@voidly/agent-sdk 2.0.0 → 2.2.0

package/dist/index.mjs

@@ -49,11 +49,11 @@ var require_nacl_fast = __commonJS({
       var _9 = new Uint8Array(32);
       _9[0] = 9;
       var gf0 = gf(), gf1 = gf([1]), _121665 = gf([56129, 1]), D = gf([30883, 4953, 19914, 30187, 55467, 16705, 2637, 112, 59544, 30585, 16505, 36039, 65139, 11119, 27886, 20995]), D2 = gf([61785, 9906, 39828, 60374, 45398, 33411, 5274, 224, 53552, 61171, 33010, 6542, 64743, 22239, 55772, 9222]), X = gf([54554, 36645, 11616, 51542, 42930, 38181, 51040, 26924, 56412, 64982, 57905, 49316, 21502, 52590, 14035, 8553]), Y = gf([26200, 26214, 26214, 26214, 26214, 26214, 26214, 26214, 26214, 26214, 26214, 26214, 26214, 26214, 26214, 26214]), I = gf([41136, 18958, 6951, 50414, 58488, 44335, 6150, 12099, 55207, 15867, 153, 11085, 57099, 20417, 9344, 11139]);
-      function ts64(x, i, h, l) {
-        x[i] = h >> 24 & 255;
-        x[i + 1] = h >> 16 & 255;
-        x[i + 2] = h >> 8 & 255;
-        x[i + 3] = h & 255;
+      function ts64(x, i, h2, l) {
+        x[i] = h2 >> 24 & 255;
+        x[i + 1] = h2 >> 16 & 255;
+        x[i + 2] = h2 >> 8 & 255;
+        x[i + 3] = h2 & 255;
         x[i + 4] = l >> 24 & 255;
         x[i + 5] = l >> 16 & 255;
         x[i + 6] = l >> 8 & 255;
@@ -631,7 +631,7 @@ var require_nacl_fast = __commonJS({
         this.h[9] = h9;
       };
       poly1305.prototype.finish = function(mac, macpos) {
-        var g = new Uint16Array(10);
+        var g2 = new Uint16Array(10);
         var c, mask, f, i;
         if (this.leftover) {
           i = this.leftover;
@@ -654,19 +654,19 @@ var require_nacl_fast = __commonJS({
         c = this.h[1] >>> 13;
         this.h[1] &= 8191;
         this.h[2] += c;
-        g[0] = this.h[0] + 5;
-        c = g[0] >>> 13;
-        g[0] &= 8191;
+        g2[0] = this.h[0] + 5;
+        c = g2[0] >>> 13;
+        g2[0] &= 8191;
         for (i = 1; i < 10; i++) {
-          g[i] = this.h[i] + c;
-          c = g[i] >>> 13;
-          g[i] &= 8191;
+          g2[i] = this.h[i] + c;
+          c = g2[i] >>> 13;
+          g2[i] &= 8191;
         }
-        g[9] -= 1 << 13;
+        g2[9] -= 1 << 13;
         mask = (c ^ 1) - 1;
-        for (i = 0; i < 10; i++) g[i] &= mask;
+        for (i = 0; i < 10; i++) g2[i] &= mask;
         mask = ~mask;
-        for (i = 0; i < 10; i++) this.h[i] = this.h[i] & mask | g[i];
+        for (i = 0; i < 10; i++) this.h[i] = this.h[i] & mask | g2[i];
         this.h[0] = (this.h[0] | this.h[1] << 13) & 65535;
         this.h[1] = (this.h[1] >>> 3 | this.h[2] << 10) & 65535;
         this.h[2] = (this.h[2] >>> 6 | this.h[3] << 7) & 65535;
@@ -732,10 +732,10 @@ var require_nacl_fast = __commonJS({
         s.finish(out, outpos);
         return 0;
       }
-      function crypto_onetimeauth_verify(h, hpos, m, mpos, n, k) {
+      function crypto_onetimeauth_verify(h2, hpos, m, mpos, n, k) {
         var x = new Uint8Array(16);
         crypto_onetimeauth(x, 0, m, mpos, n, k);
-        return crypto_verify_16(h, hpos, x, 0);
+        return crypto_verify_16(h2, hpos, x, 0);
       }
       function crypto_secretbox(c, m, d, n, k) {
         var i;
@@ -1488,7 +1488,7 @@ var require_nacl_fast = __commonJS({
         1246189591
       ];
       function crypto_hashblocks_hl(hh, hl, m, n) {
-        var wh = new Int32Array(16), wl = new Int32Array(16), bh0, bh1, bh2, bh3, bh4, bh5, bh6, bh7, bl0, bl1, bl2, bl3, bl4, bl5, bl6, bl7, th, tl, i, j, h, l, a, b, c, d;
+        var wh = new Int32Array(16), wl = new Int32Array(16), bh0, bh1, bh2, bh3, bh4, bh5, bh6, bh7, bl0, bl1, bl2, bl3, bl4, bl5, bl6, bl7, th, tl, i, j, h2, l, a, b, c, d;
         var ah0 = hh[0], ah1 = hh[1], ah2 = hh[2], ah3 = hh[3], ah4 = hh[4], ah5 = hh[5], ah6 = hh[6], ah7 = hh[7], al0 = hl[0], al1 = hl[1], al2 = hl[2], al3 = hl[3], al4 = hl[4], al5 = hl[5], al6 = hl[6], al7 = hl[7];
         var pos = 0;
         while (n >= 128) {
@@ -1514,76 +1514,76 @@ var require_nacl_fast = __commonJS({
             bl5 = al5;
             bl6 = al6;
             bl7 = al7;
-            h = ah7;
+            h2 = ah7;
             l = al7;
             a = l & 65535;
             b = l >>> 16;
-            c = h & 65535;
-            d = h >>> 16;
-            h = (ah4 >>> 14 | al4 << 32 - 14) ^ (ah4 >>> 18 | al4 << 32 - 18) ^ (al4 >>> 41 - 32 | ah4 << 32 - (41 - 32));
+            c = h2 & 65535;
+            d = h2 >>> 16;
+            h2 = (ah4 >>> 14 | al4 << 32 - 14) ^ (ah4 >>> 18 | al4 << 32 - 18) ^ (al4 >>> 41 - 32 | ah4 << 32 - (41 - 32));
             l = (al4 >>> 14 | ah4 << 32 - 14) ^ (al4 >>> 18 | ah4 << 32 - 18) ^ (ah4 >>> 41 - 32 | al4 << 32 - (41 - 32));
             a += l & 65535;
             b += l >>> 16;
-            c += h & 65535;
-            d += h >>> 16;
-            h = ah4 & ah5 ^ ~ah4 & ah6;
+            c += h2 & 65535;
+            d += h2 >>> 16;
+            h2 = ah4 & ah5 ^ ~ah4 & ah6;
             l = al4 & al5 ^ ~al4 & al6;
             a += l & 65535;
             b += l >>> 16;
-            c += h & 65535;
-            d += h >>> 16;
-            h = K[i * 2];
+            c += h2 & 65535;
+            d += h2 >>> 16;
+            h2 = K[i * 2];
             l = K[i * 2 + 1];
             a += l & 65535;
             b += l >>> 16;
-            c += h & 65535;
-            d += h >>> 16;
-            h = wh[i % 16];
+            c += h2 & 65535;
+            d += h2 >>> 16;
+            h2 = wh[i % 16];
             l = wl[i % 16];
             a += l & 65535;
             b += l >>> 16;
-            c += h & 65535;
-            d += h >>> 16;
+            c += h2 & 65535;
+            d += h2 >>> 16;
             b += a >>> 16;
             c += b >>> 16;
             d += c >>> 16;
             th = c & 65535 | d << 16;
             tl = a & 65535 | b << 16;
-            h = th;
+            h2 = th;
             l = tl;
             a = l & 65535;
             b = l >>> 16;
-            c = h & 65535;
-            d = h >>> 16;
-            h = (ah0 >>> 28 | al0 << 32 - 28) ^ (al0 >>> 34 - 32 | ah0 << 32 - (34 - 32)) ^ (al0 >>> 39 - 32 | ah0 << 32 - (39 - 32));
+            c = h2 & 65535;
+            d = h2 >>> 16;
+            h2 = (ah0 >>> 28 | al0 << 32 - 28) ^ (al0 >>> 34 - 32 | ah0 << 32 - (34 - 32)) ^ (al0 >>> 39 - 32 | ah0 << 32 - (39 - 32));
             l = (al0 >>> 28 | ah0 << 32 - 28) ^ (ah0 >>> 34 - 32 | al0 << 32 - (34 - 32)) ^ (ah0 >>> 39 - 32 | al0 << 32 - (39 - 32));
             a += l & 65535;
             b += l >>> 16;
-            c += h & 65535;
-            d += h >>> 16;
-            h = ah0 & ah1 ^ ah0 & ah2 ^ ah1 & ah2;
+            c += h2 & 65535;
+            d += h2 >>> 16;
+            h2 = ah0 & ah1 ^ ah0 & ah2 ^ ah1 & ah2;
             l = al0 & al1 ^ al0 & al2 ^ al1 & al2;
             a += l & 65535;
             b += l >>> 16;
-            c += h & 65535;
-            d += h >>> 16;
+            c += h2 & 65535;
+            d += h2 >>> 16;
             b += a >>> 16;
             c += b >>> 16;
             d += c >>> 16;
             bh7 = c & 65535 | d << 16;
             bl7 = a & 65535 | b << 16;
-            h = bh3;
+            h2 = bh3;
             l = bl3;
             a = l & 65535;
             b = l >>> 16;
-            c = h & 65535;
-            d = h >>> 16;
-            h = th;
+            c = h2 & 65535;
+            d = h2 >>> 16;
+            h2 = th;
             l = tl;
             a += l & 65535;
             b += l >>> 16;
-            c += h & 65535;
-            d += h >>> 16;
+            c += h2 & 65535;
+            d += h2 >>> 16;
             b += a >>> 16;
             c += b >>> 16;
             d += c >>> 16;
@@ -1607,34 +1607,34 @@ var require_nacl_fast = __commonJS({
             al0 = bl7;
             if (i % 16 === 15) {
               for (j = 0; j < 16; j++) {
-                h = wh[j];
+                h2 = wh[j];
                 l = wl[j];
                 a = l & 65535;
                 b = l >>> 16;
-                c = h & 65535;
-                d = h >>> 16;
-                h = wh[(j + 9) % 16];
+                c = h2 & 65535;
+                d = h2 >>> 16;
+                h2 = wh[(j + 9) % 16];
                 l = wl[(j + 9) % 16];
                 a += l & 65535;
                 b += l >>> 16;
-                c += h & 65535;
-                d += h >>> 16;
+                c += h2 & 65535;
+                d += h2 >>> 16;
                 th = wh[(j + 1) % 16];
                 tl = wl[(j + 1) % 16];
-                h = (th >>> 1 | tl << 32 - 1) ^ (th >>> 8 | tl << 32 - 8) ^ th >>> 7;
+                h2 = (th >>> 1 | tl << 32 - 1) ^ (th >>> 8 | tl << 32 - 8) ^ th >>> 7;
                 l = (tl >>> 1 | th << 32 - 1) ^ (tl >>> 8 | th << 32 - 8) ^ (tl >>> 7 | th << 32 - 7);
                 a += l & 65535;
                 b += l >>> 16;
-                c += h & 65535;
-                d += h >>> 16;
+                c += h2 & 65535;
+                d += h2 >>> 16;
                 th = wh[(j + 14) % 16];
                 tl = wl[(j + 14) % 16];
-                h = (th >>> 19 | tl << 32 - 19) ^ (tl >>> 61 - 32 | th << 32 - (61 - 32)) ^ th >>> 6;
+                h2 = (th >>> 19 | tl << 32 - 19) ^ (tl >>> 61 - 32 | th << 32 - (61 - 32)) ^ th >>> 6;
                 l = (tl >>> 19 | th << 32 - 19) ^ (th >>> 61 - 32 | tl << 32 - (61 - 32)) ^ (tl >>> 6 | th << 32 - 6);
                 a += l & 65535;
                 b += l >>> 16;
-                c += h & 65535;
-                d += h >>> 16;
+                c += h2 & 65535;
+                d += h2 >>> 16;
                 b += a >>> 16;
                 c += b >>> 16;
                 d += c >>> 16;
@@ -1643,137 +1643,137 @@ var require_nacl_fast = __commonJS({
               }
             }
           }
-          h = ah0;
+          h2 = ah0;
           l = al0;
           a = l & 65535;
           b = l >>> 16;
-          c = h & 65535;
-          d = h >>> 16;
-          h = hh[0];
+          c = h2 & 65535;
+          d = h2 >>> 16;
+          h2 = hh[0];
           l = hl[0];
           a += l & 65535;
           b += l >>> 16;
-          c += h & 65535;
-          d += h >>> 16;
+          c += h2 & 65535;
+          d += h2 >>> 16;
           b += a >>> 16;
           c += b >>> 16;
           d += c >>> 16;
           hh[0] = ah0 = c & 65535 | d << 16;
           hl[0] = al0 = a & 65535 | b << 16;
-          h = ah1;
+          h2 = ah1;
           l = al1;
           a = l & 65535;
           b = l >>> 16;
-          c = h & 65535;
-          d = h >>> 16;
-          h = hh[1];
+          c = h2 & 65535;
+          d = h2 >>> 16;
+          h2 = hh[1];
           l = hl[1];
           a += l & 65535;
           b += l >>> 16;
-          c += h & 65535;
-          d += h >>> 16;
+          c += h2 & 65535;
+          d += h2 >>> 16;
           b += a >>> 16;
           c += b >>> 16;
           d += c >>> 16;
           hh[1] = ah1 = c & 65535 | d << 16;
           hl[1] = al1 = a & 65535 | b << 16;
-          h = ah2;
+          h2 = ah2;
           l = al2;
           a = l & 65535;
           b = l >>> 16;
-          c = h & 65535;
-          d = h >>> 16;
-          h = hh[2];
+          c = h2 & 65535;
+          d = h2 >>> 16;
+          h2 = hh[2];
           l = hl[2];
           a += l & 65535;
           b += l >>> 16;
-          c += h & 65535;
-          d += h >>> 16;
+          c += h2 & 65535;
+          d += h2 >>> 16;
           b += a >>> 16;
           c += b >>> 16;
           d += c >>> 16;
           hh[2] = ah2 = c & 65535 | d << 16;
           hl[2] = al2 = a & 65535 | b << 16;
-          h = ah3;
+          h2 = ah3;
           l = al3;
           a = l & 65535;
           b = l >>> 16;
-          c = h & 65535;
-          d = h >>> 16;
-          h = hh[3];
+          c = h2 & 65535;
+          d = h2 >>> 16;
+          h2 = hh[3];
           l = hl[3];
           a += l & 65535;
           b += l >>> 16;
-          c += h & 65535;
-          d += h >>> 16;
+          c += h2 & 65535;
+          d += h2 >>> 16;
           b += a >>> 16;
           c += b >>> 16;
           d += c >>> 16;
           hh[3] = ah3 = c & 65535 | d << 16;
           hl[3] = al3 = a & 65535 | b << 16;
-          h = ah4;
+          h2 = ah4;
           l = al4;
           a = l & 65535;
           b = l >>> 16;
-          c = h & 65535;
-          d = h >>> 16;
-          h = hh[4];
+          c = h2 & 65535;
+          d = h2 >>> 16;
+          h2 = hh[4];
           l = hl[4];
           a += l & 65535;
           b += l >>> 16;
-          c += h & 65535;
-          d += h >>> 16;
+          c += h2 & 65535;
+          d += h2 >>> 16;
           b += a >>> 16;
           c += b >>> 16;
           d += c >>> 16;
           hh[4] = ah4 = c & 65535 | d << 16;
           hl[4] = al4 = a & 65535 | b << 16;
-          h = ah5;
+          h2 = ah5;
           l = al5;
           a = l & 65535;
           b = l >>> 16;
-          c = h & 65535;
-          d = h >>> 16;
-          h = hh[5];
+          c = h2 & 65535;
+          d = h2 >>> 16;
+          h2 = hh[5];
           l = hl[5];
           a += l & 65535;
           b += l >>> 16;
-          c += h & 65535;
-          d += h >>> 16;
+          c += h2 & 65535;
+          d += h2 >>> 16;
           b += a >>> 16;
           c += b >>> 16;
           d += c >>> 16;
           hh[5] = ah5 = c & 65535 | d << 16;
           hl[5] = al5 = a & 65535 | b << 16;
-          h = ah6;
+          h2 = ah6;
           l = al6;
           a = l & 65535;
           b = l >>> 16;
-          c = h & 65535;
-          d = h >>> 16;
-          h = hh[6];
+          c = h2 & 65535;
+          d = h2 >>> 16;
+          h2 = hh[6];
           l = hl[6];
           a += l & 65535;
           b += l >>> 16;
-          c += h & 65535;
-          d += h >>> 16;
+          c += h2 & 65535;
+          d += h2 >>> 16;
           b += a >>> 16;
           c += b >>> 16;
           d += c >>> 16;
           hh[6] = ah6 = c & 65535 | d << 16;
           hl[6] = al6 = a & 65535 | b << 16;
-          h = ah7;
+          h2 = ah7;
           l = al7;
           a = l & 65535;
           b = l >>> 16;
-          c = h & 65535;
-          d = h >>> 16;
-          h = hh[7];
+          c = h2 & 65535;
+          d = h2 >>> 16;
+          h2 = hh[7];
           l = hl[7];
           a += l & 65535;
           b += l >>> 16;
-          c += h & 65535;
-          d += h >>> 16;
+          c += h2 & 65535;
+          d += h2 >>> 16;
           b += a >>> 16;
           c += b >>> 16;
           d += c >>> 16;
@@ -1813,8 +1813,8 @@ var require_nacl_fast = __commonJS({
         for (i = 0; i < 8; i++) ts64(out, 8 * i, hh[i], hl[i]);
         return 0;
       }
-      function add(p, q) {
-        var a = gf(), b = gf(), c = gf(), d = gf(), e = gf(), f = gf(), g = gf(), h = gf(), t = gf();
+      function add2(p, q) {
+        var a = gf(), b = gf(), c = gf(), d = gf(), e = gf(), f = gf(), g2 = gf(), h2 = gf(), t = gf();
         Z(a, p[1], p[0]);
         Z(t, q[1], q[0]);
         M(a, a, t);
@@ -1827,12 +1827,12 @@ var require_nacl_fast = __commonJS({
         A(d, d, d);
         Z(e, b, a);
         Z(f, d, c);
-        A(g, d, c);
-        A(h, b, a);
+        A(g2, d, c);
+        A(h2, b, a);
         M(p[0], e, f);
-        M(p[1], h, g);
-        M(p[2], g, f);
-        M(p[3], e, h);
+        M(p[1], h2, g2);
+        M(p[2], g2, f);
+        M(p[3], e, h2);
       }
       function cswap(p, q, b) {
         var i;
@@ -1857,8 +1857,8 @@ var require_nacl_fast = __commonJS({
         for (i = 255; i >= 0; --i) {
           b = s[i / 8 | 0] >> (i & 7) & 1;
           cswap(p, q, b);
-          add(q, p);
-          add(p, p);
+          add2(q, p);
+          add2(p, p);
           cswap(p, q, b);
         }
       }
@@ -1909,14 +1909,14 @@ var require_nacl_fast = __commonJS({
           r[i] = x[i] & 255;
         }
       }
-      function reduce(r) {
+      function reduce2(r) {
         var x = new Float64Array(64), i;
         for (i = 0; i < 64; i++) x[i] = r[i];
         for (i = 0; i < 64; i++) r[i] = 0;
         modL(r, x);
       }
       function crypto_sign(sm, m, n, sk) {
-        var d = new Uint8Array(64), h = new Uint8Array(64), r = new Uint8Array(64);
+        var d = new Uint8Array(64), h2 = new Uint8Array(64), r = new Uint8Array(64);
         var i, j, x = new Float64Array(64);
         var p = [gf(), gf(), gf(), gf()];
         crypto_hash(d, sk, 32);
@@ -1927,17 +1927,17 @@ var require_nacl_fast = __commonJS({
         for (i = 0; i < n; i++) sm[64 + i] = m[i];
         for (i = 0; i < 32; i++) sm[32 + i] = d[32 + i];
         crypto_hash(r, sm.subarray(32), n + 32);
-        reduce(r);
+        reduce2(r);
         scalarbase(p, r);
         pack(sm, p);
         for (i = 32; i < 64; i++) sm[i] = sk[i];
-        crypto_hash(h, sm, n + 64);
-        reduce(h);
+        crypto_hash(h2, sm, n + 64);
+        reduce2(h2);
         for (i = 0; i < 64; i++) x[i] = 0;
         for (i = 0; i < 32; i++) x[i] = r[i];
         for (i = 0; i < 32; i++) {
           for (j = 0; j < 32; j++) {
-            x[i + j] += h[i] * d[j];
+            x[i + j] += h2[i] * d[j];
           }
         }
         modL(sm.subarray(32), x);
@@ -1973,17 +1973,17 @@ var require_nacl_fast = __commonJS({
       }
       function crypto_sign_open(m, sm, n, pk) {
         var i;
-        var t = new Uint8Array(32), h = new Uint8Array(64);
+        var t = new Uint8Array(32), h2 = new Uint8Array(64);
         var p = [gf(), gf(), gf(), gf()], q = [gf(), gf(), gf(), gf()];
         if (n < 64) return -1;
         if (unpackneg(q, pk)) return -1;
         for (i = 0; i < n; i++) m[i] = sm[i];
         for (i = 0; i < 32; i++) m[i + 32] = pk[i];
-        crypto_hash(h, m, n);
-        reduce(h);
-        scalarmult(p, q, h);
+        crypto_hash(h2, m, n);
+        reduce2(h2);
+        scalarmult(p, q, h2);
         scalarbase(q, sm.subarray(32));
-        add(p, q);
+        add2(p, q);
         pack(t, p);
         n -= 64;
         if (crypto_verify_32(sm, 0, t, 0)) {
@@ -2044,7 +2044,7 @@ var require_nacl_fast = __commonJS({
         S,
         Z,
         pow2523,
-        add,
+        add: add2,
         set25519,
         modL,
         scalarmult,
@@ -2215,9 +2215,9 @@ var require_nacl_fast = __commonJS({
       nacl2.sign.signatureLength = crypto_sign_BYTES;
       nacl2.hash = function(msg) {
         checkArrayTypes(msg);
-        var h = new Uint8Array(crypto_hash_BYTES);
-        crypto_hash(h, msg, msg.length);
-        return h;
+        var h2 = new Uint8Array(crypto_hash_BYTES);
+        crypto_hash(h2, msg, msg.length);
+        return h2;
       };
       nacl2.hash.hashLength = crypto_hash_BYTES;
       nacl2.verify = function(x, y) {
@@ -2230,22 +2230,22 @@ var require_nacl_fast = __commonJS({
         randombytes = fn;
       };
       (function() {
-        var crypto = typeof self !== "undefined" ? self.crypto || self.msCrypto : null;
-        if (crypto && crypto.getRandomValues) {
+        var crypto2 = typeof self !== "undefined" ? self.crypto || self.msCrypto : null;
+        if (crypto2 && crypto2.getRandomValues) {
           var QUOTA = 65536;
           nacl2.setPRNG(function(x, n) {
             var i, v = new Uint8Array(n);
             for (i = 0; i < n; i += QUOTA) {
-              crypto.getRandomValues(v.subarray(i, i + Math.min(n - i, QUOTA)));
+              crypto2.getRandomValues(v.subarray(i, i + Math.min(n - i, QUOTA)));
             }
             for (i = 0; i < n; i++) x[i] = v[i];
             cleanup(v);
           });
         } else if (typeof __require !== "undefined") {
-          crypto = __require("crypto");
-          if (crypto && crypto.randomBytes) {
+          crypto2 = __require("crypto");
+          if (crypto2 && crypto2.randomBytes) {
             nacl2.setPRNG(function(x, n) {
-              var i, v = crypto.randomBytes(n);
+              var i, v = crypto2.randomBytes(n);
               for (i = 0; i < n; i++) x[i] = v[i];
               cleanup(v);
             });
@@ -2326,6 +2326,1603 @@ var require_nacl_util = __commonJS({
 // src/index.ts
 var import_tweetnacl = __toESM(require_nacl_fast());
 var import_tweetnacl_util = __toESM(require_nacl_util());
+
+// node_modules/mlkem/esm/src/errors.js
+var MlKemError = class extends Error {
+  constructor(e) {
+    let message;
+    if (e instanceof Error) {
+      message = e.message;
+    } else if (typeof e === "string") {
+      message = e;
+    } else {
+      message = "";
+    }
+    super(message);
+    this.name = this.constructor.name;
+  }
+};
+
+// node_modules/mlkem/esm/src/consts.js
+var N = 256;
+var Q = 3329;
+var Q_INV = 62209;
+var NTT_ZETAS = [
+  2285,
+  2571,
+  2970,
+  1812,
+  1493,
+  1422,
+  287,
+  202,
+  3158,
+  622,
+  1577,
+  182,
+  962,
+  2127,
+  1855,
+  1468,
+  573,
+  2004,
+  264,
+  383,
+  2500,
+  1458,
+  1727,
+  3199,
+  2648,
+  1017,
+  732,
+  608,
+  1787,
+  411,
+  3124,
+  1758,
+  1223,
+  652,
+  2777,
+  1015,
+  2036,
+  1491,
+  3047,
+  1785,
+  516,
+  3321,
+  3009,
+  2663,
+  1711,
+  2167,
+  126,
+  1469,
+  2476,
+  3239,
+  3058,
+  830,
+  107,
+  1908,
+  3082,
+  2378,
+  2931,
+  961,
+  1821,
+  2604,
+  448,
+  2264,
+  677,
+  2054,
+  2226,
+  430,
+  555,
+  843,
+  2078,
+  871,
+  1550,
+  105,
+  422,
+  587,
+  177,
+  3094,
+  3038,
+  2869,
+  1574,
+  1653,
+  3083,
+  778,
+  1159,
+  3182,
+  2552,
+  1483,
+  2727,
+  1119,
+  1739,
+  644,
+  2457,
+  349,
+  418,
+  329,
+  3173,
+  3254,
+  817,
+  1097,
+  603,
+  610,
+  1322,
+  2044,
+  1864,
+  384,
+  2114,
+  3193,
+  1218,
+  1994,
+  2455,
+  220,
+  2142,
+  1670,
+  2144,
+  1799,
+  2051,
+  794,
+  1819,
+  2475,
+  2459,
+  478,
+  3221,
+  3021,
+  996,
+  991,
+  958,
+  1869,
+  1522,
+  1628
+];
+var NTT_ZETAS_INV = [
+  1701,
+  1807,
+  1460,
+  2371,
+  2338,
+  2333,
+  308,
+  108,
+  2851,
+  870,
+  854,
+  1510,
+  2535,
+  1278,
+  1530,
+  1185,
+  1659,
+  1187,
+  3109,
+  874,
+  1335,
+  2111,
+  136,
+  1215,
+  2945,
+  1465,
+  1285,
+  2007,
+  2719,
+  2726,
+  2232,
+  2512,
+  75,
+  156,
+  3e3,
+  2911,
+  2980,
+  872,
+  2685,
+  1590,
+  2210,
+  602,
+  1846,
+  777,
+  147,
+  2170,
+  2551,
+  246,
+  1676,
+  1755,
+  460,
+  291,
+  235,
+  3152,
+  2742,
+  2907,
+  3224,
+  1779,
+  2458,
+  1251,
+  2486,
+  2774,
+  2899,
+  1103,
+  1275,
+  2652,
+  1065,
+  2881,
+  725,
+  1508,
+  2368,
+  398,
+  951,
+  247,
+  1421,
+  3222,
+  2499,
+  271,
+  90,
+  853,
+  1860,
+  3203,
+  1162,
+  1618,
+  666,
+  320,
+  8,
+  2813,
+  1544,
+  282,
+  1838,
+  1293,
+  2314,
+  552,
+  2677,
+  2106,
+  1571,
+  205,
+  2918,
+  1542,
+  2721,
+  2597,
+  2312,
+  681,
+  130,
+  1602,
+  1871,
+  829,
+  2946,
+  3065,
+  1325,
+  2756,
+  1861,
+  1474,
+  1202,
+  2367,
+  3147,
+  1752,
+  2707,
+  171,
+  3127,
+  3042,
+  1907,
+  1836,
+  1517,
+  359,
+  758,
+  1441
+];
+
+// node_modules/mlkem/esm/src/sha3/_u64.js
+var U32_MASK64 = /* @__PURE__ */ BigInt(2 ** 32 - 1);
+var _32n = /* @__PURE__ */ BigInt(32);
+function fromBig(n, le = false) {
+  if (le) {
+    return { h: Number(n & U32_MASK64), l: Number(n >> _32n & U32_MASK64) };
+  }
+  return {
+    h: Number(n >> _32n & U32_MASK64) | 0,
+    l: Number(n & U32_MASK64) | 0
+  };
+}
+function split(lst, le = false) {
+  const len = lst.length;
+  const Ah = new Uint32Array(len);
+  const Al = new Uint32Array(len);
+  for (let i = 0; i < len; i++) {
+    const { h: h2, l } = fromBig(lst[i], le);
+    [Ah[i], Al[i]] = [h2, l];
+  }
+  return [Ah, Al];
+}
+var rotlSH = (h2, l, s) => h2 << s | l >>> 32 - s;
+var rotlSL = (h2, l, s) => l << s | h2 >>> 32 - s;
+var rotlBH = (h2, l, s) => l << s - 32 | h2 >>> 64 - s;
+var rotlBL = (h2, l, s) => h2 << s - 32 | l >>> 64 - s;
+
+// node_modules/mlkem/esm/src/sha3/utils.js
+function isBytes(a) {
+  return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array";
+}
+function anumber(n, title = "") {
+  if (!Number.isSafeInteger(n) || n < 0) {
+    const prefix = title && `"${title}" `;
+    throw new Error(`${prefix}expected integer >0, got ${n}`);
+  }
+}
+function abytes(value, length, title = "") {
+  const bytes = isBytes(value);
+  const len = value?.length;
+  const needsLen = length !== void 0;
+  if (!bytes || needsLen && len !== length) {
+    const prefix = title && `"${title}" `;
+    const ofLen = needsLen ? ` of length ${length}` : "";
+    const got = bytes ? `length=${len}` : `type=${typeof value}`;
+    throw new Error(prefix + "expected Uint8Array" + ofLen + ", got " + got);
+  }
+  return value;
+}
+function aexists(instance, checkFinished = true) {
+  if (instance.destroyed)
+    throw new Error("Hash instance has been destroyed");
+  if (checkFinished && instance.finished) {
+    throw new Error("Hash#digest() has already been called");
+  }
+}
+function aoutput(out, instance) {
+  abytes(out, void 0, "digestInto() output");
+  const min = instance.outputLen;
+  if (out.length < min) {
+    throw new Error('"digestInto() output" expected to be of length >=' + min);
+  }
+}
+function u32(arr) {
+  return new Uint32Array(arr.buffer, arr.byteOffset, Math.floor(arr.byteLength / 4));
+}
+function clean(...arrays) {
+  for (let i = 0; i < arrays.length; i++) {
+    arrays[i].fill(0);
+  }
+}
+var isLE = /* @__PURE__ */ (() => new Uint8Array(new Uint32Array([287454020]).buffer)[0] === 68)();
+function byteSwap(word) {
+  return word << 24 & 4278190080 | word << 8 & 16711680 | word >>> 8 & 65280 | word >>> 24 & 255;
+}
+function byteSwap32(arr) {
+  for (let i = 0; i < arr.length; i++) {
+    arr[i] = byteSwap(arr[i]);
+  }
+  return arr;
+}
+var swap32IfBE = isLE ? (u) => u : byteSwap32;
+function createHasher(hashCons, info = {}) {
+  const hashC = (msg, opts) => hashCons(opts).update(msg).digest();
+  const tmp = hashCons(void 0);
+  hashC.outputLen = tmp.outputLen;
+  hashC.blockLen = tmp.blockLen;
+  hashC.create = (opts) => hashCons(opts);
+  Object.assign(hashC, info);
+  return Object.freeze(hashC);
+}
+var oidNist = (suffix) => ({
+  oid: Uint8Array.from([
+    6,
+    9,
+    96,
+    134,
+    72,
+    1,
+    101,
+    3,
+    4,
+    2,
+    suffix
+  ])
+});
+
+// node_modules/mlkem/esm/src/sha3/sha3.js
+var _0n = BigInt(0);
+var _1n = BigInt(1);
+var _2n = BigInt(2);
+var _7n = BigInt(7);
+var _256n = BigInt(256);
+var _0x71n = BigInt(113);
+var SHA3_PI = [];
+var SHA3_ROTL = [];
+var _SHA3_IOTA = [];
+for (let round = 0, R = _1n, x = 1, y = 0; round < 24; round++) {
+  [x, y] = [y, (2 * x + 3 * y) % 5];
+  SHA3_PI.push(2 * (5 * y + x));
+  SHA3_ROTL.push((round + 1) * (round + 2) / 2 % 64);
+  let t = _0n;
+  for (let j = 0; j < 7; j++) {
+    R = (R << _1n ^ (R >> _7n) * _0x71n) % _256n;
+    if (R & _2n)
+      t ^= _1n << (_1n << BigInt(j)) - _1n;
+  }
+  _SHA3_IOTA.push(t);
+}
+var IOTAS = split(_SHA3_IOTA, true);
+var SHA3_IOTA_H = IOTAS[0];
+var SHA3_IOTA_L = IOTAS[1];
+var rotlH = (h2, l, s) => s > 32 ? rotlBH(h2, l, s) : rotlSH(h2, l, s);
+var rotlL = (h2, l, s) => s > 32 ? rotlBL(h2, l, s) : rotlSL(h2, l, s);
+function keccakP(s, rounds = 24) {
+  const B = new Uint32Array(5 * 2);
+  for (let round = 24 - rounds; round < 24; round++) {
+    for (let x = 0; x < 10; x++) {
+      B[x] = s[x] ^ s[x + 10] ^ s[x + 20] ^ s[x + 30] ^ s[x + 40];
+    }
+    for (let x = 0; x < 10; x += 2) {
+      const idx1 = (x + 8) % 10;
+      const idx0 = (x + 2) % 10;
+      const B0 = B[idx0];
+      const B1 = B[idx0 + 1];
+      const Th = rotlH(B0, B1, 1) ^ B[idx1];
+      const Tl = rotlL(B0, B1, 1) ^ B[idx1 + 1];
+      for (let y = 0; y < 50; y += 10) {
+        s[x + y] ^= Th;
+        s[x + y + 1] ^= Tl;
+      }
+    }
+    let curH = s[2];
+    let curL = s[3];
+    for (let t = 0; t < 24; t++) {
+      const shift = SHA3_ROTL[t];
+      const Th = rotlH(curH, curL, shift);
+      const Tl = rotlL(curH, curL, shift);
+      const PI = SHA3_PI[t];
+      curH = s[PI];
+      curL = s[PI + 1];
+      s[PI] = Th;
+      s[PI + 1] = Tl;
+    }
+    for (let y = 0; y < 50; y += 10) {
+      for (let x = 0; x < 10; x++)
+        B[x] = s[y + x];
+      for (let x = 0; x < 10; x++) {
+        s[y + x] ^= ~B[(x + 2) % 10] & B[(x + 4) % 10];
+      }
+    }
+    s[0] ^= SHA3_IOTA_H[round];
+    s[1] ^= SHA3_IOTA_L[round];
+  }
+  clean(B);
+}
+var Keccak = class _Keccak {
+  // NOTE: we accept arguments in bytes instead of bits here.
+  constructor(blockLen, suffix, outputLen, enableXOF = false, rounds = 24) {
+    Object.defineProperty(this, "state", {
+      enumerable: true,
+      configurable: true,
+      writable: true,
+      value: void 0
+    });
+    Object.defineProperty(this, "pos", {
+      enumerable: true,
+      configurable: true,
+      writable: true,
+      value: 0
+    });
+    Object.defineProperty(this, "posOut", {
+      enumerable: true,
+      configurable: true,
+      writable: true,
+      value: 0
+    });
+    Object.defineProperty(this, "finished", {
+      enumerable: true,
+      configurable: true,
+      writable: true,
+      value: false
+    });
+    Object.defineProperty(this, "state32", {
+      enumerable: true,
+      configurable: true,
+      writable: true,
+      value: void 0
+    });
+    Object.defineProperty(this, "destroyed", {
+      enumerable: true,
+      configurable: true,
+      writable: true,
+      value: false
+    });
+    Object.defineProperty(this, "blockLen", {
+      enumerable: true,
+      configurable: true,
+      writable: true,
+      value: void 0
+    });
+    Object.defineProperty(this, "suffix", {
+      enumerable: true,
+      configurable: true,
+      writable: true,
+      value: void 0
+    });
+    Object.defineProperty(this, "outputLen", {
+      enumerable: true,
+      configurable: true,
+      writable: true,
+      value: void 0
+    });
+    Object.defineProperty(this, "enableXOF", {
+      enumerable: true,
+      configurable: true,
+      writable: true,
+      value: false
+    });
+    Object.defineProperty(this, "rounds", {
+      enumerable: true,
+      configurable: true,
+      writable: true,
+      value: void 0
+    });
+    this.blockLen = blockLen;
+    this.suffix = suffix;
+    this.outputLen = outputLen;
+    this.enableXOF = enableXOF;
+    this.rounds = rounds;
+    anumber(outputLen, "outputLen");
+    if (!(0 < blockLen && blockLen < 200)) {
+      throw new Error("only keccak-f1600 function is supported");
+    }
+    this.state = new Uint8Array(200);
+    this.state32 = u32(this.state);
+  }
+  clone() {
+    return this._cloneInto();
+  }
+  keccak() {
+    swap32IfBE(this.state32);
+    keccakP(this.state32, this.rounds);
+    swap32IfBE(this.state32);
+    this.posOut = 0;
+    this.pos = 0;
+  }
+  update(data) {
+    aexists(this);
+    abytes(data);
+    const { blockLen, state } = this;
+    const len = data.length;
+    for (let pos = 0; pos < len; ) {
+      const take = Math.min(blockLen - this.pos, len - pos);
+      for (let i = 0; i < take; i++)
+        state[this.pos++] ^= data[pos++];
+      if (this.pos === blockLen)
+        this.keccak();
+    }
+    return this;
+  }
+  finish() {
+    if (this.finished)
+      return;
+    this.finished = true;
+    const { state, suffix, pos, blockLen } = this;
+    state[pos] ^= suffix;
+    if ((suffix & 128) !== 0 && pos === blockLen - 1)
+      this.keccak();
+    state[blockLen - 1] ^= 128;
+    this.keccak();
+  }
+  writeInto(out) {
+    aexists(this, false);
+    abytes(out);
+    this.finish();
+    const bufferOut = this.state;
+    const { blockLen } = this;
+    for (let pos = 0, len = out.length; pos < len; ) {
+      if (this.posOut >= blockLen)
+        this.keccak();
+      const take = Math.min(blockLen - this.posOut, len - pos);
+      out.set(bufferOut.subarray(this.posOut, this.posOut + take), pos);
+      this.posOut += take;
+      pos += take;
+    }
+    return out;
+  }
+  xofInto(out) {
+    if (!this.enableXOF) {
+      throw new Error("XOF is not possible for this instance");
+    }
+    return this.writeInto(out);
+  }
+  xof(bytes) {
+    anumber(bytes);
+    return this.xofInto(new Uint8Array(bytes));
+  }
+  digestInto(out) {
+    aoutput(out, this);
+    if (this.finished)
+      throw new Error("digest() was already called");
+    this.writeInto(out);
+    this.destroy();
+    return out;
+  }
+  digest() {
+    return this.digestInto(new Uint8Array(this.outputLen));
+  }
+  destroy() {
+    this.destroyed = true;
+    clean(this.state);
+  }
+  _cloneInto(to) {
+    const { blockLen, suffix, outputLen, rounds, enableXOF } = this;
+    to || (to = new _Keccak(blockLen, suffix, outputLen, enableXOF, rounds));
+    to.state32.set(this.state32);
+    to.pos = this.pos;
+    to.posOut = this.posOut;
+    to.finished = this.finished;
+    to.rounds = rounds;
+    to.suffix = suffix;
+    to.outputLen = outputLen;
+    to.enableXOF = enableXOF;
+    to.destroyed = this.destroyed;
+    return to;
+  }
+};
+var genKeccak = (suffix, blockLen, outputLen, info = {}) => createHasher(() => new Keccak(blockLen, suffix, outputLen), info);
+var sha3_256 = /* @__PURE__ */ genKeccak(
+  6,
+  136,
+  32,
+  /* @__PURE__ */ oidNist(8)
+);
+var sha3_512 = /* @__PURE__ */ genKeccak(
+  6,
+  72,
+  64,
+  /* @__PURE__ */ oidNist(10)
+);
+var genShake = (suffix, blockLen, outputLen, info = {}) => createHasher((opts = {}) => new Keccak(blockLen, suffix, opts.dkLen === void 0 ? outputLen : opts.dkLen, true), info);
+var shake128 = /* @__PURE__ */ genShake(31, 168, 16, /* @__PURE__ */ oidNist(11));
+var shake256 = /* @__PURE__ */ genShake(31, 136, 32, /* @__PURE__ */ oidNist(12));
+
+// node_modules/mlkem/esm/_dnt.shims.js
+var dntGlobals = {};
+var dntGlobalThis = createMergeProxy(globalThis, dntGlobals);
+function createMergeProxy(baseObj, extObj) {
+  return new Proxy(baseObj, {
+    get(_target, prop, _receiver) {
+      if (prop in extObj) {
+        return extObj[prop];
+      } else {
+        return baseObj[prop];
+      }
+    },
+    set(_target, prop, value) {
+      if (prop in extObj) {
+        delete extObj[prop];
+      }
+      baseObj[prop] = value;
+      return true;
+    },
+    deleteProperty(_target, prop) {
+      let success = false;
+      if (prop in extObj) {
+        delete extObj[prop];
+        success = true;
+      }
+      if (prop in baseObj) {
+        delete baseObj[prop];
+        success = true;
+      }
+      return success;
+    },
+    ownKeys(_target) {
+      const baseKeys = Reflect.ownKeys(baseObj);
+      const extKeys = Reflect.ownKeys(extObj);
+      const extKeysSet = new Set(extKeys);
+      return [...baseKeys.filter((k) => !extKeysSet.has(k)), ...extKeys];
+    },
+    defineProperty(_target, prop, desc) {
+      if (prop in extObj) {
+        delete extObj[prop];
+      }
+      Reflect.defineProperty(baseObj, prop, desc);
+      return true;
+    },
+    getOwnPropertyDescriptor(_target, prop) {
+      if (prop in extObj) {
+        return Reflect.getOwnPropertyDescriptor(extObj, prop);
+      } else {
+        return Reflect.getOwnPropertyDescriptor(baseObj, prop);
+      }
+    },
+    has(_target, prop) {
+      return prop in extObj || prop in baseObj;
+    }
+  });
+}
+
+// node_modules/mlkem/esm/src/utils.js
+function byte(n) {
+  return n % 256;
+}
+function int16(n) {
+  const end = -32768;
+  const start = 32767;
+  if (n >= end && n <= start) {
+    return n;
+  }
+  if (n < end) {
+    n = n + 32769;
+    n = n % 65536;
+    return start + n;
+  }
+  n = n - 32768;
+  n = n % 65536;
+  return end + n;
+}
+function uint16(n) {
+  return n % 65536;
+}
+function int32(n) {
+  const end = -2147483648;
+  const start = 2147483647;
+  if (n >= end && n <= start) {
+    return n;
+  }
+  if (n < end) {
+    n = n + 2147483649;
+    n = n % 4294967296;
+    return start + n;
+  }
+  n = n - 2147483648;
+  n = n % 4294967296;
+  return end + n;
+}
+function uint32(n) {
+  return n % 4294967296;
+}
+function constantTimeCompare(x, y) {
+  if (x.length != y.length) {
+    return 0;
+  }
+  const v = new Uint8Array([0]);
+  for (let i = 0; i < x.length; i++) {
+    v[0] |= x[i] ^ y[i];
+  }
+  const z = new Uint8Array([0]);
+  z[0] = ~(v[0] ^ z[0]);
+  z[0] &= z[0] >> 4;
+  z[0] &= z[0] >> 2;
+  z[0] &= z[0] >> 1;
+  return z[0];
+}
+function equalUint8Array(x, y) {
+  if (x.length != y.length) {
+    return false;
+  }
+  for (let i = 0; i < x.length; i++) {
+    if (x[i] !== y[i]) {
+      return false;
+    }
+  }
+  return true;
+}
+async function loadCrypto() {
+  if (typeof dntGlobalThis !== "undefined" && globalThis.crypto !== void 0) {
+    return globalThis.crypto;
+  }
+  try {
+    const { webcrypto } = await import("crypto");
+    return webcrypto;
+  } catch (_e) {
+    throw new Error("failed to load Crypto");
+  }
+}
+function prf(len, seed, nonce) {
+  return shake256.create({ dkLen: len }).update(seed).update(new Uint8Array([nonce])).digest();
+}
+function byteopsLoad32(x) {
+  let r = uint32(x[0]);
+  r |= uint32(x[1]) << 8;
+  r |= uint32(x[2]) << 16;
+  r |= uint32(x[3]) << 24;
+  return uint32(r);
+}
+
+// node_modules/mlkem/esm/src/mlKemBase.js
+var MlKemBase = class {
+  /**
+   * Creates a new instance of the MlKemBase class.
+   */
+  constructor() {
+    Object.defineProperty(this, "_api", {
+      enumerable: true,
+      configurable: true,
+      writable: true,
+      value: void 0
+    });
+    Object.defineProperty(this, "_k", {
+      enumerable: true,
+      configurable: true,
+      writable: true,
+      value: 0
+    });
+    Object.defineProperty(this, "_du", {
+      enumerable: true,
+      configurable: true,
+      writable: true,
+      value: 0
+    });
+    Object.defineProperty(this, "_dv", {
+      enumerable: true,
+      configurable: true,
+      writable: true,
+      value: 0
+    });
+    Object.defineProperty(this, "_eta1", {
+      enumerable: true,
+      configurable: true,
+      writable: true,
+      value: 0
+    });
+    Object.defineProperty(this, "_eta2", {
+      enumerable: true,
+      configurable: true,
+      writable: true,
+      value: 0
+    });
+    Object.defineProperty(this, "_skSize", {
+      enumerable: true,
+      configurable: true,
+      writable: true,
+      value: 0
+    });
+    Object.defineProperty(this, "_pkSize", {
+      enumerable: true,
+      configurable: true,
+      writable: true,
+      value: 0
+    });
+    Object.defineProperty(this, "_compressedUSize", {
+      enumerable: true,
+      configurable: true,
+      writable: true,
+      value: 0
+    });
+    Object.defineProperty(this, "_compressedVSize", {
+      enumerable: true,
+      configurable: true,
+      writable: true,
+      value: 0
+    });
+  }
+  /**
+   * Generates a keypair [publicKey, privateKey].
+   *
+   * If an error occurred, throws {@link MlKemError}.
+   *
+   * @returns A kaypair [publicKey, privateKey].
+   * @throws {@link MlKemError}
+   *
+   * @example Generates a {@link MlKem768} keypair.
+   *
+   * ```ts
+   * // Using jsr:
+   * import { MlKem768 } from "@dajiaji/mlkem";
+   * // Using npm:
+   * // import { MlKem768 } from "mlkem"; // or "crystals-kyber-js"
+   *
+   * const kyber = new MlKem768();
+   * const [pk, sk] = await kyber.generateKeyPair();
+   * ```
+   */
+  async generateKeyPair() {
+    await this._setup();
+    try {
+      const rnd = new Uint8Array(64);
+      this._api.getRandomValues(rnd);
+      return this._deriveKeyPair(rnd);
+    } catch (e) {
+      throw new MlKemError(e);
+    }
+  }
+  /**
+   * Derives a keypair [publicKey, privateKey] deterministically from a 64-octet seed.
+   *
+   * If an error occurred, throws {@link MlKemError}.
+   *
+   * @param seed A 64-octet seed for the deterministic key generation.
+   * @returns A kaypair [publicKey, privateKey].
+   * @throws {@link MlKemError}
+   *
+   * @example Derives a {@link MlKem768} keypair deterministically.
+   *
+   * ```ts
+   * // Using jsr:
+   * import { MlKem768 } from "@dajiaji/mlkem";
+   * // Using npm:
+   * // import { MlKem768 } from "mlkem"; // or "crystals-kyber-js"
+   *
+   * const kyber = new MlKem768();
+   * const seed = new Uint8Array(64);
+   * globalThis.crypto.getRandomValues(seed);
+   * const [pk, sk] = await kyber.deriveKeyPair(seed);
+   * ```
+   */
+  async deriveKeyPair(seed) {
+    await this._setup();
+    try {
+      if (seed.byteLength !== 64) {
+        throw new Error("seed must be 64 bytes in length");
+      }
+      return this._deriveKeyPair(seed);
+    } catch (e) {
+      throw new MlKemError(e);
+    }
+  }
+  /**
+   * Generates a shared secret from the encapsulated ciphertext and the private key.
+   *
+   * If an error occurred, throws {@link MlKemError}.
+   *
+   * @param pk A public key.
+   * @param seed An optional 32-octet seed for the deterministic shared secret generation.
+   * @returns A ciphertext (encapsulated public key) and a shared secret.
+   * @throws {@link MlKemError}
+   *
+   * @example The {@link MlKem768} encapsulation.
+   *
+   * ```ts
+   * // Using jsr:
+   * import { MlKem768 } from "@dajiaji/mlkem";
+   * // Using npm:
+   * // import { MlKem768 } from "mlkem"; // or "crystals-kyber-js"
+   *
+   * const kyber = new MlKem768();
+   * const [pk, sk] = await kyber.generateKeyPair();
+   * const [ct, ss] = await kyber.encap(pk);
+   * ```
+   */
+  async encap(pk, seed) {
+    await this._setup();
+    try {
+      if (pk.length !== 384 * this._k + 32) {
+        throw new Error("invalid encapsulation key");
+      }
+      const m = this._getSeed(seed);
+      const [k, r] = g(m, h(pk));
+      const ct = this._encap(pk, m, r);
+      return [ct, k];
+    } catch (e) {
+      throw new MlKemError(e);
+    }
+  }
+  /**
+   * Generates a ciphertext for the public key and a shared secret.
+   *
+   * If an error occurred, throws {@link MlKemError}.
+   *
+   * @param ct A ciphertext generated by {@link encap}.
+   * @param sk A private key.
+   * @returns A shared secret.
+   * @throws {@link MlKemError}
+   *
+   * @example The {@link MlKem768} decapsulation.
+   *
+   * ```ts
+   * // Using jsr:
+   * import { MlKem768 } from "@dajiaji/mlkem";
+   * // Using npm:
+   * // import { MlKem768 } from "mlkem"; // or "crystals-kyber-js"
+   *
+   * const kyber = new MlKem768();
+   * const [pk, sk] = await kyber.generateKeyPair();
+   * const [ct, ssS] = await kyber.encap(pk);
+   * const ssR = await kyber.decap(ct, sk);
+   * // ssS === ssR
+   * ```
+   */
+  async decap(ct, sk) {
+    await this._setup();
+    try {
+      if (ct.byteLength !== this._compressedUSize + this._compressedVSize) {
+        throw new Error("Invalid ct size");
+      }
+      if (sk.length !== 768 * this._k + 96) {
+        throw new Error("Invalid decapsulation key");
+      }
+      const sk2 = sk.subarray(0, this._skSize);
+      const pk = sk.subarray(this._skSize, this._skSize + this._pkSize);
+      const hpk = sk.subarray(this._skSize + this._pkSize, this._skSize + this._pkSize + 32);
+      const z = sk.subarray(this._skSize + this._pkSize + 32, this._skSize + this._pkSize + 64);
+      const m2 = this._decap(ct, sk2);
+      const [k2, r2] = g(m2, hpk);
+      const kBar = kdf(z, ct);
+      const ct2 = this._encap(pk, m2, r2);
+      return constantTimeCompare(ct, ct2) === 1 ? k2 : kBar;
+    } catch (e) {
+      throw new MlKemError(e);
+    }
+  }
+  /**
+   * Sets up the MlKemBase instance by loading the necessary crypto library.
+   * If the crypto library is already loaded, this method does nothing.
+   * @returns {Promise<void>} A promise that resolves when the setup is complete.
+   */
+  async _setup() {
+    if (this._api !== void 0) {
+      return;
+    }
+    this._api = await loadCrypto();
+  }
+  /**
+   * Returns a Uint8Array seed for cryptographic operations.
+   * If no seed is provided, a random seed of length 32 bytes is generated.
+   * If a seed is provided, it must be exactly 32 bytes in length.
+   *
+   * @param seed - Optional seed for cryptographic operations.
+   * @returns A Uint8Array seed.
+   * @throws Error if the provided seed is not 32 bytes in length.
+   */
+  _getSeed(seed) {
+    if (seed == void 0) {
+      const s = new Uint8Array(32);
+      this._api.getRandomValues(s);
+      return s;
+    }
+    if (seed.byteLength !== 32) {
+      throw new Error("seed must be 32 bytes in length");
+    }
+    return seed;
+  }
+  /**
+   * Derives a key pair from a given seed.
+   *
+   * @param seed - The seed used for key derivation.
+   * @returns An array containing the public key and secret key.
+   */
+  _deriveKeyPair(seed) {
+    const cpaSeed = seed.subarray(0, 32);
+    const z = seed.subarray(32, 64);
+    const [pk, skBody] = this._deriveCpaKeyPair(cpaSeed);
+    const pkh = h(pk);
+    const sk = new Uint8Array(this._skSize + this._pkSize + 64);
+    sk.set(skBody, 0);
+    sk.set(pk, this._skSize);
+    sk.set(pkh, this._skSize + this._pkSize);
+    sk.set(z, this._skSize + this._pkSize + 32);
+    return [pk, sk];
+  }
+  // indcpaKeyGen generates public and private keys for the CPA-secure
+  // public-key encryption scheme underlying ML-KEM.
+  /**
+   * Derives a CPA key pair using the provided CPA seed.
+   *
+   * @param cpaSeed - The CPA seed used for key derivation.
+   * @returns An array containing the public key and private key.
+   */
+  _deriveCpaKeyPair(cpaSeed) {
+    const [publicSeed, noiseSeed] = g(cpaSeed, new Uint8Array([this._k]));
+    const a = this._sampleMatrix(publicSeed, false);
+    const s = this._sampleNoise1(noiseSeed, 0, this._k);
+    const e = this._sampleNoise1(noiseSeed, this._k, this._k);
+    for (let i = 0; i < this._k; i++) {
+      s[i] = ntt(s[i]);
+      s[i] = reduce(s[i]);
+      e[i] = ntt(e[i]);
+    }
+    const pk = new Array(this._k);
+    for (let i = 0; i < this._k; i++) {
+      pk[i] = polyToMont(multiply(a[i], s));
+      pk[i] = add(pk[i], e[i]);
+      pk[i] = reduce(pk[i]);
+    }
+    const pubKey = new Uint8Array(this._pkSize);
+    for (let i = 0; i < this._k; i++) {
+      pubKey.set(polyToBytes(pk[i]), i * 384);
+    }
+    pubKey.set(publicSeed, this._skSize);
+    const privKey = new Uint8Array(this._skSize);
+    for (let i = 0; i < this._k; i++) {
+      privKey.set(polyToBytes(s[i]), i * 384);
+    }
+    return [pubKey, privKey];
+  }
+  // _encap is the encapsulation function of the CPA-secure
+  // public-key encryption scheme underlying ML-KEM.
+  /**
+   * Encapsulates a message using the ML-KEM encryption scheme.
+   *
+   * @param pk - The public key.
+   * @param msg - The message to be encapsulated.
+   * @param seed - The seed used for generating random values.
+   * @returns The encapsulated message as a Uint8Array.
+   */
+  _encap(pk, msg, seed) {
+    const tHat = new Array(this._k);
+    const pkCheck = new Uint8Array(384 * this._k);
+    for (let i = 0; i < this._k; i++) {
+      tHat[i] = polyFromBytes(pk.subarray(i * 384, (i + 1) * 384));
+      pkCheck.set(polyToBytes(tHat[i]), i * 384);
+    }
+    if (!equalUint8Array(pk.subarray(0, pkCheck.length), pkCheck)) {
+      throw new Error("invalid encapsulation key");
+    }
+    const rho = pk.subarray(this._skSize);
+    const a = this._sampleMatrix(rho, true);
+    const r = this._sampleNoise1(seed, 0, this._k);
+    const e1 = this._sampleNoise2(seed, this._k, this._k);
+    const e2 = this._sampleNoise2(seed, this._k * 2, 1)[0];
+    for (let i = 0; i < this._k; i++) {
+      r[i] = ntt(r[i]);
+      r[i] = reduce(r[i]);
+    }
+    const u = new Array(this._k);
+    for (let i = 0; i < this._k; i++) {
+      u[i] = multiply(a[i], r);
+      u[i] = nttInverse(u[i]);
+      u[i] = add(u[i], e1[i]);
+      u[i] = reduce(u[i]);
+    }
+    const m = polyFromMsg(msg);
+    let v = multiply(tHat, r);
+    v = nttInverse(v);
+    v = add(v, e2);
+    v = add(v, m);
+    v = reduce(v);
+    const ret = new Uint8Array(this._compressedUSize + this._compressedVSize);
+    this._compressU(ret.subarray(0, this._compressedUSize), u);
+    this._compressV(ret.subarray(this._compressedUSize), v);
+    return ret;
+  }
+  // indcpaDecrypt is the decryption function of the CPA-secure
+  // public-key encryption scheme underlying ML-KEM.
+  /**
+   * Decapsulates the ciphertext using the provided secret key.
+   *
+   * @param ct - The ciphertext to be decapsulated.
+   * @param sk - The secret key used for decapsulation.
+   * @returns The decapsulated message as a Uint8Array.
+   */
+  _decap(ct, sk) {
+    const u = this._decompressU(ct.subarray(0, this._compressedUSize));
+    const v = this._decompressV(ct.subarray(this._compressedUSize));
+    const privateKeyPolyvec = this._polyvecFromBytes(sk);
+    for (let i = 0; i < this._k; i++) {
+      u[i] = ntt(u[i]);
+    }
+    let mp = multiply(privateKeyPolyvec, u);
+    mp = nttInverse(mp);
+    mp = subtract(v, mp);
+    mp = reduce(mp);
+    return polyToMsg(mp);
+  }
+  // generateMatrixA deterministically generates a matrix `A` (or the transpose of `A`)
+  // from a seed. Entries of the matrix are polynomials that look uniformly random.
+  // Performs rejection sampling on the output of an extendable-output function (XOF).
+  /**
+   * Generates a sample matrix based on the provided seed and transposition flag.
+   *
+   * @param seed - The seed used for generating the matrix.
+   * @param transposed - A flag indicating whether the matrix should be transposed or not.
+   * @returns The generated sample matrix.
+   */
+  _sampleMatrix(seed, transposed) {
+    const a = new Array(this._k);
+    const transpose = new Uint8Array(2);
+    for (let ctr = 0, i = 0; i < this._k; i++) {
+      a[i] = new Array(this._k);
+      for (let j = 0; j < this._k; j++) {
+        if (transposed) {
+          transpose[0] = i;
+          transpose[1] = j;
+        } else {
+          transpose[0] = j;
+          transpose[1] = i;
+        }
+        const output = xof(seed, transpose);
+        const result = indcpaRejUniform(output.subarray(0, 504), 504, N);
+        a[i][j] = result[0];
+        ctr = result[1];
+        while (ctr < N) {
+          const outputn = output.subarray(504, 672);
+          const result1 = indcpaRejUniform(outputn, 168, N - ctr);
+          const missing = result1[0];
+          const ctrn = result1[1];
+          for (let k = ctr; k < N; k++) {
+            a[i][j][k] = missing[k - ctr];
+          }
+          ctr = ctr + ctrn;
+        }
+      }
+    }
+    return a;
+  }
+  /**
+   * Generates a 2D array of noise samples.
+   *
+   * @param sigma - The noise parameter.
+   * @param offset - The offset value.
+   * @param size - The size of the array.
+   * @returns The generated 2D array of noise samples.
+   */
+  _sampleNoise1(sigma, offset, size) {
+    const r = new Array(size);
+    for (let i = 0; i < size; i++) {
+      r[i] = byteopsCbd(prf(this._eta1 * N / 4, sigma, offset), this._eta1);
+      offset++;
+    }
+    return r;
+  }
+  /**
+   * Generates a 2-dimensional array of noise samples.
+   *
+   * @param sigma - The noise parameter.
+   * @param offset - The offset value.
+   * @param size - The size of the array.
+   * @returns The generated 2-dimensional array of noise samples.
+   */
+  _sampleNoise2(sigma, offset, size) {
+    const r = new Array(size);
+    for (let i = 0; i < size; i++) {
+      r[i] = byteopsCbd(prf(this._eta2 * N / 4, sigma, offset), this._eta2);
+      offset++;
+    }
+    return r;
+  }
+  // polyvecFromBytes deserializes a vector of polynomials.
+  /**
+   * Converts a Uint8Array to a 2D array of numbers representing a polynomial vector.
+   * Each element in the resulting array represents a polynomial.
+   * @param a The Uint8Array to convert.
+   * @returns The 2D array of numbers representing the polynomial vector.
+   */
+  _polyvecFromBytes(a) {
+    const r = new Array(this._k);
+    for (let i = 0; i < this._k; i++) {
+      r[i] = polyFromBytes(a.subarray(i * 384, (i + 1) * 384));
+    }
+    return r;
+  }
+  // compressU lossily compresses and serializes a vector of polynomials.
+  /**
+   * Compresses the given array of coefficients into a Uint8Array.
+   *
+   * @param r - The output Uint8Array.
+   * @param u - The array of coefficients.
+   * @returns The compressed Uint8Array.
+   */
+  _compressU(r, u) {
+    const t = new Array(4);
+    for (let rr = 0, i = 0; i < this._k; i++) {
+      for (let j = 0; j < N / 4; j++) {
+        for (let k = 0; k < 4; k++) {
+          t[k] = ((u[i][4 * j + k] << 10) + Q / 2) / Q & 1023;
+        }
+        r[rr++] = byte(t[0] >> 0);
+        r[rr++] = byte(t[0] >> 8 | t[1] << 2);
+        r[rr++] = byte(t[1] >> 6 | t[2] << 4);
+        r[rr++] = byte(t[2] >> 4 | t[3] << 6);
+        r[rr++] = byte(t[3] >> 2);
+      }
+    }
+    return r;
+  }
+  // compressV lossily compresses and subsequently serializes a polynomial.
+  /**
+   * Compresses the given array of numbers into a Uint8Array.
+   *
+   * @param r - The Uint8Array to store the compressed values.
+   * @param v - The array of numbers to compress.
+   * @returns The compressed Uint8Array.
+   */
+  _compressV(r, v) {
+    const t = new Uint8Array(8);
+    for (let rr = 0, i = 0; i < N / 8; i++) {
+      for (let j = 0; j < 8; j++) {
+        t[j] = byte(((v[8 * i + j] << 4) + Q / 2) / Q) & 15;
+      }
+      r[rr++] = t[0] | t[1] << 4;
+      r[rr++] = t[2] | t[3] << 4;
+      r[rr++] = t[4] | t[5] << 4;
+      r[rr++] = t[6] | t[7] << 4;
+    }
+    return r;
+  }
+  // decompressU de-serializes and decompresses a vector of polynomials and
+  // represents the approximate inverse of compress1. Since compression is lossy,
+  // the results of decompression will may not match the original vector of polynomials.
+  /**
+   * Decompresses a Uint8Array into a two-dimensional array of numbers.
+   *
+   * @param a The Uint8Array to decompress.
+   * @returns The decompressed two-dimensional array.
+   */
+  _decompressU(a) {
+    const r = new Array(this._k);
+    for (let i = 0; i < this._k; i++) {
+      r[i] = new Array(384);
+    }
+    const t = new Array(4);
+    for (let aa = 0, i = 0; i < this._k; i++) {
+      for (let j = 0; j < N / 4; j++) {
+        t[0] = uint16(a[aa + 0]) >> 0 | uint16(a[aa + 1]) << 8;
+        t[1] = uint16(a[aa + 1]) >> 2 | uint16(a[aa + 2]) << 6;
+        t[2] = uint16(a[aa + 2]) >> 4 | uint16(a[aa + 3]) << 4;
+        t[3] = uint16(a[aa + 3]) >> 6 | uint16(a[aa + 4]) << 2;
+        aa = aa + 5;
+        for (let k = 0; k < 4; k++) {
+          r[i][4 * j + k] = int16(uint32(t[k] & 1023) * uint32(Q) + 512 >> 10);
+        }
+      }
+    }
+    return r;
+  }
+  // decompressV de-serializes and subsequently decompresses a polynomial,
+  // representing the approximate inverse of compress2.
+  // Note that compression is lossy, and thus decompression will not match the
+  // original input.
+  /**
+   * Decompresses a Uint8Array into an array of numbers.
+   *
+   * @param a - The Uint8Array to decompress.
+   * @returns An array of numbers.
+   */
+  _decompressV(a) {
+    const r = new Array(384);
+    for (let aa = 0, i = 0; i < N / 2; i++, aa++) {
+      r[2 * i + 0] = int16(uint16(a[aa] & 15) * uint16(Q) + 8 >> 4);
+      r[2 * i + 1] = int16(uint16(a[aa] >> 4) * uint16(Q) + 8 >> 4);
+    }
+    return r;
+  }
+};
+function g(a, b) {
+  const hash = sha3_512.create().update(a);
+  if (b !== void 0) {
+    hash.update(b);
+  }
+  const res = hash.digest();
+  return [res.subarray(0, 32), res.subarray(32, 64)];
+}
+function h(msg) {
+  return sha3_256.create().update(msg).digest();
+}
+function kdf(a, b) {
+  const hash = shake256.create({ dkLen: 32 }).update(a);
+  if (b !== void 0) {
+    hash.update(b);
+  }
+  return hash.digest();
+}
+function xof(seed, transpose) {
+  return shake128.create({ dkLen: 672 }).update(seed).update(transpose).digest();
+}
+function polyToBytes(a) {
+  let t0 = 0;
+  let t1 = 0;
+  const r = new Uint8Array(384);
+  const a2 = subtractQ(a);
+  for (let i = 0; i < N / 2; i++) {
+    t0 = uint16(a2[2 * i]);
+    t1 = uint16(a2[2 * i + 1]);
+    r[3 * i + 0] = byte(t0 >> 0);
+    r[3 * i + 1] = byte(t0 >> 8) | byte(t1 << 4);
+    r[3 * i + 2] = byte(t1 >> 4);
+  }
+  return r;
+}
+function polyFromBytes(a) {
+  const r = new Array(384).fill(0);
+  for (let i = 0; i < N / 2; i++) {
+    r[2 * i] = int16((uint16(a[3 * i + 0]) >> 0 | uint16(a[3 * i + 1]) << 8) & 4095);
+    r[2 * i + 1] = int16((uint16(a[3 * i + 1]) >> 4 | uint16(a[3 * i + 2]) << 4) & 4095);
+  }
+  return r;
+}
+function polyToMsg(a) {
+  const msg = new Uint8Array(32);
+  let t;
+  const a2 = subtractQ(a);
+  for (let i = 0; i < N / 8; i++) {
+    msg[i] = 0;
+    for (let j = 0; j < 8; j++) {
+      t = ((uint16(a2[8 * i + j]) << 1) + uint16(Q / 2)) / uint16(Q) & 1;
+      msg[i] |= byte(t << j);
+    }
+  }
+  return msg;
+}
+function polyFromMsg(msg) {
+  const r = new Array(384).fill(0);
+  let mask;
+  for (let i = 0; i < N / 8; i++) {
+    for (let j = 0; j < 8; j++) {
+      mask = -1 * int16(msg[i] >> j & 1);
+      r[8 * i + j] = mask & int16((Q + 1) / 2);
+    }
+  }
+  return r;
+}
+function indcpaRejUniform(buf, bufl, len) {
+  const r = new Array(384).fill(0);
+  let ctr = 0;
+  let val0, val1;
+  for (let pos = 0; ctr < len && pos + 3 <= bufl; ) {
+    val0 = (uint16(buf[pos] >> 0) | uint16(buf[pos + 1]) << 8) & 4095;
+    val1 = (uint16(buf[pos + 1] >> 4) | uint16(buf[pos + 2]) << 4) & 4095;
+    pos = pos + 3;
+    if (val0 < Q) {
+      r[ctr] = val0;
+      ctr = ctr + 1;
+    }
+    if (ctr < len && val1 < Q) {
+      r[ctr] = val1;
+      ctr = ctr + 1;
+    }
+  }
+  return [r, ctr];
+}
+function byteopsCbd(buf, eta) {
+  let t, d;
+  let a, b;
+  const r = new Array(384).fill(0);
+  for (let i = 0; i < N / 8; i++) {
+    t = byteopsLoad32(buf.subarray(4 * i, buf.length));
+    d = t & 1431655765;
+    d = d + (t >> 1 & 1431655765);
+    for (let j = 0; j < 8; j++) {
+      a = int16(d >> 4 * j + 0 & 3);
+      b = int16(d >> 4 * j + eta & 3);
+      r[8 * i + j] = a - b;
+    }
+  }
+  return r;
+}
+function ntt(r) {
+  for (let j = 0, k = 1, l = 128; l >= 2; l >>= 1) {
+    for (let start = 0; start < 256; start = j + l) {
+      const zeta = NTT_ZETAS[k];
+      k = k + 1;
+      for (j = start; j < start + l; j++) {
+        const t = nttFqMul(zeta, r[j + l]);
+        r[j + l] = r[j] - t;
+        r[j] = r[j] + t;
+      }
+    }
+  }
+  return r;
+}
+function nttFqMul(a, b) {
+  return byteopsMontgomeryReduce(a * b);
+}
+function reduce(r) {
+  for (let i = 0; i < N; i++) {
+    r[i] = barrett(r[i]);
+  }
+  return r;
+}
+function barrett(a) {
+  const v = ((1 << 24) + Q / 2) / Q;
+  let t = v * a >> 24;
+  t = t * Q;
+  return a - t;
+}
+function byteopsMontgomeryReduce(a) {
+  const u = int16(int32(a) * Q_INV);
+  let t = u * Q;
+  t = a - t;
+  t >>= 16;
+  return int16(t);
+}
+function polyToMont(r) {
+  const f = 1353;
+  for (let i = 0; i < N; i++) {
+    r[i] = byteopsMontgomeryReduce(int32(r[i]) * int32(f));
+  }
+  return r;
+}
+function multiply(a, b) {
+  let r = polyBaseMulMontgomery(a[0], b[0]);
+  let t;
+  for (let i = 1; i < a.length; i++) {
+    t = polyBaseMulMontgomery(a[i], b[i]);
+    r = add(r, t);
+  }
+  return reduce(r);
+}
+function polyBaseMulMontgomery(a, b) {
+  let rx, ry;
+  for (let i = 0; i < N / 4; i++) {
+    rx = nttBaseMul(a[4 * i + 0], a[4 * i + 1], b[4 * i + 0], b[4 * i + 1], NTT_ZETAS[64 + i]);
+    ry = nttBaseMul(a[4 * i + 2], a[4 * i + 3], b[4 * i + 2], b[4 * i + 3], -NTT_ZETAS[64 + i]);
+    a[4 * i + 0] = rx[0];
+    a[4 * i + 1] = rx[1];
+    a[4 * i + 2] = ry[0];
+    a[4 * i + 3] = ry[1];
+  }
+  return a;
+}
+function nttBaseMul(a0, a1, b0, b1, zeta) {
+  const r = new Array(2);
+  r[0] = nttFqMul(a1, b1);
+  r[0] = nttFqMul(r[0], zeta);
+  r[0] += nttFqMul(a0, b0);
+  r[1] = nttFqMul(a0, b1);
+  r[1] += nttFqMul(a1, b0);
+  return r;
+}
+function add(a, b) {
+  const c = new Array(384);
+  for (let i = 0; i < N; i++) {
+    c[i] = a[i] + b[i];
+  }
+  return c;
+}
+function subtract(a, b) {
+  for (let i = 0; i < N; i++) {
+    a[i] -= b[i];
+  }
+  return a;
+}
+function nttInverse(r) {
+  let j = 0;
+  for (let k = 0, l = 2; l <= 128; l <<= 1) {
+    for (let start = 0; start < 256; start = j + l) {
+      const zeta = NTT_ZETAS_INV[k];
+      k = k + 1;
+      for (j = start; j < start + l; j++) {
+        const t = r[j];
+        r[j] = barrett(t + r[j + l]);
+        r[j + l] = t - r[j + l];
+        r[j + l] = nttFqMul(zeta, r[j + l]);
+      }
+    }
+  }
+  for (j = 0; j < 256; j++) {
+    r[j] = nttFqMul(r[j], NTT_ZETAS_INV[127]);
+  }
+  return r;
+}
+function subtractQ(r) {
+  for (let i = 0; i < N; i++) {
+    r[i] -= Q;
+    r[i] += r[i] >> 31 & Q;
+  }
+  return r;
+}
+
+// node_modules/mlkem/esm/src/mlKem768.js
+var MlKem768 = class extends MlKemBase {
+  constructor() {
+    super();
+    Object.defineProperty(this, "_k", {
+      enumerable: true,
+      configurable: true,
+      writable: true,
+      value: 3
+    });
+    Object.defineProperty(this, "_du", {
+      enumerable: true,
+      configurable: true,
+      writable: true,
+      value: 10
+    });
+    Object.defineProperty(this, "_dv", {
+      enumerable: true,
+      configurable: true,
+      writable: true,
+      value: 4
+    });
+    Object.defineProperty(this, "_eta1", {
+      enumerable: true,
+      configurable: true,
+      writable: true,
+      value: 2
+    });
+    Object.defineProperty(this, "_eta2", {
+      enumerable: true,
+      configurable: true,
+      writable: true,
+      value: 2
+    });
+    this._skSize = 12 * this._k * N / 8;
+    this._pkSize = this._skSize + 32;
+    this._compressedUSize = this._k * this._du * N / 8;
+    this._compressedVSize = this._dv * N / 8;
+  }
+};
+
+// src/index.ts
 async function sha256(data) {
   if (typeof globalThis.crypto?.subtle !== "undefined") {
     const encoder = new TextEncoder();
@@ -2394,6 +3991,39 @@ function unsealEnvelope(plaintext) {
     return null;
   }
 }
+var PROTO_MARKER = 86;
+var FLAG_PADDED = 1;
+var FLAG_SEALED = 2;
+var FLAG_RATCHET = 4;
+var FLAG_PQ = 8;
+function makeProtoHeader(flags, ratchetStep2) {
+  return new Uint8Array([PROTO_MARKER, flags, ratchetStep2 >> 8 & 255, ratchetStep2 & 255]);
+}
+function parseProtoHeader(data) {
+  if (data.length < 4 || data[0] !== PROTO_MARKER) return null;
+  return {
+    flags: data[1],
+    ratchetStep: data[2] << 8 | data[3],
+    content: data.slice(4)
+  };
+}
+var MAX_SKIP = 200;
+var BASE58_ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
+function toBase58(bytes) {
+  if (bytes.length === 0) return "1";
+  let result = "";
+  let num = BigInt("0x" + Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join(""));
+  while (num > 0n) {
+    const remainder = num % 58n;
+    num = num / 58n;
+    result = BASE58_ALPHABET[Number(remainder)] + result;
+  }
+  for (const byte2 of bytes) {
+    if (byte2 === 0) result = "1" + result;
+    else break;
+  }
+  return result || "1";
+}
 var VoidlyAgent = class _VoidlyAgent {
   constructor(identity, config) {
     this._pinnedDids = /* @__PURE__ */ new Set();
@@ -2401,6 +4031,9 @@ var VoidlyAgent = class _VoidlyAgent {
     this._conversations = /* @__PURE__ */ new Map();
     this._offlineQueue = [];
     this._ratchetStates = /* @__PURE__ */ new Map();
+    this._identityCache = /* @__PURE__ */ new Map();
+    this._seenMessageIds = /* @__PURE__ */ new Set();
+    this._decryptFailCount = 0;
     this.did = identity.did;
     this.apiKey = identity.apiKey;
     this.signingKeyPair = identity.signingKeyPair;
@@ -2411,6 +4044,11 @@ var VoidlyAgent = class _VoidlyAgent {
     this.fallbackRelays = config?.fallbackRelays || [];
     this.paddingEnabled = config?.padding !== false;
     this.sealedSender = config?.sealedSender || false;
+    this.requireSignatures = config?.requireSignatures || false;
+    this.timeout = config?.timeout ?? 3e4;
+    this.postQuantum = config?.postQuantum !== false;
+    this.mlkemPublicKey = identity.mlkemPublicKey || null;
+    this.mlkemSecretKey = identity.mlkemSecretKey || null;
   }
   // ─── Factory Methods ────────────────────────────────────────────────────────
   /**
@@ -2421,15 +4059,26 @@ var VoidlyAgent = class _VoidlyAgent {
     const baseUrl = config?.baseUrl || "https://api.voidly.ai";
     const signingKeyPair = import_tweetnacl.default.sign.keyPair();
     const encryptionKeyPair = import_tweetnacl.default.box.keyPair();
+    const usePQ = config?.postQuantum !== false;
+    let mlkemPk;
+    let mlkemSk;
+    if (usePQ) {
+      const kem = new MlKem768();
+      [mlkemPk, mlkemSk] = await kem.generateKeyPair();
+    }
+    const regBody = {
+      name: options.name,
+      capabilities: options.capabilities,
+      signing_public_key: (0, import_tweetnacl_util.encodeBase64)(signingKeyPair.publicKey),
+      encryption_public_key: (0, import_tweetnacl_util.encodeBase64)(encryptionKeyPair.publicKey)
+    };
+    if (mlkemPk) {
+      regBody.mlkem_public_key = (0, import_tweetnacl_util.encodeBase64)(mlkemPk);
+    }
     const res = await fetch(`${baseUrl}/v1/agent/register`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({
-        name: options.name,
-        capabilities: options.capabilities,
-        signing_public_key: (0, import_tweetnacl_util.encodeBase64)(signingKeyPair.publicKey),
-        encryption_public_key: (0, import_tweetnacl_util.encodeBase64)(encryptionKeyPair.publicKey)
-      })
+      body: JSON.stringify(regBody)
     });
     if (!res.ok) {
       const err = await res.json().catch(() => ({}));
@@ -2441,7 +4090,9 @@ var VoidlyAgent = class _VoidlyAgent {
       did: data.did,
       apiKey: data.api_key,
       signingKeyPair,
-      encryptionKeyPair
+      encryptionKeyPair,
+      mlkemPublicKey: mlkemPk,
+      mlkemSecretKey: mlkemSk
     }, config);
   }
   /**
@@ -2449,32 +4100,117 @@ var VoidlyAgent = class _VoidlyAgent {
    * Use this to resume an agent across sessions.
    */
   static fromCredentials(creds, config) {
-    const signingSecret = (0, import_tweetnacl_util.decodeBase64)(creds.signingSecretKey);
-    const encryptionSecret = (0, import_tweetnacl_util.decodeBase64)(creds.encryptionSecretKey);
-    return new _VoidlyAgent({
+    if (!creds.did || !creds.did.startsWith("did:")) {
+      throw new Error('Invalid credentials: did must start with "did:"');
+    }
+    if (!creds.apiKey || creds.apiKey.length < 8) {
+      throw new Error("Invalid credentials: apiKey is missing or too short");
+    }
+    if (!creds.signingSecretKey || !creds.encryptionSecretKey) {
+      throw new Error("Invalid credentials: secret keys are required");
+    }
+    let signingSecret;
+    let encryptionSecret;
+    try {
+      signingSecret = (0, import_tweetnacl_util.decodeBase64)(creds.signingSecretKey);
+      encryptionSecret = (0, import_tweetnacl_util.decodeBase64)(creds.encryptionSecretKey);
+    } catch {
+      throw new Error("Invalid credentials: secret keys must be valid base64");
+    }
+    if (signingSecret.length !== 64) {
+      throw new Error(`Invalid credentials: signing key must be 64 bytes, got ${signingSecret.length}`);
+    }
+    if (encryptionSecret.length !== 32) {
+      throw new Error(`Invalid credentials: encryption key must be 32 bytes, got ${encryptionSecret.length}`);
+    }
+    let mlkemPk;
+    let mlkemSk;
+    if (creds.mlkemPublicKey && creds.mlkemSecretKey) {
+      try {
+        mlkemPk = (0, import_tweetnacl_util.decodeBase64)(creds.mlkemPublicKey);
+        mlkemSk = (0, import_tweetnacl_util.decodeBase64)(creds.mlkemSecretKey);
+        if (mlkemPk.length !== 1184 || mlkemSk.length !== 2400) {
+          mlkemPk = void 0;
+          mlkemSk = void 0;
+        }
+      } catch {
+      }
+    }
+    const agent = new _VoidlyAgent({
       did: creds.did,
       apiKey: creds.apiKey,
       signingKeyPair: import_tweetnacl.default.sign.keyPair.fromSecretKey(signingSecret),
       encryptionKeyPair: {
         publicKey: import_tweetnacl.default.box.keyPair.fromSecretKey(encryptionSecret).publicKey,
         secretKey: encryptionSecret
-      }
+      },
+      mlkemPublicKey: mlkemPk,
+      mlkemSecretKey: mlkemSk
     }, config);
+    if (creds.ratchetStates) {
+      for (const [pairId, rs] of Object.entries(creds.ratchetStates)) {
+        try {
+          const sendChainKey = (0, import_tweetnacl_util.decodeBase64)(rs.sendChainKey);
+          const recvChainKey = (0, import_tweetnacl_util.decodeBase64)(rs.recvChainKey);
+          if (sendChainKey.length !== 32 || recvChainKey.length !== 32) continue;
+          agent._ratchetStates.set(pairId, {
+            sendChainKey,
+            sendStep: rs.sendStep || 0,
+            recvChainKey,
+            recvStep: rs.recvStep || 0,
+            skippedKeys: /* @__PURE__ */ new Map()
+          });
+        } catch {
+        }
+      }
+    }
+    return agent;
   }
   /**
    * Export credentials for persistence.
    * Store these securely — they contain private keys.
    */
   exportCredentials() {
+    const ratchetStates = {};
+    for (const [pairId, state] of this._ratchetStates) {
+      ratchetStates[pairId] = {
+        sendChainKey: (0, import_tweetnacl_util.encodeBase64)(state.sendChainKey),
+        sendStep: state.sendStep,
+        recvChainKey: (0, import_tweetnacl_util.encodeBase64)(state.recvChainKey),
+        recvStep: state.recvStep
+      };
+    }
     return {
       did: this.did,
       apiKey: this.apiKey,
       signingSecretKey: (0, import_tweetnacl_util.encodeBase64)(this.signingKeyPair.secretKey),
       encryptionSecretKey: (0, import_tweetnacl_util.encodeBase64)(this.encryptionKeyPair.secretKey),
       signingPublicKey: (0, import_tweetnacl_util.encodeBase64)(this.signingKeyPair.publicKey),
-      encryptionPublicKey: (0, import_tweetnacl_util.encodeBase64)(this.encryptionKeyPair.publicKey)
+      encryptionPublicKey: (0, import_tweetnacl_util.encodeBase64)(this.encryptionKeyPair.publicKey),
+      ...Object.keys(ratchetStates).length > 0 ? { ratchetStates } : {},
+      ...this.mlkemPublicKey ? { mlkemPublicKey: (0, import_tweetnacl_util.encodeBase64)(this.mlkemPublicKey) } : {},
+      ...this.mlkemSecretKey ? { mlkemSecretKey: (0, import_tweetnacl_util.encodeBase64)(this.mlkemSecretKey) } : {}
     };
   }
+  /**
+   * Get the number of messages that failed to decrypt.
+   * Useful for detecting key mismatches, attacks, or corruption.
+   */
+  get decryptFailCount() {
+    return this._decryptFailCount;
+  }
+  /**
+   * Generate a did:key identifier from this agent's Ed25519 signing key.
+   * did:key is a W3C standard — interoperable across systems.
+   * Format: did:key:z6Mk{base58-multicodec-ed25519-pubkey}
+   */
+  get didKey() {
+    const multicodec = new Uint8Array(2 + this.signingKeyPair.publicKey.length);
+    multicodec[0] = 237;
+    multicodec[1] = 1;
+    multicodec.set(this.signingKeyPair.publicKey, 2);
+    return `did:key:z${toBase58(multicodec)}`;
+  }
   // ─── Messaging ──────────────────────────────────────────────────────────────
   /**
    * Send an E2E encrypted message with hardened security.
@@ -2505,39 +4241,73 @@ var VoidlyAgent = class _VoidlyAgent {
     if (useSealed) {
       plaintext = sealEnvelope(this.did, message);
     }
-    let messageBytes;
+    let contentBytes;
     if (usePadding) {
-      messageBytes = padMessage((0, import_tweetnacl_util.decodeUTF8)(plaintext));
+      contentBytes = padMessage((0, import_tweetnacl_util.decodeUTF8)(plaintext));
     } else {
-      messageBytes = (0, import_tweetnacl_util.decodeUTF8)(plaintext);
+      contentBytes = (0, import_tweetnacl_util.decodeUTF8)(plaintext);
     }
     const pairId = `${this.did}:${recipientDid}`;
-    const ratchetState = this._ratchetStates.get(pairId);
-    let ratchetStep_n = 0;
-    if (ratchetState) {
-      const { nextChainKey, messageKey } = await ratchetStep(ratchetState.chainKey);
-      ratchetState.chainKey = nextChainKey;
-      ratchetState.step++;
-      ratchetStep_n = ratchetState.step;
-    } else {
-      const sharedSecret = import_tweetnacl.default.box.before(recipientPubKey, this.encryptionKeyPair.secretKey);
-      this._ratchetStates.set(pairId, {
-        chainKey: sharedSecret,
-        step: 0
-      });
+    let state = this._ratchetStates.get(pairId);
+    let pqCiphertext = null;
+    if (!state) {
+      const x25519Shared = import_tweetnacl.default.box.before(recipientPubKey, this.encryptionKeyPair.secretKey);
+      let chainKey;
+      if (this.postQuantum && profile.mlkem_public_key) {
+        try {
+          const recipientPqPk = (0, import_tweetnacl_util.decodeBase64)(profile.mlkem_public_key);
+          const kem = new MlKem768();
+          const [ct, pqShared] = await kem.encap(recipientPqPk);
+          pqCiphertext = ct;
+          const combined = new Uint8Array(x25519Shared.length + pqShared.length);
+          combined.set(x25519Shared, 0);
+          combined.set(pqShared, x25519Shared.length);
+          chainKey = new Uint8Array(await crypto.subtle.digest("SHA-256", combined));
+        } catch {
+          chainKey = x25519Shared;
+        }
+      } else {
+        chainKey = x25519Shared;
+      }
+      state = {
+        sendChainKey: chainKey,
+        sendStep: 0,
+        recvChainKey: chainKey,
+        // Will be synced on first receive
+        recvStep: 0,
+        skippedKeys: /* @__PURE__ */ new Map()
+      };
+      this._ratchetStates.set(pairId, state);
     }
-    const nonce = import_tweetnacl.default.randomBytes(import_tweetnacl.default.box.nonceLength);
-    const ciphertext = import_tweetnacl.default.box(messageBytes, nonce, recipientPubKey, this.encryptionKeyPair.secretKey);
+    const { nextChainKey, messageKey } = await ratchetStep(state.sendChainKey);
+    state.sendChainKey = nextChainKey;
+    state.sendStep++;
+    const currentStep = state.sendStep;
+    let flags = FLAG_RATCHET;
+    if (usePadding) flags |= FLAG_PADDED;
+    if (useSealed) flags |= FLAG_SEALED;
+    if (pqCiphertext) flags |= FLAG_PQ;
+    const header = makeProtoHeader(flags, currentStep);
+    const messageBytes = new Uint8Array(header.length + contentBytes.length);
+    messageBytes.set(header, 0);
+    messageBytes.set(contentBytes, header.length);
+    const nonce = import_tweetnacl.default.randomBytes(import_tweetnacl.default.secretbox.nonceLength);
+    const ciphertext = import_tweetnacl.default.secretbox(messageBytes, nonce, messageKey);
     if (!ciphertext) {
       throw new Error("Encryption failed");
     }
-    const envelopeData = JSON.stringify({
+    const envelopeObj = {
       from: this.did,
       to: recipientDid,
       timestamp: (/* @__PURE__ */ new Date()).toISOString(),
       nonce: (0, import_tweetnacl_util.encodeBase64)(nonce),
-      ciphertext_hash: await sha256((0, import_tweetnacl_util.encodeBase64)(ciphertext))
-    });
+      ciphertext_hash: await sha256((0, import_tweetnacl_util.encodeBase64)(ciphertext)),
+      ratchet_step: currentStep
+    };
+    if (pqCiphertext) {
+      envelopeObj.pq_ciphertext = (0, import_tweetnacl_util.encodeBase64)(pqCiphertext);
+    }
+    const envelopeData = JSON.stringify(envelopeObj);
     const signature = import_tweetnacl.default.sign.detached((0, import_tweetnacl_util.decodeUTF8)(envelopeData), this.signingKeyPair.secretKey);
     const payload = {
       to: recipientDid,
@@ -2601,7 +4371,7 @@ var VoidlyAgent = class _VoidlyAgent {
     if (options.contentType) params.set("content_type", options.contentType);
     if (options.messageType) params.set("message_type", options.messageType);
     if (options.unreadOnly) params.set("unread", "true");
-    const res = await fetch(`${this.baseUrl}/v1/agent/receive/raw?${params}`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/receive/raw?${params}`, {
       headers: { "X-Agent-Key": this.apiKey }
     });
     if (!res.ok) {
@@ -2612,13 +4382,105 @@ var VoidlyAgent = class _VoidlyAgent {
     const decrypted = [];
     for (const msg of data.messages) {
       try {
+        if (this._seenMessageIds.has(msg.id)) continue;
         const senderEncPub = (0, import_tweetnacl_util.decodeBase64)(msg.sender_encryption_key);
         const ciphertext = (0, import_tweetnacl_util.decodeBase64)(msg.ciphertext);
         const nonce = (0, import_tweetnacl_util.decodeBase64)(msg.nonce);
-        const rawPlaintext = import_tweetnacl.default.box.open(ciphertext, nonce, senderEncPub, this.encryptionKeyPair.secretKey);
-        if (!rawPlaintext) continue;
+        let rawPlaintext = null;
+        let envelopeRatchetStep = 0;
+        let envelopePqCiphertext = null;
+        if (msg.envelope) {
+          try {
+            const env = JSON.parse(msg.envelope);
+            if (typeof env.ratchet_step === "number") {
+              envelopeRatchetStep = env.ratchet_step;
+            }
+            if (typeof env.pq_ciphertext === "string") {
+              envelopePqCiphertext = env.pq_ciphertext;
+            }
+          } catch {
+          }
+        }
+        if (envelopeRatchetStep > 0) {
+          const pairId = `${msg.from}:${this.did}`;
+          let state = this._ratchetStates.get(pairId);
+          if (!state) {
+            const x25519Shared = import_tweetnacl.default.box.before(senderEncPub, this.encryptionKeyPair.secretKey);
+            let chainKey;
+            if (envelopePqCiphertext && this.mlkemSecretKey) {
+              try {
+                const pqCt = (0, import_tweetnacl_util.decodeBase64)(envelopePqCiphertext);
+                const kem = new MlKem768();
+                const pqShared = await kem.decap(pqCt, this.mlkemSecretKey);
+                const combined = new Uint8Array(x25519Shared.length + pqShared.length);
+                combined.set(x25519Shared, 0);
+                combined.set(pqShared, x25519Shared.length);
+                chainKey = new Uint8Array(await crypto.subtle.digest("SHA-256", combined));
+              } catch {
+                chainKey = x25519Shared;
+              }
+            } else {
+              chainKey = x25519Shared;
+            }
+            state = {
+              sendChainKey: chainKey,
+              // Our sending chain to this peer
+              sendStep: 0,
+              recvChainKey: chainKey,
+              // Their sending chain (our receiving)
+              recvStep: 0,
+              skippedKeys: /* @__PURE__ */ new Map()
+            };
+            this._ratchetStates.set(pairId, state);
+          }
+          const targetStep = envelopeRatchetStep;
+          if (state.skippedKeys.has(targetStep)) {
+            const mk = state.skippedKeys.get(targetStep);
+            rawPlaintext = import_tweetnacl.default.secretbox.open(ciphertext, nonce, mk);
+            state.skippedKeys.delete(targetStep);
+          } else if (targetStep > state.recvStep) {
+            const skip = targetStep - state.recvStep;
+            if (skip > MAX_SKIP) {
+              rawPlaintext = import_tweetnacl.default.box.open(ciphertext, nonce, senderEncPub, this.encryptionKeyPair.secretKey);
+            } else {
+              let ck = state.recvChainKey;
+              for (let i = state.recvStep + 1; i < targetStep; i++) {
+                const { nextChainKey: nextChainKey2, messageKey: skippedMk } = await ratchetStep(ck);
+                state.skippedKeys.set(i, skippedMk);
+                ck = nextChainKey2;
+                if (state.skippedKeys.size > MAX_SKIP) {
+                  const oldest = state.skippedKeys.keys().next().value;
+                  if (oldest !== void 0) state.skippedKeys.delete(oldest);
+                }
+              }
+              const { nextChainKey, messageKey } = await ratchetStep(ck);
+              state.recvChainKey = nextChainKey;
+              state.recvStep = targetStep;
+              rawPlaintext = import_tweetnacl.default.secretbox.open(ciphertext, nonce, messageKey);
+            }
+          }
+          if (!rawPlaintext) {
+            rawPlaintext = import_tweetnacl.default.box.open(ciphertext, nonce, senderEncPub, this.encryptionKeyPair.secretKey);
+          }
+        } else {
+          rawPlaintext = import_tweetnacl.default.box.open(ciphertext, nonce, senderEncPub, this.encryptionKeyPair.secretKey);
+        }
+        if (!rawPlaintext) {
+          this._decryptFailCount++;
+          continue;
+        }
         let plaintextBytes = rawPlaintext;
-        if (rawPlaintext.length >= 256 && (rawPlaintext.length & rawPlaintext.length - 1) === 0) {
+        let wasPadded = false;
+        let wasSealed = false;
+        const proto = parseProtoHeader(rawPlaintext);
+        if (proto) {
+          wasPadded = !!(proto.flags & FLAG_PADDED);
+          wasSealed = !!(proto.flags & FLAG_SEALED);
+          plaintextBytes = proto.content;
+        }
+        if (wasPadded) {
+          plaintextBytes = unpadMessage(plaintextBytes);
+        } else if (!proto && rawPlaintext.length >= 256 && (rawPlaintext.length & rawPlaintext.length - 1) === 0) {
           const unpadded = unpadMessage(rawPlaintext);
           if (unpadded.length < rawPlaintext.length) {
             plaintextBytes = unpadded;
@@ -2626,10 +4488,12 @@ var VoidlyAgent = class _VoidlyAgent {
         }
         let content = (0, import_tweetnacl_util.encodeUTF8)(plaintextBytes);
         let senderDid = msg.from;
-        const unsealed = unsealEnvelope(content);
-        if (unsealed) {
-          content = unsealed.msg;
-          senderDid = unsealed.from;
+        if (wasSealed || !proto) {
+          const unsealed = unsealEnvelope(content);
+          if (unsealed) {
+            content = unsealed.msg;
+            senderDid = unsealed.from;
+          }
         }
         let signatureValid = false;
         try {
@@ -2650,6 +4514,15 @@ var VoidlyAgent = class _VoidlyAgent {
         } catch {
           signatureValid = false;
         }
+        if (this.requireSignatures && !signatureValid) {
+          this._decryptFailCount++;
+          continue;
+        }
+        this._seenMessageIds.add(msg.id);
+        if (this._seenMessageIds.size > 1e4) {
+          const first = this._seenMessageIds.values().next().value;
+          if (first !== void 0) this._seenMessageIds.delete(first);
+        }
         decrypted.push({
           id: msg.id,
           from: senderDid,
@@ -2664,6 +4537,7 @@ var VoidlyAgent = class _VoidlyAgent {
           expiresAt: msg.expires_at
         });
       } catch {
+        this._decryptFailCount++;
       }
     }
     return decrypted;
@@ -2673,7 +4547,7 @@ var VoidlyAgent = class _VoidlyAgent {
    * Delete a message by ID (must be sender or recipient).
    */
   async deleteMessage(messageId) {
-    const res = await fetch(`${this.baseUrl}/v1/agent/messages/${messageId}`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/messages/${messageId}`, {
       method: "DELETE",
       headers: { "X-Agent-Key": this.apiKey }
     });
@@ -2684,7 +4558,7 @@ var VoidlyAgent = class _VoidlyAgent {
    * Get this agent's own profile.
    */
   async getProfile() {
-    const res = await fetch(`${this.baseUrl}/v1/agent/profile`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/profile`, {
       headers: { "X-Agent-Key": this.apiKey }
     });
     if (!res.ok) {
@@ -2696,7 +4570,7 @@ var VoidlyAgent = class _VoidlyAgent {
    * Update this agent's profile (name, capabilities, metadata).
    */
   async updateProfile(updates) {
-    const res = await fetch(`${this.baseUrl}/v1/agent/profile`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/profile`, {
       method: "PATCH",
       headers: {
         "Content-Type": "application/json",
@@ -2714,9 +4588,19 @@ var VoidlyAgent = class _VoidlyAgent {
    * Look up an agent's public profile and keys.
    */
   async getIdentity(did) {
-    const res = await fetch(`${this.baseUrl}/v1/agent/identity/${did}`);
+    const cached = this._identityCache.get(did);
+    if (cached && Date.now() - cached.cachedAt < 3e5) {
+      return cached.profile;
+    }
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/identity/${did}`);
     if (!res.ok) return null;
-    return await res.json();
+    const profile = await res.json();
+    this._identityCache.set(did, { profile, cachedAt: Date.now() });
+    if (this._identityCache.size > 500) {
+      const oldest = this._identityCache.keys().next().value;
+      if (oldest !== void 0) this._identityCache.delete(oldest);
+    }
+    return profile;
   }
   /**
    * Search for agents by name or capability.
@@ -2726,7 +4610,7 @@ var VoidlyAgent = class _VoidlyAgent {
     if (options.query) params.set("query", options.query);
     if (options.capability) params.set("capability", options.capability);
     if (options.limit) params.set("limit", String(options.limit));
-    const res = await fetch(`${this.baseUrl}/v1/agent/discover?${params}`);
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/discover?${params}`);
     if (!res.ok) return [];
     const data = await res.json();
     return data.agents;
@@ -2735,7 +4619,7 @@ var VoidlyAgent = class _VoidlyAgent {
    * Get relay network statistics.
    */
   async stats() {
-    const res = await fetch(`${this.baseUrl}/v1/agent/stats`);
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/stats`);
     return await res.json();
   }
   // ─── Webhooks ──────────────────────────────────────────────────────────────
@@ -2744,7 +4628,7 @@ var VoidlyAgent = class _VoidlyAgent {
    * Instead of polling receive(), messages are POSTed to your URL with HMAC signatures.
    */
   async registerWebhook(webhookUrl, options = {}) {
-    const res = await fetch(`${this.baseUrl}/v1/agent/webhooks`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/webhooks`, {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
@@ -2765,7 +4649,7 @@ var VoidlyAgent = class _VoidlyAgent {
    * List registered webhooks.
    */
   async listWebhooks() {
-    const res = await fetch(`${this.baseUrl}/v1/agent/webhooks`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/webhooks`, {
       headers: { "X-Agent-Key": this.apiKey }
     });
     if (!res.ok) return [];
@@ -2776,10 +4660,14 @@ var VoidlyAgent = class _VoidlyAgent {
    * Delete a webhook.
    */
   async deleteWebhook(webhookId) {
-    await fetch(`${this.baseUrl}/v1/agent/webhooks/${webhookId}`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/webhooks/${webhookId}`, {
       method: "DELETE",
       headers: { "X-Agent-Key": this.apiKey }
     });
+    if (!res.ok) {
+      const err = await res.json().catch(() => ({}));
+      throw new Error(`Webhook delete failed: ${err.error || res.statusText}`);
+    }
   }
   /**
    * Verify a webhook payload signature (for use in your webhook handler).
@@ -2816,7 +4704,7 @@ var VoidlyAgent = class _VoidlyAgent {
   async rotateKeys() {
     const newSigningKeyPair = import_tweetnacl.default.sign.keyPair();
     const newEncryptionKeyPair = import_tweetnacl.default.box.keyPair();
-    const res = await fetch(`${this.baseUrl}/v1/agent/rotate-keys`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/rotate-keys`, {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
@@ -2839,7 +4727,7 @@ var VoidlyAgent = class _VoidlyAgent {
    * Only authenticated agents with did:voidly: identities can join and read.
    */
   async createChannel(options) {
-    const res = await fetch(`${this.baseUrl}/v1/agent/channels`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/channels`, {
       method: "POST",
       headers: { "Content-Type": "application/json", "X-Agent-Key": this.apiKey },
       body: JSON.stringify(options)
@@ -2859,7 +4747,7 @@ var VoidlyAgent = class _VoidlyAgent {
     if (options.query) params.set("q", options.query);
     if (options.mine) params.set("mine", "true");
     if (options.limit) params.set("limit", String(options.limit));
-    const res = await fetch(`${this.baseUrl}/v1/agent/channels?${params}`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/channels?${params}`, {
       headers: options.mine ? { "X-Agent-Key": this.apiKey } : {}
     });
     if (!res.ok) return [];
@@ -2870,7 +4758,7 @@ var VoidlyAgent = class _VoidlyAgent {
    * Join an encrypted channel.
    */
   async joinChannel(channelId) {
-    const res = await fetch(`${this.baseUrl}/v1/agent/channels/${channelId}/join`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/channels/${channelId}/join`, {
       method: "POST",
       headers: { "X-Agent-Key": this.apiKey }
     });
@@ -2884,7 +4772,7 @@ var VoidlyAgent = class _VoidlyAgent {
    * Leave a channel.
    */
   async leaveChannel(channelId) {
-    const res = await fetch(`${this.baseUrl}/v1/agent/channels/${channelId}/leave`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/channels/${channelId}/leave`, {
       method: "POST",
       headers: { "X-Agent-Key": this.apiKey }
     });
@@ -2897,7 +4785,7 @@ var VoidlyAgent = class _VoidlyAgent {
    * Post an encrypted message to a channel.
    */
   async postToChannel(channelId, message, replyTo) {
-    const res = await fetch(`${this.baseUrl}/v1/agent/channels/${channelId}/messages`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/channels/${channelId}/messages`, {
       method: "POST",
       headers: { "Content-Type": "application/json", "X-Agent-Key": this.apiKey },
       body: JSON.stringify({ message, reply_to: replyTo })
@@ -2916,7 +4804,7 @@ var VoidlyAgent = class _VoidlyAgent {
     if (options.since) params.set("since", options.since);
     if (options.before) params.set("before", options.before);
     if (options.limit) params.set("limit", String(options.limit));
-    const res = await fetch(`${this.baseUrl}/v1/agent/channels/${channelId}/messages?${params}`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/channels/${channelId}/messages?${params}`, {
       headers: { "X-Agent-Key": this.apiKey }
     });
     if (!res.ok) {
@@ -2930,7 +4818,7 @@ var VoidlyAgent = class _VoidlyAgent {
    * This is a soft delete — messages expire per TTL. Re-register for a new identity.
    */
   async deactivate() {
-    const res = await fetch(`${this.baseUrl}/v1/agent/deactivate`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/deactivate`, {
       method: "DELETE",
       headers: { "X-Agent-Key": this.apiKey }
     });
@@ -2953,7 +4841,7 @@ var VoidlyAgent = class _VoidlyAgent {
    * ```
    */
   async registerCapability(options) {
-    const res = await fetch(`${this.baseUrl}/v1/agent/capabilities`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/capabilities`, {
       method: "POST",
       headers: { "Content-Type": "application/json", "X-Agent-Key": this.apiKey },
       body: JSON.stringify({
@@ -2974,7 +4862,7 @@ var VoidlyAgent = class _VoidlyAgent {
    * List this agent's registered capabilities.
    */
   async listCapabilities() {
-    const res = await fetch(`${this.baseUrl}/v1/agent/capabilities`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/capabilities`, {
       headers: { "X-Agent-Key": this.apiKey }
     });
     if (!res.ok) return [];
@@ -2996,7 +4884,7 @@ var VoidlyAgent = class _VoidlyAgent {
     if (options.query) params.set("q", options.query);
     if (options.name) params.set("name", options.name);
     if (options.limit) params.set("limit", String(options.limit));
-    const res = await fetch(`${this.baseUrl}/v1/agent/capabilities/search?${params}`);
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/capabilities/search?${params}`);
     if (!res.ok) return [];
     const data = await res.json();
     return data.results;
@@ -3005,7 +4893,7 @@ var VoidlyAgent = class _VoidlyAgent {
    * Remove a capability.
    */
   async deleteCapability(capabilityId) {
-    const res = await fetch(`${this.baseUrl}/v1/agent/capabilities/${capabilityId}`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/capabilities/${capabilityId}`, {
       method: "DELETE",
       headers: { "X-Agent-Key": this.apiKey }
     });
@@ -3030,14 +4918,14 @@ var VoidlyAgent = class _VoidlyAgent {
    * ```
    */
   async createTask(options) {
-    const identityRes = await fetch(`${this.baseUrl}/v1/agent/identity/${options.to}`);
+    const identityRes = await this._timedFetch(`${this.baseUrl}/v1/agent/identity/${options.to}`);
     if (!identityRes.ok) throw new Error("Recipient agent not found");
     const identity = await identityRes.json();
     const recipientPubKey = (0, import_tweetnacl_util.decodeBase64)(identity.encryption_public_key);
     const plaintext = (0, import_tweetnacl_util.decodeUTF8)(JSON.stringify(options.input));
     const nonce = import_tweetnacl.default.randomBytes(import_tweetnacl.default.box.nonceLength);
     const encrypted = import_tweetnacl.default.box(plaintext, nonce, recipientPubKey, this.encryptionKeyPair.secretKey);
-    const res = await fetch(`${this.baseUrl}/v1/agent/tasks`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/tasks`, {
       method: "POST",
       headers: { "Content-Type": "application/json", "X-Agent-Key": this.apiKey },
       body: JSON.stringify({
@@ -3064,7 +4952,7 @@ var VoidlyAgent = class _VoidlyAgent {
     if (options.status) params.set("status", options.status);
     if (options.capability) params.set("capability", options.capability);
     if (options.limit) params.set("limit", String(options.limit));
-    const res = await fetch(`${this.baseUrl}/v1/agent/tasks?${params}`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/tasks?${params}`, {
       headers: { "X-Agent-Key": this.apiKey }
     });
     if (!res.ok) return [];
@@ -3075,7 +4963,7 @@ var VoidlyAgent = class _VoidlyAgent {
    * Get task detail. Includes encrypted input/output (only visible to participants).
    */
   async getTask(taskId) {
-    const res = await fetch(`${this.baseUrl}/v1/agent/tasks/${taskId}`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/tasks/${taskId}`, {
       headers: { "X-Agent-Key": this.apiKey }
     });
     if (!res.ok) {
@@ -3107,7 +4995,7 @@ var VoidlyAgent = class _VoidlyAgent {
     if (update.output && (update.status === "completed" || update.status === "failed")) {
       const task = await this.getTask(taskId);
       const requesterDid = task.from;
-      const identityRes = await fetch(`${this.baseUrl}/v1/agent/identity/${requesterDid}`);
+      const identityRes = await this._timedFetch(`${this.baseUrl}/v1/agent/identity/${requesterDid}`);
       if (identityRes.ok) {
         const identity = await identityRes.json();
         const requesterPubKey = (0, import_tweetnacl_util.decodeBase64)(identity.encryption_public_key);
@@ -3120,7 +5008,7 @@ var VoidlyAgent = class _VoidlyAgent {
         body.output_signature = (0, import_tweetnacl_util.encodeBase64)(signature);
       }
     }
-    const res = await fetch(`${this.baseUrl}/v1/agent/tasks/${taskId}`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/tasks/${taskId}`, {
       method: "PATCH",
       headers: { "Content-Type": "application/json", "X-Agent-Key": this.apiKey },
       body: JSON.stringify(body)
@@ -3187,7 +5075,7 @@ var VoidlyAgent = class _VoidlyAgent {
     const payload = options.claimType + JSON.stringify(options.claimData) + timestamp;
     const payloadBytes = (0, import_tweetnacl_util.decodeUTF8)(payload);
     const signature = import_tweetnacl.default.sign.detached(payloadBytes, this.signingKeyPair.secretKey);
-    const res = await fetch(`${this.baseUrl}/v1/agent/attestations`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/attestations`, {
       method: "POST",
       headers: { "Content-Type": "application/json", "X-Agent-Key": this.apiKey },
       body: JSON.stringify({
@@ -3224,7 +5112,7 @@ var VoidlyAgent = class _VoidlyAgent {
     const payload = attestationId + vote;
     const payloadBytes = (0, import_tweetnacl_util.decodeUTF8)(payload);
     const signature = import_tweetnacl.default.sign.detached(payloadBytes, this.signingKeyPair.secretKey);
-    const res = await fetch(`${this.baseUrl}/v1/agent/attestations/${attestationId}/corroborate`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/attestations/${attestationId}/corroborate`, {
       method: "POST",
       headers: { "Content-Type": "application/json", "X-Agent-Key": this.apiKey },
       body: JSON.stringify({ vote, signature: (0, import_tweetnacl_util.encodeBase64)(signature), comment })
@@ -3247,7 +5135,7 @@ var VoidlyAgent = class _VoidlyAgent {
     if (options.minConsensus !== void 0) params.set("min_consensus", String(options.minConsensus));
     if (options.since) params.set("since", options.since);
     if (options.limit) params.set("limit", String(options.limit));
-    const res = await fetch(`${this.baseUrl}/v1/agent/attestations?${params}`);
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/attestations?${params}`);
     if (!res.ok) return [];
     const data = await res.json();
     return data.attestations;
@@ -3256,7 +5144,7 @@ var VoidlyAgent = class _VoidlyAgent {
    * Get attestation detail including all corroborations.
    */
   async getAttestation(attestationId) {
-    const res = await fetch(`${this.baseUrl}/v1/agent/attestations/${attestationId}`);
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/attestations/${attestationId}`);
     if (!res.ok) {
       const err = await res.json().catch(() => ({}));
       throw new Error(`Get attestation failed: ${err.error || res.statusText}`);
@@ -3271,7 +5159,7 @@ var VoidlyAgent = class _VoidlyAgent {
     if (options.country) params.set("country", options.country);
     if (options.domain) params.set("domain", options.domain);
     if (options.type) params.set("type", options.type);
-    const res = await fetch(`${this.baseUrl}/v1/agent/attestations/consensus?${params}`);
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/attestations/consensus?${params}`);
     if (!res.ok) return [];
     const data = await res.json();
     return data.consensus;
@@ -3284,7 +5172,7 @@ var VoidlyAgent = class _VoidlyAgent {
    * Only channel members can invite.
    */
   async inviteToChannel(channelId, inviteeDid, options) {
-    const res = await fetch(`${this.baseUrl}/v1/agent/channels/${channelId}/invite`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/channels/${channelId}/invite`, {
       method: "POST",
       headers: { "Content-Type": "application/json", "X-Agent-Key": this.apiKey },
       body: JSON.stringify({
@@ -3303,7 +5191,7 @@ var VoidlyAgent = class _VoidlyAgent {
    * List pending channel invites for this agent.
    */
   async listInvites(status = "pending") {
-    const res = await fetch(`${this.baseUrl}/v1/agent/invites?status=${status}`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/invites?status=${status}`, {
       headers: { "Content-Type": "application/json", "X-Agent-Key": this.apiKey }
     });
     if (!res.ok) return [];
@@ -3314,7 +5202,7 @@ var VoidlyAgent = class _VoidlyAgent {
    * Accept or decline a channel invite.
    */
   async respondToInvite(inviteId, action) {
-    const res = await fetch(`${this.baseUrl}/v1/agent/invites/${inviteId}/respond`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/invites/${inviteId}/respond`, {
       method: "POST",
       headers: { "Content-Type": "application/json", "X-Agent-Key": this.apiKey },
       body: JSON.stringify({ action })
@@ -3332,7 +5220,7 @@ var VoidlyAgent = class _VoidlyAgent {
    * Get an agent's trust score and reputation breakdown.
    */
   async getTrustScore(did) {
-    const res = await fetch(`${this.baseUrl}/v1/agent/trust/${did}`);
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/trust/${did}`);
     if (!res.ok) {
       const err = await res.json().catch(() => ({}));
       throw new Error(`Trust score failed: ${err.error || res.statusText}`);
@@ -3346,7 +5234,7 @@ var VoidlyAgent = class _VoidlyAgent {
     const params = new URLSearchParams();
     if (options?.limit) params.set("limit", options.limit.toString());
     if (options?.minLevel) params.set("min_level", options.minLevel);
-    const res = await fetch(`${this.baseUrl}/v1/agent/trust/leaderboard?${params}`);
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/trust/leaderboard?${params}`);
     if (!res.ok) return [];
     const data = await res.json();
     return data.leaderboard;
@@ -3358,7 +5246,7 @@ var VoidlyAgent = class _VoidlyAgent {
    * Mark a message as read.
    */
   async markRead(messageId) {
-    const res = await fetch(`${this.baseUrl}/v1/agent/messages/${messageId}/read`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/messages/${messageId}/read`, {
       method: "POST",
       headers: { "Content-Type": "application/json", "X-Agent-Key": this.apiKey }
     });
@@ -3369,7 +5257,7 @@ var VoidlyAgent = class _VoidlyAgent {
    * Mark multiple messages as read in one call.
    */
   async markReadBatch(messageIds) {
-    const res = await fetch(`${this.baseUrl}/v1/agent/messages/read-batch`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/messages/read-batch`, {
       method: "POST",
       headers: { "Content-Type": "application/json", "X-Agent-Key": this.apiKey },
       body: JSON.stringify({ message_ids: messageIds })
@@ -3383,7 +5271,7 @@ var VoidlyAgent = class _VoidlyAgent {
   async getUnreadCount(fromDid) {
     const params = new URLSearchParams();
     if (fromDid) params.set("from", fromDid);
-    const res = await fetch(`${this.baseUrl}/v1/agent/messages/unread-count?${params}`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/messages/unread-count?${params}`, {
       headers: { "Content-Type": "application/json", "X-Agent-Key": this.apiKey }
     });
     if (!res.ok) throw new Error(`Failed to get unread count: ${res.status}`);
@@ -3397,13 +5285,21 @@ var VoidlyAgent = class _VoidlyAgent {
    * The relay finds matching agents and creates individual tasks for each.
    */
   async broadcastTask(options) {
-    const res = await fetch(`${this.baseUrl}/v1/agent/tasks/broadcast`, {
+    const inputBytes = (0, import_tweetnacl_util.decodeUTF8)(options.input);
+    const broadcastNonce = import_tweetnacl.default.randomBytes(import_tweetnacl.default.secretbox.nonceLength);
+    const broadcastEncrypted = import_tweetnacl.default.secretbox(inputBytes, broadcastNonce, import_tweetnacl.default.box.before(
+      this.encryptionKeyPair.publicKey,
+      this.encryptionKeyPair.secretKey
+    ));
+    const broadcastSig = import_tweetnacl.default.sign.detached(inputBytes, this.signingKeyPair.secretKey);
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/tasks/broadcast`, {
       method: "POST",
       headers: { "Content-Type": "application/json", "X-Agent-Key": this.apiKey },
       body: JSON.stringify({
         capability: options.capability,
-        encrypted_input: (0, import_tweetnacl_util.encodeBase64)((0, import_tweetnacl_util.decodeUTF8)(options.input)),
-        input_nonce: (0, import_tweetnacl_util.encodeBase64)(import_tweetnacl.default.randomBytes(24)),
+        encrypted_input: (0, import_tweetnacl_util.encodeBase64)(broadcastEncrypted),
+        input_nonce: (0, import_tweetnacl_util.encodeBase64)(broadcastNonce),
+        input_signature: (0, import_tweetnacl_util.encodeBase64)(broadcastSig),
         priority: options.priority,
         max_agents: options.maxAgents,
         min_trust_level: options.minTrustLevel,
@@ -3422,7 +5318,7 @@ var VoidlyAgent = class _VoidlyAgent {
   async listBroadcasts(status) {
     const params = new URLSearchParams();
     if (status) params.set("status", status);
-    const res = await fetch(`${this.baseUrl}/v1/agent/tasks/broadcasts?${params}`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/tasks/broadcasts?${params}`, {
       headers: { "Content-Type": "application/json", "X-Agent-Key": this.apiKey }
     });
     if (!res.ok) return [];
@@ -3433,7 +5329,7 @@ var VoidlyAgent = class _VoidlyAgent {
    * Get broadcast detail with individual task statuses.
    */
   async getBroadcast(broadcastId) {
-    const res = await fetch(`${this.baseUrl}/v1/agent/tasks/broadcasts/${broadcastId}`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/tasks/broadcasts/${broadcastId}`, {
       headers: { "Content-Type": "application/json", "X-Agent-Key": this.apiKey }
     });
     if (!res.ok) throw new Error(`Failed to get broadcast: ${res.status}`);
@@ -3449,7 +5345,7 @@ var VoidlyAgent = class _VoidlyAgent {
   async getAnalytics(period) {
     const params = new URLSearchParams();
     if (period) params.set("period", period);
-    const res = await fetch(`${this.baseUrl}/v1/agent/analytics?${params}`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/analytics?${params}`, {
       headers: { "Content-Type": "application/json", "X-Agent-Key": this.apiKey }
     });
     if (!res.ok) throw new Error(`Failed to get analytics: ${res.status}`);
@@ -3473,16 +5369,30 @@ var VoidlyAgent = class _VoidlyAgent {
   // ─── Memory Store ──────────────────────────────────────────────────────────
   /**
    * Store an encrypted key-value pair in persistent memory.
-   * Values are encrypted with a key derived from your API key — only you can read them.
+   * Values are encrypted CLIENT-SIDE with nacl.secretbox before sending to relay.
+   * The relay never sees plaintext values — true E2E encrypted storage.
    */
   async memorySet(namespace, key, value, options) {
-    const res = await fetch(`${this.baseUrl}/v1/agent/memory/${encodeURIComponent(namespace)}/${encodeURIComponent(key)}`, {
+    const valueStr = JSON.stringify(value);
+    const valueBytes = (0, import_tweetnacl_util.decodeUTF8)(valueStr);
+    const memNonce = import_tweetnacl.default.randomBytes(import_tweetnacl.default.secretbox.nonceLength);
+    const memKeyInput = new Uint8Array([...this.encryptionKeyPair.secretKey, 77, 69, 77]);
+    let memKey;
+    if (typeof globalThis.crypto?.subtle !== "undefined") {
+      memKey = new Uint8Array(await globalThis.crypto.subtle.digest("SHA-256", memKeyInput));
+    } else {
+      const { createHash } = await import("crypto");
+      memKey = new Uint8Array(createHash("sha256").update(Buffer.from(memKeyInput)).digest());
+    }
+    const encryptedValue = import_tweetnacl.default.secretbox(valueBytes, memNonce, memKey);
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/memory/${encodeURIComponent(namespace)}/${encodeURIComponent(key)}`, {
       method: "PUT",
       headers: { "Content-Type": "application/json", "X-Agent-Key": this.apiKey },
       body: JSON.stringify({
-        value,
-        value_type: options?.valueType || (typeof value === "object" ? "json" : typeof value),
-        ttl: options?.ttl
+        value: (0, import_tweetnacl_util.encodeBase64)(encryptedValue),
+        value_type: `encrypted:${options?.valueType || (typeof value === "object" ? "json" : typeof value)}`,
+        ttl: options?.ttl,
+        client_nonce: (0, import_tweetnacl_util.encodeBase64)(memNonce)
       })
     });
     if (!res.ok) throw new Error(`Memory set failed: ${res.status} ${await res.text()}`);
@@ -3490,21 +5400,42 @@ var VoidlyAgent = class _VoidlyAgent {
   }
   /**
    * Retrieve a value from persistent memory.
-   * Decrypted server-side using your API key derivation.
+   * Decrypted CLIENT-SIDE — relay never sees plaintext.
    */
   async memoryGet(namespace, key) {
-    const res = await fetch(`${this.baseUrl}/v1/agent/memory/${encodeURIComponent(namespace)}/${encodeURIComponent(key)}`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/memory/${encodeURIComponent(namespace)}/${encodeURIComponent(key)}`, {
       headers: { "X-Agent-Key": this.apiKey }
     });
     if (res.status === 404) return null;
     if (!res.ok) throw new Error(`Memory get failed: ${res.status} ${await res.text()}`);
-    return res.json();
+    const data = await res.json();
+    if (data.value_type?.startsWith("encrypted:") && data.client_nonce) {
+      try {
+        const memKeyInput = new Uint8Array([...this.encryptionKeyPair.secretKey, 77, 69, 77]);
+        let memKey;
+        if (typeof globalThis.crypto?.subtle !== "undefined") {
+          memKey = new Uint8Array(await globalThis.crypto.subtle.digest("SHA-256", memKeyInput));
+        } else {
+          const { createHash } = await import("crypto");
+          memKey = new Uint8Array(createHash("sha256").update(Buffer.from(memKeyInput)).digest());
+        }
+        const encBytes = (0, import_tweetnacl_util.decodeBase64)(data.value);
+        const memNonce = (0, import_tweetnacl_util.decodeBase64)(data.client_nonce);
+        const plain = import_tweetnacl.default.secretbox.open(encBytes, memNonce, memKey);
+        if (plain) {
+          data.value = JSON.parse((0, import_tweetnacl_util.encodeUTF8)(plain));
+          data.value_type = data.value_type.replace("encrypted:", "");
+        }
+      } catch {
+      }
+    }
+    return data;
   }
   /**
    * Delete a key from persistent memory.
    */
   async memoryDelete(namespace, key) {
-    const res = await fetch(`${this.baseUrl}/v1/agent/memory/${encodeURIComponent(namespace)}/${encodeURIComponent(key)}`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/memory/${encodeURIComponent(namespace)}/${encodeURIComponent(key)}`, {
       method: "DELETE",
       headers: { "X-Agent-Key": this.apiKey }
     });
@@ -3520,7 +5451,7 @@ var VoidlyAgent = class _VoidlyAgent {
     if (options?.prefix) params.set("prefix", options.prefix);
     if (options?.limit) params.set("limit", String(options.limit));
     const qs = params.toString() ? `?${params.toString()}` : "";
-    const res = await fetch(`${this.baseUrl}/v1/agent/memory/${encodeURIComponent(ns)}${qs}`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/memory/${encodeURIComponent(ns)}${qs}`, {
       headers: { "X-Agent-Key": this.apiKey }
     });
     if (!res.ok) throw new Error(`Memory list failed: ${res.status} ${await res.text()}`);
@@ -3530,7 +5461,7 @@ var VoidlyAgent = class _VoidlyAgent {
    * List all memory namespaces and quota usage.
    */
   async memoryNamespaces() {
-    const res = await fetch(`${this.baseUrl}/v1/agent/memory`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/memory`, {
       headers: { "X-Agent-Key": this.apiKey }
     });
     if (!res.ok) throw new Error(`Memory namespaces failed: ${res.status} ${await res.text()}`);
@@ -3543,7 +5474,7 @@ var VoidlyAgent = class _VoidlyAgent {
    * Memory values remain encrypted — portable to another relay.
    */
   async exportData(options) {
-    const res = await fetch(`${this.baseUrl}/v1/agent/export`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/export`, {
       method: "POST",
       headers: { "Content-Type": "application/json", "X-Agent-Key": this.apiKey },
       body: JSON.stringify({
@@ -3562,7 +5493,7 @@ var VoidlyAgent = class _VoidlyAgent {
    * List past data export records.
    */
   async listExports() {
-    const res = await fetch(`${this.baseUrl}/v1/agent/exports`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/exports`, {
       headers: { "X-Agent-Key": this.apiKey }
     });
     if (!res.ok) throw new Error(`List exports failed: ${res.status} ${await res.text()}`);
@@ -3574,7 +5505,7 @@ var VoidlyAgent = class _VoidlyAgent {
    * Includes federation capabilities and known peers.
    */
   async getRelayInfo() {
-    const res = await fetch(`${this.baseUrl}/v1/relay/info`);
+    const res = await this._timedFetch(`${this.baseUrl}/v1/relay/info`);
     if (!res.ok) throw new Error(`Relay info failed: ${res.status} ${await res.text()}`);
     return res.json();
   }
@@ -3582,7 +5513,7 @@ var VoidlyAgent = class _VoidlyAgent {
    * List known federated relay peers.
    */
   async getRelayPeers() {
-    const res = await fetch(`${this.baseUrl}/v1/relay/peers`);
+    const res = await this._timedFetch(`${this.baseUrl}/v1/relay/peers`);
     if (!res.ok) throw new Error(`Relay peers failed: ${res.status} ${await res.text()}`);
     return res.json();
   }
@@ -3604,7 +5535,7 @@ var VoidlyAgent = class _VoidlyAgent {
       ciphertext_hash: await sha256((0, import_tweetnacl_util.encodeBase64)(encrypted))
     }));
     const signature = import_tweetnacl.default.sign.detached(signaturePayload, this.signingKeyPair.secretKey);
-    const res = await fetch(`${this.baseUrl}/v1/relay/route`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/relay/route`, {
       method: "POST",
       headers: { "Content-Type": "application/json", "X-Agent-Key": this.apiKey },
       body: JSON.stringify({
@@ -3622,7 +5553,7 @@ var VoidlyAgent = class _VoidlyAgent {
   // ── Heartbeat ──────────────────────────────────────────────────────────────
   /** Send heartbeat — signals agent is alive, updates last_seen */
   async ping() {
-    const res = await fetch(`${this.baseUrl}/v1/agent/ping`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/ping`, {
       method: "POST",
       headers: { "X-Agent-Key": this.apiKey }
     });
@@ -3631,14 +5562,14 @@ var VoidlyAgent = class _VoidlyAgent {
   }
   /** Check if another agent is online (public) */
   async checkOnline(did) {
-    const res = await fetch(`${this.baseUrl}/v1/agent/ping/${encodeURIComponent(did)}`);
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/ping/${encodeURIComponent(did)}`);
     if (!res.ok) throw new Error(`Ping check failed: ${res.status}`);
     return res.json();
   }
   // ── Key Pinning (TOFU) ────────────────────────────────────────────────────
   /** Pin another agent's public keys (Trust On First Use). Returns warning if keys changed since last pin. */
   async pinKeys(did) {
-    const res = await fetch(`${this.baseUrl}/v1/agent/keys/pin`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/keys/pin`, {
       method: "POST",
       headers: { "Content-Type": "application/json", "X-Agent-Key": this.apiKey },
       body: JSON.stringify({ did })
@@ -3651,7 +5582,7 @@ var VoidlyAgent = class _VoidlyAgent {
     const params = new URLSearchParams();
     if (options?.status) params.set("status", options.status);
     const qs = params.toString() ? `?${params.toString()}` : "";
-    const res = await fetch(`${this.baseUrl}/v1/agent/keys/pins${qs}`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/keys/pins${qs}`, {
       headers: { "X-Agent-Key": this.apiKey }
     });
     if (!res.ok) throw new Error(`List pins failed: ${res.status}`);
@@ -3659,7 +5590,7 @@ var VoidlyAgent = class _VoidlyAgent {
   }
   /** Verify an agent's keys against your pinned copy. Detects key changes (potential MitM). */
   async verifyKeys(did) {
-    const res = await fetch(`${this.baseUrl}/v1/agent/keys/verify/${encodeURIComponent(did)}`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/keys/verify/${encodeURIComponent(did)}`, {
       headers: { "X-Agent-Key": this.apiKey }
     });
     if (!res.ok) throw new Error(`Key verify failed: ${res.status}`);
@@ -3870,6 +5801,21 @@ var VoidlyAgent = class _VoidlyAgent {
   // ═══════════════════════════════════════════════════════════════════════════
   // INTERNAL — Retry, Auto-Pin
   // ═══════════════════════════════════════════════════════════════════════════
+  /** @internal Fetch with timeout via AbortController */
+  async _timedFetch(url, init) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), this.timeout);
+    try {
+      return await fetch(url, { ...init, signal: controller.signal });
+    } catch (err) {
+      if (err instanceof Error && err.name === "AbortError") {
+        throw new Error(`Request timed out after ${this.timeout}ms: ${url.replace(this.baseUrl, "")}`);
+      }
+      throw err;
+    } finally {
+      clearTimeout(timer);
+    }
+  }
   /** @internal Auto-pin keys on first contact (TOFU) */
   async _autoPinKeys(did) {
     if (this._pinnedDids.has(did)) return;
@@ -3890,7 +5836,7 @@ var VoidlyAgent = class _VoidlyAgent {
     let lastError = null;
     for (let attempt = 0; attempt <= maxRetries; attempt++) {
       try {
-        const res = await fetch(url, init);
+        const res = await this._timedFetch(url, init);
         if (res.ok) {
           return await res.json();
         }
@@ -3967,31 +5913,42 @@ var VoidlyAgent = class _VoidlyAgent {
         "Approximate message size (even with padding, bounded to power-of-2)"
       ],
       relayCannotSee: [
-        "Message content (E2E encrypted with NaCl box)",
+        "Message content (E2E encrypted \u2014 nacl.secretbox with ratchet-derived per-message keys)",
         "Private keys (generated and stored client-side only)",
-        "Memory values (encrypted with key derived from your API key)",
-        "Attestation content (signed but readable by anyone with the attestation)",
+        "Memory values (encrypted CLIENT-SIDE with nacl.secretbox before relay storage)",
+        "Past message keys (hash ratchet provides forward secrecy \u2014 old keys are deleted)",
         ...this.sealedSender ? ["Sender identity (sealed inside ciphertext)"] : []
       ],
       protections: [
+        "Hash ratchet forward secrecy \u2014 per-message key derivation, old keys deleted",
+        ...this.postQuantum && this.mlkemPublicKey ? ["ML-KEM-768 + X25519 hybrid key exchange (NIST FIPS 203 post-quantum, harvest-now-decrypt-later resistant)"] : [],
         "X25519 key exchange + XSalsa20-Poly1305 authenticated encryption",
-        "Ed25519 signatures on every message",
+        "Ed25519 signatures on every message (envelope + ciphertext hash)",
         "TOFU key pinning (MitM detection on key change)",
+        "Client-side memory encryption (relay never sees plaintext values)",
+        "Protocol version header (deterministic padding/sealing detection, no heuristics)",
+        "Identity cache (reduced key lookups, 5-min TTL)",
+        "Message deduplication (track seen message IDs)",
+        "Request timeouts (AbortController on all HTTP, configurable)",
+        "Request validation (fromCredentials validates key sizes and format)",
         ...this.paddingEnabled ? ["Message padding to power-of-2 boundary (traffic analysis resistance)"] : [],
         ...this.sealedSender ? ["Sealed sender (relay cannot see who sent a message)"] : [],
+        ...this.requireSignatures ? ["Strict signature enforcement (reject unsigned/invalid messages)"] : [],
         ...this.fallbackRelays.length > 0 ? [`Multi-relay fallback (${this.fallbackRelays.length} backup relays)`] : [],
         "Auto-retry with exponential backoff",
-        "Offline message queue"
+        "Offline message queue",
+        "did:key interoperability (W3C standard DID format)"
       ],
       gaps: [
-        "No forward secrecy \u2014 same keypair for all messages (compromise exposes ALL history)",
-        "No post-quantum protection \u2014 vulnerable to harvest-now-decrypt-later",
+        "No DH ratchet yet \u2014 hash ratchet only (no post-compromise recovery, planned for v3)",
+        ...!this.postQuantum || !this.mlkemPublicKey ? ["No post-quantum protection \u2014 enable postQuantum option and re-register"] : [],
         "Channel encryption is server-side (relay holds channel keys, NOT true E2E)",
         "Metadata (who, when, thread structure) visible to relay operator",
         "Single relay architecture (no onion routing, no mix network)",
         "Ed25519 signatures are non-repudiable (no deniable messaging)",
         "No async key agreement (no X3DH prekeys)",
-        "Polling-based (no WebSocket real-time transport)"
+        "Polling-based (no WebSocket real-time transport)",
+        "Ratchet state is in-memory (lost on process restart \u2014 export credentials to persist)"
       ]
     };
   }
@@ -4017,6 +5974,9 @@ var Conversation = class {
       replyTo: this._lastMessageId || void 0
     });
     this._lastMessageId = result.id;
+    if (this._messageHistory.length >= 1e3) {
+      this._messageHistory.splice(0, this._messageHistory.length - 999);
+    }
     this._messageHistory.push({
       id: result.id,
       from: this.agent.did,
@@ -4071,9 +6031,9 @@ var Conversation = class {
             messageType: msg.messageType
           });
           this._lastMessageId = msg.id;
-          for (const h of this._replyHandlers) {
+          for (const h2 of this._replyHandlers) {
             try {
-              await h(msg);
+              await h2(msg);
             } catch {
             }
           }
@@ -4091,14 +6051,23 @@ var Conversation = class {
   async waitForReply(timeoutMs = 3e4) {
     return new Promise((resolve, reject) => {
       let resolved = false;
+      let pollTimer = null;
+      const cleanup = () => {
+        resolved = true;
+        if (pollTimer) {
+          clearTimeout(pollTimer);
+          pollTimer = null;
+        }
+      };
       const timeout = setTimeout(() => {
         if (!resolved) {
-          resolved = true;
+          cleanup();
           reject(new Error(`No reply received within ${timeoutMs}ms`));
         }
       }, timeoutMs);
       const check = async () => {
-        while (!resolved) {
+        if (resolved) return;
+        try {
           const messages = await this.agent.receive({
             from: this.peerDid,
             threadId: this.threadId,
@@ -4106,9 +6075,12 @@ var Conversation = class {
             limit: 1
           });
           if (messages.length > 0 && !resolved) {
-            resolved = true;
             clearTimeout(timeout);
+            cleanup();
             const msg = messages[0];
+            if (this._messageHistory.length >= 1e3) {
+              this._messageHistory.splice(0, this._messageHistory.length - 999);
+            }
             this._messageHistory.push({
               id: msg.id,
               from: msg.from,
@@ -4123,16 +6095,19 @@ var Conversation = class {
             resolve(msg);
             return;
           }
-          await new Promise((r) => setTimeout(r, 1500));
+        } catch (err) {
+          if (!resolved) {
+            clearTimeout(timeout);
+            cleanup();
+            reject(err instanceof Error ? err : new Error(String(err)));
+            return;
+          }
         }
-      };
-      check().catch((err) => {
         if (!resolved) {
-          resolved = true;
-          clearTimeout(timeout);
-          reject(err);
+          pollTimer = setTimeout(check, 1500);
         }
-      });
+      };
+      check();
     });
   }
   /**
@@ -4168,3 +6143,8 @@ export {
   export_encodeUTF8 as encodeUTF8,
   export_nacl as nacl
 };
+/*! Bundled license information:
+
+mlkem/esm/src/sha3/utils.js:
+  (*! noble-hashes - MIT License (c) 2022 Paul Miller (paulmillr.com) *)
+*/