@paigy/mcp 0.40.8 → 0.40.9

package/dist/{chunk-BT5S7VT2.js → chunk-5OY6ED2Q.js}

@@ -16,2260 +16,6 @@ import { join } from "path";
 import { randomUUID as randomUUID4 } from "crypto";
 import { WebSocket } from "undici";
 var require2 = __sdkCreateRequire(import.meta.url);
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __require = /* @__PURE__ */ ((x) => typeof require2 !== "undefined" ? require2 : typeof Proxy !== "undefined" ? new Proxy(x, {
-  get: (a, b) => (typeof require2 !== "undefined" ? require2 : a)[b]
-}) : x)(function(x) {
-  if (typeof require2 !== "undefined") return require2.apply(this, arguments);
-  throw Error('Dynamic require of "' + x + '" is not supported');
-});
-var __commonJS = (cb, mod) => function __require2() {
-  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
-var require_nacl_fast = __commonJS({
-  "../../node_modules/.pnpm/tweetnacl@1.0.3/node_modules/tweetnacl/nacl-fast.js"(exports, module) {
-    "use strict";
-    (function(nacl6) {
-      "use strict";
-      var gf = function(init) {
-        var i, r = new Float64Array(16);
-        if (init) for (i = 0; i < init.length; i++) r[i] = init[i];
-        return r;
-      };
-      var randombytes = function() {
-        throw new Error("no PRNG");
-      };
-      var _0 = new Uint8Array(16);
-      var _9 = new Uint8Array(32);
-      _9[0] = 9;
-      var gf0 = gf(), gf1 = gf([1]), _121665 = gf([56129, 1]), D = gf([30883, 4953, 19914, 30187, 55467, 16705, 2637, 112, 59544, 30585, 16505, 36039, 65139, 11119, 27886, 20995]), D2 = gf([61785, 9906, 39828, 60374, 45398, 33411, 5274, 224, 53552, 61171, 33010, 6542, 64743, 22239, 55772, 9222]), X = gf([54554, 36645, 11616, 51542, 42930, 38181, 51040, 26924, 56412, 64982, 57905, 49316, 21502, 52590, 14035, 8553]), Y = gf([26200, 26214, 26214, 26214, 26214, 26214, 26214, 26214, 26214, 26214, 26214, 26214, 26214, 26214, 26214, 26214]), I = gf([41136, 18958, 6951, 50414, 58488, 44335, 6150, 12099, 55207, 15867, 153, 11085, 57099, 20417, 9344, 11139]);
-      function ts64(x, i, h, l) {
-        x[i] = h >> 24 & 255;
-        x[i + 1] = h >> 16 & 255;
-        x[i + 2] = h >> 8 & 255;
-        x[i + 3] = h & 255;
-        x[i + 4] = l >> 24 & 255;
-        x[i + 5] = l >> 16 & 255;
-        x[i + 6] = l >> 8 & 255;
-        x[i + 7] = l & 255;
-      }
-      function vn(x, xi, y, yi, n) {
-        var i, d = 0;
-        for (i = 0; i < n; i++) d |= x[xi + i] ^ y[yi + i];
-        return (1 & d - 1 >>> 8) - 1;
-      }
-      function crypto_verify_16(x, xi, y, yi) {
-        return vn(x, xi, y, yi, 16);
-      }
-      function crypto_verify_32(x, xi, y, yi) {
-        return vn(x, xi, y, yi, 32);
-      }
-      function core_salsa20(o, p, k, c) {
-        var j0 = c[0] & 255 | (c[1] & 255) << 8 | (c[2] & 255) << 16 | (c[3] & 255) << 24, j1 = k[0] & 255 | (k[1] & 255) << 8 | (k[2] & 255) << 16 | (k[3] & 255) << 24, j2 = k[4] & 255 | (k[5] & 255) << 8 | (k[6] & 255) << 16 | (k[7] & 255) << 24, j3 = k[8] & 255 | (k[9] & 255) << 8 | (k[10] & 255) << 16 | (k[11] & 255) << 24, j4 = k[12] & 255 | (k[13] & 255) << 8 | (k[14] & 255) << 16 | (k[15] & 255) << 24, j5 = c[4] & 255 | (c[5] & 255) << 8 | (c[6] & 255) << 16 | (c[7] & 255) << 24, j6 = p[0] & 255 | (p[1] & 255) << 8 | (p[2] & 255) << 16 | (p[3] & 255) << 24, j7 = p[4] & 255 | (p[5] & 255) << 8 | (p[6] & 255) << 16 | (p[7] & 255) << 24, j8 = p[8] & 255 | (p[9] & 255) << 8 | (p[10] & 255) << 16 | (p[11] & 255) << 24, j9 = p[12] & 255 | (p[13] & 255) << 8 | (p[14] & 255) << 16 | (p[15] & 255) << 24, j10 = c[8] & 255 | (c[9] & 255) << 8 | (c[10] & 255) << 16 | (c[11] & 255) << 24, j11 = k[16] & 255 | (k[17] & 255) << 8 | (k[18] & 255) << 16 | (k[19] & 255) << 24, j12 = k[20] & 255 | (k[21] & 255) << 8 | (k[22] & 255) << 16 | (k[23] & 255) << 24, j13 = k[24] & 255 | (k[25] & 255) << 8 | (k[26] & 255) << 16 | (k[27] & 255) << 24, j14 = k[28] & 255 | (k[29] & 255) << 8 | (k[30] & 255) << 16 | (k[31] & 255) << 24, j15 = c[12] & 255 | (c[13] & 255) << 8 | (c[14] & 255) << 16 | (c[15] & 255) << 24;
-        var x0 = j0, x1 = j1, x2 = j2, x3 = j3, x4 = j4, x5 = j5, x6 = j6, x7 = j7, x8 = j8, x9 = j9, x10 = j10, x11 = j11, x12 = j12, x13 = j13, x14 = j14, x15 = j15, u;
-        for (var i = 0; i < 20; i += 2) {
-          u = x0 + x12 | 0;
-          x4 ^= u << 7 | u >>> 32 - 7;
-          u = x4 + x0 | 0;
-          x8 ^= u << 9 | u >>> 32 - 9;
-          u = x8 + x4 | 0;
-          x12 ^= u << 13 | u >>> 32 - 13;
-          u = x12 + x8 | 0;
-          x0 ^= u << 18 | u >>> 32 - 18;
-          u = x5 + x1 | 0;
-          x9 ^= u << 7 | u >>> 32 - 7;
-          u = x9 + x5 | 0;
-          x13 ^= u << 9 | u >>> 32 - 9;
-          u = x13 + x9 | 0;
-          x1 ^= u << 13 | u >>> 32 - 13;
-          u = x1 + x13 | 0;
-          x5 ^= u << 18 | u >>> 32 - 18;
-          u = x10 + x6 | 0;
-          x14 ^= u << 7 | u >>> 32 - 7;
-          u = x14 + x10 | 0;
-          x2 ^= u << 9 | u >>> 32 - 9;
-          u = x2 + x14 | 0;
-          x6 ^= u << 13 | u >>> 32 - 13;
-          u = x6 + x2 | 0;
-          x10 ^= u << 18 | u >>> 32 - 18;
-          u = x15 + x11 | 0;
-          x3 ^= u << 7 | u >>> 32 - 7;
-          u = x3 + x15 | 0;
-          x7 ^= u << 9 | u >>> 32 - 9;
-          u = x7 + x3 | 0;
-          x11 ^= u << 13 | u >>> 32 - 13;
-          u = x11 + x7 | 0;
-          x15 ^= u << 18 | u >>> 32 - 18;
-          u = x0 + x3 | 0;
-          x1 ^= u << 7 | u >>> 32 - 7;
-          u = x1 + x0 | 0;
-          x2 ^= u << 9 | u >>> 32 - 9;
-          u = x2 + x1 | 0;
-          x3 ^= u << 13 | u >>> 32 - 13;
-          u = x3 + x2 | 0;
-          x0 ^= u << 18 | u >>> 32 - 18;
-          u = x5 + x4 | 0;
-          x6 ^= u << 7 | u >>> 32 - 7;
-          u = x6 + x5 | 0;
-          x7 ^= u << 9 | u >>> 32 - 9;
-          u = x7 + x6 | 0;
-          x4 ^= u << 13 | u >>> 32 - 13;
-          u = x4 + x7 | 0;
-          x5 ^= u << 18 | u >>> 32 - 18;
-          u = x10 + x9 | 0;
-          x11 ^= u << 7 | u >>> 32 - 7;
-          u = x11 + x10 | 0;
-          x8 ^= u << 9 | u >>> 32 - 9;
-          u = x8 + x11 | 0;
-          x9 ^= u << 13 | u >>> 32 - 13;
-          u = x9 + x8 | 0;
-          x10 ^= u << 18 | u >>> 32 - 18;
-          u = x15 + x14 | 0;
-          x12 ^= u << 7 | u >>> 32 - 7;
-          u = x12 + x15 | 0;
-          x13 ^= u << 9 | u >>> 32 - 9;
-          u = x13 + x12 | 0;
-          x14 ^= u << 13 | u >>> 32 - 13;
-          u = x14 + x13 | 0;
-          x15 ^= u << 18 | u >>> 32 - 18;
-        }
-        x0 = x0 + j0 | 0;
-        x1 = x1 + j1 | 0;
-        x2 = x2 + j2 | 0;
-        x3 = x3 + j3 | 0;
-        x4 = x4 + j4 | 0;
-        x5 = x5 + j5 | 0;
-        x6 = x6 + j6 | 0;
-        x7 = x7 + j7 | 0;
-        x8 = x8 + j8 | 0;
-        x9 = x9 + j9 | 0;
-        x10 = x10 + j10 | 0;
-        x11 = x11 + j11 | 0;
-        x12 = x12 + j12 | 0;
-        x13 = x13 + j13 | 0;
-        x14 = x14 + j14 | 0;
-        x15 = x15 + j15 | 0;
-        o[0] = x0 >>> 0 & 255;
-        o[1] = x0 >>> 8 & 255;
-        o[2] = x0 >>> 16 & 255;
-        o[3] = x0 >>> 24 & 255;
-        o[4] = x1 >>> 0 & 255;
-        o[5] = x1 >>> 8 & 255;
-        o[6] = x1 >>> 16 & 255;
-        o[7] = x1 >>> 24 & 255;
-        o[8] = x2 >>> 0 & 255;
-        o[9] = x2 >>> 8 & 255;
-        o[10] = x2 >>> 16 & 255;
-        o[11] = x2 >>> 24 & 255;
-        o[12] = x3 >>> 0 & 255;
-        o[13] = x3 >>> 8 & 255;
-        o[14] = x3 >>> 16 & 255;
-        o[15] = x3 >>> 24 & 255;
-        o[16] = x4 >>> 0 & 255;
-        o[17] = x4 >>> 8 & 255;
-        o[18] = x4 >>> 16 & 255;
-        o[19] = x4 >>> 24 & 255;
-        o[20] = x5 >>> 0 & 255;
-        o[21] = x5 >>> 8 & 255;
-        o[22] = x5 >>> 16 & 255;
-        o[23] = x5 >>> 24 & 255;
-        o[24] = x6 >>> 0 & 255;
-        o[25] = x6 >>> 8 & 255;
-        o[26] = x6 >>> 16 & 255;
-        o[27] = x6 >>> 24 & 255;
-        o[28] = x7 >>> 0 & 255;
-        o[29] = x7 >>> 8 & 255;
-        o[30] = x7 >>> 16 & 255;
-        o[31] = x7 >>> 24 & 255;
-        o[32] = x8 >>> 0 & 255;
-        o[33] = x8 >>> 8 & 255;
-        o[34] = x8 >>> 16 & 255;
-        o[35] = x8 >>> 24 & 255;
-        o[36] = x9 >>> 0 & 255;
-        o[37] = x9 >>> 8 & 255;
-        o[38] = x9 >>> 16 & 255;
-        o[39] = x9 >>> 24 & 255;
-        o[40] = x10 >>> 0 & 255;
-        o[41] = x10 >>> 8 & 255;
-        o[42] = x10 >>> 16 & 255;
-        o[43] = x10 >>> 24 & 255;
-        o[44] = x11 >>> 0 & 255;
-        o[45] = x11 >>> 8 & 255;
-        o[46] = x11 >>> 16 & 255;
-        o[47] = x11 >>> 24 & 255;
-        o[48] = x12 >>> 0 & 255;
-        o[49] = x12 >>> 8 & 255;
-        o[50] = x12 >>> 16 & 255;
-        o[51] = x12 >>> 24 & 255;
-        o[52] = x13 >>> 0 & 255;
-        o[53] = x13 >>> 8 & 255;
-        o[54] = x13 >>> 16 & 255;
-        o[55] = x13 >>> 24 & 255;
-        o[56] = x14 >>> 0 & 255;
-        o[57] = x14 >>> 8 & 255;
-        o[58] = x14 >>> 16 & 255;
-        o[59] = x14 >>> 24 & 255;
-        o[60] = x15 >>> 0 & 255;
-        o[61] = x15 >>> 8 & 255;
-        o[62] = x15 >>> 16 & 255;
-        o[63] = x15 >>> 24 & 255;
-      }
-      function core_hsalsa20(o, p, k, c) {
-        var j0 = c[0] & 255 | (c[1] & 255) << 8 | (c[2] & 255) << 16 | (c[3] & 255) << 24, j1 = k[0] & 255 | (k[1] & 255) << 8 | (k[2] & 255) << 16 | (k[3] & 255) << 24, j2 = k[4] & 255 | (k[5] & 255) << 8 | (k[6] & 255) << 16 | (k[7] & 255) << 24, j3 = k[8] & 255 | (k[9] & 255) << 8 | (k[10] & 255) << 16 | (k[11] & 255) << 24, j4 = k[12] & 255 | (k[13] & 255) << 8 | (k[14] & 255) << 16 | (k[15] & 255) << 24, j5 = c[4] & 255 | (c[5] & 255) << 8 | (c[6] & 255) << 16 | (c[7] & 255) << 24, j6 = p[0] & 255 | (p[1] & 255) << 8 | (p[2] & 255) << 16 | (p[3] & 255) << 24, j7 = p[4] & 255 | (p[5] & 255) << 8 | (p[6] & 255) << 16 | (p[7] & 255) << 24, j8 = p[8] & 255 | (p[9] & 255) << 8 | (p[10] & 255) << 16 | (p[11] & 255) << 24, j9 = p[12] & 255 | (p[13] & 255) << 8 | (p[14] & 255) << 16 | (p[15] & 255) << 24, j10 = c[8] & 255 | (c[9] & 255) << 8 | (c[10] & 255) << 16 | (c[11] & 255) << 24, j11 = k[16] & 255 | (k[17] & 255) << 8 | (k[18] & 255) << 16 | (k[19] & 255) << 24, j12 = k[20] & 255 | (k[21] & 255) << 8 | (k[22] & 255) << 16 | (k[23] & 255) << 24, j13 = k[24] & 255 | (k[25] & 255) << 8 | (k[26] & 255) << 16 | (k[27] & 255) << 24, j14 = k[28] & 255 | (k[29] & 255) << 8 | (k[30] & 255) << 16 | (k[31] & 255) << 24, j15 = c[12] & 255 | (c[13] & 255) << 8 | (c[14] & 255) << 16 | (c[15] & 255) << 24;
-        var x0 = j0, x1 = j1, x2 = j2, x3 = j3, x4 = j4, x5 = j5, x6 = j6, x7 = j7, x8 = j8, x9 = j9, x10 = j10, x11 = j11, x12 = j12, x13 = j13, x14 = j14, x15 = j15, u;
-        for (var i = 0; i < 20; i += 2) {
-          u = x0 + x12 | 0;
-          x4 ^= u << 7 | u >>> 32 - 7;
-          u = x4 + x0 | 0;
-          x8 ^= u << 9 | u >>> 32 - 9;
-          u = x8 + x4 | 0;
-          x12 ^= u << 13 | u >>> 32 - 13;
-          u = x12 + x8 | 0;
-          x0 ^= u << 18 | u >>> 32 - 18;
-          u = x5 + x1 | 0;
-          x9 ^= u << 7 | u >>> 32 - 7;
-          u = x9 + x5 | 0;
-          x13 ^= u << 9 | u >>> 32 - 9;
-          u = x13 + x9 | 0;
-          x1 ^= u << 13 | u >>> 32 - 13;
-          u = x1 + x13 | 0;
-          x5 ^= u << 18 | u >>> 32 - 18;
-          u = x10 + x6 | 0;
-          x14 ^= u << 7 | u >>> 32 - 7;
-          u = x14 + x10 | 0;
-          x2 ^= u << 9 | u >>> 32 - 9;
-          u = x2 + x14 | 0;
-          x6 ^= u << 13 | u >>> 32 - 13;
-          u = x6 + x2 | 0;
-          x10 ^= u << 18 | u >>> 32 - 18;
-          u = x15 + x11 | 0;
-          x3 ^= u << 7 | u >>> 32 - 7;
-          u = x3 + x15 | 0;
-          x7 ^= u << 9 | u >>> 32 - 9;
-          u = x7 + x3 | 0;
-          x11 ^= u << 13 | u >>> 32 - 13;
-          u = x11 + x7 | 0;
-          x15 ^= u << 18 | u >>> 32 - 18;
-          u = x0 + x3 | 0;
-          x1 ^= u << 7 | u >>> 32 - 7;
-          u = x1 + x0 | 0;
-          x2 ^= u << 9 | u >>> 32 - 9;
-          u = x2 + x1 | 0;
-          x3 ^= u << 13 | u >>> 32 - 13;
-          u = x3 + x2 | 0;
-          x0 ^= u << 18 | u >>> 32 - 18;
-          u = x5 + x4 | 0;
-          x6 ^= u << 7 | u >>> 32 - 7;
-          u = x6 + x5 | 0;
-          x7 ^= u << 9 | u >>> 32 - 9;
-          u = x7 + x6 | 0;
-          x4 ^= u << 13 | u >>> 32 - 13;
-          u = x4 + x7 | 0;
-          x5 ^= u << 18 | u >>> 32 - 18;
-          u = x10 + x9 | 0;
-          x11 ^= u << 7 | u >>> 32 - 7;
-          u = x11 + x10 | 0;
-          x8 ^= u << 9 | u >>> 32 - 9;
-          u = x8 + x11 | 0;
-          x9 ^= u << 13 | u >>> 32 - 13;
-          u = x9 + x8 | 0;
-          x10 ^= u << 18 | u >>> 32 - 18;
-          u = x15 + x14 | 0;
-          x12 ^= u << 7 | u >>> 32 - 7;
-          u = x12 + x15 | 0;
-          x13 ^= u << 9 | u >>> 32 - 9;
-          u = x13 + x12 | 0;
-          x14 ^= u << 13 | u >>> 32 - 13;
-          u = x14 + x13 | 0;
-          x15 ^= u << 18 | u >>> 32 - 18;
-        }
-        o[0] = x0 >>> 0 & 255;
-        o[1] = x0 >>> 8 & 255;
-        o[2] = x0 >>> 16 & 255;
-        o[3] = x0 >>> 24 & 255;
-        o[4] = x5 >>> 0 & 255;
-        o[5] = x5 >>> 8 & 255;
-        o[6] = x5 >>> 16 & 255;
-        o[7] = x5 >>> 24 & 255;
-        o[8] = x10 >>> 0 & 255;
-        o[9] = x10 >>> 8 & 255;
-        o[10] = x10 >>> 16 & 255;
-        o[11] = x10 >>> 24 & 255;
-        o[12] = x15 >>> 0 & 255;
-        o[13] = x15 >>> 8 & 255;
-        o[14] = x15 >>> 16 & 255;
-        o[15] = x15 >>> 24 & 255;
-        o[16] = x6 >>> 0 & 255;
-        o[17] = x6 >>> 8 & 255;
-        o[18] = x6 >>> 16 & 255;
-        o[19] = x6 >>> 24 & 255;
-        o[20] = x7 >>> 0 & 255;
-        o[21] = x7 >>> 8 & 255;
-        o[22] = x7 >>> 16 & 255;
-        o[23] = x7 >>> 24 & 255;
-        o[24] = x8 >>> 0 & 255;
-        o[25] = x8 >>> 8 & 255;
-        o[26] = x8 >>> 16 & 255;
-        o[27] = x8 >>> 24 & 255;
-        o[28] = x9 >>> 0 & 255;
-        o[29] = x9 >>> 8 & 255;
-        o[30] = x9 >>> 16 & 255;
-        o[31] = x9 >>> 24 & 255;
-      }
-      function crypto_core_salsa20(out, inp, k, c) {
-        core_salsa20(out, inp, k, c);
-      }
-      function crypto_core_hsalsa20(out, inp, k, c) {
-        core_hsalsa20(out, inp, k, c);
-      }
-      var sigma = new Uint8Array([101, 120, 112, 97, 110, 100, 32, 51, 50, 45, 98, 121, 116, 101, 32, 107]);
-      function crypto_stream_salsa20_xor(c, cpos, m, mpos, b, n, k) {
-        var z4 = new Uint8Array(16), x = new Uint8Array(64);
-        var u, i;
-        for (i = 0; i < 16; i++) z4[i] = 0;
-        for (i = 0; i < 8; i++) z4[i] = n[i];
-        while (b >= 64) {
-          crypto_core_salsa20(x, z4, k, sigma);
-          for (i = 0; i < 64; i++) c[cpos + i] = m[mpos + i] ^ x[i];
-          u = 1;
-          for (i = 8; i < 16; i++) {
-            u = u + (z4[i] & 255) | 0;
-            z4[i] = u & 255;
-            u >>>= 8;
-          }
-          b -= 64;
-          cpos += 64;
-          mpos += 64;
-        }
-        if (b > 0) {
-          crypto_core_salsa20(x, z4, k, sigma);
-          for (i = 0; i < b; i++) c[cpos + i] = m[mpos + i] ^ x[i];
-        }
-        return 0;
-      }
-      function crypto_stream_salsa20(c, cpos, b, n, k) {
-        var z4 = new Uint8Array(16), x = new Uint8Array(64);
-        var u, i;
-        for (i = 0; i < 16; i++) z4[i] = 0;
-        for (i = 0; i < 8; i++) z4[i] = n[i];
-        while (b >= 64) {
-          crypto_core_salsa20(x, z4, k, sigma);
-          for (i = 0; i < 64; i++) c[cpos + i] = x[i];
-          u = 1;
-          for (i = 8; i < 16; i++) {
-            u = u + (z4[i] & 255) | 0;
-            z4[i] = u & 255;
-            u >>>= 8;
-          }
-          b -= 64;
-          cpos += 64;
-        }
-        if (b > 0) {
-          crypto_core_salsa20(x, z4, k, sigma);
-          for (i = 0; i < b; i++) c[cpos + i] = x[i];
-        }
-        return 0;
-      }
-      function crypto_stream(c, cpos, d, n, k) {
-        var s = new Uint8Array(32);
-        crypto_core_hsalsa20(s, n, k, sigma);
-        var sn = new Uint8Array(8);
-        for (var i = 0; i < 8; i++) sn[i] = n[i + 16];
-        return crypto_stream_salsa20(c, cpos, d, sn, s);
-      }
-      function crypto_stream_xor(c, cpos, m, mpos, d, n, k) {
-        var s = new Uint8Array(32);
-        crypto_core_hsalsa20(s, n, k, sigma);
-        var sn = new Uint8Array(8);
-        for (var i = 0; i < 8; i++) sn[i] = n[i + 16];
-        return crypto_stream_salsa20_xor(c, cpos, m, mpos, d, sn, s);
-      }
-      var poly1305 = function(key) {
-        this.buffer = new Uint8Array(16);
-        this.r = new Uint16Array(10);
-        this.h = new Uint16Array(10);
-        this.pad = new Uint16Array(8);
-        this.leftover = 0;
-        this.fin = 0;
-        var t0, t1, t2, t3, t4, t5, t6, t7;
-        t0 = key[0] & 255 | (key[1] & 255) << 8;
-        this.r[0] = t0 & 8191;
-        t1 = key[2] & 255 | (key[3] & 255) << 8;
-        this.r[1] = (t0 >>> 13 | t1 << 3) & 8191;
-        t2 = key[4] & 255 | (key[5] & 255) << 8;
-        this.r[2] = (t1 >>> 10 | t2 << 6) & 7939;
-        t3 = key[6] & 255 | (key[7] & 255) << 8;
-        this.r[3] = (t2 >>> 7 | t3 << 9) & 8191;
-        t4 = key[8] & 255 | (key[9] & 255) << 8;
-        this.r[4] = (t3 >>> 4 | t4 << 12) & 255;
-        this.r[5] = t4 >>> 1 & 8190;
-        t5 = key[10] & 255 | (key[11] & 255) << 8;
-        this.r[6] = (t4 >>> 14 | t5 << 2) & 8191;
-        t6 = key[12] & 255 | (key[13] & 255) << 8;
-        this.r[7] = (t5 >>> 11 | t6 << 5) & 8065;
-        t7 = key[14] & 255 | (key[15] & 255) << 8;
-        this.r[8] = (t6 >>> 8 | t7 << 8) & 8191;
-        this.r[9] = t7 >>> 5 & 127;
-        this.pad[0] = key[16] & 255 | (key[17] & 255) << 8;
-        this.pad[1] = key[18] & 255 | (key[19] & 255) << 8;
-        this.pad[2] = key[20] & 255 | (key[21] & 255) << 8;
-        this.pad[3] = key[22] & 255 | (key[23] & 255) << 8;
-        this.pad[4] = key[24] & 255 | (key[25] & 255) << 8;
-        this.pad[5] = key[26] & 255 | (key[27] & 255) << 8;
-        this.pad[6] = key[28] & 255 | (key[29] & 255) << 8;
-        this.pad[7] = key[30] & 255 | (key[31] & 255) << 8;
-      };
-      poly1305.prototype.blocks = function(m, mpos, bytes) {
-        var hibit = this.fin ? 0 : 1 << 11;
-        var t0, t1, t2, t3, t4, t5, t6, t7, c;
-        var d0, d1, d2, d3, d4, d5, d6, d7, d8, d9;
-        var h0 = this.h[0], h1 = this.h[1], h2 = this.h[2], h3 = this.h[3], h4 = this.h[4], h5 = this.h[5], h6 = this.h[6], h7 = this.h[7], h8 = this.h[8], h9 = this.h[9];
-        var r0 = this.r[0], r1 = this.r[1], r2 = this.r[2], r3 = this.r[3], r4 = this.r[4], r5 = this.r[5], r6 = this.r[6], r7 = this.r[7], r8 = this.r[8], r9 = this.r[9];
-        while (bytes >= 16) {
-          t0 = m[mpos + 0] & 255 | (m[mpos + 1] & 255) << 8;
-          h0 += t0 & 8191;
-          t1 = m[mpos + 2] & 255 | (m[mpos + 3] & 255) << 8;
-          h1 += (t0 >>> 13 | t1 << 3) & 8191;
-          t2 = m[mpos + 4] & 255 | (m[mpos + 5] & 255) << 8;
-          h2 += (t1 >>> 10 | t2 << 6) & 8191;
-          t3 = m[mpos + 6] & 255 | (m[mpos + 7] & 255) << 8;
-          h3 += (t2 >>> 7 | t3 << 9) & 8191;
-          t4 = m[mpos + 8] & 255 | (m[mpos + 9] & 255) << 8;
-          h4 += (t3 >>> 4 | t4 << 12) & 8191;
-          h5 += t4 >>> 1 & 8191;
-          t5 = m[mpos + 10] & 255 | (m[mpos + 11] & 255) << 8;
-          h6 += (t4 >>> 14 | t5 << 2) & 8191;
-          t6 = m[mpos + 12] & 255 | (m[mpos + 13] & 255) << 8;
-          h7 += (t5 >>> 11 | t6 << 5) & 8191;
-          t7 = m[mpos + 14] & 255 | (m[mpos + 15] & 255) << 8;
-          h8 += (t6 >>> 8 | t7 << 8) & 8191;
-          h9 += t7 >>> 5 | hibit;
-          c = 0;
-          d0 = c;
-          d0 += h0 * r0;
-          d0 += h1 * (5 * r9);
-          d0 += h2 * (5 * r8);
-          d0 += h3 * (5 * r7);
-          d0 += h4 * (5 * r6);
-          c = d0 >>> 13;
-          d0 &= 8191;
-          d0 += h5 * (5 * r5);
-          d0 += h6 * (5 * r4);
-          d0 += h7 * (5 * r3);
-          d0 += h8 * (5 * r2);
-          d0 += h9 * (5 * r1);
-          c += d0 >>> 13;
-          d0 &= 8191;
-          d1 = c;
-          d1 += h0 * r1;
-          d1 += h1 * r0;
-          d1 += h2 * (5 * r9);
-          d1 += h3 * (5 * r8);
-          d1 += h4 * (5 * r7);
-          c = d1 >>> 13;
-          d1 &= 8191;
-          d1 += h5 * (5 * r6);
-          d1 += h6 * (5 * r5);
-          d1 += h7 * (5 * r4);
-          d1 += h8 * (5 * r3);
-          d1 += h9 * (5 * r2);
-          c += d1 >>> 13;
-          d1 &= 8191;
-          d2 = c;
-          d2 += h0 * r2;
-          d2 += h1 * r1;
-          d2 += h2 * r0;
-          d2 += h3 * (5 * r9);
-          d2 += h4 * (5 * r8);
-          c = d2 >>> 13;
-          d2 &= 8191;
-          d2 += h5 * (5 * r7);
-          d2 += h6 * (5 * r6);
-          d2 += h7 * (5 * r5);
-          d2 += h8 * (5 * r4);
-          d2 += h9 * (5 * r3);
-          c += d2 >>> 13;
-          d2 &= 8191;
-          d3 = c;
-          d3 += h0 * r3;
-          d3 += h1 * r2;
-          d3 += h2 * r1;
-          d3 += h3 * r0;
-          d3 += h4 * (5 * r9);
-          c = d3 >>> 13;
-          d3 &= 8191;
-          d3 += h5 * (5 * r8);
-          d3 += h6 * (5 * r7);
-          d3 += h7 * (5 * r6);
-          d3 += h8 * (5 * r5);
-          d3 += h9 * (5 * r4);
-          c += d3 >>> 13;
-          d3 &= 8191;
-          d4 = c;
-          d4 += h0 * r4;
-          d4 += h1 * r3;
-          d4 += h2 * r2;
-          d4 += h3 * r1;
-          d4 += h4 * r0;
-          c = d4 >>> 13;
-          d4 &= 8191;
-          d4 += h5 * (5 * r9);
-          d4 += h6 * (5 * r8);
-          d4 += h7 * (5 * r7);
-          d4 += h8 * (5 * r6);
-          d4 += h9 * (5 * r5);
-          c += d4 >>> 13;
-          d4 &= 8191;
-          d5 = c;
-          d5 += h0 * r5;
-          d5 += h1 * r4;
-          d5 += h2 * r3;
-          d5 += h3 * r2;
-          d5 += h4 * r1;
-          c = d5 >>> 13;
-          d5 &= 8191;
-          d5 += h5 * r0;
-          d5 += h6 * (5 * r9);
-          d5 += h7 * (5 * r8);
-          d5 += h8 * (5 * r7);
-          d5 += h9 * (5 * r6);
-          c += d5 >>> 13;
-          d5 &= 8191;
-          d6 = c;
-          d6 += h0 * r6;
-          d6 += h1 * r5;
-          d6 += h2 * r4;
-          d6 += h3 * r3;
-          d6 += h4 * r2;
-          c = d6 >>> 13;
-          d6 &= 8191;
-          d6 += h5 * r1;
-          d6 += h6 * r0;
-          d6 += h7 * (5 * r9);
-          d6 += h8 * (5 * r8);
-          d6 += h9 * (5 * r7);
-          c += d6 >>> 13;
-          d6 &= 8191;
-          d7 = c;
-          d7 += h0 * r7;
-          d7 += h1 * r6;
-          d7 += h2 * r5;
-          d7 += h3 * r4;
-          d7 += h4 * r3;
-          c = d7 >>> 13;
-          d7 &= 8191;
-          d7 += h5 * r2;
-          d7 += h6 * r1;
-          d7 += h7 * r0;
-          d7 += h8 * (5 * r9);
-          d7 += h9 * (5 * r8);
-          c += d7 >>> 13;
-          d7 &= 8191;
-          d8 = c;
-          d8 += h0 * r8;
-          d8 += h1 * r7;
-          d8 += h2 * r6;
-          d8 += h3 * r5;
-          d8 += h4 * r4;
-          c = d8 >>> 13;
-          d8 &= 8191;
-          d8 += h5 * r3;
-          d8 += h6 * r2;
-          d8 += h7 * r1;
-          d8 += h8 * r0;
-          d8 += h9 * (5 * r9);
-          c += d8 >>> 13;
-          d8 &= 8191;
-          d9 = c;
-          d9 += h0 * r9;
-          d9 += h1 * r8;
-          d9 += h2 * r7;
-          d9 += h3 * r6;
-          d9 += h4 * r5;
-          c = d9 >>> 13;
-          d9 &= 8191;
-          d9 += h5 * r4;
-          d9 += h6 * r3;
-          d9 += h7 * r2;
-          d9 += h8 * r1;
-          d9 += h9 * r0;
-          c += d9 >>> 13;
-          d9 &= 8191;
-          c = (c << 2) + c | 0;
-          c = c + d0 | 0;
-          d0 = c & 8191;
-          c = c >>> 13;
-          d1 += c;
-          h0 = d0;
-          h1 = d1;
-          h2 = d2;
-          h3 = d3;
-          h4 = d4;
-          h5 = d5;
-          h6 = d6;
-          h7 = d7;
-          h8 = d8;
-          h9 = d9;
-          mpos += 16;
-          bytes -= 16;
-        }
-        this.h[0] = h0;
-        this.h[1] = h1;
-        this.h[2] = h2;
-        this.h[3] = h3;
-        this.h[4] = h4;
-        this.h[5] = h5;
-        this.h[6] = h6;
-        this.h[7] = h7;
-        this.h[8] = h8;
-        this.h[9] = h9;
-      };
-      poly1305.prototype.finish = function(mac, macpos) {
-        var g = new Uint16Array(10);
-        var c, mask, f, i;
-        if (this.leftover) {
-          i = this.leftover;
-          this.buffer[i++] = 1;
-          for (; i < 16; i++) this.buffer[i] = 0;
-          this.fin = 1;
-          this.blocks(this.buffer, 0, 16);
-        }
-        c = this.h[1] >>> 13;
-        this.h[1] &= 8191;
-        for (i = 2; i < 10; i++) {
-          this.h[i] += c;
-          c = this.h[i] >>> 13;
-          this.h[i] &= 8191;
-        }
-        this.h[0] += c * 5;
-        c = this.h[0] >>> 13;
-        this.h[0] &= 8191;
-        this.h[1] += c;
-        c = this.h[1] >>> 13;
-        this.h[1] &= 8191;
-        this.h[2] += c;
-        g[0] = this.h[0] + 5;
-        c = g[0] >>> 13;
-        g[0] &= 8191;
-        for (i = 1; i < 10; i++) {
-          g[i] = this.h[i] + c;
-          c = g[i] >>> 13;
-          g[i] &= 8191;
-        }
-        g[9] -= 1 << 13;
-        mask = (c ^ 1) - 1;
-        for (i = 0; i < 10; i++) g[i] &= mask;
-        mask = ~mask;
-        for (i = 0; i < 10; i++) this.h[i] = this.h[i] & mask | g[i];
-        this.h[0] = (this.h[0] | this.h[1] << 13) & 65535;
-        this.h[1] = (this.h[1] >>> 3 | this.h[2] << 10) & 65535;
-        this.h[2] = (this.h[2] >>> 6 | this.h[3] << 7) & 65535;
-        this.h[3] = (this.h[3] >>> 9 | this.h[4] << 4) & 65535;
-        this.h[4] = (this.h[4] >>> 12 | this.h[5] << 1 | this.h[6] << 14) & 65535;
-        this.h[5] = (this.h[6] >>> 2 | this.h[7] << 11) & 65535;
-        this.h[6] = (this.h[7] >>> 5 | this.h[8] << 8) & 65535;
-        this.h[7] = (this.h[8] >>> 8 | this.h[9] << 5) & 65535;
-        f = this.h[0] + this.pad[0];
-        this.h[0] = f & 65535;
-        for (i = 1; i < 8; i++) {
-          f = (this.h[i] + this.pad[i] | 0) + (f >>> 16) | 0;
-          this.h[i] = f & 65535;
-        }
-        mac[macpos + 0] = this.h[0] >>> 0 & 255;
-        mac[macpos + 1] = this.h[0] >>> 8 & 255;
-        mac[macpos + 2] = this.h[1] >>> 0 & 255;
-        mac[macpos + 3] = this.h[1] >>> 8 & 255;
-        mac[macpos + 4] = this.h[2] >>> 0 & 255;
-        mac[macpos + 5] = this.h[2] >>> 8 & 255;
-        mac[macpos + 6] = this.h[3] >>> 0 & 255;
-        mac[macpos + 7] = this.h[3] >>> 8 & 255;
-        mac[macpos + 8] = this.h[4] >>> 0 & 255;
-        mac[macpos + 9] = this.h[4] >>> 8 & 255;
-        mac[macpos + 10] = this.h[5] >>> 0 & 255;
-        mac[macpos + 11] = this.h[5] >>> 8 & 255;
-        mac[macpos + 12] = this.h[6] >>> 0 & 255;
-        mac[macpos + 13] = this.h[6] >>> 8 & 255;
-        mac[macpos + 14] = this.h[7] >>> 0 & 255;
-        mac[macpos + 15] = this.h[7] >>> 8 & 255;
-      };
-      poly1305.prototype.update = function(m, mpos, bytes) {
-        var i, want;
-        if (this.leftover) {
-          want = 16 - this.leftover;
-          if (want > bytes)
-            want = bytes;
-          for (i = 0; i < want; i++)
-            this.buffer[this.leftover + i] = m[mpos + i];
-          bytes -= want;
-          mpos += want;
-          this.leftover += want;
-          if (this.leftover < 16)
-            return;
-          this.blocks(this.buffer, 0, 16);
-          this.leftover = 0;
-        }
-        if (bytes >= 16) {
-          want = bytes - bytes % 16;
-          this.blocks(m, mpos, want);
-          mpos += want;
-          bytes -= want;
-        }
-        if (bytes) {
-          for (i = 0; i < bytes; i++)
-            this.buffer[this.leftover + i] = m[mpos + i];
-          this.leftover += bytes;
-        }
-      };
-      function crypto_onetimeauth(out, outpos, m, mpos, n, k) {
-        var s = new poly1305(k);
-        s.update(m, mpos, n);
-        s.finish(out, outpos);
-        return 0;
-      }
-      function crypto_onetimeauth_verify(h, hpos, m, mpos, n, k) {
-        var x = new Uint8Array(16);
-        crypto_onetimeauth(x, 0, m, mpos, n, k);
-        return crypto_verify_16(h, hpos, x, 0);
-      }
-      function crypto_secretbox(c, m, d, n, k) {
-        var i;
-        if (d < 32) return -1;
-        crypto_stream_xor(c, 0, m, 0, d, n, k);
-        crypto_onetimeauth(c, 16, c, 32, d - 32, c);
-        for (i = 0; i < 16; i++) c[i] = 0;
-        return 0;
-      }
-      function crypto_secretbox_open(m, c, d, n, k) {
-        var i;
-        var x = new Uint8Array(32);
-        if (d < 32) return -1;
-        crypto_stream(x, 0, 32, n, k);
-        if (crypto_onetimeauth_verify(c, 16, c, 32, d - 32, x) !== 0) return -1;
-        crypto_stream_xor(m, 0, c, 0, d, n, k);
-        for (i = 0; i < 32; i++) m[i] = 0;
-        return 0;
-      }
-      function set25519(r, a) {
-        var i;
-        for (i = 0; i < 16; i++) r[i] = a[i] | 0;
-      }
-      function car25519(o) {
-        var i, v, c = 1;
-        for (i = 0; i < 16; i++) {
-          v = o[i] + c + 65535;
-          c = Math.floor(v / 65536);
-          o[i] = v - c * 65536;
-        }
-        o[0] += c - 1 + 37 * (c - 1);
-      }
-      function sel25519(p, q, b) {
-        var t, c = ~(b - 1);
-        for (var i = 0; i < 16; i++) {
-          t = c & (p[i] ^ q[i]);
-          p[i] ^= t;
-          q[i] ^= t;
-        }
-      }
-      function pack25519(o, n) {
-        var i, j, b;
-        var m = gf(), t = gf();
-        for (i = 0; i < 16; i++) t[i] = n[i];
-        car25519(t);
-        car25519(t);
-        car25519(t);
-        for (j = 0; j < 2; j++) {
-          m[0] = t[0] - 65517;
-          for (i = 1; i < 15; i++) {
-            m[i] = t[i] - 65535 - (m[i - 1] >> 16 & 1);
-            m[i - 1] &= 65535;
-          }
-          m[15] = t[15] - 32767 - (m[14] >> 16 & 1);
-          b = m[15] >> 16 & 1;
-          m[14] &= 65535;
-          sel25519(t, m, 1 - b);
-        }
-        for (i = 0; i < 16; i++) {
-          o[2 * i] = t[i] & 255;
-          o[2 * i + 1] = t[i] >> 8;
-        }
-      }
-      function neq25519(a, b) {
-        var c = new Uint8Array(32), d = new Uint8Array(32);
-        pack25519(c, a);
-        pack25519(d, b);
-        return crypto_verify_32(c, 0, d, 0);
-      }
-      function par25519(a) {
-        var d = new Uint8Array(32);
-        pack25519(d, a);
-        return d[0] & 1;
-      }
-      function unpack25519(o, n) {
-        var i;
-        for (i = 0; i < 16; i++) o[i] = n[2 * i] + (n[2 * i + 1] << 8);
-        o[15] &= 32767;
-      }
-      function A(o, a, b) {
-        for (var i = 0; i < 16; i++) o[i] = a[i] + b[i];
-      }
-      function Z(o, a, b) {
-        for (var i = 0; i < 16; i++) o[i] = a[i] - b[i];
-      }
-      function M(o, a, b) {
-        var v, c, t0 = 0, t1 = 0, t2 = 0, t3 = 0, t4 = 0, t5 = 0, t6 = 0, t7 = 0, t8 = 0, t9 = 0, t10 = 0, t11 = 0, t12 = 0, t13 = 0, t14 = 0, t15 = 0, t16 = 0, t17 = 0, t18 = 0, t19 = 0, t20 = 0, t21 = 0, t22 = 0, t23 = 0, t24 = 0, t25 = 0, t26 = 0, t27 = 0, t28 = 0, t29 = 0, t30 = 0, b0 = b[0], b1 = b[1], b2 = b[2], b3 = b[3], b4 = b[4], b5 = b[5], b6 = b[6], b7 = b[7], b8 = b[8], b9 = b[9], b10 = b[10], b11 = b[11], b12 = b[12], b13 = b[13], b14 = b[14], b15 = b[15];
-        v = a[0];
-        t0 += v * b0;
-        t1 += v * b1;
-        t2 += v * b2;
-        t3 += v * b3;
-        t4 += v * b4;
-        t5 += v * b5;
-        t6 += v * b6;
-        t7 += v * b7;
-        t8 += v * b8;
-        t9 += v * b9;
-        t10 += v * b10;
-        t11 += v * b11;
-        t12 += v * b12;
-        t13 += v * b13;
-        t14 += v * b14;
-        t15 += v * b15;
-        v = a[1];
-        t1 += v * b0;
-        t2 += v * b1;
-        t3 += v * b2;
-        t4 += v * b3;
-        t5 += v * b4;
-        t6 += v * b5;
-        t7 += v * b6;
-        t8 += v * b7;
-        t9 += v * b8;
-        t10 += v * b9;
-        t11 += v * b10;
-        t12 += v * b11;
-        t13 += v * b12;
-        t14 += v * b13;
-        t15 += v * b14;
-        t16 += v * b15;
-        v = a[2];
-        t2 += v * b0;
-        t3 += v * b1;
-        t4 += v * b2;
-        t5 += v * b3;
-        t6 += v * b4;
-        t7 += v * b5;
-        t8 += v * b6;
-        t9 += v * b7;
-        t10 += v * b8;
-        t11 += v * b9;
-        t12 += v * b10;
-        t13 += v * b11;
-        t14 += v * b12;
-        t15 += v * b13;
-        t16 += v * b14;
-        t17 += v * b15;
-        v = a[3];
-        t3 += v * b0;
-        t4 += v * b1;
-        t5 += v * b2;
-        t6 += v * b3;
-        t7 += v * b4;
-        t8 += v * b5;
-        t9 += v * b6;
-        t10 += v * b7;
-        t11 += v * b8;
-        t12 += v * b9;
-        t13 += v * b10;
-        t14 += v * b11;
-        t15 += v * b12;
-        t16 += v * b13;
-        t17 += v * b14;
-        t18 += v * b15;
-        v = a[4];
-        t4 += v * b0;
-        t5 += v * b1;
-        t6 += v * b2;
-        t7 += v * b3;
-        t8 += v * b4;
-        t9 += v * b5;
-        t10 += v * b6;
-        t11 += v * b7;
-        t12 += v * b8;
-        t13 += v * b9;
-        t14 += v * b10;
-        t15 += v * b11;
-        t16 += v * b12;
-        t17 += v * b13;
-        t18 += v * b14;
-        t19 += v * b15;
-        v = a[5];
-        t5 += v * b0;
-        t6 += v * b1;
-        t7 += v * b2;
-        t8 += v * b3;
-        t9 += v * b4;
-        t10 += v * b5;
-        t11 += v * b6;
-        t12 += v * b7;
-        t13 += v * b8;
-        t14 += v * b9;
-        t15 += v * b10;
-        t16 += v * b11;
-        t17 += v * b12;
-        t18 += v * b13;
-        t19 += v * b14;
-        t20 += v * b15;
-        v = a[6];
-        t6 += v * b0;
-        t7 += v * b1;
-        t8 += v * b2;
-        t9 += v * b3;
-        t10 += v * b4;
-        t11 += v * b5;
-        t12 += v * b6;
-        t13 += v * b7;
-        t14 += v * b8;
-        t15 += v * b9;
-        t16 += v * b10;
-        t17 += v * b11;
-        t18 += v * b12;
-        t19 += v * b13;
-        t20 += v * b14;
-        t21 += v * b15;
-        v = a[7];
-        t7 += v * b0;
-        t8 += v * b1;
-        t9 += v * b2;
-        t10 += v * b3;
-        t11 += v * b4;
-        t12 += v * b5;
-        t13 += v * b6;
-        t14 += v * b7;
-        t15 += v * b8;
-        t16 += v * b9;
-        t17 += v * b10;
-        t18 += v * b11;
-        t19 += v * b12;
-        t20 += v * b13;
-        t21 += v * b14;
-        t22 += v * b15;
-        v = a[8];
-        t8 += v * b0;
-        t9 += v * b1;
-        t10 += v * b2;
-        t11 += v * b3;
-        t12 += v * b4;
-        t13 += v * b5;
-        t14 += v * b6;
-        t15 += v * b7;
-        t16 += v * b8;
-        t17 += v * b9;
-        t18 += v * b10;
-        t19 += v * b11;
-        t20 += v * b12;
-        t21 += v * b13;
-        t22 += v * b14;
-        t23 += v * b15;
-        v = a[9];
-        t9 += v * b0;
-        t10 += v * b1;
-        t11 += v * b2;
-        t12 += v * b3;
-        t13 += v * b4;
-        t14 += v * b5;
-        t15 += v * b6;
-        t16 += v * b7;
-        t17 += v * b8;
-        t18 += v * b9;
-        t19 += v * b10;
-        t20 += v * b11;
-        t21 += v * b12;
-        t22 += v * b13;
-        t23 += v * b14;
-        t24 += v * b15;
-        v = a[10];
-        t10 += v * b0;
-        t11 += v * b1;
-        t12 += v * b2;
-        t13 += v * b3;
-        t14 += v * b4;
-        t15 += v * b5;
-        t16 += v * b6;
-        t17 += v * b7;
-        t18 += v * b8;
-        t19 += v * b9;
-        t20 += v * b10;
-        t21 += v * b11;
-        t22 += v * b12;
-        t23 += v * b13;
-        t24 += v * b14;
-        t25 += v * b15;
-        v = a[11];
-        t11 += v * b0;
-        t12 += v * b1;
-        t13 += v * b2;
-        t14 += v * b3;
-        t15 += v * b4;
-        t16 += v * b5;
-        t17 += v * b6;
-        t18 += v * b7;
-        t19 += v * b8;
-        t20 += v * b9;
-        t21 += v * b10;
-        t22 += v * b11;
-        t23 += v * b12;
-        t24 += v * b13;
-        t25 += v * b14;
-        t26 += v * b15;
-        v = a[12];
-        t12 += v * b0;
-        t13 += v * b1;
-        t14 += v * b2;
-        t15 += v * b3;
-        t16 += v * b4;
-        t17 += v * b5;
-        t18 += v * b6;
-        t19 += v * b7;
-        t20 += v * b8;
-        t21 += v * b9;
-        t22 += v * b10;
-        t23 += v * b11;
-        t24 += v * b12;
-        t25 += v * b13;
-        t26 += v * b14;
-        t27 += v * b15;
-        v = a[13];
-        t13 += v * b0;
-        t14 += v * b1;
-        t15 += v * b2;
-        t16 += v * b3;
-        t17 += v * b4;
-        t18 += v * b5;
-        t19 += v * b6;
-        t20 += v * b7;
-        t21 += v * b8;
-        t22 += v * b9;
-        t23 += v * b10;
-        t24 += v * b11;
-        t25 += v * b12;
-        t26 += v * b13;
-        t27 += v * b14;
-        t28 += v * b15;
-        v = a[14];
-        t14 += v * b0;
-        t15 += v * b1;
-        t16 += v * b2;
-        t17 += v * b3;
-        t18 += v * b4;
-        t19 += v * b5;
-        t20 += v * b6;
-        t21 += v * b7;
-        t22 += v * b8;
-        t23 += v * b9;
-        t24 += v * b10;
-        t25 += v * b11;
-        t26 += v * b12;
-        t27 += v * b13;
-        t28 += v * b14;
-        t29 += v * b15;
-        v = a[15];
-        t15 += v * b0;
-        t16 += v * b1;
-        t17 += v * b2;
-        t18 += v * b3;
-        t19 += v * b4;
-        t20 += v * b5;
-        t21 += v * b6;
-        t22 += v * b7;
-        t23 += v * b8;
-        t24 += v * b9;
-        t25 += v * b10;
-        t26 += v * b11;
-        t27 += v * b12;
-        t28 += v * b13;
-        t29 += v * b14;
-        t30 += v * b15;
-        t0 += 38 * t16;
-        t1 += 38 * t17;
-        t2 += 38 * t18;
-        t3 += 38 * t19;
-        t4 += 38 * t20;
-        t5 += 38 * t21;
-        t6 += 38 * t22;
-        t7 += 38 * t23;
-        t8 += 38 * t24;
-        t9 += 38 * t25;
-        t10 += 38 * t26;
-        t11 += 38 * t27;
-        t12 += 38 * t28;
-        t13 += 38 * t29;
-        t14 += 38 * t30;
-        c = 1;
-        v = t0 + c + 65535;
-        c = Math.floor(v / 65536);
-        t0 = v - c * 65536;
-        v = t1 + c + 65535;
-        c = Math.floor(v / 65536);
-        t1 = v - c * 65536;
-        v = t2 + c + 65535;
-        c = Math.floor(v / 65536);
-        t2 = v - c * 65536;
-        v = t3 + c + 65535;
-        c = Math.floor(v / 65536);
-        t3 = v - c * 65536;
-        v = t4 + c + 65535;
-        c = Math.floor(v / 65536);
-        t4 = v - c * 65536;
-        v = t5 + c + 65535;
-        c = Math.floor(v / 65536);
-        t5 = v - c * 65536;
-        v = t6 + c + 65535;
-        c = Math.floor(v / 65536);
-        t6 = v - c * 65536;
-        v = t7 + c + 65535;
-        c = Math.floor(v / 65536);
-        t7 = v - c * 65536;
-        v = t8 + c + 65535;
-        c = Math.floor(v / 65536);
-        t8 = v - c * 65536;
-        v = t9 + c + 65535;
-        c = Math.floor(v / 65536);
-        t9 = v - c * 65536;
-        v = t10 + c + 65535;
-        c = Math.floor(v / 65536);
-        t10 = v - c * 65536;
-        v = t11 + c + 65535;
-        c = Math.floor(v / 65536);
-        t11 = v - c * 65536;
-        v = t12 + c + 65535;
-        c = Math.floor(v / 65536);
-        t12 = v - c * 65536;
-        v = t13 + c + 65535;
-        c = Math.floor(v / 65536);
-        t13 = v - c * 65536;
-        v = t14 + c + 65535;
-        c = Math.floor(v / 65536);
-        t14 = v - c * 65536;
-        v = t15 + c + 65535;
-        c = Math.floor(v / 65536);
-        t15 = v - c * 65536;
-        t0 += c - 1 + 37 * (c - 1);
-        c = 1;
-        v = t0 + c + 65535;
-        c = Math.floor(v / 65536);
-        t0 = v - c * 65536;
-        v = t1 + c + 65535;
-        c = Math.floor(v / 65536);
-        t1 = v - c * 65536;
-        v = t2 + c + 65535;
-        c = Math.floor(v / 65536);
-        t2 = v - c * 65536;
-        v = t3 + c + 65535;
-        c = Math.floor(v / 65536);
-        t3 = v - c * 65536;
-        v = t4 + c + 65535;
-        c = Math.floor(v / 65536);
-        t4 = v - c * 65536;
-        v = t5 + c + 65535;
-        c = Math.floor(v / 65536);
-        t5 = v - c * 65536;
-        v = t6 + c + 65535;
-        c = Math.floor(v / 65536);
-        t6 = v - c * 65536;
-        v = t7 + c + 65535;
-        c = Math.floor(v / 65536);
-        t7 = v - c * 65536;
-        v = t8 + c + 65535;
-        c = Math.floor(v / 65536);
-        t8 = v - c * 65536;
-        v = t9 + c + 65535;
-        c = Math.floor(v / 65536);
-        t9 = v - c * 65536;
-        v = t10 + c + 65535;
-        c = Math.floor(v / 65536);
-        t10 = v - c * 65536;
-        v = t11 + c + 65535;
-        c = Math.floor(v / 65536);
-        t11 = v - c * 65536;
-        v = t12 + c + 65535;
-        c = Math.floor(v / 65536);
-        t12 = v - c * 65536;
-        v = t13 + c + 65535;
-        c = Math.floor(v / 65536);
-        t13 = v - c * 65536;
-        v = t14 + c + 65535;
-        c = Math.floor(v / 65536);
-        t14 = v - c * 65536;
-        v = t15 + c + 65535;
-        c = Math.floor(v / 65536);
-        t15 = v - c * 65536;
-        t0 += c - 1 + 37 * (c - 1);
-        o[0] = t0;
-        o[1] = t1;
-        o[2] = t2;
-        o[3] = t3;
-        o[4] = t4;
-        o[5] = t5;
-        o[6] = t6;
-        o[7] = t7;
-        o[8] = t8;
-        o[9] = t9;
-        o[10] = t10;
-        o[11] = t11;
-        o[12] = t12;
-        o[13] = t13;
-        o[14] = t14;
-        o[15] = t15;
-      }
-      function S(o, a) {
-        M(o, a, a);
-      }
-      function inv25519(o, i) {
-        var c = gf();
-        var a;
-        for (a = 0; a < 16; a++) c[a] = i[a];
-        for (a = 253; a >= 0; a--) {
-          S(c, c);
-          if (a !== 2 && a !== 4) M(c, c, i);
-        }
-        for (a = 0; a < 16; a++) o[a] = c[a];
-      }
-      function pow2523(o, i) {
-        var c = gf();
-        var a;
-        for (a = 0; a < 16; a++) c[a] = i[a];
-        for (a = 250; a >= 0; a--) {
-          S(c, c);
-          if (a !== 1) M(c, c, i);
-        }
-        for (a = 0; a < 16; a++) o[a] = c[a];
-      }
-      function crypto_scalarmult(q, n, p) {
-        var z4 = new Uint8Array(32);
-        var x = new Float64Array(80), r, i;
-        var a = gf(), b = gf(), c = gf(), d = gf(), e = gf(), f = gf();
-        for (i = 0; i < 31; i++) z4[i] = n[i];
-        z4[31] = n[31] & 127 | 64;
-        z4[0] &= 248;
-        unpack25519(x, p);
-        for (i = 0; i < 16; i++) {
-          b[i] = x[i];
-          d[i] = a[i] = c[i] = 0;
-        }
-        a[0] = d[0] = 1;
-        for (i = 254; i >= 0; --i) {
-          r = z4[i >>> 3] >>> (i & 7) & 1;
-          sel25519(a, b, r);
-          sel25519(c, d, r);
-          A(e, a, c);
-          Z(a, a, c);
-          A(c, b, d);
-          Z(b, b, d);
-          S(d, e);
-          S(f, a);
-          M(a, c, a);
-          M(c, b, e);
-          A(e, a, c);
-          Z(a, a, c);
-          S(b, a);
-          Z(c, d, f);
-          M(a, c, _121665);
-          A(a, a, d);
-          M(c, c, a);
-          M(a, d, f);
-          M(d, b, x);
-          S(b, e);
-          sel25519(a, b, r);
-          sel25519(c, d, r);
-        }
-        for (i = 0; i < 16; i++) {
-          x[i + 16] = a[i];
-          x[i + 32] = c[i];
-          x[i + 48] = b[i];
-          x[i + 64] = d[i];
-        }
-        var x32 = x.subarray(32);
-        var x16 = x.subarray(16);
-        inv25519(x32, x32);
-        M(x16, x16, x32);
-        pack25519(q, x16);
-        return 0;
-      }
-      function crypto_scalarmult_base(q, n) {
-        return crypto_scalarmult(q, n, _9);
-      }
-      function crypto_box_keypair(y, x) {
-        randombytes(x, 32);
-        return crypto_scalarmult_base(y, x);
-      }
-      function crypto_box_beforenm(k, y, x) {
-        var s = new Uint8Array(32);
-        crypto_scalarmult(s, x, y);
-        return crypto_core_hsalsa20(k, _0, s, sigma);
-      }
-      var crypto_box_afternm = crypto_secretbox;
-      var crypto_box_open_afternm = crypto_secretbox_open;
-      function crypto_box(c, m, d, n, y, x) {
-        var k = new Uint8Array(32);
-        crypto_box_beforenm(k, y, x);
-        return crypto_box_afternm(c, m, d, n, k);
-      }
-      function crypto_box_open(m, c, d, n, y, x) {
-        var k = new Uint8Array(32);
-        crypto_box_beforenm(k, y, x);
-        return crypto_box_open_afternm(m, c, d, n, k);
-      }
-      var K = [
-        1116352408,
-        3609767458,
-        1899447441,
-        602891725,
-        3049323471,
-        3964484399,
-        3921009573,
-        2173295548,
-        961987163,
-        4081628472,
-        1508970993,
-        3053834265,
-        2453635748,
-        2937671579,
-        2870763221,
-        3664609560,
-        3624381080,
-        2734883394,
-        310598401,
-        1164996542,
-        607225278,
-        1323610764,
-        1426881987,
-        3590304994,
-        1925078388,
-        4068182383,
-        2162078206,
-        991336113,
-        2614888103,
-        633803317,
-        3248222580,
-        3479774868,
-        3835390401,
-        2666613458,
-        4022224774,
-        944711139,
-        264347078,
-        2341262773,
-        604807628,
-        2007800933,
-        770255983,
-        1495990901,
-        1249150122,
-        1856431235,
-        1555081692,
-        3175218132,
-        1996064986,
-        2198950837,
-        2554220882,
-        3999719339,
-        2821834349,
-        766784016,
-        2952996808,
-        2566594879,
-        3210313671,
-        3203337956,
-        3336571891,
-        1034457026,
-        3584528711,
-        2466948901,
-        113926993,
-        3758326383,
-        338241895,
-        168717936,
-        666307205,
-        1188179964,
-        773529912,
-        1546045734,
-        1294757372,
-        1522805485,
-        1396182291,
-        2643833823,
-        1695183700,
-        2343527390,
-        1986661051,
-        1014477480,
-        2177026350,
-        1206759142,
-        2456956037,
-        344077627,
-        2730485921,
-        1290863460,
-        2820302411,
-        3158454273,
-        3259730800,
-        3505952657,
-        3345764771,
-        106217008,
-        3516065817,
-        3606008344,
-        3600352804,
-        1432725776,
-        4094571909,
-        1467031594,
-        275423344,
-        851169720,
-        430227734,
-        3100823752,
-        506948616,
-        1363258195,
-        659060556,
-        3750685593,
-        883997877,
-        3785050280,
-        958139571,
-        3318307427,
-        1322822218,
-        3812723403,
-        1537002063,
-        2003034995,
-        1747873779,
-        3602036899,
-        1955562222,
-        1575990012,
-        2024104815,
-        1125592928,
-        2227730452,
-        2716904306,
-        2361852424,
-        442776044,
-        2428436474,
-        593698344,
-        2756734187,
-        3733110249,
-        3204031479,
-        2999351573,
-        3329325298,
-        3815920427,
-        3391569614,
-        3928383900,
-        3515267271,
-        566280711,
-        3940187606,
-        3454069534,
-        4118630271,
-        4000239992,
-        116418474,
-        1914138554,
-        174292421,
-        2731055270,
-        289380356,
-        3203993006,
-        460393269,
-        320620315,
-        685471733,
-        587496836,
-        852142971,
-        1086792851,
-        1017036298,
-        365543100,
-        1126000580,
-        2618297676,
-        1288033470,
-        3409855158,
-        1501505948,
-        4234509866,
-        1607167915,
-        987167468,
-        1816402316,
-        1246189591
-      ];
-      function crypto_hashblocks_hl(hh, hl, m, n) {
-        var wh = new Int32Array(16), wl = new Int32Array(16), bh0, bh1, bh2, bh3, bh4, bh5, bh6, bh7, bl0, bl1, bl2, bl3, bl4, bl5, bl6, bl7, th, tl, i, j, h, l, a, b, c, d;
-        var ah0 = hh[0], ah1 = hh[1], ah2 = hh[2], ah3 = hh[3], ah4 = hh[4], ah5 = hh[5], ah6 = hh[6], ah7 = hh[7], al0 = hl[0], al1 = hl[1], al2 = hl[2], al3 = hl[3], al4 = hl[4], al5 = hl[5], al6 = hl[6], al7 = hl[7];
-        var pos = 0;
-        while (n >= 128) {
-          for (i = 0; i < 16; i++) {
-            j = 8 * i + pos;
-            wh[i] = m[j + 0] << 24 | m[j + 1] << 16 | m[j + 2] << 8 | m[j + 3];
-            wl[i] = m[j + 4] << 24 | m[j + 5] << 16 | m[j + 6] << 8 | m[j + 7];
-          }
-          for (i = 0; i < 80; i++) {
-            bh0 = ah0;
-            bh1 = ah1;
-            bh2 = ah2;
-            bh3 = ah3;
-            bh4 = ah4;
-            bh5 = ah5;
-            bh6 = ah6;
-            bh7 = ah7;
-            bl0 = al0;
-            bl1 = al1;
-            bl2 = al2;
-            bl3 = al3;
-            bl4 = al4;
-            bl5 = al5;
-            bl6 = al6;
-            bl7 = al7;
-            h = ah7;
-            l = al7;
-            a = l & 65535;
-            b = l >>> 16;
-            c = h & 65535;
-            d = h >>> 16;
-            h = (ah4 >>> 14 | al4 << 32 - 14) ^ (ah4 >>> 18 | al4 << 32 - 18) ^ (al4 >>> 41 - 32 | ah4 << 32 - (41 - 32));
-            l = (al4 >>> 14 | ah4 << 32 - 14) ^ (al4 >>> 18 | ah4 << 32 - 18) ^ (ah4 >>> 41 - 32 | al4 << 32 - (41 - 32));
-            a += l & 65535;
-            b += l >>> 16;
-            c += h & 65535;
-            d += h >>> 16;
-            h = ah4 & ah5 ^ ~ah4 & ah6;
-            l = al4 & al5 ^ ~al4 & al6;
-            a += l & 65535;
-            b += l >>> 16;
-            c += h & 65535;
-            d += h >>> 16;
-            h = K[i * 2];
-            l = K[i * 2 + 1];
-            a += l & 65535;
-            b += l >>> 16;
-            c += h & 65535;
-            d += h >>> 16;
-            h = wh[i % 16];
-            l = wl[i % 16];
-            a += l & 65535;
-            b += l >>> 16;
-            c += h & 65535;
-            d += h >>> 16;
-            b += a >>> 16;
-            c += b >>> 16;
-            d += c >>> 16;
-            th = c & 65535 | d << 16;
-            tl = a & 65535 | b << 16;
-            h = th;
-            l = tl;
-            a = l & 65535;
-            b = l >>> 16;
-            c = h & 65535;
-            d = h >>> 16;
-            h = (ah0 >>> 28 | al0 << 32 - 28) ^ (al0 >>> 34 - 32 | ah0 << 32 - (34 - 32)) ^ (al0 >>> 39 - 32 | ah0 << 32 - (39 - 32));
-            l = (al0 >>> 28 | ah0 << 32 - 28) ^ (ah0 >>> 34 - 32 | al0 << 32 - (34 - 32)) ^ (ah0 >>> 39 - 32 | al0 << 32 - (39 - 32));
-            a += l & 65535;
-            b += l >>> 16;
-            c += h & 65535;
-            d += h >>> 16;
-            h = ah0 & ah1 ^ ah0 & ah2 ^ ah1 & ah2;
-            l = al0 & al1 ^ al0 & al2 ^ al1 & al2;
-            a += l & 65535;
-            b += l >>> 16;
-            c += h & 65535;
-            d += h >>> 16;
-            b += a >>> 16;
-            c += b >>> 16;
-            d += c >>> 16;
-            bh7 = c & 65535 | d << 16;
-            bl7 = a & 65535 | b << 16;
-            h = bh3;
-            l = bl3;
-            a = l & 65535;
-            b = l >>> 16;
-            c = h & 65535;
-            d = h >>> 16;
-            h = th;
-            l = tl;
-            a += l & 65535;
-            b += l >>> 16;
-            c += h & 65535;
-            d += h >>> 16;
-            b += a >>> 16;
-            c += b >>> 16;
-            d += c >>> 16;
-            bh3 = c & 65535 | d << 16;
-            bl3 = a & 65535 | b << 16;
-            ah1 = bh0;
-            ah2 = bh1;
-            ah3 = bh2;
-            ah4 = bh3;
-            ah5 = bh4;
-            ah6 = bh5;
-            ah7 = bh6;
-            ah0 = bh7;
-            al1 = bl0;
-            al2 = bl1;
-            al3 = bl2;
-            al4 = bl3;
-            al5 = bl4;
-            al6 = bl5;
-            al7 = bl6;
-            al0 = bl7;
-            if (i % 16 === 15) {
-              for (j = 0; j < 16; j++) {
-                h = wh[j];
-                l = wl[j];
-                a = l & 65535;
-                b = l >>> 16;
-                c = h & 65535;
-                d = h >>> 16;
-                h = wh[(j + 9) % 16];
-                l = wl[(j + 9) % 16];
-                a += l & 65535;
-                b += l >>> 16;
-                c += h & 65535;
-                d += h >>> 16;
-                th = wh[(j + 1) % 16];
-                tl = wl[(j + 1) % 16];
-                h = (th >>> 1 | tl << 32 - 1) ^ (th >>> 8 | tl << 32 - 8) ^ th >>> 7;
-                l = (tl >>> 1 | th << 32 - 1) ^ (tl >>> 8 | th << 32 - 8) ^ (tl >>> 7 | th << 32 - 7);
-                a += l & 65535;
-                b += l >>> 16;
-                c += h & 65535;
-                d += h >>> 16;
-                th = wh[(j + 14) % 16];
-                tl = wl[(j + 14) % 16];
-                h = (th >>> 19 | tl << 32 - 19) ^ (tl >>> 61 - 32 | th << 32 - (61 - 32)) ^ th >>> 6;
-                l = (tl >>> 19 | th << 32 - 19) ^ (th >>> 61 - 32 | tl << 32 - (61 - 32)) ^ (tl >>> 6 | th << 32 - 6);
-                a += l & 65535;
-                b += l >>> 16;
-                c += h & 65535;
-                d += h >>> 16;
-                b += a >>> 16;
-                c += b >>> 16;
-                d += c >>> 16;
-                wh[j] = c & 65535 | d << 16;
-                wl[j] = a & 65535 | b << 16;
-              }
-            }
-          }
-          h = ah0;
-          l = al0;
-          a = l & 65535;
-          b = l >>> 16;
-          c = h & 65535;
-          d = h >>> 16;
-          h = hh[0];
-          l = hl[0];
-          a += l & 65535;
-          b += l >>> 16;
-          c += h & 65535;
-          d += h >>> 16;
-          b += a >>> 16;
-          c += b >>> 16;
-          d += c >>> 16;
-          hh[0] = ah0 = c & 65535 | d << 16;
-          hl[0] = al0 = a & 65535 | b << 16;
-          h = ah1;
-          l = al1;
-          a = l & 65535;
-          b = l >>> 16;
-          c = h & 65535;
-          d = h >>> 16;
-          h = hh[1];
-          l = hl[1];
-          a += l & 65535;
-          b += l >>> 16;
-          c += h & 65535;
-          d += h >>> 16;
-          b += a >>> 16;
-          c += b >>> 16;
-          d += c >>> 16;
-          hh[1] = ah1 = c & 65535 | d << 16;
-          hl[1] = al1 = a & 65535 | b << 16;
-          h = ah2;
-          l = al2;
-          a = l & 65535;
-          b = l >>> 16;
-          c = h & 65535;
-          d = h >>> 16;
-          h = hh[2];
-          l = hl[2];
-          a += l & 65535;
-          b += l >>> 16;
-          c += h & 65535;
-          d += h >>> 16;
-          b += a >>> 16;
-          c += b >>> 16;
-          d += c >>> 16;
-          hh[2] = ah2 = c & 65535 | d << 16;
-          hl[2] = al2 = a & 65535 | b << 16;
-          h = ah3;
-          l = al3;
-          a = l & 65535;
-          b = l >>> 16;
-          c = h & 65535;
-          d = h >>> 16;
-          h = hh[3];
-          l = hl[3];
-          a += l & 65535;
-          b += l >>> 16;
-          c += h & 65535;
-          d += h >>> 16;
-          b += a >>> 16;
-          c += b >>> 16;
-          d += c >>> 16;
-          hh[3] = ah3 = c & 65535 | d << 16;
-          hl[3] = al3 = a & 65535 | b << 16;
-          h = ah4;
-          l = al4;
-          a = l & 65535;
-          b = l >>> 16;
-          c = h & 65535;
-          d = h >>> 16;
-          h = hh[4];
-          l = hl[4];
-          a += l & 65535;
-          b += l >>> 16;
-          c += h & 65535;
-          d += h >>> 16;
-          b += a >>> 16;
-          c += b >>> 16;
-          d += c >>> 16;
-          hh[4] = ah4 = c & 65535 | d << 16;
-          hl[4] = al4 = a & 65535 | b << 16;
-          h = ah5;
-          l = al5;
-          a = l & 65535;
-          b = l >>> 16;
-          c = h & 65535;
-          d = h >>> 16;
-          h = hh[5];
-          l = hl[5];
-          a += l & 65535;
-          b += l >>> 16;
-          c += h & 65535;
-          d += h >>> 16;
-          b += a >>> 16;
-          c += b >>> 16;
-          d += c >>> 16;
-          hh[5] = ah5 = c & 65535 | d << 16;
-          hl[5] = al5 = a & 65535 | b << 16;
-          h = ah6;
-          l = al6;
-          a = l & 65535;
-          b = l >>> 16;
-          c = h & 65535;
-          d = h >>> 16;
-          h = hh[6];
-          l = hl[6];
-          a += l & 65535;
-          b += l >>> 16;
-          c += h & 65535;
-          d += h >>> 16;
-          b += a >>> 16;
-          c += b >>> 16;
-          d += c >>> 16;
-          hh[6] = ah6 = c & 65535 | d << 16;
-          hl[6] = al6 = a & 65535 | b << 16;
-          h = ah7;
-          l = al7;
-          a = l & 65535;
-          b = l >>> 16;
-          c = h & 65535;
-          d = h >>> 16;
-          h = hh[7];
-          l = hl[7];
-          a += l & 65535;
-          b += l >>> 16;
-          c += h & 65535;
-          d += h >>> 16;
-          b += a >>> 16;
-          c += b >>> 16;
-          d += c >>> 16;
-          hh[7] = ah7 = c & 65535 | d << 16;
-          hl[7] = al7 = a & 65535 | b << 16;
-          pos += 128;
-          n -= 128;
-        }
-        return n;
-      }
-      function crypto_hash(out, m, n) {
-        var hh = new Int32Array(8), hl = new Int32Array(8), x = new Uint8Array(256), i, b = n;
-        hh[0] = 1779033703;
-        hh[1] = 3144134277;
-        hh[2] = 1013904242;
-        hh[3] = 2773480762;
-        hh[4] = 1359893119;
-        hh[5] = 2600822924;
-        hh[6] = 528734635;
-        hh[7] = 1541459225;
-        hl[0] = 4089235720;
-        hl[1] = 2227873595;
-        hl[2] = 4271175723;
-        hl[3] = 1595750129;
-        hl[4] = 2917565137;
-        hl[5] = 725511199;
-        hl[6] = 4215389547;
-        hl[7] = 327033209;
-        crypto_hashblocks_hl(hh, hl, m, n);
-        n %= 128;
-        for (i = 0; i < n; i++) x[i] = m[b - n + i];
-        x[n] = 128;
-        n = 256 - 128 * (n < 112 ? 1 : 0);
-        x[n - 9] = 0;
-        ts64(x, n - 8, b / 536870912 | 0, b << 3);
-        crypto_hashblocks_hl(hh, hl, x, n);
-        for (i = 0; i < 8; i++) ts64(out, 8 * i, hh[i], hl[i]);
-        return 0;
-      }
-      function add(p, q) {
-        var a = gf(), b = gf(), c = gf(), d = gf(), e = gf(), f = gf(), g = gf(), h = gf(), t = gf();
-        Z(a, p[1], p[0]);
-        Z(t, q[1], q[0]);
-        M(a, a, t);
-        A(b, p[0], p[1]);
-        A(t, q[0], q[1]);
-        M(b, b, t);
-        M(c, p[3], q[3]);
-        M(c, c, D2);
-        M(d, p[2], q[2]);
-        A(d, d, d);
-        Z(e, b, a);
-        Z(f, d, c);
-        A(g, d, c);
-        A(h, b, a);
-        M(p[0], e, f);
-        M(p[1], h, g);
-        M(p[2], g, f);
-        M(p[3], e, h);
-      }
-      function cswap(p, q, b) {
-        var i;
-        for (i = 0; i < 4; i++) {
-          sel25519(p[i], q[i], b);
-        }
-      }
-      function pack(r, p) {
-        var tx = gf(), ty = gf(), zi = gf();
-        inv25519(zi, p[2]);
-        M(tx, p[0], zi);
-        M(ty, p[1], zi);
-        pack25519(r, ty);
-        r[31] ^= par25519(tx) << 7;
-      }
-      function scalarmult(p, q, s) {
-        var b, i;
-        set25519(p[0], gf0);
-        set25519(p[1], gf1);
-        set25519(p[2], gf1);
-        set25519(p[3], gf0);
-        for (i = 255; i >= 0; --i) {
-          b = s[i / 8 | 0] >> (i & 7) & 1;
-          cswap(p, q, b);
-          add(q, p);
-          add(p, p);
-          cswap(p, q, b);
-        }
-      }
-      function scalarbase(p, s) {
-        var q = [gf(), gf(), gf(), gf()];
-        set25519(q[0], X);
-        set25519(q[1], Y);
-        set25519(q[2], gf1);
-        M(q[3], X, Y);
-        scalarmult(p, q, s);
-      }
-      function crypto_sign_keypair(pk, sk, seeded) {
-        var d = new Uint8Array(64);
-        var p = [gf(), gf(), gf(), gf()];
-        var i;
-        if (!seeded) randombytes(sk, 32);
-        crypto_hash(d, sk, 32);
-        d[0] &= 248;
-        d[31] &= 127;
-        d[31] |= 64;
-        scalarbase(p, d);
-        pack(pk, p);
-        for (i = 0; i < 32; i++) sk[i + 32] = pk[i];
-        return 0;
-      }
-      var L = new Float64Array([237, 211, 245, 92, 26, 99, 18, 88, 214, 156, 247, 162, 222, 249, 222, 20, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 16]);
-      function modL(r, x) {
-        var carry, i, j, k;
-        for (i = 63; i >= 32; --i) {
-          carry = 0;
-          for (j = i - 32, k = i - 12; j < k; ++j) {
-            x[j] += carry - 16 * x[i] * L[j - (i - 32)];
-            carry = Math.floor((x[j] + 128) / 256);
-            x[j] -= carry * 256;
-          }
-          x[j] += carry;
-          x[i] = 0;
-        }
-        carry = 0;
-        for (j = 0; j < 32; j++) {
-          x[j] += carry - (x[31] >> 4) * L[j];
-          carry = x[j] >> 8;
-          x[j] &= 255;
-        }
-        for (j = 0; j < 32; j++) x[j] -= carry * L[j];
-        for (i = 0; i < 32; i++) {
-          x[i + 1] += x[i] >> 8;
-          r[i] = x[i] & 255;
-        }
-      }
-      function reduce(r) {
-        var x = new Float64Array(64), i;
-        for (i = 0; i < 64; i++) x[i] = r[i];
-        for (i = 0; i < 64; i++) r[i] = 0;
-        modL(r, x);
-      }
-      function crypto_sign(sm, m, n, sk) {
-        var d = new Uint8Array(64), h = new Uint8Array(64), r = new Uint8Array(64);
-        var i, j, x = new Float64Array(64);
-        var p = [gf(), gf(), gf(), gf()];
-        crypto_hash(d, sk, 32);
-        d[0] &= 248;
-        d[31] &= 127;
-        d[31] |= 64;
-        var smlen = n + 64;
-        for (i = 0; i < n; i++) sm[64 + i] = m[i];
-        for (i = 0; i < 32; i++) sm[32 + i] = d[32 + i];
-        crypto_hash(r, sm.subarray(32), n + 32);
-        reduce(r);
-        scalarbase(p, r);
-        pack(sm, p);
-        for (i = 32; i < 64; i++) sm[i] = sk[i];
-        crypto_hash(h, sm, n + 64);
-        reduce(h);
-        for (i = 0; i < 64; i++) x[i] = 0;
-        for (i = 0; i < 32; i++) x[i] = r[i];
-        for (i = 0; i < 32; i++) {
-          for (j = 0; j < 32; j++) {
-            x[i + j] += h[i] * d[j];
-          }
-        }
-        modL(sm.subarray(32), x);
-        return smlen;
-      }
-      function unpackneg(r, p) {
-        var t = gf(), chk = gf(), num = gf(), den = gf(), den2 = gf(), den4 = gf(), den6 = gf();
-        set25519(r[2], gf1);
-        unpack25519(r[1], p);
-        S(num, r[1]);
-        M(den, num, D);
-        Z(num, num, r[2]);
-        A(den, r[2], den);
-        S(den2, den);
-        S(den4, den2);
-        M(den6, den4, den2);
-        M(t, den6, num);
-        M(t, t, den);
-        pow2523(t, t);
-        M(t, t, num);
-        M(t, t, den);
-        M(t, t, den);
-        M(r[0], t, den);
-        S(chk, r[0]);
-        M(chk, chk, den);
-        if (neq25519(chk, num)) M(r[0], r[0], I);
-        S(chk, r[0]);
-        M(chk, chk, den);
-        if (neq25519(chk, num)) return -1;
-        if (par25519(r[0]) === p[31] >> 7) Z(r[0], gf0, r[0]);
-        M(r[3], r[0], r[1]);
-        return 0;
-      }
-      function crypto_sign_open(m, sm, n, pk) {
-        var i;
-        var t = new Uint8Array(32), h = new Uint8Array(64);
-        var p = [gf(), gf(), gf(), gf()], q = [gf(), gf(), gf(), gf()];
-        if (n < 64) return -1;
-        if (unpackneg(q, pk)) return -1;
-        for (i = 0; i < n; i++) m[i] = sm[i];
-        for (i = 0; i < 32; i++) m[i + 32] = pk[i];
-        crypto_hash(h, m, n);
-        reduce(h);
-        scalarmult(p, q, h);
-        scalarbase(q, sm.subarray(32));
-        add(p, q);
-        pack(t, p);
-        n -= 64;
-        if (crypto_verify_32(sm, 0, t, 0)) {
-          for (i = 0; i < n; i++) m[i] = 0;
-          return -1;
-        }
-        for (i = 0; i < n; i++) m[i] = sm[i + 64];
-        return n;
-      }
-      var crypto_secretbox_KEYBYTES = 32, crypto_secretbox_NONCEBYTES = 24, crypto_secretbox_ZEROBYTES = 32, crypto_secretbox_BOXZEROBYTES = 16, crypto_scalarmult_BYTES = 32, crypto_scalarmult_SCALARBYTES = 32, crypto_box_PUBLICKEYBYTES = 32, crypto_box_SECRETKEYBYTES = 32, crypto_box_BEFORENMBYTES = 32, crypto_box_NONCEBYTES = crypto_secretbox_NONCEBYTES, crypto_box_ZEROBYTES = crypto_secretbox_ZEROBYTES, crypto_box_BOXZEROBYTES = crypto_secretbox_BOXZEROBYTES, crypto_sign_BYTES = 64, crypto_sign_PUBLICKEYBYTES = 32, crypto_sign_SECRETKEYBYTES = 64, crypto_sign_SEEDBYTES = 32, crypto_hash_BYTES = 64;
-      nacl6.lowlevel = {
-        crypto_core_hsalsa20,
-        crypto_stream_xor,
-        crypto_stream,
-        crypto_stream_salsa20_xor,
-        crypto_stream_salsa20,
-        crypto_onetimeauth,
-        crypto_onetimeauth_verify,
-        crypto_verify_16,
-        crypto_verify_32,
-        crypto_secretbox,
-        crypto_secretbox_open,
-        crypto_scalarmult,
-        crypto_scalarmult_base,
-        crypto_box_beforenm,
-        crypto_box_afternm,
-        crypto_box,
-        crypto_box_open,
-        crypto_box_keypair,
-        crypto_hash,
-        crypto_sign,
-        crypto_sign_keypair,
-        crypto_sign_open,
-        crypto_secretbox_KEYBYTES,
-        crypto_secretbox_NONCEBYTES,
-        crypto_secretbox_ZEROBYTES,
-        crypto_secretbox_BOXZEROBYTES,
-        crypto_scalarmult_BYTES,
-        crypto_scalarmult_SCALARBYTES,
-        crypto_box_PUBLICKEYBYTES,
-        crypto_box_SECRETKEYBYTES,
-        crypto_box_BEFORENMBYTES,
-        crypto_box_NONCEBYTES,
-        crypto_box_ZEROBYTES,
-        crypto_box_BOXZEROBYTES,
-        crypto_sign_BYTES,
-        crypto_sign_PUBLICKEYBYTES,
-        crypto_sign_SECRETKEYBYTES,
-        crypto_sign_SEEDBYTES,
-        crypto_hash_BYTES,
-        gf,
-        D,
-        L,
-        pack25519,
-        unpack25519,
-        M,
-        A,
-        S,
-        Z,
-        pow2523,
-        add,
-        set25519,
-        modL,
-        scalarmult,
-        scalarbase
-      };
-      function checkLengths(k, n) {
-        if (k.length !== crypto_secretbox_KEYBYTES) throw new Error("bad key size");
-        if (n.length !== crypto_secretbox_NONCEBYTES) throw new Error("bad nonce size");
-      }
-      function checkBoxLengths(pk, sk) {
-        if (pk.length !== crypto_box_PUBLICKEYBYTES) throw new Error("bad public key size");
-        if (sk.length !== crypto_box_SECRETKEYBYTES) throw new Error("bad secret key size");
-      }
-      function checkArrayTypes() {
-        for (var i = 0; i < arguments.length; i++) {
-          if (!(arguments[i] instanceof Uint8Array))
-            throw new TypeError("unexpected type, use Uint8Array");
-        }
-      }
-      function cleanup(arr) {
-        for (var i = 0; i < arr.length; i++) arr[i] = 0;
-      }
-      nacl6.randomBytes = function(n) {
-        var b = new Uint8Array(n);
-        randombytes(b, n);
-        return b;
-      };
-      nacl6.secretbox = function(msg, nonce, key) {
-        checkArrayTypes(msg, nonce, key);
-        checkLengths(key, nonce);
-        var m = new Uint8Array(crypto_secretbox_ZEROBYTES + msg.length);
-        var c = new Uint8Array(m.length);
-        for (var i = 0; i < msg.length; i++) m[i + crypto_secretbox_ZEROBYTES] = msg[i];
-        crypto_secretbox(c, m, m.length, nonce, key);
-        return c.subarray(crypto_secretbox_BOXZEROBYTES);
-      };
-      nacl6.secretbox.open = function(box, nonce, key) {
-        checkArrayTypes(box, nonce, key);
-        checkLengths(key, nonce);
-        var c = new Uint8Array(crypto_secretbox_BOXZEROBYTES + box.length);
-        var m = new Uint8Array(c.length);
-        for (var i = 0; i < box.length; i++) c[i + crypto_secretbox_BOXZEROBYTES] = box[i];
-        if (c.length < 32) return null;
-        if (crypto_secretbox_open(m, c, c.length, nonce, key) !== 0) return null;
-        return m.subarray(crypto_secretbox_ZEROBYTES);
-      };
-      nacl6.secretbox.keyLength = crypto_secretbox_KEYBYTES;
-      nacl6.secretbox.nonceLength = crypto_secretbox_NONCEBYTES;
-      nacl6.secretbox.overheadLength = crypto_secretbox_BOXZEROBYTES;
-      nacl6.scalarMult = function(n, p) {
-        checkArrayTypes(n, p);
-        if (n.length !== crypto_scalarmult_SCALARBYTES) throw new Error("bad n size");
-        if (p.length !== crypto_scalarmult_BYTES) throw new Error("bad p size");
-        var q = new Uint8Array(crypto_scalarmult_BYTES);
-        crypto_scalarmult(q, n, p);
-        return q;
-      };
-      nacl6.scalarMult.base = function(n) {
-        checkArrayTypes(n);
-        if (n.length !== crypto_scalarmult_SCALARBYTES) throw new Error("bad n size");
-        var q = new Uint8Array(crypto_scalarmult_BYTES);
-        crypto_scalarmult_base(q, n);
-        return q;
-      };
-      nacl6.scalarMult.scalarLength = crypto_scalarmult_SCALARBYTES;
-      nacl6.scalarMult.groupElementLength = crypto_scalarmult_BYTES;
-      nacl6.box = function(msg, nonce, publicKey, secretKey) {
-        var k = nacl6.box.before(publicKey, secretKey);
-        return nacl6.secretbox(msg, nonce, k);
-      };
-      nacl6.box.before = function(publicKey, secretKey) {
-        checkArrayTypes(publicKey, secretKey);
-        checkBoxLengths(publicKey, secretKey);
-        var k = new Uint8Array(crypto_box_BEFORENMBYTES);
-        crypto_box_beforenm(k, publicKey, secretKey);
-        return k;
-      };
-      nacl6.box.after = nacl6.secretbox;
-      nacl6.box.open = function(msg, nonce, publicKey, secretKey) {
-        var k = nacl6.box.before(publicKey, secretKey);
-        return nacl6.secretbox.open(msg, nonce, k);
-      };
-      nacl6.box.open.after = nacl6.secretbox.open;
-      nacl6.box.keyPair = function() {
-        var pk = new Uint8Array(crypto_box_PUBLICKEYBYTES);
-        var sk = new Uint8Array(crypto_box_SECRETKEYBYTES);
-        crypto_box_keypair(pk, sk);
-        return { publicKey: pk, secretKey: sk };
-      };
-      nacl6.box.keyPair.fromSecretKey = function(secretKey) {
-        checkArrayTypes(secretKey);
-        if (secretKey.length !== crypto_box_SECRETKEYBYTES)
-          throw new Error("bad secret key size");
-        var pk = new Uint8Array(crypto_box_PUBLICKEYBYTES);
-        crypto_scalarmult_base(pk, secretKey);
-        return { publicKey: pk, secretKey: new Uint8Array(secretKey) };
-      };
-      nacl6.box.publicKeyLength = crypto_box_PUBLICKEYBYTES;
-      nacl6.box.secretKeyLength = crypto_box_SECRETKEYBYTES;
-      nacl6.box.sharedKeyLength = crypto_box_BEFORENMBYTES;
-      nacl6.box.nonceLength = crypto_box_NONCEBYTES;
-      nacl6.box.overheadLength = nacl6.secretbox.overheadLength;
-      nacl6.sign = function(msg, secretKey) {
-        checkArrayTypes(msg, secretKey);
-        if (secretKey.length !== crypto_sign_SECRETKEYBYTES)
-          throw new Error("bad secret key size");
-        var signedMsg = new Uint8Array(crypto_sign_BYTES + msg.length);
-        crypto_sign(signedMsg, msg, msg.length, secretKey);
-        return signedMsg;
-      };
-      nacl6.sign.open = function(signedMsg, publicKey) {
-        checkArrayTypes(signedMsg, publicKey);
-        if (publicKey.length !== crypto_sign_PUBLICKEYBYTES)
-          throw new Error("bad public key size");
-        var tmp = new Uint8Array(signedMsg.length);
-        var mlen = crypto_sign_open(tmp, signedMsg, signedMsg.length, publicKey);
-        if (mlen < 0) return null;
-        var m = new Uint8Array(mlen);
-        for (var i = 0; i < m.length; i++) m[i] = tmp[i];
-        return m;
-      };
-      nacl6.sign.detached = function(msg, secretKey) {
-        var signedMsg = nacl6.sign(msg, secretKey);
-        var sig = new Uint8Array(crypto_sign_BYTES);
-        for (var i = 0; i < sig.length; i++) sig[i] = signedMsg[i];
-        return sig;
-      };
-      nacl6.sign.detached.verify = function(msg, sig, publicKey) {
-        checkArrayTypes(msg, sig, publicKey);
-        if (sig.length !== crypto_sign_BYTES)
-          throw new Error("bad signature size");
-        if (publicKey.length !== crypto_sign_PUBLICKEYBYTES)
-          throw new Error("bad public key size");
-        var sm = new Uint8Array(crypto_sign_BYTES + msg.length);
-        var m = new Uint8Array(crypto_sign_BYTES + msg.length);
-        var i;
-        for (i = 0; i < crypto_sign_BYTES; i++) sm[i] = sig[i];
-        for (i = 0; i < msg.length; i++) sm[i + crypto_sign_BYTES] = msg[i];
-        return crypto_sign_open(m, sm, sm.length, publicKey) >= 0;
-      };
-      nacl6.sign.keyPair = function() {
-        var pk = new Uint8Array(crypto_sign_PUBLICKEYBYTES);
-        var sk = new Uint8Array(crypto_sign_SECRETKEYBYTES);
-        crypto_sign_keypair(pk, sk);
-        return { publicKey: pk, secretKey: sk };
-      };
-      nacl6.sign.keyPair.fromSecretKey = function(secretKey) {
-        checkArrayTypes(secretKey);
-        if (secretKey.length !== crypto_sign_SECRETKEYBYTES)
-          throw new Error("bad secret key size");
-        var pk = new Uint8Array(crypto_sign_PUBLICKEYBYTES);
-        for (var i = 0; i < pk.length; i++) pk[i] = secretKey[32 + i];
-        return { publicKey: pk, secretKey: new Uint8Array(secretKey) };
-      };
-      nacl6.sign.keyPair.fromSeed = function(seed) {
-        checkArrayTypes(seed);
-        if (seed.length !== crypto_sign_SEEDBYTES)
-          throw new Error("bad seed size");
-        var pk = new Uint8Array(crypto_sign_PUBLICKEYBYTES);
-        var sk = new Uint8Array(crypto_sign_SECRETKEYBYTES);
-        for (var i = 0; i < 32; i++) sk[i] = seed[i];
-        crypto_sign_keypair(pk, sk, true);
-        return { publicKey: pk, secretKey: sk };
-      };
-      nacl6.sign.publicKeyLength = crypto_sign_PUBLICKEYBYTES;
-      nacl6.sign.secretKeyLength = crypto_sign_SECRETKEYBYTES;
-      nacl6.sign.seedLength = crypto_sign_SEEDBYTES;
-      nacl6.sign.signatureLength = crypto_sign_BYTES;
-      nacl6.hash = function(msg) {
-        checkArrayTypes(msg);
-        var h = new Uint8Array(crypto_hash_BYTES);
-        crypto_hash(h, msg, msg.length);
-        return h;
-      };
-      nacl6.hash.hashLength = crypto_hash_BYTES;
-      nacl6.verify = function(x, y) {
-        checkArrayTypes(x, y);
-        if (x.length === 0 || y.length === 0) return false;
-        if (x.length !== y.length) return false;
-        return vn(x, 0, y, 0, x.length) === 0 ? true : false;
-      };
-      nacl6.setPRNG = function(fn) {
-        randombytes = fn;
-      };
-      (function() {
-        var crypto = typeof self !== "undefined" ? self.crypto || self.msCrypto : null;
-        if (crypto && crypto.getRandomValues) {
-          var QUOTA = 65536;
-          nacl6.setPRNG(function(x, n) {
-            var i, v = new Uint8Array(n);
-            for (i = 0; i < n; i += QUOTA) {
-              crypto.getRandomValues(v.subarray(i, i + Math.min(n - i, QUOTA)));
-            }
-            for (i = 0; i < n; i++) x[i] = v[i];
-            cleanup(v);
-          });
-        } else if (typeof __require !== "undefined") {
-          crypto = __require("crypto");
-          if (crypto && crypto.randomBytes) {
-            nacl6.setPRNG(function(x, n) {
-              var i, v = crypto.randomBytes(n);
-              for (i = 0; i < n; i++) x[i] = v[i];
-              cleanup(v);
-            });
-          }
-        }
-      })();
-    })(typeof module !== "undefined" && module.exports ? module.exports : self.nacl = self.nacl || {});
-  }
-});
 var BACKEND_URL = process.env.PAIGY_BACKEND_URL ?? "https://paigy.ai";
 var NETWORK_MSG = `Can't reach ${BACKEND_URL} \u2014 the connection was blocked or dropped before an HTTP response. If this agent runs in a sandboxed environment with a network allowlist (e.g. Claude Code on the web, CI), ask the user to add the Paigy domain (paigy.ai) to the environment's allowed domains, then retry.`;
 var PROXY_ENV = ["HTTPS_PROXY", "https_proxy", "HTTP_PROXY", "http_proxy"];
@@ -3553,32 +1299,28 @@ function mcpInputSchema(s) {
   delete schema.$schema;
   return draft2020(schema);
 }
-var StartContactSchema = z.object({
-  goalIds: z.tuple([z.string().uuid()]),
-  // THE ASK IS THE QUESTION, not a bulletin with a question at the end (2026-09-16).
-  //
-  // A DecisionNeed is settled only by an answer in the shape THIS ask declares. Bundle news,
-  // findings and a decision into one, and the person answers whichever part engaged them —
-  // which settles nothing, leaves the need open, and gets them asked again. On call 619c5a92
-  // one ask carried a briefing, a side question ("the ring should show the agent's name now —
-  // what did you actually see?") and a one-of-four about how far an erase reaches. The owner
-  // answered the side question. The need stayed open; the card asked again. Of the 45 call
-  // asks carrying a decision, 27 are over 600 characters.
-  //
-  // Sending them separately costs nothing, because a CALL contact joins the call already
-  // happening (`goal/store.ts`, JOIN BEFORE MINTING) — several contacts on one Goal arrive as
-  // one call, planned as its turns, and each keeps its own settleable need.
+var AskInputSchema = z.object({
+  id: z.string().optional().describe("Optional idempotency key or client-side ID for this specific ask."),
+  parentId: z.string().uuid().optional().describe("Optional explicit parent Goal ID. If omitted, the platform's semantic router will auto-cluster it."),
+  repo: z.string().optional().describe("Optional repository context."),
   ask: z.string().trim().min(1).max(1e4).describe(
     "The question, and only what is needed to answer it. News, progress and findings are their own contact \u2014 a call contact JOINS a call already happening, so several arrive as one call. Do not bundle: a DecisionNeed is settled only by an answer in the shape this ask declares, so someone who answers the part that interested them settles nothing and is asked again."
   ),
+  options: z.array(z.object({
+    label: z.string().trim().min(1).max(1e3),
+    hint: z.string().trim().max(500).describe("Optional short projection of consequence or action if this option is chosen.").optional(),
+    image: z.string().url().optional(),
+    html: z.string().max(16384).describe("Optional sandboxed HTML/CSS preview. No JavaScript or network; inline CSS and data: URIs only. It renders edge-to-edge in a responsive card 200pt tall (about 320pt wide on a phone, with the next option peeking beside it), so fit the HTML to that viewport.").optional()
+  }).strict()).min(2).max(6).optional()
+}).strict();
+var StartContactSchema = z.object({
+  asks: z.array(AskInputSchema).min(1).describe("The list of asks/questions to pose. They will be semantically clustered by the API."),
   waiting: z.enum(["none", "hard"]).default("none"),
-  channel: z.enum(["notification", "call"]).default("notification"),
-  options: z.array(z.object({ label: z.string().trim().min(1).max(1e3), image: z.string().url().optional(), html: z.string().max(16384).optional() }).strict()).min(2).max(6).optional(),
-  threadId: z.string().uuid().optional().describe("Continue an existing Thread: the threadId a prior Delivery returned. Omit to start a new Thread.")
+  channel: z.enum(["notification", "call"]).default("notification")
 }).strict();
 var ContactSchema = z.union([StartContactSchema, z.object({ deliveryId: z.string().uuid() }).strict()]);
 var CONTACT_SCHEMA = { type: "object", ...mcpInputSchema(ContactSchema) };
-var CONTACT_DESCRIPTION = "Contact the user about exactly one existing Goal: pass goalIds:[goalId], ask, channel:'notification'|'call', and waiting:'none'|'hard'. Options supply choices. Notification returns immediately; collect durable answers with claim_goal/get_goal. On stdio, a Call holds one cancellable ~45s window; continue with ONLY {deliveryId}. Continuation sends nothing and rereads the same durable evidence, including previously read answers. Entries retain authorship and provenance; accepted decisions are separate from quoted speech. Call state open does not mean ringing. Unsupported: soft waiting, multiple Goals/questions, outcome admission, and re-presentation of an existing request. Create a Goal explicitly first; never resend a pending ask to continue waiting.";
+var CONTACT_DESCRIPTION = "Contact the user with one or more asks/questions. Pass an array of asks (each with 'ask', optional 'options', 'id', 'parentId', 'repo'), plus channel:'notification'|'call', and waiting:'none'|'hard'. The platform will semantically cluster your asks under the correct Goals automatically. Notification returns immediately; collect durable answers with check_replies. On stdio, a Call holds one cancellable ~45s window; continue with ONLY {deliveryId}. Never bundle multiple questions into a single 'ask' string; pass them as separate objects in the 'asks' array.";
 var CreateGoalSchema = z2.object({
   outcome: z2.string().trim().min(1).max(1e4),
   /** The work's NAME (#2115) — one to five words, how a person refers to it out loud ("the night
@@ -3590,7 +1332,6 @@ var CreateGoalSchema = z2.object({
    *  (owner, on the call of 2026-09-14: "let's do the reference with the threading"). A
    *  reference only: the owner reads it through `get_thread`, which does its own scoping, and
    *  the writer refuses a thread belonging to another account. */
-  contextThreadId: z2.string().uuid().optional(),
   /** THE GOAL THIS ONE BELONGS UNDER (owner, 2026-09-15: "the ask I gave for the design doc
    *  didn't get created as a child goal of the voice UI goal, which is how it should've
    *  worked"). It could not have been: this door took no parent, so the only route was
@@ -3598,12 +1339,15 @@ var CreateGoalSchema = z2.object({
    *  took the short one. The hierarchy has been modelled since Goals existed and had been used
    *  ZERO times in 2,031 of them. Absent, the server judges it against the caller's open Goals
    *  (`apps/api/src/goal/intake.ts`). The writer refuses a Goal belonging to another account. */
-  parentGoalId: z2.string().uuid().optional()
+  parentGoalId: z2.string().uuid().optional(),
+  /** The repository or project identifier this Goal belongs to (#2280) — e.g. "owner/repo" or
+   *  repo name. Delegated work inherits this from its parent Goal when omitted. */
+  repo: z2.string().trim().min(1).max(200).optional()
 });
 var CreateGoalToolSchema = CreateGoalSchema.extend({
   idempotencyKey: CreateGoalSchema.shape.idempotencyKey.optional().describe("Optional. One is minted per call; pass your own only so a retry lands on the same Goal.")
 }).strict();
-var CREATE_GOAL_DESCRIPTION = 'Create a durable Goal for an outcome. Without parentGoalId it is placed against your open Goals: if one already IS this work, that Goal comes back (existing: true) and nothing new is created \u2014 continue it; if the work belongs under one, it is created there (parentGoalId in the receipt); otherwise it is a root. Pass parentGoalId yourself to put it under a specific Goal. Pass title to name it in one to five words, as a person would refer to it out loud ("the night rings") \u2014 it heads every list and is spoken on a call; without one the brain writes it. Admission only: the owner must claim it before doing work, then update it as it advances. Returns an admission receipt with goalId, current state, revision, ownerParticipant, and the next step; no Goal content or execution lease.';
+var CREATE_GOAL_DESCRIPTION = 'Create a durable Goal for an outcome. Without parentGoalId it is placed against your open Goals: if one already IS this work, that Goal comes back (existing: true) and nothing new is created \u2014 continue it; if the work belongs under one, it is created there (parentGoalId in the receipt); otherwise it is a root. Pass parentGoalId yourself to put it under a specific Goal. Pass repo to anchor the work to a specific repository ("owner/repo" or repo name); delegated children inherit it. Pass title to name it in one to five words, as a person would refer to it out loud ("the night rings") \u2014 it heads every list and is spoken on a call; without one the brain writes it. Admission only: the owner must claim it before doing work, then update it as it advances. Returns an admission receipt with goalId, current state, revision, ownerParticipant, and the next step; no Goal content or execution lease.';
 var UpdateGoalSchema = z2.object({
   revision: z2.number().int().positive(),
   changes: z2.object({
@@ -3695,10 +1439,11 @@ var TransformSchema = z3.enum([
 var OptionSchema = z3.object({
   id: z3.string(),
   label: z3.string(),
+  hint: z3.string().max(500).describe("Optional short projection of consequence or action if this option is chosen (e.g. 'Reruns test suite', 'Merges to main').").optional(),
   // .describe() flows into the MCP contact JSON schema (zodToJsonSchema), so
   // the constraints below are what an agent reads when deciding to use these.
   html: z3.string().max(16384).describe(
-    "Optional sandboxed HTML/CSS preview for a visual 'pick one' (shown in the option card). Untrusted-sandboxed: NO JavaScript, NO external network or images \u2014 inline CSS and data: URIs only; <=16KB. Use for layout/CSS mockups, tables, diffs. For a hosted image use `image` instead."
+    "Optional sandboxed HTML/CSS preview for a visual 'pick one' (shown in the option card). Untrusted-sandboxed: NO JavaScript, NO external network or images \u2014 inline CSS and data: URIs only; <=16KB. Rendered edge-to-edge in a responsive card that is 200pt tall (about 320pt wide on a phone, with the next option peeking beside it); make your HTML fit that viewport. Use for layout/CSS mockups, tables, diffs. For a hosted image use `image` instead."
   ).optional(),
   image: z3.string().url().describe(
     "Optional image URL rendered as the option's preview (plain image, not sandboxed). For agent-generated HTML/CSS mockups, use `html` instead."
@@ -3789,23 +1534,6 @@ var NotifyRequestFields = z3.object({
    *  when `parentId` became the conversation handle: `parentId` says WHERE, this
    *  says HOW. */
   clarifies: z3.string().optional(),
-  /** E2EE (text lane): when the pairing is E2EE, the sealed replacements for the
-   *  plaintext content fields, keyed by field name. FINALIZED wire shape (was
-   *  provisional in the storage PR): a per-field map `{ context?, options?,
-   *  visuals? }` of opaque Envelopes — one seal per present content field, so a
-   *  message with no options/visuals seals only `context`. It COEXISTS with the
-   *  plaintext fields by mutual exclusion: the superRefine below requires that
-   *  when `envelope` is present the plaintext `context`/`options`/`visuals` are
-   *  ABSENT (and vice-versa), so a row is either fully plaintext or fully sealed —
-   *  never a readable half. The server persists this OPAQUELY into
-   *  notifications.envelope and relays it blindly; it never decrypts. Absent =
-   *  today's plaintext path (context/options/visuals carry the cleartext).
-   *  z.lazy because EnvelopeSchema is declared further down (E2EE section). */
-  envelope: z3.object({
-    context: z3.lazy(() => EnvelopeSchema).optional(),
-    options: z3.lazy(() => EnvelopeSchema).optional(),
-    visuals: z3.lazy(() => EnvelopeSchema).optional()
-  }).optional(),
   select: SelectShapeSchema.optional().describe(
     "How the user answers \u2014 required on the fully-shaped form, pick the shape that fits the question: 'one' = pick one option, 'many' = pick several, 'rank' = pick & order (each needs `options`); 'confirm' = yes/no or approve/deny; 'text' = free-form reply only (status updates, open questions). 'confirm' and 'text' take no options. Omit only when sending the simplified `ask` form \u2014 the broker picks the shape."
   ),
@@ -3859,22 +1587,6 @@ var NotifyRequestFields = z3.object({
 });
 var NotifyRequestSchema = NotifyRequestFields.superRefine((r, ctx) => {
   if (r.workId && r.goalId) ctx.addIssue({ code: z3.ZodIssueCode.custom, path: ["goalId"], message: "pass goalId or workId, not both" });
-  const sealed = !!r.envelope;
-  if (sealed) {
-    if (!r.envelope?.context)
-      ctx.addIssue({ code: z3.ZodIssueCode.custom, path: ["envelope", "context"], message: "sealed request must include envelope.context" });
-    for (const f of ["context", "options", "visuals"]) {
-      if (r[f] !== void 0)
-        ctx.addIssue({ code: z3.ZodIssueCode.custom, path: [f], message: `E2EE request must not carry plaintext ${f} \u2014 it's sealed in envelope.${f}` });
-    }
-    if (r.points !== void 0)
-      ctx.addIssue({ code: z3.ZodIssueCode.custom, path: ["points"], message: "E2EE request must not carry plaintext points" });
-    if (r.ask !== void 0)
-      ctx.addIssue({ code: z3.ZodIssueCode.custom, path: ["ask"], message: "E2EE request must not carry a plaintext ask \u2014 derive the shape agent-side and seal it" });
-    if (r.needs !== void 0)
-      ctx.addIssue({ code: z3.ZodIssueCode.custom, path: ["needs"], message: "E2EE request must not carry plaintext needs" });
-    return;
-  }
   if (r.ask !== void 0) {
     for (const f of ["context", "select", "points"]) {
       if (r[f] !== void 0)
@@ -3894,61 +1606,6 @@ var NotifyRequestSchema = NotifyRequestFields.superRefine((r, ctx) => {
   if (!needsOptions && r.options?.length)
     ctx.addIssue({ code: z3.ZodIssueCode.custom, path: ["options"], message: `select:'${r.select}' takes no options` });
 });
-function normalizeWaiting(req) {
-  if (!req.waiting) return req;
-  const { waiting, ...rest } = req;
-  return {
-    ...rest,
-    urgencyHint: req.urgencyHint ?? { none: "whenever", soft: "soon", hard: "now" }[waiting],
-    blocking: req.blocking || waiting === "hard"
-  };
-}
-function unitsOf(text) {
-  const spans = [];
-  const re = /\n\s*\n+/g;
-  let cursor = 0;
-  const push = (from, to) => {
-    const slice = text.slice(from, to);
-    const lead = slice.length - slice.trimStart().length;
-    const tail = slice.length - slice.trimEnd().length;
-    if (from + lead < to - tail) spans.push({ start: from + lead, end: to - tail });
-  };
-  for (let m = re.exec(text); m; m = re.exec(text)) {
-    push(cursor, m.index);
-    cursor = m.index + m[0].length;
-  }
-  push(cursor, text.length);
-  return spans;
-}
-function headline(text) {
-  const line = text.split("\n").map((l) => l.trim()).filter((l) => l && !/^`{3,}/.test(l)).map((l) => l.replace(/^(?:#{1,6}|[-*>]|\d{1,3}\.)\s+/, "")).find(Boolean) ?? "";
-  return (/^[^.!?\n]+[.!?]?/.exec(line)?.[0] ?? line).trim();
-}
-function bodyAfterHeadline(text) {
-  const body = text.trim();
-  const title = headline(body);
-  const rest = body.slice(title.length).replace(/^[\s.!?—–-]+/, "").trim();
-  if (!rest) return { title, description: [] };
-  const chunks = unitsOf(rest).map((u) => rest.slice(u.start, u.end)).filter(Boolean);
-  return { title, description: chunks.length ? chunks : [rest] };
-}
-function deriveAsk(req) {
-  req = normalizeWaiting(req);
-  if (!req.ask) return req;
-  const text = req.ask.trim();
-  const hinted = req.urgencyHint === "now" ? "call" : req.urgencyHint === "soon" ? "banner" : req.urgencyHint === "whenever" ? "inbox" : req.urgency;
-  const urgency = req.channel === "call" ? "call" : req.channel === "message" && hinted === "call" ? "banner" : hinted;
-  const { ask: _ask, needs, urgencyHint: _hint, channel: _channel, ...rest } = req;
-  return {
-    ...rest,
-    context: bodyAfterHeadline(text),
-    // Options riding alongside the ask (#575: pixels can't be prose) floor to a
-    // single pick — the model broker may upgrade to many/rank from the wording.
-    select: req.options?.length ? "one" : "text",
-    urgency,
-    ...needs?.length ? { points: needs } : {}
-  };
-}
 var NotifyStatusSchema = z3.enum(["pending", "answered", "ignored"]);
 var AgentStateSchema = z3.enum(["idle", "in_progress", "completed", "needs_input"]);
 var TurnSchema = z3.object({
@@ -4004,13 +1661,6 @@ var AwaitItemSchema = z3.discriminatedUnion("type", [
     workId: z3.string().uuid().optional(),
     decisionId: z3.string().uuid().optional(),
     answer: UserAnswerSchema,
-    /** E2EE: present when the answer is sealed. The server relays the opaque answer
-     *  envelope + the plaintext `ignored` status hint; the receiving agent OPENS it
-     *  with its device key and re-derives the real UserAnswer, treating a mismatch
-     *  against `ignored` as tampering. Absent = today's plaintext answer (in `answer`).
-     *  On a sealed reply the plaintext `answer` is a placeholder (kind reflects only
-     *  the `ignored` bit) — never the real content, which stays sealed. */
-    sealed: z3.lazy(() => SealedAnswerSchema).optional(),
     /** WHAT THE AGENT CANNOT KNOW FROM THE FIELDS BESIDE IT (owner, 2026-09-04, issue
      *  #1537). One line, built from the record: the ask and the caller's reply VERBATIM,
      *  the notification they belong to, and the `contact` call that reaches the person
@@ -4232,21 +1882,6 @@ var InboxItemSchema = z3.object({
   blocking: z3.boolean().default(false),
   /** The user's locked-in answer; present only for replied items (GET /api/replied/:id). */
   answer: UserAnswerSchema.optional(),
-  /** E2EE (text lane): the sealed content this item carries when the pairing is E2EE, in
-   *  place of the plaintext `context`/`options`/`visuals` (which the operator would
-   *  otherwise read). A per-field map of opaque Envelopes — the SAME shape as
-   *  NotifyRequest.envelope. The native app decrypts it locally via openNotification;
-   *  web / an un-enrolled device can't and renders a locked placeholder. Absent = today's
-   *  plaintext item (context carries the cleartext), so plaintext items are unchanged. */
-  envelope: z3.object({
-    context: z3.lazy(() => EnvelopeSchema).optional(),
-    options: z3.lazy(() => EnvelopeSchema).optional(),
-    visuals: z3.lazy(() => EnvelopeSchema).optional()
-  }).optional(),
-  /** E2EE: the agent's device X25519 public key to seal the user's answer BACK to (the
-   *  sender the phone replies to). Sourced server-side from this item's pairing credential.
-   *  Present only alongside `envelope`; the phone seals via sealAnswer(answer, this, id). */
-  agentX25519: z3.string().optional(),
   /** THE TARGET FACTS A CARD RENDERS (#1796 point 5, 2026-09-11): the Delivery it is a view of,
    *  that Delivery's kind, the request Entry, the Goals it answers for, the exact DecisionNeed (none
    *  for a request that asks nothing), whether its content is sealed, and that Goal's state. The
@@ -4344,13 +1979,6 @@ var UserSettingsSchema = z3.object({
    *  setting. Absent = a spoken time can't be landed, so the reminder rides the next
    *  call — honest about what we know. */
   timezone: z3.string().min(1).max(64).optional(),
-  /** Account E2EE state (text lane): 'off' (default) = today's plaintext; 'on' =
-   *  content is sealed end-to-end between the local agent and the phone. Like
-   *  voiceMode, OPTIONAL and NOT defaulted so a stale client PATCHing the full
-   *  settings object without it can't silently flip the account's E2EE state.
-   *  Absent = leave unchanged on write, 'off' on read (see store.ts). The demo
-   *  account is plaintext by construction and refuses any non-'off' value. */
-  e2eeMode: z3.enum(["off", "on"]).optional(),
   /** Rung-2 broker tuning (#381). Optional and NOT defaulted, same stale-client
    *  clobber guard as voiceMode: absent = leave unchanged on write. */
   broker: BrokerTuningSchema.optional()
@@ -4540,6 +2168,8 @@ var QueueItemSchema = z3.object({
   blocked: z3.boolean().default(false),
   /** Every decision need on it, open or settled — the page decides which to show. */
   questions: z3.array(QueueQuestionSchema).default([]),
+  /** The repository or project identifier this Goal belongs to (#2280), null if untracked. */
+  repo: z3.string().nullable().optional(),
   createdAt: z3.string(),
   updatedAt: z3.string().nullable().default(null)
 });
@@ -4653,54 +2283,12 @@ var DeliveryConfigSchema = z3.object({
    *  carries credentials; only a `poll` registration can come back with null here. */
   realtime: z3.object({ url: z3.string(), anonKey: z3.string() }).nullable()
 });
-var EnvelopeRecipientSchema = z3.object({
-  keyId: z3.string(),
-  epk: z3.string(),
-  wnonce: z3.string(),
-  wrap: z3.string()
-});
-var EnvelopeHeaderSchema = z3.object({
-  field: z3.enum(["context", "options", "visuals", "answer"]),
-  kind: z3.string(),
-  senderRole: z3.enum(["agent", "user"]),
-  recipientKeyIds: z3.array(z3.string()),
-  seq: z3.number().int().nonnegative()
-});
-var EnvelopeSchema = z3.object({
-  v: z3.literal(1),
-  alg: z3.literal("x25519-xsalsa20poly1305"),
-  msgId: z3.string(),
-  hdr: EnvelopeHeaderSchema,
-  recipients: z3.array(EnvelopeRecipientSchema).min(1),
-  nonce: z3.string(),
-  ct: z3.string()
-});
-var SealedAnswerSchema = z3.object({
-  ignored: z3.boolean(),
-  envelope: EnvelopeSchema
-});
-var DeviceCredentialSchema = z3.object({
-  deviceId: z3.string(),
-  kind: z3.enum(["phone", "web", "agent"]),
-  x25519Pub: z3.string(),
-  ed25519Pub: z3.string(),
-  sig: z3.string()
-});
-var DeviceRosterSchema = z3.object({
-  uikPub: z3.string(),
-  devices: z3.array(DeviceCredentialSchema)
-});
 var WakeNudgeSchema = z3.object({
   kind: z3.enum(["reply", "request", "callback"]),
   notificationId: z3.string().optional(),
   parentId: z3.string()
 });
 var PairingStatusSchema = z3.enum(["pending", "approved", "denied", "expired"]);
-var PairingRevealSchema = z3.object({
-  x25519: z3.string(),
-  ed25519: z3.string(),
-  nonce: z3.string()
-});
 var DeviceCodeSchema = z3.object({
   device_code: z3.string(),
   user_code: z3.string(),
@@ -4720,19 +2308,7 @@ var DeviceInfoSchema = z3.object({
    *  (seen live: PAIGY-5T, 2026-07-21). Remove once a newer binary is the floor. */
   agent: z3.string().optional(),
   device: z3.string().nullable(),
-  status: PairingStatusSchema,
-  proto: z3.string().nullable().optional(),
-  agent_commitment: z3.string().nullable().optional(),
-  // Ca
-  agent_reveal: PairingRevealSchema.nullable().optional(),
-  // present once the agent reveals
-  agent_credential: DeviceCredentialSchema.nullable().optional(),
-  // the phone's UIK-signed cred over the agent's keys — the agent fetches it here to finalizeE2ee
-  // The phone's reveal + identity key, exposed here so a GATED agent (e2ee_mode='on', token
-  // withheld until e2ee=true) can compute the SAS WITHOUT a token. Public keys — same safety
-  // class as agent_reveal above. Present only once the phone reveals; null otherwise.
-  phone_reveal: PairingRevealSchema.nullable().optional(),
-  uik_pub: z3.string().nullable().optional()
+  status: PairingStatusSchema
 });
 var DeviceTokenSchema = z3.object({
   access_token: z3.string(),
@@ -4751,8 +2327,6 @@ var DeviceTokenSchema = z3.object({
    *  landed in the FIRST granted workspace and the agent rediscovered its own repo from
    *  the thread each time (host.ts, live catch 2026-08-06 — prompt-papered until now). */
   workspace: z3.string().nullable().optional(),
-  phone_reveal: PairingRevealSchema.nullable().optional(),
-  // present once the phone reveals
   uik_pub: z3.string().nullable().optional()
 });
 var SupportRequestSchema = z3.object({
@@ -4774,182 +2348,11 @@ var NotificationFeedbackKindSchema = z3.enum([
   "other"
   // anything else — the note carries it.
 ]);
-var FeedbackResolutionSchema = z3.enum(["broker_fixed", "sent_to_agent"]);
-var FeedbackOutcomeSchema = z3.object({
-  resolution: FeedbackResolutionSchema,
-  transform: TransformSchema,
-  message: z3.string(),
-  childIds: z3.array(z3.string()).optional()
-});
-var import_tweetnacl = __toESM(require_nacl_fast(), 1);
-var import_tweetnacl2 = __toESM(require_nacl_fast(), 1);
-var import_tweetnacl3 = __toESM(require_nacl_fast(), 1);
-var import_tweetnacl4 = __toESM(require_nacl_fast(), 1);
-var import_tweetnacl5 = __toESM(require_nacl_fast(), 1);
-function utf8ToBytes(s) {
-  const out = [];
-  for (let i = 0; i < s.length; i++) {
-    const c = s.charCodeAt(i);
-    if (c < 128) out.push(c);
-    else if (c < 2048) out.push(192 | c >> 6, 128 | c & 63);
-    else if (c >= 55296 && c <= 56319) {
-      const c2 = s.charCodeAt(i + 1);
-      if (c2 >= 56320 && c2 <= 57343) {
-        i++;
-        const cp = 65536 + ((c & 1023) << 10) + (c2 & 1023);
-        out.push(240 | cp >> 18, 128 | cp >> 12 & 63, 128 | cp >> 6 & 63, 128 | cp & 63);
-      } else out.push(239, 191, 189);
-    } else if (c >= 56320 && c <= 57343) out.push(239, 191, 189);
-    else out.push(224 | c >> 12, 128 | c >> 6 & 63, 128 | c & 63);
-  }
-  return Uint8Array.from(out);
-}
-var B64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
-function toB64(bytes) {
-  let out = "";
-  for (let i = 0; i < bytes.length; i += 3) {
-    const b0 = bytes[i];
-    const has1 = i + 1 < bytes.length;
-    const has2 = i + 2 < bytes.length;
-    const b1 = has1 ? bytes[i + 1] : 0;
-    const b2 = has2 ? bytes[i + 2] : 0;
-    out += B64[b0 >> 2] + B64[(b0 & 3) << 4 | b1 >> 4];
-    out += has1 ? B64[(b1 & 15) << 2 | b2 >> 6] : "=";
-    out += has2 ? B64[b2 & 63] : "=";
-  }
-  return out;
-}
-function fromB64Lenient(s) {
-  const clean = s.replace(/[^A-Za-z0-9+/]/g, "");
-  const out = [];
-  for (let i = 0; i < clean.length; i += 4) {
-    const c0 = B64.indexOf(clean[i]);
-    const c1 = B64.indexOf(clean[i + 1] ?? "A");
-    const c2 = clean[i + 2] !== void 0 ? B64.indexOf(clean[i + 2]) : -1;
-    const c3 = clean[i + 3] !== void 0 ? B64.indexOf(clean[i + 3]) : -1;
-    out.push(c0 << 2 | c1 >> 4);
-    if (c2 >= 0) out.push((c1 & 15) << 4 | c2 >> 2);
-    if (c3 >= 0) out.push((c2 & 3) << 6 | c3);
-  }
-  return Uint8Array.from(out);
-}
-function fromB64(s) {
-  const bytes = fromB64Lenient(s);
-  if (toB64(bytes) !== s) throw new Error("non-canonical base64");
-  return bytes;
-}
-function concat(parts) {
-  let n = 0;
-  for (const p of parts) n += p.length;
-  const out = new Uint8Array(n);
-  let o = 0;
-  for (const p of parts) {
-    out.set(p, o);
-    o += p.length;
-  }
-  return out;
-}
-function u32be(n) {
-  return Uint8Array.of(n >>> 24 & 255, n >>> 16 & 255, n >>> 8 & 255, n & 255);
-}
-function lp(b) {
-  return concat([u32be(b.length), b]);
-}
-function eqCt(a, b) {
-  if (a.length !== b.length) return false;
-  let d = 0;
-  for (let i = 0; i < a.length; i++) d |= a[i] ^ b[i];
-  return d === 0;
-}
-var ok = false;
-function ensureCsprng() {
-  if (ok) return;
-  let a;
-  let b;
-  try {
-    a = import_tweetnacl.default.randomBytes(32);
-    b = import_tweetnacl.default.randomBytes(32);
-  } catch {
-    throw new Error("paigy-crypto: no secure RNG available \u2014 refusing to generate keys (fail-closed)");
-  }
-  if (a.every((x) => x === 0) || eqCt(a, b)) {
-    throw new Error("paigy-crypto: RNG self-test failed (constant/low-entropy output)");
-  }
-  ok = true;
-}
-function randomBytes(n) {
-  ensureCsprng();
-  return import_tweetnacl.default.randomBytes(n);
-}
-function kp(k) {
-  return { publicKey: toB64(k.publicKey), secretKey: toB64(k.secretKey) };
-}
-function genDeviceKeypair() {
-  ensureCsprng();
-  return { x25519: kp(import_tweetnacl2.default.box.keyPair()), ed25519: kp(import_tweetnacl2.default.sign.keyPair()) };
-}
-function sharedSecret(peerX25519PubB64, mySecretB64) {
-  const raw = import_tweetnacl2.default.scalarMult(fromB64(mySecretB64), fromB64(peerX25519PubB64));
-  if (raw.every((b) => b === 0)) throw new Error("low-order X25519 point \u2014 shared secret rejected");
-  return toB64(raw);
-}
-function credentialBody(c) {
-  return concat([
-    lp(utf8ToBytes("paigy-device-credential-v1")),
-    lp(utf8ToBytes(c.deviceId)),
-    lp(utf8ToBytes(c.kind)),
-    lp(fromB64(c.x25519Pub)),
-    lp(fromB64(c.ed25519Pub))
-  ]);
-}
-function verifyDeviceCredential(cred, uikPublicB64) {
-  const { sig, ...fields } = cred;
-  try {
-    return import_tweetnacl2.default.sign.detached.verify(credentialBody(fields), fromB64(sig), fromB64(uikPublicB64));
-  } catch {
-    return false;
-  }
-}
-var SAS_DOMAIN = "paigy-sas-v2";
-function deriveSAS(input, bits = 24) {
-  const bundle = concat([
-    lp(utf8ToBytes(SAS_DOMAIN)),
-    lp(utf8ToBytes(input.proto)),
-    lp(fromB64(input.ss)),
-    lp(fromB64(input.ca)),
-    lp(fromB64(input.cb))
-  ]);
-  const d = import_tweetnacl4.default.hash(bundle);
-  const nbytes = Math.ceil(bits / 8);
-  let n = 0n;
-  for (let i = 0; i < nbytes; i++) n = n << 8n | BigInt(d[i]);
-  n &= (1n << BigInt(bits)) - 1n;
-  const digits = (2n ** BigInt(bits) - 1n).toString().length;
-  return n.toString().padStart(digits, "0").replace(/(\d{3})(?=\d)/g, "$1 ");
-}
-var COMMIT_DOMAIN = "paigy-commit-v1";
-function commit(valuesB64) {
-  return toB64(import_tweetnacl5.default.hash(concat([lp(utf8ToBytes(COMMIT_DOMAIN)), ...valuesB64.map((v) => lp(fromB64(v)))])).slice(0, 32));
-}
-function commitPairing(proto, role, x25519Pub, ed25519Pub, nonce, uikPub) {
-  const vals = [toB64(utf8ToBytes(proto)), toB64(utf8ToBytes(role)), x25519Pub, ed25519Pub, nonce];
-  if (uikPub !== void 0) vals.push(uikPub);
-  return commit(vals);
-}
-function verifyPairingCommit(commitment, proto, role, x25519Pub, ed25519Pub, nonce, uikPub) {
-  try {
-    return eqCt(fromB64(commitment), fromB64(commitPairing(proto, role, x25519Pub, ed25519Pub, nonce, uikPub)));
-  } catch {
-    return false;
-  }
-}
 function sessionSlot(sessionId2) {
   const id = sessionId2 ?? sessionId();
   return `session:${id.slice(0, 8)}`;
 }
 var AGENT_NAME = process.env.PAIGY_AGENT || sessionSlot();
-var PROTO = "paigy-pair-v2|sas=24";
-var SAS_BITS = 24;
 var TOKEN_PATH = join(homedir(), ".paigy", "token.json");
 var KEY_PATH = join(homedir(), ".paigy", "key.json");
 function readTokenFile() {
@@ -5018,24 +2421,23 @@ async function revokeToken(token) {
   });
   return res.ok;
 }
-async function requestCode(suggestedName = AGENT_NAME, e2ee, device) {
+async function requestCode(suggestedName = AGENT_NAME, device) {
   const res = await reach(`${BACKEND_URL}/api/device/code`, {
     method: "POST",
     headers: { "content-type": "application/json" },
     body: JSON.stringify({
       suggestedName,
-      ...device ? { device } : {},
-      ...e2ee ? { proto: e2ee.proto, commitment: e2ee.commitment } : {}
+      ...device ? { device } : {}
     })
   });
   if (!res.ok) throw new Error(`/api/device/code failed: ${res.status} ${await res.text()}`);
   return await res.json();
 }
-async function pollToken(deviceCode, reveal) {
+async function pollToken(deviceCode) {
   const res = await reach(`${BACKEND_URL}/api/device/token`, {
     method: "POST",
     headers: { "content-type": "application/json" },
-    body: JSON.stringify(reveal ? { device_code: deviceCode, reveal } : { device_code: deviceCode })
+    body: JSON.stringify({ device_code: deviceCode })
   });
   if (res.ok) return await res.json();
   const body = await res.json().catch(() => ({ error: "unknown" }));
@@ -5047,96 +2449,6 @@ async function pollToken(deviceCode, reveal) {
   if (err === "access_denied") throw new Error("Access denied by user. Pairing cancelled.");
   throw new Error(`Unexpected error from /api/device/token: ${err}`);
 }
-function saveKeyFile(kf) {
-  mkdirSync(join(homedir(), ".paigy"), { recursive: true });
-  writeFileSync(KEY_PATH, JSON.stringify(kf, null, 2) + "\n", { mode: 384 });
-}
-function readKeyFile() {
-  if (!existsSync(KEY_PATH)) return null;
-  try {
-    return JSON.parse(readFileSync(KEY_PATH, "utf8"));
-  } catch {
-    return null;
-  }
-}
-function deleteKeyFile() {
-  if (!existsSync(KEY_PATH)) return false;
-  rmSync(KEY_PATH);
-  return true;
-}
-function startE2ee() {
-  const keypair = genDeviceKeypair();
-  const nonce = toB64(randomBytes(32));
-  const ca = commitPairing(PROTO, "A", keypair.x25519.publicKey, keypair.ed25519.publicKey, nonce);
-  const keyFile = { proto: PROTO, keypair, nonce, ca, e2ee: false };
-  saveKeyFile(keyFile);
-  return { keyFile, offer: { proto: PROTO, commitment: ca } };
-}
-async function fetchPeerCommit(deviceCode) {
-  const res = await reach(`${BACKEND_URL}/api/device/peer-commit?device_code=${encodeURIComponent(deviceCode)}`);
-  if (!res.ok) return null;
-  const body = await res.json().catch(() => ({}));
-  return body.commitment ?? null;
-}
-function agentReveal(kf) {
-  return { x25519: kf.keypair.x25519.publicKey, ed25519: kf.keypair.ed25519.publicKey, nonce: kf.nonce };
-}
-function computeSAS(kf, cb, phoneReveal, uikPub) {
-  const opens = verifyPairingCommit(cb, PROTO, "P", phoneReveal.x25519, phoneReveal.ed25519, phoneReveal.nonce, uikPub);
-  if (!opens) throw new Error("phone reveal does not open its commitment \u2014 aborting E2EE");
-  const ss = sharedSecret(phoneReveal.x25519, kf.keypair.x25519.secretKey);
-  return deriveSAS({ proto: PROTO, ss, ca: kf.ca, cb }, SAS_BITS);
-}
-function finalizeE2ee(kf, credential, uikPub) {
-  if (!verifyDeviceCredential(credential, uikPub)) return false;
-  if (credential.x25519Pub !== kf.keypair.x25519.publicKey || credential.ed25519Pub !== kf.keypair.ed25519.publicKey) {
-    return false;
-  }
-  saveKeyFile({ ...kf, e2ee: true, uikPub });
-  return true;
-}
-async function fetchCredential(userCode) {
-  const res = await reach(`${BACKEND_URL}/api/device/info?code=${encodeURIComponent(userCode)}`);
-  if (!res.ok) return null;
-  const body = await res.json().catch(() => ({}));
-  return body.agent_credential ?? null;
-}
-async function fetchPhoneReveal(userCode) {
-  const res = await reach(`${BACKEND_URL}/api/device/info?code=${encodeURIComponent(userCode)}`);
-  if (!res.ok) return null;
-  const body = await res.json().catch(() => ({}));
-  if (!body.phone_reveal || !body.uik_pub) return null;
-  return { phone_reveal: body.phone_reveal, uik_pub: body.uik_pub };
-}
-async function pairStep(deviceCode, keyFile) {
-  if (!keyFile) {
-    const token2 = await pollToken(deviceCode);
-    return token2 ? { kind: "paired", token: token2 } : { kind: "pending" };
-  }
-  const cb = await fetchPeerCommit(deviceCode);
-  if (!cb) {
-    const token2 = await pollToken(deviceCode);
-    return token2 ? { kind: "paired", token: token2 } : { kind: "pending" };
-  }
-  const token = await pollToken(deviceCode, agentReveal(keyFile));
-  if (!token) {
-    const gated = keyFile.userCode ? await fetchPhoneReveal(keyFile.userCode) : null;
-    if (!gated) return { kind: "pending" };
-    try {
-      const sas = computeSAS(keyFile, cb, gated.phone_reveal, gated.uik_pub);
-      return { kind: "awaiting_confirm", sas, uikPub: gated.uik_pub };
-    } catch (e) {
-      return { kind: "e2ee_aborted", warning: e.message };
-    }
-  }
-  if (!token.phone_reveal || !token.uik_pub) return { kind: "paired", token };
-  try {
-    const sas = computeSAS(keyFile, cb, token.phone_reveal, token.uik_pub);
-    return { kind: "paired", token, sas, uikPub: token.uik_pub };
-  } catch (e) {
-    return { kind: "e2ee_aborted", warning: e.message };
-  }
-}
 var UnpairedError = class extends Error {
   constructor() {
     super("Not paired with Paigy \u2014 no valid token (the API answered 401). Run the pairing flow, then retry.");
@@ -5272,20 +2584,34 @@ async function contact(input, opts = {}) {
   const send2 = opts.reach ?? reach;
   const headers = { "content-type": "application/json", authorization: `Bearer ${authToken(opts.token) ?? ""}`, "x-paigy-model": "goal-entry-v1" };
   let deliveryId;
-  if ("deliveryId" in parsed) deliveryId = parsed.deliveryId;
-  else {
-    if (!opts.reach && readKeyFile()?.e2ee) throw new Error("Goal contact does not support E2EE yet; refusing to send plaintext.");
-    const shaped = deriveAsk(NotifyRequestSchema.parse({ ask: parsed.ask, waiting: parsed.waiting, options: parsed.options }));
-    const res = ensureAuthed(await send2(`${BACKEND_URL}/api/goals/${parsed.goalIds[0]}/contact`, {
+  let deliveries = [];
+  if ("deliveryId" in parsed) {
+    deliveryId = parsed.deliveryId;
+  } else {
+    const reqAsks = parsed.asks.map((a) => ({
+      id: a.id,
+      parentId: a.parentId,
+      repo: a.repo,
+      ask: a.ask,
+      options: a.options ?? []
+    }));
+    const res = ensureAuthed(await send2(`${BACKEND_URL}/api/goals/contact`, {
       method: "POST",
       headers,
       signal: opts.signal,
-      body: JSON.stringify({ operationId: opts.operationId ?? randomUUID3(), threadId: parsed.threadId ?? null, content: parsed.ask, select: shaped.select, options: shaped.options ?? [], blocking: parsed.waiting === "hard", channel: parsed.channel === "call" ? "call" : "message" })
+      body: JSON.stringify({
+        operationId: opts.operationId ?? randomUUID3(),
+        asks: reqAsks,
+        waiting: parsed.waiting,
+        channel: parsed.channel === "call" ? "call" : "message"
+      })
     }));
-    if (!res.ok) await fail("goal contact", res);
+    if (!res.ok) await fail("batch contact", res);
     const receipt = await res.json();
-    deliveryId = receipt.deliveryId ?? receipt.callId ?? receipt.notificationId ?? "";
-    if (!deliveryId) throw new Error("Goal contact returned no Delivery identity");
+    deliveries = receipt.deliveries ?? [];
+    if (deliveries.length === 0) throw new Error("Goal contact returned no Delivery identities");
+    deliveryId = deliveries[0]?.deliveryId ?? "";
+    if (!deliveryId) throw new Error("Goal contact returned no valid Delivery identity");
   }
   const read = async (signal2) => {
     const res = ensureAuthed(await send2(`${BACKEND_URL}/api/deliveries/${encodeURIComponent(deliveryId)}`, { headers, signal: signal2 }));
@@ -5375,7 +2701,6 @@ function goalView(g) {
     blockedBy: g.blockedDependencyGoalIds,
     dueAt: g.dueAt,
     leaseExpiresAt: g.leaseExpiresAt,
-    contextThreadId: g.contextThreadId,
     conversation: conversation(g),
     next: g.message
   });
@@ -5386,7 +2711,6 @@ function deliveryView(d) {
     kind: d.kind,
     state: d.state,
     goalIds: d.goalIds,
-    threadId: d.threadId,
     conversation: conversation(d),
     next: d.kind === "notification" ? "Answers land on the Goal: read them with claim_goal or get_goal. Do not poll this notification." : d.message
   });
@@ -5562,13 +2886,7 @@ export {
   deleteToken,
   revokeToken,
   requestCode,
-  saveKeyFile,
-  readKeyFile,
-  deleteKeyFile,
-  startE2ee,
-  finalizeE2ee,
-  fetchCredential,
-  pairStep,
+  pollToken,
   UnpairedError,
   getGoal,
   overrideToken,