@paigy/mcp 0.12.1 → 0.13.0

package/dist/chunk-O6W2T6D2.js

@@ -0,0 +1,3312 @@
+import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+var __commonJS = (cb, mod) => function __require2() {
+  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+
+// ../../node_modules/.pnpm/tweetnacl@1.0.3/node_modules/tweetnacl/nacl-fast.js
+var require_nacl_fast = __commonJS({
+  "../../node_modules/.pnpm/tweetnacl@1.0.3/node_modules/tweetnacl/nacl-fast.js"(exports, module) {
+    "use strict";
+    (function(nacl6) {
+      "use strict";
+      var gf = function(init) {
+        var i, r = new Float64Array(16);
+        if (init) for (i = 0; i < init.length; i++) r[i] = init[i];
+        return r;
+      };
+      var randombytes = function() {
+        throw new Error("no PRNG");
+      };
+      var _0 = new Uint8Array(16);
+      var _9 = new Uint8Array(32);
+      _9[0] = 9;
+      var gf0 = gf(), gf1 = gf([1]), _121665 = gf([56129, 1]), D = gf([30883, 4953, 19914, 30187, 55467, 16705, 2637, 112, 59544, 30585, 16505, 36039, 65139, 11119, 27886, 20995]), D2 = gf([61785, 9906, 39828, 60374, 45398, 33411, 5274, 224, 53552, 61171, 33010, 6542, 64743, 22239, 55772, 9222]), X = gf([54554, 36645, 11616, 51542, 42930, 38181, 51040, 26924, 56412, 64982, 57905, 49316, 21502, 52590, 14035, 8553]), Y = gf([26200, 26214, 26214, 26214, 26214, 26214, 26214, 26214, 26214, 26214, 26214, 26214, 26214, 26214, 26214, 26214]), I = gf([41136, 18958, 6951, 50414, 58488, 44335, 6150, 12099, 55207, 15867, 153, 11085, 57099, 20417, 9344, 11139]);
+      function ts64(x, i, h, l) {
+        x[i] = h >> 24 & 255;
+        x[i + 1] = h >> 16 & 255;
+        x[i + 2] = h >> 8 & 255;
+        x[i + 3] = h & 255;
+        x[i + 4] = l >> 24 & 255;
+        x[i + 5] = l >> 16 & 255;
+        x[i + 6] = l >> 8 & 255;
+        x[i + 7] = l & 255;
+      }
+      function vn(x, xi, y, yi, n) {
+        var i, d = 0;
+        for (i = 0; i < n; i++) d |= x[xi + i] ^ y[yi + i];
+        return (1 & d - 1 >>> 8) - 1;
+      }
+      function crypto_verify_16(x, xi, y, yi) {
+        return vn(x, xi, y, yi, 16);
+      }
+      function crypto_verify_32(x, xi, y, yi) {
+        return vn(x, xi, y, yi, 32);
+      }
+      function core_salsa20(o, p, k, c) {
+        var j0 = c[0] & 255 | (c[1] & 255) << 8 | (c[2] & 255) << 16 | (c[3] & 255) << 24, j1 = k[0] & 255 | (k[1] & 255) << 8 | (k[2] & 255) << 16 | (k[3] & 255) << 24, j2 = k[4] & 255 | (k[5] & 255) << 8 | (k[6] & 255) << 16 | (k[7] & 255) << 24, j3 = k[8] & 255 | (k[9] & 255) << 8 | (k[10] & 255) << 16 | (k[11] & 255) << 24, j4 = k[12] & 255 | (k[13] & 255) << 8 | (k[14] & 255) << 16 | (k[15] & 255) << 24, j5 = c[4] & 255 | (c[5] & 255) << 8 | (c[6] & 255) << 16 | (c[7] & 255) << 24, j6 = p[0] & 255 | (p[1] & 255) << 8 | (p[2] & 255) << 16 | (p[3] & 255) << 24, j7 = p[4] & 255 | (p[5] & 255) << 8 | (p[6] & 255) << 16 | (p[7] & 255) << 24, j8 = p[8] & 255 | (p[9] & 255) << 8 | (p[10] & 255) << 16 | (p[11] & 255) << 24, j9 = p[12] & 255 | (p[13] & 255) << 8 | (p[14] & 255) << 16 | (p[15] & 255) << 24, j10 = c[8] & 255 | (c[9] & 255) << 8 | (c[10] & 255) << 16 | (c[11] & 255) << 24, j11 = k[16] & 255 | (k[17] & 255) << 8 | (k[18] & 255) << 16 | (k[19] & 255) << 24, j12 = k[20] & 255 | (k[21] & 255) << 8 | (k[22] & 255) << 16 | (k[23] & 255) << 24, j13 = k[24] & 255 | (k[25] & 255) << 8 | (k[26] & 255) << 16 | (k[27] & 255) << 24, j14 = k[28] & 255 | (k[29] & 255) << 8 | (k[30] & 255) << 16 | (k[31] & 255) << 24, j15 = c[12] & 255 | (c[13] & 255) << 8 | (c[14] & 255) << 16 | (c[15] & 255) << 24;
+        var x0 = j0, x1 = j1, x2 = j2, x3 = j3, x4 = j4, x5 = j5, x6 = j6, x7 = j7, x8 = j8, x9 = j9, x10 = j10, x11 = j11, x12 = j12, x13 = j13, x14 = j14, x15 = j15, u;
+        for (var i = 0; i < 20; i += 2) {
+          u = x0 + x12 | 0;
+          x4 ^= u << 7 | u >>> 32 - 7;
+          u = x4 + x0 | 0;
+          x8 ^= u << 9 | u >>> 32 - 9;
+          u = x8 + x4 | 0;
+          x12 ^= u << 13 | u >>> 32 - 13;
+          u = x12 + x8 | 0;
+          x0 ^= u << 18 | u >>> 32 - 18;
+          u = x5 + x1 | 0;
+          x9 ^= u << 7 | u >>> 32 - 7;
+          u = x9 + x5 | 0;
+          x13 ^= u << 9 | u >>> 32 - 9;
+          u = x13 + x9 | 0;
+          x1 ^= u << 13 | u >>> 32 - 13;
+          u = x1 + x13 | 0;
+          x5 ^= u << 18 | u >>> 32 - 18;
+          u = x10 + x6 | 0;
+          x14 ^= u << 7 | u >>> 32 - 7;
+          u = x14 + x10 | 0;
+          x2 ^= u << 9 | u >>> 32 - 9;
+          u = x2 + x14 | 0;
+          x6 ^= u << 13 | u >>> 32 - 13;
+          u = x6 + x2 | 0;
+          x10 ^= u << 18 | u >>> 32 - 18;
+          u = x15 + x11 | 0;
+          x3 ^= u << 7 | u >>> 32 - 7;
+          u = x3 + x15 | 0;
+          x7 ^= u << 9 | u >>> 32 - 9;
+          u = x7 + x3 | 0;
+          x11 ^= u << 13 | u >>> 32 - 13;
+          u = x11 + x7 | 0;
+          x15 ^= u << 18 | u >>> 32 - 18;
+          u = x0 + x3 | 0;
+          x1 ^= u << 7 | u >>> 32 - 7;
+          u = x1 + x0 | 0;
+          x2 ^= u << 9 | u >>> 32 - 9;
+          u = x2 + x1 | 0;
+          x3 ^= u << 13 | u >>> 32 - 13;
+          u = x3 + x2 | 0;
+          x0 ^= u << 18 | u >>> 32 - 18;
+          u = x5 + x4 | 0;
+          x6 ^= u << 7 | u >>> 32 - 7;
+          u = x6 + x5 | 0;
+          x7 ^= u << 9 | u >>> 32 - 9;
+          u = x7 + x6 | 0;
+          x4 ^= u << 13 | u >>> 32 - 13;
+          u = x4 + x7 | 0;
+          x5 ^= u << 18 | u >>> 32 - 18;
+          u = x10 + x9 | 0;
+          x11 ^= u << 7 | u >>> 32 - 7;
+          u = x11 + x10 | 0;
+          x8 ^= u << 9 | u >>> 32 - 9;
+          u = x8 + x11 | 0;
+          x9 ^= u << 13 | u >>> 32 - 13;
+          u = x9 + x8 | 0;
+          x10 ^= u << 18 | u >>> 32 - 18;
+          u = x15 + x14 | 0;
+          x12 ^= u << 7 | u >>> 32 - 7;
+          u = x12 + x15 | 0;
+          x13 ^= u << 9 | u >>> 32 - 9;
+          u = x13 + x12 | 0;
+          x14 ^= u << 13 | u >>> 32 - 13;
+          u = x14 + x13 | 0;
+          x15 ^= u << 18 | u >>> 32 - 18;
+        }
+        x0 = x0 + j0 | 0;
+        x1 = x1 + j1 | 0;
+        x2 = x2 + j2 | 0;
+        x3 = x3 + j3 | 0;
+        x4 = x4 + j4 | 0;
+        x5 = x5 + j5 | 0;
+        x6 = x6 + j6 | 0;
+        x7 = x7 + j7 | 0;
+        x8 = x8 + j8 | 0;
+        x9 = x9 + j9 | 0;
+        x10 = x10 + j10 | 0;
+        x11 = x11 + j11 | 0;
+        x12 = x12 + j12 | 0;
+        x13 = x13 + j13 | 0;
+        x14 = x14 + j14 | 0;
+        x15 = x15 + j15 | 0;
+        o[0] = x0 >>> 0 & 255;
+        o[1] = x0 >>> 8 & 255;
+        o[2] = x0 >>> 16 & 255;
+        o[3] = x0 >>> 24 & 255;
+        o[4] = x1 >>> 0 & 255;
+        o[5] = x1 >>> 8 & 255;
+        o[6] = x1 >>> 16 & 255;
+        o[7] = x1 >>> 24 & 255;
+        o[8] = x2 >>> 0 & 255;
+        o[9] = x2 >>> 8 & 255;
+        o[10] = x2 >>> 16 & 255;
+        o[11] = x2 >>> 24 & 255;
+        o[12] = x3 >>> 0 & 255;
+        o[13] = x3 >>> 8 & 255;
+        o[14] = x3 >>> 16 & 255;
+        o[15] = x3 >>> 24 & 255;
+        o[16] = x4 >>> 0 & 255;
+        o[17] = x4 >>> 8 & 255;
+        o[18] = x4 >>> 16 & 255;
+        o[19] = x4 >>> 24 & 255;
+        o[20] = x5 >>> 0 & 255;
+        o[21] = x5 >>> 8 & 255;
+        o[22] = x5 >>> 16 & 255;
+        o[23] = x5 >>> 24 & 255;
+        o[24] = x6 >>> 0 & 255;
+        o[25] = x6 >>> 8 & 255;
+        o[26] = x6 >>> 16 & 255;
+        o[27] = x6 >>> 24 & 255;
+        o[28] = x7 >>> 0 & 255;
+        o[29] = x7 >>> 8 & 255;
+        o[30] = x7 >>> 16 & 255;
+        o[31] = x7 >>> 24 & 255;
+        o[32] = x8 >>> 0 & 255;
+        o[33] = x8 >>> 8 & 255;
+        o[34] = x8 >>> 16 & 255;
+        o[35] = x8 >>> 24 & 255;
+        o[36] = x9 >>> 0 & 255;
+        o[37] = x9 >>> 8 & 255;
+        o[38] = x9 >>> 16 & 255;
+        o[39] = x9 >>> 24 & 255;
+        o[40] = x10 >>> 0 & 255;
+        o[41] = x10 >>> 8 & 255;
+        o[42] = x10 >>> 16 & 255;
+        o[43] = x10 >>> 24 & 255;
+        o[44] = x11 >>> 0 & 255;
+        o[45] = x11 >>> 8 & 255;
+        o[46] = x11 >>> 16 & 255;
+        o[47] = x11 >>> 24 & 255;
+        o[48] = x12 >>> 0 & 255;
+        o[49] = x12 >>> 8 & 255;
+        o[50] = x12 >>> 16 & 255;
+        o[51] = x12 >>> 24 & 255;
+        o[52] = x13 >>> 0 & 255;
+        o[53] = x13 >>> 8 & 255;
+        o[54] = x13 >>> 16 & 255;
+        o[55] = x13 >>> 24 & 255;
+        o[56] = x14 >>> 0 & 255;
+        o[57] = x14 >>> 8 & 255;
+        o[58] = x14 >>> 16 & 255;
+        o[59] = x14 >>> 24 & 255;
+        o[60] = x15 >>> 0 & 255;
+        o[61] = x15 >>> 8 & 255;
+        o[62] = x15 >>> 16 & 255;
+        o[63] = x15 >>> 24 & 255;
+      }
+      function core_hsalsa20(o, p, k, c) {
+        var j0 = c[0] & 255 | (c[1] & 255) << 8 | (c[2] & 255) << 16 | (c[3] & 255) << 24, j1 = k[0] & 255 | (k[1] & 255) << 8 | (k[2] & 255) << 16 | (k[3] & 255) << 24, j2 = k[4] & 255 | (k[5] & 255) << 8 | (k[6] & 255) << 16 | (k[7] & 255) << 24, j3 = k[8] & 255 | (k[9] & 255) << 8 | (k[10] & 255) << 16 | (k[11] & 255) << 24, j4 = k[12] & 255 | (k[13] & 255) << 8 | (k[14] & 255) << 16 | (k[15] & 255) << 24, j5 = c[4] & 255 | (c[5] & 255) << 8 | (c[6] & 255) << 16 | (c[7] & 255) << 24, j6 = p[0] & 255 | (p[1] & 255) << 8 | (p[2] & 255) << 16 | (p[3] & 255) << 24, j7 = p[4] & 255 | (p[5] & 255) << 8 | (p[6] & 255) << 16 | (p[7] & 255) << 24, j8 = p[8] & 255 | (p[9] & 255) << 8 | (p[10] & 255) << 16 | (p[11] & 255) << 24, j9 = p[12] & 255 | (p[13] & 255) << 8 | (p[14] & 255) << 16 | (p[15] & 255) << 24, j10 = c[8] & 255 | (c[9] & 255) << 8 | (c[10] & 255) << 16 | (c[11] & 255) << 24, j11 = k[16] & 255 | (k[17] & 255) << 8 | (k[18] & 255) << 16 | (k[19] & 255) << 24, j12 = k[20] & 255 | (k[21] & 255) << 8 | (k[22] & 255) << 16 | (k[23] & 255) << 24, j13 = k[24] & 255 | (k[25] & 255) << 8 | (k[26] & 255) << 16 | (k[27] & 255) << 24, j14 = k[28] & 255 | (k[29] & 255) << 8 | (k[30] & 255) << 16 | (k[31] & 255) << 24, j15 = c[12] & 255 | (c[13] & 255) << 8 | (c[14] & 255) << 16 | (c[15] & 255) << 24;
+        var x0 = j0, x1 = j1, x2 = j2, x3 = j3, x4 = j4, x5 = j5, x6 = j6, x7 = j7, x8 = j8, x9 = j9, x10 = j10, x11 = j11, x12 = j12, x13 = j13, x14 = j14, x15 = j15, u;
+        for (var i = 0; i < 20; i += 2) {
+          u = x0 + x12 | 0;
+          x4 ^= u << 7 | u >>> 32 - 7;
+          u = x4 + x0 | 0;
+          x8 ^= u << 9 | u >>> 32 - 9;
+          u = x8 + x4 | 0;
+          x12 ^= u << 13 | u >>> 32 - 13;
+          u = x12 + x8 | 0;
+          x0 ^= u << 18 | u >>> 32 - 18;
+          u = x5 + x1 | 0;
+          x9 ^= u << 7 | u >>> 32 - 7;
+          u = x9 + x5 | 0;
+          x13 ^= u << 9 | u >>> 32 - 9;
+          u = x13 + x9 | 0;
+          x1 ^= u << 13 | u >>> 32 - 13;
+          u = x1 + x13 | 0;
+          x5 ^= u << 18 | u >>> 32 - 18;
+          u = x10 + x6 | 0;
+          x14 ^= u << 7 | u >>> 32 - 7;
+          u = x14 + x10 | 0;
+          x2 ^= u << 9 | u >>> 32 - 9;
+          u = x2 + x14 | 0;
+          x6 ^= u << 13 | u >>> 32 - 13;
+          u = x6 + x2 | 0;
+          x10 ^= u << 18 | u >>> 32 - 18;
+          u = x15 + x11 | 0;
+          x3 ^= u << 7 | u >>> 32 - 7;
+          u = x3 + x15 | 0;
+          x7 ^= u << 9 | u >>> 32 - 9;
+          u = x7 + x3 | 0;
+          x11 ^= u << 13 | u >>> 32 - 13;
+          u = x11 + x7 | 0;
+          x15 ^= u << 18 | u >>> 32 - 18;
+          u = x0 + x3 | 0;
+          x1 ^= u << 7 | u >>> 32 - 7;
+          u = x1 + x0 | 0;
+          x2 ^= u << 9 | u >>> 32 - 9;
+          u = x2 + x1 | 0;
+          x3 ^= u << 13 | u >>> 32 - 13;
+          u = x3 + x2 | 0;
+          x0 ^= u << 18 | u >>> 32 - 18;
+          u = x5 + x4 | 0;
+          x6 ^= u << 7 | u >>> 32 - 7;
+          u = x6 + x5 | 0;
+          x7 ^= u << 9 | u >>> 32 - 9;
+          u = x7 + x6 | 0;
+          x4 ^= u << 13 | u >>> 32 - 13;
+          u = x4 + x7 | 0;
+          x5 ^= u << 18 | u >>> 32 - 18;
+          u = x10 + x9 | 0;
+          x11 ^= u << 7 | u >>> 32 - 7;
+          u = x11 + x10 | 0;
+          x8 ^= u << 9 | u >>> 32 - 9;
+          u = x8 + x11 | 0;
+          x9 ^= u << 13 | u >>> 32 - 13;
+          u = x9 + x8 | 0;
+          x10 ^= u << 18 | u >>> 32 - 18;
+          u = x15 + x14 | 0;
+          x12 ^= u << 7 | u >>> 32 - 7;
+          u = x12 + x15 | 0;
+          x13 ^= u << 9 | u >>> 32 - 9;
+          u = x13 + x12 | 0;
+          x14 ^= u << 13 | u >>> 32 - 13;
+          u = x14 + x13 | 0;
+          x15 ^= u << 18 | u >>> 32 - 18;
+        }
+        o[0] = x0 >>> 0 & 255;
+        o[1] = x0 >>> 8 & 255;
+        o[2] = x0 >>> 16 & 255;
+        o[3] = x0 >>> 24 & 255;
+        o[4] = x5 >>> 0 & 255;
+        o[5] = x5 >>> 8 & 255;
+        o[6] = x5 >>> 16 & 255;
+        o[7] = x5 >>> 24 & 255;
+        o[8] = x10 >>> 0 & 255;
+        o[9] = x10 >>> 8 & 255;
+        o[10] = x10 >>> 16 & 255;
+        o[11] = x10 >>> 24 & 255;
+        o[12] = x15 >>> 0 & 255;
+        o[13] = x15 >>> 8 & 255;
+        o[14] = x15 >>> 16 & 255;
+        o[15] = x15 >>> 24 & 255;
+        o[16] = x6 >>> 0 & 255;
+        o[17] = x6 >>> 8 & 255;
+        o[18] = x6 >>> 16 & 255;
+        o[19] = x6 >>> 24 & 255;
+        o[20] = x7 >>> 0 & 255;
+        o[21] = x7 >>> 8 & 255;
+        o[22] = x7 >>> 16 & 255;
+        o[23] = x7 >>> 24 & 255;
+        o[24] = x8 >>> 0 & 255;
+        o[25] = x8 >>> 8 & 255;
+        o[26] = x8 >>> 16 & 255;
+        o[27] = x8 >>> 24 & 255;
+        o[28] = x9 >>> 0 & 255;
+        o[29] = x9 >>> 8 & 255;
+        o[30] = x9 >>> 16 & 255;
+        o[31] = x9 >>> 24 & 255;
+      }
+      function crypto_core_salsa20(out, inp, k, c) {
+        core_salsa20(out, inp, k, c);
+      }
+      function crypto_core_hsalsa20(out, inp, k, c) {
+        core_hsalsa20(out, inp, k, c);
+      }
+      var sigma = new Uint8Array([101, 120, 112, 97, 110, 100, 32, 51, 50, 45, 98, 121, 116, 101, 32, 107]);
+      function crypto_stream_salsa20_xor(c, cpos, m, mpos, b, n, k) {
+        var z2 = new Uint8Array(16), x = new Uint8Array(64);
+        var u, i;
+        for (i = 0; i < 16; i++) z2[i] = 0;
+        for (i = 0; i < 8; i++) z2[i] = n[i];
+        while (b >= 64) {
+          crypto_core_salsa20(x, z2, k, sigma);
+          for (i = 0; i < 64; i++) c[cpos + i] = m[mpos + i] ^ x[i];
+          u = 1;
+          for (i = 8; i < 16; i++) {
+            u = u + (z2[i] & 255) | 0;
+            z2[i] = u & 255;
+            u >>>= 8;
+          }
+          b -= 64;
+          cpos += 64;
+          mpos += 64;
+        }
+        if (b > 0) {
+          crypto_core_salsa20(x, z2, k, sigma);
+          for (i = 0; i < b; i++) c[cpos + i] = m[mpos + i] ^ x[i];
+        }
+        return 0;
+      }
+      function crypto_stream_salsa20(c, cpos, b, n, k) {
+        var z2 = new Uint8Array(16), x = new Uint8Array(64);
+        var u, i;
+        for (i = 0; i < 16; i++) z2[i] = 0;
+        for (i = 0; i < 8; i++) z2[i] = n[i];
+        while (b >= 64) {
+          crypto_core_salsa20(x, z2, k, sigma);
+          for (i = 0; i < 64; i++) c[cpos + i] = x[i];
+          u = 1;
+          for (i = 8; i < 16; i++) {
+            u = u + (z2[i] & 255) | 0;
+            z2[i] = u & 255;
+            u >>>= 8;
+          }
+          b -= 64;
+          cpos += 64;
+        }
+        if (b > 0) {
+          crypto_core_salsa20(x, z2, k, sigma);
+          for (i = 0; i < b; i++) c[cpos + i] = x[i];
+        }
+        return 0;
+      }
+      function crypto_stream(c, cpos, d, n, k) {
+        var s = new Uint8Array(32);
+        crypto_core_hsalsa20(s, n, k, sigma);
+        var sn = new Uint8Array(8);
+        for (var i = 0; i < 8; i++) sn[i] = n[i + 16];
+        return crypto_stream_salsa20(c, cpos, d, sn, s);
+      }
+      function crypto_stream_xor(c, cpos, m, mpos, d, n, k) {
+        var s = new Uint8Array(32);
+        crypto_core_hsalsa20(s, n, k, sigma);
+        var sn = new Uint8Array(8);
+        for (var i = 0; i < 8; i++) sn[i] = n[i + 16];
+        return crypto_stream_salsa20_xor(c, cpos, m, mpos, d, sn, s);
+      }
+      var poly1305 = function(key) {
+        this.buffer = new Uint8Array(16);
+        this.r = new Uint16Array(10);
+        this.h = new Uint16Array(10);
+        this.pad = new Uint16Array(8);
+        this.leftover = 0;
+        this.fin = 0;
+        var t0, t1, t2, t3, t4, t5, t6, t7;
+        t0 = key[0] & 255 | (key[1] & 255) << 8;
+        this.r[0] = t0 & 8191;
+        t1 = key[2] & 255 | (key[3] & 255) << 8;
+        this.r[1] = (t0 >>> 13 | t1 << 3) & 8191;
+        t2 = key[4] & 255 | (key[5] & 255) << 8;
+        this.r[2] = (t1 >>> 10 | t2 << 6) & 7939;
+        t3 = key[6] & 255 | (key[7] & 255) << 8;
+        this.r[3] = (t2 >>> 7 | t3 << 9) & 8191;
+        t4 = key[8] & 255 | (key[9] & 255) << 8;
+        this.r[4] = (t3 >>> 4 | t4 << 12) & 255;
+        this.r[5] = t4 >>> 1 & 8190;
+        t5 = key[10] & 255 | (key[11] & 255) << 8;
+        this.r[6] = (t4 >>> 14 | t5 << 2) & 8191;
+        t6 = key[12] & 255 | (key[13] & 255) << 8;
+        this.r[7] = (t5 >>> 11 | t6 << 5) & 8065;
+        t7 = key[14] & 255 | (key[15] & 255) << 8;
+        this.r[8] = (t6 >>> 8 | t7 << 8) & 8191;
+        this.r[9] = t7 >>> 5 & 127;
+        this.pad[0] = key[16] & 255 | (key[17] & 255) << 8;
+        this.pad[1] = key[18] & 255 | (key[19] & 255) << 8;
+        this.pad[2] = key[20] & 255 | (key[21] & 255) << 8;
+        this.pad[3] = key[22] & 255 | (key[23] & 255) << 8;
+        this.pad[4] = key[24] & 255 | (key[25] & 255) << 8;
+        this.pad[5] = key[26] & 255 | (key[27] & 255) << 8;
+        this.pad[6] = key[28] & 255 | (key[29] & 255) << 8;
+        this.pad[7] = key[30] & 255 | (key[31] & 255) << 8;
+      };
+      poly1305.prototype.blocks = function(m, mpos, bytes) {
+        var hibit = this.fin ? 0 : 1 << 11;
+        var t0, t1, t2, t3, t4, t5, t6, t7, c;
+        var d0, d1, d2, d3, d4, d5, d6, d7, d8, d9;
+        var h0 = this.h[0], h1 = this.h[1], h2 = this.h[2], h3 = this.h[3], h4 = this.h[4], h5 = this.h[5], h6 = this.h[6], h7 = this.h[7], h8 = this.h[8], h9 = this.h[9];
+        var r0 = this.r[0], r1 = this.r[1], r2 = this.r[2], r3 = this.r[3], r4 = this.r[4], r5 = this.r[5], r6 = this.r[6], r7 = this.r[7], r8 = this.r[8], r9 = this.r[9];
+        while (bytes >= 16) {
+          t0 = m[mpos + 0] & 255 | (m[mpos + 1] & 255) << 8;
+          h0 += t0 & 8191;
+          t1 = m[mpos + 2] & 255 | (m[mpos + 3] & 255) << 8;
+          h1 += (t0 >>> 13 | t1 << 3) & 8191;
+          t2 = m[mpos + 4] & 255 | (m[mpos + 5] & 255) << 8;
+          h2 += (t1 >>> 10 | t2 << 6) & 8191;
+          t3 = m[mpos + 6] & 255 | (m[mpos + 7] & 255) << 8;
+          h3 += (t2 >>> 7 | t3 << 9) & 8191;
+          t4 = m[mpos + 8] & 255 | (m[mpos + 9] & 255) << 8;
+          h4 += (t3 >>> 4 | t4 << 12) & 8191;
+          h5 += t4 >>> 1 & 8191;
+          t5 = m[mpos + 10] & 255 | (m[mpos + 11] & 255) << 8;
+          h6 += (t4 >>> 14 | t5 << 2) & 8191;
+          t6 = m[mpos + 12] & 255 | (m[mpos + 13] & 255) << 8;
+          h7 += (t5 >>> 11 | t6 << 5) & 8191;
+          t7 = m[mpos + 14] & 255 | (m[mpos + 15] & 255) << 8;
+          h8 += (t6 >>> 8 | t7 << 8) & 8191;
+          h9 += t7 >>> 5 | hibit;
+          c = 0;
+          d0 = c;
+          d0 += h0 * r0;
+          d0 += h1 * (5 * r9);
+          d0 += h2 * (5 * r8);
+          d0 += h3 * (5 * r7);
+          d0 += h4 * (5 * r6);
+          c = d0 >>> 13;
+          d0 &= 8191;
+          d0 += h5 * (5 * r5);
+          d0 += h6 * (5 * r4);
+          d0 += h7 * (5 * r3);
+          d0 += h8 * (5 * r2);
+          d0 += h9 * (5 * r1);
+          c += d0 >>> 13;
+          d0 &= 8191;
+          d1 = c;
+          d1 += h0 * r1;
+          d1 += h1 * r0;
+          d1 += h2 * (5 * r9);
+          d1 += h3 * (5 * r8);
+          d1 += h4 * (5 * r7);
+          c = d1 >>> 13;
+          d1 &= 8191;
+          d1 += h5 * (5 * r6);
+          d1 += h6 * (5 * r5);
+          d1 += h7 * (5 * r4);
+          d1 += h8 * (5 * r3);
+          d1 += h9 * (5 * r2);
+          c += d1 >>> 13;
+          d1 &= 8191;
+          d2 = c;
+          d2 += h0 * r2;
+          d2 += h1 * r1;
+          d2 += h2 * r0;
+          d2 += h3 * (5 * r9);
+          d2 += h4 * (5 * r8);
+          c = d2 >>> 13;
+          d2 &= 8191;
+          d2 += h5 * (5 * r7);
+          d2 += h6 * (5 * r6);
+          d2 += h7 * (5 * r5);
+          d2 += h8 * (5 * r4);
+          d2 += h9 * (5 * r3);
+          c += d2 >>> 13;
+          d2 &= 8191;
+          d3 = c;
+          d3 += h0 * r3;
+          d3 += h1 * r2;
+          d3 += h2 * r1;
+          d3 += h3 * r0;
+          d3 += h4 * (5 * r9);
+          c = d3 >>> 13;
+          d3 &= 8191;
+          d3 += h5 * (5 * r8);
+          d3 += h6 * (5 * r7);
+          d3 += h7 * (5 * r6);
+          d3 += h8 * (5 * r5);
+          d3 += h9 * (5 * r4);
+          c += d3 >>> 13;
+          d3 &= 8191;
+          d4 = c;
+          d4 += h0 * r4;
+          d4 += h1 * r3;
+          d4 += h2 * r2;
+          d4 += h3 * r1;
+          d4 += h4 * r0;
+          c = d4 >>> 13;
+          d4 &= 8191;
+          d4 += h5 * (5 * r9);
+          d4 += h6 * (5 * r8);
+          d4 += h7 * (5 * r7);
+          d4 += h8 * (5 * r6);
+          d4 += h9 * (5 * r5);
+          c += d4 >>> 13;
+          d4 &= 8191;
+          d5 = c;
+          d5 += h0 * r5;
+          d5 += h1 * r4;
+          d5 += h2 * r3;
+          d5 += h3 * r2;
+          d5 += h4 * r1;
+          c = d5 >>> 13;
+          d5 &= 8191;
+          d5 += h5 * r0;
+          d5 += h6 * (5 * r9);
+          d5 += h7 * (5 * r8);
+          d5 += h8 * (5 * r7);
+          d5 += h9 * (5 * r6);
+          c += d5 >>> 13;
+          d5 &= 8191;
+          d6 = c;
+          d6 += h0 * r6;
+          d6 += h1 * r5;
+          d6 += h2 * r4;
+          d6 += h3 * r3;
+          d6 += h4 * r2;
+          c = d6 >>> 13;
+          d6 &= 8191;
+          d6 += h5 * r1;
+          d6 += h6 * r0;
+          d6 += h7 * (5 * r9);
+          d6 += h8 * (5 * r8);
+          d6 += h9 * (5 * r7);
+          c += d6 >>> 13;
+          d6 &= 8191;
+          d7 = c;
+          d7 += h0 * r7;
+          d7 += h1 * r6;
+          d7 += h2 * r5;
+          d7 += h3 * r4;
+          d7 += h4 * r3;
+          c = d7 >>> 13;
+          d7 &= 8191;
+          d7 += h5 * r2;
+          d7 += h6 * r1;
+          d7 += h7 * r0;
+          d7 += h8 * (5 * r9);
+          d7 += h9 * (5 * r8);
+          c += d7 >>> 13;
+          d7 &= 8191;
+          d8 = c;
+          d8 += h0 * r8;
+          d8 += h1 * r7;
+          d8 += h2 * r6;
+          d8 += h3 * r5;
+          d8 += h4 * r4;
+          c = d8 >>> 13;
+          d8 &= 8191;
+          d8 += h5 * r3;
+          d8 += h6 * r2;
+          d8 += h7 * r1;
+          d8 += h8 * r0;
+          d8 += h9 * (5 * r9);
+          c += d8 >>> 13;
+          d8 &= 8191;
+          d9 = c;
+          d9 += h0 * r9;
+          d9 += h1 * r8;
+          d9 += h2 * r7;
+          d9 += h3 * r6;
+          d9 += h4 * r5;
+          c = d9 >>> 13;
+          d9 &= 8191;
+          d9 += h5 * r4;
+          d9 += h6 * r3;
+          d9 += h7 * r2;
+          d9 += h8 * r1;
+          d9 += h9 * r0;
+          c += d9 >>> 13;
+          d9 &= 8191;
+          c = (c << 2) + c | 0;
+          c = c + d0 | 0;
+          d0 = c & 8191;
+          c = c >>> 13;
+          d1 += c;
+          h0 = d0;
+          h1 = d1;
+          h2 = d2;
+          h3 = d3;
+          h4 = d4;
+          h5 = d5;
+          h6 = d6;
+          h7 = d7;
+          h8 = d8;
+          h9 = d9;
+          mpos += 16;
+          bytes -= 16;
+        }
+        this.h[0] = h0;
+        this.h[1] = h1;
+        this.h[2] = h2;
+        this.h[3] = h3;
+        this.h[4] = h4;
+        this.h[5] = h5;
+        this.h[6] = h6;
+        this.h[7] = h7;
+        this.h[8] = h8;
+        this.h[9] = h9;
+      };
+      poly1305.prototype.finish = function(mac, macpos) {
+        var g = new Uint16Array(10);
+        var c, mask, f, i;
+        if (this.leftover) {
+          i = this.leftover;
+          this.buffer[i++] = 1;
+          for (; i < 16; i++) this.buffer[i] = 0;
+          this.fin = 1;
+          this.blocks(this.buffer, 0, 16);
+        }
+        c = this.h[1] >>> 13;
+        this.h[1] &= 8191;
+        for (i = 2; i < 10; i++) {
+          this.h[i] += c;
+          c = this.h[i] >>> 13;
+          this.h[i] &= 8191;
+        }
+        this.h[0] += c * 5;
+        c = this.h[0] >>> 13;
+        this.h[0] &= 8191;
+        this.h[1] += c;
+        c = this.h[1] >>> 13;
+        this.h[1] &= 8191;
+        this.h[2] += c;
+        g[0] = this.h[0] + 5;
+        c = g[0] >>> 13;
+        g[0] &= 8191;
+        for (i = 1; i < 10; i++) {
+          g[i] = this.h[i] + c;
+          c = g[i] >>> 13;
+          g[i] &= 8191;
+        }
+        g[9] -= 1 << 13;
+        mask = (c ^ 1) - 1;
+        for (i = 0; i < 10; i++) g[i] &= mask;
+        mask = ~mask;
+        for (i = 0; i < 10; i++) this.h[i] = this.h[i] & mask | g[i];
+        this.h[0] = (this.h[0] | this.h[1] << 13) & 65535;
+        this.h[1] = (this.h[1] >>> 3 | this.h[2] << 10) & 65535;
+        this.h[2] = (this.h[2] >>> 6 | this.h[3] << 7) & 65535;
+        this.h[3] = (this.h[3] >>> 9 | this.h[4] << 4) & 65535;
+        this.h[4] = (this.h[4] >>> 12 | this.h[5] << 1 | this.h[6] << 14) & 65535;
+        this.h[5] = (this.h[6] >>> 2 | this.h[7] << 11) & 65535;
+        this.h[6] = (this.h[7] >>> 5 | this.h[8] << 8) & 65535;
+        this.h[7] = (this.h[8] >>> 8 | this.h[9] << 5) & 65535;
+        f = this.h[0] + this.pad[0];
+        this.h[0] = f & 65535;
+        for (i = 1; i < 8; i++) {
+          f = (this.h[i] + this.pad[i] | 0) + (f >>> 16) | 0;
+          this.h[i] = f & 65535;
+        }
+        mac[macpos + 0] = this.h[0] >>> 0 & 255;
+        mac[macpos + 1] = this.h[0] >>> 8 & 255;
+        mac[macpos + 2] = this.h[1] >>> 0 & 255;
+        mac[macpos + 3] = this.h[1] >>> 8 & 255;
+        mac[macpos + 4] = this.h[2] >>> 0 & 255;
+        mac[macpos + 5] = this.h[2] >>> 8 & 255;
+        mac[macpos + 6] = this.h[3] >>> 0 & 255;
+        mac[macpos + 7] = this.h[3] >>> 8 & 255;
+        mac[macpos + 8] = this.h[4] >>> 0 & 255;
+        mac[macpos + 9] = this.h[4] >>> 8 & 255;
+        mac[macpos + 10] = this.h[5] >>> 0 & 255;
+        mac[macpos + 11] = this.h[5] >>> 8 & 255;
+        mac[macpos + 12] = this.h[6] >>> 0 & 255;
+        mac[macpos + 13] = this.h[6] >>> 8 & 255;
+        mac[macpos + 14] = this.h[7] >>> 0 & 255;
+        mac[macpos + 15] = this.h[7] >>> 8 & 255;
+      };
+      poly1305.prototype.update = function(m, mpos, bytes) {
+        var i, want;
+        if (this.leftover) {
+          want = 16 - this.leftover;
+          if (want > bytes)
+            want = bytes;
+          for (i = 0; i < want; i++)
+            this.buffer[this.leftover + i] = m[mpos + i];
+          bytes -= want;
+          mpos += want;
+          this.leftover += want;
+          if (this.leftover < 16)
+            return;
+          this.blocks(this.buffer, 0, 16);
+          this.leftover = 0;
+        }
+        if (bytes >= 16) {
+          want = bytes - bytes % 16;
+          this.blocks(m, mpos, want);
+          mpos += want;
+          bytes -= want;
+        }
+        if (bytes) {
+          for (i = 0; i < bytes; i++)
+            this.buffer[this.leftover + i] = m[mpos + i];
+          this.leftover += bytes;
+        }
+      };
+      function crypto_onetimeauth(out, outpos, m, mpos, n, k) {
+        var s = new poly1305(k);
+        s.update(m, mpos, n);
+        s.finish(out, outpos);
+        return 0;
+      }
+      function crypto_onetimeauth_verify(h, hpos, m, mpos, n, k) {
+        var x = new Uint8Array(16);
+        crypto_onetimeauth(x, 0, m, mpos, n, k);
+        return crypto_verify_16(h, hpos, x, 0);
+      }
+      function crypto_secretbox(c, m, d, n, k) {
+        var i;
+        if (d < 32) return -1;
+        crypto_stream_xor(c, 0, m, 0, d, n, k);
+        crypto_onetimeauth(c, 16, c, 32, d - 32, c);
+        for (i = 0; i < 16; i++) c[i] = 0;
+        return 0;
+      }
+      function crypto_secretbox_open(m, c, d, n, k) {
+        var i;
+        var x = new Uint8Array(32);
+        if (d < 32) return -1;
+        crypto_stream(x, 0, 32, n, k);
+        if (crypto_onetimeauth_verify(c, 16, c, 32, d - 32, x) !== 0) return -1;
+        crypto_stream_xor(m, 0, c, 0, d, n, k);
+        for (i = 0; i < 32; i++) m[i] = 0;
+        return 0;
+      }
+      function set25519(r, a) {
+        var i;
+        for (i = 0; i < 16; i++) r[i] = a[i] | 0;
+      }
+      function car25519(o) {
+        var i, v, c = 1;
+        for (i = 0; i < 16; i++) {
+          v = o[i] + c + 65535;
+          c = Math.floor(v / 65536);
+          o[i] = v - c * 65536;
+        }
+        o[0] += c - 1 + 37 * (c - 1);
+      }
+      function sel25519(p, q, b) {
+        var t, c = ~(b - 1);
+        for (var i = 0; i < 16; i++) {
+          t = c & (p[i] ^ q[i]);
+          p[i] ^= t;
+          q[i] ^= t;
+        }
+      }
+      function pack25519(o, n) {
+        var i, j, b;
+        var m = gf(), t = gf();
+        for (i = 0; i < 16; i++) t[i] = n[i];
+        car25519(t);
+        car25519(t);
+        car25519(t);
+        for (j = 0; j < 2; j++) {
+          m[0] = t[0] - 65517;
+          for (i = 1; i < 15; i++) {
+            m[i] = t[i] - 65535 - (m[i - 1] >> 16 & 1);
+            m[i - 1] &= 65535;
+          }
+          m[15] = t[15] - 32767 - (m[14] >> 16 & 1);
+          b = m[15] >> 16 & 1;
+          m[14] &= 65535;
+          sel25519(t, m, 1 - b);
+        }
+        for (i = 0; i < 16; i++) {
+          o[2 * i] = t[i] & 255;
+          o[2 * i + 1] = t[i] >> 8;
+        }
+      }
+      function neq25519(a, b) {
+        var c = new Uint8Array(32), d = new Uint8Array(32);
+        pack25519(c, a);
+        pack25519(d, b);
+        return crypto_verify_32(c, 0, d, 0);
+      }
+      function par25519(a) {
+        var d = new Uint8Array(32);
+        pack25519(d, a);
+        return d[0] & 1;
+      }
+      function unpack25519(o, n) {
+        var i;
+        for (i = 0; i < 16; i++) o[i] = n[2 * i] + (n[2 * i + 1] << 8);
+        o[15] &= 32767;
+      }
+      function A(o, a, b) {
+        for (var i = 0; i < 16; i++) o[i] = a[i] + b[i];
+      }
+      function Z(o, a, b) {
+        for (var i = 0; i < 16; i++) o[i] = a[i] - b[i];
+      }
+      function M(o, a, b) {
+        var v, c, t0 = 0, t1 = 0, t2 = 0, t3 = 0, t4 = 0, t5 = 0, t6 = 0, t7 = 0, t8 = 0, t9 = 0, t10 = 0, t11 = 0, t12 = 0, t13 = 0, t14 = 0, t15 = 0, t16 = 0, t17 = 0, t18 = 0, t19 = 0, t20 = 0, t21 = 0, t22 = 0, t23 = 0, t24 = 0, t25 = 0, t26 = 0, t27 = 0, t28 = 0, t29 = 0, t30 = 0, b0 = b[0], b1 = b[1], b2 = b[2], b3 = b[3], b4 = b[4], b5 = b[5], b6 = b[6], b7 = b[7], b8 = b[8], b9 = b[9], b10 = b[10], b11 = b[11], b12 = b[12], b13 = b[13], b14 = b[14], b15 = b[15];
+        v = a[0];
+        t0 += v * b0;
+        t1 += v * b1;
+        t2 += v * b2;
+        t3 += v * b3;
+        t4 += v * b4;
+        t5 += v * b5;
+        t6 += v * b6;
+        t7 += v * b7;
+        t8 += v * b8;
+        t9 += v * b9;
+        t10 += v * b10;
+        t11 += v * b11;
+        t12 += v * b12;
+        t13 += v * b13;
+        t14 += v * b14;
+        t15 += v * b15;
+        v = a[1];
+        t1 += v * b0;
+        t2 += v * b1;
+        t3 += v * b2;
+        t4 += v * b3;
+        t5 += v * b4;
+        t6 += v * b5;
+        t7 += v * b6;
+        t8 += v * b7;
+        t9 += v * b8;
+        t10 += v * b9;
+        t11 += v * b10;
+        t12 += v * b11;
+        t13 += v * b12;
+        t14 += v * b13;
+        t15 += v * b14;
+        t16 += v * b15;
+        v = a[2];
+        t2 += v * b0;
+        t3 += v * b1;
+        t4 += v * b2;
+        t5 += v * b3;
+        t6 += v * b4;
+        t7 += v * b5;
+        t8 += v * b6;
+        t9 += v * b7;
+        t10 += v * b8;
+        t11 += v * b9;
+        t12 += v * b10;
+        t13 += v * b11;
+        t14 += v * b12;
+        t15 += v * b13;
+        t16 += v * b14;
+        t17 += v * b15;
+        v = a[3];
+        t3 += v * b0;
+        t4 += v * b1;
+        t5 += v * b2;
+        t6 += v * b3;
+        t7 += v * b4;
+        t8 += v * b5;
+        t9 += v * b6;
+        t10 += v * b7;
+        t11 += v * b8;
+        t12 += v * b9;
+        t13 += v * b10;
+        t14 += v * b11;
+        t15 += v * b12;
+        t16 += v * b13;
+        t17 += v * b14;
+        t18 += v * b15;
+        v = a[4];
+        t4 += v * b0;
+        t5 += v * b1;
+        t6 += v * b2;
+        t7 += v * b3;
+        t8 += v * b4;
+        t9 += v * b5;
+        t10 += v * b6;
+        t11 += v * b7;
+        t12 += v * b8;
+        t13 += v * b9;
+        t14 += v * b10;
+        t15 += v * b11;
+        t16 += v * b12;
+        t17 += v * b13;
+        t18 += v * b14;
+        t19 += v * b15;
+        v = a[5];
+        t5 += v * b0;
+        t6 += v * b1;
+        t7 += v * b2;
+        t8 += v * b3;
+        t9 += v * b4;
+        t10 += v * b5;
+        t11 += v * b6;
+        t12 += v * b7;
+        t13 += v * b8;
+        t14 += v * b9;
+        t15 += v * b10;
+        t16 += v * b11;
+        t17 += v * b12;
+        t18 += v * b13;
+        t19 += v * b14;
+        t20 += v * b15;
+        v = a[6];
+        t6 += v * b0;
+        t7 += v * b1;
+        t8 += v * b2;
+        t9 += v * b3;
+        t10 += v * b4;
+        t11 += v * b5;
+        t12 += v * b6;
+        t13 += v * b7;
+        t14 += v * b8;
+        t15 += v * b9;
+        t16 += v * b10;
+        t17 += v * b11;
+        t18 += v * b12;
+        t19 += v * b13;
+        t20 += v * b14;
+        t21 += v * b15;
+        v = a[7];
+        t7 += v * b0;
+        t8 += v * b1;
+        t9 += v * b2;
+        t10 += v * b3;
+        t11 += v * b4;
+        t12 += v * b5;
+        t13 += v * b6;
+        t14 += v * b7;
+        t15 += v * b8;
+        t16 += v * b9;
+        t17 += v * b10;
+        t18 += v * b11;
+        t19 += v * b12;
+        t20 += v * b13;
+        t21 += v * b14;
+        t22 += v * b15;
+        v = a[8];
+        t8 += v * b0;
+        t9 += v * b1;
+        t10 += v * b2;
+        t11 += v * b3;
+        t12 += v * b4;
+        t13 += v * b5;
+        t14 += v * b6;
+        t15 += v * b7;
+        t16 += v * b8;
+        t17 += v * b9;
+        t18 += v * b10;
+        t19 += v * b11;
+        t20 += v * b12;
+        t21 += v * b13;
+        t22 += v * b14;
+        t23 += v * b15;
+        v = a[9];
+        t9 += v * b0;
+        t10 += v * b1;
+        t11 += v * b2;
+        t12 += v * b3;
+        t13 += v * b4;
+        t14 += v * b5;
+        t15 += v * b6;
+        t16 += v * b7;
+        t17 += v * b8;
+        t18 += v * b9;
+        t19 += v * b10;
+        t20 += v * b11;
+        t21 += v * b12;
+        t22 += v * b13;
+        t23 += v * b14;
+        t24 += v * b15;
+        v = a[10];
+        t10 += v * b0;
+        t11 += v * b1;
+        t12 += v * b2;
+        t13 += v * b3;
+        t14 += v * b4;
+        t15 += v * b5;
+        t16 += v * b6;
+        t17 += v * b7;
+        t18 += v * b8;
+        t19 += v * b9;
+        t20 += v * b10;
+        t21 += v * b11;
+        t22 += v * b12;
+        t23 += v * b13;
+        t24 += v * b14;
+        t25 += v * b15;
+        v = a[11];
+        t11 += v * b0;
+        t12 += v * b1;
+        t13 += v * b2;
+        t14 += v * b3;
+        t15 += v * b4;
+        t16 += v * b5;
+        t17 += v * b6;
+        t18 += v * b7;
+        t19 += v * b8;
+        t20 += v * b9;
+        t21 += v * b10;
+        t22 += v * b11;
+        t23 += v * b12;
+        t24 += v * b13;
+        t25 += v * b14;
+        t26 += v * b15;
+        v = a[12];
+        t12 += v * b0;
+        t13 += v * b1;
+        t14 += v * b2;
+        t15 += v * b3;
+        t16 += v * b4;
+        t17 += v * b5;
+        t18 += v * b6;
+        t19 += v * b7;
+        t20 += v * b8;
+        t21 += v * b9;
+        t22 += v * b10;
+        t23 += v * b11;
+        t24 += v * b12;
+        t25 += v * b13;
+        t26 += v * b14;
+        t27 += v * b15;
+        v = a[13];
+        t13 += v * b0;
+        t14 += v * b1;
+        t15 += v * b2;
+        t16 += v * b3;
+        t17 += v * b4;
+        t18 += v * b5;
+        t19 += v * b6;
+        t20 += v * b7;
+        t21 += v * b8;
+        t22 += v * b9;
+        t23 += v * b10;
+        t24 += v * b11;
+        t25 += v * b12;
+        t26 += v * b13;
+        t27 += v * b14;
+        t28 += v * b15;
+        v = a[14];
+        t14 += v * b0;
+        t15 += v * b1;
+        t16 += v * b2;
+        t17 += v * b3;
+        t18 += v * b4;
+        t19 += v * b5;
+        t20 += v * b6;
+        t21 += v * b7;
+        t22 += v * b8;
+        t23 += v * b9;
+        t24 += v * b10;
+        t25 += v * b11;
+        t26 += v * b12;
+        t27 += v * b13;
+        t28 += v * b14;
+        t29 += v * b15;
+        v = a[15];
+        t15 += v * b0;
+        t16 += v * b1;
+        t17 += v * b2;
+        t18 += v * b3;
+        t19 += v * b4;
+        t20 += v * b5;
+        t21 += v * b6;
+        t22 += v * b7;
+        t23 += v * b8;
+        t24 += v * b9;
+        t25 += v * b10;
+        t26 += v * b11;
+        t27 += v * b12;
+        t28 += v * b13;
+        t29 += v * b14;
+        t30 += v * b15;
+        t0 += 38 * t16;
+        t1 += 38 * t17;
+        t2 += 38 * t18;
+        t3 += 38 * t19;
+        t4 += 38 * t20;
+        t5 += 38 * t21;
+        t6 += 38 * t22;
+        t7 += 38 * t23;
+        t8 += 38 * t24;
+        t9 += 38 * t25;
+        t10 += 38 * t26;
+        t11 += 38 * t27;
+        t12 += 38 * t28;
+        t13 += 38 * t29;
+        t14 += 38 * t30;
+        c = 1;
+        v = t0 + c + 65535;
+        c = Math.floor(v / 65536);
+        t0 = v - c * 65536;
+        v = t1 + c + 65535;
+        c = Math.floor(v / 65536);
+        t1 = v - c * 65536;
+        v = t2 + c + 65535;
+        c = Math.floor(v / 65536);
+        t2 = v - c * 65536;
+        v = t3 + c + 65535;
+        c = Math.floor(v / 65536);
+        t3 = v - c * 65536;
+        v = t4 + c + 65535;
+        c = Math.floor(v / 65536);
+        t4 = v - c * 65536;
+        v = t5 + c + 65535;
+        c = Math.floor(v / 65536);
+        t5 = v - c * 65536;
+        v = t6 + c + 65535;
+        c = Math.floor(v / 65536);
+        t6 = v - c * 65536;
+        v = t7 + c + 65535;
+        c = Math.floor(v / 65536);
+        t7 = v - c * 65536;
+        v = t8 + c + 65535;
+        c = Math.floor(v / 65536);
+        t8 = v - c * 65536;
+        v = t9 + c + 65535;
+        c = Math.floor(v / 65536);
+        t9 = v - c * 65536;
+        v = t10 + c + 65535;
+        c = Math.floor(v / 65536);
+        t10 = v - c * 65536;
+        v = t11 + c + 65535;
+        c = Math.floor(v / 65536);
+        t11 = v - c * 65536;
+        v = t12 + c + 65535;
+        c = Math.floor(v / 65536);
+        t12 = v - c * 65536;
+        v = t13 + c + 65535;
+        c = Math.floor(v / 65536);
+        t13 = v - c * 65536;
+        v = t14 + c + 65535;
+        c = Math.floor(v / 65536);
+        t14 = v - c * 65536;
+        v = t15 + c + 65535;
+        c = Math.floor(v / 65536);
+        t15 = v - c * 65536;
+        t0 += c - 1 + 37 * (c - 1);
+        c = 1;
+        v = t0 + c + 65535;
+        c = Math.floor(v / 65536);
+        t0 = v - c * 65536;
+        v = t1 + c + 65535;
+        c = Math.floor(v / 65536);
+        t1 = v - c * 65536;
+        v = t2 + c + 65535;
+        c = Math.floor(v / 65536);
+        t2 = v - c * 65536;
+        v = t3 + c + 65535;
+        c = Math.floor(v / 65536);
+        t3 = v - c * 65536;
+        v = t4 + c + 65535;
+        c = Math.floor(v / 65536);
+        t4 = v - c * 65536;
+        v = t5 + c + 65535;
+        c = Math.floor(v / 65536);
+        t5 = v - c * 65536;
+        v = t6 + c + 65535;
+        c = Math.floor(v / 65536);
+        t6 = v - c * 65536;
+        v = t7 + c + 65535;
+        c = Math.floor(v / 65536);
+        t7 = v - c * 65536;
+        v = t8 + c + 65535;
+        c = Math.floor(v / 65536);
+        t8 = v - c * 65536;
+        v = t9 + c + 65535;
+        c = Math.floor(v / 65536);
+        t9 = v - c * 65536;
+        v = t10 + c + 65535;
+        c = Math.floor(v / 65536);
+        t10 = v - c * 65536;
+        v = t11 + c + 65535;
+        c = Math.floor(v / 65536);
+        t11 = v - c * 65536;
+        v = t12 + c + 65535;
+        c = Math.floor(v / 65536);
+        t12 = v - c * 65536;
+        v = t13 + c + 65535;
+        c = Math.floor(v / 65536);
+        t13 = v - c * 65536;
+        v = t14 + c + 65535;
+        c = Math.floor(v / 65536);
+        t14 = v - c * 65536;
+        v = t15 + c + 65535;
+        c = Math.floor(v / 65536);
+        t15 = v - c * 65536;
+        t0 += c - 1 + 37 * (c - 1);
+        o[0] = t0;
+        o[1] = t1;
+        o[2] = t2;
+        o[3] = t3;
+        o[4] = t4;
+        o[5] = t5;
+        o[6] = t6;
+        o[7] = t7;
+        o[8] = t8;
+        o[9] = t9;
+        o[10] = t10;
+        o[11] = t11;
+        o[12] = t12;
+        o[13] = t13;
+        o[14] = t14;
+        o[15] = t15;
+      }
+      function S(o, a) {
+        M(o, a, a);
+      }
+      function inv25519(o, i) {
+        var c = gf();
+        var a;
+        for (a = 0; a < 16; a++) c[a] = i[a];
+        for (a = 253; a >= 0; a--) {
+          S(c, c);
+          if (a !== 2 && a !== 4) M(c, c, i);
+        }
+        for (a = 0; a < 16; a++) o[a] = c[a];
+      }
+      function pow2523(o, i) {
+        var c = gf();
+        var a;
+        for (a = 0; a < 16; a++) c[a] = i[a];
+        for (a = 250; a >= 0; a--) {
+          S(c, c);
+          if (a !== 1) M(c, c, i);
+        }
+        for (a = 0; a < 16; a++) o[a] = c[a];
+      }
+      function crypto_scalarmult(q, n, p) {
+        var z2 = new Uint8Array(32);
+        var x = new Float64Array(80), r, i;
+        var a = gf(), b = gf(), c = gf(), d = gf(), e = gf(), f = gf();
+        for (i = 0; i < 31; i++) z2[i] = n[i];
+        z2[31] = n[31] & 127 | 64;
+        z2[0] &= 248;
+        unpack25519(x, p);
+        for (i = 0; i < 16; i++) {
+          b[i] = x[i];
+          d[i] = a[i] = c[i] = 0;
+        }
+        a[0] = d[0] = 1;
+        for (i = 254; i >= 0; --i) {
+          r = z2[i >>> 3] >>> (i & 7) & 1;
+          sel25519(a, b, r);
+          sel25519(c, d, r);
+          A(e, a, c);
+          Z(a, a, c);
+          A(c, b, d);
+          Z(b, b, d);
+          S(d, e);
+          S(f, a);
+          M(a, c, a);
+          M(c, b, e);
+          A(e, a, c);
+          Z(a, a, c);
+          S(b, a);
+          Z(c, d, f);
+          M(a, c, _121665);
+          A(a, a, d);
+          M(c, c, a);
+          M(a, d, f);
+          M(d, b, x);
+          S(b, e);
+          sel25519(a, b, r);
+          sel25519(c, d, r);
+        }
+        for (i = 0; i < 16; i++) {
+          x[i + 16] = a[i];
+          x[i + 32] = c[i];
+          x[i + 48] = b[i];
+          x[i + 64] = d[i];
+        }
+        var x32 = x.subarray(32);
+        var x16 = x.subarray(16);
+        inv25519(x32, x32);
+        M(x16, x16, x32);
+        pack25519(q, x16);
+        return 0;
+      }
+      function crypto_scalarmult_base(q, n) {
+        return crypto_scalarmult(q, n, _9);
+      }
+      function crypto_box_keypair(y, x) {
+        randombytes(x, 32);
+        return crypto_scalarmult_base(y, x);
+      }
+      function crypto_box_beforenm(k, y, x) {
+        var s = new Uint8Array(32);
+        crypto_scalarmult(s, x, y);
+        return crypto_core_hsalsa20(k, _0, s, sigma);
+      }
+      var crypto_box_afternm = crypto_secretbox;
+      var crypto_box_open_afternm = crypto_secretbox_open;
+      function crypto_box(c, m, d, n, y, x) {
+        var k = new Uint8Array(32);
+        crypto_box_beforenm(k, y, x);
+        return crypto_box_afternm(c, m, d, n, k);
+      }
+      function crypto_box_open(m, c, d, n, y, x) {
+        var k = new Uint8Array(32);
+        crypto_box_beforenm(k, y, x);
+        return crypto_box_open_afternm(m, c, d, n, k);
+      }
+      var K = [
+        1116352408,
+        3609767458,
+        1899447441,
+        602891725,
+        3049323471,
+        3964484399,
+        3921009573,
+        2173295548,
+        961987163,
+        4081628472,
+        1508970993,
+        3053834265,
+        2453635748,
+        2937671579,
+        2870763221,
+        3664609560,
+        3624381080,
+        2734883394,
+        310598401,
+        1164996542,
+        607225278,
+        1323610764,
+        1426881987,
+        3590304994,
+        1925078388,
+        4068182383,
+        2162078206,
+        991336113,
+        2614888103,
+        633803317,
+        3248222580,
+        3479774868,
+        3835390401,
+        2666613458,
+        4022224774,
+        944711139,
+        264347078,
+        2341262773,
+        604807628,
+        2007800933,
+        770255983,
+        1495990901,
+        1249150122,
+        1856431235,
+        1555081692,
+        3175218132,
+        1996064986,
+        2198950837,
+        2554220882,
+        3999719339,
+        2821834349,
+        766784016,
+        2952996808,
+        2566594879,
+        3210313671,
+        3203337956,
+        3336571891,
+        1034457026,
+        3584528711,
+        2466948901,
+        113926993,
+        3758326383,
+        338241895,
+        168717936,
+        666307205,
+        1188179964,
+        773529912,
+        1546045734,
+        1294757372,
+        1522805485,
+        1396182291,
+        2643833823,
+        1695183700,
+        2343527390,
+        1986661051,
+        1014477480,
+        2177026350,
+        1206759142,
+        2456956037,
+        344077627,
+        2730485921,
+        1290863460,
+        2820302411,
+        3158454273,
+        3259730800,
+        3505952657,
+        3345764771,
+        106217008,
+        3516065817,
+        3606008344,
+        3600352804,
+        1432725776,
+        4094571909,
+        1467031594,
+        275423344,
+        851169720,
+        430227734,
+        3100823752,
+        506948616,
+        1363258195,
+        659060556,
+        3750685593,
+        883997877,
+        3785050280,
+        958139571,
+        3318307427,
+        1322822218,
+        3812723403,
+        1537002063,
+        2003034995,
+        1747873779,
+        3602036899,
+        1955562222,
+        1575990012,
+        2024104815,
+        1125592928,
+        2227730452,
+        2716904306,
+        2361852424,
+        442776044,
+        2428436474,
+        593698344,
+        2756734187,
+        3733110249,
+        3204031479,
+        2999351573,
+        3329325298,
+        3815920427,
+        3391569614,
+        3928383900,
+        3515267271,
+        566280711,
+        3940187606,
+        3454069534,
+        4118630271,
+        4000239992,
+        116418474,
+        1914138554,
+        174292421,
+        2731055270,
+        289380356,
+        3203993006,
+        460393269,
+        320620315,
+        685471733,
+        587496836,
+        852142971,
+        1086792851,
+        1017036298,
+        365543100,
+        1126000580,
+        2618297676,
+        1288033470,
+        3409855158,
+        1501505948,
+        4234509866,
+        1607167915,
+        987167468,
+        1816402316,
+        1246189591
+      ];
+      function crypto_hashblocks_hl(hh, hl, m, n) {
+        var wh = new Int32Array(16), wl = new Int32Array(16), bh0, bh1, bh2, bh3, bh4, bh5, bh6, bh7, bl0, bl1, bl2, bl3, bl4, bl5, bl6, bl7, th, tl, i, j, h, l, a, b, c, d;
+        var ah0 = hh[0], ah1 = hh[1], ah2 = hh[2], ah3 = hh[3], ah4 = hh[4], ah5 = hh[5], ah6 = hh[6], ah7 = hh[7], al0 = hl[0], al1 = hl[1], al2 = hl[2], al3 = hl[3], al4 = hl[4], al5 = hl[5], al6 = hl[6], al7 = hl[7];
+        var pos = 0;
+        while (n >= 128) {
+          for (i = 0; i < 16; i++) {
+            j = 8 * i + pos;
+            wh[i] = m[j + 0] << 24 | m[j + 1] << 16 | m[j + 2] << 8 | m[j + 3];
+            wl[i] = m[j + 4] << 24 | m[j + 5] << 16 | m[j + 6] << 8 | m[j + 7];
+          }
+          for (i = 0; i < 80; i++) {
+            bh0 = ah0;
+            bh1 = ah1;
+            bh2 = ah2;
+            bh3 = ah3;
+            bh4 = ah4;
+            bh5 = ah5;
+            bh6 = ah6;
+            bh7 = ah7;
+            bl0 = al0;
+            bl1 = al1;
+            bl2 = al2;
+            bl3 = al3;
+            bl4 = al4;
+            bl5 = al5;
+            bl6 = al6;
+            bl7 = al7;
+            h = ah7;
+            l = al7;
+            a = l & 65535;
+            b = l >>> 16;
+            c = h & 65535;
+            d = h >>> 16;
+            h = (ah4 >>> 14 | al4 << 32 - 14) ^ (ah4 >>> 18 | al4 << 32 - 18) ^ (al4 >>> 41 - 32 | ah4 << 32 - (41 - 32));
+            l = (al4 >>> 14 | ah4 << 32 - 14) ^ (al4 >>> 18 | ah4 << 32 - 18) ^ (ah4 >>> 41 - 32 | al4 << 32 - (41 - 32));
+            a += l & 65535;
+            b += l >>> 16;
+            c += h & 65535;
+            d += h >>> 16;
+            h = ah4 & ah5 ^ ~ah4 & ah6;
+            l = al4 & al5 ^ ~al4 & al6;
+            a += l & 65535;
+            b += l >>> 16;
+            c += h & 65535;
+            d += h >>> 16;
+            h = K[i * 2];
+            l = K[i * 2 + 1];
+            a += l & 65535;
+            b += l >>> 16;
+            c += h & 65535;
+            d += h >>> 16;
+            h = wh[i % 16];
+            l = wl[i % 16];
+            a += l & 65535;
+            b += l >>> 16;
+            c += h & 65535;
+            d += h >>> 16;
+            b += a >>> 16;
+            c += b >>> 16;
+            d += c >>> 16;
+            th = c & 65535 | d << 16;
+            tl = a & 65535 | b << 16;
+            h = th;
+            l = tl;
+            a = l & 65535;
+            b = l >>> 16;
+            c = h & 65535;
+            d = h >>> 16;
+            h = (ah0 >>> 28 | al0 << 32 - 28) ^ (al0 >>> 34 - 32 | ah0 << 32 - (34 - 32)) ^ (al0 >>> 39 - 32 | ah0 << 32 - (39 - 32));
+            l = (al0 >>> 28 | ah0 << 32 - 28) ^ (ah0 >>> 34 - 32 | al0 << 32 - (34 - 32)) ^ (ah0 >>> 39 - 32 | al0 << 32 - (39 - 32));
+            a += l & 65535;
+            b += l >>> 16;
+            c += h & 65535;
+            d += h >>> 16;
+            h = ah0 & ah1 ^ ah0 & ah2 ^ ah1 & ah2;
+            l = al0 & al1 ^ al0 & al2 ^ al1 & al2;
+            a += l & 65535;
+            b += l >>> 16;
+            c += h & 65535;
+            d += h >>> 16;
+            b += a >>> 16;
+            c += b >>> 16;
+            d += c >>> 16;
+            bh7 = c & 65535 | d << 16;
+            bl7 = a & 65535 | b << 16;
+            h = bh3;
+            l = bl3;
+            a = l & 65535;
+            b = l >>> 16;
+            c = h & 65535;
+            d = h >>> 16;
+            h = th;
+            l = tl;
+            a += l & 65535;
+            b += l >>> 16;
+            c += h & 65535;
+            d += h >>> 16;
+            b += a >>> 16;
+            c += b >>> 16;
+            d += c >>> 16;
+            bh3 = c & 65535 | d << 16;
+            bl3 = a & 65535 | b << 16;
+            ah1 = bh0;
+            ah2 = bh1;
+            ah3 = bh2;
+            ah4 = bh3;
+            ah5 = bh4;
+            ah6 = bh5;
+            ah7 = bh6;
+            ah0 = bh7;
+            al1 = bl0;
+            al2 = bl1;
+            al3 = bl2;
+            al4 = bl3;
+            al5 = bl4;
+            al6 = bl5;
+            al7 = bl6;
+            al0 = bl7;
+            if (i % 16 === 15) {
+              for (j = 0; j < 16; j++) {
+                h = wh[j];
+                l = wl[j];
+                a = l & 65535;
+                b = l >>> 16;
+                c = h & 65535;
+                d = h >>> 16;
+                h = wh[(j + 9) % 16];
+                l = wl[(j + 9) % 16];
+                a += l & 65535;
+                b += l >>> 16;
+                c += h & 65535;
+                d += h >>> 16;
+                th = wh[(j + 1) % 16];
+                tl = wl[(j + 1) % 16];
+                h = (th >>> 1 | tl << 32 - 1) ^ (th >>> 8 | tl << 32 - 8) ^ th >>> 7;
+                l = (tl >>> 1 | th << 32 - 1) ^ (tl >>> 8 | th << 32 - 8) ^ (tl >>> 7 | th << 32 - 7);
+                a += l & 65535;
+                b += l >>> 16;
+                c += h & 65535;
+                d += h >>> 16;
+                th = wh[(j + 14) % 16];
+                tl = wl[(j + 14) % 16];
+                h = (th >>> 19 | tl << 32 - 19) ^ (tl >>> 61 - 32 | th << 32 - (61 - 32)) ^ th >>> 6;
+                l = (tl >>> 19 | th << 32 - 19) ^ (th >>> 61 - 32 | tl << 32 - (61 - 32)) ^ (tl >>> 6 | th << 32 - 6);
+                a += l & 65535;
+                b += l >>> 16;
+                c += h & 65535;
+                d += h >>> 16;
+                b += a >>> 16;
+                c += b >>> 16;
+                d += c >>> 16;
+                wh[j] = c & 65535 | d << 16;
+                wl[j] = a & 65535 | b << 16;
+              }
+            }
+          }
+          h = ah0;
+          l = al0;
+          a = l & 65535;
+          b = l >>> 16;
+          c = h & 65535;
+          d = h >>> 16;
+          h = hh[0];
+          l = hl[0];
+          a += l & 65535;
+          b += l >>> 16;
+          c += h & 65535;
+          d += h >>> 16;
+          b += a >>> 16;
+          c += b >>> 16;
+          d += c >>> 16;
+          hh[0] = ah0 = c & 65535 | d << 16;
+          hl[0] = al0 = a & 65535 | b << 16;
+          h = ah1;
+          l = al1;
+          a = l & 65535;
+          b = l >>> 16;
+          c = h & 65535;
+          d = h >>> 16;
+          h = hh[1];
+          l = hl[1];
+          a += l & 65535;
+          b += l >>> 16;
+          c += h & 65535;
+          d += h >>> 16;
+          b += a >>> 16;
+          c += b >>> 16;
+          d += c >>> 16;
+          hh[1] = ah1 = c & 65535 | d << 16;
+          hl[1] = al1 = a & 65535 | b << 16;
+          h = ah2;
+          l = al2;
+          a = l & 65535;
+          b = l >>> 16;
+          c = h & 65535;
+          d = h >>> 16;
+          h = hh[2];
+          l = hl[2];
+          a += l & 65535;
+          b += l >>> 16;
+          c += h & 65535;
+          d += h >>> 16;
+          b += a >>> 16;
+          c += b >>> 16;
+          d += c >>> 16;
+          hh[2] = ah2 = c & 65535 | d << 16;
+          hl[2] = al2 = a & 65535 | b << 16;
+          h = ah3;
+          l = al3;
+          a = l & 65535;
+          b = l >>> 16;
+          c = h & 65535;
+          d = h >>> 16;
+          h = hh[3];
+          l = hl[3];
+          a += l & 65535;
+          b += l >>> 16;
+          c += h & 65535;
+          d += h >>> 16;
+          b += a >>> 16;
+          c += b >>> 16;
+          d += c >>> 16;
+          hh[3] = ah3 = c & 65535 | d << 16;
+          hl[3] = al3 = a & 65535 | b << 16;
+          h = ah4;
+          l = al4;
+          a = l & 65535;
+          b = l >>> 16;
+          c = h & 65535;
+          d = h >>> 16;
+          h = hh[4];
+          l = hl[4];
+          a += l & 65535;
+          b += l >>> 16;
+          c += h & 65535;
+          d += h >>> 16;
+          b += a >>> 16;
+          c += b >>> 16;
+          d += c >>> 16;
+          hh[4] = ah4 = c & 65535 | d << 16;
+          hl[4] = al4 = a & 65535 | b << 16;
+          h = ah5;
+          l = al5;
+          a = l & 65535;
+          b = l >>> 16;
+          c = h & 65535;
+          d = h >>> 16;
+          h = hh[5];
+          l = hl[5];
+          a += l & 65535;
+          b += l >>> 16;
+          c += h & 65535;
+          d += h >>> 16;
+          b += a >>> 16;
+          c += b >>> 16;
+          d += c >>> 16;
+          hh[5] = ah5 = c & 65535 | d << 16;
+          hl[5] = al5 = a & 65535 | b << 16;
+          h = ah6;
+          l = al6;
+          a = l & 65535;
+          b = l >>> 16;
+          c = h & 65535;
+          d = h >>> 16;
+          h = hh[6];
+          l = hl[6];
+          a += l & 65535;
+          b += l >>> 16;
+          c += h & 65535;
+          d += h >>> 16;
+          b += a >>> 16;
+          c += b >>> 16;
+          d += c >>> 16;
+          hh[6] = ah6 = c & 65535 | d << 16;
+          hl[6] = al6 = a & 65535 | b << 16;
+          h = ah7;
+          l = al7;
+          a = l & 65535;
+          b = l >>> 16;
+          c = h & 65535;
+          d = h >>> 16;
+          h = hh[7];
+          l = hl[7];
+          a += l & 65535;
+          b += l >>> 16;
+          c += h & 65535;
+          d += h >>> 16;
+          b += a >>> 16;
+          c += b >>> 16;
+          d += c >>> 16;
+          hh[7] = ah7 = c & 65535 | d << 16;
+          hl[7] = al7 = a & 65535 | b << 16;
+          pos += 128;
+          n -= 128;
+        }
+        return n;
+      }
+      function crypto_hash(out, m, n) {
+        var hh = new Int32Array(8), hl = new Int32Array(8), x = new Uint8Array(256), i, b = n;
+        hh[0] = 1779033703;
+        hh[1] = 3144134277;
+        hh[2] = 1013904242;
+        hh[3] = 2773480762;
+        hh[4] = 1359893119;
+        hh[5] = 2600822924;
+        hh[6] = 528734635;
+        hh[7] = 1541459225;
+        hl[0] = 4089235720;
+        hl[1] = 2227873595;
+        hl[2] = 4271175723;
+        hl[3] = 1595750129;
+        hl[4] = 2917565137;
+        hl[5] = 725511199;
+        hl[6] = 4215389547;
+        hl[7] = 327033209;
+        crypto_hashblocks_hl(hh, hl, m, n);
+        n %= 128;
+        for (i = 0; i < n; i++) x[i] = m[b - n + i];
+        x[n] = 128;
+        n = 256 - 128 * (n < 112 ? 1 : 0);
+        x[n - 9] = 0;
+        ts64(x, n - 8, b / 536870912 | 0, b << 3);
+        crypto_hashblocks_hl(hh, hl, x, n);
+        for (i = 0; i < 8; i++) ts64(out, 8 * i, hh[i], hl[i]);
+        return 0;
+      }
+      function add(p, q) {
+        var a = gf(), b = gf(), c = gf(), d = gf(), e = gf(), f = gf(), g = gf(), h = gf(), t = gf();
+        Z(a, p[1], p[0]);
+        Z(t, q[1], q[0]);
+        M(a, a, t);
+        A(b, p[0], p[1]);
+        A(t, q[0], q[1]);
+        M(b, b, t);
+        M(c, p[3], q[3]);
+        M(c, c, D2);
+        M(d, p[2], q[2]);
+        A(d, d, d);
+        Z(e, b, a);
+        Z(f, d, c);
+        A(g, d, c);
+        A(h, b, a);
+        M(p[0], e, f);
+        M(p[1], h, g);
+        M(p[2], g, f);
+        M(p[3], e, h);
+      }
+      function cswap(p, q, b) {
+        var i;
+        for (i = 0; i < 4; i++) {
+          sel25519(p[i], q[i], b);
+        }
+      }
+      function pack(r, p) {
+        var tx = gf(), ty = gf(), zi = gf();
+        inv25519(zi, p[2]);
+        M(tx, p[0], zi);
+        M(ty, p[1], zi);
+        pack25519(r, ty);
+        r[31] ^= par25519(tx) << 7;
+      }
+      function scalarmult(p, q, s) {
+        var b, i;
+        set25519(p[0], gf0);
+        set25519(p[1], gf1);
+        set25519(p[2], gf1);
+        set25519(p[3], gf0);
+        for (i = 255; i >= 0; --i) {
+          b = s[i / 8 | 0] >> (i & 7) & 1;
+          cswap(p, q, b);
+          add(q, p);
+          add(p, p);
+          cswap(p, q, b);
+        }
+      }
+      function scalarbase(p, s) {
+        var q = [gf(), gf(), gf(), gf()];
+        set25519(q[0], X);
+        set25519(q[1], Y);
+        set25519(q[2], gf1);
+        M(q[3], X, Y);
+        scalarmult(p, q, s);
+      }
+      function crypto_sign_keypair(pk, sk, seeded) {
+        var d = new Uint8Array(64);
+        var p = [gf(), gf(), gf(), gf()];
+        var i;
+        if (!seeded) randombytes(sk, 32);
+        crypto_hash(d, sk, 32);
+        d[0] &= 248;
+        d[31] &= 127;
+        d[31] |= 64;
+        scalarbase(p, d);
+        pack(pk, p);
+        for (i = 0; i < 32; i++) sk[i + 32] = pk[i];
+        return 0;
+      }
+      var L = new Float64Array([237, 211, 245, 92, 26, 99, 18, 88, 214, 156, 247, 162, 222, 249, 222, 20, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 16]);
+      function modL(r, x) {
+        var carry, i, j, k;
+        for (i = 63; i >= 32; --i) {
+          carry = 0;
+          for (j = i - 32, k = i - 12; j < k; ++j) {
+            x[j] += carry - 16 * x[i] * L[j - (i - 32)];
+            carry = Math.floor((x[j] + 128) / 256);
+            x[j] -= carry * 256;
+          }
+          x[j] += carry;
+          x[i] = 0;
+        }
+        carry = 0;
+        for (j = 0; j < 32; j++) {
+          x[j] += carry - (x[31] >> 4) * L[j];
+          carry = x[j] >> 8;
+          x[j] &= 255;
+        }
+        for (j = 0; j < 32; j++) x[j] -= carry * L[j];
+        for (i = 0; i < 32; i++) {
+          x[i + 1] += x[i] >> 8;
+          r[i] = x[i] & 255;
+        }
+      }
+      function reduce(r) {
+        var x = new Float64Array(64), i;
+        for (i = 0; i < 64; i++) x[i] = r[i];
+        for (i = 0; i < 64; i++) r[i] = 0;
+        modL(r, x);
+      }
+      function crypto_sign(sm, m, n, sk) {
+        var d = new Uint8Array(64), h = new Uint8Array(64), r = new Uint8Array(64);
+        var i, j, x = new Float64Array(64);
+        var p = [gf(), gf(), gf(), gf()];
+        crypto_hash(d, sk, 32);
+        d[0] &= 248;
+        d[31] &= 127;
+        d[31] |= 64;
+        var smlen = n + 64;
+        for (i = 0; i < n; i++) sm[64 + i] = m[i];
+        for (i = 0; i < 32; i++) sm[32 + i] = d[32 + i];
+        crypto_hash(r, sm.subarray(32), n + 32);
+        reduce(r);
+        scalarbase(p, r);
+        pack(sm, p);
+        for (i = 32; i < 64; i++) sm[i] = sk[i];
+        crypto_hash(h, sm, n + 64);
+        reduce(h);
+        for (i = 0; i < 64; i++) x[i] = 0;
+        for (i = 0; i < 32; i++) x[i] = r[i];
+        for (i = 0; i < 32; i++) {
+          for (j = 0; j < 32; j++) {
+            x[i + j] += h[i] * d[j];
+          }
+        }
+        modL(sm.subarray(32), x);
+        return smlen;
+      }
+      function unpackneg(r, p) {
+        var t = gf(), chk = gf(), num = gf(), den = gf(), den2 = gf(), den4 = gf(), den6 = gf();
+        set25519(r[2], gf1);
+        unpack25519(r[1], p);
+        S(num, r[1]);
+        M(den, num, D);
+        Z(num, num, r[2]);
+        A(den, r[2], den);
+        S(den2, den);
+        S(den4, den2);
+        M(den6, den4, den2);
+        M(t, den6, num);
+        M(t, t, den);
+        pow2523(t, t);
+        M(t, t, num);
+        M(t, t, den);
+        M(t, t, den);
+        M(r[0], t, den);
+        S(chk, r[0]);
+        M(chk, chk, den);
+        if (neq25519(chk, num)) M(r[0], r[0], I);
+        S(chk, r[0]);
+        M(chk, chk, den);
+        if (neq25519(chk, num)) return -1;
+        if (par25519(r[0]) === p[31] >> 7) Z(r[0], gf0, r[0]);
+        M(r[3], r[0], r[1]);
+        return 0;
+      }
+      function crypto_sign_open(m, sm, n, pk) {
+        var i;
+        var t = new Uint8Array(32), h = new Uint8Array(64);
+        var p = [gf(), gf(), gf(), gf()], q = [gf(), gf(), gf(), gf()];
+        if (n < 64) return -1;
+        if (unpackneg(q, pk)) return -1;
+        for (i = 0; i < n; i++) m[i] = sm[i];
+        for (i = 0; i < 32; i++) m[i + 32] = pk[i];
+        crypto_hash(h, m, n);
+        reduce(h);
+        scalarmult(p, q, h);
+        scalarbase(q, sm.subarray(32));
+        add(p, q);
+        pack(t, p);
+        n -= 64;
+        if (crypto_verify_32(sm, 0, t, 0)) {
+          for (i = 0; i < n; i++) m[i] = 0;
+          return -1;
+        }
+        for (i = 0; i < n; i++) m[i] = sm[i + 64];
+        return n;
+      }
+      var crypto_secretbox_KEYBYTES = 32, crypto_secretbox_NONCEBYTES = 24, crypto_secretbox_ZEROBYTES = 32, crypto_secretbox_BOXZEROBYTES = 16, crypto_scalarmult_BYTES = 32, crypto_scalarmult_SCALARBYTES = 32, crypto_box_PUBLICKEYBYTES = 32, crypto_box_SECRETKEYBYTES = 32, crypto_box_BEFORENMBYTES = 32, crypto_box_NONCEBYTES = crypto_secretbox_NONCEBYTES, crypto_box_ZEROBYTES = crypto_secretbox_ZEROBYTES, crypto_box_BOXZEROBYTES = crypto_secretbox_BOXZEROBYTES, crypto_sign_BYTES = 64, crypto_sign_PUBLICKEYBYTES = 32, crypto_sign_SECRETKEYBYTES = 64, crypto_sign_SEEDBYTES = 32, crypto_hash_BYTES = 64;
+      nacl6.lowlevel = {
+        crypto_core_hsalsa20,
+        crypto_stream_xor,
+        crypto_stream,
+        crypto_stream_salsa20_xor,
+        crypto_stream_salsa20,
+        crypto_onetimeauth,
+        crypto_onetimeauth_verify,
+        crypto_verify_16,
+        crypto_verify_32,
+        crypto_secretbox,
+        crypto_secretbox_open,
+        crypto_scalarmult,
+        crypto_scalarmult_base,
+        crypto_box_beforenm,
+        crypto_box_afternm,
+        crypto_box,
+        crypto_box_open,
+        crypto_box_keypair,
+        crypto_hash,
+        crypto_sign,
+        crypto_sign_keypair,
+        crypto_sign_open,
+        crypto_secretbox_KEYBYTES,
+        crypto_secretbox_NONCEBYTES,
+        crypto_secretbox_ZEROBYTES,
+        crypto_secretbox_BOXZEROBYTES,
+        crypto_scalarmult_BYTES,
+        crypto_scalarmult_SCALARBYTES,
+        crypto_box_PUBLICKEYBYTES,
+        crypto_box_SECRETKEYBYTES,
+        crypto_box_BEFORENMBYTES,
+        crypto_box_NONCEBYTES,
+        crypto_box_ZEROBYTES,
+        crypto_box_BOXZEROBYTES,
+        crypto_sign_BYTES,
+        crypto_sign_PUBLICKEYBYTES,
+        crypto_sign_SECRETKEYBYTES,
+        crypto_sign_SEEDBYTES,
+        crypto_hash_BYTES,
+        gf,
+        D,
+        L,
+        pack25519,
+        unpack25519,
+        M,
+        A,
+        S,
+        Z,
+        pow2523,
+        add,
+        set25519,
+        modL,
+        scalarmult,
+        scalarbase
+      };
+      function checkLengths(k, n) {
+        if (k.length !== crypto_secretbox_KEYBYTES) throw new Error("bad key size");
+        if (n.length !== crypto_secretbox_NONCEBYTES) throw new Error("bad nonce size");
+      }
+      function checkBoxLengths(pk, sk) {
+        if (pk.length !== crypto_box_PUBLICKEYBYTES) throw new Error("bad public key size");
+        if (sk.length !== crypto_box_SECRETKEYBYTES) throw new Error("bad secret key size");
+      }
+      function checkArrayTypes() {
+        for (var i = 0; i < arguments.length; i++) {
+          if (!(arguments[i] instanceof Uint8Array))
+            throw new TypeError("unexpected type, use Uint8Array");
+        }
+      }
+      function cleanup(arr) {
+        for (var i = 0; i < arr.length; i++) arr[i] = 0;
+      }
+      nacl6.randomBytes = function(n) {
+        var b = new Uint8Array(n);
+        randombytes(b, n);
+        return b;
+      };
+      nacl6.secretbox = function(msg, nonce, key) {
+        checkArrayTypes(msg, nonce, key);
+        checkLengths(key, nonce);
+        var m = new Uint8Array(crypto_secretbox_ZEROBYTES + msg.length);
+        var c = new Uint8Array(m.length);
+        for (var i = 0; i < msg.length; i++) m[i + crypto_secretbox_ZEROBYTES] = msg[i];
+        crypto_secretbox(c, m, m.length, nonce, key);
+        return c.subarray(crypto_secretbox_BOXZEROBYTES);
+      };
+      nacl6.secretbox.open = function(box, nonce, key) {
+        checkArrayTypes(box, nonce, key);
+        checkLengths(key, nonce);
+        var c = new Uint8Array(crypto_secretbox_BOXZEROBYTES + box.length);
+        var m = new Uint8Array(c.length);
+        for (var i = 0; i < box.length; i++) c[i + crypto_secretbox_BOXZEROBYTES] = box[i];
+        if (c.length < 32) return null;
+        if (crypto_secretbox_open(m, c, c.length, nonce, key) !== 0) return null;
+        return m.subarray(crypto_secretbox_ZEROBYTES);
+      };
+      nacl6.secretbox.keyLength = crypto_secretbox_KEYBYTES;
+      nacl6.secretbox.nonceLength = crypto_secretbox_NONCEBYTES;
+      nacl6.secretbox.overheadLength = crypto_secretbox_BOXZEROBYTES;
+      nacl6.scalarMult = function(n, p) {
+        checkArrayTypes(n, p);
+        if (n.length !== crypto_scalarmult_SCALARBYTES) throw new Error("bad n size");
+        if (p.length !== crypto_scalarmult_BYTES) throw new Error("bad p size");
+        var q = new Uint8Array(crypto_scalarmult_BYTES);
+        crypto_scalarmult(q, n, p);
+        return q;
+      };
+      nacl6.scalarMult.base = function(n) {
+        checkArrayTypes(n);
+        if (n.length !== crypto_scalarmult_SCALARBYTES) throw new Error("bad n size");
+        var q = new Uint8Array(crypto_scalarmult_BYTES);
+        crypto_scalarmult_base(q, n);
+        return q;
+      };
+      nacl6.scalarMult.scalarLength = crypto_scalarmult_SCALARBYTES;
+      nacl6.scalarMult.groupElementLength = crypto_scalarmult_BYTES;
+      nacl6.box = function(msg, nonce, publicKey, secretKey) {
+        var k = nacl6.box.before(publicKey, secretKey);
+        return nacl6.secretbox(msg, nonce, k);
+      };
+      nacl6.box.before = function(publicKey, secretKey) {
+        checkArrayTypes(publicKey, secretKey);
+        checkBoxLengths(publicKey, secretKey);
+        var k = new Uint8Array(crypto_box_BEFORENMBYTES);
+        crypto_box_beforenm(k, publicKey, secretKey);
+        return k;
+      };
+      nacl6.box.after = nacl6.secretbox;
+      nacl6.box.open = function(msg, nonce, publicKey, secretKey) {
+        var k = nacl6.box.before(publicKey, secretKey);
+        return nacl6.secretbox.open(msg, nonce, k);
+      };
+      nacl6.box.open.after = nacl6.secretbox.open;
+      nacl6.box.keyPair = function() {
+        var pk = new Uint8Array(crypto_box_PUBLICKEYBYTES);
+        var sk = new Uint8Array(crypto_box_SECRETKEYBYTES);
+        crypto_box_keypair(pk, sk);
+        return { publicKey: pk, secretKey: sk };
+      };
+      nacl6.box.keyPair.fromSecretKey = function(secretKey) {
+        checkArrayTypes(secretKey);
+        if (secretKey.length !== crypto_box_SECRETKEYBYTES)
+          throw new Error("bad secret key size");
+        var pk = new Uint8Array(crypto_box_PUBLICKEYBYTES);
+        crypto_scalarmult_base(pk, secretKey);
+        return { publicKey: pk, secretKey: new Uint8Array(secretKey) };
+      };
+      nacl6.box.publicKeyLength = crypto_box_PUBLICKEYBYTES;
+      nacl6.box.secretKeyLength = crypto_box_SECRETKEYBYTES;
+      nacl6.box.sharedKeyLength = crypto_box_BEFORENMBYTES;
+      nacl6.box.nonceLength = crypto_box_NONCEBYTES;
+      nacl6.box.overheadLength = nacl6.secretbox.overheadLength;
+      nacl6.sign = function(msg, secretKey) {
+        checkArrayTypes(msg, secretKey);
+        if (secretKey.length !== crypto_sign_SECRETKEYBYTES)
+          throw new Error("bad secret key size");
+        var signedMsg = new Uint8Array(crypto_sign_BYTES + msg.length);
+        crypto_sign(signedMsg, msg, msg.length, secretKey);
+        return signedMsg;
+      };
+      nacl6.sign.open = function(signedMsg, publicKey) {
+        checkArrayTypes(signedMsg, publicKey);
+        if (publicKey.length !== crypto_sign_PUBLICKEYBYTES)
+          throw new Error("bad public key size");
+        var tmp = new Uint8Array(signedMsg.length);
+        var mlen = crypto_sign_open(tmp, signedMsg, signedMsg.length, publicKey);
+        if (mlen < 0) return null;
+        var m = new Uint8Array(mlen);
+        for (var i = 0; i < m.length; i++) m[i] = tmp[i];
+        return m;
+      };
+      nacl6.sign.detached = function(msg, secretKey) {
+        var signedMsg = nacl6.sign(msg, secretKey);
+        var sig = new Uint8Array(crypto_sign_BYTES);
+        for (var i = 0; i < sig.length; i++) sig[i] = signedMsg[i];
+        return sig;
+      };
+      nacl6.sign.detached.verify = function(msg, sig, publicKey) {
+        checkArrayTypes(msg, sig, publicKey);
+        if (sig.length !== crypto_sign_BYTES)
+          throw new Error("bad signature size");
+        if (publicKey.length !== crypto_sign_PUBLICKEYBYTES)
+          throw new Error("bad public key size");
+        var sm = new Uint8Array(crypto_sign_BYTES + msg.length);
+        var m = new Uint8Array(crypto_sign_BYTES + msg.length);
+        var i;
+        for (i = 0; i < crypto_sign_BYTES; i++) sm[i] = sig[i];
+        for (i = 0; i < msg.length; i++) sm[i + crypto_sign_BYTES] = msg[i];
+        return crypto_sign_open(m, sm, sm.length, publicKey) >= 0;
+      };
+      nacl6.sign.keyPair = function() {
+        var pk = new Uint8Array(crypto_sign_PUBLICKEYBYTES);
+        var sk = new Uint8Array(crypto_sign_SECRETKEYBYTES);
+        crypto_sign_keypair(pk, sk);
+        return { publicKey: pk, secretKey: sk };
+      };
+      nacl6.sign.keyPair.fromSecretKey = function(secretKey) {
+        checkArrayTypes(secretKey);
+        if (secretKey.length !== crypto_sign_SECRETKEYBYTES)
+          throw new Error("bad secret key size");
+        var pk = new Uint8Array(crypto_sign_PUBLICKEYBYTES);
+        for (var i = 0; i < pk.length; i++) pk[i] = secretKey[32 + i];
+        return { publicKey: pk, secretKey: new Uint8Array(secretKey) };
+      };
+      nacl6.sign.keyPair.fromSeed = function(seed) {
+        checkArrayTypes(seed);
+        if (seed.length !== crypto_sign_SEEDBYTES)
+          throw new Error("bad seed size");
+        var pk = new Uint8Array(crypto_sign_PUBLICKEYBYTES);
+        var sk = new Uint8Array(crypto_sign_SECRETKEYBYTES);
+        for (var i = 0; i < 32; i++) sk[i] = seed[i];
+        crypto_sign_keypair(pk, sk, true);
+        return { publicKey: pk, secretKey: sk };
+      };
+      nacl6.sign.publicKeyLength = crypto_sign_PUBLICKEYBYTES;
+      nacl6.sign.secretKeyLength = crypto_sign_SECRETKEYBYTES;
+      nacl6.sign.seedLength = crypto_sign_SEEDBYTES;
+      nacl6.sign.signatureLength = crypto_sign_BYTES;
+      nacl6.hash = function(msg) {
+        checkArrayTypes(msg);
+        var h = new Uint8Array(crypto_hash_BYTES);
+        crypto_hash(h, msg, msg.length);
+        return h;
+      };
+      nacl6.hash.hashLength = crypto_hash_BYTES;
+      nacl6.verify = function(x, y) {
+        checkArrayTypes(x, y);
+        if (x.length === 0 || y.length === 0) return false;
+        if (x.length !== y.length) return false;
+        return vn(x, 0, y, 0, x.length) === 0 ? true : false;
+      };
+      nacl6.setPRNG = function(fn) {
+        randombytes = fn;
+      };
+      (function() {
+        var crypto = typeof self !== "undefined" ? self.crypto || self.msCrypto : null;
+        if (crypto && crypto.getRandomValues) {
+          var QUOTA = 65536;
+          nacl6.setPRNG(function(x, n) {
+            var i, v = new Uint8Array(n);
+            for (i = 0; i < n; i += QUOTA) {
+              crypto.getRandomValues(v.subarray(i, i + Math.min(n - i, QUOTA)));
+            }
+            for (i = 0; i < n; i++) x[i] = v[i];
+            cleanup(v);
+          });
+        } else if (typeof __require !== "undefined") {
+          crypto = __require("crypto");
+          if (crypto && crypto.randomBytes) {
+            nacl6.setPRNG(function(x, n) {
+              var i, v = crypto.randomBytes(n);
+              for (i = 0; i < n; i++) x[i] = v[i];
+              cleanup(v);
+            });
+          }
+        }
+      })();
+    })(typeof module !== "undefined" && module.exports ? module.exports : self.nacl = self.nacl || {});
+  }
+});
+
+// ../../packages/schema/dist/index.js
+import { z } from "zod";
+var ContextSchema = z.object({
+  title: z.string().min(1).describe("One-line headline of what you need (required, non-empty)."),
+  description: z.array(z.string().min(1)).min(1).describe("Semantic chunks of detail (each a standalone, non-empty piece). The user can select chunks to ask you to expand.")
+});
+var OptionSchema = z.object({
+  id: z.string(),
+  label: z.string(),
+  // .describe() flows into the MCP notify_user JSON schema (zodToJsonSchema), so
+  // the constraints below are what an agent reads when deciding to use these.
+  html: z.string().max(16384).describe(
+    "Optional sandboxed HTML/CSS preview for a visual 'pick one' (shown in the option card). Untrusted-sandboxed: NO JavaScript, NO external network or images \u2014 inline CSS and data: URIs only; <=16KB. Use for layout/CSS mockups, tables, diffs. For a hosted image use `image` instead."
+  ).optional(),
+  image: z.string().url().describe(
+    "Optional image URL rendered as the option's preview (plain image, not sandboxed). For agent-generated HTML/CSS mockups, use `html` instead."
+  ).optional()
+});
+var VisualSchema = z.object({
+  url: z.string().url(),
+  label: z.string().optional()
+});
+var NotifyLevelSchema = z.enum(["inbox", "push", "banner", "call"]);
+var NotifyRequestSchema = z.object({
+  /** Plaintext message content. Present on the plaintext path (today's shape);
+   *  ABSENT on the E2EE path, where the sealed `envelope` below carries it. The
+   *  superRefine at the bottom enforces exactly one of the two. */
+  context: ContextSchema.optional(),
+  options: z.array(OptionSchema.omit({ id: true })).min(1).optional().describe(
+    "The choices, in order \u2014 required when select is 'one'/'many'/'rank', omitted otherwise. Ids are assigned automatically by position ('1', '2', \u2026); the user's answer references them as optionId(s)."
+  ),
+  points: z.array(z.string().min(1)).optional().describe(
+    "The distinct things you need answered, each a short phrase \u2014 on a call the broker keeps the conversation going until each is addressed, and the reply reports which were covered, so a half-answer is never silently returned as final. Omit for single-part asks."
+  ),
+  visuals: z.array(VisualSchema).optional().describe(
+    "Images attached to the message itself \u2014 context for the whole question (a screenshot, a chart). For a preview on one selectable choice, use that option's `html`/`image` instead."
+  ),
+  /** Git repo the agent is working in ("owner/name"). Local MCP fills this from the checkout — omit unless overriding. */
+  repo: z.string().optional(),
+  /** Git branch the agent is on. Local MCP fills this from the checkout — omit unless overriding. */
+  branch: z.string().optional(),
+  /** Continue an existing conversation; omitted = start a new thread. */
+  threadId: z.string().uuid().optional(),
+  urgency: NotifyLevelSchema.default("inbox").describe(
+    "The level you're requesting \u2014 the user's account permissions + session mode can lower it. 'inbox' (default) = sits silently in the inbox for the user to get to. 'push' = a quiet passive push (lands in Notification Center, no sound) \u2014 a gentle heads-up. 'banner' = a time-sensitive banner/lock-screen push with sound (a 'paige') they tap to open \u2014 use when you need them soon-ish but it's not worth ringing them. 'call' = rings the user's phone now (a CallKit voice call) \u2014 use only when you genuinely need them in the moment (blocked and waiting, time-sensitive). context.title is what they see on the banner/ring, so make it specific."
+  ),
+  /** The request this one was spawned from, for a clarification. */
+  parentId: z.string().optional(),
+  /** E2EE (text lane): when the pairing is E2EE, the sealed replacements for the
+   *  plaintext content fields, keyed by field name. FINALIZED wire shape (was
+   *  provisional in the storage PR): a per-field map `{ context?, options?,
+   *  visuals? }` of opaque Envelopes — one seal per present content field, so a
+   *  message with no options/visuals seals only `context`. It COEXISTS with the
+   *  plaintext fields by mutual exclusion: the superRefine below requires that
+   *  when `envelope` is present the plaintext `context`/`options`/`visuals` are
+   *  ABSENT (and vice-versa), so a row is either fully plaintext or fully sealed —
+   *  never a readable half. The server persists this OPAQUELY into
+   *  notifications.envelope and relays it blindly; it never decrypts. Absent =
+   *  today's plaintext path (context/options/visuals carry the cleartext).
+   *  z.lazy because EnvelopeSchema is declared further down (E2EE section). */
+  envelope: z.object({
+    context: z.lazy(() => EnvelopeSchema).optional(),
+    options: z.lazy(() => EnvelopeSchema).optional(),
+    visuals: z.lazy(() => EnvelopeSchema).optional()
+  }).optional(),
+  select: z.enum(["one", "many", "rank", "confirm", "text"]).optional().describe(
+    "How the user answers \u2014 required on the fully-shaped form, pick the shape that fits the question: 'one' = pick one option, 'many' = pick several, 'rank' = pick & order (each needs `options`); 'confirm' = yes/no or approve/deny; 'text' = free-form reply only (status updates, open questions). 'confirm' and 'text' take no options. Omit only when sending the simplified `ask` form \u2014 the broker picks the shape."
+  ),
+  /** The simplified form (#395): instead of shaping the notification yourself
+   *  (context/select/options/urgency), state what you need to learn and why it
+   *  matters now — the broker derives the optimal shape and channel. Mutually
+   *  exclusive with `context` (and never sent alongside `envelope`: E2EE pairings
+   *  derive agent-side before sealing, so the server only ever shapes plaintext). */
+  ask: z.string().min(1).optional().describe(
+    'SIMPLIFIED FORM \u2014 state in plain prose what you need to learn from the user and why it matters now (e.g. "I need to know whether to deploy the auth fix \u2014 tests are green, staging verified"). Paigy derives the title, answer shape, options, and delivery channel for you. Mutually exclusive with context/select/options \u2014 send one form or the other.'
+  ),
+  needs: z.array(z.string().min(1)).optional().describe(
+    "With `ask` only: the distinct things you need answered when the ask is multi-part \u2014 becomes the coverage contract (`points`), so a half-answer is never silently final."
+  ),
+  urgencyHint: z.enum(["whenever", "soon", "now"]).optional().describe(
+    "With `ask` only: how urgently you need the answer \u2014 'whenever' (inbox), 'soon' (worth a heads-up), 'now' (you're blocked this minute). A hint, not a command: the user's settings still have the final word."
+  ),
+  confirmStyle: z.enum(["yesno", "approve"]).default("yesno").describe(
+    "Labels for a select:'confirm' paige \u2014 'yesno' (Yes/No) or 'approve' (Approve/Deny). Ignored unless select is 'confirm'."
+  ),
+  blocking: z.boolean().default(false).describe(
+    "Set true when real downstream work is stuck behind this specific decision \u2014 you can't make meaningful progress until it's answered. This is the real signal for how urgently the user should be reached; it's what the premier use case (an agent that stays unblocked instead of going idle) depends on. Independent of `urgency`: a `banner`-level question can still be `blocking` (something IS stuck, just not time-critical enough to ring for immediately) \u2014 if it goes unanswered a while, Paigy escalates it to a real call using this flag rather than guessing from how many other things happen to be pending. Leave false for anything you could work around, defer, or where other useful work exists meanwhile."
+  )
+}).superRefine((r, ctx) => {
+  const sealed = !!r.envelope;
+  if (sealed) {
+    if (!r.envelope?.context)
+      ctx.addIssue({ code: z.ZodIssueCode.custom, path: ["envelope", "context"], message: "sealed request must include envelope.context" });
+    for (const f of ["context", "options", "visuals"]) {
+      if (r[f] !== void 0)
+        ctx.addIssue({ code: z.ZodIssueCode.custom, path: [f], message: `E2EE request must not carry plaintext ${f} \u2014 it's sealed in envelope.${f}` });
+    }
+    if (r.points !== void 0)
+      ctx.addIssue({ code: z.ZodIssueCode.custom, path: ["points"], message: "E2EE request must not carry plaintext points" });
+    if (r.ask !== void 0)
+      ctx.addIssue({ code: z.ZodIssueCode.custom, path: ["ask"], message: "E2EE request must not carry a plaintext ask \u2014 derive the shape agent-side and seal it" });
+    if (r.needs !== void 0)
+      ctx.addIssue({ code: z.ZodIssueCode.custom, path: ["needs"], message: "E2EE request must not carry plaintext needs" });
+    return;
+  }
+  if (r.ask !== void 0) {
+    for (const f of ["context", "options", "select", "points", "visuals"]) {
+      if (r[f] !== void 0)
+        ctx.addIssue({ code: z.ZodIssueCode.custom, path: [f], message: `the simplified \`ask\` form takes no ${f} \u2014 the broker derives it (use \`needs\` for multi-part asks)` });
+    }
+    return;
+  }
+  if (r.needs !== void 0 || r.urgencyHint !== void 0)
+    ctx.addIssue({ code: z.ZodIssueCode.custom, path: ["needs"], message: "needs/urgencyHint belong to the simplified `ask` form \u2014 with a shaped request use points/urgency" });
+  if (!r.context)
+    ctx.addIssue({ code: z.ZodIssueCode.custom, path: ["context"], message: "context is required (plaintext path)" });
+  if (!r.select)
+    ctx.addIssue({ code: z.ZodIssueCode.custom, path: ["select"], message: "select is required on the shaped form" });
+  const needsOptions = r.select === "one" || r.select === "many" || r.select === "rank";
+  if (needsOptions && !r.options?.length)
+    ctx.addIssue({ code: z.ZodIssueCode.custom, path: ["options"], message: `select:'${r.select}' requires options` });
+  if (!needsOptions && r.options?.length)
+    ctx.addIssue({ code: z.ZodIssueCode.custom, path: ["options"], message: `select:'${r.select}' takes no options` });
+});
+function deriveAsk(req) {
+  if (!req.ask) return req;
+  const text = req.ask.trim();
+  const firstSentence = (/^[^.!?\n]+[.!?]?/.exec(text)?.[0] ?? text).trim();
+  const title = firstSentence.length > 90 ? `${firstSentence.slice(0, 87).trimEnd()}\u2026` : firstSentence;
+  const urgency = req.urgencyHint === "now" ? "call" : req.urgencyHint === "soon" ? "banner" : req.urgencyHint === "whenever" ? "inbox" : req.urgency;
+  const { ask: _ask, needs, urgencyHint: _hint, ...rest } = req;
+  return {
+    ...rest,
+    context: { title, description: [text] },
+    select: "text",
+    urgency,
+    ...needs?.length ? { points: needs } : {}
+  };
+}
+var NotifyStatusSchema = z.enum(["pending", "answered", "ignored"]);
+var AgentStateSchema = z.enum(["idle", "in_progress", "completed", "needs_input"]);
+var SetTaskStateSchema = z.object({
+  state: z.enum(["in_progress", "completed", "needs_input"])
+});
+var TurnSchema = z.object({
+  prompt: z.string(),
+  reply: z.string()
+});
+var UserAnswerSchema = z.discriminatedUnion("kind", [
+  z.object({ kind: z.literal("option"), optionId: z.string() }),
+  z.object({ kind: z.literal("text"), text: z.string() }),
+  z.object({ kind: z.literal("ignored") }),
+  z.object({ kind: z.literal("multi"), optionIds: z.array(z.string()) }),
+  z.object({ kind: z.literal("ranked"), optionIds: z.array(z.string()) }),
+  z.object({ kind: z.literal("clarify"), chunks: z.array(z.string()).min(1) }),
+  z.object({ kind: z.literal("confirm"), approved: z.boolean() }),
+  z.object({ kind: z.literal("turns"), turns: z.array(TurnSchema).min(1) })
+]);
+var IntentSchema = z.object({
+  kind: z.enum(["defer", "delegate", "channel"]),
+  detail: z.string(),
+  /** Landed defer (#397): the MCP parses common spoken forms ("in 20 minutes",
+   *  "after lunch") against the agent machine's clock — the user's — and attaches
+   *  the seconds, ready to pass straight to schedule_callback. Absent when the
+   *  detail didn't parse (the agent interprets it) or the kind isn't defer. */
+  dueInSeconds: z.number().int().positive().optional()
+});
+var AwaitItemSchema = z.discriminatedUnion("type", [
+  z.object({
+    type: z.literal("reply"),
+    threadId: z.string(),
+    notificationId: z.string(),
+    answer: UserAnswerSchema,
+    /** E2EE: present when the answer is sealed. The server relays the opaque answer
+     *  envelope + the plaintext `ignored` status hint; the receiving agent OPENS it
+     *  with its device key and re-derives the real UserAnswer, treating a mismatch
+     *  against `ignored` as tampering. Absent = today's plaintext answer (in `answer`).
+     *  On a sealed reply the plaintext `answer` is a placeholder (kind reflects only
+     *  the `ignored` bit) — never the real content, which stays sealed. */
+    sealed: z.lazy(() => SealedAnswerSchema).optional(),
+    /** Broker extras (#381), present when the answer was mapped from a call: next
+     *  steps the user attached ("call me after lunch" → defer — act on it via
+     *  schedule_callback) and the raw words the shaped answer was mapped from. */
+    intents: z.array(IntentSchema).optional(),
+    transcript: z.string().optional(),
+    /** Coverage report (#396), when the ask declared `points`: which of them this
+     *  answer addressed. Missing points = re-ask or proceed knowingly partial. */
+    covered: z.array(z.string()).optional()
+  }),
+  z.object({
+    type: z.literal("remind"),
+    threadId: z.string(),
+    notificationId: z.string(),
+    remindAt: z.string().datetime({ offset: true }),
+    /** Seconds until remindAt, server-computed — pass straight to ScheduleWakeup. */
+    remindInSeconds: z.number()
+  }),
+  z.object({ type: z.literal("idle") })
+]);
+var CallbackTriggerSchema = z.enum(["on_done", "on_blocked", "scheduled"]);
+var ScheduleCallbackSchema = z.object({
+  threadId: z.string().describe("The thread to call back on (from a prior notify_user / reply / request)."),
+  trigger: CallbackTriggerSchema,
+  dueInSeconds: z.number().int().positive().optional().describe("For 'scheduled' only: how many seconds from now to fire."),
+  note: z.string().optional().describe("What to tell the user when you follow up.")
+});
+var PendingRepliesSchema = z.object({
+  replies: z.array(
+    z.object({
+      threadId: z.string(),
+      notificationId: z.string(),
+      answer: UserAnswerSchema,
+      /** E2EE: the sealed answer (opaque envelope + plaintext `ignored` hint) when the
+       *  pairing is E2EE — the agent opens it and re-derives the real answer. Absent =
+       *  plaintext answer (in `answer`). See AwaitItemSchema's reply variant. */
+      sealed: z.lazy(() => SealedAnswerSchema).optional(),
+      /** Broker extras (#381): next steps the user attached to a call-mapped answer
+       *  ("call me after lunch" → defer — act on it via schedule_callback) and the
+       *  raw words the shaped answer was mapped from. */
+      intents: z.array(IntentSchema).optional(),
+      transcript: z.string().optional(),
+      /** Coverage report (#396): which declared `points` this answer addressed. */
+      covered: z.array(z.string()).optional()
+    })
+  ),
+  pending: z.array(
+    z.object({ threadId: z.string(), notificationId: z.string(), createdAt: z.string() })
+  ),
+  /** User-initiated requests addressed to this agent; act on them and reply via
+   *  notify_user on the same threadId. Keeps reappearing until you call
+   *  set_task_state on its notificationId. */
+  requests: z.array(
+    z.object({ threadId: z.string(), notificationId: z.string(), text: z.string(), createdAt: z.string() })
+  ),
+  /** Callbacks you owe the user that are now DUE (you said you'd follow up when done,
+   *  if blocked, or at a time that has passed). Re-surfaced every sweep until you
+   *  fulfill one by calling notify_user on its threadId. */
+  owedCallbacks: z.array(
+    z.object({ threadId: z.string(), trigger: CallbackTriggerSchema, note: z.string() })
+  ),
+  /** Work (either direction) you reported in_progress a while ago and never reported
+   *  completed — likely left half-done by this session or a prior one that crashed or
+   *  went idle. Report a real state (set_task_state) or continue the work. */
+  stalled: z.array(
+    z.object({ threadId: z.string(), notificationId: z.string(), title: z.string().nullable(), startedAt: z.string() })
+  )
+});
+var NotifyResponseSchema = z.object({
+  notificationId: z.string(),
+  status: NotifyStatusSchema,
+  createdAt: z.string().datetime(),
+  answer: UserAnswerSchema.optional(),
+  answeredAt: z.string().datetime().optional()
+});
+var UserResponseSchema = z.object({
+  requestId: z.string(),
+  answer: UserAnswerSchema,
+  answeredAt: z.string().datetime(),
+  intents: z.array(IntentSchema).optional(),
+  transcript: z.string().optional(),
+  /** E2EE: the sealed answer (opaque envelope + plaintext `ignored` hint) when the item was
+   *  E2EE-sealed. Present → the server persists it opaquely and branches status on `ignored`;
+   *  the plaintext `answer` is a placeholder (`{ kind: "ignored" }`) the server ignores for a
+   *  sealed row. Absent = today's plaintext answer, unchanged. */
+  sealed: z.lazy(() => SealedAnswerSchema).optional(),
+  /** Coverage report (#396): which of the ask's declared `points` were addressed. */
+  covered: z.array(z.string()).optional()
+});
+var InboxItemSchema = z.object({
+  id: z.string(),
+  status: NotifyStatusSchema,
+  context: ContextSchema,
+  options: z.array(OptionSchema).optional(),
+  /** The ask's declared coverage points (#396), when the agent sent them. */
+  points: z.array(z.string()).optional(),
+  /** On a replied detail (#397): the next steps the user attached to the answer
+   *  ("call back after lunch") — shown so they can see the commitment was captured. */
+  intents: z.array(IntentSchema).optional(),
+  visuals: z.array(VisualSchema).optional(),
+  agent: z.string(),
+  nickname: z.string(),
+  repo: z.string().optional(),
+  branch: z.string().optional(),
+  createdAt: z.string().datetime(),
+  snoozedUntil: z.string().datetime().optional(),
+  agentState: AgentStateSchema.default("idle"),
+  /** Whose action the item is waiting on: "you" = an agent asked you (the default,
+   *  every agent→user notification); "agent" = you sent a request and it's awaiting the
+   *  agent (held in the inbox until the agent replies on the thread). */
+  turn: z.enum(["you", "agent"]).default("you"),
+  /** Hard error reason on an awaiting request (turn="agent") — the wake failed to reach
+   *  the agent (provider-agnostic; set server-side). Absent = no hard error, though the
+   *  client may still flag a stall by age. Drives the inbox error badge + Retry. */
+  error: z.string().optional(),
+  parentId: z.string().optional(),
+  select: z.enum(["one", "many", "rank", "confirm", "text"]).default("one"),
+  confirmStyle: z.enum(["yesno", "approve"]).default("yesno").describe(
+    "Labels for a select:'confirm' paige \u2014 'yesno' (Yes/No) or 'approve' (Approve/Deny). Ignored unless select is 'confirm'."
+  ),
+  /** Real downstream work is stuck behind this one — set by the agent, independent of
+   *  urgency (see the main README's "premier use case" + notify/states.md). Drives the
+   *  inbox's blocking badge and the extra confirm step before dismissing it. */
+  blocking: z.boolean().default(false),
+  /** The user's locked-in answer; present only for replied items (GET /api/replied/:id). */
+  answer: UserAnswerSchema.optional(),
+  /** E2EE (text lane): the sealed content this item carries when the pairing is E2EE, in
+   *  place of the plaintext `context`/`options`/`visuals` (which the operator would
+   *  otherwise read). A per-field map of opaque Envelopes — the SAME shape as
+   *  NotifyRequest.envelope. The native app decrypts it locally via openNotification;
+   *  web / an un-enrolled device can't and renders a locked placeholder. Absent = today's
+   *  plaintext item (context carries the cleartext), so plaintext items are unchanged. */
+  envelope: z.object({
+    context: z.lazy(() => EnvelopeSchema).optional(),
+    options: z.lazy(() => EnvelopeSchema).optional(),
+    visuals: z.lazy(() => EnvelopeSchema).optional()
+  }).optional(),
+  /** E2EE: the agent's device X25519 public key to seal the user's answer BACK to (the
+   *  sender the phone replies to). Sourced server-side from this item's pairing credential.
+   *  Present only alongside `envelope`; the phone seals via sealAnswer(answer, this, id). */
+  agentX25519: z.string().optional()
+});
+var SnoozeRequestSchema = z.object({
+  requestId: z.string(),
+  until: z.string().datetime()
+});
+var PushTokenSchema = z.object({
+  voipToken: z.string().min(1).optional(),
+  alertToken: z.string().min(1).optional(),
+  fcmToken: z.string().min(1).optional(),
+  platform: z.enum(["ios", "android"])
+});
+var MissedCallSchema = z.enum([
+  "retry_10m",
+  "retry_30m",
+  "retry_60m",
+  "backoff_gentle",
+  "backoff_standard",
+  "backoff_aggressive",
+  "inbox",
+  "dismiss"
+]);
+var UserSettingsSchema = z.object({
+  permissions: z.object({
+    call: z.boolean(),
+    banner: z.boolean(),
+    push: z.boolean()
+  }),
+  sessionMode: z.enum(["default", "all_calls", "silent"]),
+  silentPush: z.boolean(),
+  autoCallback: z.boolean(),
+  /** Opt-in (default false) to using your content to improve Paigy and train models. */
+  improveConsent: z.boolean(),
+  missedCall: MissedCallSchema.default("backoff_standard"),
+  /** Where voice audio is processed. 'hosted' (default) = Paigy's voice services
+   *  (ElevenLabs TTS, faster-whisper STT, the call bot); 'on_device' = the phone
+   *  synthesizes and transcribes locally — no audio or spoken text leaves it.
+   *  Optional, NOT defaulted: a stale client PATCHing the full settings object
+   *  must not silently reset this privacy choice. Absent = leave unchanged on
+   *  write, 'hosted' on read (see store.ts). */
+  voiceMode: z.enum(["hosted", "on_device"]).optional(),
+  /** Account E2EE state (text lane): 'off' (default) = today's plaintext; 'on' =
+   *  content is sealed end-to-end between the local agent and the phone. Like
+   *  voiceMode, OPTIONAL and NOT defaulted so a stale client PATCHing the full
+   *  settings object without it can't silently flip the account's E2EE state.
+   *  Absent = leave unchanged on write, 'off' on read (see store.ts). The demo
+   *  account is plaintext by construction and refuses any non-'off' value. */
+  e2eeMode: z.enum(["off", "on"]).optional()
+});
+var HistoryItemSchema = z.object({
+  id: z.string(),
+  threadId: z.string(),
+  /** 'user' = a request you sent; 'agent' = a notification an agent sent you. */
+  initiator: z.enum(["user", "agent"]),
+  title: z.string(),
+  /** The agent on the other end (nickname). */
+  agent: z.string(),
+  createdAt: z.string(),
+  /** When the agent fetched your request (user→agent only). */
+  agentAckedAt: z.string().nullable(),
+  /** When you answered the agent's notification (agent→user only). */
+  humanAckedAt: z.string().nullable()
+});
+var ConnectionSummarySchema = z.object({
+  /** The connection = the agent's token id (used to address a request). */
+  id: z.string(),
+  agent: z.string(),
+  device: z.string().nullable(),
+  nickname: z.string(),
+  createdAt: z.string().datetime(),
+  /** Most recent notification on this connection, either direction. Null = no contact yet.
+   *  Drives the agents-page recency grouping (Today / This week / …). */
+  lastContactAt: z.string().datetime().nullable(),
+  /** True = a provider-managed agent running in the provider's cloud (e.g. Anthropic CMA);
+   *  false = a local MCP connection running on the user's computer (Claude Code/Codex/…). */
+  managed: z.boolean()
+});
+var CreateRequestSchema = z.object({
+  /** The connection (token id) to send to, from GET /api/tokens. */
+  tokenId: z.string(),
+  /** The user's message to the agent. */
+  text: z.string().min(1)
+});
+var DeliveryModeSchema = z.enum(["poll", "self_hosted"]);
+var WAKE_EVENT = "wake";
+var wakeChannel = (tokenId) => `wake:${tokenId}`;
+var RegisterDeliverySchema = z.object({ mode: DeliveryModeSchema });
+var OAuthStartSchema = z.object({
+  provider: z.enum(["cma"]),
+  returnTo: z.string().min(1)
+});
+var DeliveryConfigSchema = z.object({
+  tokenId: z.string(),
+  mode: DeliveryModeSchema,
+  /** null when the server has no SUPABASE_ANON_KEY set — the listener then falls
+   *  back to its own PAIGY_SUPABASE_URL / PAIGY_SUPABASE_ANON_KEY env. */
+  realtime: z.object({ url: z.string(), anonKey: z.string() }).nullable()
+});
+var StatusSchema = z.object({
+  agent: z.string(),
+  nickname: z.string(),
+  sessionMode: z.enum(["default", "all_calls", "silent"]),
+  /** A phone is registered for push/ring (any push token on the account). */
+  phone: z.boolean()
+});
+var EnvelopeRecipientSchema = z.object({
+  keyId: z.string(),
+  epk: z.string(),
+  wnonce: z.string(),
+  wrap: z.string()
+});
+var EnvelopeHeaderSchema = z.object({
+  field: z.enum(["context", "options", "visuals", "answer"]),
+  kind: z.string(),
+  senderRole: z.enum(["agent", "user"]),
+  recipientKeyIds: z.array(z.string()),
+  seq: z.number().int().nonnegative()
+});
+var EnvelopeSchema = z.object({
+  v: z.literal(1),
+  alg: z.literal("x25519-xsalsa20poly1305"),
+  msgId: z.string(),
+  hdr: EnvelopeHeaderSchema,
+  recipients: z.array(EnvelopeRecipientSchema).min(1),
+  nonce: z.string(),
+  ct: z.string()
+});
+var SealedAnswerSchema = z.object({
+  ignored: z.boolean(),
+  envelope: EnvelopeSchema
+});
+var DeviceCredentialSchema = z.object({
+  deviceId: z.string(),
+  kind: z.enum(["phone", "web", "agent"]),
+  x25519Pub: z.string(),
+  ed25519Pub: z.string(),
+  sig: z.string()
+});
+var DeviceRosterSchema = z.object({
+  uikPub: z.string(),
+  devices: z.array(DeviceCredentialSchema)
+});
+var WakeNudgeSchema = z.object({
+  kind: z.enum(["reply", "request", "callback"]),
+  notificationId: z.string().optional(),
+  threadId: z.string()
+});
+var DeviceAgentTokenSchema = z.object({
+  token: z.string(),
+  deviceId: z.string(),
+  agentName: z.string(),
+  /** User-chosen session label; defaults to `<agent> <device>`. */
+  nickname: z.string(),
+  createdAt: z.string().datetime()
+});
+var PairingStatusSchema = z.enum(["pending", "approved", "denied", "expired"]);
+var PairingRevealSchema = z.object({
+  x25519: z.string(),
+  ed25519: z.string(),
+  nonce: z.string()
+});
+var DeviceCodeRequestSchema = z.object({
+  agent: z.union([z.string(), z.object({ name: z.string().optional() })]).optional(),
+  device: z.string().optional(),
+  proto: z.string().optional(),
+  // compiled-in tag, e.g. "paigy-pair-v2|sas=24"
+  commitment: z.string().optional()
+  // agent's Ca
+});
+var DeviceCodeSchema = z.object({
+  device_code: z.string(),
+  user_code: z.string(),
+  verification_uri: z.string().url(),
+  verification_uri_complete: z.string().url(),
+  interval: z.number(),
+  expires_in: z.number()
+});
+var DeviceInfoSchema = z.object({
+  code: z.string(),
+  agent: z.string(),
+  device: z.string().nullable(),
+  status: PairingStatusSchema,
+  proto: z.string().nullable().optional(),
+  agent_commitment: z.string().nullable().optional(),
+  // Ca
+  agent_reveal: PairingRevealSchema.nullable().optional(),
+  // present once the agent reveals
+  agent_credential: DeviceCredentialSchema.nullable().optional(),
+  // the phone's UIK-signed cred over the agent's keys — the agent fetches it here to finalizeE2ee
+  // The phone's reveal + identity key, exposed here so a GATED agent (e2ee_mode='on', token
+  // withheld until e2ee=true) can compute the SAS WITHOUT a token. Public keys — same safety
+  // class as agent_reveal above. Present only once the phone reveals; null otherwise.
+  phone_reveal: PairingRevealSchema.nullable().optional(),
+  uik_pub: z.string().nullable().optional()
+});
+var DeviceTokenRequestSchema = z.object({
+  device_code: z.string(),
+  reveal: PairingRevealSchema.optional()
+  // agent's reveal {x25519, ed25519, nonce}
+});
+var DeviceTokenSchema = z.object({
+  access_token: z.string(),
+  nickname: z.string(),
+  agent: z.string(),
+  device: z.string().nullable(),
+  phone_reveal: PairingRevealSchema.nullable().optional(),
+  // present once the phone reveals
+  uik_pub: z.string().nullable().optional()
+});
+var DeviceCommitRequestSchema = z.object({
+  code: z.string(),
+  commitment: z.string()
+  // Cb
+});
+var DevicePeerCommitSchema = z.object({
+  commitment: z.string().nullable()
+});
+var SupportRequestSchema = z.object({
+  email: z.string().email().max(320),
+  message: z.string().trim().min(1).max(5e3),
+  name: z.string().trim().max(120).optional()
+});
+
+// src/http.ts
+var BACKEND_URL = process.env.PAIGY_BACKEND_URL ?? "https://paigy.ai";
+var NETWORK_MSG = `Can't reach ${BACKEND_URL} \u2014 the connection was blocked or dropped before an HTTP response. If this agent runs in a sandboxed environment with a network allowlist (e.g. Claude Code on the web, CI), ask the user to add the Paigy domain (paigy.ai) to the environment's allowed domains, then retry.`;
+async function reach(url, init) {
+  try {
+    return await fetch(url, init);
+  } catch (e) {
+    throw new Error(`${NETWORK_MSG} (${e?.message ?? String(e)})`);
+  }
+}
+
+// src/device.ts
+import { execFile } from "child_process";
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "fs";
+import { homedir, platform } from "os";
+import { join } from "path";
+
+// ../../packages/crypto/dist/index.js
+var import_tweetnacl = __toESM(require_nacl_fast(), 1);
+var import_tweetnacl2 = __toESM(require_nacl_fast(), 1);
+var import_tweetnacl3 = __toESM(require_nacl_fast(), 1);
+var import_tweetnacl4 = __toESM(require_nacl_fast(), 1);
+var import_tweetnacl5 = __toESM(require_nacl_fast(), 1);
+function utf8ToBytes(s) {
+  const out = [];
+  for (let i = 0; i < s.length; i++) {
+    const c = s.charCodeAt(i);
+    if (c < 128) out.push(c);
+    else if (c < 2048) out.push(192 | c >> 6, 128 | c & 63);
+    else if (c >= 55296 && c <= 56319) {
+      const c2 = s.charCodeAt(i + 1);
+      if (c2 >= 56320 && c2 <= 57343) {
+        i++;
+        const cp = 65536 + ((c & 1023) << 10) + (c2 & 1023);
+        out.push(240 | cp >> 18, 128 | cp >> 12 & 63, 128 | cp >> 6 & 63, 128 | cp & 63);
+      } else out.push(239, 191, 189);
+    } else if (c >= 56320 && c <= 57343) out.push(239, 191, 189);
+    else out.push(224 | c >> 12, 128 | c >> 6 & 63, 128 | c & 63);
+  }
+  return Uint8Array.from(out);
+}
+function bytesToUtf8(b) {
+  let out = "";
+  for (let i = 0; i < b.length; ) {
+    const c = b[i++];
+    if (c < 128) out += String.fromCharCode(c);
+    else if (c < 224) out += String.fromCharCode((c & 31) << 6 | b[i++] & 63);
+    else if (c < 240) out += String.fromCharCode((c & 15) << 12 | (b[i++] & 63) << 6 | b[i++] & 63);
+    else {
+      const cp = (c & 7) << 18 | (b[i++] & 63) << 12 | (b[i++] & 63) << 6 | b[i++] & 63;
+      const u = cp - 65536;
+      out += String.fromCharCode(55296 + (u >> 10), 56320 + (u & 1023));
+    }
+  }
+  return out;
+}
+var B64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+function toB64(bytes) {
+  let out = "";
+  for (let i = 0; i < bytes.length; i += 3) {
+    const b0 = bytes[i];
+    const has1 = i + 1 < bytes.length;
+    const has2 = i + 2 < bytes.length;
+    const b1 = has1 ? bytes[i + 1] : 0;
+    const b2 = has2 ? bytes[i + 2] : 0;
+    out += B64[b0 >> 2] + B64[(b0 & 3) << 4 | b1 >> 4];
+    out += has1 ? B64[(b1 & 15) << 2 | b2 >> 6] : "=";
+    out += has2 ? B64[b2 & 63] : "=";
+  }
+  return out;
+}
+function fromB64Lenient(s) {
+  const clean = s.replace(/[^A-Za-z0-9+/]/g, "");
+  const out = [];
+  for (let i = 0; i < clean.length; i += 4) {
+    const c0 = B64.indexOf(clean[i]);
+    const c1 = B64.indexOf(clean[i + 1] ?? "A");
+    const c2 = clean[i + 2] !== void 0 ? B64.indexOf(clean[i + 2]) : -1;
+    const c3 = clean[i + 3] !== void 0 ? B64.indexOf(clean[i + 3]) : -1;
+    out.push(c0 << 2 | c1 >> 4);
+    if (c2 >= 0) out.push((c1 & 15) << 4 | c2 >> 2);
+    if (c3 >= 0) out.push((c2 & 3) << 6 | c3);
+  }
+  return Uint8Array.from(out);
+}
+function fromB64(s) {
+  const bytes = fromB64Lenient(s);
+  if (toB64(bytes) !== s) throw new Error("non-canonical base64");
+  return bytes;
+}
+function concat(parts) {
+  let n = 0;
+  for (const p of parts) n += p.length;
+  const out = new Uint8Array(n);
+  let o = 0;
+  for (const p of parts) {
+    out.set(p, o);
+    o += p.length;
+  }
+  return out;
+}
+function u16be(n) {
+  return Uint8Array.of(n >>> 8 & 255, n & 255);
+}
+function u32be(n) {
+  return Uint8Array.of(n >>> 24 & 255, n >>> 16 & 255, n >>> 8 & 255, n & 255);
+}
+function readU32be(b, o) {
+  return (b[o] << 24 | b[o + 1] << 16 | b[o + 2] << 8 | b[o + 3]) >>> 0;
+}
+function lp(b) {
+  return concat([u32be(b.length), b]);
+}
+function eqCt(a, b) {
+  if (a.length !== b.length) return false;
+  let d = 0;
+  for (let i = 0; i < a.length; i++) d |= a[i] ^ b[i];
+  return d === 0;
+}
+var ok = false;
+function ensureCsprng() {
+  if (ok) return;
+  let a;
+  let b;
+  try {
+    a = import_tweetnacl.default.randomBytes(32);
+    b = import_tweetnacl.default.randomBytes(32);
+  } catch {
+    throw new Error("paigy-crypto: no secure RNG available \u2014 refusing to generate keys (fail-closed)");
+  }
+  if (a.every((x) => x === 0) || eqCt(a, b)) {
+    throw new Error("paigy-crypto: RNG self-test failed (constant/low-entropy output)");
+  }
+  ok = true;
+}
+function randomBytes(n) {
+  ensureCsprng();
+  return import_tweetnacl.default.randomBytes(n);
+}
+function kp(k) {
+  return { publicKey: toB64(k.publicKey), secretKey: toB64(k.secretKey) };
+}
+function genDeviceKeypair() {
+  ensureCsprng();
+  return { x25519: kp(import_tweetnacl2.default.box.keyPair()), ed25519: kp(import_tweetnacl2.default.sign.keyPair()) };
+}
+function sharedSecret(peerX25519PubB64, mySecretB64) {
+  const raw = import_tweetnacl2.default.scalarMult(fromB64(mySecretB64), fromB64(peerX25519PubB64));
+  if (raw.every((b) => b === 0)) throw new Error("low-order X25519 point \u2014 shared secret rejected");
+  return toB64(raw);
+}
+function keyId(publicKeyB64) {
+  return toB64(import_tweetnacl2.default.hash(fromB64(publicKeyB64)).slice(0, 8));
+}
+function credentialBody(c) {
+  return concat([
+    lp(utf8ToBytes("paigy-device-credential-v1")),
+    lp(utf8ToBytes(c.deviceId)),
+    lp(utf8ToBytes(c.kind)),
+    lp(fromB64(c.x25519Pub)),
+    lp(fromB64(c.ed25519Pub))
+  ]);
+}
+function verifyDeviceCredential(cred, uikPublicB64) {
+  const { sig, ...fields } = cred;
+  try {
+    return import_tweetnacl2.default.sign.detached.verify(credentialBody(fields), fromB64(sig), fromB64(uikPublicB64));
+  } catch {
+    return false;
+  }
+}
+var ENVELOPE_VERSION = 1;
+var ENVELOPE_ALG = "x25519-xsalsa20poly1305";
+function padme(L) {
+  if (L < 2) return L;
+  const E = Math.floor(Math.log2(L));
+  const S = Math.floor(Math.log2(E)) + 1;
+  const lastBits = E - S;
+  if (lastBits <= 0) return L;
+  const mask = (1 << lastBits) - 1;
+  return L + mask & ~mask;
+}
+function canonicalHeader(msgId, hdr) {
+  const parts = [
+    u16be(ENVELOPE_VERSION),
+    lp(utf8ToBytes(ENVELOPE_ALG)),
+    lp(msgId),
+    lp(utf8ToBytes(hdr.field)),
+    lp(utf8ToBytes(hdr.kind)),
+    lp(utf8ToBytes(hdr.senderRole)),
+    u32be(hdr.seq),
+    u32be(hdr.recipientKeyIds.length),
+    ...hdr.recipientKeyIds.map((k) => lp(utf8ToBytes(k)))
+  ];
+  return concat(parts);
+}
+function seal(input) {
+  ensureCsprng();
+  if (input.recipients.length === 0) throw new Error("seal: no recipients");
+  const kind = input.kind ?? "";
+  const recs = input.recipients.map((pub) => ({ pub, id: keyId(pub) })).sort((a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0);
+  const hdr = {
+    field: input.field,
+    kind,
+    senderRole: input.senderRole,
+    recipientKeyIds: recs.map((r) => r.id),
+    seq: input.seq
+  };
+  const msgIdBytes = input.msgId ? fromB64(input.msgId) : randomBytes(16);
+  const cek = randomBytes(32);
+  const canon = canonicalHeader(msgIdBytes, hdr);
+  const plaintext = concat([u32be(canon.length), canon, u32be(input.body.length), input.body]);
+  const padded = new Uint8Array(padme(plaintext.length));
+  padded.set(plaintext);
+  const nonce = randomBytes(24);
+  const ct = import_tweetnacl3.default.secretbox(padded, nonce, cek);
+  const recipients = recs.map((r) => {
+    const eph = import_tweetnacl3.default.box.keyPair();
+    const wnonce = randomBytes(24);
+    const wrap = import_tweetnacl3.default.box(cek, wnonce, fromB64(r.pub), eph.secretKey);
+    return { keyId: r.id, epk: toB64(eph.publicKey), wnonce: toB64(wnonce), wrap: toB64(wrap) };
+  });
+  return {
+    v: ENVELOPE_VERSION,
+    alg: ENVELOPE_ALG,
+    msgId: toB64(msgIdBytes),
+    hdr,
+    recipients,
+    nonce: toB64(nonce),
+    ct: toB64(ct)
+  };
+}
+function open(envelope, myKeyId, mySecretKeyB64) {
+  if (envelope.v !== ENVELOPE_VERSION) throw new Error(`unsupported envelope version ${String(envelope.v)}`);
+  if (envelope.alg !== ENVELOPE_ALG) throw new Error(`unsupported alg ${String(envelope.alg)}`);
+  const rec = envelope.recipients.find((r) => r.keyId === myKeyId);
+  if (!rec) throw new Error("not a recipient of this envelope");
+  const cek = import_tweetnacl3.default.box.open(fromB64(rec.wrap), fromB64(rec.wnonce), fromB64(rec.epk), fromB64(mySecretKeyB64));
+  if (!cek) throw new Error("CEK unwrap failed (wrong key or tampered)");
+  const padded = import_tweetnacl3.default.secretbox.open(fromB64(envelope.ct), fromB64(envelope.nonce), cek);
+  if (!padded) throw new Error("body authentication failed (tampered ciphertext)");
+  if (padded.length < 8) throw new Error("malformed sealed plaintext");
+  const canonLen = readU32be(padded, 0);
+  if (canonLen < 0 || 8 + canonLen > padded.length) throw new Error("malformed sealed plaintext");
+  const sealedCanon = padded.slice(4, 4 + canonLen);
+  const bodyLen = readU32be(padded, 4 + canonLen);
+  const bodyStart = 8 + canonLen;
+  if (bodyStart + bodyLen > padded.length) throw new Error("malformed sealed plaintext");
+  const body = padded.slice(bodyStart, bodyStart + bodyLen);
+  const expected = canonicalHeader(fromB64(envelope.msgId), envelope.hdr);
+  if (!eqCt(sealedCanon, expected)) throw new Error("header mismatch (tampered metadata)");
+  return { header: envelope.hdr, body };
+}
+var SAS_DOMAIN = "paigy-sas-v2";
+function deriveSAS(input, bits = 24) {
+  const bundle = concat([
+    lp(utf8ToBytes(SAS_DOMAIN)),
+    lp(utf8ToBytes(input.proto)),
+    lp(fromB64(input.ss)),
+    lp(fromB64(input.ca)),
+    lp(fromB64(input.cb))
+  ]);
+  const d = import_tweetnacl4.default.hash(bundle);
+  const nbytes = Math.ceil(bits / 8);
+  let n = 0n;
+  for (let i = 0; i < nbytes; i++) n = n << 8n | BigInt(d[i]);
+  n &= (1n << BigInt(bits)) - 1n;
+  const digits = (2n ** BigInt(bits) - 1n).toString().length;
+  return n.toString().padStart(digits, "0").replace(/(\d{3})(?=\d)/g, "$1 ");
+}
+var COMMIT_DOMAIN = "paigy-commit-v1";
+function commit(valuesB64) {
+  return toB64(import_tweetnacl5.default.hash(concat([lp(utf8ToBytes(COMMIT_DOMAIN)), ...valuesB64.map((v) => lp(fromB64(v)))])).slice(0, 32));
+}
+function commitPairing(proto, role, x25519Pub, ed25519Pub, nonce, uikPub) {
+  const vals = [toB64(utf8ToBytes(proto)), toB64(utf8ToBytes(role)), x25519Pub, ed25519Pub, nonce];
+  if (uikPub !== void 0) vals.push(uikPub);
+  return commit(vals);
+}
+function verifyPairingCommit(commitment, proto, role, x25519Pub, ed25519Pub, nonce, uikPub) {
+  try {
+    return eqCt(fromB64(commitment), fromB64(commitPairing(proto, role, x25519Pub, ed25519Pub, nonce, uikPub)));
+  } catch {
+    return false;
+  }
+}
+
+// src/device.ts
+var AGENT_NAME = process.env.PAIGY_AGENT ?? "mcp-agent";
+var PROTO = "paigy-pair-v2|sas=24";
+var SAS_BITS = 24;
+var TOKEN_PATH = join(homedir(), ".paigy", "token.json");
+var KEY_PATH = join(homedir(), ".paigy", "key.json");
+function openBrowser(url) {
+  const cmd = platform() === "darwin" ? "open" : platform() === "win32" ? "cmd" : "xdg-open";
+  const args = platform() === "win32" ? ["/c", "start", url] : [url];
+  execFile(cmd, args, () => {
+  });
+}
+function saveToken(token) {
+  mkdirSync(join(homedir(), ".paigy"), { recursive: true });
+  writeFileSync(TOKEN_PATH, JSON.stringify(token, null, 2) + "\n", { mode: 384 });
+}
+var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+function readToken() {
+  if (process.env.PAIGY_TOKEN) return process.env.PAIGY_TOKEN;
+  if (existsSync(TOKEN_PATH)) {
+    try {
+      return JSON.parse(readFileSync(TOKEN_PATH, "utf8")).access_token ?? "";
+    } catch {
+    }
+  }
+  return "";
+}
+function deleteToken() {
+  if (!existsSync(TOKEN_PATH)) return false;
+  rmSync(TOKEN_PATH);
+  return true;
+}
+async function revokeToken(token) {
+  const res = await reach(`${BACKEND_URL}/api/device/revoke`, {
+    method: "POST",
+    headers: { authorization: `Bearer ${token}` }
+  });
+  return res.ok;
+}
+async function requestCode(agent = AGENT_NAME, e2ee) {
+  const res = await reach(`${BACKEND_URL}/api/device/code`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify(e2ee ? { agent, proto: e2ee.proto, commitment: e2ee.commitment } : { agent })
+  });
+  if (!res.ok) throw new Error(`/api/device/code failed: ${res.status} ${await res.text()}`);
+  return await res.json();
+}
+async function pollToken(deviceCode, reveal) {
+  const res = await reach(`${BACKEND_URL}/api/device/token`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify(reveal ? { device_code: deviceCode, reveal } : { device_code: deviceCode })
+  });
+  if (res.ok) return await res.json();
+  const body = await res.json().catch(() => ({ error: "unknown" }));
+  const err = body.error ?? "unknown";
+  if (err === "authorization_pending") return null;
+  if (err === "commit_required") return null;
+  if (err === "rate_limited") throw new Error("Too many pairing attempts. Wait a moment and retry.");
+  if (err === "expired_token") throw new Error("Device code expired. Start pairing again.");
+  if (err === "access_denied") throw new Error("Access denied by user. Pairing cancelled.");
+  throw new Error(`Unexpected error from /api/device/token: ${err}`);
+}
+function saveKeyFile(kf) {
+  mkdirSync(join(homedir(), ".paigy"), { recursive: true });
+  writeFileSync(KEY_PATH, JSON.stringify(kf, null, 2) + "\n", { mode: 384 });
+}
+function readKeyFile() {
+  if (!existsSync(KEY_PATH)) return null;
+  try {
+    return JSON.parse(readFileSync(KEY_PATH, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function deleteKeyFile() {
+  if (!existsSync(KEY_PATH)) return false;
+  rmSync(KEY_PATH);
+  return true;
+}
+function startE2ee() {
+  const keypair = genDeviceKeypair();
+  const nonce = toB64(randomBytes(32));
+  const ca = commitPairing(PROTO, "A", keypair.x25519.publicKey, keypair.ed25519.publicKey, nonce);
+  const keyFile = { proto: PROTO, keypair, nonce, ca, e2ee: false };
+  saveKeyFile(keyFile);
+  return { keyFile, offer: { proto: PROTO, commitment: ca } };
+}
+async function fetchPeerCommit(deviceCode) {
+  const res = await reach(`${BACKEND_URL}/api/device/peer-commit?device_code=${encodeURIComponent(deviceCode)}`);
+  if (!res.ok) return null;
+  const body = await res.json().catch(() => ({}));
+  return body.commitment ?? null;
+}
+function agentReveal(kf) {
+  return { x25519: kf.keypair.x25519.publicKey, ed25519: kf.keypair.ed25519.publicKey, nonce: kf.nonce };
+}
+function computeSAS(kf, cb, phoneReveal, uikPub) {
+  const opens = verifyPairingCommit(cb, PROTO, "P", phoneReveal.x25519, phoneReveal.ed25519, phoneReveal.nonce, uikPub);
+  if (!opens) throw new Error("phone reveal does not open its commitment \u2014 aborting E2EE");
+  const ss = sharedSecret(phoneReveal.x25519, kf.keypair.x25519.secretKey);
+  return deriveSAS({ proto: PROTO, ss, ca: kf.ca, cb }, SAS_BITS);
+}
+function finalizeE2ee(kf, credential, uikPub) {
+  if (!verifyDeviceCredential(credential, uikPub)) return false;
+  if (credential.x25519Pub !== kf.keypair.x25519.publicKey || credential.ed25519Pub !== kf.keypair.ed25519.publicKey) {
+    return false;
+  }
+  saveKeyFile({ ...kf, e2ee: true, uikPub });
+  return true;
+}
+async function fetchCredential(userCode) {
+  const res = await reach(`${BACKEND_URL}/api/device/info?code=${encodeURIComponent(userCode)}`);
+  if (!res.ok) return null;
+  const body = await res.json().catch(() => ({}));
+  return body.agent_credential ?? null;
+}
+async function fetchPhoneReveal(userCode) {
+  const res = await reach(`${BACKEND_URL}/api/device/info?code=${encodeURIComponent(userCode)}`);
+  if (!res.ok) return null;
+  const body = await res.json().catch(() => ({}));
+  if (!body.phone_reveal || !body.uik_pub) return null;
+  return { phone_reveal: body.phone_reveal, uik_pub: body.uik_pub };
+}
+async function pairStep(deviceCode, keyFile) {
+  if (!keyFile) {
+    const token2 = await pollToken(deviceCode);
+    return token2 ? { kind: "paired", token: token2 } : { kind: "pending" };
+  }
+  const cb = await fetchPeerCommit(deviceCode);
+  if (!cb) {
+    const token2 = await pollToken(deviceCode);
+    return token2 ? { kind: "paired", token: token2 } : { kind: "pending" };
+  }
+  const token = await pollToken(deviceCode, agentReveal(keyFile));
+  if (!token) {
+    const gated = keyFile.userCode ? await fetchPhoneReveal(keyFile.userCode) : null;
+    if (!gated) return { kind: "pending" };
+    try {
+      const sas = computeSAS(keyFile, cb, gated.phone_reveal, gated.uik_pub);
+      return { kind: "awaiting_confirm", sas, uikPub: gated.uik_pub };
+    } catch (e) {
+      return { kind: "e2ee_aborted", warning: e.message };
+    }
+  }
+  if (!token.phone_reveal || !token.uik_pub) return { kind: "paired", token };
+  try {
+    const sas = computeSAS(keyFile, cb, token.phone_reveal, token.uik_pub);
+    return { kind: "paired", token, sas, uikPub: token.uik_pub };
+  } catch (e) {
+    return { kind: "e2ee_aborted", warning: e.message };
+  }
+}
+async function fetchRoster(token) {
+  const res = await reach(`${BACKEND_URL}/api/roster`, { headers: { authorization: `Bearer ${token}` } });
+  if (!res.ok) return null;
+  return await res.json().catch(() => null);
+}
+function verifiedRecipients(roster, pinnedUikPub) {
+  return roster.devices.filter((cred) => verifyDeviceCredential(cred, pinnedUikPub)).map((cred) => cred.x25519Pub);
+}
+function sealFields(content, recipients) {
+  if (recipients.length === 0) throw new Error("sealFields: no verified recipients");
+  const seq = Math.floor(Date.now() / 1e3);
+  const out = {};
+  for (const field of ["context", "options", "visuals"]) {
+    if (content[field] === void 0) continue;
+    out[field] = seal({
+      body: utf8ToBytes(JSON.stringify(content[field])),
+      field,
+      senderRole: "agent",
+      seq,
+      recipients
+    });
+  }
+  return out;
+}
+function openSealedAnswer(sealed, keypair) {
+  const myKeyId = keyId(keypair.x25519.publicKey);
+  const { header, body } = open(sealed.envelope, myKeyId, keypair.x25519.secretKey);
+  if (header.field !== "answer" || header.senderRole !== "user") {
+    throw new Error("sealed answer has the wrong envelope field/role \u2014 refusing (possible replay/misattribution)");
+  }
+  const parsed = UserAnswerSchema.safeParse(JSON.parse(bytesToUtf8(body)));
+  if (!parsed.success) throw new Error("sealed answer body is not a valid UserAnswer");
+  const answer = parsed.data;
+  const bodyIsIgnored = answer.kind === "ignored";
+  if (sealed.ignored !== bodyIsIgnored) {
+    throw new Error("sealed answer tamper: `ignored` hint disagrees with the decrypted body");
+  }
+  return answer;
+}
+
+export {
+  NotifyRequestSchema,
+  deriveAsk,
+  SetTaskStateSchema,
+  ScheduleCallbackSchema,
+  WAKE_EVENT,
+  wakeChannel,
+  BACKEND_URL,
+  reach,
+  AGENT_NAME,
+  TOKEN_PATH,
+  openBrowser,
+  saveToken,
+  sleep,
+  readToken,
+  deleteToken,
+  revokeToken,
+  requestCode,
+  pollToken,
+  saveKeyFile,
+  readKeyFile,
+  deleteKeyFile,
+  startE2ee,
+  finalizeE2ee,
+  fetchCredential,
+  pairStep,
+  fetchRoster,
+  verifiedRecipients,
+  sealFields,
+  openSealedAnswer
+};