@unicitylabs/sphere-sdk 0.9.1-dev.6 → 0.9.1-dev.7

package/dist/impl/shared/wallet-api/index.cjs

@@ -0,0 +1,3224 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// impl/shared/wallet-api/index.ts
+var wallet_api_exports = {};
+__export(wallet_api_exports, {
+  WalletApiMailboxProvider: () => WalletApiMailboxProvider,
+  WalletApiTokenStorageProvider: () => WalletApiTokenStorageProvider,
+  createOwnStorageWalletApiProviders: () => createOwnStorageWalletApiProviders,
+  createSphereProviders: () => createSphereProviders,
+  createWalletApiMailboxProvider: () => createWalletApiMailboxProvider,
+  createWalletApiProviders: () => createWalletApiProviders,
+  createWalletApiTokenStorageProvider: () => createWalletApiTokenStorageProvider
+});
+module.exports = __toCommonJS(wallet_api_exports);
+
+// node_modules/@noble/hashes/utils.js
+function isBytes(a) {
+  return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array" && "BYTES_PER_ELEMENT" in a && a.BYTES_PER_ELEMENT === 1;
+}
+function anumber(n, title = "") {
+  if (typeof n !== "number") {
+    const prefix = title && `"${title}" `;
+    throw new TypeError(`${prefix}expected number, got ${typeof n}`);
+  }
+  if (!Number.isSafeInteger(n) || n < 0) {
+    const prefix = title && `"${title}" `;
+    throw new RangeError(`${prefix}expected integer >= 0, got ${n}`);
+  }
+}
+function abytes(value, length, title = "") {
+  const bytes = isBytes(value);
+  const len = value?.length;
+  const needsLen = length !== void 0;
+  if (!bytes || needsLen && len !== length) {
+    const prefix = title && `"${title}" `;
+    const ofLen = needsLen ? ` of length ${length}` : "";
+    const got = bytes ? `length=${len}` : `type=${typeof value}`;
+    const message = prefix + "expected Uint8Array" + ofLen + ", got " + got;
+    if (!bytes)
+      throw new TypeError(message);
+    throw new RangeError(message);
+  }
+  return value;
+}
+function ahash(h) {
+  if (typeof h !== "function" || typeof h.create !== "function")
+    throw new TypeError("Hash must wrapped by utils.createHasher");
+  anumber(h.outputLen);
+  anumber(h.blockLen);
+  if (h.outputLen < 1)
+    throw new Error('"outputLen" must be >= 1');
+  if (h.blockLen < 1)
+    throw new Error('"blockLen" must be >= 1');
+}
+function aexists(instance, checkFinished = true) {
+  if (instance.destroyed)
+    throw new Error("Hash instance has been destroyed");
+  if (checkFinished && instance.finished)
+    throw new Error("Hash#digest() has already been called");
+}
+function aoutput(out, instance) {
+  abytes(out, void 0, "digestInto() output");
+  const min = instance.outputLen;
+  if (out.length < min) {
+    throw new RangeError('"digestInto() output" expected to be of length >=' + min);
+  }
+}
+function clean(...arrays) {
+  for (let i = 0; i < arrays.length; i++) {
+    arrays[i].fill(0);
+  }
+}
+function createView(arr) {
+  return new DataView(arr.buffer, arr.byteOffset, arr.byteLength);
+}
+function rotr(word, shift) {
+  return word << 32 - shift | word >>> shift;
+}
+function createHasher(hashCons, info = {}) {
+  const hashC = (msg, opts) => hashCons(opts).update(msg).digest();
+  const tmp = hashCons(void 0);
+  hashC.outputLen = tmp.outputLen;
+  hashC.blockLen = tmp.blockLen;
+  hashC.canXOF = tmp.canXOF;
+  hashC.create = (opts) => hashCons(opts);
+  Object.assign(hashC, info);
+  return Object.freeze(hashC);
+}
+var oidNist = (suffix) => ({
+  // Current NIST hashAlgs suffixes used here fit in one DER subidentifier octet.
+  // Larger suffix values would need base-128 OID encoding and a different length byte.
+  oid: Uint8Array.from([6, 9, 96, 134, 72, 1, 101, 3, 4, 2, suffix])
+});
+
+// node_modules/@noble/hashes/_md.js
+function Chi(a, b, c) {
+  return a & b ^ ~a & c;
+}
+function Maj(a, b, c) {
+  return a & b ^ a & c ^ b & c;
+}
+var HashMD = class {
+  blockLen;
+  outputLen;
+  canXOF = false;
+  padOffset;
+  isLE;
+  // For partial updates less than block size
+  buffer;
+  view;
+  finished = false;
+  length = 0;
+  pos = 0;
+  destroyed = false;
+  constructor(blockLen, outputLen, padOffset, isLE2) {
+    this.blockLen = blockLen;
+    this.outputLen = outputLen;
+    this.padOffset = padOffset;
+    this.isLE = isLE2;
+    this.buffer = new Uint8Array(blockLen);
+    this.view = createView(this.buffer);
+  }
+  update(data) {
+    aexists(this);
+    abytes(data);
+    const { view, buffer, blockLen } = this;
+    const len = data.length;
+    for (let pos = 0; pos < len; ) {
+      const take = Math.min(blockLen - this.pos, len - pos);
+      if (take === blockLen) {
+        const dataView = createView(data);
+        for (; blockLen <= len - pos; pos += blockLen)
+          this.process(dataView, pos);
+        continue;
+      }
+      buffer.set(data.subarray(pos, pos + take), this.pos);
+      this.pos += take;
+      pos += take;
+      if (this.pos === blockLen) {
+        this.process(view, 0);
+        this.pos = 0;
+      }
+    }
+    this.length += data.length;
+    this.roundClean();
+    return this;
+  }
+  digestInto(out) {
+    aexists(this);
+    aoutput(out, this);
+    this.finished = true;
+    const { buffer, view, blockLen, isLE: isLE2 } = this;
+    let { pos } = this;
+    buffer[pos++] = 128;
+    clean(this.buffer.subarray(pos));
+    if (this.padOffset > blockLen - pos) {
+      this.process(view, 0);
+      pos = 0;
+    }
+    for (let i = pos; i < blockLen; i++)
+      buffer[i] = 0;
+    view.setBigUint64(blockLen - 8, BigInt(this.length * 8), isLE2);
+    this.process(view, 0);
+    const oview = createView(out);
+    const len = this.outputLen;
+    if (len % 4)
+      throw new Error("_sha2: outputLen must be aligned to 32bit");
+    const outLen = len / 4;
+    const state = this.get();
+    if (outLen > state.length)
+      throw new Error("_sha2: outputLen bigger than state");
+    for (let i = 0; i < outLen; i++)
+      oview.setUint32(4 * i, state[i], isLE2);
+  }
+  digest() {
+    const { buffer, outputLen } = this;
+    this.digestInto(buffer);
+    const res = buffer.slice(0, outputLen);
+    this.destroy();
+    return res;
+  }
+  _cloneInto(to) {
+    to ||= new this.constructor();
+    to.set(...this.get());
+    const { blockLen, buffer, length, finished, destroyed, pos } = this;
+    to.destroyed = destroyed;
+    to.finished = finished;
+    to.length = length;
+    to.pos = pos;
+    if (length % blockLen)
+      to.buffer.set(buffer);
+    return to;
+  }
+  clone() {
+    return this._cloneInto();
+  }
+};
+var SHA256_IV = /* @__PURE__ */ Uint32Array.from([
+  1779033703,
+  3144134277,
+  1013904242,
+  2773480762,
+  1359893119,
+  2600822924,
+  528734635,
+  1541459225
+]);
+
+// node_modules/@noble/hashes/sha2.js
+var SHA256_K = /* @__PURE__ */ Uint32Array.from([
+  1116352408,
+  1899447441,
+  3049323471,
+  3921009573,
+  961987163,
+  1508970993,
+  2453635748,
+  2870763221,
+  3624381080,
+  310598401,
+  607225278,
+  1426881987,
+  1925078388,
+  2162078206,
+  2614888103,
+  3248222580,
+  3835390401,
+  4022224774,
+  264347078,
+  604807628,
+  770255983,
+  1249150122,
+  1555081692,
+  1996064986,
+  2554220882,
+  2821834349,
+  2952996808,
+  3210313671,
+  3336571891,
+  3584528711,
+  113926993,
+  338241895,
+  666307205,
+  773529912,
+  1294757372,
+  1396182291,
+  1695183700,
+  1986661051,
+  2177026350,
+  2456956037,
+  2730485921,
+  2820302411,
+  3259730800,
+  3345764771,
+  3516065817,
+  3600352804,
+  4094571909,
+  275423344,
+  430227734,
+  506948616,
+  659060556,
+  883997877,
+  958139571,
+  1322822218,
+  1537002063,
+  1747873779,
+  1955562222,
+  2024104815,
+  2227730452,
+  2361852424,
+  2428436474,
+  2756734187,
+  3204031479,
+  3329325298
+]);
+var SHA256_W = /* @__PURE__ */ new Uint32Array(64);
+var SHA2_32B = class extends HashMD {
+  constructor(outputLen) {
+    super(64, outputLen, 8, false);
+  }
+  get() {
+    const { A, B, C, D, E, F, G, H } = this;
+    return [A, B, C, D, E, F, G, H];
+  }
+  // prettier-ignore
+  set(A, B, C, D, E, F, G, H) {
+    this.A = A | 0;
+    this.B = B | 0;
+    this.C = C | 0;
+    this.D = D | 0;
+    this.E = E | 0;
+    this.F = F | 0;
+    this.G = G | 0;
+    this.H = H | 0;
+  }
+  process(view, offset) {
+    for (let i = 0; i < 16; i++, offset += 4)
+      SHA256_W[i] = view.getUint32(offset, false);
+    for (let i = 16; i < 64; i++) {
+      const W15 = SHA256_W[i - 15];
+      const W2 = SHA256_W[i - 2];
+      const s0 = rotr(W15, 7) ^ rotr(W15, 18) ^ W15 >>> 3;
+      const s1 = rotr(W2, 17) ^ rotr(W2, 19) ^ W2 >>> 10;
+      SHA256_W[i] = s1 + SHA256_W[i - 7] + s0 + SHA256_W[i - 16] | 0;
+    }
+    let { A, B, C, D, E, F, G, H } = this;
+    for (let i = 0; i < 64; i++) {
+      const sigma1 = rotr(E, 6) ^ rotr(E, 11) ^ rotr(E, 25);
+      const T1 = H + sigma1 + Chi(E, F, G) + SHA256_K[i] + SHA256_W[i] | 0;
+      const sigma0 = rotr(A, 2) ^ rotr(A, 13) ^ rotr(A, 22);
+      const T2 = sigma0 + Maj(A, B, C) | 0;
+      H = G;
+      G = F;
+      F = E;
+      E = D + T1 | 0;
+      D = C;
+      C = B;
+      B = A;
+      A = T1 + T2 | 0;
+    }
+    A = A + this.A | 0;
+    B = B + this.B | 0;
+    C = C + this.C | 0;
+    D = D + this.D | 0;
+    E = E + this.E | 0;
+    F = F + this.F | 0;
+    G = G + this.G | 0;
+    H = H + this.H | 0;
+    this.set(A, B, C, D, E, F, G, H);
+  }
+  roundClean() {
+    clean(SHA256_W);
+  }
+  destroy() {
+    this.destroyed = true;
+    this.set(0, 0, 0, 0, 0, 0, 0, 0);
+    clean(this.buffer);
+  }
+};
+var _SHA256 = class extends SHA2_32B {
+  // We cannot use array here since array allows indexing by variable
+  // which means optimizer/compiler cannot use registers.
+  A = SHA256_IV[0] | 0;
+  B = SHA256_IV[1] | 0;
+  C = SHA256_IV[2] | 0;
+  D = SHA256_IV[3] | 0;
+  E = SHA256_IV[4] | 0;
+  F = SHA256_IV[5] | 0;
+  G = SHA256_IV[6] | 0;
+  H = SHA256_IV[7] | 0;
+  constructor() {
+    super(32);
+  }
+};
+var sha256 = /* @__PURE__ */ createHasher(
+  () => new _SHA256(),
+  /* @__PURE__ */ oidNist(1)
+);
+
+// token-engine/sdk.ts
+var import_StateTransitionClient = require("@unicitylabs/state-transition-sdk/lib/StateTransitionClient.js");
+var import_AggregatorClient = require("@unicitylabs/state-transition-sdk/lib/api/AggregatorClient.js");
+var import_NetworkId = require("@unicitylabs/state-transition-sdk/lib/api/NetworkId.js");
+var import_CertificationData = require("@unicitylabs/state-transition-sdk/lib/api/CertificationData.js");
+var import_CertificationResponse = require("@unicitylabs/state-transition-sdk/lib/api/CertificationResponse.js");
+var import_StateId = require("@unicitylabs/state-transition-sdk/lib/api/StateId.js");
+var import_InclusionProof = require("@unicitylabs/state-transition-sdk/lib/api/InclusionProof.js");
+var import_InclusionProofResponse = require("@unicitylabs/state-transition-sdk/lib/api/InclusionProofResponse.js");
+var import_RootTrustBase = require("@unicitylabs/state-transition-sdk/lib/api/bft/RootTrustBase.js");
+var import_InclusionProofUtils = require("@unicitylabs/state-transition-sdk/lib/util/InclusionProofUtils.js");
+var import_InclusionProofVerificationRule = require("@unicitylabs/state-transition-sdk/lib/transaction/verification/rule/InclusionProofVerificationRule.js");
+var import_Token = require("@unicitylabs/state-transition-sdk/lib/transaction/Token.js");
+var import_MintTransaction = require("@unicitylabs/state-transition-sdk/lib/transaction/MintTransaction.js");
+var import_TransferTransaction = require("@unicitylabs/state-transition-sdk/lib/transaction/TransferTransaction.js");
+var import_CertifiedMintTransaction = require("@unicitylabs/state-transition-sdk/lib/transaction/CertifiedMintTransaction.js");
+var import_CertifiedTransferTransaction = require("@unicitylabs/state-transition-sdk/lib/transaction/CertifiedTransferTransaction.js");
+var import_TokenId = require("@unicitylabs/state-transition-sdk/lib/transaction/TokenId.js");
+var import_TokenType = require("@unicitylabs/state-transition-sdk/lib/transaction/TokenType.js");
+var import_TokenSalt = require("@unicitylabs/state-transition-sdk/lib/transaction/TokenSalt.js");
+var import_MintJustificationVerifierService = require("@unicitylabs/state-transition-sdk/lib/transaction/verification/MintJustificationVerifierService.js");
+var import_EncodedPredicate = require("@unicitylabs/state-transition-sdk/lib/predicate/EncodedPredicate.js");
+var import_SignaturePredicate = require("@unicitylabs/state-transition-sdk/lib/predicate/builtin/SignaturePredicate.js");
+var import_SignaturePredicateUnlockScript = require("@unicitylabs/state-transition-sdk/lib/predicate/builtin/SignaturePredicateUnlockScript.js");
+var import_BurnPredicate = require("@unicitylabs/state-transition-sdk/lib/predicate/builtin/BurnPredicate.js");
+var import_PredicateVerifierService = require("@unicitylabs/state-transition-sdk/lib/predicate/verification/PredicateVerifierService.js");
+var import_SigningService = require("@unicitylabs/state-transition-sdk/lib/crypto/secp256k1/SigningService.js");
+var import_Signature = require("@unicitylabs/state-transition-sdk/lib/crypto/secp256k1/Signature.js");
+var import_MintSigningService = require("@unicitylabs/state-transition-sdk/lib/crypto/MintSigningService.js");
+var import_HashAlgorithm = require("@unicitylabs/state-transition-sdk/lib/crypto/hash/HashAlgorithm.js");
+var import_DataHash = require("@unicitylabs/state-transition-sdk/lib/crypto/hash/DataHash.js");
+var import_DataHasher = require("@unicitylabs/state-transition-sdk/lib/crypto/hash/DataHasher.js");
+var import_DataHasherFactory = require("@unicitylabs/state-transition-sdk/lib/crypto/hash/DataHasherFactory.js");
+var import_CborSerializer = require("@unicitylabs/state-transition-sdk/lib/serialization/cbor/CborSerializer.js");
+var import_CborDeserializer = require("@unicitylabs/state-transition-sdk/lib/serialization/cbor/CborDeserializer.js");
+var import_CborError = require("@unicitylabs/state-transition-sdk/lib/serialization/cbor/CborError.js");
+var import_Asset = require("@unicitylabs/state-transition-sdk/lib/payment/asset/Asset.js");
+var import_AssetId = require("@unicitylabs/state-transition-sdk/lib/payment/asset/AssetId.js");
+var import_PaymentAssetCollection = require("@unicitylabs/state-transition-sdk/lib/payment/asset/PaymentAssetCollection.js");
+var import_TokenSplit = require("@unicitylabs/state-transition-sdk/lib/payment/TokenSplit.js");
+var import_SplitTokenRequest = require("@unicitylabs/state-transition-sdk/lib/payment/SplitTokenRequest.js");
+var import_SplitToken = require("@unicitylabs/state-transition-sdk/lib/payment/SplitToken.js");
+var import_SplitAssetProof = require("@unicitylabs/state-transition-sdk/lib/payment/SplitAssetProof.js");
+var import_SplitMintJustification = require("@unicitylabs/state-transition-sdk/lib/payment/SplitMintJustification.js");
+var import_SplitMintJustificationVerifier = require("@unicitylabs/state-transition-sdk/lib/payment/SplitMintJustificationVerifier.js");
+var import_VerificationStatus = require("@unicitylabs/state-transition-sdk/lib/verification/VerificationStatus.js");
+var import_VerificationResult = require("@unicitylabs/state-transition-sdk/lib/verification/VerificationResult.js");
+var import_UnicityId = require("@unicitylabs/state-transition-sdk/lib/unicity-id/UnicityId.js");
+var import_UnicityIdMintTransaction = require("@unicitylabs/state-transition-sdk/lib/unicity-id/UnicityIdMintTransaction.js");
+var import_CertifiedUnicityIdMintTransaction = require("@unicitylabs/state-transition-sdk/lib/unicity-id/CertifiedUnicityIdMintTransaction.js");
+var import_UnicityIdToken = require("@unicitylabs/state-transition-sdk/lib/unicity-id/UnicityIdToken.js");
+var import_HexConverter = require("@unicitylabs/state-transition-sdk/lib/util/HexConverter.js");
+var import_BigintConverter = require("@unicitylabs/state-transition-sdk/lib/util/BigintConverter.js");
+var import_BitString = require("@unicitylabs/state-transition-sdk/lib/util/BitString.js");
+
+// token-engine/token-blob.ts
+var TOKEN_BLOB_TAG = 39051n;
+var TOKEN_BLOB_VERSION = 1;
+function decodeTokenBlob(bytes) {
+  const tag = import_CborDeserializer.CborDeserializer.decodeTag(bytes);
+  if (tag.tag !== TOKEN_BLOB_TAG) {
+    throw new import_CborError.CborError(`Invalid TokenBlob tag: ${tag.tag}`);
+  }
+  const fields = import_CborDeserializer.CborDeserializer.decodeArray(tag.data, 4);
+  const v = Number(import_CborDeserializer.CborDeserializer.decodeUnsignedInteger(fields[0]));
+  if (v !== TOKEN_BLOB_VERSION) {
+    throw new import_CborError.CborError(`Unsupported TokenBlob version: ${v}`);
+  }
+  return {
+    v,
+    network: Number(import_CborDeserializer.CborDeserializer.decodeUnsignedInteger(fields[1])),
+    tokenId: import_CborDeserializer.CborDeserializer.decodeTextString(fields[2]),
+    token: import_CborDeserializer.CborDeserializer.decodeByteString(fields[3])
+  };
+}
+function unwrapTokenBlobBytes(bytes) {
+  try {
+    return decodeTokenBlob(bytes).token;
+  } catch {
+    return bytes;
+  }
+}
+
+// core/crypto.ts
+var bip39 = __toESM(require("bip39"), 1);
+var import_crypto_js = __toESM(require("crypto-js"), 1);
+var import_elliptic = __toESM(require("elliptic"), 1);
+
+// core/errors.ts
+var SphereError = class extends Error {
+  code;
+  cause;
+  constructor(message, code, cause) {
+    super(message);
+    this.name = "SphereError";
+    this.code = code;
+    this.cause = cause;
+  }
+};
+
+// core/crypto.ts
+var ec = new import_elliptic.default.ec("secp256k1");
+var CURVE_ORDER = BigInt(
+  "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141"
+);
+var SIGN_MESSAGE_PREFIX = "Sphere Signed Message:\n";
+function varint(n) {
+  if (n < 253) return new Uint8Array([n]);
+  const buf = new Uint8Array(3);
+  buf[0] = 253;
+  buf[1] = n & 255;
+  buf[2] = n >> 8 & 255;
+  return buf;
+}
+function hashSignMessage(message) {
+  const prefix = new TextEncoder().encode(SIGN_MESSAGE_PREFIX);
+  const msg = new TextEncoder().encode(message);
+  const prefixLen = varint(prefix.length);
+  const msgLen = varint(msg.length);
+  const full = new Uint8Array(prefixLen.length + prefix.length + msgLen.length + msg.length);
+  let off = 0;
+  full.set(prefixLen, off);
+  off += prefixLen.length;
+  full.set(prefix, off);
+  off += prefix.length;
+  full.set(msgLen, off);
+  off += msgLen.length;
+  full.set(msg, off);
+  const hex = Array.from(full).map((b) => b.toString(16).padStart(2, "0")).join("");
+  const h1 = import_crypto_js.default.SHA256(import_crypto_js.default.enc.Hex.parse(hex)).toString();
+  return import_crypto_js.default.SHA256(import_crypto_js.default.enc.Hex.parse(h1)).toString();
+}
+function signMessage(privateKeyHex, message) {
+  const keyPair = ec.keyFromPrivate(privateKeyHex, "hex");
+  const hashHex = hashSignMessage(message);
+  const hashBytes = Buffer.from(hashHex, "hex");
+  const sig = keyPair.sign(hashBytes, { canonical: true });
+  const pub = keyPair.getPublic();
+  let recoveryParam = -1;
+  for (let i = 0; i < 4; i++) {
+    try {
+      if (ec.recoverPubKey(hashBytes, sig, i).eq(pub)) {
+        recoveryParam = i;
+        break;
+      }
+    } catch {
+    }
+  }
+  if (recoveryParam === -1) {
+    throw new SphereError("Could not find recovery parameter", "SIGNING_ERROR");
+  }
+  const v = (31 + recoveryParam).toString(16).padStart(2, "0");
+  const r = sig.r.toString("hex").padStart(64, "0");
+  const s = sig.s.toString("hex").padStart(64, "0");
+  return v + r + s;
+}
+
+// wallet-api/errors.ts
+var STATUS_TO_CODE = {
+  401: "UNAUTHORIZED",
+  403: "FORBIDDEN",
+  404: "NOT_FOUND",
+  409: "CONFLICT",
+  413: "TOO_LARGE",
+  422: "VALIDATION",
+  429: "RATE_LIMITED"
+};
+var WalletApiError = class _WalletApiError extends Error {
+  code;
+  /** HTTP status when the error came from a response. */
+  status;
+  constructor(message, code, status, cause) {
+    super(message);
+    this.name = "WalletApiError";
+    this.code = code;
+    this.status = status;
+    if (cause !== void 0) this.cause = cause;
+  }
+  static fromStatus(status, message) {
+    return new _WalletApiError(message, STATUS_TO_CODE[status] ?? "SERVER", status);
+  }
+};
+var ChallengeTemplateError = class extends WalletApiError {
+  constructor(message) {
+    super(message, "CHALLENGE_TEMPLATE");
+    this.name = "ChallengeTemplateError";
+  }
+};
+
+// wallet-api/challenge.ts
+var AUTH_CHALLENGE_PREFIX = "unicity:wallet-api:auth:v1\n";
+var MAX_CLOCK_SKEW_MS = 5 * 60 * 1e3;
+var MAX_VALIDITY_WINDOW_MS = 60 * 60 * 1e3;
+function parseFields(body) {
+  let parsed;
+  try {
+    parsed = JSON.parse(body);
+  } catch {
+    throw new ChallengeTemplateError("Challenge body is not the single-line JSON object the backend emits");
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    throw new ChallengeTemplateError("Challenge body must be a JSON object");
+  }
+  const fields = /* @__PURE__ */ new Map();
+  for (const [key, value] of Object.entries(parsed)) {
+    if (typeof value !== "string") {
+      throw new ChallengeTemplateError(`Challenge field "${key}" must be a string`);
+    }
+    fields.set(key, value);
+  }
+  return fields;
+}
+function requireField(fields, key) {
+  const value = fields.get(key);
+  if (value === void 0 || value === "") {
+    throw new ChallengeTemplateError(`Challenge is missing the "${key}" field`);
+  }
+  return value;
+}
+function parseTimestamp(value, key) {
+  const ms = Date.parse(value);
+  if (Number.isNaN(ms)) {
+    throw new ChallengeTemplateError(`Challenge "${key}" is not a parseable timestamp: ${value}`);
+  }
+  return ms;
+}
+function verifyChallengeTemplate(challenge, expect) {
+  if (typeof challenge !== "string" || !challenge.startsWith(AUTH_CHALLENGE_PREFIX)) {
+    throw new ChallengeTemplateError("Challenge does not start with the unicity:wallet-api:auth:v1 domain prefix");
+  }
+  const fields = parseFields(challenge.slice(AUTH_CHALLENGE_PREFIX.length));
+  const pubkey = requireField(fields, "pubkey");
+  if (pubkey.toLowerCase() !== expect.pubkey.toLowerCase()) {
+    throw new ChallengeTemplateError("Challenge embeds a different pubkey than this wallet");
+  }
+  const nonce = requireField(fields, "nonce");
+  if (nonce !== expect.nonce) {
+    throw new ChallengeTemplateError("Challenge nonce does not match the nonce issued with it");
+  }
+  const network = requireField(fields, "network");
+  if (network !== expect.network) {
+    throw new ChallengeTemplateError(`Challenge is for network "${network}", expected "${expect.network}"`);
+  }
+  const issuedAt = parseTimestamp(requireField(fields, "issuedAt"), "issuedAt");
+  const expiresAt = parseTimestamp(requireField(fields, "expiresAt"), "expiresAt");
+  if (issuedAt > expect.nowMs + MAX_CLOCK_SKEW_MS) {
+    throw new ChallengeTemplateError("Challenge issuedAt is in the future");
+  }
+  if (expiresAt <= expect.nowMs - MAX_CLOCK_SKEW_MS) {
+    throw new ChallengeTemplateError("Challenge is already expired");
+  }
+  if (expiresAt <= issuedAt || expiresAt - issuedAt > MAX_VALIDITY_WINDOW_MS) {
+    throw new ChallengeTemplateError("Challenge validity window is implausible");
+  }
+}
+
+// wallet-api/codec.ts
+function protocolError(message) {
+  return new WalletApiError(message, "PROTOCOL");
+}
+function asRecord(value, what) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw protocolError(`${what} is not an object`);
+  }
+  return value;
+}
+function asArray(value, what) {
+  if (!Array.isArray(value)) throw protocolError(`${what} is not an array`);
+  return value;
+}
+function asString(value, what) {
+  if (typeof value !== "string") throw protocolError(`${what} is not a string`);
+  return value;
+}
+function parseCounter(value, what) {
+  if (typeof value === "string" && /^[0-9]+$/.test(value)) return BigInt(value);
+  if (typeof value === "number" && Number.isSafeInteger(value) && value >= 0) return BigInt(value);
+  throw protocolError(`${what} is not a non-negative integer counter`);
+}
+function parseAmount(value, what) {
+  if (typeof value === "string" && /^[0-9]+$/.test(value)) return BigInt(value);
+  throw protocolError(`${what} is not a decimal-string amount`);
+}
+function parseAssets(value, what) {
+  if (value === void 0 || value === null) return void 0;
+  return asArray(value, what).map((raw, i) => {
+    const rec = asRecord(raw, `${what}[${i}]`);
+    return {
+      coinId: asString(rec.coinId, `${what}[${i}].coinId`),
+      amount: parseAmount(rec.amount, `${what}[${i}].amount`)
+    };
+  });
+}
+function parseInventoryItem(raw, what) {
+  const rec = asRecord(raw, what);
+  const status = asString(rec.status, `${what}.status`);
+  if (status !== "active" && status !== "removed") {
+    throw protocolError(`${what}.status is neither 'active' nor 'removed'`);
+  }
+  return {
+    tokenId: asString(rec.tokenId, `${what}.tokenId`),
+    status,
+    assets: parseAssets(rec.assets, `${what}.assets`),
+    seq: parseCounter(rec.seq, `${what}.seq`)
+  };
+}
+function parseInventoryPage(body) {
+  const rec = asRecord(body, "inventory response");
+  if (typeof rec.more !== "boolean") throw protocolError("inventory response .more is not a boolean");
+  return {
+    cursor: parseCounter(rec.cursor, "inventory response .cursor"),
+    syncEpoch: parseCounter(rec.syncEpoch, "inventory response .syncEpoch"),
+    more: rec.more,
+    items: asArray(rec.items, "inventory response .items").map(
+      (raw, i) => parseInventoryItem(raw, `items[${i}]`)
+    )
+  };
+}
+function parseBalances(body) {
+  const rec = asRecord(body, "balances response");
+  return asArray(rec.balances, "balances response .balances").map((raw, i) => {
+    const b = asRecord(raw, `balances[${i}]`);
+    const tokenCount = b.tokenCount;
+    if (typeof tokenCount !== "number" || !Number.isSafeInteger(tokenCount) || tokenCount < 0) {
+      throw protocolError(`balances[${i}].tokenCount is not a non-negative integer`);
+    }
+    return {
+      coinId: asString(b.coinId, `balances[${i}].coinId`),
+      total: parseAmount(b.total, `balances[${i}].total`),
+      tokenCount
+    };
+  });
+}
+function parseBlobUrls(body) {
+  const rec = asRecord(body, "blob-urls response");
+  return asArray(rec.urls, "blob-urls response .urls").map((raw, i) => {
+    const u = asRecord(raw, `urls[${i}]`);
+    return {
+      tokenId: asString(u.tokenId, `urls[${i}].tokenId`),
+      getUrl: asString(u.getUrl, `urls[${i}].getUrl`)
+    };
+  });
+}
+function parseUploadUrls(body) {
+  const rec = asRecord(body, "upload-urls response");
+  return asArray(rec.urls, "upload-urls response .urls").map((raw, i) => {
+    const u = asRecord(raw, `urls[${i}]`);
+    return {
+      sha256: asString(u.sha256, `urls[${i}].sha256`),
+      key: asString(u.key, `urls[${i}].key`),
+      putUrl: asString(u.putUrl, `urls[${i}].putUrl`)
+    };
+  });
+}
+function parseApplyResult(body) {
+  const rec = asRecord(body, "apply response");
+  return parseCounter(rec.cursor, "apply response .cursor");
+}
+function parseIntents(body) {
+  const rec = asRecord(body, "intents response");
+  return asArray(rec.intents, "intents response .intents").map((raw, i) => {
+    const it = asRecord(raw, `intents[${i}]`);
+    const status = asString(it.status, `intents[${i}].status`);
+    if (status !== "open" && status !== "completed" && status !== "aborted") {
+      throw protocolError(`intents[${i}].status is not a known intent status`);
+    }
+    const createdAt = Date.parse(asString(it.createdAt, `intents[${i}].createdAt`));
+    if (Number.isNaN(createdAt)) throw protocolError(`intents[${i}].createdAt is not a timestamp`);
+    return {
+      transferId: asString(it.transferId, `intents[${i}].transferId`),
+      payload: asString(it.payload, `intents[${i}].payload`),
+      status,
+      createdAt
+    };
+  });
+}
+function parseDepositResult(body) {
+  const rec = asRecord(body, "mailbox deposit response");
+  return asString(rec.entryId, "mailbox deposit response .entryId");
+}
+function parseMailboxEntry(raw, what) {
+  const rec = asRecord(raw, what);
+  const status = asString(rec.status, `${what}.status`);
+  if (status !== "unclaimed" && status !== "claimed" && status !== "rejected") {
+    throw protocolError(`${what}.status is not a known mailbox entry status`);
+  }
+  const createdAt = Date.parse(asString(rec.createdAt, `${what}.createdAt`));
+  if (Number.isNaN(createdAt)) throw protocolError(`${what}.createdAt is not a timestamp`);
+  return {
+    entryId: asString(rec.entryId, `${what}.entryId`),
+    seq: parseCounter(rec.seq, `${what}.seq`),
+    status,
+    transferId: asString(rec.transferId, `${what}.transferId`),
+    tokenId: asString(rec.tokenId, `${what}.tokenId`),
+    assets: (parseAssets(rec.assets, `${what}.assets`) ?? []).map((a) => ({ ...a })),
+    senderPubkey: asString(rec.senderPubkey, `${what}.senderPubkey`),
+    ...rec.memo !== void 0 && rec.memo !== null ? { memo: asString(rec.memo, `${what}.memo`) } : {},
+    createdAt,
+    ...rec.getUrl !== void 0 && rec.getUrl !== null ? { getUrl: asString(rec.getUrl, `${what}.getUrl`) } : {},
+    ...rec.blobCollected === true ? { blobCollected: true } : {}
+  };
+}
+function parseMailboxPage(body) {
+  const rec = asRecord(body, "mailbox response");
+  if (typeof rec.more !== "boolean") throw protocolError("mailbox response .more is not a boolean");
+  return {
+    readPointer: parseCounter(rec.readPointer, "mailbox response .readPointer"),
+    syncEpoch: parseCounter(rec.syncEpoch, "mailbox response .syncEpoch"),
+    more: rec.more,
+    entries: asArray(rec.entries, "mailbox response .entries").map(
+      (raw, i) => parseMailboxEntry(raw, `entries[${i}]`)
+    )
+  };
+}
+function parseClaimResult(body) {
+  const rec = asRecord(body, "mailbox claim response");
+  return {
+    claimed: asArray(rec.claimed, "claim response .claimed").map(
+      (raw, i) => asString(raw, `claimed[${i}]`)
+    ),
+    alreadyClaimed: asArray(rec.alreadyClaimed, "claim response .alreadyClaimed").map((raw, i) => {
+      const a = asRecord(raw, `alreadyClaimed[${i}]`);
+      if (typeof a.intoInventory !== "boolean") {
+        throw protocolError(`alreadyClaimed[${i}].intoInventory is not a boolean`);
+      }
+      return { entryId: asString(a.entryId, `alreadyClaimed[${i}].entryId`), intoInventory: a.intoInventory };
+    }),
+    failed: asArray(rec.failed, "claim response .failed").map((raw, i) => {
+      const f = asRecord(raw, `failed[${i}]`);
+      return { entryId: asString(f.entryId, `failed[${i}].entryId`), code: asString(f.code, `failed[${i}].code`) };
+    })
+  };
+}
+function parseRejectResult(body) {
+  const rec = asRecord(body, "mailbox reject response");
+  return asArray(rec.rejected, "reject response .rejected").map((raw, i) => asString(raw, `rejected[${i}]`));
+}
+function parsePaymentRequestRecord(raw, what) {
+  const rec = asRecord(raw, what);
+  const status = asString(rec.status, `${what}.status`);
+  if (status !== "open" && status !== "paid" && status !== "declined" && status !== "expired") {
+    throw protocolError(`${what}.status is not a known payment-request status`);
+  }
+  const createdAt = Date.parse(asString(rec.createdAt, `${what}.createdAt`));
+  if (Number.isNaN(createdAt)) throw protocolError(`${what}.createdAt is not a timestamp`);
+  let expiresAt;
+  if (rec.expiresAt !== void 0 && rec.expiresAt !== null) {
+    expiresAt = Date.parse(asString(rec.expiresAt, `${what}.expiresAt`));
+    if (Number.isNaN(expiresAt)) throw protocolError(`${what}.expiresAt is not a timestamp`);
+  }
+  if (rec.transferId !== null && typeof rec.transferId !== "string") {
+    throw protocolError(`${what}.transferId is neither a string nor null`);
+  }
+  return {
+    id: asString(rec.id, `${what}.id`),
+    seq: parseCounter(rec.seq, `${what}.seq`),
+    fromPubkey: asString(rec.fromPubkey, `${what}.fromPubkey`),
+    toPubkey: asString(rec.toPubkey, `${what}.toPubkey`),
+    assets: (parseAssets(rec.assets, `${what}.assets`) ?? []).map((a) => ({ ...a })),
+    ...rec.memo !== void 0 && rec.memo !== null ? { memo: asString(rec.memo, `${what}.memo`) } : {},
+    status,
+    transferId: rec.transferId,
+    createdAt,
+    ...expiresAt !== void 0 ? { expiresAt } : {}
+  };
+}
+function parsePaymentRequestsPage(body, role) {
+  const rec = asRecord(body, "payment-requests response");
+  if (typeof rec.more !== "boolean") throw protocolError("payment-requests response .more is not a boolean");
+  const requests = asArray(rec.requests, "payment-requests response .requests").map(
+    (raw, i) => parsePaymentRequestRecord(raw, `requests[${i}]`)
+  );
+  const syncEpoch = parseCounter(rec.syncEpoch, "payment-requests response .syncEpoch");
+  if (role === "incoming") {
+    return {
+      role,
+      requests,
+      more: rec.more,
+      cursor: parseCounter(rec.cursor, "payment-requests response .cursor"),
+      syncEpoch
+    };
+  }
+  if (rec.cursor !== null && typeof rec.cursor !== "string") {
+    throw protocolError("payment-requests response .cursor is neither a keyset string nor null");
+  }
+  return { role, requests, more: rec.more, cursor: rec.cursor, syncEpoch };
+}
+function parseHistoryRecord(raw, what) {
+  const rec = asRecord(raw, what);
+  return {
+    dedupKey: asString(rec.dedupKey, `${what}.dedupKey`),
+    id: asString(rec.id, `${what}.id`),
+    type: asString(rec.type, `${what}.type`),
+    ts: asString(rec.ts, `${what}.ts`),
+    assets: asArray(rec.assets, `${what}.assets`).map((a, i) => {
+      const asset = asRecord(a, `${what}.assets[${i}]`);
+      parseAmount(asset.amount, `${what}.assets[${i}].amount`);
+      return {
+        coinId: asString(asset.coinId, `${what}.assets[${i}].coinId`),
+        amount: asString(asset.amount, `${what}.assets[${i}].amount`)
+      };
+    }),
+    ...typeof rec.transferId === "string" ? { transferId: rec.transferId } : {},
+    ...typeof rec.tokenId === "string" ? { tokenId: rec.tokenId } : {},
+    ...typeof rec.counterpartyPubkey === "string" ? { counterpartyPubkey: rec.counterpartyPubkey } : {},
+    ...typeof rec.memo === "string" ? { memo: rec.memo } : {},
+    ...typeof rec.counterpartyNametag === "string" ? { counterpartyNametag: rec.counterpartyNametag } : {}
+  };
+}
+function parseHistoryPage(body) {
+  const rec = asRecord(body, "history response");
+  if (typeof rec.more !== "boolean") throw protocolError("history response .more is not a boolean");
+  if (rec.cursor !== null && typeof rec.cursor !== "string") {
+    throw protocolError("history response .cursor is not a string or null");
+  }
+  return {
+    records: asArray(rec.records, "history response .records").map(
+      (raw, i) => parseHistoryRecord(raw, `records[${i}]`)
+    ),
+    more: rec.more,
+    cursor: rec.cursor,
+    syncEpoch: parseCounter(rec.syncEpoch, "history response .syncEpoch")
+  };
+}
+function parseAuthChallenge(body) {
+  const rec = asRecord(body, "auth/challenge response");
+  return {
+    nonce: asString(rec.nonce, "auth/challenge response .nonce"),
+    challenge: asString(rec.challenge, "auth/challenge response .challenge")
+  };
+}
+function parseAuthTokens(body) {
+  const rec = asRecord(body, "auth token response");
+  return {
+    jwt: asString(rec.jwt, "auth token response .jwt"),
+    refreshToken: asString(rec.refreshToken, "auth token response .refreshToken")
+  };
+}
+function parseWsTicket(body) {
+  const rec = asRecord(body, "ws-ticket response");
+  return asString(rec.ticket, "ws-ticket response .ticket");
+}
+function parseWakeFrame(raw) {
+  let body;
+  try {
+    body = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (typeof body !== "object" || body === null) return null;
+  const rec = body;
+  if (rec.type !== "wake") return null;
+  const stream = rec.stream;
+  if (stream !== "inventory" && stream !== "mailbox" && stream !== "payment_requests") return null;
+  try {
+    return { stream, syncEpoch: parseCounter(rec.syncEpoch, "wake .syncEpoch") };
+  } catch {
+    return null;
+  }
+}
+
+// wallet-api/client.ts
+function isLoopbackHost(hostname) {
+  return hostname === "localhost" || hostname.endsWith(".localhost") || /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(hostname) || hostname === "::1" || hostname === "[::1]";
+}
+function assertSecureBaseUrl(baseUrl) {
+  let url;
+  try {
+    url = new URL(baseUrl);
+  } catch {
+    throw new WalletApiError(`Invalid wallet-api base URL: ${baseUrl}`, "CONFIG");
+  }
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && isLoopbackHost(url.hostname))) {
+    throw new WalletApiError(
+      "wallet-api base URL must be https (plain http is allowed only on loopback \u2014 ARCHITECTURE \xA74)",
+      "CONFIG"
+    );
+  }
+  return url;
+}
+function bytesToBase64(bytes) {
+  let bin = "";
+  for (const b of bytes) bin += String.fromCharCode(b);
+  return btoa(bin);
+}
+function defaultWebSocketFactory(url) {
+  const Ctor = globalThis.WebSocket;
+  if (!Ctor) {
+    throw new WalletApiError(
+      'No global WebSocket available \u2014 inject webSocketFactory (e.g. the "ws" package on Node < 22)',
+      "CONFIG"
+    );
+  }
+  return new Ctor(url);
+}
+var WalletApiClient = class {
+  /** Network name (also the blob-key prefix `<network>/t/<sha256>` — §5.2). */
+  network;
+  baseUrl;
+  deviceId;
+  storage;
+  fetchFn;
+  wsFactory;
+  now;
+  identity = null;
+  jwt = null;
+  /** Serializes concurrent re-auth attempts. */
+  authInFlight = null;
+  constructor(config) {
+    const url = assertSecureBaseUrl(config.baseUrl);
+    this.baseUrl = url.toString().replace(/\/$/, "");
+    if (!config.network) throw new WalletApiError("network is required", "CONFIG");
+    this.network = config.network;
+    this.deviceId = config.deviceId;
+    this.storage = config.storage;
+    if (!config.fetchFn && !globalThis.fetch) {
+      throw new WalletApiError("No fetch available \u2014 inject fetchFn", "CONFIG");
+    }
+    this.fetchFn = config.fetchFn ?? ((u, init) => globalThis.fetch(u, init));
+    this.wsFactory = config.webSocketFactory ?? defaultWebSocketFactory;
+    this.now = config.now ?? (() => Date.now());
+  }
+  /** Bind the wallet identity this client authenticates as. Resets the session. */
+  setIdentity(identity) {
+    this.identity = identity;
+    this.jwt = null;
+  }
+  // ── storage keys (scoped per network + pubkey + device) ────────────────────
+  requireIdentity() {
+    if (!this.identity) throw new WalletApiError("No identity set \u2014 call setIdentity() first", "CONFIG");
+    return this.identity;
+  }
+  scopedKey(kind) {
+    const { chainPubkey } = this.requireIdentity();
+    return `wallet-api:${kind}:${this.network}:${chainPubkey}`;
+  }
+  refreshTokenKey() {
+    return `${this.scopedKey("refresh")}:${this.deviceId}`;
+  }
+  // ── auth (ARCHITECTURE §4) ──────────────────────────────────────────────────
+  /**
+   * Establish a session: try the stored refresh token first (rotating), fall
+   * back to a fresh challenge→sign→verify cycle. Safe to call repeatedly.
+   */
+  async signIn() {
+    if (this.authInFlight) return this.authInFlight;
+    this.authInFlight = this.signInInner().finally(() => {
+      this.authInFlight = null;
+    });
+    return this.authInFlight;
+  }
+  async signInInner() {
+    if (await this.tryRefresh()) return;
+    await this.challengeSignIn();
+  }
+  /**
+   * `POST /v1/auth/refresh` with the stored token; rotates on success. Any
+   * 4xx (expired, revoked, rotation-reuse revocation) clears the stored token
+   * and reports `false` — the caller falls back to a challenge cycle.
+   */
+  async tryRefresh() {
+    const stored = await this.storage.get(this.refreshTokenKey());
+    if (!stored) return false;
+    const res = await this.rawFetch("POST", "/v1/auth/refresh", { refreshToken: stored });
+    if (res.status === 200) {
+      const tokens = parseAuthTokens(await this.readJson(res, "auth/refresh"));
+      this.jwt = tokens.jwt;
+      await this.storage.set(this.refreshTokenKey(), tokens.refreshToken);
+      return true;
+    }
+    await this.storage.remove(this.refreshTokenKey());
+    return false;
+  }
+  /** The challenge→verify cycle (§4 steps 1–3) with template verification (S1). */
+  async challengeSignIn() {
+    const identity = this.requireIdentity();
+    const challengeRes = await this.rawFetch("POST", "/v1/auth/challenge", {
+      pubkey: identity.chainPubkey
+    });
+    if (challengeRes.status !== 200) throw await this.toError(challengeRes, "auth/challenge");
+    const { nonce, challenge } = parseAuthChallenge(await this.readJson(challengeRes, "auth/challenge"));
+    verifyChallengeTemplate(challenge, {
+      pubkey: identity.chainPubkey,
+      nonce,
+      network: this.network,
+      nowMs: this.now()
+    });
+    const signature = signMessage(identity.privateKey, challenge);
+    const verifyRes = await this.rawFetch("POST", "/v1/auth/verify", {
+      nonce,
+      signature,
+      deviceId: this.deviceId
+    });
+    if (verifyRes.status !== 200) throw await this.toError(verifyRes, "auth/verify");
+    const tokens = parseAuthTokens(await this.readJson(verifyRes, "auth/verify"));
+    this.jwt = tokens.jwt;
+    await this.storage.set(this.refreshTokenKey(), tokens.refreshToken);
+  }
+  /** Revoke the session server-side and drop all local credentials. */
+  async logout() {
+    if (this.jwt) {
+      try {
+        await this.rawFetch("POST", "/v1/auth/logout", {}, this.jwt);
+      } finally {
+        this.jwt = null;
+      }
+    }
+    await this.storage.remove(this.refreshTokenKey());
+  }
+  // ── request core ────────────────────────────────────────────────────────────
+  async rawFetch(method, path, body, jwt) {
+    const headers = {};
+    if (body !== void 0) headers["content-type"] = "application/json";
+    if (jwt) headers["authorization"] = `Bearer ${jwt}`;
+    try {
+      return await this.fetchFn(`${this.baseUrl}${path}`, {
+        method,
+        headers,
+        body: body !== void 0 ? JSON.stringify(body) : void 0
+      });
+    } catch (err) {
+      throw new WalletApiError(`wallet-api request failed: ${method} ${path}`, "NETWORK", void 0, err);
+    }
+  }
+  async readJson(res, what) {
+    const text = await res.text();
+    if (text === "") return null;
+    try {
+      return JSON.parse(text);
+    } catch (err) {
+      throw new WalletApiError(`${what}: response is not JSON`, "PROTOCOL", res.status, err);
+    }
+  }
+  async toError(res, what) {
+    let message = `${what} failed with status ${res.status}`;
+    try {
+      const body = await this.readJson(res, what);
+      if (body?.error?.message) message = `${what}: ${body.error.code ?? ""} ${body.error.message}`.trim();
+    } catch {
+    }
+    return WalletApiError.fromStatus(res.status, message);
+  }
+  /**
+   * Authenticated JSON request. A 401 triggers one silent re-auth
+   * (refresh → challenge fallback) and one retry.
+   */
+  async requestJson(method, path, body) {
+    if (!this.jwt) await this.signIn();
+    let res = await this.rawFetch(method, path, body, this.jwt);
+    if (res.status === 401) {
+      this.jwt = null;
+      await this.signIn();
+      res = await this.rawFetch(method, path, body, this.jwt);
+    }
+    if (res.status === 204) return null;
+    if (!res.ok) throw await this.toError(res, `${method} ${path}`);
+    return this.readJson(res, `${method} ${path}`);
+  }
+  // ── inventory / blobs (§16) ─────────────────────────────────────────────────
+  /** `GET /v1/inventory?since=` — one page; the caller loops while `more`. */
+  async listInventory(since) {
+    const query = since !== void 0 ? `?since=${since.toString()}` : "";
+    const page = parseInventoryPage(await this.requestJson("GET", `/v1/inventory${query}`));
+    await this.noteSyncEpoch(page.syncEpoch);
+    return page;
+  }
+  /** `GET /v1/balances` — active rows only. */
+  async getBalances() {
+    return parseBalances(await this.requestJson("GET", "/v1/balances"));
+  }
+  /** `POST /v1/tokens/blob-urls` — owner's active *or tombstoned* rows (§5.3 recovery). */
+  async getBlobUrls(tokenIds) {
+    return parseBlobUrls(await this.requestJson("POST", "/v1/tokens/blob-urls", { tokenIds }));
+  }
+  /** `POST /v1/tokens/upload-urls` — checksum/length-bound presigned PUTs (§5.2). */
+  async getUploadUrls(blobs) {
+    return parseUploadUrls(await this.requestJson("POST", "/v1/tokens/upload-urls", { blobs }));
+  }
+  /**
+   * `POST /v1/inventory/apply` (§5.3). Also marks the local intent copy
+   * completed — the server completes the intent in the same transaction (§16).
+   */
+  async applyInventoryDelta(req) {
+    const cursor = parseApplyResult(
+      await this.requestJson("POST", "/v1/inventory/apply", {
+        transferId: req.transferId,
+        spent: req.spent,
+        added: req.added,
+        ...req.externalDelivery !== void 0 ? { externalDelivery: req.externalDelivery } : {}
+      })
+    );
+    await this.setLocalIntentStatus(req.transferId, "completed");
+    return cursor;
+  }
+  /** Download blob bytes from a signed GET URL (the URL itself is the credential). */
+  async fetchBlob(getUrl) {
+    let res;
+    try {
+      res = await this.fetchFn(getUrl, { method: "GET" });
+    } catch (err) {
+      throw new WalletApiError("blob download failed", "NETWORK", void 0, err);
+    }
+    if (!res.ok) throw WalletApiError.fromStatus(res.status, `blob download failed with status ${res.status}`);
+    return new Uint8Array(await res.arrayBuffer());
+  }
+  /**
+   * Upload blob bytes to a signed PUT URL. A `412 Precondition Failed` means
+   * the identical blob already exists (content addressing, `If-None-Match: *`
+   * — §5.2) and is treated as success.
+   *
+   * The §5.2 presign binds `x-amz-checksum-sha256` and `if-none-match` (plus
+   * `content-length`) as SIGNED HEADERS — a real S3 endpoint rejects the
+   * SigV4 signature unless the uploader sends them verbatim. (Caught by the
+   * phase-2 harness on first contact with real MinIO — the in-process fake
+   * had only validated the body, not the signed headers.)
+   */
+  async uploadBlob(putUrl, bytes) {
+    let res;
+    try {
+      res = await this.fetchFn(putUrl, {
+        method: "PUT",
+        headers: {
+          "content-type": "application/octet-stream",
+          "x-amz-checksum-sha256": bytesToBase64(sha256(bytes)),
+          "if-none-match": "*"
+        },
+        body: bytes
+      });
+    } catch (err) {
+      throw new WalletApiError("blob upload failed", "NETWORK", void 0, err);
+    }
+    if (res.ok || res.status === 412) return;
+    throw WalletApiError.fromStatus(res.status, `blob upload failed with status ${res.status}`);
+  }
+  // ── mailbox (§6/§16) ────────────────────────────────────────────────────────
+  /**
+   * `POST /v1/mailbox` — deposit an already-uploaded finished blob to the
+   * recipient's mailbox. Idempotent by content-derived `entry_id` (§6): an
+   * existing entry in any status returns `200` with its id, provided the
+   * request's recipient and key match the stored entry (a mismatch is `409`).
+   */
+  async depositMailbox(req) {
+    return parseDepositResult(
+      await this.requestJson("POST", "/v1/mailbox", {
+        recipientPubkey: req.recipientPubkey,
+        key: req.key,
+        transferId: req.transferId,
+        stateHash: req.stateHash,
+        tokenId: req.tokenId,
+        ...req.memo !== void 0 ? { memo: req.memo } : {}
+      })
+    );
+  }
+  /**
+   * `GET /v1/mailbox?since=<seq>` — entries of EVERY status are listable for
+   * any client-chosen `since`; a claimed entry carries a working `getUrl`
+   * while its blob is within retention, `blobCollected: true` afterwards (§6).
+   */
+  async listMailbox(since) {
+    const query = since !== void 0 ? `?since=${since.toString()}` : "";
+    const page = parseMailboxPage(await this.requestJson("GET", `/v1/mailbox${query}`));
+    await this.noteSyncEpoch(page.syncEpoch);
+    return page;
+  }
+  /**
+   * `POST /v1/mailbox/claim` — addressee-only, idempotent ownership handoff
+   * (§6). `intoInventory:false` is the delivery-only claim: the entry resolves
+   * and the pointer advances with ZERO inventory writes.
+   */
+  async claimMailbox(entryIds, intoInventory) {
+    return parseClaimResult(
+      await this.requestJson("POST", "/v1/mailbox/claim", { entryIds, intoInventory })
+    );
+  }
+  /**
+   * `POST /v1/mailbox/reject` — addressee-only; terminal for DISCOVERY only:
+   * the entry counts toward read-pointer contiguity but remains claimable and
+   * its blob is retained (§6 — reject is never a destruction path).
+   */
+  async rejectMailbox(entryIds) {
+    return parseRejectResult(await this.requestJson("POST", "/v1/mailbox/reject", { entryIds }));
+  }
+  // ── history (§10/§16) ───────────────────────────────────────────────────────
+  /**
+   * `POST /v1/history` — client-asserted records, deduped by `dedupKey` (the
+   * server never writes history rows — §10). `memo`/`counterpartyNametag`
+   * MUST already be S6 envelopes.
+   */
+  async postHistoryRecords(records) {
+    await this.requestJson("POST", "/v1/history", { records });
+  }
+  /** `GET /v1/history?before=&limit=` — newest-first keyset pages (§10). */
+  async listHistory(options = {}) {
+    const params = new URLSearchParams();
+    if (options.before !== void 0) params.set("before", options.before);
+    if (options.limit !== void 0) params.set("limit", String(options.limit));
+    const qs = params.toString();
+    return parseHistoryPage(await this.requestJson("GET", `/v1/history${qs ? `?${qs}` : ""}`));
+  }
+  // ── payment requests (§10/§16) ──────────────────────────────────────────────
+  /**
+   * `POST /v1/payment-requests` — create a request addressed to a payer (the
+   * payer's account is auto-provisioned even if they never authenticated —
+   * §4/§9; the per-payer open cap → 429, §5.5). `memo` MUST already be an S6
+   * `enc1.` envelope (§8.3) — only the requester's wallet key decrypts it.
+   */
+  async createPaymentRequest(input) {
+    return parsePaymentRequestRecord(
+      await this.requestJson("POST", "/v1/payment-requests", {
+        toPubkey: input.toPubkey,
+        // Amounts are decimal strings in every JSON body (§11).
+        assets: input.assets.map((a) => ({ coinId: a.coinId, amount: a.amount.toString() })),
+        ...input.memo !== void 0 ? { memo: input.memo } : {},
+        ...input.expiresAt !== void 0 ? { expiresAt: new Date(input.expiresAt).toISOString() } : {}
+      }),
+      "payment-request create response"
+    );
+  }
+  /**
+   * `GET /v1/payment-requests?role=…` (§16): `'incoming'` is the payer's
+   * gap-free `?since=<seq>` stream (cursor = bigint, the standard §16 since
+   * contract); `'outgoing'` is the requester's newest-first
+   * `?before=<opaque keyset>` backfill (cursor = string | null). The two
+   * cursor families never mix — the server 422s a mismatched parameter, and
+   * the parameter types make it unrepresentable here.
+   */
+  async listPaymentRequests(params) {
+    const p = params;
+    const query = new URLSearchParams();
+    query.set("role", p.role);
+    if (p.status !== void 0) query.set("status", p.status);
+    if (p.role === "incoming") {
+      if (p.since !== void 0) query.set("since", p.since.toString());
+    } else if (p.before !== void 0) {
+      query.set("before", p.before);
+    }
+    const page = parsePaymentRequestsPage(
+      await this.requestJson("GET", `/v1/payment-requests?${query.toString()}`),
+      p.role
+    );
+    await this.noteSyncEpoch(page.syncEpoch);
+    return page;
+  }
+  /**
+   * `POST /v1/payment-requests/{id}/respond` — addressee-only (§10, non-
+   * addressee → 403); only an `open` request may be responded to (else 409).
+   * `paid` REQUIRES and links the fulfilling send's transferId, `declined`
+   * carries none — the pairing is enforced by {@link RespondPaymentRequestInput}.
+   */
+  async respondPaymentRequest(id, response) {
+    return parsePaymentRequestRecord(
+      await this.requestJson("POST", `/v1/payment-requests/${id}/respond`, response),
+      "payment-request respond response"
+    );
+  }
+  // ── intents (E.3) ───────────────────────────────────────────────────────────
+  intentsKey() {
+    return this.scopedKey("intents");
+  }
+  async readLocalIntents() {
+    const raw = await this.storage.get(this.intentsKey());
+    if (!raw) return {};
+    try {
+      return JSON.parse(raw);
+    } catch {
+      return {};
+    }
+  }
+  async writeLocalIntents(intents) {
+    await this.storage.set(this.intentsKey(), JSON.stringify(intents));
+  }
+  async setLocalIntentStatus(transferId, status) {
+    const intents = await this.readLocalIntents();
+    const intent = intents[transferId];
+    if (!intent || intent.status === status) return;
+    if (intent.status === "completed") return;
+    intent.status = status;
+    await this.writeLocalIntents(intents);
+  }
+  /**
+   * Persist a (client-encrypted — S6) intent payload: LOCAL copy first, then
+   * `PUT /v1/intents/{transferId}` and await the server ack (E.3 — the engine
+   * MUST NOT be called before this resolves). A failed server PUT throws, but
+   * the local copy stays as the restore backstop and is re-PUT by
+   * {@link resyncOpenIntents}.
+   */
+  async putIntent(transferId, payloadEnvelope) {
+    const intents = await this.readLocalIntents();
+    if (!intents[transferId]) {
+      intents[transferId] = { payload: payloadEnvelope, status: "open", createdAt: this.now() };
+      await this.writeLocalIntents(intents);
+    }
+    await this.requestJson("PUT", `/v1/intents/${transferId}`, { payload: payloadEnvelope });
+  }
+  /** `GET /v1/intents?status=` — server-side intent list. */
+  async listIntents(status) {
+    return parseIntents(await this.requestJson("GET", `/v1/intents?status=${status}`));
+  }
+  /** `POST /v1/intents/{id}/abort` — soft, recoverable (§16). */
+  async abortIntent(transferId) {
+    await this.requestJson("POST", `/v1/intents/${transferId}/abort`);
+    await this.setLocalIntentStatus(transferId, "aborted");
+  }
+  /** `POST /v1/intents/{id}/complete` — the uniform client-side close (E.3). */
+  async completeIntent(transferId) {
+    await this.requestJson("POST", `/v1/intents/${transferId}/complete`);
+    await this.setLocalIntentStatus(transferId, "completed");
+  }
+  /** The locally-known open intents (the E.3 restore backstop). */
+  async listLocalOpenIntents() {
+    const intents = await this.readLocalIntents();
+    return Object.entries(intents).filter(([, i]) => i.status === "open").map(([transferId, i]) => ({ transferId, payload: i.payload, status: "open", createdAt: i.createdAt }));
+  }
+  /**
+   * Re-PUT every locally-known open intent (idempotent — the server PUT is
+   * write-once while open/completed). Called after a `syncEpoch` change
+   * (server restore — §5.4): intents are the one server table not
+   * re-derivable from blobs.
+   */
+  async resyncOpenIntents() {
+    for (const intent of await this.listLocalOpenIntents()) {
+      await this.requestJson("PUT", `/v1/intents/${intent.transferId}`, { payload: intent.payload });
+    }
+  }
+  // ── syncEpoch (§5.4/§9) ─────────────────────────────────────────────────────
+  syncEpochKey() {
+    return this.scopedKey("syncEpoch");
+  }
+  /**
+   * Track the server `syncEpoch` carried by cursor-bearing responses and
+   * wakes. On a change (server restore), re-PUT locally-known open intents
+   * before anything resumes (E.3). Storage-provider cursor invalidation is
+   * the provider's own duty (S2) — it observes the same epoch values.
+   */
+  async noteSyncEpoch(epoch) {
+    const stored = await this.storage.get(this.syncEpochKey());
+    if (stored === epoch.toString()) return;
+    await this.storage.set(this.syncEpochKey(), epoch.toString());
+    if (stored !== null) {
+      await this.resyncOpenIntents();
+    }
+  }
+  // ── realtime (§9) ───────────────────────────────────────────────────────────
+  /**
+   * Open the wake channel: `POST /v1/ws-ticket` (JWT-authed, single-use,
+   * short TTL) then `GET /v1/ws?ticket=…` — the JWT never appears in a URL.
+   * Wakes are nudges only; correctness comes from the `?since=` cursors.
+   */
+  async connectWakeSocket(onWake) {
+    const ticket = parseWsTicket(await this.requestJson("POST", "/v1/ws-ticket"));
+    const wsBase = this.baseUrl.replace(/^http/, "ws");
+    const ws = this.wsFactory(`${wsBase}/v1/ws?ticket=${encodeURIComponent(ticket)}`);
+    await new Promise((resolve, reject) => {
+      ws.onopen = () => resolve();
+      ws.onerror = (err) => reject(new WalletApiError("wake socket failed to connect", "NETWORK", void 0, err));
+      ws.onclose = () => reject(new WalletApiError("wake socket closed before connecting", "NETWORK"));
+    });
+    ws.onerror = null;
+    ws.onclose = null;
+    ws.onmessage = (ev) => {
+      const frame = parseWakeFrame(typeof ev.data === "string" ? ev.data : String(ev.data));
+      if (!frame) return;
+      void this.noteSyncEpoch(frame.syncEpoch);
+      onWake(frame);
+    };
+    return { close: () => ws.close() };
+  }
+};
+
+// impl/shared/wallet-api/WalletApiTokenStorageProvider.ts
+function bytesToHex(bytes) {
+  return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+function hexToBytes(hex) {
+  const out = new Uint8Array(hex.length / 2);
+  for (let i = 0; i < out.length; i++) out[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+  return out;
+}
+function newTransferId() {
+  return globalThis.crypto.randomUUID();
+}
+function isV2BlobEntry(entry) {
+  if (typeof entry !== "object" || entry === null || "genesis" in entry) return false;
+  const sdkData = entry.sdkData;
+  return typeof sdkData === "string" && sdkData.length >= 2 && sdkData.length % 2 === 0 && /^[0-9a-f]+$/i.test(sdkData);
+}
+var WalletApiTokenStorageProvider = class {
+  id = "wallet-api-token-storage";
+  name = "Wallet API Token Storage";
+  type = "cloud";
+  client;
+  stateStore;
+  verifyToken;
+  status = "disconnected";
+  identity = null;
+  /** Local mirror of the inventory view — active rows and tombstones. */
+  view = /* @__PURE__ */ new Map();
+  /**
+   * Empty-import protection (§5.1): no removal is ever pushed before this
+   * flips on the first successful inventory load.
+   */
+  hadSuccessfulLoad = false;
+  constructor(config) {
+    this.client = config.client;
+    this.stateStore = config.stateStore;
+    this.verifyToken = config.verifyToken;
+  }
+  // ── provider lifecycle ──────────────────────────────────────────────────────
+  setIdentity(identity) {
+    this.identity = identity;
+    this.client.setIdentity({ privateKey: identity.privateKey, chainPubkey: identity.chainPubkey });
+    this.view.clear();
+    this.hadSuccessfulLoad = false;
+  }
+  async initialize() {
+    this.status = "connected";
+    return true;
+  }
+  async shutdown() {
+    this.status = "disconnected";
+  }
+  async connect() {
+    await this.initialize();
+  }
+  async disconnect() {
+    this.status = "disconnected";
+  }
+  isConnected() {
+    return this.status === "connected";
+  }
+  getStatus() {
+    return this.status;
+  }
+  // ── persisted sync state (per network + identity) ───────────────────────────
+  stateKey(kind) {
+    if (!this.identity) {
+      throw new WalletApiError("No identity set \u2014 call setIdentity() first", "CONFIG");
+    }
+    return `wallet-api-storage:${kind}:${this.client.network}:${this.identity.chainPubkey}`;
+  }
+  async readCursor() {
+    const raw = await this.stateStore.get(this.stateKey("cursor"));
+    return raw !== null && /^[0-9]+$/.test(raw) ? BigInt(raw) : null;
+  }
+  async readSyncEpoch() {
+    const raw = await this.stateStore.get(this.stateKey("syncEpoch"));
+    return raw !== null && /^[0-9]+$/.test(raw) ? BigInt(raw) : null;
+  }
+  async persistSyncState(cursor, syncEpoch) {
+    await this.stateStore.set(this.stateKey("cursor"), cursor.toString());
+    await this.stateStore.set(this.stateKey("syncEpoch"), syncEpoch.toString());
+  }
+  /** TokenIds this provider itself spent — `recoverRemoved()` skips these. */
+  async readKnownSpends() {
+    const raw = await this.stateStore.get(this.stateKey("knownSpends"));
+    if (!raw) return /* @__PURE__ */ new Set();
+    try {
+      return new Set(JSON.parse(raw));
+    } catch {
+      return /* @__PURE__ */ new Set();
+    }
+  }
+  async addKnownSpends(tokenIds) {
+    if (tokenIds.length === 0) return;
+    const known = await this.readKnownSpends();
+    for (const id of tokenIds) known.add(id);
+    await this.stateStore.set(this.stateKey("knownSpends"), JSON.stringify([...known]));
+  }
+  // ── inventory sync (§5.1) ───────────────────────────────────────────────────
+  applyItems(items) {
+    for (const item of items) {
+      this.view.set(item.tokenId, item);
+    }
+  }
+  /** Full pull + the §5.1 closing delta; replaces the whole local view. */
+  async fullPull() {
+    this.view.clear();
+    let page = await this.client.listInventory(void 0);
+    const firstPageCursor = page.cursor;
+    this.applyItems(page.items);
+    while (page.more) {
+      page = await this.client.listInventory(page.cursor);
+      this.applyItems(page.items);
+    }
+    let delta = await this.client.listInventory(firstPageCursor);
+    this.applyItems(delta.items);
+    while (delta.more) {
+      delta = await this.client.listInventory(delta.cursor);
+      this.applyItems(delta.items);
+    }
+    await this.persistSyncState(delta.cursor, delta.syncEpoch);
+  }
+  /**
+   * Delta loop from the persisted cursor. Returns `true` when the server's
+   * `syncEpoch` no longer matches the persisted one — the cursors are invalid
+   * (server restore, §5.4) and the caller must resync from scratch.
+   */
+  async deltaLoop(since) {
+    const knownEpoch = await this.readSyncEpoch();
+    let page = await this.client.listInventory(since);
+    if (knownEpoch !== null && page.syncEpoch !== knownEpoch) return true;
+    this.applyItems(page.items);
+    while (page.more) {
+      page = await this.client.listInventory(page.cursor);
+      if (knownEpoch !== null && page.syncEpoch !== knownEpoch) return true;
+      this.applyItems(page.items);
+    }
+    await this.persistSyncState(page.cursor, page.syncEpoch);
+    return false;
+  }
+  /** §5.4: discard cursors → full pull → re-PUT locally-known open intents. */
+  async handleSyncEpochChange() {
+    await this.stateStore.remove(this.stateKey("cursor"));
+    await this.stateStore.remove(this.stateKey("syncEpoch"));
+    await this.fullPull();
+    await this.client.resyncOpenIntents();
+  }
+  /** Converge the local view with the server (delta when possible). */
+  async syncInventory() {
+    const cursor = await this.readCursor();
+    if (cursor === null) {
+      await this.fullPull();
+    } else if (await this.deltaLoop(cursor)) {
+      await this.handleSyncEpochChange();
+    }
+    this.hadSuccessfulLoad = true;
+  }
+  // ── lazy inventory port (S2) ────────────────────────────────────────────────
+  /**
+   * Without `since`: converge with the server, then return the full active
+   * view (`more:false`) — a fresh device renders balances with zero blob
+   * downloads. With `since`: a true server delta page (tombstones included),
+   * also applied to the local view.
+   */
+  async listInventory(since) {
+    if (since === void 0) {
+      await this.syncInventory();
+      return this.snapshotView();
+    }
+    const knownEpoch = await this.readSyncEpoch();
+    const page = await this.client.listInventory(since);
+    if (knownEpoch !== null && page.syncEpoch !== knownEpoch) {
+      await this.handleSyncEpochChange();
+      this.hadSuccessfulLoad = true;
+      return this.snapshotView();
+    }
+    this.applyItems(page.items);
+    if (!page.more) {
+      const stored = await this.readCursor();
+      if (stored === null || page.cursor > stored) {
+        await this.persistSyncState(page.cursor, page.syncEpoch);
+      }
+    }
+    return page;
+  }
+  async snapshotView() {
+    const items = [...this.view.values()].filter((i) => i.status === "active");
+    const cursor = await this.readCursor() ?? 0n;
+    const syncEpoch = await this.readSyncEpoch() ?? 0n;
+    return { cursor, syncEpoch, more: false, items };
+  }
+  /** Fetch + decode one blob on demand via a short-lived signed GET (§5.1). */
+  async getToken(tokenId) {
+    const urls = await this.client.getBlobUrls([tokenId]);
+    const entry = urls.find((u) => u.tokenId === tokenId);
+    if (!entry) {
+      throw new WalletApiError(`No blob URL for token ${tokenId} (not owned here)`, "NOT_FOUND");
+    }
+    const bytes = await this.client.fetchBlob(entry.getUrl);
+    const blob = this.wrapWireBlob(tokenId, bytes);
+    if (blob.tokenId !== tokenId) {
+      throw new WalletApiError(
+        `Blob tokenId mismatch: requested ${tokenId}, blob carries ${blob.tokenId}`,
+        "PROTOCOL"
+      );
+    }
+    return blob;
+  }
+  /**
+   * The §16 wire serves RAW token bytes (§5.2/§8.2 — the sphere 39051
+   * envelope never crosses the API): re-wrap them for the engine-facing
+   * {@link TokenBlob} surface. Envelope bytes (older rows, fake-world seeds)
+   * still decode — their embedded tokenId is then checked by the caller. The
+   * `network` of a raw wrap is not recoverable without the engine; consumers
+   * derive it from the decoded token (`engine.decodeToken` re-wraps), so it
+   * is never read from this value.
+   */
+  wrapWireBlob(tokenId, bytes) {
+    try {
+      return decodeTokenBlob(bytes);
+    } catch {
+      return { v: TOKEN_BLOB_VERSION, network: 0, tokenId, token: bytes };
+    }
+  }
+  /**
+   * Record a spend (§5.3) — idempotent by `transferId` server-side. MUST be
+   * called after the mailbox deposit of the same `transferId` (the backend
+   * evidence-checks removals against it). Refreshes the local view from the
+   * resulting delta.
+   */
+  async applyDelta(transferId, spent, added, opts) {
+    await this.client.applyInventoryDelta({
+      transferId,
+      spent,
+      added,
+      ...opts?.externalDelivery !== void 0 ? { externalDelivery: opts.externalDelivery } : {}
+    });
+    await this.addKnownSpends(spent);
+    await this.syncInventory();
+  }
+  // ── recovery (§5.3, sdk-changes S2) ─────────────────────────────────────────
+  /**
+   * Re-add tombstoned tokens this client cannot match to a known spend (a
+   * wiped view — stolen JWT or a buggy client). Blobs are retained server-side
+   * and blob-urls works for own tombstoned rows; each candidate is re-fetched,
+   * locally verified, and re-added (reactivation). A `409` is the server's
+   * verdict that the tombstone is an evidenced spend — kept as spent.
+   */
+  async recoverRemoved() {
+    await this.syncInventory();
+    const knownSpends = await this.readKnownSpends();
+    const result = { recovered: [], spent: [], skipped: [] };
+    const candidates = [...this.view.values()].filter(
+      (i) => i.status === "removed" && !knownSpends.has(i.tokenId)
+    );
+    for (const item of candidates) {
+      const blobBytes = await this.fetchRemovedBlob(item.tokenId);
+      if (blobBytes === null || !await this.locallyValid(item.tokenId, blobBytes)) {
+        result.skipped.push(item.tokenId);
+        continue;
+      }
+      const key = `${this.client.network}/t/${bytesToHex(sha256(blobBytes))}`;
+      try {
+        await this.client.applyInventoryDelta({
+          transferId: newTransferId(),
+          spent: [],
+          added: [{ tokenId: item.tokenId, key }]
+        });
+        result.recovered.push(item.tokenId);
+      } catch (err) {
+        if (err instanceof WalletApiError && err.code === "CONFLICT") {
+          result.spent.push(item.tokenId);
+          await this.addKnownSpends([item.tokenId]);
+        } else {
+          throw err;
+        }
+      }
+    }
+    await this.syncInventory();
+    return result;
+  }
+  async fetchRemovedBlob(tokenId) {
+    const urls = await this.client.getBlobUrls([tokenId]);
+    const entry = urls.find((u) => u.tokenId === tokenId);
+    if (!entry) return null;
+    try {
+      return await this.client.fetchBlob(entry.getUrl);
+    } catch {
+      return null;
+    }
+  }
+  async locallyValid(tokenId, bytes) {
+    const blob = this.wrapWireBlob(tokenId, bytes);
+    if (blob.tokenId !== tokenId) return false;
+    if (this.verifyToken) return this.verifyToken(blob);
+    return true;
+  }
+  // ── whole-blob surface (thin: the hot path is the lazy port above) ──────────
+  /**
+   * Thin view: converges with the server and reports tombstones, but carries
+   * NO token entries — blobs are fetched on demand via `getToken()`
+   * (sdk-changes S2: `load()` no longer eagerly pulls every blob).
+   */
+  async load() {
+    try {
+      await this.syncInventory();
+    } catch (error) {
+      return {
+        success: false,
+        error: error instanceof Error ? error.message : "inventory sync failed",
+        source: "remote",
+        timestamp: Date.now()
+      };
+    }
+    const data = {
+      _meta: {
+        version: 1,
+        address: this.identity?.l1Address ?? "",
+        formatVersion: "2.0",
+        updatedAt: Date.now()
+      },
+      _tombstones: [...this.view.values()].filter((i) => i.status === "removed").map((i) => ({ tokenId: i.tokenId, stateHash: "", timestamp: Date.now() }))
+    };
+    return { success: true, data, source: "remote", timestamp: Date.now() };
+  }
+  /**
+   * Write-behind push of a whole-blob snapshot:
+   * - unknown tokens are uploaded (content-addressed, 412 = already present)
+   *   and added via one idempotent apply;
+   * - removals are pushed ONLY for confirmed spends (`_tombstones` entries)
+   *   and ONLY after a successful inventory load (empty-import protection,
+   *   §5.1) — a merely-absent token is never removed.
+   * A failed sync fails the save: pushing against an unknown server view
+   * could only do harm.
+   */
+  async save(data) {
+    try {
+      await this.syncInventory();
+      const tombstoneIds = new Set((data._tombstones ?? []).map((t) => t.tokenId));
+      await this.pushAdditions(data, tombstoneIds);
+      await this.pushRemovals(tombstoneIds);
+      await this.syncInventory();
+      return { success: true, timestamp: Date.now() };
+    } catch (error) {
+      return {
+        success: false,
+        error: error instanceof Error ? error.message : "wallet-api save failed",
+        timestamp: Date.now()
+      };
+    }
+  }
+  async pushAdditions(data, excluded) {
+    const toAdd = [];
+    for (const [key, value] of Object.entries(data)) {
+      if (!/^_[0-9a-f]{4,}$/i.test(key) || !isV2BlobEntry(value)) continue;
+      const tokenId = key.slice(1);
+      if (excluded.has(tokenId) || this.view.has(tokenId)) continue;
+      toAdd.push({ tokenId, bytes: unwrapTokenBlobBytes(hexToBytes(value.sdkData)) });
+    }
+    if (toAdd.length === 0) return;
+    const urls = await this.client.getUploadUrls(
+      toAdd.map((t) => ({ sha256: bytesToHex(sha256(t.bytes)), size: t.bytes.length }))
+    );
+    const added = [];
+    for (const token of toAdd) {
+      const sha = bytesToHex(sha256(token.bytes));
+      const url = urls.find((u) => u.sha256 === sha);
+      if (!url) {
+        throw new WalletApiError(`upload-urls response missing sha256 ${sha}`, "PROTOCOL");
+      }
+      await this.client.uploadBlob(url.putUrl, token.bytes);
+      added.push({ tokenId: token.tokenId, key: url.key });
+    }
+    await this.client.applyInventoryDelta({ transferId: newTransferId(), spent: [], added });
+  }
+  async pushRemovals(tombstoneIds) {
+    if (!this.hadSuccessfulLoad || tombstoneIds.size === 0) return;
+    const spent = [...tombstoneIds].filter((id) => this.view.get(id)?.status === "active");
+    if (spent.length === 0) return;
+    await this.client.applyInventoryDelta({ transferId: newTransferId(), spent, added: [] });
+    await this.addKnownSpends(spent);
+  }
+  async sync(localData) {
+    const result = await this.save(localData);
+    return {
+      success: result.success,
+      merged: localData,
+      added: 0,
+      removed: 0,
+      conflicts: 0,
+      error: result.error
+    };
+  }
+};
+function createWalletApiTokenStorageProvider(config) {
+  return new WalletApiTokenStorageProvider(config);
+}
+
+// transport/delivery-provider.ts
+function hexToBytes2(hex) {
+  const out = new Uint8Array(hex.length / 2);
+  for (let i = 0; i < out.length; i++) out[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+  return out;
+}
+function bytesToHex2(bytes) {
+  return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+function computeDeliveryId(tokenIdHex, stateHashHex) {
+  const tokenId = hexToBytes2(tokenIdHex);
+  const stateHash = hexToBytes2(stateHashHex);
+  const joined = new Uint8Array(tokenId.length + stateHash.length);
+  joined.set(tokenId, 0);
+  joined.set(stateHash, tokenId.length);
+  return bytesToHex2(sha256(joined));
+}
+function composeDeliveryKeys(keys) {
+  return { ...keys, deliveryId: computeDeliveryId(keys.tokenId, keys.stateHash) };
+}
+
+// node_modules/@noble/hashes/hmac.js
+var _HMAC = class {
+  oHash;
+  iHash;
+  blockLen;
+  outputLen;
+  canXOF = false;
+  finished = false;
+  destroyed = false;
+  constructor(hash, key) {
+    ahash(hash);
+    abytes(key, void 0, "key");
+    this.iHash = hash.create();
+    if (typeof this.iHash.update !== "function")
+      throw new Error("Expected instance of class which extends utils.Hash");
+    this.blockLen = this.iHash.blockLen;
+    this.outputLen = this.iHash.outputLen;
+    const blockLen = this.blockLen;
+    const pad = new Uint8Array(blockLen);
+    pad.set(key.length > blockLen ? hash.create().update(key).digest() : key);
+    for (let i = 0; i < pad.length; i++)
+      pad[i] ^= 54;
+    this.iHash.update(pad);
+    this.oHash = hash.create();
+    for (let i = 0; i < pad.length; i++)
+      pad[i] ^= 54 ^ 92;
+    this.oHash.update(pad);
+    clean(pad);
+  }
+  update(buf) {
+    aexists(this);
+    this.iHash.update(buf);
+    return this;
+  }
+  digestInto(out) {
+    aexists(this);
+    aoutput(out, this);
+    this.finished = true;
+    const buf = out.subarray(0, this.outputLen);
+    this.iHash.digestInto(buf);
+    this.oHash.update(buf);
+    this.oHash.digestInto(buf);
+    this.destroy();
+  }
+  digest() {
+    const out = new Uint8Array(this.oHash.outputLen);
+    this.digestInto(out);
+    return out;
+  }
+  _cloneInto(to) {
+    to ||= Object.create(Object.getPrototypeOf(this), {});
+    const { oHash, iHash, finished, destroyed, blockLen, outputLen } = this;
+    to = to;
+    to.finished = finished;
+    to.destroyed = destroyed;
+    to.blockLen = blockLen;
+    to.outputLen = outputLen;
+    to.oHash = oHash._cloneInto(to.oHash);
+    to.iHash = iHash._cloneInto(to.iHash);
+    return to;
+  }
+  clone() {
+    return this._cloneInto();
+  }
+  destroy() {
+    this.destroyed = true;
+    this.oHash.destroy();
+    this.iHash.destroy();
+  }
+};
+var hmac = /* @__PURE__ */ (() => {
+  const hmac_ = ((hash, key, message) => new _HMAC(hash, key).update(message).digest());
+  hmac_.create = (hash, key) => new _HMAC(hash, key);
+  return hmac_;
+})();
+
+// node_modules/@noble/hashes/hkdf.js
+function extract(hash, ikm, salt) {
+  ahash(hash);
+  if (salt === void 0)
+    salt = new Uint8Array(hash.outputLen);
+  return hmac(hash, salt, ikm);
+}
+var HKDF_COUNTER = /* @__PURE__ */ Uint8Array.of(0);
+var EMPTY_BUFFER = /* @__PURE__ */ Uint8Array.of();
+function expand(hash, prk, info, length = 32) {
+  ahash(hash);
+  anumber(length, "length");
+  abytes(prk, void 0, "prk");
+  const olen = hash.outputLen;
+  if (prk.length < olen)
+    throw new Error('"prk" must be at least HashLen octets');
+  if (length > 255 * olen)
+    throw new Error("Length must be <= 255*HashLen");
+  const blocks = Math.ceil(length / olen);
+  if (info === void 0)
+    info = EMPTY_BUFFER;
+  else
+    abytes(info, void 0, "info");
+  const okm = new Uint8Array(blocks * olen);
+  const HMAC = hmac.create(hash, prk);
+  const HMACTmp = HMAC._cloneInto();
+  const T = new Uint8Array(HMAC.outputLen);
+  for (let counter = 0; counter < blocks; counter++) {
+    HKDF_COUNTER[0] = counter + 1;
+    HMACTmp.update(counter === 0 ? EMPTY_BUFFER : T).update(info).update(HKDF_COUNTER).digestInto(T);
+    okm.set(T, olen * counter);
+    HMAC._cloneInto(HMACTmp);
+  }
+  HMAC.destroy();
+  HMACTmp.destroy();
+  clean(T, HKDF_COUNTER);
+  return okm.slice(0, length);
+}
+var hkdf = (hash, ikm, salt, info, length) => expand(hash, extract(hash, ikm, salt), info, length);
+
+// node_modules/@noble/ciphers/utils.js
+function isBytes2(a) {
+  return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array" && "BYTES_PER_ELEMENT" in a && a.BYTES_PER_ELEMENT === 1;
+}
+function abool(b) {
+  if (typeof b !== "boolean")
+    throw new TypeError(`boolean expected, not ${b}`);
+}
+function anumber2(n) {
+  if (typeof n !== "number")
+    throw new TypeError("number expected, got " + typeof n);
+  if (!Number.isSafeInteger(n) || n < 0)
+    throw new RangeError("positive integer expected, got " + n);
+}
+function abytes2(value, length, title = "") {
+  const bytes = isBytes2(value);
+  const len = value?.length;
+  const needsLen = length !== void 0;
+  if (!bytes || needsLen && len !== length) {
+    const prefix = title && `"${title}" `;
+    const ofLen = needsLen ? ` of length ${length}` : "";
+    const got = bytes ? `length=${len}` : `type=${typeof value}`;
+    const message = prefix + "expected Uint8Array" + ofLen + ", got " + got;
+    if (!bytes)
+      throw new TypeError(message);
+    throw new RangeError(message);
+  }
+  return value;
+}
+function aexists2(instance, checkFinished = true) {
+  if (instance.destroyed)
+    throw new Error("Hash instance has been destroyed");
+  if (checkFinished && instance.finished)
+    throw new Error("Hash#digest() has already been called");
+}
+function aoutput2(out, instance, onlyAligned = false) {
+  abytes2(out, void 0, "output");
+  const min = instance.outputLen;
+  if (out.length < min) {
+    throw new RangeError("digestInto() expects output buffer of length at least " + min);
+  }
+  if (onlyAligned && !isAligned32(out))
+    throw new Error("invalid output, must be aligned");
+}
+function u32(arr) {
+  return new Uint32Array(arr.buffer, arr.byteOffset, Math.floor(arr.byteLength / 4));
+}
+function clean2(...arrays) {
+  for (let i = 0; i < arrays.length; i++) {
+    arrays[i].fill(0);
+  }
+}
+function createView2(arr) {
+  return new DataView(arr.buffer, arr.byteOffset, arr.byteLength);
+}
+var isLE = /* @__PURE__ */ (() => new Uint8Array(new Uint32Array([287454020]).buffer)[0] === 68)();
+var byteSwap = (word) => word << 24 & 4278190080 | word << 8 & 16711680 | word >>> 8 & 65280 | word >>> 24 & 255;
+var swap8IfBE = isLE ? (n) => n : (n) => byteSwap(n) >>> 0;
+var byteSwap32 = (arr) => {
+  for (let i = 0; i < arr.length; i++)
+    arr[i] = byteSwap(arr[i]);
+  return arr;
+};
+var swap32IfBE = isLE ? (u) => u : byteSwap32;
+function checkOpts(defaults, opts) {
+  if (opts == null || typeof opts !== "object")
+    throw new Error("options must be defined");
+  const merged = Object.assign(defaults, opts);
+  return merged;
+}
+function equalBytes(a, b) {
+  if (a.length !== b.length)
+    return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++)
+    diff |= a[i] ^ b[i];
+  return diff === 0;
+}
+function wrapMacConstructor(keyLen, macCons, fromMsg) {
+  const mac = macCons;
+  const getArgs = fromMsg || (() => []);
+  const macC = (msg, key) => mac(key, ...getArgs(msg)).update(msg).digest();
+  const tmp = mac(new Uint8Array(keyLen), ...getArgs(new Uint8Array(0)));
+  macC.outputLen = tmp.outputLen;
+  macC.blockLen = tmp.blockLen;
+  macC.create = (key, ...args) => mac(key, ...args);
+  return macC;
+}
+var wrapCipher = /* @__NO_SIDE_EFFECTS__ */ (params, constructor) => {
+  function wrappedCipher(key, ...args) {
+    abytes2(key, void 0, "key");
+    if (params.nonceLength !== void 0) {
+      const nonce = args[0];
+      abytes2(nonce, params.varSizeNonce ? void 0 : params.nonceLength, "nonce");
+    }
+    const tagl = params.tagLength;
+    if (tagl && args[1] !== void 0)
+      abytes2(args[1], void 0, "AAD");
+    const cipher = constructor(key, ...args);
+    const checkOutput = (fnLength, output) => {
+      if (output !== void 0) {
+        if (fnLength !== 2)
+          throw new Error("cipher output not supported");
+        abytes2(output, void 0, "output");
+      }
+    };
+    let called = false;
+    const wrCipher = {
+      encrypt(data, output) {
+        if (called)
+          throw new Error("cannot encrypt() twice with same key + nonce");
+        called = true;
+        abytes2(data);
+        checkOutput(cipher.encrypt.length, output);
+        return cipher.encrypt(data, output);
+      },
+      decrypt(data, output) {
+        abytes2(data);
+        if (tagl && data.length < tagl)
+          throw new Error('"ciphertext" expected length bigger than tagLength=' + tagl);
+        checkOutput(cipher.decrypt.length, output);
+        return cipher.decrypt(data, output);
+      }
+    };
+    return wrCipher;
+  }
+  Object.assign(wrappedCipher, params);
+  return wrappedCipher;
+};
+function getOutput(expectedLength, out, onlyAligned = true) {
+  if (out === void 0)
+    return new Uint8Array(expectedLength);
+  abytes2(out, void 0, "output");
+  if (out.length !== expectedLength)
+    throw new Error('"output" expected Uint8Array of length ' + expectedLength + ", got: " + out.length);
+  if (onlyAligned && !isAligned32(out))
+    throw new Error("invalid output, must be aligned");
+  return out;
+}
+function u64Lengths(dataLength, aadLength, isLE2) {
+  anumber2(dataLength);
+  anumber2(aadLength);
+  abool(isLE2);
+  const num = new Uint8Array(16);
+  const view = createView2(num);
+  view.setBigUint64(0, BigInt(aadLength), isLE2);
+  view.setBigUint64(8, BigInt(dataLength), isLE2);
+  return num;
+}
+function isAligned32(bytes) {
+  return bytes.byteOffset % 4 === 0;
+}
+function copyBytes(bytes) {
+  return Uint8Array.from(abytes2(bytes));
+}
+function randomBytes(bytesLength = 32) {
+  anumber2(bytesLength);
+  const cr = typeof globalThis === "object" ? globalThis.crypto : null;
+  if (typeof cr?.getRandomValues !== "function")
+    throw new Error("crypto.getRandomValues must be defined");
+  return cr.getRandomValues(new Uint8Array(bytesLength));
+}
+
+// node_modules/@noble/ciphers/_arx.js
+var encodeStr = (str) => Uint8Array.from(str.split(""), (c) => c.charCodeAt(0));
+var sigma16_32 = /* @__PURE__ */ (() => swap32IfBE(u32(encodeStr("expand 16-byte k"))))();
+var sigma32_32 = /* @__PURE__ */ (() => swap32IfBE(u32(encodeStr("expand 32-byte k"))))();
+function rotl(a, b) {
+  return a << b | a >>> 32 - b;
+}
+var BLOCK_LEN = 64;
+var BLOCK_LEN32 = 16;
+var MAX_COUNTER = /* @__PURE__ */ (() => 2 ** 32 - 1)();
+var U32_EMPTY = /* @__PURE__ */ Uint32Array.of();
+function runCipher(core, sigma, key, nonce, data, output, counter, rounds) {
+  const len = data.length;
+  const block = new Uint8Array(BLOCK_LEN);
+  const b32 = u32(block);
+  const isAligned = isLE && isAligned32(data) && isAligned32(output);
+  const d32 = isAligned ? u32(data) : U32_EMPTY;
+  const o32 = isAligned ? u32(output) : U32_EMPTY;
+  if (!isLE) {
+    for (let pos = 0; pos < len; counter++) {
+      core(sigma, key, nonce, b32, counter, rounds);
+      swap32IfBE(b32);
+      if (counter >= MAX_COUNTER)
+        throw new Error("arx: counter overflow");
+      const take = Math.min(BLOCK_LEN, len - pos);
+      for (let j = 0, posj; j < take; j++) {
+        posj = pos + j;
+        output[posj] = data[posj] ^ block[j];
+      }
+      pos += take;
+    }
+    return;
+  }
+  for (let pos = 0; pos < len; counter++) {
+    core(sigma, key, nonce, b32, counter, rounds);
+    if (counter >= MAX_COUNTER)
+      throw new Error("arx: counter overflow");
+    const take = Math.min(BLOCK_LEN, len - pos);
+    if (isAligned && take === BLOCK_LEN) {
+      const pos32 = pos / 4;
+      if (pos % 4 !== 0)
+        throw new Error("arx: invalid block position");
+      for (let j = 0, posj; j < BLOCK_LEN32; j++) {
+        posj = pos32 + j;
+        o32[posj] = d32[posj] ^ b32[j];
+      }
+      pos += BLOCK_LEN;
+      continue;
+    }
+    for (let j = 0, posj; j < take; j++) {
+      posj = pos + j;
+      output[posj] = data[posj] ^ block[j];
+    }
+    pos += take;
+  }
+}
+function createCipher(core, opts) {
+  const { allowShortKeys, extendNonceFn, counterLength, counterRight, rounds } = checkOpts({ allowShortKeys: false, counterLength: 8, counterRight: false, rounds: 20 }, opts);
+  if (typeof core !== "function")
+    throw new Error("core must be a function");
+  anumber2(counterLength);
+  anumber2(rounds);
+  abool(counterRight);
+  abool(allowShortKeys);
+  return (key, nonce, data, output, counter = 0) => {
+    abytes2(key, void 0, "key");
+    abytes2(nonce, void 0, "nonce");
+    abytes2(data, void 0, "data");
+    const len = data.length;
+    output = getOutput(len, output, false);
+    anumber2(counter);
+    if (counter < 0 || counter >= MAX_COUNTER)
+      throw new Error("arx: counter overflow");
+    const toClean = [];
+    let l = key.length;
+    let k;
+    let sigma;
+    if (l === 32) {
+      toClean.push(k = copyBytes(key));
+      sigma = sigma32_32;
+    } else if (l === 16 && allowShortKeys) {
+      k = new Uint8Array(32);
+      k.set(key);
+      k.set(key, 16);
+      sigma = sigma16_32;
+      toClean.push(k);
+    } else {
+      abytes2(key, 32, "arx key");
+      throw new Error("invalid key size");
+    }
+    if (!isLE || !isAligned32(nonce))
+      toClean.push(nonce = copyBytes(nonce));
+    let k32 = u32(k);
+    if (extendNonceFn) {
+      if (nonce.length !== 24)
+        throw new Error(`arx: extended nonce must be 24 bytes`);
+      const n16 = nonce.subarray(0, 16);
+      if (isLE)
+        extendNonceFn(sigma, k32, u32(n16), k32);
+      else {
+        const sigmaRaw = swap32IfBE(Uint32Array.from(sigma));
+        extendNonceFn(sigmaRaw, k32, u32(n16), k32);
+        clean2(sigmaRaw);
+        swap32IfBE(k32);
+      }
+      nonce = nonce.subarray(16);
+    } else if (!isLE)
+      swap32IfBE(k32);
+    const nonceNcLen = 16 - counterLength;
+    if (nonceNcLen !== nonce.length)
+      throw new Error(`arx: nonce must be ${nonceNcLen} or 16 bytes`);
+    if (nonceNcLen !== 12) {
+      const nc = new Uint8Array(12);
+      nc.set(nonce, counterRight ? 0 : 12 - nonce.length);
+      nonce = nc;
+      toClean.push(nonce);
+    }
+    const n32 = swap32IfBE(u32(nonce));
+    try {
+      runCipher(core, sigma, k32, n32, data, output, counter, rounds);
+      return output;
+    } finally {
+      clean2(...toClean);
+    }
+  };
+}
+
+// node_modules/@noble/ciphers/_poly1305.js
+function u8to16(a, i) {
+  return a[i++] & 255 | (a[i++] & 255) << 8;
+}
+var Poly1305 = class {
+  blockLen = 16;
+  outputLen = 16;
+  buffer = new Uint8Array(16);
+  r = new Uint16Array(10);
+  // Allocating 1 array with .subarray() here is slower than 3
+  h = new Uint16Array(10);
+  pad = new Uint16Array(8);
+  pos = 0;
+  finished = false;
+  destroyed = false;
+  // Can be speed-up using BigUint64Array, at the cost of complexity
+  constructor(key) {
+    key = copyBytes(abytes2(key, 32, "key"));
+    const t0 = u8to16(key, 0);
+    const t1 = u8to16(key, 2);
+    const t2 = u8to16(key, 4);
+    const t3 = u8to16(key, 6);
+    const t4 = u8to16(key, 8);
+    const t5 = u8to16(key, 10);
+    const t6 = u8to16(key, 12);
+    const t7 = u8to16(key, 14);
+    this.r[0] = t0 & 8191;
+    this.r[1] = (t0 >>> 13 | t1 << 3) & 8191;
+    this.r[2] = (t1 >>> 10 | t2 << 6) & 7939;
+    this.r[3] = (t2 >>> 7 | t3 << 9) & 8191;
+    this.r[4] = (t3 >>> 4 | t4 << 12) & 255;
+    this.r[5] = t4 >>> 1 & 8190;
+    this.r[6] = (t4 >>> 14 | t5 << 2) & 8191;
+    this.r[7] = (t5 >>> 11 | t6 << 5) & 8065;
+    this.r[8] = (t6 >>> 8 | t7 << 8) & 8191;
+    this.r[9] = t7 >>> 5 & 127;
+    for (let i = 0; i < 8; i++)
+      this.pad[i] = u8to16(key, 16 + 2 * i);
+  }
+  process(data, offset, isLast = false) {
+    const hibit = isLast ? 0 : 1 << 11;
+    const { h, r } = this;
+    const r0 = r[0];
+    const r1 = r[1];
+    const r2 = r[2];
+    const r3 = r[3];
+    const r4 = r[4];
+    const r5 = r[5];
+    const r6 = r[6];
+    const r7 = r[7];
+    const r8 = r[8];
+    const r9 = r[9];
+    const t0 = u8to16(data, offset + 0);
+    const t1 = u8to16(data, offset + 2);
+    const t2 = u8to16(data, offset + 4);
+    const t3 = u8to16(data, offset + 6);
+    const t4 = u8to16(data, offset + 8);
+    const t5 = u8to16(data, offset + 10);
+    const t6 = u8to16(data, offset + 12);
+    const t7 = u8to16(data, offset + 14);
+    let h0 = h[0] + (t0 & 8191);
+    let h1 = h[1] + ((t0 >>> 13 | t1 << 3) & 8191);
+    let h2 = h[2] + ((t1 >>> 10 | t2 << 6) & 8191);
+    let h3 = h[3] + ((t2 >>> 7 | t3 << 9) & 8191);
+    let h4 = h[4] + ((t3 >>> 4 | t4 << 12) & 8191);
+    let h5 = h[5] + (t4 >>> 1 & 8191);
+    let h6 = h[6] + ((t4 >>> 14 | t5 << 2) & 8191);
+    let h7 = h[7] + ((t5 >>> 11 | t6 << 5) & 8191);
+    let h8 = h[8] + ((t6 >>> 8 | t7 << 8) & 8191);
+    let h9 = h[9] + (t7 >>> 5 | hibit);
+    let c = 0;
+    let d0 = c + h0 * r0 + h1 * (5 * r9) + h2 * (5 * r8) + h3 * (5 * r7) + h4 * (5 * r6);
+    c = d0 >>> 13;
+    d0 &= 8191;
+    d0 += h5 * (5 * r5) + h6 * (5 * r4) + h7 * (5 * r3) + h8 * (5 * r2) + h9 * (5 * r1);
+    c += d0 >>> 13;
+    d0 &= 8191;
+    let d1 = c + h0 * r1 + h1 * r0 + h2 * (5 * r9) + h3 * (5 * r8) + h4 * (5 * r7);
+    c = d1 >>> 13;
+    d1 &= 8191;
+    d1 += h5 * (5 * r6) + h6 * (5 * r5) + h7 * (5 * r4) + h8 * (5 * r3) + h9 * (5 * r2);
+    c += d1 >>> 13;
+    d1 &= 8191;
+    let d2 = c + h0 * r2 + h1 * r1 + h2 * r0 + h3 * (5 * r9) + h4 * (5 * r8);
+    c = d2 >>> 13;
+    d2 &= 8191;
+    d2 += h5 * (5 * r7) + h6 * (5 * r6) + h7 * (5 * r5) + h8 * (5 * r4) + h9 * (5 * r3);
+    c += d2 >>> 13;
+    d2 &= 8191;
+    let d3 = c + h0 * r3 + h1 * r2 + h2 * r1 + h3 * r0 + h4 * (5 * r9);
+    c = d3 >>> 13;
+    d3 &= 8191;
+    d3 += h5 * (5 * r8) + h6 * (5 * r7) + h7 * (5 * r6) + h8 * (5 * r5) + h9 * (5 * r4);
+    c += d3 >>> 13;
+    d3 &= 8191;
+    let d4 = c + h0 * r4 + h1 * r3 + h2 * r2 + h3 * r1 + h4 * r0;
+    c = d4 >>> 13;
+    d4 &= 8191;
+    d4 += h5 * (5 * r9) + h6 * (5 * r8) + h7 * (5 * r7) + h8 * (5 * r6) + h9 * (5 * r5);
+    c += d4 >>> 13;
+    d4 &= 8191;
+    let d5 = c + h0 * r5 + h1 * r4 + h2 * r3 + h3 * r2 + h4 * r1;
+    c = d5 >>> 13;
+    d5 &= 8191;
+    d5 += h5 * r0 + h6 * (5 * r9) + h7 * (5 * r8) + h8 * (5 * r7) + h9 * (5 * r6);
+    c += d5 >>> 13;
+    d5 &= 8191;
+    let d6 = c + h0 * r6 + h1 * r5 + h2 * r4 + h3 * r3 + h4 * r2;
+    c = d6 >>> 13;
+    d6 &= 8191;
+    d6 += h5 * r1 + h6 * r0 + h7 * (5 * r9) + h8 * (5 * r8) + h9 * (5 * r7);
+    c += d6 >>> 13;
+    d6 &= 8191;
+    let d7 = c + h0 * r7 + h1 * r6 + h2 * r5 + h3 * r4 + h4 * r3;
+    c = d7 >>> 13;
+    d7 &= 8191;
+    d7 += h5 * r2 + h6 * r1 + h7 * r0 + h8 * (5 * r9) + h9 * (5 * r8);
+    c += d7 >>> 13;
+    d7 &= 8191;
+    let d8 = c + h0 * r8 + h1 * r7 + h2 * r6 + h3 * r5 + h4 * r4;
+    c = d8 >>> 13;
+    d8 &= 8191;
+    d8 += h5 * r3 + h6 * r2 + h7 * r1 + h8 * r0 + h9 * (5 * r9);
+    c += d8 >>> 13;
+    d8 &= 8191;
+    let d9 = c + h0 * r9 + h1 * r8 + h2 * r7 + h3 * r6 + h4 * r5;
+    c = d9 >>> 13;
+    d9 &= 8191;
+    d9 += h5 * r4 + h6 * r3 + h7 * r2 + h8 * r1 + h9 * r0;
+    c += d9 >>> 13;
+    d9 &= 8191;
+    c = (c << 2) + c | 0;
+    c = c + d0 | 0;
+    d0 = c & 8191;
+    c = c >>> 13;
+    d1 += c;
+    h[0] = d0;
+    h[1] = d1;
+    h[2] = d2;
+    h[3] = d3;
+    h[4] = d4;
+    h[5] = d5;
+    h[6] = d6;
+    h[7] = d7;
+    h[8] = d8;
+    h[9] = d9;
+  }
+  finalize() {
+    const { h, pad } = this;
+    const g = new Uint16Array(10);
+    let c = h[1] >>> 13;
+    h[1] &= 8191;
+    for (let i = 2; i < 10; i++) {
+      h[i] += c;
+      c = h[i] >>> 13;
+      h[i] &= 8191;
+    }
+    h[0] += c * 5;
+    c = h[0] >>> 13;
+    h[0] &= 8191;
+    h[1] += c;
+    c = h[1] >>> 13;
+    h[1] &= 8191;
+    h[2] += c;
+    g[0] = h[0] + 5;
+    c = g[0] >>> 13;
+    g[0] &= 8191;
+    for (let i = 1; i < 10; i++) {
+      g[i] = h[i] + c;
+      c = g[i] >>> 13;
+      g[i] &= 8191;
+    }
+    g[9] -= 1 << 13;
+    let mask = (c ^ 1) - 1;
+    for (let i = 0; i < 10; i++)
+      g[i] &= mask;
+    mask = ~mask;
+    for (let i = 0; i < 10; i++)
+      h[i] = h[i] & mask | g[i];
+    h[0] = (h[0] | h[1] << 13) & 65535;
+    h[1] = (h[1] >>> 3 | h[2] << 10) & 65535;
+    h[2] = (h[2] >>> 6 | h[3] << 7) & 65535;
+    h[3] = (h[3] >>> 9 | h[4] << 4) & 65535;
+    h[4] = (h[4] >>> 12 | h[5] << 1 | h[6] << 14) & 65535;
+    h[5] = (h[6] >>> 2 | h[7] << 11) & 65535;
+    h[6] = (h[7] >>> 5 | h[8] << 8) & 65535;
+    h[7] = (h[8] >>> 8 | h[9] << 5) & 65535;
+    let f = h[0] + pad[0];
+    h[0] = f & 65535;
+    for (let i = 1; i < 8; i++) {
+      f = (h[i] + pad[i] | 0) + (f >>> 16) | 0;
+      h[i] = f & 65535;
+    }
+    clean2(g);
+  }
+  update(data) {
+    aexists2(this);
+    abytes2(data);
+    data = copyBytes(data);
+    const { buffer, blockLen } = this;
+    const len = data.length;
+    for (let pos = 0; pos < len; ) {
+      const take = Math.min(blockLen - this.pos, len - pos);
+      if (take === blockLen) {
+        for (; blockLen <= len - pos; pos += blockLen)
+          this.process(data, pos);
+        continue;
+      }
+      buffer.set(data.subarray(pos, pos + take), this.pos);
+      this.pos += take;
+      pos += take;
+      if (this.pos === blockLen) {
+        this.process(buffer, 0, false);
+        this.pos = 0;
+      }
+    }
+    return this;
+  }
+  destroy() {
+    this.destroyed = true;
+    clean2(this.h, this.r, this.buffer, this.pad);
+  }
+  digestInto(out) {
+    aexists2(this);
+    aoutput2(out, this);
+    this.finished = true;
+    const { buffer, h } = this;
+    let { pos } = this;
+    if (pos) {
+      buffer[pos++] = 1;
+      for (; pos < 16; pos++)
+        buffer[pos] = 0;
+      this.process(buffer, 0, true);
+    }
+    this.finalize();
+    let opos = 0;
+    for (let i = 0; i < 8; i++) {
+      out[opos++] = h[i] >>> 0;
+      out[opos++] = h[i] >>> 8;
+    }
+  }
+  digest() {
+    const { buffer, outputLen } = this;
+    this.digestInto(buffer);
+    const res = buffer.slice(0, outputLen);
+    this.destroy();
+    return res;
+  }
+};
+var poly1305 = /* @__PURE__ */ wrapMacConstructor(32, (key) => new Poly1305(key));
+
+// node_modules/@noble/ciphers/chacha.js
+function chachaCore(s, k, n, out, cnt, rounds = 20) {
+  let y00 = s[0], y01 = s[1], y02 = s[2], y03 = s[3], y04 = k[0], y05 = k[1], y06 = k[2], y07 = k[3], y08 = k[4], y09 = k[5], y10 = k[6], y11 = k[7], y12 = cnt, y13 = n[0], y14 = n[1], y15 = n[2];
+  let x00 = y00, x01 = y01, x02 = y02, x03 = y03, x04 = y04, x05 = y05, x06 = y06, x07 = y07, x08 = y08, x09 = y09, x10 = y10, x11 = y11, x12 = y12, x13 = y13, x14 = y14, x15 = y15;
+  for (let r = 0; r < rounds; r += 2) {
+    x00 = x00 + x04 | 0;
+    x12 = rotl(x12 ^ x00, 16);
+    x08 = x08 + x12 | 0;
+    x04 = rotl(x04 ^ x08, 12);
+    x00 = x00 + x04 | 0;
+    x12 = rotl(x12 ^ x00, 8);
+    x08 = x08 + x12 | 0;
+    x04 = rotl(x04 ^ x08, 7);
+    x01 = x01 + x05 | 0;
+    x13 = rotl(x13 ^ x01, 16);
+    x09 = x09 + x13 | 0;
+    x05 = rotl(x05 ^ x09, 12);
+    x01 = x01 + x05 | 0;
+    x13 = rotl(x13 ^ x01, 8);
+    x09 = x09 + x13 | 0;
+    x05 = rotl(x05 ^ x09, 7);
+    x02 = x02 + x06 | 0;
+    x14 = rotl(x14 ^ x02, 16);
+    x10 = x10 + x14 | 0;
+    x06 = rotl(x06 ^ x10, 12);
+    x02 = x02 + x06 | 0;
+    x14 = rotl(x14 ^ x02, 8);
+    x10 = x10 + x14 | 0;
+    x06 = rotl(x06 ^ x10, 7);
+    x03 = x03 + x07 | 0;
+    x15 = rotl(x15 ^ x03, 16);
+    x11 = x11 + x15 | 0;
+    x07 = rotl(x07 ^ x11, 12);
+    x03 = x03 + x07 | 0;
+    x15 = rotl(x15 ^ x03, 8);
+    x11 = x11 + x15 | 0;
+    x07 = rotl(x07 ^ x11, 7);
+    x00 = x00 + x05 | 0;
+    x15 = rotl(x15 ^ x00, 16);
+    x10 = x10 + x15 | 0;
+    x05 = rotl(x05 ^ x10, 12);
+    x00 = x00 + x05 | 0;
+    x15 = rotl(x15 ^ x00, 8);
+    x10 = x10 + x15 | 0;
+    x05 = rotl(x05 ^ x10, 7);
+    x01 = x01 + x06 | 0;
+    x12 = rotl(x12 ^ x01, 16);
+    x11 = x11 + x12 | 0;
+    x06 = rotl(x06 ^ x11, 12);
+    x01 = x01 + x06 | 0;
+    x12 = rotl(x12 ^ x01, 8);
+    x11 = x11 + x12 | 0;
+    x06 = rotl(x06 ^ x11, 7);
+    x02 = x02 + x07 | 0;
+    x13 = rotl(x13 ^ x02, 16);
+    x08 = x08 + x13 | 0;
+    x07 = rotl(x07 ^ x08, 12);
+    x02 = x02 + x07 | 0;
+    x13 = rotl(x13 ^ x02, 8);
+    x08 = x08 + x13 | 0;
+    x07 = rotl(x07 ^ x08, 7);
+    x03 = x03 + x04 | 0;
+    x14 = rotl(x14 ^ x03, 16);
+    x09 = x09 + x14 | 0;
+    x04 = rotl(x04 ^ x09, 12);
+    x03 = x03 + x04 | 0;
+    x14 = rotl(x14 ^ x03, 8);
+    x09 = x09 + x14 | 0;
+    x04 = rotl(x04 ^ x09, 7);
+  }
+  let oi = 0;
+  out[oi++] = y00 + x00 | 0;
+  out[oi++] = y01 + x01 | 0;
+  out[oi++] = y02 + x02 | 0;
+  out[oi++] = y03 + x03 | 0;
+  out[oi++] = y04 + x04 | 0;
+  out[oi++] = y05 + x05 | 0;
+  out[oi++] = y06 + x06 | 0;
+  out[oi++] = y07 + x07 | 0;
+  out[oi++] = y08 + x08 | 0;
+  out[oi++] = y09 + x09 | 0;
+  out[oi++] = y10 + x10 | 0;
+  out[oi++] = y11 + x11 | 0;
+  out[oi++] = y12 + x12 | 0;
+  out[oi++] = y13 + x13 | 0;
+  out[oi++] = y14 + x14 | 0;
+  out[oi++] = y15 + x15 | 0;
+}
+function hchacha(s, k, i, out) {
+  let x00 = swap8IfBE(s[0]), x01 = swap8IfBE(s[1]), x02 = swap8IfBE(s[2]), x03 = swap8IfBE(s[3]), x04 = swap8IfBE(k[0]), x05 = swap8IfBE(k[1]), x06 = swap8IfBE(k[2]), x07 = swap8IfBE(k[3]), x08 = swap8IfBE(k[4]), x09 = swap8IfBE(k[5]), x10 = swap8IfBE(k[6]), x11 = swap8IfBE(k[7]), x12 = swap8IfBE(i[0]), x13 = swap8IfBE(i[1]), x14 = swap8IfBE(i[2]), x15 = swap8IfBE(i[3]);
+  for (let r = 0; r < 20; r += 2) {
+    x00 = x00 + x04 | 0;
+    x12 = rotl(x12 ^ x00, 16);
+    x08 = x08 + x12 | 0;
+    x04 = rotl(x04 ^ x08, 12);
+    x00 = x00 + x04 | 0;
+    x12 = rotl(x12 ^ x00, 8);
+    x08 = x08 + x12 | 0;
+    x04 = rotl(x04 ^ x08, 7);
+    x01 = x01 + x05 | 0;
+    x13 = rotl(x13 ^ x01, 16);
+    x09 = x09 + x13 | 0;
+    x05 = rotl(x05 ^ x09, 12);
+    x01 = x01 + x05 | 0;
+    x13 = rotl(x13 ^ x01, 8);
+    x09 = x09 + x13 | 0;
+    x05 = rotl(x05 ^ x09, 7);
+    x02 = x02 + x06 | 0;
+    x14 = rotl(x14 ^ x02, 16);
+    x10 = x10 + x14 | 0;
+    x06 = rotl(x06 ^ x10, 12);
+    x02 = x02 + x06 | 0;
+    x14 = rotl(x14 ^ x02, 8);
+    x10 = x10 + x14 | 0;
+    x06 = rotl(x06 ^ x10, 7);
+    x03 = x03 + x07 | 0;
+    x15 = rotl(x15 ^ x03, 16);
+    x11 = x11 + x15 | 0;
+    x07 = rotl(x07 ^ x11, 12);
+    x03 = x03 + x07 | 0;
+    x15 = rotl(x15 ^ x03, 8);
+    x11 = x11 + x15 | 0;
+    x07 = rotl(x07 ^ x11, 7);
+    x00 = x00 + x05 | 0;
+    x15 = rotl(x15 ^ x00, 16);
+    x10 = x10 + x15 | 0;
+    x05 = rotl(x05 ^ x10, 12);
+    x00 = x00 + x05 | 0;
+    x15 = rotl(x15 ^ x00, 8);
+    x10 = x10 + x15 | 0;
+    x05 = rotl(x05 ^ x10, 7);
+    x01 = x01 + x06 | 0;
+    x12 = rotl(x12 ^ x01, 16);
+    x11 = x11 + x12 | 0;
+    x06 = rotl(x06 ^ x11, 12);
+    x01 = x01 + x06 | 0;
+    x12 = rotl(x12 ^ x01, 8);
+    x11 = x11 + x12 | 0;
+    x06 = rotl(x06 ^ x11, 7);
+    x02 = x02 + x07 | 0;
+    x13 = rotl(x13 ^ x02, 16);
+    x08 = x08 + x13 | 0;
+    x07 = rotl(x07 ^ x08, 12);
+    x02 = x02 + x07 | 0;
+    x13 = rotl(x13 ^ x02, 8);
+    x08 = x08 + x13 | 0;
+    x07 = rotl(x07 ^ x08, 7);
+    x03 = x03 + x04 | 0;
+    x14 = rotl(x14 ^ x03, 16);
+    x09 = x09 + x14 | 0;
+    x04 = rotl(x04 ^ x09, 12);
+    x03 = x03 + x04 | 0;
+    x14 = rotl(x14 ^ x03, 8);
+    x09 = x09 + x14 | 0;
+    x04 = rotl(x04 ^ x09, 7);
+  }
+  let oi = 0;
+  out[oi++] = x00;
+  out[oi++] = x01;
+  out[oi++] = x02;
+  out[oi++] = x03;
+  out[oi++] = x12;
+  out[oi++] = x13;
+  out[oi++] = x14;
+  out[oi++] = x15;
+  swap32IfBE(out);
+}
+var xchacha20 = /* @__PURE__ */ createCipher(chachaCore, {
+  counterRight: false,
+  counterLength: 8,
+  extendNonceFn: hchacha,
+  allowShortKeys: false
+});
+var ZEROS16 = /* @__PURE__ */ new Uint8Array(16);
+var updatePadded = (h, msg) => {
+  h.update(msg);
+  const leftover = msg.length % 16;
+  if (leftover)
+    h.update(ZEROS16.subarray(leftover));
+};
+var ZEROS32 = /* @__PURE__ */ new Uint8Array(32);
+function computeTag(fn, key, nonce, ciphertext, AAD) {
+  if (AAD !== void 0)
+    abytes2(AAD, void 0, "AAD");
+  const authKey = fn(key, nonce, ZEROS32);
+  const lengths = u64Lengths(ciphertext.length, AAD ? AAD.length : 0, true);
+  const h = poly1305.create(authKey);
+  if (AAD)
+    updatePadded(h, AAD);
+  updatePadded(h, ciphertext);
+  h.update(lengths);
+  const res = h.digest();
+  clean2(authKey, lengths);
+  return res;
+}
+var _poly1305_aead = (xorStream) => (key, nonce, AAD) => {
+  const tagLength = 16;
+  return {
+    encrypt(plaintext, output) {
+      const plength = plaintext.length;
+      output = getOutput(plength + tagLength, output, false);
+      output.set(plaintext);
+      const oPlain = output.subarray(0, -tagLength);
+      xorStream(key, nonce, oPlain, oPlain, 1);
+      const tag = computeTag(xorStream, key, nonce, oPlain, AAD);
+      output.set(tag, plength);
+      clean2(tag);
+      return output;
+    },
+    decrypt(ciphertext, output) {
+      output = getOutput(ciphertext.length - tagLength, output, false);
+      const data = ciphertext.subarray(0, -tagLength);
+      const passedTag = ciphertext.subarray(-tagLength);
+      const tag = computeTag(xorStream, key, nonce, data, AAD);
+      if (!equalBytes(passedTag, tag)) {
+        clean2(tag);
+        throw new Error("invalid tag");
+      }
+      output.set(ciphertext.subarray(0, -tagLength));
+      xorStream(key, nonce, output, output, 1);
+      clean2(tag);
+      return output;
+    }
+  };
+};
+var xchacha20poly1305 = /* @__PURE__ */ wrapCipher(
+  { blockSize: 64, nonceLength: 24, tagLength: 16 },
+  /* @__PURE__ */ _poly1305_aead(xchacha20)
+);
+
+// core/field-encryption.ts
+var FIELD_ENCRYPTION_HKDF_INFO = "sphere-fieldenc-v1";
+var FIELD_ENVELOPE_PREFIX = "enc1.";
+var FIELD_ENVELOPE_NONCE_BYTES = 24;
+var POLY1305_TAG_BYTES = 16;
+var B64_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+var B64_LOOKUP = {};
+for (let i = 0; i < B64_ALPHABET.length; i++) B64_LOOKUP[B64_ALPHABET[i]] = i;
+function base64Encode(bytes) {
+  let out = "";
+  for (let i = 0; i < bytes.length; i += 3) {
+    const b0 = bytes[i];
+    const b1 = i + 1 < bytes.length ? bytes[i + 1] : 0;
+    const b2 = i + 2 < bytes.length ? bytes[i + 2] : 0;
+    out += B64_ALPHABET[b0 >> 2];
+    out += B64_ALPHABET[(b0 & 3) << 4 | b1 >> 4];
+    out += i + 1 < bytes.length ? B64_ALPHABET[(b1 & 15) << 2 | b2 >> 6] : "=";
+    out += i + 2 < bytes.length ? B64_ALPHABET[b2 & 63] : "=";
+  }
+  return out;
+}
+function base64Decode(s) {
+  if (s.length % 4 !== 0) {
+    throw new SphereError("Invalid field envelope: base64 length not a multiple of 4", "DECRYPTION_ERROR");
+  }
+  let padding = 0;
+  if (s.endsWith("==")) padding = 2;
+  else if (s.endsWith("=")) padding = 1;
+  const body = s.slice(0, s.length - padding);
+  if (body.includes("=")) {
+    throw new SphereError("Invalid field envelope: misplaced base64 padding", "DECRYPTION_ERROR");
+  }
+  const out = new Uint8Array(s.length / 4 * 3 - padding);
+  let o = 0;
+  for (let i = 0; i < body.length; i += 4) {
+    const n0 = B64_LOOKUP[body[i]];
+    const n1 = B64_LOOKUP[body[i + 1]];
+    const n2 = body[i + 2] !== void 0 ? B64_LOOKUP[body[i + 2]] : 0;
+    const n3 = body[i + 3] !== void 0 ? B64_LOOKUP[body[i + 3]] : 0;
+    if (n0 === void 0 || n1 === void 0 || n2 === void 0 || n3 === void 0) {
+      throw new SphereError("Invalid field envelope: non-base64 character", "DECRYPTION_ERROR");
+    }
+    const triple = n0 << 18 | n1 << 12 | n2 << 6 | n3;
+    if (o < out.length) out[o++] = triple >> 16 & 255;
+    if (o < out.length) out[o++] = triple >> 8 & 255;
+    if (o < out.length) out[o++] = triple & 255;
+  }
+  return out;
+}
+function hexToBytesStrict(hex) {
+  if (hex.length === 0 || hex.length % 2 !== 0 || !/^[0-9a-fA-F]+$/.test(hex)) {
+    throw new SphereError("Invalid private key hex for field-encryption key derivation", "INVALID_CONFIG");
+  }
+  const out = new Uint8Array(hex.length / 2);
+  for (let i = 0; i < out.length; i++) {
+    out[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+  }
+  return out;
+}
+function deriveFieldEncryptionKey(privKeyHex) {
+  const ikm = hexToBytesStrict(privKeyHex);
+  const info = new TextEncoder().encode(FIELD_ENCRYPTION_HKDF_INFO);
+  return hkdf(sha256, ikm, void 0, info, 32);
+}
+function encryptField(key, plaintext) {
+  const nonce = randomBytes(FIELD_ENVELOPE_NONCE_BYTES);
+  const ciphertext = xchacha20poly1305(key, nonce).encrypt(new TextEncoder().encode(plaintext));
+  const packed = new Uint8Array(nonce.length + ciphertext.length);
+  packed.set(nonce, 0);
+  packed.set(ciphertext, nonce.length);
+  return FIELD_ENVELOPE_PREFIX + base64Encode(packed);
+}
+function decryptField(key, envelope) {
+  if (typeof envelope !== "string" || !envelope.startsWith(FIELD_ENVELOPE_PREFIX)) {
+    throw new SphereError('Invalid field envelope: missing "enc1." prefix', "DECRYPTION_ERROR");
+  }
+  const packed = base64Decode(envelope.slice(FIELD_ENVELOPE_PREFIX.length));
+  if (packed.length < FIELD_ENVELOPE_NONCE_BYTES + POLY1305_TAG_BYTES) {
+    throw new SphereError("Invalid field envelope: too short for nonce + tag", "DECRYPTION_ERROR");
+  }
+  const nonce = packed.slice(0, FIELD_ENVELOPE_NONCE_BYTES);
+  const ciphertext = packed.slice(FIELD_ENVELOPE_NONCE_BYTES);
+  try {
+    const plain = xchacha20poly1305(key, nonce).decrypt(ciphertext);
+    return new TextDecoder().decode(plain);
+  } catch (err) {
+    throw new SphereError("Field envelope authentication failed (tampered or wrong key)", "DECRYPTION_ERROR", err);
+  }
+}
+
+// core/logger.ts
+var LOGGER_KEY = "__sphere_sdk_logger__";
+function getState() {
+  const g = globalThis;
+  if (!g[LOGGER_KEY]) {
+    g[LOGGER_KEY] = { debug: false, tags: {}, handler: null };
+  }
+  return g[LOGGER_KEY];
+}
+function isEnabled(tag) {
+  const state = getState();
+  if (tag in state.tags) return state.tags[tag];
+  return state.debug;
+}
+var logger = {
+  /**
+   * Configure the logger. Can be called multiple times (last write wins).
+   * Typically called by createBrowserProviders(), createNodeProviders(), or Sphere.init().
+   */
+  configure(config) {
+    const state = getState();
+    if (config.debug !== void 0) state.debug = config.debug;
+    if (config.handler !== void 0) state.handler = config.handler;
+  },
+  /**
+   * Enable/disable debug logging for a specific tag.
+   * Per-tag setting overrides the global debug flag.
+   *
+   * @example
+   * ```ts
+   * logger.setTagDebug('Nostr', true);  // enable only Nostr logs
+   * logger.setTagDebug('Nostr', false); // disable Nostr logs even if global debug=true
+   * ```
+   */
+  setTagDebug(tag, enabled) {
+    getState().tags[tag] = enabled;
+  },
+  /**
+   * Clear per-tag override, falling back to global debug flag.
+   */
+  clearTagDebug(tag) {
+    delete getState().tags[tag];
+  },
+  /** Returns true if debug mode is enabled for the given tag (or globally). */
+  isDebugEnabled(tag) {
+    if (tag) return isEnabled(tag);
+    return getState().debug;
+  },
+  /**
+   * Debug-level log. Only shown when debug is enabled (globally or for this tag).
+   * Use for detailed operational information.
+   */
+  debug(tag, message, ...args) {
+    if (!isEnabled(tag)) return;
+    const state = getState();
+    if (state.handler) {
+      state.handler("debug", tag, message, ...args);
+    } else {
+      console.log(`[${tag}]`, message, ...args);
+    }
+  },
+  /**
+   * Warning-level log. ALWAYS shown regardless of debug flag.
+   * Use for important but non-critical issues (timeouts, retries, degraded state).
+   */
+  warn(tag, message, ...args) {
+    const state = getState();
+    if (state.handler) {
+      state.handler("warn", tag, message, ...args);
+    } else {
+      console.warn(`[${tag}]`, message, ...args);
+    }
+  },
+  /**
+   * Error-level log. ALWAYS shown regardless of debug flag.
+   * Use for critical failures that should never be silenced.
+   */
+  error(tag, message, ...args) {
+    const state = getState();
+    if (state.handler) {
+      state.handler("error", tag, message, ...args);
+    } else {
+      console.error(`[${tag}]`, message, ...args);
+    }
+  },
+  /** Reset all logger state (debug flag, tags, handler). Primarily for tests. */
+  reset() {
+    const g = globalThis;
+    delete g[LOGGER_KEY];
+  }
+};
+
+// impl/shared/wallet-api/WalletApiMailboxProvider.ts
+function bytesToHex4(bytes) {
+  return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+var TAG = "WalletApiMailbox";
+var WalletApiMailboxProvider = class {
+  custody;
+  client;
+  stateStore;
+  deriveKeysFn = null;
+  identity = null;
+  fieldKey = null;
+  constructor(config) {
+    this.client = config.client;
+    this.custody = config.custody;
+    this.stateStore = config.stateStore;
+    this.deriveKeysFn = config.deliveryKeys ?? null;
+  }
+  /** @inheritDoc — wired by PaymentsModule at init (engine-owning seam). */
+  bindDeliveryKeys(derive) {
+    this.deriveKeysFn = derive;
+  }
+  deriveKeys(blobBytes) {
+    if (this.deriveKeysFn === null) {
+      throw new WalletApiError(
+        "deliveryKeys derivation not bound \u2014 PaymentsModule binds ITokenEngine.deliveryKeys at init (S7)",
+        "PROTOCOL"
+      );
+    }
+    return this.deriveKeysFn(blobBytes);
+  }
+  /** Bind the wallet identity (derives the S6 field key; binds the client). */
+  setIdentity(identity) {
+    this.identity = identity;
+    this.fieldKey = deriveFieldEncryptionKey(identity.privateKey);
+    this.client.setIdentity(identity);
+  }
+  // ── persisted state (per network + identity) ────────────────────────────────
+  stateKey(kind) {
+    if (!this.identity) {
+      throw new WalletApiError("No identity set \u2014 call setIdentity() first", "CONFIG");
+    }
+    return `wallet-api-mailbox:${kind}:${this.client.network}:${this.identity.chainPubkey}`;
+  }
+  /**
+   * The persistent seen-set (S7): content-derived delivery ids — i.e. the
+   * canonical `SHA-256(tokenId ‖ stateHash)` encoding of the (tokenId,
+   * stateHash) pairs this wallet has already resolved.
+   */
+  async readSeen() {
+    const raw = await this.stateStore.get(this.stateKey("seen"));
+    if (!raw) return /* @__PURE__ */ new Set();
+    try {
+      return new Set(JSON.parse(raw));
+    } catch {
+      return /* @__PURE__ */ new Set();
+    }
+  }
+  async addSeen(deliveryIds) {
+    if (deliveryIds.length === 0) return;
+    const seen = await this.readSeen();
+    for (const id of deliveryIds) seen.add(id);
+    await this.stateStore.set(this.stateKey("seen"), JSON.stringify([...seen]));
+  }
+  async readCursorState() {
+    const raw = await this.stateStore.get(this.stateKey("cursor"));
+    if (!raw) return null;
+    try {
+      const parsed = JSON.parse(raw);
+      if (typeof parsed.cursor !== "string" || typeof parsed.syncEpoch !== "string") return null;
+      return { cursor: BigInt(parsed.cursor), syncEpoch: BigInt(parsed.syncEpoch) };
+    } catch {
+      return null;
+    }
+  }
+  async persistCursorState(cursor, syncEpoch) {
+    await this.stateStore.set(
+      this.stateKey("cursor"),
+      JSON.stringify({ cursor: cursor.toString(), syncEpoch: syncEpoch.toString() })
+    );
+  }
+  // ── deliver (S3: upload → deposit) ──────────────────────────────────────────
+  /**
+   * Idempotent per (token, state): the upload is content-addressed (412 =
+   * already present = success — §5.2) and the deposit is idempotent by the
+   * content-derived entry_id — it succeeds even after the recipient claimed
+   * (§6), which is what makes the sender's journal replay safe.
+   */
+  async deliver(recipientPubkey, blob, options) {
+    if (!this.fieldKey) {
+      throw new WalletApiError("No identity set \u2014 call setIdentity() first", "CONFIG");
+    }
+    const keys = composeDeliveryKeys(await this.deriveKeys(blob));
+    const wire = unwrapTokenBlobBytes(blob);
+    const sha = bytesToHex4(sha256(wire));
+    const urls = await this.client.getUploadUrls([{ sha256: sha, size: wire.length }]);
+    const upload = urls.find((u) => u.sha256 === sha);
+    if (!upload) {
+      throw new WalletApiError(`upload-urls response missing sha256 ${sha}`, "PROTOCOL");
+    }
+    await this.client.uploadBlob(upload.putUrl, wire);
+    let entryId;
+    try {
+      entryId = await this.client.depositMailbox({
+        recipientPubkey,
+        key: upload.key,
+        transferId: options.transferId,
+        stateHash: keys.stateHash,
+        tokenId: keys.tokenId,
+        ...options.memo !== void 0 ? { memo: encryptField(this.fieldKey, options.memo) } : {}
+      });
+    } catch (err) {
+      if (err instanceof WalletApiError && err.status === 409) {
+        return { deliveryId: keys.deliveryId };
+      }
+      throw err;
+    }
+    if (entryId !== keys.deliveryId) {
+      throw new WalletApiError(
+        `mailbox deposit returned a non-content-derived entryId (got ${entryId}, expected ${keys.deliveryId})`,
+        "PROTOCOL"
+      );
+    }
+    return { deliveryId: keys.deliveryId };
+  }
+  // ── incoming (S3: mailbox pull) ─────────────────────────────────────────────
+  /**
+   * Pull entries since the given cursor (or the persisted one), loop while
+   * `more`, and yield claimable deliveries not yet in the seen-set. The
+   * persisted cursor advances to the server's read pointer (§6) — entries at
+   * or below it are all resolved; the seen-set (not the cursor) is the replay
+   * guard, so a cursor reset is safe.
+   */
+  async *incoming(sinceCursor) {
+    const persisted = await this.readCursorState();
+    let since;
+    if (sinceCursor !== void 0) {
+      since = BigInt(sinceCursor);
+    } else {
+      since = persisted?.cursor ?? 0n;
+    }
+    const seen = await this.readSeen();
+    let page = await this.client.listMailbox(since);
+    if (persisted !== null && page.syncEpoch !== persisted.syncEpoch && sinceCursor === void 0) {
+      page = await this.client.listMailbox(0n);
+    }
+    for (; ; ) {
+      for (const entry of page.entries) {
+        if (seen.has(entry.entryId)) continue;
+        if (entry.status !== "unclaimed") {
+          seen.add(entry.entryId);
+          await this.addSeen([entry.entryId]);
+          continue;
+        }
+        yield this.toIncomingDelivery(entry);
+      }
+      await this.persistCursorState(page.readPointer, page.syncEpoch);
+      if (!page.more) break;
+      const lastSeq = page.entries.length > 0 ? page.entries[page.entries.length - 1].seq : since;
+      page = await this.client.listMailbox(lastSeq);
+    }
+  }
+  toIncomingDelivery(entry) {
+    const client = this.client;
+    const fieldKey = this.fieldKey;
+    const deriveKeys = (bytes) => this.deriveKeys(bytes);
+    let memo;
+    if (entry.memo !== void 0 && fieldKey) {
+      try {
+        memo = decryptField(fieldKey, entry.memo);
+      } catch {
+        logger.debug(TAG, `memo for entry ${entry.entryId.slice(0, 12)}\u2026 not decryptable with this wallet's key`);
+      }
+    }
+    return {
+      deliveryId: entry.entryId,
+      transferId: entry.transferId,
+      senderPubkey: entry.senderPubkey,
+      ...memo !== void 0 ? { memo } : {},
+      cursor: entry.seq.toString(),
+      async fetchBlob() {
+        if (entry.blobCollected || !entry.getUrl) {
+          throw new WalletApiError(
+            `mailbox entry ${entry.entryId} has no fetchable blob (blobCollected)`,
+            "PROTOCOL"
+          );
+        }
+        const bytes = await client.fetchBlob(entry.getUrl);
+        const keys = composeDeliveryKeys(await deriveKeys(bytes));
+        if (keys.deliveryId !== entry.entryId) {
+          throw new WalletApiError(
+            `mailbox blob does not match its entry id (expected ${entry.entryId}, bytes derive ${keys.deliveryId})`,
+            "PROTOCOL"
+          );
+        }
+        return bytes;
+      }
+    };
+  }
+  // ── ack (claim / reject) ────────────────────────────────────────────────────
+  async ack(deliveryId, disposition) {
+    if (disposition === "claimed") {
+      const intoInventory = this.custody === "inventory";
+      const result = await this.client.claimMailbox([deliveryId], intoInventory);
+      const failed = result.failed.find((f) => f.entryId === deliveryId);
+      if (failed) {
+        throw new WalletApiError(
+          `mailbox claim failed for ${deliveryId}: ${failed.code}`,
+          "CONFLICT"
+        );
+      }
+    } else {
+      await this.client.rejectMailbox([deliveryId]);
+    }
+    await this.addSeen([deliveryId]);
+  }
+  // ── wake (optional hook — §9: a nudge, never a correctness dependency) ──────
+  onWake(callback) {
+    let closed = false;
+    let close = null;
+    void this.client.connectWakeSocket((wake) => {
+      if (wake.stream === "mailbox") callback();
+    }).then((handle) => {
+      if (closed) handle.close();
+      else close = () => handle.close();
+    }).catch((err) => {
+      logger.debug(TAG, "wake socket unavailable (polling continues):", err);
+    });
+    return () => {
+      closed = true;
+      close?.();
+    };
+  }
+};
+function createWalletApiMailboxProvider(config) {
+  return new WalletApiMailboxProvider(config);
+}
+
+// impl/shared/wallet-api/composition.ts
+function createSphereProviders(base, ports = {}) {
+  return {
+    ...base,
+    ...ports.storage ? { tokenStorage: ports.storage } : {},
+    ...ports.engine ? { oracle: ports.engine } : {},
+    ...ports.delivery ? { delivery: ports.delivery } : {}
+  };
+}
+function buildClient(base, config) {
+  const stateStore = config.stateStore ?? base.storage;
+  const client = config.client ?? new WalletApiClient({
+    baseUrl: config.baseUrl,
+    network: config.network,
+    deviceId: config.deviceId ?? `sphere-${crypto.randomUUID()}`,
+    storage: stateStore,
+    fetchFn: config.fetchFn,
+    webSocketFactory: config.webSocketFactory
+  });
+  return { client, stateStore };
+}
+function createWalletApiProviders(base, config) {
+  const { client, stateStore } = buildClient(base, config);
+  const tokenStorage = new WalletApiTokenStorageProvider({
+    client,
+    stateStore,
+    verifyToken: config.verifyToken
+  });
+  const delivery = new WalletApiMailboxProvider({ client, custody: "inventory", stateStore });
+  return { ...base, tokenStorage, delivery, walletApi: client };
+}
+function createOwnStorageWalletApiProviders(base, config) {
+  const { client, stateStore } = buildClient(base, config);
+  const delivery = new WalletApiMailboxProvider({ client, custody: "external", stateStore });
+  return { ...base, delivery, walletApi: client };
+}
+/*! Bundled license information:
+
+@noble/ciphers/utils.js:
+  (*! noble-ciphers - MIT License (c) 2023 Paul Miller (paulmillr.com) *)
+*/
+//# sourceMappingURL=index.cjs.map