throw new DStorageError(
         ChainErrorCode.GATEWAY_LIST_INVALID_JSON,
@@ -18267,11 +16379,17 @@ var HttpGatewayChainAdapter = class {
     const body = ownerSecret !== void 0 ? { ownerSecret: bytesToBase64url(ownerSecret) } : {};
     let res;
     try {
-      res = await this.fetchFn(url, {
-        method: "DELETE",
-        headers: { "Content-Type": "application/json", ...this.extraHeaders },
-        body: JSON.stringify(body)
-      });
+      res = await this.fetchFn(
+        url,
+        this._withTimeout({
+          method: "DELETE",
+          headers: {
+            "Content-Type": "application/json",
+            ...this.extraHeaders
+          },
+          body: JSON.stringify(body)
+        })
+      );
     } catch (err) {
       throw new DStorageError(
         ChainErrorCode.GATEWAY_REMOVE_FAILED,
@@ -18318,16 +16436,16 @@ var NETWORKS = {
     networkId: "preprod",
     nodeHttp: "https://rpc.preprod.midnight.network",
     nodeWs: "wss://rpc.preprod.midnight.network",
-    indexerHttp: "https://indexer.preprod.midnight.network/api/v3/graphql",
-    indexerWs: "wss://indexer.preprod.midnight.network/api/v3/graphql/ws",
+    indexerHttp: "https://indexer.preprod.midnight.network/api/v4/graphql",
+    indexerWs: "wss://indexer.preprod.midnight.network/api/v4/graphql/ws",
     proofServer: "http://127.0.0.1:6300"
   },
   undeployed: {
     networkId: "undeployed",
     nodeHttp: "http://127.0.0.1:9944",
     nodeWs: "ws://127.0.0.1:9944",
-    indexerHttp: "http://127.0.0.1:8088/api/v3/graphql",
-    indexerWs: "ws://127.0.0.1:8088/api/v3/graphql/ws",
+    indexerHttp: "http://127.0.0.1:8088/api/v4/graphql",
+    indexerWs: "ws://127.0.0.1:8088/api/v4/graphql/ws",
     proofServer: "http://127.0.0.1:6300"
   }
 };
@@ -18737,7 +16855,7 @@ var MidnightChainAdapter = class _MidnightChainAdapter {
     } else {
       providers = await this._buildWalletProviderMode();
     }
-    const { DataRegistryAPI: DataRegistryAPI2 } = await Promise.resolve().then(() => (init_contract_api_TJ7JPHZA(), contract_api_TJ7JPHZA_exports));
+    const { DataRegistryAPI: DataRegistryAPI2 } = await Promise.resolve().then(() => (init_contract_api_NUY4UEKE(), contract_api_NUY4UEKE_exports));
     if (!this._contractAddress) {
       this.logger?.log("dStorage/midnight", "Deploying DataRegistry contract\u2026");
       this._api = await DataRegistryAPI2.deploy(providers, this.logger);
@@ -19276,6 +17394,7 @@ var MidnightChainAdapter = class _MidnightChainAdapter {
   mlkemUnwrapDek,
   mlkemWrapDek,
   parseKeyEnvelope,
+  readResponseTextWithLimit,
   serializeKeyEnvelope,
   serializeXChaChaPayload,
   unwrapKey,