@qntx/wallet-worker 0.1.0 → 0.2.0

package/dist/kernel.worker.js

@@ -486,11 +486,11 @@ function abytes(value, length, title = "") {
     return value;
   if (length !== undefined)
     anumber(length, "length");
-  const bytes2 = isBytes(value);
+  const bytes = isBytes(value);
   const ofLen = length !== undefined ? ` of length ${length}` : "";
-  const got = bytes2 ? `length=${value.length}` : `type=${typeof value}`;
+  const got = bytes ? `length=${value.length}` : `type=${typeof value}`;
   const message = atitle(title) + "expected Uint8Array" + ofLen + ", got " + got;
-  if (!bytes2)
+  if (!bytes)
     throw new TypeError(message);
   throw new RangeError(message);
 }
@@ -527,16 +527,16 @@ function aoutput(out, instance) {
     throw new RangeError('"output" expected length >= ' + min);
   }
 }
-function u32(arr2) {
-  return new Uint32Array(arr2.buffer, arr2.byteOffset, Math.floor(arr2.byteLength / 4));
+function u32(arr) {
+  return new Uint32Array(arr.buffer, arr.byteOffset, Math.floor(arr.byteLength / 4));
 }
 function clean(...arrays) {
   for (let i = 0;i < arrays.length; i++) {
     arrays[i].fill(0);
   }
 }
-function createView(arr2) {
-  return new DataView(arr2.buffer, arr2.byteOffset, arr2.byteLength);
+function createView(arr) {
+  return new DataView(arr.buffer, arr.byteOffset, arr.byteLength);
 }
 function rotr(word, shift) {
   return word << 32 - shift | word >>> shift;
@@ -548,22 +548,22 @@ var isLE = /* @__PURE__ */ (() => new Uint8Array(new Uint32Array([287454020]).bu
 function byteSwap(word) {
   return word << 24 & 4278190080 | word << 8 & 16711680 | word >>> 8 & 65280 | word >>> 24 & 255;
 }
-function byteSwap32(arr2) {
-  for (let i = 0;i < arr2.length; i++) {
-    arr2[i] = byteSwap(arr2[i]);
+function byteSwap32(arr) {
+  for (let i = 0;i < arr.length; i++) {
+    arr[i] = byteSwap(arr[i]);
   }
-  return arr2;
+  return arr;
 }
 var swap32IfBE = isLE ? (u) => u : byteSwap32;
 var hasHexBuiltin = /* @__PURE__ */ (() => typeof Uint8Array.from([]).toHex === "function" && typeof Uint8Array.fromHex === "function")();
 var hexes = /* @__PURE__ */ Array.from({ length: 256 }, (_, i) => i.toString(16).padStart(2, "0"));
-function bytesToHex(bytes2) {
-  abytes(bytes2);
+function bytesToHex(bytes) {
+  abytes(bytes);
   if (hasHexBuiltin)
-    return bytes2.toHex();
+    return bytes.toHex();
   let hex = "";
-  for (let i = 0;i < bytes2.length; i++) {
-    hex += hexes[bytes2[i]];
+  for (let i = 0;i < bytes.length; i++) {
+    hex += hexes[bytes[i]];
   }
   return hex;
 }
@@ -623,10 +623,10 @@ async function asyncLoop(iters, tick, cb, onReject) {
     ts = Date.now();
   }
 }
-function utf8ToBytes(str2) {
-  if (typeof str2 !== "string")
+function utf8ToBytes(str) {
+  if (typeof str !== "string")
     throw new TypeError("string expected");
-  const encoded = new TextEncoder().encode(str2);
+  const encoded = new TextEncoder().encode(str);
   try {
     return new Uint8Array(encoded);
   } finally {
@@ -692,45 +692,45 @@ function wipe(...buffers) {
     buffer.fill(0);
   }
 }
-function decodeUtf8Secret(bytes2) {
+function decodeUtf8Secret(bytes) {
   try {
-    return new TextDecoder("utf-8", { fatal: true }).decode(bytes2);
+    return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
   } catch {
     throw new KernelError("invalid-input", "input is not valid UTF-8");
   } finally {
-    wipe(bytes2);
+    wipe(bytes);
   }
 }
 
 class Secret {
   #bytes;
-  constructor(bytes2) {
-    this.#bytes = bytes2;
+  constructor(bytes) {
+    this.#bytes = bytes;
   }
-  static take(bytes2) {
-    return new Secret(bytes2);
+  static take(bytes) {
+    return new Secret(bytes);
   }
   get length() {
-    const bytes2 = this.#bytes;
-    if (bytes2 === undefined) {
+    const bytes = this.#bytes;
+    if (bytes === undefined) {
       throw new KernelError("integrity", "secret already wiped");
     }
-    return bytes2.length;
+    return bytes.length;
   }
   get wiped() {
     return this.#bytes === undefined;
   }
   use(fn) {
-    const bytes2 = this.#bytes;
-    if (bytes2 === undefined) {
+    const bytes = this.#bytes;
+    if (bytes === undefined) {
       throw new KernelError("integrity", "secret already wiped");
     }
-    return fn(bytes2);
+    return fn(bytes);
   }
   wipe() {
-    const bytes2 = this.#bytes;
-    if (bytes2 !== undefined) {
-      bytes2.fill(0);
+    const bytes = this.#bytes;
+    if (bytes !== undefined) {
+      bytes.fill(0);
       this.#bytes = undefined;
     }
   }
@@ -913,11 +913,11 @@ function split(lst, le = false) {
 }
 var fromNumH = (n) => n / 2 ** 32 | 0;
 var fromNumL = (n) => n >>> 0;
-function setU64FromNum(view, byteOffset, n, isLE2) {
+function setU64FromNum(view, byteOffset, n, isLE) {
   const h = fromNumH(n);
   const l = fromNumL(n);
-  view.setUint32(byteOffset, isLE2 ? l : h, isLE2);
-  view.setUint32(byteOffset + 4, isLE2 ? h : l, isLE2);
+  view.setUint32(byteOffset, isLE ? l : h, isLE);
+  view.setUint32(byteOffset + 4, isLE ? h : l, isLE);
 }
 var shrSH = (h, _l, s) => h >>> s;
 var shrSL = (h, l, s) => h << 32 - s | l >>> s;
@@ -956,11 +956,11 @@ class HashMD {
   length = 0;
   pos = 0;
   destroyed = false;
-  constructor(blockLen, outputLen, padOffset, isLE2) {
+  constructor(blockLen, outputLen, padOffset, isLE) {
     this.blockLen = blockLen;
     this.outputLen = outputLen;
     this.padOffset = padOffset;
-    this.isLE = isLE2;
+    this.isLE = isLE;
     this.buffer = new Uint8Array(blockLen);
     this.view = createView(this.buffer);
   }
@@ -997,7 +997,7 @@ class HashMD {
     aexists(this);
     aoutput(out, this);
     this.finished = true;
-    const { buffer, view, blockLen, isLE: isLE2 } = this;
+    const { buffer, view, blockLen, isLE } = this;
     let { pos } = this;
     buffer[pos++] = 128;
     buffer.fill(0, pos);
@@ -1005,7 +1005,7 @@ class HashMD {
       this.process(view, 0);
       buffer.fill(0);
     }
-    setU64FromNum(view, blockLen - 8, this.length * 8, isLE2);
+    setU64FromNum(view, blockLen - 8, this.length * 8, isLE);
     this.process(view, 0);
     this.roundClean();
     const oview = out === buffer ? view : createView(out);
@@ -1015,7 +1015,7 @@ class HashMD {
     if (len % 4 || outLen > state.length)
       throw new Error("invalid outputLen");
     for (let i = 0;i < outLen; i++)
-      oview.setUint32(4 * i, state[i], isLE2);
+      oview.setUint32(4 * i, state[i], isLE);
   }
   digest() {
     const { buffer, outputLen } = this;
@@ -1468,15 +1468,15 @@ function isWellFormedUnicode(value) {
   }
   return true;
 }
-function nfkd(str2) {
-  if (typeof str2 !== "string")
-    throw new TypeError("invalid mnemonic type: " + typeof str2);
-  if (!isWellFormedUnicode(str2))
+function nfkd(str) {
+  if (typeof str !== "string")
+    throw new TypeError("invalid mnemonic type: " + typeof str);
+  if (!isWellFormedUnicode(str))
     throw new TypeError("expected well-formed Unicode string");
-  return str2.normalize("NFKD");
+  return str.normalize("NFKD");
 }
-function normalize(str2) {
-  const norm = nfkd(str2);
+function normalize(str) {
+  const norm = nfkd(str);
   const words = norm.split(" ");
   if (![12, 15, 18, 21, 24].includes(words.length))
     throw new Error("Invalid mnemonic");
@@ -1503,13 +1503,13 @@ function awordlist(wordlist) {
 }
 function encodeWords(entropy, wordlist) {
   awordlist(wordlist);
-  const bytes2 = new Uint8Array(entropy.length + 1);
-  bytes2.set(entropy);
-  bytes2[entropy.length] = calcChecksum(entropy);
+  const bytes = new Uint8Array(entropy.length + 1);
+  bytes.set(entropy);
+  bytes[entropy.length] = calcChecksum(entropy);
   const words = [];
   let carry = 0;
   let bits = 0;
-  for (const byte of bytes2) {
+  for (const byte of bytes) {
     carry = carry << 8 | byte;
     bits += 8;
     if (bits >= 11) {
@@ -1523,7 +1523,7 @@ function encodeWords(entropy, wordlist) {
 function decodeWords(words, wordlist) {
   awordlist(wordlist);
   const entLen = words.length / 3 * 4;
-  const bytes2 = new Uint8Array(entLen + 1);
+  const bytes = new Uint8Array(entLen + 1);
   let carry = 0;
   let bits = 0;
   let pos = 0;
@@ -1535,14 +1535,14 @@ function decodeWords(words, wordlist) {
     bits += 11;
     while (bits >= 8) {
       bits -= 8;
-      bytes2[pos++] = carry >>> bits & 255;
+      bytes[pos++] = carry >>> bits & 255;
     }
     carry &= (1 << bits) - 1;
   }
   if (bits > 0)
-    bytes2[pos] = carry << 8 - bits;
-  const entropy = bytes2.subarray(0, entLen);
-  if (bytes2[entLen] !== calcChecksum(entropy))
+    bytes[pos] = carry << 8 - bits;
+  const entropy = bytes.subarray(0, entLen);
+  if (bytes[entLen] !== calcChecksum(entropy))
     throw new Error("Invalid checksum");
   return Uint8Array.from(entropy);
 }
@@ -3650,15 +3650,15 @@ function abytes2(b) {
   if (!isBytes2(b))
     throw new TypeError("Uint8Array expected");
 }
-function isArrayOf(isString, arr2) {
-  if (!Array.isArray(arr2))
+function isArrayOf(isString, arr) {
+  if (!Array.isArray(arr))
     return false;
-  if (arr2.length === 0)
+  if (arr.length === 0)
     return true;
   if (isString) {
-    return arr2.every((item) => typeof item === "string");
+    return arr.every((item) => typeof item === "string");
   } else {
-    return arr2.every((item) => Number.isSafeInteger(item));
+    return arr.every((item) => Number.isSafeInteger(item));
   }
 }
 function afn(input) {
@@ -3726,20 +3726,20 @@ function radix2(bits) {
     throw new RangeError("radix2: bits should be in (0..8]");
   const mask = powers[bits] - 1;
   return {
-    encode: (bytes2) => {
-      abytes2(bytes2);
-      const len = bytes2.length;
+    encode: (bytes) => {
+      abytes2(bytes);
+      const len = bytes.length;
       const res = new Uint8Array(Math.ceil(len * 8 / bits));
       let carry = 0;
       let pos = 0;
       let j = 0;
       for (let i = 0;i < len; ) {
         if (i + 2 < len) {
-          carry = carry << 24 | bytes2[i] << 16 | bytes2[i + 1] << 8 | bytes2[i + 2];
+          carry = carry << 24 | bytes[i] << 16 | bytes[i + 1] << 8 | bytes[i + 2];
           pos += 24;
           i += 3;
         } else {
-          carry = (carry << 8 | bytes2[i]) & 65535;
+          carry = (carry << 8 | bytes[i]) & 65535;
           pos += 8;
           i++;
         }
@@ -3886,10 +3886,10 @@ var hasBase64Builtin = /* @__PURE__ */ (() => typeof Uint8Array.from([]).toBase6
 var ASCII_WHITESPACE = /[\t\n\f\r ]/;
 var decodeBase64Builtin = (s, isUrl) => {
   astr("base64", s);
-  const alphabet2 = isUrl ? "base64url" : "base64";
+  const alphabet = isUrl ? "base64url" : "base64";
   if (s.length > 0 && ASCII_WHITESPACE.test(s))
     throw new Error("invalid base64");
-  return Uint8Array.fromBase64(s, { alphabet: alphabet2, lastChunkHandling: "strict" });
+  return Uint8Array.fromBase64(s, { alphabet, lastChunkHandling: "strict" });
 };
 var base64Fallback = /* @__PURE__ */ freeze(() => chain(radix2(6), alphabet("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"), padding(6)));
 var base64 = /* @__PURE__ */ freeze(() => hasBase64Builtin ? {
@@ -3907,23 +3907,23 @@ var RADIX_BASE_N_MAX_LENGTH = 65536;
 var BASE_N_MAX_BYTES = 2048;
 var BASE_N_MAX_CHARS = 4096;
 var radixBaseN = (BASE, GROUP) => ({
-  encode: (bytes2) => {
-    abytes2(bytes2);
-    const blen = bytes2.length;
+  encode: (bytes) => {
+    abytes2(bytes);
+    const blen = bytes.length;
     if (blen === 0)
       return new Uint8Array(0);
     if (blen >= RADIX_BASE_N_MAX_LENGTH)
       throw new Error("invalid length");
     let zeros = 0;
-    while (zeros < blen - 1 && bytes2[zeros] === 0)
+    while (zeros < blen - 1 && bytes[zeros] === 0)
       zeros++;
     const nlimbs = Math.ceil(blen / 2);
     const limbs = new Uint16Array(nlimbs);
     const odd = blen & 1;
     if (odd)
-      limbs[0] = bytes2[0];
-    for (let i = odd, j2 = odd;i < blen; i += 2, j2++)
-      limbs[j2] = bytes2[i] << 8 | bytes2[i + 1];
+      limbs[0] = bytes[0];
+    for (let i = odd, j = odd;i < blen; i += 2, j++)
+      limbs[j] = bytes[i] << 8 | bytes[i + 1];
     const groups = [];
     let pos = 0;
     while (pos < nlimbs) {
@@ -3974,18 +3974,18 @@ var radixBaseN = (BASE, GROUP) => ({
     let group = dlen % 5 || 5;
     while (i < dlen) {
       let gval = 0;
-      let factor2 = 1;
+      let factor = 1;
       for (const end = i + group;i < end; i++) {
         const d = digits[i];
         if (d >= BASE)
           throw new Error(`invalid integer: ${d}`);
         gval = gval * BASE + d;
-        factor2 *= BASE;
+        factor *= BASE;
       }
       group = 5;
       let carry = gval;
       for (let k = 0;k < used; k++) {
-        const cur = limbs[k] * factor2 + carry;
+        const cur = limbs[k] * factor + carry;
         carry = Math.floor(cur / 65536);
         limbs[k] = cur - carry * 65536;
       }
@@ -4007,26 +4007,26 @@ var radixBaseN = (BASE, GROUP) => ({
 var genBaseN = (radix, abc) => {
   const letters = alphabet(abc);
   return {
-    encode(bytes2) {
-      abytes2(bytes2);
-      if (bytes2.length > BASE_N_MAX_BYTES)
+    encode(bytes) {
+      abytes2(bytes);
+      if (bytes.length > BASE_N_MAX_BYTES)
         throw new Error("invalid length");
-      return letters.encode(radix.encode(bytes2));
+      return letters.encode(radix.encode(bytes));
     },
-    decode(str2) {
-      astr("baseN.decode", str2);
-      if (str2.length > BASE_N_MAX_CHARS)
+    decode(str) {
+      astr("baseN.decode", str);
+      if (str.length > BASE_N_MAX_CHARS)
         throw new Error("invalid length");
-      return radix.decode(letters.decode(str2));
+      return radix.decode(letters.decode(str));
     }
   };
 };
 var radix58 = /* @__PURE__ */ radixBaseN(58, B58_GROUP);
 var genBase58 = (abc) => genBaseN(radix58, abc);
 var base58 = /* @__PURE__ */ freeze(() => genBase58("123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz"));
-var createBase58check = (sha2562) => {
-  afn(sha2562);
-  const _sha256 = sha2562;
+var createBase58check = (sha256) => {
+  afn(sha256);
+  const _sha256 = sha256;
   return chain(checksum(4, (data) => _sha256(_sha256(data))), base58);
 };
 var BECH_ALPHABET = /* @__PURE__ */ alphabet("qpzry9x8gf2tvdw0s3jn54khce6mua7l");
@@ -4132,17 +4132,17 @@ function genBech32(encoding) {
     const sum = bechChecksum(lowered, words, ENCODING_CONST);
     return `${lowered}1${BECH_ALPHABET.encode(wordsToU8(words))}${sum}`;
   }
-  function decode(str2, limit = 90) {
-    astr("bech32.decode input", str2);
+  function decode(str, limit = 90) {
+    astr("bech32.decode input", str);
     if (limit !== false)
       anumber2(limit, "limit");
-    const slen = str2.length;
+    const slen = str.length;
     if (slen < 8 || limit !== false && slen > limit)
       throw new TypeError(`invalid string length ${slen}, expected (8..${limit})`);
-    const lowered = str2.toLowerCase();
-    if (str2 !== lowered) {
-      if (!BECH_UPPERCASE_PRINTABLE.test(str2)) {
-        assertBech32Printable("bech32.decode input", str2);
+    const lowered = str.toLowerCase();
+    if (str !== lowered) {
+      if (!BECH_UPPERCASE_PRINTABLE.test(str)) {
+        assertBech32Printable("bech32.decode input", str);
         throw new Error(`mixed-case string not allowed`);
       }
     }
@@ -4157,20 +4157,20 @@ function genBech32(encoding) {
     const words = u8ToNumArr(digits, digits.length - 6);
     const sum = bechChecksum(prefix, words, ENCODING_CONST);
     if (!data.endsWith(sum))
-      throw new Error(`Invalid checksum in ${str2}`);
+      throw new Error(`Invalid checksum in ${str}`);
     return { prefix, words };
   }
   const decodeUnsafe = unsafeWrapper(decode);
-  function decodeToBytes(str2, limit = 90) {
-    const { prefix, words } = decode(str2, limit);
+  function decodeToBytes(str, limit = 90) {
+    const { prefix, words } = decode(str, limit);
     return {
       prefix,
       words,
       bytes: fromWords(words)
     };
   }
-  function encodeFromBytes(prefix, bytes2) {
-    return encode(prefix, toWords(bytes2));
+  function encodeFromBytes(prefix, bytes) {
+    return encode(prefix, toWords(bytes));
   }
   return {
     encode,
@@ -4352,11 +4352,11 @@ function abytes3(value, length, title = "") {
     return value;
   if (length !== undefined)
     anumber3(length, "length");
-  const bytes2 = isBytes3(value);
+  const bytes = isBytes3(value);
   const ofLen = length !== undefined ? ` of length ${length}` : "";
-  const got = bytes2 ? `length=${value.length}` : `type=${typeof value}`;
+  const got = bytes ? `length=${value.length}` : `type=${typeof value}`;
   const message = atitle2(title) + "expected Uint8Array" + ofLen + ", got " + got;
-  if (!bytes2)
+  if (!bytes)
     throw new TypeError(message);
   throw new RangeError(message);
 }
@@ -4377,26 +4377,26 @@ function aoutput2(out, instance) {
     throw new RangeError('"output" expected length >= ' + min);
   }
 }
-function u322(arr2) {
-  return new Uint32Array(arr2.buffer, arr2.byteOffset, Math.floor(arr2.byteLength / 4));
+function u322(arr) {
+  return new Uint32Array(arr.buffer, arr.byteOffset, Math.floor(arr.byteLength / 4));
 }
 function clean2(...arrays) {
   for (let i = 0;i < arrays.length; i++) {
     arrays[i].fill(0);
   }
 }
-function createView2(arr2) {
-  return new DataView(arr2.buffer, arr2.byteOffset, arr2.byteLength);
+function createView2(arr) {
+  return new DataView(arr.buffer, arr.byteOffset, arr.byteLength);
 }
 var isLE2 = /* @__PURE__ */ (() => new Uint8Array(new Uint32Array([287454020]).buffer)[0] === 68)();
 function byteSwap2(word) {
   return word << 24 & 4278190080 | word << 8 & 16711680 | word >>> 8 & 65280 | word >>> 24 & 255;
 }
-function byteSwap322(arr2) {
-  for (let i = 0;i < arr2.length; i++) {
-    arr2[i] = byteSwap2(arr2[i]);
+function byteSwap322(arr) {
+  for (let i = 0;i < arr.length; i++) {
+    arr[i] = byteSwap2(arr[i]);
   }
-  return arr2;
+  return arr;
 }
 var swap32IfBE2 = isLE2 ? (u) => u : byteSwap322;
 function overlapBytes(a, b) {
@@ -4489,25 +4489,25 @@ function getOutput(expectedLength, out, onlyAligned = true) {
     throw new Error("invalid output, must be aligned");
   return out;
 }
-function u64Lengths(dataLength, aadLength, isLE3) {
+function u64Lengths(dataLength, aadLength, isLE) {
   anumber3(dataLength);
   anumber3(aadLength);
-  abool(isLE3);
+  abool(isLE);
   const num = new Uint8Array(16);
   const view = createView2(num);
-  view.setBigUint64(0, BigInt(aadLength), isLE3);
-  view.setBigUint64(8, BigInt(dataLength), isLE3);
+  view.setBigUint64(0, BigInt(aadLength), isLE);
+  view.setBigUint64(8, BigInt(dataLength), isLE);
   return num;
 }
-function isAligned32(bytes2) {
-  return bytes2.byteOffset % 4 === 0;
+function isAligned32(bytes) {
+  return bytes.byteOffset % 4 === 0;
 }
-function copyBytes(bytes2) {
-  return Uint8Array.from(abytes3(bytes2));
+function copyBytes(bytes) {
+  return Uint8Array.from(abytes3(bytes));
 }
 
 // ../../node_modules/.bun/@noble+ciphers@2.4.0/node_modules/@noble/ciphers/_arx.js
-var encodeStr = (str2) => Uint8Array.from(str2.split(""), (c) => c.charCodeAt(0));
+var encodeStr = (str) => Uint8Array.from(str.split(""), (c) => c.charCodeAt(0));
 var sigma16_32 = /* @__PURE__ */ (() => swap32IfBE2(u322(encodeStr("expand 16-byte k"))))();
 var sigma32_32 = /* @__PURE__ */ (() => swap32IfBE2(u322(encodeStr("expand 32-byte k"))))();
 function rotl2(a, b) {
@@ -5183,27 +5183,27 @@ function assertPasswordPolicy(password) {
     throw new KernelError("invalid-input", "password must be at least 10 characters");
   }
 }
-async function passwordKek(password, salt, pbkdf22) {
+async function passwordKek(password, salt, pbkdf2) {
   const normalized = decodeUtf8Secret(password).normalize("NFKC");
   const normalizedBytes = utf8ToBytes(normalized);
   try {
-    return await pbkdf22("sha256", normalizedBytes, salt, PASSWORD_ITERATIONS2, 32);
+    return await pbkdf2("sha256", normalizedBytes, salt, PASSWORD_ITERATIONS2, 32);
   } finally {
     wipe(normalizedBytes);
   }
 }
-function passkeyKek(prf, credentialId2) {
+function passkeyKek(prf, credentialId) {
   try {
     if (prf.length !== 32) {
       throw new KernelError("invalid-input", "PRF output must be 32 bytes");
     }
-    return hkdf(sha256, prf, credentialId2, utf8ToBytes("qntx-wallet/kek/passkey/v1"), 32);
+    return hkdf(sha256, prf, credentialId, utf8ToBytes("qntx-wallet/kek/passkey/v1"), 32);
   } finally {
     wipe(prf);
   }
 }
-function wrapDek(kek, dek, factor2, random) {
-  return dek.use((bytes2) => seal(kek, bytes2, factorContext(factor2.kind, factor2.id), factor2.header, random));
+function wrapDek(kek, dek, factor, random) {
+  return dek.use((bytes) => seal(kek, bytes, factorContext(factor.kind, factor.id), factor.header, random));
 }
 function unwrapDek(kek, stored) {
   return Secret.take(open(kek, stored.sealed, factorContext(stored.kind, stored.id), stored.header));
@@ -5216,15 +5216,15 @@ var PASSWORD_FACTOR_ITERATIONS = 600000;
 function factorId(random) {
   return bytesToHex(random(16));
 }
-async function newFactorKek(platform, factor2) {
-  if (factor2.kind === "password") {
-    assertPasswordPolicy(factor2.password);
+async function newFactorKek(platform, factor) {
+  if (factor.kind === "password") {
+    assertPasswordPolicy(factor.password);
     const salt = platform.random(16);
-    const kek2 = await passwordKek(factor2.password, salt, platform.pbkdf2);
-    return { kind: "password", kek: kek2, salt };
+    const kek = await passwordKek(factor.password, salt, platform.pbkdf2);
+    return { kind: "password", kek, salt };
   }
-  const kek = passkeyKek(factor2.prf, factor2.credentialId);
-  return { kind: "passkey", kek, credentialId: factor2.credentialId };
+  const kek = passkeyKek(factor.prf, factor.credentialId);
+  return { kind: "passkey", kek, credentialId: factor.credentialId };
 }
 function factorHeader(material, createdAt) {
   if (material.kind === "password") {
@@ -5239,8 +5239,8 @@ function factorHeader(material, createdAt) {
     createdAt
   });
 }
-async function makeFactor(platform, factor2, dek) {
-  const material = await newFactorKek(platform, factor2);
+async function makeFactor(platform, factor, dek) {
+  const material = await newFactorKek(platform, factor);
   const id = factorId(platform.random);
   const header = factorHeader(material, platform.now());
   try {
@@ -5253,14 +5253,14 @@ async function makeFactor(platform, factor2, dek) {
     }
   }
 }
-async function kekFor(platform, factor2, stored) {
-  if (factor2.kind === "password") {
+async function kekFor(platform, factor, stored) {
+  if (factor.kind === "password") {
     const { salt } = parsePasswordFactorHeader(stored.header);
-    return passwordKek(factor2.password, base64urlnopad.decode(salt), platform.pbkdf2);
+    return passwordKek(factor.password, base64urlnopad.decode(salt), platform.pbkdf2);
   }
-  return passkeyKek(factor2.prf, factor2.credentialId);
+  return passkeyKek(factor.prf, factor.credentialId);
 }
-async function unlock(platform, image, factor2) {
+async function unlock(platform, image, factor) {
   const { meta } = image;
   if (meta === undefined) {
     throw new KernelError("invalid-input", "vault is not initialized");
@@ -5270,13 +5270,13 @@ async function unlock(platform, image, factor2) {
     throw new KernelError("rate-limited", "too many wrong passwords", meta.retryAt);
   }
   let dek;
-  if (factor2.kind === "password") {
+  if (factor.kind === "password") {
     let lastError;
     for (const stored of image.factors) {
       if (stored.kind !== "password") {
         continue;
       }
-      const kek = await kekFor(platform, factor2, stored);
+      const kek = await kekFor(platform, factor, stored);
       try {
         dek = unwrapDek(kek, stored);
         break;
@@ -5306,13 +5306,13 @@ async function unlock(platform, image, factor2) {
       ]);
     }
   } else {
-    const wanted = base64urlnopad.encode(factor2.credentialId);
+    const wanted = base64urlnopad.encode(factor.credentialId);
     const stored = image.factors.find((f) => f.kind === "passkey" && credentialIdOf(f) === wanted);
     if (stored === undefined) {
-      wipe(factor2.prf);
+      wipe(factor.prf);
       throw new KernelError("integrity", "no passkey factor matches the credential");
     }
-    const kek = await kekFor(platform, factor2, stored);
+    const kek = await kekFor(platform, factor, stored);
     try {
       dek = unwrapDek(kek, stored);
     } finally {
@@ -5341,7 +5341,7 @@ function authenticateRecords(dek, records) {
   const opened = [];
   try {
     for (const record of records) {
-      const plaintext = dek.use((bytes2) => open(bytes2, record.sealed, recordContext(record.kind, record.id), record.header));
+      const plaintext = dek.use((bytes) => open(bytes, record.sealed, recordContext(record.kind, record.id), record.header));
       opened.push({ kind: record.kind, id: record.id, plaintext });
     }
     return opened;
@@ -5352,16 +5352,16 @@ function authenticateRecords(dek, records) {
     throw error;
   }
 }
-async function verifyFactor(platform, image, factor2, dek) {
+async function verifyFactor(platform, image, factor, dek) {
   const candidates = image.factors.filter((stored) => {
-    if (factor2.kind !== stored.kind) {
+    if (factor.kind !== stored.kind) {
       return false;
     }
-    return factor2.kind === "password" || credentialIdOf(stored) === base64urlnopad.encode(factor2.credentialId);
+    return factor.kind === "password" || credentialIdOf(stored) === base64urlnopad.encode(factor.credentialId);
   });
   let sawPasswordFactor = false;
   for (const stored of candidates) {
-    const kek = await kekFor(platform, factor2, stored);
+    const kek = await kekFor(platform, factor, stored);
     try {
       const opened = unwrapDek(kek, stored);
       try {
@@ -5382,17 +5382,17 @@ async function verifyFactor(platform, image, factor2, dek) {
       wipe(kek);
     }
   }
-  if (factor2.kind === "password") {
+  if (factor.kind === "password") {
     throw new KernelError(sawPasswordFactor ? "wrong-password" : "invalid-input", "password did not verify");
   }
   throw new KernelError("integrity", "factor did not verify");
 }
 function sealRecord(platform, dek, kind, id, header, plaintext) {
-  const sealed = dek.use((bytes2) => seal(bytes2, plaintext, recordContext(kind, id), header, platform.random));
+  const sealed = dek.use((bytes) => seal(bytes, plaintext, recordContext(kind, id), header, platform.random));
   return { kind, id, header, sealed };
 }
 function openRecord(dek, record) {
-  return dek.use((bytes2) => open(bytes2, record.sealed, recordContext(record.kind, record.id), record.header));
+  return dek.use((bytes) => open(bytes, record.sealed, recordContext(record.kind, record.id), record.header));
 }
 function findRecord(image, kind, id) {
   const record = image.records.find((r) => r.kind === kind && r.id === id);
@@ -5401,12 +5401,12 @@ function findRecord(image, kind, id) {
   }
   return record;
 }
-function establishOps(factor2, records) {
+function establishOps(factor, records) {
   const meta = { format: 1, failedAttempts: 0, retryAt: 0 };
   return [
     { op: "expect-uninitialized" },
     { op: "put-meta", meta },
-    { op: "put-factor", factor: factor2 },
+    { op: "put-factor", factor },
     ...records.map((record) => ({ op: "put-record", record }))
   ];
 }
@@ -5586,11 +5586,11 @@ function hexToNumber(hex) {
     throw new TypeError("hex string expected, got " + typeof hex);
   return hex === "" ? _0n : BigInt("0x" + hex);
 }
-function bytesToNumberBE(bytes2) {
-  return hexToNumber(bytesToHex(bytes2));
+function bytesToNumberBE(bytes) {
+  return hexToNumber(bytesToHex(bytes));
 }
-function bytesToNumberLE(bytes2) {
-  return hexToNumber(bytesToHex(copyBytes2(abytes(bytes2)).reverse()));
+function bytesToNumberLE(bytes) {
+  return hexToNumber(bytesToHex(copyBytes2(abytes(bytes)).reverse()));
 }
 function numberToBytesBE(n, len) {
   anumber(len);
@@ -5606,8 +5606,8 @@ function numberToBytesBE(n, len) {
 function numberToBytesLE(n, len) {
   return numberToBytesBE(n, len).reverse();
 }
-function copyBytes2(bytes2) {
-  return Uint8Array.from(abytes4(bytes2));
+function copyBytes2(bytes) {
+  return Uint8Array.from(abytes4(bytes));
 }
 function asciiToBytes(ascii) {
   if (typeof ascii !== "string")
@@ -5746,14 +5746,14 @@ function pow(num, power, modulo) {
   if (d < _0n2)
     d += modulo;
   if (power < POW_WINDOWED_MIN) {
-    let p2 = _1n2;
+    let p = _1n2;
     while (power > _0n2) {
       if (power & _1n2)
-        p2 = p2 * d % modulo;
+        p = p * d % modulo;
       d = d * d % modulo;
       power >>= _1n2;
     }
-    return p2;
+    return p;
   }
   const digits = [];
   while (power > _0n2) {
@@ -6112,20 +6112,20 @@ class _Field {
   toBytes(num) {
     return this.isLE ? numberToBytesLE(num, this.BYTES) : numberToBytesBE(num, this.BYTES);
   }
-  fromBytes(bytes2, skipValidation = false) {
-    abytes4(bytes2);
-    const { _lengths: allowedLengths, BYTES, isLE: isLE3, ORDER, _mod: modFromBytes } = this;
+  fromBytes(bytes, skipValidation = false) {
+    abytes4(bytes);
+    const { _lengths: allowedLengths, BYTES, isLE, ORDER, _mod: modFromBytes } = this;
     if (allowedLengths) {
-      if (bytes2.length < 1 || !allowedLengths.includes(bytes2.length) || bytes2.length > BYTES) {
-        throw new Error("Field.fromBytes: expected " + allowedLengths + " bytes, got " + bytes2.length);
+      if (bytes.length < 1 || !allowedLengths.includes(bytes.length) || bytes.length > BYTES) {
+        throw new Error("Field.fromBytes: expected " + allowedLengths + " bytes, got " + bytes.length);
       }
       const padded = new Uint8Array(BYTES);
-      padded.set(bytes2, isLE3 ? 0 : padded.length - bytes2.length);
-      bytes2 = padded;
+      padded.set(bytes, isLE ? 0 : padded.length - bytes.length);
+      bytes = padded;
     }
-    if (bytes2.length !== BYTES)
-      throw new Error("Field.fromBytes: expected " + BYTES + " bytes, got " + bytes2.length);
-    let scalar = isLE3 ? bytesToNumberLE(bytes2) : bytesToNumberBE(bytes2);
+    if (bytes.length !== BYTES)
+      throw new Error("Field.fromBytes: expected " + BYTES + " bytes, got " + bytes.length);
+    let scalar = isLE ? bytesToNumberLE(bytes) : bytesToNumberBE(bytes);
     if (modFromBytes)
       scalar = mod(scalar, ORDER);
     if (!skipValidation) {
@@ -6158,16 +6158,16 @@ function getMinHashLength(fieldOrder) {
   const length = getFieldBytesLength(fieldOrder);
   return length + Math.ceil(length / 2);
 }
-function mapHashToField(key, fieldOrder, isLE3 = false) {
+function mapHashToField(key, fieldOrder, isLE = false) {
   abytes4(key);
   const len = key.length;
   const fieldLen = getFieldBytesLength(fieldOrder);
   const minLen = Math.max(getMinHashLength(fieldOrder), 16);
   if (len < minLen || len > 1024)
     throw new Error("expected " + minLen + "-1024 bytes of input, got " + len);
-  const num = isLE3 ? bytesToNumberLE(key) : bytesToNumberBE(key);
+  const num = isLE ? bytesToNumberLE(key) : bytesToNumberBE(key);
   const reduced = mod(num, fieldOrder - _1n2) + _1n2;
-  return isLE3 ? numberToBytesLE(reduced, fieldLen) : numberToBytesBE(reduced, fieldLen);
+  return isLE ? numberToBytesLE(reduced, fieldLen) : numberToBytesBE(reduced, fieldLen);
 }
 
 // ../../node_modules/.bun/@noble+curves@2.4.0/node_modules/@noble/curves/abstract/curve.js
@@ -6202,22 +6202,22 @@ function validateW(W, bits, min = 1) {
     throw new Error("invalid window size, expected [" + min + ".." + bits + "], got W=" + W);
 }
 function validateTableBytes(numPoints, fpBytes) {
-  const bytes2 = numPoints * (4 * fpBytes + 128);
-  if (bytes2 > TABLE_BYTES_MAX)
-    throw new Error("invalid window size: table would need ~" + Math.ceil(bytes2 / 2 ** 20) + " MiB, max " + TABLE_BYTES_MAX / 2 ** 20 + " MiB");
+  const bytes = numPoints * (4 * fpBytes + 128);
+  if (bytes > TABLE_BYTES_MAX)
+    throw new Error("invalid window size: table would need ~" + Math.ceil(bytes / 2 ** 20) + " MiB, max " + TABLE_BYTES_MAX / 2 ** 20 + " MiB");
 }
-function probeRandomBytes(randomBytes4, length) {
-  if (randomBytes4 === undefined)
+function probeRandomBytes(randomBytes, length) {
+  if (randomBytes === undefined)
     return;
-  afunction(randomBytes4, "randomBytes");
+  afunction(randomBytes, "randomBytes");
   try {
-    const probe = randomBytes4(length);
+    const probe = randomBytes(length);
     if (!isBytes4(probe) || probe.length !== length)
       return;
   } catch {
     return;
   }
-  return randomBytes4;
+  return randomBytes;
 }
 function validateMSMPoints(points, c) {
   aarray(points, "points");
@@ -6310,9 +6310,9 @@ class ScalarMultiplier {
   wnafPrecomputes = new WeakMap;
   baseCanBeBlinded;
   bits;
-  constructor(Point, randomBytes4) {
+  constructor(Point, randomBytes) {
     validatePointCons(Point);
-    this.randomBytes = probeRandomBytes(randomBytes4, BLIND_BYTES);
+    this.randomBytes = probeRandomBytes(randomBytes, BLIND_BYTES);
     this.Point = Point;
     this.BASE = Point.BASE;
     this.ZERO = Point.ZERO;
@@ -6469,14 +6469,14 @@ function mulAddUnsafe(c, points, scalars, allowOversized = false) {
   const digits = scalars.map((n) => wnafDigits(n, 4));
   return wnafWalk(c.ZERO, tables, digits);
 }
-function createField(order, field, isLE3) {
+function createField(order, field, isLE) {
   if (field) {
     if (field.ORDER !== order)
       throw new Error("Field.ORDER must match order: Fp == p, Fn == n");
     validateField(field);
     return field;
   } else {
-    return Field(order, { isLE: isLE3 });
+    return Field(order, { isLE });
   }
 }
 function createCurveFields(type, CURVE, curveOpts = {}, FpFnLE) {
@@ -6598,14 +6598,14 @@ var _DER = {
       return bytesToNumberBE(data);
     }
   },
-  toSig(bytes2, maxScalarBytes) {
-    const { Err: E, _int: int2, _tlv: tlv } = _DER;
+  toSig(bytes, maxScalarBytes) {
+    const { Err: E, _int: int, _tlv: tlv } = _DER;
     if (maxScalarBytes !== undefined) {
       asafenumber(maxScalarBytes, "maxScalarBytes");
       if (maxScalarBytes < 1)
         throw new E("invalid signature: maxScalarBytes must be positive");
     }
-    const data = abytes4(bytes2, undefined, "signature");
+    const data = abytes4(bytes, undefined, "signature");
     const { v: seqBytes, l: seqLeftBytes } = tlv.decode(48, data);
     if (seqLeftBytes.length)
       throw new E("invalid signature: left bytes after parsing");
@@ -6615,13 +6615,13 @@ var _DER = {
       throw new E("invalid signature: left bytes after parsing");
     if (maxScalarBytes !== undefined && (rBytes.length > maxScalarBytes || sBytes.length > maxScalarBytes))
       throw new E("invalid signature: integer too large");
-    return { r: int2.decode(rBytes), s: int2.decode(sBytes) };
+    return { r: int.decode(rBytes), s: int.decode(sBytes) };
   },
   hexFromSig(sig) {
-    const { _tlv: tlv, _int: int2 } = _DER;
+    const { _tlv: tlv, _int: int } = _DER;
     validateObject(sig, { r: "bigint", s: "bigint" }, {}, "sig");
-    const rs = tlv.encode(2, int2.encode(sig.r));
-    const ss = tlv.encode(2, int2.encode(sig.s));
+    const rs = tlv.encode(2, int.encode(sig.r));
+    const ss = tlv.encode(2, int.encode(sig.s));
     const seq = rs + ss;
     return tlv.encode(48, seq);
   }
@@ -6692,7 +6692,7 @@ function weierstrass(params, extraOpts = {}) {
     randomBytes: "function"
   });
   const { endo: endoOpts, allowInfinityPoint, clearCofactor, isTorsionFree, fromBytes, toBytes } = extraOpts;
-  const randomBytes4 = extraOpts.randomBytes === undefined ? randomBytes3 : extraOpts.randomBytes;
+  const randomBytes = extraOpts.randomBytes === undefined ? randomBytes3 : extraOpts.randomBytes;
   if (endoOpts) {
     if (!Fp.is0(CURVE.a) || typeof endoOpts.beta !== "bigint" || !Array.isArray(endoOpts.basises)) {
       throw new Error('invalid endo: expected "beta": bigint and "basises": array');
@@ -6724,12 +6724,12 @@ function weierstrass(params, extraOpts = {}) {
       return concatBytes2(Uint8Array.of(4), bx, Fp.toBytes(y));
     }
   }
-  function pointFromBytes(bytes2) {
-    abytes4(bytes2, undefined, "Point");
+  function pointFromBytes(bytes) {
+    abytes4(bytes, undefined, "Point");
     const { publicKey: comp, publicKeyUncompressed: uncomp } = lengths;
-    const length = bytes2.length;
-    const head = bytes2[0];
-    const tail = bytes2.subarray(1);
+    const length = bytes.length;
+    const head = bytes[0];
+    const tail = bytes.subarray(1);
     if (allowInfinityPoint && length === 1 && head === 0)
       return { x: Fp.ZERO, y: Fp.ZERO };
     if (length === comp && (head === 2 || head === 3)) {
@@ -6837,8 +6837,8 @@ function weierstrass(params, extraOpts = {}) {
         return Point.ZERO;
       return new Point(x, y, Fp.ONE);
     }
-    static fromBytes(bytes2) {
-      const P = Point.fromAffine(decodePoint(abytes4(bytes2, undefined, "point")));
+    static fromBytes(bytes) {
+      const P = Point.fromAffine(decodePoint(abytes4(bytes, undefined, "point")));
       P.assertValidity();
       return P;
     }
@@ -6985,8 +6985,8 @@ function weierstrass(params, extraOpts = {}) {
     multiply(scalar) {
       if (!Fn.isValidNot0(scalar))
         throw new RangeError("invalid scalar: out of range");
-      const { p, f } = wnaf.mulSecret(this, scalar, cofactor, normalize2);
-      return normalize2([p, f])[0];
+      const { p, f } = wnaf.mulSecret(this, scalar, cofactor, normalize);
+      return normalize([p, f])[0];
     }
     multiplyUnsafe(scalar) {
       const p = this;
@@ -6998,7 +6998,7 @@ function weierstrass(params, extraOpts = {}) {
       if (sc === _1n4)
         return p;
       if (wnaf.hasWindowSize(this))
-        return wnaf.mulUnsafe(p, sc, normalize2);
+        return wnaf.mulUnsafe(p, sc, normalize);
       const points = [];
       const scalars = [];
       pushWnafPair(points, scalars, p, sc);
@@ -7063,8 +7063,8 @@ function weierstrass(params, extraOpts = {}) {
       return `<Point ${this.is0() ? "ZERO" : this.toHex()}>`;
     }
   }
-  const normalize2 = (points) => normalizeZ(Point, points);
-  const wnaf = new ScalarMultiplier(Point, randomBytes4);
+  const normalize = (points) => normalizeZ(Point, points);
+  const wnaf = new ScalarMultiplier(Point, randomBytes);
   if (wnaf.bits >= 6)
     Point.BASE.precompute(6);
   Object.freeze(Point.prototype);
@@ -7098,15 +7098,15 @@ function ecdh(Point, ecdhOpts = {}) {
       return false;
     }
   }
-  function isValidPublicKey(publicKey2, isCompressed) {
+  function isValidPublicKey(publicKey, isCompressed) {
     const { publicKey: comp, publicKeyUncompressed } = lengths;
     try {
-      const l = publicKey2.length;
+      const l = publicKey.length;
       if (isCompressed === true && l !== comp)
         return false;
       if (isCompressed === false && l !== publicKeyUncompressed)
         return false;
-      return !Point.fromBytes(publicKey2).is0();
+      return !Point.fromBytes(publicKey).is0();
     } catch (error) {
       return false;
     }
@@ -7119,12 +7119,12 @@ function ecdh(Point, ecdhOpts = {}) {
     return Point.BASE.multiply(Fn.fromBytes(secretKey)).toBytes(isCompressed);
   }
   function isProbPub(item) {
-    const { secretKey, publicKey: publicKey2, publicKeyUncompressed } = lengths;
+    const { secretKey, publicKey, publicKeyUncompressed } = lengths;
     const allowedLengths = Fn._lengths;
     if (!isBytes4(item))
       return;
     const l = abytes4(item, undefined, "key").length;
-    const isPub = l === publicKey2 || l === publicKeyUncompressed;
+    const isPub = l === publicKey || l === publicKeyUncompressed;
     const isSec = l === secretKey || !!allowedLengths?.includes(l);
     if (isPub && isSec)
       return;
@@ -7163,12 +7163,12 @@ function ecdsa(Point, hash, ecdsaOpts = {}) {
     bits2int_modN: "function"
   });
   const opts = Object.assign({}, ecdsaOpts);
-  const randomBytes4 = opts.randomBytes === undefined ? randomBytes3 : opts.randomBytes;
+  const randomBytes = opts.randomBytes === undefined ? randomBytes3 : opts.randomBytes;
   const hmac2 = opts.hmac === undefined ? (key, msg) => hmac(hash_, key, msg) : opts.hmac;
   const { Fp, Fn } = Point;
   const { ORDER: CURVE_ORDER, BITS: fnBits } = Fn;
   const blindLength = getMinHashLength(CURVE_ORDER);
-  const csprng = probeRandomBytes(randomBytes4, blindLength);
+  const csprng = probeRandomBytes(randomBytes, blindLength);
   const { keygen, getPublicKey, getSharedSecret, utils, lengths } = ecdh(Point, opts);
   const defaultSigOpts = {
     prehash: true,
@@ -7198,11 +7198,11 @@ function ecdsa(Point, hash, ecdsaOpts = {}) {
     if (hasLargeRecoveryLifts)
       throw new Error('"recovered" sig type is not supported for cofactor >2 curves');
   }
-  function validateSigLength(bytes2, format) {
+  function validateSigLength(bytes, format) {
     validateSigFormat(format);
     const size = lengths.signature;
     const sizer = format === "compact" ? size : format === "recovered" ? size + 1 : undefined;
-    return abytes4(bytes2, sizer);
+    return abytes4(bytes, sizer);
   }
 
   class Signature {
@@ -7220,23 +7220,23 @@ function ecdsa(Point, hash, ecdsaOpts = {}) {
       }
       Object.freeze(this);
     }
-    static fromBytes(bytes2, format = defaultSigOpts.format) {
-      validateSigLength(bytes2, format);
+    static fromBytes(bytes, format = defaultSigOpts.format) {
+      validateSigLength(bytes, format);
       let recid;
       if (format === "der") {
-        if (bytes2.length > 2 * Fn.BYTES + 16)
+        if (bytes.length > 2 * Fn.BYTES + 16)
           throw new DER.Err("invalid signature: DER signature too long");
-        const { r: r2, s: s2 } = DER.toSig(abytes4(bytes2), Fn.BYTES + 1);
-        return new Signature(r2, s2);
+        const { r, s } = DER.toSig(abytes4(bytes), Fn.BYTES + 1);
+        return new Signature(r, s);
       }
       if (format === "recovered") {
-        recid = bytes2[0];
+        recid = bytes[0];
         format = "compact";
-        bytes2 = bytes2.subarray(1);
+        bytes = bytes.subarray(1);
       }
       const L = lengths.signature / 2;
-      const r = bytes2.subarray(0, L);
-      const s = bytes2.subarray(L, L * 2);
+      const r = bytes.subarray(0, L);
+      const s = bytes.subarray(L, L * 2);
       return new Signature(Fn.fromBytes(r), Fn.fromBytes(s), recid);
     }
     static fromHex(hex, format) {
@@ -7291,15 +7291,15 @@ function ecdsa(Point, hash, ecdsaOpts = {}) {
   }
   Object.freeze(Signature.prototype);
   Object.freeze(Signature);
-  const bits2int = opts.bits2int === undefined ? function bits2int_def(bytes2) {
-    if (bytes2.length > 8192)
+  const bits2int = opts.bits2int === undefined ? function bits2int_def(bytes) {
+    if (bytes.length > 8192)
       throw new Error("input is too large");
-    const num = bytesToNumberBE(bytes2);
-    const delta = bytes2.length * 8 - fnBits;
+    const num = bytesToNumberBE(bytes);
+    const delta = bytes.length * 8 - fnBits;
     return delta > 0 ? num >> BigInt(delta) : num;
   } : opts.bits2int;
-  const bits2int_modN = opts.bits2int_modN === undefined ? function bits2int_modN_def(bytes2) {
-    return Fn.create(bits2int(bytes2));
+  const bits2int_modN = opts.bits2int_modN === undefined ? function bits2int_modN_def(bytes) {
+    return Fn.create(bits2int(bytes));
   } : opts.bits2int_modN;
   const ORDER_MASK = bitMask(fnBits);
   function int2octets(num) {
@@ -7310,8 +7310,8 @@ function ecdsa(Point, hash, ecdsaOpts = {}) {
     abytes4(message, undefined, "message");
     return prehash ? abytes4(hash_(message), undefined, "prehashed message") : message;
   }
-  function prepSig(message, secretKey, opts2) {
-    const { lowS, prehash, extraEntropy } = validateSigOpts(opts2, defaultSigOpts);
+  function prepSig(message, secretKey, opts) {
+    const { lowS, prehash, extraEntropy } = validateSigOpts(opts, defaultSigOpts);
     message = validateMsgAndHash(message, prehash);
     const h1int = bits2int_modN(message);
     const d = Fn.fromBytes(secretKey);
@@ -7319,7 +7319,7 @@ function ecdsa(Point, hash, ecdsaOpts = {}) {
       throw new Error("invalid private key");
     const seedArgs = [int2octets(d), int2octets(h1int)];
     if (extraEntropy != null && extraEntropy !== false) {
-      const e = extraEntropy === true ? randomBytes4(lengths.secretKey) : extraEntropy;
+      const e = extraEntropy === true ? randomBytes(lengths.secretKey) : extraEntropy;
       seedArgs.push(abytes4(e, undefined, "extraEntropy"));
     }
     const seed = concatBytes2(...seedArgs);
@@ -7355,15 +7355,15 @@ function ecdsa(Point, hash, ecdsaOpts = {}) {
     }
     return { seed, k2sig };
   }
-  function sign(message, secretKey, opts2 = {}) {
-    const { seed, k2sig } = prepSig(message, secretKey, opts2);
+  function sign(message, secretKey, opts = {}) {
+    const { seed, k2sig } = prepSig(message, secretKey, opts);
     const drbg = createHmacDrbg(hash_.outputLen, Fn.BYTES, hmac2);
     const sig = drbg(seed, k2sig);
-    return sig.toBytes(opts2.format);
+    return sig.toBytes(opts.format);
   }
-  function verify(signature, message, publicKey2, opts2 = {}) {
-    const { lowS, prehash, format } = validateSigOpts(opts2, defaultSigOpts);
-    publicKey2 = abytes4(publicKey2, undefined, "publicKey");
+  function verify(signature, message, publicKey, opts = {}) {
+    const { lowS, prehash, format } = validateSigOpts(opts, defaultSigOpts);
+    publicKey = abytes4(publicKey, undefined, "publicKey");
     message = validateMsgAndHash(message, prehash);
     if (!isBytes4(signature)) {
       const end = signature instanceof Signature ? ", use sig.toBytes()" : "";
@@ -7372,7 +7372,7 @@ function ecdsa(Point, hash, ecdsaOpts = {}) {
     validateSigLength(signature, format);
     try {
       const sig = Signature.fromBytes(signature, format);
-      const P = Point.fromBytes(publicKey2);
+      const P = Point.fromBytes(publicKey);
       if (P.is0())
         return false;
       if (lowS && sig.hasHighS())
@@ -7396,8 +7396,8 @@ function ecdsa(Point, hash, ecdsaOpts = {}) {
       return false;
     }
   }
-  function recoverPublicKey(signature, message, opts2 = {}) {
-    const { prehash } = validateSigOpts(opts2, defaultSigOpts);
+  function recoverPublicKey(signature, message, opts = {}) {
+    const { prehash } = validateSigOpts(opts, defaultSigOpts);
     message = validateMsgAndHash(message, prehash);
     return Signature.fromBytes(signature, "recovered").recoverPublicKey(message).toBytes();
   }
@@ -7438,19 +7438,19 @@ var _0n6 = /* @__PURE__ */ BigInt(0);
 var _2n3 = /* @__PURE__ */ BigInt(2);
 function sqrtMod(y) {
   const P = secp256k1_CURVE.p;
-  const _3n3 = BigInt(3), _6n = BigInt(6), _11n = BigInt(11), _22n = BigInt(22);
+  const _3n = BigInt(3), _6n = BigInt(6), _11n = BigInt(11), _22n = BigInt(22);
   const _23n = BigInt(23), _44n = BigInt(44), _88n = BigInt(88);
   const b2 = y * y * y % P;
   const b3 = b2 * b2 * y % P;
-  const b6 = pow2(b3, _3n3, P) * b3 % P;
-  const b9 = pow2(b6, _3n3, P) * b3 % P;
+  const b6 = pow2(b3, _3n, P) * b3 % P;
+  const b9 = pow2(b6, _3n, P) * b3 % P;
   const b11 = pow2(b9, _2n3, P) * b2 % P;
   const b22 = pow2(b11, _11n, P) * b11 % P;
   const b44 = pow2(b22, _22n, P) * b22 % P;
   const b88 = pow2(b44, _44n, P) * b44 % P;
   const b176 = pow2(b88, _88n, P) * b88 % P;
   const b220 = pow2(b176, _44n, P) * b44 % P;
-  const b223 = pow2(b220, _3n3, P) * b3 % P;
+  const b223 = pow2(b220, _3n, P) * b3 % P;
   const t1 = pow2(b223, _23n, P) * b22 % P;
   const t2 = pow2(t1, _6n, P) * b2 % P;
   const root = pow2(t2, _2n3, P);
@@ -7527,11 +7527,11 @@ function schnorrSign(message, secretKey, auxRand = randomBytes(32)) {
     throw new Error("sign: Invalid signature produced");
   return sig;
 }
-function schnorrVerify(signature, message, publicKey2) {
+function schnorrVerify(signature, message, publicKey) {
   const { Fp, Fn, BASE } = Pointk1;
   const sig = abytes4(signature, 64, "signature");
   const m = abytes4(message, undefined, "message");
-  const pub = abytes4(publicKey2, 32, "publicKey");
+  const pub = abytes4(publicKey, 32, "publicKey");
   try {
     const P = lift_x(num(pub));
     const rBytes = sig.subarray(0, 32);
@@ -7787,7 +7787,7 @@ class HDKey {
     }
     const keyView = createView(keyBuffer);
     const version = keyView.getUint32(0, false);
-    const opt2 = {
+    const opt = {
       versions,
       depth: keyBuffer[4],
       parentFingerprint: keyView.getUint32(5, false),
@@ -7800,9 +7800,9 @@ class HDKey {
       throw new Error("Version mismatch");
     }
     if (isPriv) {
-      return new HDKey({ ...opt2, privateKey: key.slice(1) });
+      return new HDKey({ ...opt, privateKey: key.slice(1) });
     } else {
-      return new HDKey({ ...opt2, publicKey: key });
+      return new HDKey({ ...opt, publicKey: key });
     }
   }
   static fromJSON(json) {
@@ -7816,13 +7816,13 @@ class HDKey {
   _privateKey;
   _publicKey;
   _pubHash;
-  constructor(opt2) {
-    if (!opt2 || typeof opt2 !== "object") {
+  constructor(opt) {
+    if (!opt || typeof opt !== "object") {
       throw new Error("HDKey.constructor must not be called directly");
     }
-    const depth = opt2.depth ?? 0;
-    const index = opt2.index ?? 0;
-    const parentFingerprint = opt2.parentFingerprint ?? 0;
+    const depth = opt.depth ?? 0;
+    const index = opt.index ?? 0;
+    const parentFingerprint = opt.parentFingerprint ?? 0;
     if (!Number.isSafeInteger(depth) || depth < 0 || depth > MAX_DEPTH) {
       throw new RangeError("HDKey: depth must be an integer in range 0..255");
     }
@@ -7831,23 +7831,23 @@ class HDKey {
     if (depth === 0 && (index !== 0 || parentFingerprint !== 0)) {
       throw new Error("HDKey: zero depth with non-zero index/parent fingerprint");
     }
-    this.versions = opt2.versions ? validateVersions(opt2.versions) : BITCOIN_VERSIONS;
+    this.versions = opt.versions ? validateVersions(opt.versions) : BITCOIN_VERSIONS;
     this.depth = depth;
-    if (opt2.chainCode)
-      abytes(opt2.chainCode, 32);
-    this._chainCode = opt2.chainCode ? Uint8Array.from(opt2.chainCode) : null;
+    if (opt.chainCode)
+      abytes(opt.chainCode, 32);
+    this._chainCode = opt.chainCode ? Uint8Array.from(opt.chainCode) : null;
     this.index = index;
     this.parentFingerprint = parentFingerprint;
-    if (opt2.publicKey && opt2.privateKey) {
+    if (opt.publicKey && opt.privateKey) {
       throw new Error("HDKey: publicKey and privateKey at same time.");
     }
-    if (opt2.privateKey) {
-      if (!secp256k1.utils.isValidSecretKey(opt2.privateKey))
+    if (opt.privateKey) {
+      if (!secp256k1.utils.isValidSecretKey(opt.privateKey))
         throw new Error("Invalid private key");
-      this._privateKey = Uint8Array.from(opt2.privateKey);
+      this._privateKey = Uint8Array.from(opt.privateKey);
       this._publicKey = secp256k1.getPublicKey(this._privateKey, true);
-    } else if (opt2.publicKey) {
-      this._publicKey = Point.fromBytes(opt2.publicKey).toBytes(true);
+    } else if (opt.publicKey) {
+      this._publicKey = Point.fromBytes(opt.publicKey).toBytes(true);
     } else {
       throw new Error("HDKey: no public or private key provided");
     }
@@ -7902,14 +7902,14 @@ class HDKey {
     abytes(out, 64);
     const childTweak = out.slice(0, 32);
     const chainCode = out.slice(32);
-    const opt2 = {
+    const opt = {
       versions: this.versions,
       chainCode,
       depth: this.depth + 1,
       parentFingerprint: this.fingerprint,
       index
     };
-    if (opt2.depth > MAX_DEPTH) {
+    if (opt.depth > MAX_DEPTH) {
       throw new Error("HDKey: depth exceeds the serializable value 255");
     }
     const retry = () => {
@@ -7926,15 +7926,15 @@ class HDKey {
       const added = Fn.create(Fn.fromBytes(this._privateKey) + ctweak);
       if (!Fn.isValidNot0(added))
         return retry();
-      opt2.privateKey = Fn.toBytes(added);
+      opt.privateKey = Fn.toBytes(added);
     } else {
       const point = Point.fromBytes(this._publicKey);
       const added = ctweak === 0n ? point : point.add(Point.BASE.multiply(ctweak));
       if (added.equals(Point.ZERO))
         return retry();
-      opt2.publicKey = added.toBytes(true);
+      opt.publicKey = added.toBytes(true);
     }
-    return new HDKey(opt2);
+    return new HDKey(opt);
   }
   sign(hash) {
     if (!this._privateKey) {
@@ -7983,11 +7983,11 @@ function masterKey(seed) {
 
 // ../wallet-kernel/src/derive/wallet-id.ts
 function walletIdOf(master) {
-  const { publicKey: publicKey2 } = master;
-  if (publicKey2 === null || publicKey2.length !== 33) {
+  const { publicKey } = master;
+  if (publicKey === null || publicKey.length !== 33) {
     throw new KernelError("integrity", "master key has no compressed public key");
   }
-  return bytesToHex(sha256(concatBytes(utf8ToBytes("qntx-wallet/wallet-id/v1"), publicKey2)).slice(0, 8));
+  return bytesToHex(sha256(concatBytes(utf8ToBytes("qntx-wallet/wallet-id/v1"), publicKey)).slice(0, 8));
 }
 
 // ../wallet-kernel/src/seed/entropy.ts
@@ -8013,17 +8013,17 @@ function entropyFromPrf(prf) {
 }
 
 // ../wallet-kernel/src/seed/seed.ts
-async function seedFromMnemonic(mnemonic, passphrase, pbkdf22) {
+async function seedFromMnemonic(mnemonic, passphrase, pbkdf2) {
   const password = utf8ToBytes(mnemonic.normalize("NFKD"));
   const salt = utf8ToBytes(`mnemonic${passphrase}`.normalize("NFKD"));
   try {
-    return await pbkdf22("sha512", password, salt, 2048, 64);
+    return await pbkdf2("sha512", password, salt, 2048, 64);
   } finally {
     wipe(password, salt);
   }
 }
-async function seedFromEntropy(entropy, pbkdf22) {
-  return seedFromMnemonic(mnemonicFromEntropy(entropy), "", pbkdf22);
+async function seedFromEntropy(entropy, pbkdf2) {
+  return seedFromMnemonic(mnemonicFromEntropy(entropy), "", pbkdf2);
 }
 
 // ../wallet-kernel/src/commands/wallets.ts
@@ -8037,9 +8037,9 @@ async function deriveWalletMaterial(platform, entropy) {
   }
 }
 async function walletMaterial(platform, entropy, origin, words) {
-  const { master, walletId: walletId2 } = await deriveWalletMaterial(platform, entropy);
+  const { master, walletId } = await deriveWalletMaterial(platform, entropy);
   try {
-    return { walletId: walletId2, entropy, words, origin };
+    return { walletId, entropy, words, origin };
   } finally {
     master.wipePrivateData();
   }
@@ -8063,25 +8063,25 @@ function walletRecord(ctx, dek, material, backedUp, createdAt) {
   });
   return sealRecord(ctx.platform, dek, "entropy", material.walletId, header, new Uint8Array(material.entropy));
 }
-function gate(ctx, factor2, requestSession) {
+function gate(ctx, factor, requestSession) {
   if (ctx.image.meta === undefined) {
-    if (factor2 === undefined) {
+    if (factor === undefined) {
       throw new KernelError("invalid-input", "an initial factor is required");
     }
     return { uninitialized: true, dek: Secret.take(ctx.platform.random(32)) };
   }
-  if (factor2 !== undefined) {
+  if (factor !== undefined) {
     throw new KernelError("invalid-input", "vault is already initialized");
   }
   const session = ctx.session.require(requestSession);
   return { uninitialized: false, dek: session.dek };
 }
-async function commitRecords(ctx, gated, factor2, records) {
+async function commitRecords(ctx, gated, factor, records) {
   if (gated.uninitialized) {
-    if (factor2 === undefined) {
+    if (factor === undefined) {
       throw new KernelError("integrity", "unreachable: initial factor missing");
     }
-    const storedFactor = await makeFactor(ctx.platform, factor2, gated.dek);
+    const storedFactor = await makeFactor(ctx.platform, factor, gated.dek);
     try {
       await ctx.commit([...establishOps(storedFactor, records)]);
     } catch (error) {
@@ -8104,17 +8104,17 @@ function quizPositions(random, count) {
   while (picked.size < 3) {
     const draw = random(4);
     for (let i = 0;i < 4 && picked.size < 3; i++) {
-      const b2 = draw[i];
-      if (b2 !== undefined && b2 < limit) {
-        picked.add(b2 % count);
+      const b = draw[i];
+      if (b !== undefined && b < limit) {
+        picked.add(b % count);
       }
     }
   }
   const [a, b, c] = [...picked];
   return [a ?? 0, b ?? 0, c ?? 0];
 }
-async function pendingFactorOf(ctx, factor2) {
-  const material = await newFactorKek(ctx.platform, factor2);
+async function pendingFactorOf(ctx, factor) {
+  const material = await newFactorKek(ctx.platform, factor);
   return material.kind === "password" ? { kind: "password", kek: Secret.take(material.kek), salt: material.salt } : { kind: "passkey", kek: Secret.take(material.kek), credentialId: material.credentialId };
 }
 async function createMnemonic(ctx, params, requestSession) {
@@ -8166,7 +8166,7 @@ async function confirmMnemonic(ctx, params) {
   }
   const taken = ctx.session.takeDraft(params.draft);
   try {
-    const entropy = taken.entropy.use((bytes2) => new Uint8Array(bytes2));
+    const entropy = taken.entropy.use((bytes) => new Uint8Array(bytes));
     const material = await walletMaterial(ctx.platform, entropy, "mnemonic", taken.words);
     try {
       ensureNewWallet(ctx, material);
@@ -8174,15 +8174,15 @@ async function confirmMnemonic(ctx, params) {
       if (taken.pendingFactor !== undefined) {
         const dek = Secret.take(ctx.platform.random(32));
         const storedFactor = storedFactorForPending(ctx, taken.pendingFactor, dek);
-        const record2 = walletRecord(ctx, dek, material, true, createdAt);
+        const record = walletRecord(ctx, dek, material, true, createdAt);
         try {
-          await ctx.commit(establishOps(storedFactor, [record2]));
+          await ctx.commit(establishOps(storedFactor, [record]));
         } catch (error) {
           dek.wipe();
           throw error;
         }
-        const session2 = ctx.session.open(dek);
-        return { wallet: walletInfoOf(material, true, createdAt), session: session2 };
+        const session = ctx.session.open(dek);
+        return { wallet: walletInfoOf(material, true, createdAt), session };
       }
       const session = ctx.session.current();
       const record = walletRecord(ctx, session.dek, material, true, createdAt);
@@ -8298,8 +8298,8 @@ var utf8Encoder = new TextEncoder;
 var utf8Decoder = new TextDecoder;
 var HEX32_RE = /^[0-9a-f]{64}$/;
 var HEX64_RE = /^[0-9a-f]{128}$/;
-function bytesToHex$1(bytes2) {
-  return bytesToHex(bytes2);
+function bytesToHex$1(bytes) {
+  return bytesToHex(bytes);
 }
 function hexToBytes$1(hex) {
   try {
@@ -8320,12 +8320,12 @@ function assertHex32(value, label) {
     throw new HexError(`invalid ${label}: expected 64-char hex`);
   return normalized;
 }
-function assertByteLength(bytes2, expected, label) {
-  if (bytes2.length !== expected)
-    throw new HexError(`invalid ${label} length: expected ${expected}, got ${bytes2.length}`);
+function assertByteLength(bytes, expected, label) {
+  if (bytes.length !== expected)
+    throw new HexError(`invalid ${label} length: expected ${expected}, got ${bytes.length}`);
 }
-function assertSecretKeyBytes(bytes2) {
-  assertByteLength(bytes2, 32, "secret key");
+function assertSecretKeyBytes(bytes) {
+  assertByteLength(bytes, 32, "secret key");
 }
 function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -8461,20 +8461,20 @@ function getEventHash(event) {
 }
 
 // ../../node_modules/.bun/@qntx+nostr@0.14.0+ea9f70ecde856c26/node_modules/@qntx/nostr/dist/key-D_oEutQ6.mjs
-var SecretKey = class SecretKey2 {
+var SecretKey = class SecretKey {
   #bytes;
-  constructor(bytes2) {
-    assertSecretKeyBytes(bytes2);
-    this.#bytes = new Uint8Array(bytes2);
+  constructor(bytes) {
+    assertSecretKeyBytes(bytes);
+    this.#bytes = new Uint8Array(bytes);
   }
   static generate() {
-    return new SecretKey2(schnorr.utils.randomSecretKey());
+    return new SecretKey(schnorr.utils.randomSecretKey());
   }
-  static fromBytes(bytes2) {
-    return new SecretKey2(bytes2);
+  static fromBytes(bytes) {
+    return new SecretKey(bytes);
   }
   static fromHex(hex) {
-    return new SecretKey2(hexToBytes$1(assertHex32(hex, "secret key")));
+    return new SecretKey(hexToBytes$1(assertHex32(hex, "secret key")));
   }
   get bytes() {
     if (!this.#bytes)
@@ -8505,7 +8505,7 @@ var nobleSigning = {
 function getPublicKey(secretKey) {
   return bytesToHex$1(schnorr.getPublicKey(toSecretKey(secretKey).bytes));
 }
-var Keys = class Keys2 {
+var Keys = class Keys {
   secretKey;
   publicKey;
   backend;
@@ -8524,10 +8524,10 @@ var Keys = class Keys2 {
     this.publicKey = bytesToHex$1(pubkey);
   }
   static generate(backend = nobleSigning) {
-    return new Keys2(SecretKey.generate(), backend);
+    return new Keys(SecretKey.generate(), backend);
   }
   static fromSecretKey(secretKey, backend = nobleSigning) {
-    return new Keys2(toSecretKey(secretKey), backend);
+    return new Keys(toSecretKey(secretKey), backend);
   }
 };
 function resolveKeys(secretKey) {
@@ -8636,25 +8636,25 @@ var sbox = /* @__PURE__ */ (() => {
 var invSbox = /* @__PURE__ */ sbox.map((_, j) => sbox.indexOf(j));
 var rotr32_8 = (n) => n << 24 | n >>> 8;
 var rotl32_8 = (n) => n << 8 | n >>> 24;
-function genTtable(sbox2, fn) {
-  if (sbox2.length !== 256)
+function genTtable(sbox, fn) {
+  if (sbox.length !== 256)
     throw new Error("wrong sbox length");
-  const T0 = new Uint32Array(256).map((_, j) => fn(sbox2[j]));
+  const T0 = new Uint32Array(256).map((_, j) => fn(sbox[j]));
   const T1 = T0.map(rotl32_8);
   const T2 = T1.map(rotl32_8);
   const T3 = T2.map(rotl32_8);
   const T01 = new Uint32Array(256 * 256);
   const T23 = new Uint32Array(256 * 256);
-  const sbox22 = new Uint16Array(256 * 256);
+  const sbox2 = new Uint16Array(256 * 256);
   for (let i = 0;i < 256; i++) {
     for (let j = 0;j < 256; j++) {
       const idx = i * 256 + j;
       T01[idx] = T0[i] ^ T1[j];
       T23[idx] = T2[i] ^ T3[j];
-      sbox22[idx] = sbox2[i] << 8 | sbox2[j];
+      sbox2[idx] = sbox[i] << 8 | sbox[j];
     }
   }
-  return { sbox: sbox2, sbox2: sbox22, T0, T1, T2, T3, T01, T23 };
+  return { sbox, sbox2, T0, T1, T2, T3, T01, T23 };
 }
 var tableEncoding = /* @__PURE__ */ genTtable(sbox, (s) => mul(s, 3) << 24 | s << 16 | s << 8 | mul(s, 2));
 var tableDecoding = /* @__PURE__ */ genTtable(invSbox, (s) => mul(s, 11) << 24 | mul(s, 13) << 16 | mul(s, 9) << 8 | mul(s, 14));
@@ -8718,11 +8718,11 @@ function encrypt(xk, s0, s1, s2, s3) {
   s0 ^= xk[k++], s1 ^= xk[k++], s2 ^= xk[k++], s3 ^= xk[k++];
   const rounds = xk.length / 4 - 2;
   for (let i = 0;i < rounds; i++) {
-    const t02 = xk[k++] ^ apply0123(T01, T23, s0, s1, s2, s3);
-    const t12 = xk[k++] ^ apply0123(T01, T23, s1, s2, s3, s0);
-    const t22 = xk[k++] ^ apply0123(T01, T23, s2, s3, s0, s1);
-    const t32 = xk[k++] ^ apply0123(T01, T23, s3, s0, s1, s2);
-    s0 = t02, s1 = t12, s2 = t22, s3 = t32;
+    const t0 = xk[k++] ^ apply0123(T01, T23, s0, s1, s2, s3);
+    const t1 = xk[k++] ^ apply0123(T01, T23, s1, s2, s3, s0);
+    const t2 = xk[k++] ^ apply0123(T01, T23, s2, s3, s0, s1);
+    const t3 = xk[k++] ^ apply0123(T01, T23, s3, s0, s1, s2);
+    s0 = t0, s1 = t1, s2 = t2, s3 = t3;
   }
   const t0 = xk[k++] ^ applySbox(sbox2, s0, s1, s2, s3);
   const t1 = xk[k++] ^ applySbox(sbox2, s1, s2, s3, s0);
@@ -8736,11 +8736,11 @@ function decrypt(xk, s0, s1, s2, s3) {
   s0 ^= xk[k++], s1 ^= xk[k++], s2 ^= xk[k++], s3 ^= xk[k++];
   const rounds = xk.length / 4 - 2;
   for (let i = 0;i < rounds; i++) {
-    const t02 = xk[k++] ^ apply0123(T01, T23, s0, s3, s2, s1);
-    const t12 = xk[k++] ^ apply0123(T01, T23, s1, s0, s3, s2);
-    const t22 = xk[k++] ^ apply0123(T01, T23, s2, s1, s0, s3);
-    const t32 = xk[k++] ^ apply0123(T01, T23, s3, s2, s1, s0);
-    s0 = t02, s1 = t12, s2 = t22, s3 = t32;
+    const t0 = xk[k++] ^ apply0123(T01, T23, s0, s3, s2, s1);
+    const t1 = xk[k++] ^ apply0123(T01, T23, s1, s0, s3, s2);
+    const t2 = xk[k++] ^ apply0123(T01, T23, s2, s1, s0, s3);
+    const t3 = xk[k++] ^ apply0123(T01, T23, s3, s2, s1, s0);
+    s0 = t0, s1 = t1, s2 = t2, s3 = t3;
   }
   const t0 = xk[k++] ^ applySbox(sbox2, s0, s3, s2, s1);
   const t1 = xk[k++] ^ applySbox(sbox2, s1, s0, s3, s2);
@@ -8938,8 +8938,8 @@ var minPlaintextSize = 1;
 var maxPlaintextSize = 4294967295;
 var extendedPrefixThreshold = 65536;
 var DEFAULT_MAX_PAYLOAD_CHARS = Math.ceil((71 + calcPaddedLen(1048576)) / 3) * 4;
-function assert32(bytes2, label) {
-  if (bytes2.length !== 32)
+function assert32(bytes, label) {
+  if (bytes.length !== 32)
     throw new CryptoError(`${label} must be 32 bytes`);
 }
 function getConversationKey(privkeyA, pubkeyB) {
@@ -8970,19 +8970,19 @@ function calcPaddedLen(len) {
   const chunk = nextPower <= 256 ? 32 : nextPower / 8;
   return chunk * (Math.floor((len - 1) / chunk) + 1);
 }
-function writeU16BE(num2) {
-  if (!Number.isSafeInteger(num2) || num2 < minPlaintextSize || num2 > 65535)
+function writeU16BE(num) {
+  if (!Number.isSafeInteger(num) || num < minPlaintextSize || num > 65535)
     throw new CryptoError("invalid plaintext size: must be between 1 and 65535 bytes");
-  const arr2 = /* @__PURE__ */ new Uint8Array(2);
-  new DataView(arr2.buffer).setUint16(0, num2, false);
-  return arr2;
+  const arr = /* @__PURE__ */ new Uint8Array(2);
+  new DataView(arr.buffer).setUint16(0, num, false);
+  return arr;
 }
-function writeU32BE(num2) {
-  if (!Number.isSafeInteger(num2) || num2 < extendedPrefixThreshold || num2 > maxPlaintextSize)
+function writeU32BE(num) {
+  if (!Number.isSafeInteger(num) || num < extendedPrefixThreshold || num > maxPlaintextSize)
     throw new CryptoError("invalid plaintext size: must be between 65536 and 4294967295 bytes");
-  const arr2 = /* @__PURE__ */ new Uint8Array(4);
-  new DataView(arr2.buffer).setUint32(0, num2, false);
-  return arr2;
+  const arr = /* @__PURE__ */ new Uint8Array(4);
+  new DataView(arr.buffer).setUint32(0, num, false);
+  return arr;
 }
 function pad(plaintext) {
   const unpadded = utf8Encoder.encode(plaintext);
@@ -9132,11 +9132,11 @@ var KeysSigner = class {
 };
 // ../wallet-kernel/src/modules/nostr/derive.ts
 var NIP06_PATH = "m/44'/1237'/i'/0/0";
-function nostrKeyAt(master, groupIndex2) {
-  if (!Number.isSafeInteger(groupIndex2) || groupIndex2 < 0 || groupIndex2 > 2147483647) {
+function nostrKeyAt(master, groupIndex) {
+  if (!Number.isSafeInteger(groupIndex) || groupIndex < 0 || groupIndex > 2147483647) {
     throw new KernelError("invalid-input", "group index out of range");
   }
-  const path = NIP06_PATH.split("/").map((segment) => segment === "i'" ? `${groupIndex2}'` : segment).join("/");
+  const path = NIP06_PATH.split("/").map((segment) => segment === "i'" ? `${groupIndex}'` : segment).join("/");
   const node = master.derive(path);
   try {
     const key = node.privateKey;
@@ -9181,15 +9181,15 @@ function encodeBech32(prefix, data) {
   const words = bech32.toWords(data);
   return bech32.encode(prefix, words, Bech32MaxSize2);
 }
-function encodeBytes(prefix, bytes2) {
-  return encodeBech32(prefix, bytes2);
+function encodeBytes(prefix, bytes) {
+  return encodeBech32(prefix, bytes);
 }
 function nsecEncode2(key) {
   assertByteLength(key, 32, "secret key");
   return encodeBytes("nsec", key);
 }
-function readUint32(bytes2) {
-  return new DataView(bytes2.buffer, bytes2.byteOffset, bytes2.byteLength).getUint32(0);
+function readUint32(bytes) {
+  return new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength).getUint32(0);
 }
 function decode2(code) {
   let prefix;
@@ -9493,8 +9493,8 @@ async function encrypt4(secretKey, password, opts) {
   const nonce = randomBytes(NONCE_LEN);
   const aad = Uint8Array.from([opts?.ksb ?? 2]);
   const ciphertext = xchacha20poly1305(key, nonce, aad).encrypt(secretKey);
-  const bytes2 = concatBytes(Uint8Array.from([VERSION2]), Uint8Array.from([logn]), salt, nonce, aad, ciphertext);
-  return encodeBytes("ncryptsec", bytes2);
+  const bytes = concatBytes(Uint8Array.from([VERSION2]), Uint8Array.from([logn]), salt, nonce, aad, ciphertext);
+  return encodeBytes("ncryptsec", bytes);
 }
 async function decrypt4(ncryptsec, password, opts) {
   const { maxLogN } = opts;
@@ -9559,10 +9559,10 @@ function isGiftWrapKind(kind) {
   return kind === Kind.GiftWrap || kind === Kind.GiftWrapEphemeral;
 }
 function requireNip44Decryptor(crypto2) {
-  const decrypt5 = crypto2.nip44Decrypt;
-  if (!decrypt5)
+  const decrypt = crypto2.nip44Decrypt;
+  if (!decrypt)
     throw new Nip59Error("NIP-44 is required");
-  return { nip44Decrypt: async (peer, payload) => decrypt5.call(crypto2, peer, payload) };
+  return { nip44Decrypt: async (peer, payload) => decrypt.call(crypto2, peer, payload) };
 }
 function parseJson(text) {
   try {
@@ -9617,10 +9617,10 @@ async function unwrap(crypto2, giftWrap) {
       throw new Nip59Error("seal tags must be empty");
   if (!verifyEvent(sealRaw))
     throw new Nip59Error("seal signature");
-  const rumor2 = parseRumor(parseJson(await decryptLayer(decryptor, sealRaw.pubkey, sealRaw.content)));
-  if (sealRaw.pubkey.toLowerCase() !== rumor2.pubkey.toLowerCase())
+  const rumor = parseRumor(parseJson(await decryptLayer(decryptor, sealRaw.pubkey, sealRaw.content)));
+  if (sealRaw.pubkey.toLowerCase() !== rumor.pubkey.toLowerCase())
     throw new Nip59Error("seal pubkey does not match rumor pubkey");
-  return rumor2;
+  return rumor;
 }
 
 // ../wallet-kernel/src/modules/nostr/pool.ts
@@ -9629,25 +9629,25 @@ class SignerPool {
   add(secretKey) {
     try {
       const signer = new KeysSigner(Keys.fromSecretKey(secretKey));
-      const { publicKey: publicKey2 } = signer.keys;
-      this.signers.set(publicKey2, signer);
-      return publicKey2;
+      const { publicKey } = signer.keys;
+      this.signers.set(publicKey, signer);
+      return publicKey;
     } finally {
       wipe(secretKey);
     }
   }
-  get(publicKey2) {
-    const signer = this.signers.get(publicKey2);
+  get(publicKey) {
+    const signer = this.signers.get(publicKey);
     if (signer === undefined) {
       throw new KernelError("not-found", "no such nostr key");
     }
     return signer;
   }
-  remove(publicKey2) {
-    const signer = this.signers.get(publicKey2);
+  remove(publicKey) {
+    const signer = this.signers.get(publicKey);
     if (signer !== undefined) {
       signer.dispose();
-      this.signers.delete(publicKey2);
+      this.signers.delete(publicKey);
     }
   }
   dispose() {
@@ -9699,26 +9699,26 @@ async function ncryptsecFromSecretKey(secretKey, password, ksb) {
   const encoded = await encrypt4(secretKey, text, { logn: 16, ksb });
   return new TextEncoder().encode(encoded);
 }
-async function signEvent2(pool, publicKey2, event) {
-  if (event.pubkey !== undefined && event.pubkey !== publicKey2) {
+async function signEvent2(pool, publicKey, event) {
+  if (event.pubkey !== undefined && event.pubkey !== publicKey) {
     throw new KernelError("invalid-input", "event pubkey does not match the selected key");
   }
   const unsigned = {
-    pubkey: publicKey2,
+    pubkey: publicKey,
     kind: event.kind,
     created_at: event.created_at,
     tags: event.tags,
     content: event.content
   };
-  return pool.get(publicKey2).signEvent(unsigned);
+  return pool.get(publicKey).signEvent(unsigned);
 }
-async function unwrapGiftWrap(pool, publicKey2, event) {
+async function unwrapGiftWrap(pool, publicKey, event) {
   if (!isGiftWrapKind(event.kind)) {
     return { err: "invalid-input" };
   }
   try {
-    const rumor2 = await unwrap(pool.get(publicKey2), event);
-    return { ok: rumor2 };
+    const rumor = await unwrap(pool.get(publicKey), event);
+    return { ok: rumor };
   } catch (error) {
     const err = error instanceof KernelError ? error.code : "integrity";
     return { err };
@@ -9742,12 +9742,12 @@ function encodeNostrKeyHeader(header) {
 }
 function parseNostrKeyHeader(text) {
   const object = headerObject(text);
-  const publicKey2 = asPublicKey(object["publicKey"]);
+  const publicKey = asPublicKey(object["publicKey"]);
   const createdAt = asCreatedAt(object["createdAt"]);
   if (object["origin"] === "derived") {
     expectKeys(object, ["publicKey", "origin", "walletId", "groupIndex", "createdAt"]);
     return {
-      publicKey: publicKey2,
+      publicKey,
       origin: "derived",
       walletId: asWalletId(object["walletId"]),
       groupIndex: asGroupIndex(object["groupIndex"]),
@@ -9759,7 +9759,7 @@ function parseNostrKeyHeader(text) {
   if (origin !== "nsec" && origin !== "ncryptsec" && origin !== "generated" && origin !== "nip46-client") {
     throw headerFailure();
   }
-  return { publicKey: publicKey2, origin, createdAt };
+  return { publicKey, origin, createdAt };
 }
 function nostrKeyInfo2(header) {
   return {
@@ -9786,18 +9786,18 @@ function nostrStatus2(records) {
 function keyRecord(ctx, dek, secretKey, header) {
   return sealRecord(ctx.platform, dek, NOSTR_KEY_KIND, header.publicKey, encodeNostrKeyHeader(header), new Uint8Array(secretKey));
 }
-function ensureNewKey(ctx, publicKey2) {
-  if (ctx.image.records.some((r) => r.kind === NOSTR_KEY_KIND && r.id === publicKey2)) {
+function ensureNewKey(ctx, publicKey) {
+  if (ctx.image.records.some((r) => r.kind === NOSTR_KEY_KIND && r.id === publicKey)) {
     throw new KernelError("already-exists", "nostr key already exists");
   }
 }
-async function addKey(ctx, pool, secretKey, origin, factor2, requestSession) {
-  const gated = gate(ctx, factor2, requestSession);
-  const publicKey2 = getPublicKey(secretKey);
-  ensureNewKey(ctx, publicKey2);
-  const header = { publicKey: publicKey2, origin, createdAt: ctx.platform.now() };
+async function addKey(ctx, pool, secretKey, origin, factor, requestSession) {
+  const gated = gate(ctx, factor, requestSession);
+  const publicKey = getPublicKey(secretKey);
+  ensureNewKey(ctx, publicKey);
+  const header = { publicKey, origin, createdAt: ctx.platform.now() };
   const record = keyRecord(ctx, gated.dek, secretKey, header);
-  const session = await commitRecords(ctx, gated, factor2, [record]);
+  const session = await commitRecords(ctx, gated, factor, [record]);
   pool.add(secretKey);
   return { key: nostrKeyInfo2(header), session };
 }
@@ -9822,10 +9822,10 @@ async function createNip46ClientKey(ctx, pool, requestSession) {
   const { dek } = ctx.session.require(requestSession);
   const secretKey = generateSecretKey(ctx.platform.random);
   try {
-    const publicKey2 = getPublicKey(secretKey);
-    ensureNewKey(ctx, publicKey2);
+    const publicKey = getPublicKey(secretKey);
+    ensureNewKey(ctx, publicKey);
     const header = {
-      publicKey: publicKey2,
+      publicKey,
       origin: "nip46-client",
       createdAt: ctx.platform.now()
     };
@@ -9847,10 +9847,10 @@ async function deriveKey2(ctx, pool, params, requestSession) {
   try {
     const secretKey = nostrKeyAt(master, params.groupIndex);
     try {
-      const publicKey2 = getPublicKey(secretKey);
-      ensureNewKey(ctx, publicKey2);
+      const publicKey = getPublicKey(secretKey);
+      ensureNewKey(ctx, publicKey);
       const header = {
-        publicKey: publicKey2,
+        publicKey,
         origin: "derived",
         walletId: params.walletId,
         groupIndex: params.groupIndex,
@@ -9877,9 +9877,9 @@ async function discover(ctx, params, requestSession) {
   wipe(seed);
   try {
     for (let i = 0;i < params.count; i++) {
-      const groupIndex2 = params.from + i;
-      const secretKey = nostrKeyAt(master, groupIndex2);
-      keys.push({ groupIndex: groupIndex2, publicKey: getPublicKey(secretKey) });
+      const groupIndex = params.from + i;
+      const secretKey = nostrKeyAt(master, groupIndex);
+      keys.push({ groupIndex, publicKey: getPublicKey(secretKey) });
       wipe(secretKey);
     }
     return { keys };
@@ -9967,14 +9967,14 @@ function createNostrModule() {
     lock: () => {
       pool.dispose();
     },
-    walletDeleteOps: (image, walletId2) => {
+    walletDeleteOps: (image, walletId) => {
       const ids = [];
       for (const record of image.records) {
         if (record.kind !== NOSTR_KEY_KIND) {
           continue;
         }
         const header = parseNostrKeyHeader(record.header);
-        if (header.origin === "derived" && header.walletId === walletId2) {
+        if (header.origin === "derived" && header.walletId === walletId) {
           ids.push(record.id);
         }
       }
@@ -10172,9 +10172,9 @@ function statusContents(image, modules, nostr) {
   const wallets = [];
   const owned = [];
   let corrupted = false;
-  for (const factor2 of image.factors) {
+  for (const factor of image.factors) {
     try {
-      factors.push(factorInfo2(factor2));
+      factors.push(factorInfo2(factor));
     } catch {
       corrupted = true;
     }
@@ -10237,7 +10237,7 @@ function isMethodName(method) {
 function startKernel(platform, port) {
   const nostr = createNostrModule();
   const HANDLERS = {
-    status: (ctx2) => statusPayload2(ctx2, nostr),
+    status: (ctx) => statusPayload2(ctx, nostr),
     ...CORE_HANDLERS,
     ...nostr.handlers
   };
@@ -10402,6 +10402,9 @@ function startKernel(platform, port) {
 }
 // ../wallet-kernel/src/vault/store.ts
 var RECORD_KIND_PATTERN = /^[a-z][a-z0-9-]{0,31}$/;
+function isRecordKind(kind) {
+  return RECORD_KIND_PATTERN.test(kind);
+}
 // src/shared.ts
 var MAX_ID = 128;
 var MAX_HEADER = 4096;
@@ -10460,7 +10463,7 @@ function assertVaultImage(value) {
   for (const entry of records) {
     const row = plainObject(entry);
     exactKeys(row, "header,id,kind,sealed");
-    if (typeof row["kind"] !== "string" || !RECORD_KIND_PATTERN.test(row["kind"])) {
+    if (typeof row["kind"] !== "string" || !isRecordKind(row["kind"])) {
       throw bad("record kind is not a valid kind string");
     }
     boundedString(row["id"], MAX_ID, "record id");
@@ -10520,11 +10523,11 @@ async function transactionDone(tx) {
     tx.addEventListener("complete", () => {
       resolve();
     });
-    const fail2 = () => {
+    const fail = () => {
       reject(tx.error instanceof Error ? tx.error : new Error("indexeddb transaction failed"));
     };
-    tx.addEventListener("error", fail2);
-    tx.addEventListener("abort", fail2);
+    tx.addEventListener("error", fail);
+    tx.addEventListener("abort", fail);
   });
 }
 async function openDb() {