@voidly/agent-sdk 2.1.0 → 3.0.0

package/dist/index.js

@@ -49,11 +49,11 @@ var require_nacl_fast = __commonJS({
       var _9 = new Uint8Array(32);
       _9[0] = 9;
       var gf0 = gf(), gf1 = gf([1]), _121665 = gf([56129, 1]), D = gf([30883, 4953, 19914, 30187, 55467, 16705, 2637, 112, 59544, 30585, 16505, 36039, 65139, 11119, 27886, 20995]), D2 = gf([61785, 9906, 39828, 60374, 45398, 33411, 5274, 224, 53552, 61171, 33010, 6542, 64743, 22239, 55772, 9222]), X = gf([54554, 36645, 11616, 51542, 42930, 38181, 51040, 26924, 56412, 64982, 57905, 49316, 21502, 52590, 14035, 8553]), Y = gf([26200, 26214, 26214, 26214, 26214, 26214, 26214, 26214, 26214, 26214, 26214, 26214, 26214, 26214, 26214, 26214]), I = gf([41136, 18958, 6951, 50414, 58488, 44335, 6150, 12099, 55207, 15867, 153, 11085, 57099, 20417, 9344, 11139]);
-      function ts64(x, i, h, l) {
-        x[i] = h >> 24 & 255;
-        x[i + 1] = h >> 16 & 255;
-        x[i + 2] = h >> 8 & 255;
-        x[i + 3] = h & 255;
+      function ts64(x, i, h2, l) {
+        x[i] = h2 >> 24 & 255;
+        x[i + 1] = h2 >> 16 & 255;
+        x[i + 2] = h2 >> 8 & 255;
+        x[i + 3] = h2 & 255;
         x[i + 4] = l >> 24 & 255;
         x[i + 5] = l >> 16 & 255;
         x[i + 6] = l >> 8 & 255;
@@ -631,7 +631,7 @@ var require_nacl_fast = __commonJS({
         this.h[9] = h9;
       };
       poly1305.prototype.finish = function(mac, macpos) {
-        var g = new Uint16Array(10);
+        var g2 = new Uint16Array(10);
         var c, mask, f, i;
         if (this.leftover) {
           i = this.leftover;
@@ -654,19 +654,19 @@ var require_nacl_fast = __commonJS({
         c = this.h[1] >>> 13;
         this.h[1] &= 8191;
         this.h[2] += c;
-        g[0] = this.h[0] + 5;
-        c = g[0] >>> 13;
-        g[0] &= 8191;
+        g2[0] = this.h[0] + 5;
+        c = g2[0] >>> 13;
+        g2[0] &= 8191;
         for (i = 1; i < 10; i++) {
-          g[i] = this.h[i] + c;
-          c = g[i] >>> 13;
-          g[i] &= 8191;
+          g2[i] = this.h[i] + c;
+          c = g2[i] >>> 13;
+          g2[i] &= 8191;
         }
-        g[9] -= 1 << 13;
+        g2[9] -= 1 << 13;
         mask = (c ^ 1) - 1;
-        for (i = 0; i < 10; i++) g[i] &= mask;
+        for (i = 0; i < 10; i++) g2[i] &= mask;
         mask = ~mask;
-        for (i = 0; i < 10; i++) this.h[i] = this.h[i] & mask | g[i];
+        for (i = 0; i < 10; i++) this.h[i] = this.h[i] & mask | g2[i];
         this.h[0] = (this.h[0] | this.h[1] << 13) & 65535;
         this.h[1] = (this.h[1] >>> 3 | this.h[2] << 10) & 65535;
         this.h[2] = (this.h[2] >>> 6 | this.h[3] << 7) & 65535;
@@ -732,10 +732,10 @@ var require_nacl_fast = __commonJS({
         s.finish(out, outpos);
         return 0;
       }
-      function crypto_onetimeauth_verify(h, hpos, m, mpos, n, k) {
+      function crypto_onetimeauth_verify(h2, hpos, m, mpos, n, k) {
         var x = new Uint8Array(16);
         crypto_onetimeauth(x, 0, m, mpos, n, k);
-        return crypto_verify_16(h, hpos, x, 0);
+        return crypto_verify_16(h2, hpos, x, 0);
       }
       function crypto_secretbox(c, m, d, n, k) {
         var i;
@@ -1488,7 +1488,7 @@ var require_nacl_fast = __commonJS({
         1246189591
       ];
       function crypto_hashblocks_hl(hh, hl, m, n) {
-        var wh = new Int32Array(16), wl = new Int32Array(16), bh0, bh1, bh2, bh3, bh4, bh5, bh6, bh7, bl0, bl1, bl2, bl3, bl4, bl5, bl6, bl7, th, tl, i, j, h, l, a, b, c, d;
+        var wh = new Int32Array(16), wl = new Int32Array(16), bh0, bh1, bh2, bh3, bh4, bh5, bh6, bh7, bl0, bl1, bl2, bl3, bl4, bl5, bl6, bl7, th, tl, i, j, h2, l, a, b, c, d;
         var ah0 = hh[0], ah1 = hh[1], ah2 = hh[2], ah3 = hh[3], ah4 = hh[4], ah5 = hh[5], ah6 = hh[6], ah7 = hh[7], al0 = hl[0], al1 = hl[1], al2 = hl[2], al3 = hl[3], al4 = hl[4], al5 = hl[5], al6 = hl[6], al7 = hl[7];
         var pos = 0;
         while (n >= 128) {
@@ -1514,76 +1514,76 @@ var require_nacl_fast = __commonJS({
             bl5 = al5;
             bl6 = al6;
             bl7 = al7;
-            h = ah7;
+            h2 = ah7;
             l = al7;
             a = l & 65535;
             b = l >>> 16;
-            c = h & 65535;
-            d = h >>> 16;
-            h = (ah4 >>> 14 | al4 << 32 - 14) ^ (ah4 >>> 18 | al4 << 32 - 18) ^ (al4 >>> 41 - 32 | ah4 << 32 - (41 - 32));
+            c = h2 & 65535;
+            d = h2 >>> 16;
+            h2 = (ah4 >>> 14 | al4 << 32 - 14) ^ (ah4 >>> 18 | al4 << 32 - 18) ^ (al4 >>> 41 - 32 | ah4 << 32 - (41 - 32));
             l = (al4 >>> 14 | ah4 << 32 - 14) ^ (al4 >>> 18 | ah4 << 32 - 18) ^ (ah4 >>> 41 - 32 | al4 << 32 - (41 - 32));
             a += l & 65535;
             b += l >>> 16;
-            c += h & 65535;
-            d += h >>> 16;
-            h = ah4 & ah5 ^ ~ah4 & ah6;
+            c += h2 & 65535;
+            d += h2 >>> 16;
+            h2 = ah4 & ah5 ^ ~ah4 & ah6;
             l = al4 & al5 ^ ~al4 & al6;
             a += l & 65535;
             b += l >>> 16;
-            c += h & 65535;
-            d += h >>> 16;
-            h = K[i * 2];
+            c += h2 & 65535;
+            d += h2 >>> 16;
+            h2 = K[i * 2];
             l = K[i * 2 + 1];
             a += l & 65535;
             b += l >>> 16;
-            c += h & 65535;
-            d += h >>> 16;
-            h = wh[i % 16];
+            c += h2 & 65535;
+            d += h2 >>> 16;
+            h2 = wh[i % 16];
             l = wl[i % 16];
             a += l & 65535;
             b += l >>> 16;
-            c += h & 65535;
-            d += h >>> 16;
+            c += h2 & 65535;
+            d += h2 >>> 16;
             b += a >>> 16;
             c += b >>> 16;
             d += c >>> 16;
             th = c & 65535 | d << 16;
             tl = a & 65535 | b << 16;
-            h = th;
+            h2 = th;
             l = tl;
             a = l & 65535;
             b = l >>> 16;
-            c = h & 65535;
-            d = h >>> 16;
-            h = (ah0 >>> 28 | al0 << 32 - 28) ^ (al0 >>> 34 - 32 | ah0 << 32 - (34 - 32)) ^ (al0 >>> 39 - 32 | ah0 << 32 - (39 - 32));
+            c = h2 & 65535;
+            d = h2 >>> 16;
+            h2 = (ah0 >>> 28 | al0 << 32 - 28) ^ (al0 >>> 34 - 32 | ah0 << 32 - (34 - 32)) ^ (al0 >>> 39 - 32 | ah0 << 32 - (39 - 32));
             l = (al0 >>> 28 | ah0 << 32 - 28) ^ (ah0 >>> 34 - 32 | al0 << 32 - (34 - 32)) ^ (ah0 >>> 39 - 32 | al0 << 32 - (39 - 32));
             a += l & 65535;
             b += l >>> 16;
-            c += h & 65535;
-            d += h >>> 16;
-            h = ah0 & ah1 ^ ah0 & ah2 ^ ah1 & ah2;
+            c += h2 & 65535;
+            d += h2 >>> 16;
+            h2 = ah0 & ah1 ^ ah0 & ah2 ^ ah1 & ah2;
             l = al0 & al1 ^ al0 & al2 ^ al1 & al2;
             a += l & 65535;
             b += l >>> 16;
-            c += h & 65535;
-            d += h >>> 16;
+            c += h2 & 65535;
+            d += h2 >>> 16;
             b += a >>> 16;
             c += b >>> 16;
             d += c >>> 16;
             bh7 = c & 65535 | d << 16;
             bl7 = a & 65535 | b << 16;
-            h = bh3;
+            h2 = bh3;
             l = bl3;
             a = l & 65535;
             b = l >>> 16;
-            c = h & 65535;
-            d = h >>> 16;
-            h = th;
+            c = h2 & 65535;
+            d = h2 >>> 16;
+            h2 = th;
             l = tl;
             a += l & 65535;
             b += l >>> 16;
-            c += h & 65535;
-            d += h >>> 16;
+            c += h2 & 65535;
+            d += h2 >>> 16;
             b += a >>> 16;
             c += b >>> 16;
             d += c >>> 16;
@@ -1607,34 +1607,34 @@ var require_nacl_fast = __commonJS({
             al0 = bl7;
             if (i % 16 === 15) {
               for (j = 0; j < 16; j++) {
-                h = wh[j];
+                h2 = wh[j];
                 l = wl[j];
                 a = l & 65535;
                 b = l >>> 16;
-                c = h & 65535;
-                d = h >>> 16;
-                h = wh[(j + 9) % 16];
+                c = h2 & 65535;
+                d = h2 >>> 16;
+                h2 = wh[(j + 9) % 16];
                 l = wl[(j + 9) % 16];
                 a += l & 65535;
                 b += l >>> 16;
-                c += h & 65535;
-                d += h >>> 16;
+                c += h2 & 65535;
+                d += h2 >>> 16;
                 th = wh[(j + 1) % 16];
                 tl = wl[(j + 1) % 16];
-                h = (th >>> 1 | tl << 32 - 1) ^ (th >>> 8 | tl << 32 - 8) ^ th >>> 7;
+                h2 = (th >>> 1 | tl << 32 - 1) ^ (th >>> 8 | tl << 32 - 8) ^ th >>> 7;
                 l = (tl >>> 1 | th << 32 - 1) ^ (tl >>> 8 | th << 32 - 8) ^ (tl >>> 7 | th << 32 - 7);
                 a += l & 65535;
                 b += l >>> 16;
-                c += h & 65535;
-                d += h >>> 16;
+                c += h2 & 65535;
+                d += h2 >>> 16;
                 th = wh[(j + 14) % 16];
                 tl = wl[(j + 14) % 16];
-                h = (th >>> 19 | tl << 32 - 19) ^ (tl >>> 61 - 32 | th << 32 - (61 - 32)) ^ th >>> 6;
+                h2 = (th >>> 19 | tl << 32 - 19) ^ (tl >>> 61 - 32 | th << 32 - (61 - 32)) ^ th >>> 6;
                 l = (tl >>> 19 | th << 32 - 19) ^ (th >>> 61 - 32 | tl << 32 - (61 - 32)) ^ (tl >>> 6 | th << 32 - 6);
                 a += l & 65535;
                 b += l >>> 16;
-                c += h & 65535;
-                d += h >>> 16;
+                c += h2 & 65535;
+                d += h2 >>> 16;
                 b += a >>> 16;
                 c += b >>> 16;
                 d += c >>> 16;
@@ -1643,137 +1643,137 @@ var require_nacl_fast = __commonJS({
               }
             }
           }
-          h = ah0;
+          h2 = ah0;
           l = al0;
           a = l & 65535;
           b = l >>> 16;
-          c = h & 65535;
-          d = h >>> 16;
-          h = hh[0];
+          c = h2 & 65535;
+          d = h2 >>> 16;
+          h2 = hh[0];
           l = hl[0];
           a += l & 65535;
           b += l >>> 16;
-          c += h & 65535;
-          d += h >>> 16;
+          c += h2 & 65535;
+          d += h2 >>> 16;
           b += a >>> 16;
           c += b >>> 16;
           d += c >>> 16;
           hh[0] = ah0 = c & 65535 | d << 16;
           hl[0] = al0 = a & 65535 | b << 16;
-          h = ah1;
+          h2 = ah1;
           l = al1;
           a = l & 65535;
           b = l >>> 16;
-          c = h & 65535;
-          d = h >>> 16;
-          h = hh[1];
+          c = h2 & 65535;
+          d = h2 >>> 16;
+          h2 = hh[1];
           l = hl[1];
           a += l & 65535;
           b += l >>> 16;
-          c += h & 65535;
-          d += h >>> 16;
+          c += h2 & 65535;
+          d += h2 >>> 16;
           b += a >>> 16;
           c += b >>> 16;
           d += c >>> 16;
           hh[1] = ah1 = c & 65535 | d << 16;
           hl[1] = al1 = a & 65535 | b << 16;
-          h = ah2;
+          h2 = ah2;
           l = al2;
           a = l & 65535;
           b = l >>> 16;
-          c = h & 65535;
-          d = h >>> 16;
-          h = hh[2];
+          c = h2 & 65535;
+          d = h2 >>> 16;
+          h2 = hh[2];
           l = hl[2];
           a += l & 65535;
           b += l >>> 16;
-          c += h & 65535;
-          d += h >>> 16;
+          c += h2 & 65535;
+          d += h2 >>> 16;
           b += a >>> 16;
           c += b >>> 16;
           d += c >>> 16;
           hh[2] = ah2 = c & 65535 | d << 16;
           hl[2] = al2 = a & 65535 | b << 16;
-          h = ah3;
+          h2 = ah3;
           l = al3;
           a = l & 65535;
           b = l >>> 16;
-          c = h & 65535;
-          d = h >>> 16;
-          h = hh[3];
+          c = h2 & 65535;
+          d = h2 >>> 16;
+          h2 = hh[3];
           l = hl[3];
           a += l & 65535;
           b += l >>> 16;
-          c += h & 65535;
-          d += h >>> 16;
+          c += h2 & 65535;
+          d += h2 >>> 16;
           b += a >>> 16;
           c += b >>> 16;
           d += c >>> 16;
           hh[3] = ah3 = c & 65535 | d << 16;
           hl[3] = al3 = a & 65535 | b << 16;
-          h = ah4;
+          h2 = ah4;
           l = al4;
           a = l & 65535;
           b = l >>> 16;
-          c = h & 65535;
-          d = h >>> 16;
-          h = hh[4];
+          c = h2 & 65535;
+          d = h2 >>> 16;
+          h2 = hh[4];
           l = hl[4];
           a += l & 65535;
           b += l >>> 16;
-          c += h & 65535;
-          d += h >>> 16;
+          c += h2 & 65535;
+          d += h2 >>> 16;
           b += a >>> 16;
           c += b >>> 16;
           d += c >>> 16;
           hh[4] = ah4 = c & 65535 | d << 16;
           hl[4] = al4 = a & 65535 | b << 16;
-          h = ah5;
+          h2 = ah5;
           l = al5;
           a = l & 65535;
           b = l >>> 16;
-          c = h & 65535;
-          d = h >>> 16;
-          h = hh[5];
+          c = h2 & 65535;
+          d = h2 >>> 16;
+          h2 = hh[5];
           l = hl[5];
           a += l & 65535;
           b += l >>> 16;
-          c += h & 65535;
-          d += h >>> 16;
+          c += h2 & 65535;
+          d += h2 >>> 16;
           b += a >>> 16;
           c += b >>> 16;
           d += c >>> 16;
           hh[5] = ah5 = c & 65535 | d << 16;
           hl[5] = al5 = a & 65535 | b << 16;
-          h = ah6;
+          h2 = ah6;
           l = al6;
           a = l & 65535;
           b = l >>> 16;
-          c = h & 65535;
-          d = h >>> 16;
-          h = hh[6];
+          c = h2 & 65535;
+          d = h2 >>> 16;
+          h2 = hh[6];
           l = hl[6];
           a += l & 65535;
           b += l >>> 16;
-          c += h & 65535;
-          d += h >>> 16;
+          c += h2 & 65535;
+          d += h2 >>> 16;
           b += a >>> 16;
           c += b >>> 16;
           d += c >>> 16;
           hh[6] = ah6 = c & 65535 | d << 16;
           hl[6] = al6 = a & 65535 | b << 16;
-          h = ah7;
+          h2 = ah7;
           l = al7;
           a = l & 65535;
           b = l >>> 16;
-          c = h & 65535;
-          d = h >>> 16;
-          h = hh[7];
+          c = h2 & 65535;
+          d = h2 >>> 16;
+          h2 = hh[7];
           l = hl[7];
           a += l & 65535;
           b += l >>> 16;
-          c += h & 65535;
-          d += h >>> 16;
+          c += h2 & 65535;
+          d += h2 >>> 16;
           b += a >>> 16;
           c += b >>> 16;
           d += c >>> 16;
@@ -1813,8 +1813,8 @@ var require_nacl_fast = __commonJS({
         for (i = 0; i < 8; i++) ts64(out, 8 * i, hh[i], hl[i]);
         return 0;
       }
-      function add(p, q) {
-        var a = gf(), b = gf(), c = gf(), d = gf(), e = gf(), f = gf(), g = gf(), h = gf(), t = gf();
+      function add2(p, q) {
+        var a = gf(), b = gf(), c = gf(), d = gf(), e = gf(), f = gf(), g2 = gf(), h2 = gf(), t = gf();
         Z(a, p[1], p[0]);
         Z(t, q[1], q[0]);
         M(a, a, t);
@@ -1827,12 +1827,12 @@ var require_nacl_fast = __commonJS({
         A(d, d, d);
         Z(e, b, a);
         Z(f, d, c);
-        A(g, d, c);
-        A(h, b, a);
+        A(g2, d, c);
+        A(h2, b, a);
         M(p[0], e, f);
-        M(p[1], h, g);
-        M(p[2], g, f);
-        M(p[3], e, h);
+        M(p[1], h2, g2);
+        M(p[2], g2, f);
+        M(p[3], e, h2);
       }
       function cswap(p, q, b) {
         var i;
@@ -1857,8 +1857,8 @@ var require_nacl_fast = __commonJS({
         for (i = 255; i >= 0; --i) {
           b = s[i / 8 | 0] >> (i & 7) & 1;
           cswap(p, q, b);
-          add(q, p);
-          add(p, p);
+          add2(q, p);
+          add2(p, p);
           cswap(p, q, b);
         }
       }
@@ -1909,14 +1909,14 @@ var require_nacl_fast = __commonJS({
           r[i] = x[i] & 255;
         }
       }
-      function reduce(r) {
+      function reduce2(r) {
         var x = new Float64Array(64), i;
         for (i = 0; i < 64; i++) x[i] = r[i];
         for (i = 0; i < 64; i++) r[i] = 0;
         modL(r, x);
       }
       function crypto_sign(sm, m, n, sk) {
-        var d = new Uint8Array(64), h = new Uint8Array(64), r = new Uint8Array(64);
+        var d = new Uint8Array(64), h2 = new Uint8Array(64), r = new Uint8Array(64);
         var i, j, x = new Float64Array(64);
         var p = [gf(), gf(), gf(), gf()];
         crypto_hash(d, sk, 32);
@@ -1927,17 +1927,17 @@ var require_nacl_fast = __commonJS({
         for (i = 0; i < n; i++) sm[64 + i] = m[i];
         for (i = 0; i < 32; i++) sm[32 + i] = d[32 + i];
         crypto_hash(r, sm.subarray(32), n + 32);
-        reduce(r);
+        reduce2(r);
         scalarbase(p, r);
         pack(sm, p);
         for (i = 32; i < 64; i++) sm[i] = sk[i];
-        crypto_hash(h, sm, n + 64);
-        reduce(h);
+        crypto_hash(h2, sm, n + 64);
+        reduce2(h2);
         for (i = 0; i < 64; i++) x[i] = 0;
         for (i = 0; i < 32; i++) x[i] = r[i];
         for (i = 0; i < 32; i++) {
           for (j = 0; j < 32; j++) {
-            x[i + j] += h[i] * d[j];
+            x[i + j] += h2[i] * d[j];
           }
         }
         modL(sm.subarray(32), x);
@@ -1973,17 +1973,17 @@ var require_nacl_fast = __commonJS({
       }
       function crypto_sign_open(m, sm, n, pk) {
         var i;
-        var t = new Uint8Array(32), h = new Uint8Array(64);
+        var t = new Uint8Array(32), h2 = new Uint8Array(64);
         var p = [gf(), gf(), gf(), gf()], q = [gf(), gf(), gf(), gf()];
         if (n < 64) return -1;
         if (unpackneg(q, pk)) return -1;
         for (i = 0; i < n; i++) m[i] = sm[i];
         for (i = 0; i < 32; i++) m[i + 32] = pk[i];
-        crypto_hash(h, m, n);
-        reduce(h);
-        scalarmult(p, q, h);
+        crypto_hash(h2, m, n);
+        reduce2(h2);
+        scalarmult(p, q, h2);
         scalarbase(q, sm.subarray(32));
-        add(p, q);
+        add2(p, q);
         pack(t, p);
         n -= 64;
         if (crypto_verify_32(sm, 0, t, 0)) {
@@ -2044,7 +2044,7 @@ var require_nacl_fast = __commonJS({
         S,
         Z,
         pow2523,
-        add,
+        add: add2,
         set25519,
         modL,
         scalarmult,
@@ -2215,9 +2215,9 @@ var require_nacl_fast = __commonJS({
       nacl2.sign.signatureLength = crypto_sign_BYTES;
       nacl2.hash = function(msg) {
         checkArrayTypes(msg);
-        var h = new Uint8Array(crypto_hash_BYTES);
-        crypto_hash(h, msg, msg.length);
-        return h;
+        var h2 = new Uint8Array(crypto_hash_BYTES);
+        crypto_hash(h2, msg, msg.length);
+        return h2;
       };
       nacl2.hash.hashLength = crypto_hash_BYTES;
       nacl2.verify = function(x, y) {
@@ -2230,22 +2230,22 @@ var require_nacl_fast = __commonJS({
         randombytes = fn;
       };
       (function() {
-        var crypto = typeof self !== "undefined" ? self.crypto || self.msCrypto : null;
-        if (crypto && crypto.getRandomValues) {
+        var crypto2 = typeof self !== "undefined" ? self.crypto || self.msCrypto : null;
+        if (crypto2 && crypto2.getRandomValues) {
           var QUOTA = 65536;
           nacl2.setPRNG(function(x, n) {
             var i, v = new Uint8Array(n);
             for (i = 0; i < n; i += QUOTA) {
-              crypto.getRandomValues(v.subarray(i, i + Math.min(n - i, QUOTA)));
+              crypto2.getRandomValues(v.subarray(i, i + Math.min(n - i, QUOTA)));
             }
             for (i = 0; i < n; i++) x[i] = v[i];
             cleanup(v);
           });
         } else if (typeof require !== "undefined") {
-          crypto = require("crypto");
-          if (crypto && crypto.randomBytes) {
+          crypto2 = require("crypto");
+          if (crypto2 && crypto2.randomBytes) {
             nacl2.setPRNG(function(x, n) {
-              var i, v = crypto.randomBytes(n);
+              var i, v = crypto2.randomBytes(n);
               for (i = 0; i < n; i++) x[i] = v[i];
               cleanup(v);
             });
@@ -2337,6 +2337,1603 @@ __export(index_exports, {
 module.exports = __toCommonJS(index_exports);
 var import_tweetnacl = __toESM(require_nacl_fast());
 var import_tweetnacl_util = __toESM(require_nacl_util());
+
+// node_modules/mlkem/esm/src/errors.js
+var MlKemError = class extends Error {
+  constructor(e) {
+    let message;
+    if (e instanceof Error) {
+      message = e.message;
+    } else if (typeof e === "string") {
+      message = e;
+    } else {
+      message = "";
+    }
+    super(message);
+    this.name = this.constructor.name;
+  }
+};
+
+// node_modules/mlkem/esm/src/consts.js
+var N = 256;
+var Q = 3329;
+var Q_INV = 62209;
+var NTT_ZETAS = [
+  2285,
+  2571,
+  2970,
+  1812,
+  1493,
+  1422,
+  287,
+  202,
+  3158,
+  622,
+  1577,
+  182,
+  962,
+  2127,
+  1855,
+  1468,
+  573,
+  2004,
+  264,
+  383,
+  2500,
+  1458,
+  1727,
+  3199,
+  2648,
+  1017,
+  732,
+  608,
+  1787,
+  411,
+  3124,
+  1758,
+  1223,
+  652,
+  2777,
+  1015,
+  2036,
+  1491,
+  3047,
+  1785,
+  516,
+  3321,
+  3009,
+  2663,
+  1711,
+  2167,
+  126,
+  1469,
+  2476,
+  3239,
+  3058,
+  830,
+  107,
+  1908,
+  3082,
+  2378,
+  2931,
+  961,
+  1821,
+  2604,
+  448,
+  2264,
+  677,
+  2054,
+  2226,
+  430,
+  555,
+  843,
+  2078,
+  871,
+  1550,
+  105,
+  422,
+  587,
+  177,
+  3094,
+  3038,
+  2869,
+  1574,
+  1653,
+  3083,
+  778,
+  1159,
+  3182,
+  2552,
+  1483,
+  2727,
+  1119,
+  1739,
+  644,
+  2457,
+  349,
+  418,
+  329,
+  3173,
+  3254,
+  817,
+  1097,
+  603,
+  610,
+  1322,
+  2044,
+  1864,
+  384,
+  2114,
+  3193,
+  1218,
+  1994,
+  2455,
+  220,
+  2142,
+  1670,
+  2144,
+  1799,
+  2051,
+  794,
+  1819,
+  2475,
+  2459,
+  478,
+  3221,
+  3021,
+  996,
+  991,
+  958,
+  1869,
+  1522,
+  1628
+];
+var NTT_ZETAS_INV = [
+  1701,
+  1807,
+  1460,
+  2371,
+  2338,
+  2333,
+  308,
+  108,
+  2851,
+  870,
+  854,
+  1510,
+  2535,
+  1278,
+  1530,
+  1185,
+  1659,
+  1187,
+  3109,
+  874,
+  1335,
+  2111,
+  136,
+  1215,
+  2945,
+  1465,
+  1285,
+  2007,
+  2719,
+  2726,
+  2232,
+  2512,
+  75,
+  156,
+  3e3,
+  2911,
+  2980,
+  872,
+  2685,
+  1590,
+  2210,
+  602,
+  1846,
+  777,
+  147,
+  2170,
+  2551,
+  246,
+  1676,
+  1755,
+  460,
+  291,
+  235,
+  3152,
+  2742,
+  2907,
+  3224,
+  1779,
+  2458,
+  1251,
+  2486,
+  2774,
+  2899,
+  1103,
+  1275,
+  2652,
+  1065,
+  2881,
+  725,
+  1508,
+  2368,
+  398,
+  951,
+  247,
+  1421,
+  3222,
+  2499,
+  271,
+  90,
+  853,
+  1860,
+  3203,
+  1162,
+  1618,
+  666,
+  320,
+  8,
+  2813,
+  1544,
+  282,
+  1838,
+  1293,
+  2314,
+  552,
+  2677,
+  2106,
+  1571,
+  205,
+  2918,
+  1542,
+  2721,
+  2597,
+  2312,
+  681,
+  130,
+  1602,
+  1871,
+  829,
+  2946,
+  3065,
+  1325,
+  2756,
+  1861,
+  1474,
+  1202,
+  2367,
+  3147,
+  1752,
+  2707,
+  171,
+  3127,
+  3042,
+  1907,
+  1836,
+  1517,
+  359,
+  758,
+  1441
+];
+
+// node_modules/mlkem/esm/src/sha3/_u64.js
+var U32_MASK64 = /* @__PURE__ */ BigInt(2 ** 32 - 1);
+var _32n = /* @__PURE__ */ BigInt(32);
+function fromBig(n, le = false) {
+  if (le) {
+    return { h: Number(n & U32_MASK64), l: Number(n >> _32n & U32_MASK64) };
+  }
+  return {
+    h: Number(n >> _32n & U32_MASK64) | 0,
+    l: Number(n & U32_MASK64) | 0
+  };
+}
+function split(lst, le = false) {
+  const len = lst.length;
+  const Ah = new Uint32Array(len);
+  const Al = new Uint32Array(len);
+  for (let i = 0; i < len; i++) {
+    const { h: h2, l } = fromBig(lst[i], le);
+    [Ah[i], Al[i]] = [h2, l];
+  }
+  return [Ah, Al];
+}
+var rotlSH = (h2, l, s) => h2 << s | l >>> 32 - s;
+var rotlSL = (h2, l, s) => l << s | h2 >>> 32 - s;
+var rotlBH = (h2, l, s) => l << s - 32 | h2 >>> 64 - s;
+var rotlBL = (h2, l, s) => h2 << s - 32 | l >>> 64 - s;
+
+// node_modules/mlkem/esm/src/sha3/utils.js
+function isBytes(a) {
+  return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array";
+}
+function anumber(n, title = "") {
+  if (!Number.isSafeInteger(n) || n < 0) {
+    const prefix = title && `"${title}" `;
+    throw new Error(`${prefix}expected integer >0, got ${n}`);
+  }
+}
+function abytes(value, length, title = "") {
+  const bytes = isBytes(value);
+  const len = value?.length;
+  const needsLen = length !== void 0;
+  if (!bytes || needsLen && len !== length) {
+    const prefix = title && `"${title}" `;
+    const ofLen = needsLen ? ` of length ${length}` : "";
+    const got = bytes ? `length=${len}` : `type=${typeof value}`;
+    throw new Error(prefix + "expected Uint8Array" + ofLen + ", got " + got);
+  }
+  return value;
+}
+function aexists(instance, checkFinished = true) {
+  if (instance.destroyed)
+    throw new Error("Hash instance has been destroyed");
+  if (checkFinished && instance.finished) {
+    throw new Error("Hash#digest() has already been called");
+  }
+}
+function aoutput(out, instance) {
+  abytes(out, void 0, "digestInto() output");
+  const min = instance.outputLen;
+  if (out.length < min) {
+    throw new Error('"digestInto() output" expected to be of length >=' + min);
+  }
+}
+function u32(arr) {
+  return new Uint32Array(arr.buffer, arr.byteOffset, Math.floor(arr.byteLength / 4));
+}
+function clean(...arrays) {
+  for (let i = 0; i < arrays.length; i++) {
+    arrays[i].fill(0);
+  }
+}
+var isLE = /* @__PURE__ */ (() => new Uint8Array(new Uint32Array([287454020]).buffer)[0] === 68)();
+function byteSwap(word) {
+  return word << 24 & 4278190080 | word << 8 & 16711680 | word >>> 8 & 65280 | word >>> 24 & 255;
+}
+function byteSwap32(arr) {
+  for (let i = 0; i < arr.length; i++) {
+    arr[i] = byteSwap(arr[i]);
+  }
+  return arr;
+}
+var swap32IfBE = isLE ? (u) => u : byteSwap32;
+function createHasher(hashCons, info = {}) {
+  const hashC = (msg, opts) => hashCons(opts).update(msg).digest();
+  const tmp = hashCons(void 0);
+  hashC.outputLen = tmp.outputLen;
+  hashC.blockLen = tmp.blockLen;
+  hashC.create = (opts) => hashCons(opts);
+  Object.assign(hashC, info);
+  return Object.freeze(hashC);
+}
+var oidNist = (suffix) => ({
+  oid: Uint8Array.from([
+    6,
+    9,
+    96,
+    134,
+    72,
+    1,
+    101,
+    3,
+    4,
+    2,
+    suffix
+  ])
+});
+
+// node_modules/mlkem/esm/src/sha3/sha3.js
+var _0n = BigInt(0);
+var _1n = BigInt(1);
+var _2n = BigInt(2);
+var _7n = BigInt(7);
+var _256n = BigInt(256);
+var _0x71n = BigInt(113);
+var SHA3_PI = [];
+var SHA3_ROTL = [];
+var _SHA3_IOTA = [];
+for (let round = 0, R = _1n, x = 1, y = 0; round < 24; round++) {
+  [x, y] = [y, (2 * x + 3 * y) % 5];
+  SHA3_PI.push(2 * (5 * y + x));
+  SHA3_ROTL.push((round + 1) * (round + 2) / 2 % 64);
+  let t = _0n;
+  for (let j = 0; j < 7; j++) {
+    R = (R << _1n ^ (R >> _7n) * _0x71n) % _256n;
+    if (R & _2n)
+      t ^= _1n << (_1n << BigInt(j)) - _1n;
+  }
+  _SHA3_IOTA.push(t);
+}
+var IOTAS = split(_SHA3_IOTA, true);
+var SHA3_IOTA_H = IOTAS[0];
+var SHA3_IOTA_L = IOTAS[1];
+var rotlH = (h2, l, s) => s > 32 ? rotlBH(h2, l, s) : rotlSH(h2, l, s);
+var rotlL = (h2, l, s) => s > 32 ? rotlBL(h2, l, s) : rotlSL(h2, l, s);
+function keccakP(s, rounds = 24) {
+  const B = new Uint32Array(5 * 2);
+  for (let round = 24 - rounds; round < 24; round++) {
+    for (let x = 0; x < 10; x++) {
+      B[x] = s[x] ^ s[x + 10] ^ s[x + 20] ^ s[x + 30] ^ s[x + 40];
+    }
+    for (let x = 0; x < 10; x += 2) {
+      const idx1 = (x + 8) % 10;
+      const idx0 = (x + 2) % 10;
+      const B0 = B[idx0];
+      const B1 = B[idx0 + 1];
+      const Th = rotlH(B0, B1, 1) ^ B[idx1];
+      const Tl = rotlL(B0, B1, 1) ^ B[idx1 + 1];
+      for (let y = 0; y < 50; y += 10) {
+        s[x + y] ^= Th;
+        s[x + y + 1] ^= Tl;
+      }
+    }
+    let curH = s[2];
+    let curL = s[3];
+    for (let t = 0; t < 24; t++) {
+      const shift = SHA3_ROTL[t];
+      const Th = rotlH(curH, curL, shift);
+      const Tl = rotlL(curH, curL, shift);
+      const PI = SHA3_PI[t];
+      curH = s[PI];
+      curL = s[PI + 1];
+      s[PI] = Th;
+      s[PI + 1] = Tl;
+    }
+    for (let y = 0; y < 50; y += 10) {
+      for (let x = 0; x < 10; x++)
+        B[x] = s[y + x];
+      for (let x = 0; x < 10; x++) {
+        s[y + x] ^= ~B[(x + 2) % 10] & B[(x + 4) % 10];
+      }
+    }
+    s[0] ^= SHA3_IOTA_H[round];
+    s[1] ^= SHA3_IOTA_L[round];
+  }
+  clean(B);
+}
+var Keccak = class _Keccak {
+  // NOTE: we accept arguments in bytes instead of bits here.
+  constructor(blockLen, suffix, outputLen, enableXOF = false, rounds = 24) {
+    Object.defineProperty(this, "state", {
+      enumerable: true,
+      configurable: true,
+      writable: true,
+      value: void 0
+    });
+    Object.defineProperty(this, "pos", {
+      enumerable: true,
+      configurable: true,
+      writable: true,
+      value: 0
+    });
+    Object.defineProperty(this, "posOut", {
+      enumerable: true,
+      configurable: true,
+      writable: true,
+      value: 0
+    });
+    Object.defineProperty(this, "finished", {
+      enumerable: true,
+      configurable: true,
+      writable: true,
+      value: false
+    });
+    Object.defineProperty(this, "state32", {
+      enumerable: true,
+      configurable: true,
+      writable: true,
+      value: void 0
+    });
+    Object.defineProperty(this, "destroyed", {
+      enumerable: true,
+      configurable: true,
+      writable: true,
+      value: false
+    });
+    Object.defineProperty(this, "blockLen", {
+      enumerable: true,
+      configurable: true,
+      writable: true,
+      value: void 0
+    });
+    Object.defineProperty(this, "suffix", {
+      enumerable: true,
+      configurable: true,
+      writable: true,
+      value: void 0
+    });
+    Object.defineProperty(this, "outputLen", {
+      enumerable: true,
+      configurable: true,
+      writable: true,
+      value: void 0
+    });
+    Object.defineProperty(this, "enableXOF", {
+      enumerable: true,
+      configurable: true,
+      writable: true,
+      value: false
+    });
+    Object.defineProperty(this, "rounds", {
+      enumerable: true,
+      configurable: true,
+      writable: true,
+      value: void 0
+    });
+    this.blockLen = blockLen;
+    this.suffix = suffix;
+    this.outputLen = outputLen;
+    this.enableXOF = enableXOF;
+    this.rounds = rounds;
+    anumber(outputLen, "outputLen");
+    if (!(0 < blockLen && blockLen < 200)) {
+      throw new Error("only keccak-f1600 function is supported");
+    }
+    this.state = new Uint8Array(200);
+    this.state32 = u32(this.state);
+  }
+  clone() {
+    return this._cloneInto();
+  }
+  keccak() {
+    swap32IfBE(this.state32);
+    keccakP(this.state32, this.rounds);
+    swap32IfBE(this.state32);
+    this.posOut = 0;
+    this.pos = 0;
+  }
+  update(data) {
+    aexists(this);
+    abytes(data);
+    const { blockLen, state } = this;
+    const len = data.length;
+    for (let pos = 0; pos < len; ) {
+      const take = Math.min(blockLen - this.pos, len - pos);
+      for (let i = 0; i < take; i++)
+        state[this.pos++] ^= data[pos++];
+      if (this.pos === blockLen)
+        this.keccak();
+    }
+    return this;
+  }
+  finish() {
+    if (this.finished)
+      return;
+    this.finished = true;
+    const { state, suffix, pos, blockLen } = this;
+    state[pos] ^= suffix;
+    if ((suffix & 128) !== 0 && pos === blockLen - 1)
+      this.keccak();
+    state[blockLen - 1] ^= 128;
+    this.keccak();
+  }
+  writeInto(out) {
+    aexists(this, false);
+    abytes(out);
+    this.finish();
+    const bufferOut = this.state;
+    const { blockLen } = this;
+    for (let pos = 0, len = out.length; pos < len; ) {
+      if (this.posOut >= blockLen)
+        this.keccak();
+      const take = Math.min(blockLen - this.posOut, len - pos);
+      out.set(bufferOut.subarray(this.posOut, this.posOut + take), pos);
+      this.posOut += take;
+      pos += take;
+    }
+    return out;
+  }
+  xofInto(out) {
+    if (!this.enableXOF) {
+      throw new Error("XOF is not possible for this instance");
+    }
+    return this.writeInto(out);
+  }
+  xof(bytes) {
+    anumber(bytes);
+    return this.xofInto(new Uint8Array(bytes));
+  }
+  digestInto(out) {
+    aoutput(out, this);
+    if (this.finished)
+      throw new Error("digest() was already called");
+    this.writeInto(out);
+    this.destroy();
+    return out;
+  }
+  digest() {
+    return this.digestInto(new Uint8Array(this.outputLen));
+  }
+  destroy() {
+    this.destroyed = true;
+    clean(this.state);
+  }
+  _cloneInto(to) {
+    const { blockLen, suffix, outputLen, rounds, enableXOF } = this;
+    to || (to = new _Keccak(blockLen, suffix, outputLen, enableXOF, rounds));
+    to.state32.set(this.state32);
+    to.pos = this.pos;
+    to.posOut = this.posOut;
+    to.finished = this.finished;
+    to.rounds = rounds;
+    to.suffix = suffix;
+    to.outputLen = outputLen;
+    to.enableXOF = enableXOF;
+    to.destroyed = this.destroyed;
+    return to;
+  }
+};
+var genKeccak = (suffix, blockLen, outputLen, info = {}) => createHasher(() => new Keccak(blockLen, suffix, outputLen), info);
+var sha3_256 = /* @__PURE__ */ genKeccak(
+  6,
+  136,
+  32,
+  /* @__PURE__ */ oidNist(8)
+);
+var sha3_512 = /* @__PURE__ */ genKeccak(
+  6,
+  72,
+  64,
+  /* @__PURE__ */ oidNist(10)
+);
+var genShake = (suffix, blockLen, outputLen, info = {}) => createHasher((opts = {}) => new Keccak(blockLen, suffix, opts.dkLen === void 0 ? outputLen : opts.dkLen, true), info);
+var shake128 = /* @__PURE__ */ genShake(31, 168, 16, /* @__PURE__ */ oidNist(11));
+var shake256 = /* @__PURE__ */ genShake(31, 136, 32, /* @__PURE__ */ oidNist(12));
+
+// node_modules/mlkem/esm/_dnt.shims.js
+var dntGlobals = {};
+var dntGlobalThis = createMergeProxy(globalThis, dntGlobals);
+function createMergeProxy(baseObj, extObj) {
+  return new Proxy(baseObj, {
+    get(_target, prop, _receiver) {
+      if (prop in extObj) {
+        return extObj[prop];
+      } else {
+        return baseObj[prop];
+      }
+    },
+    set(_target, prop, value) {
+      if (prop in extObj) {
+        delete extObj[prop];
+      }
+      baseObj[prop] = value;
+      return true;
+    },
+    deleteProperty(_target, prop) {
+      let success = false;
+      if (prop in extObj) {
+        delete extObj[prop];
+        success = true;
+      }
+      if (prop in baseObj) {
+        delete baseObj[prop];
+        success = true;
+      }
+      return success;
+    },
+    ownKeys(_target) {
+      const baseKeys = Reflect.ownKeys(baseObj);
+      const extKeys = Reflect.ownKeys(extObj);
+      const extKeysSet = new Set(extKeys);
+      return [...baseKeys.filter((k) => !extKeysSet.has(k)), ...extKeys];
+    },
+    defineProperty(_target, prop, desc) {
+      if (prop in extObj) {
+        delete extObj[prop];
+      }
+      Reflect.defineProperty(baseObj, prop, desc);
+      return true;
+    },
+    getOwnPropertyDescriptor(_target, prop) {
+      if (prop in extObj) {
+        return Reflect.getOwnPropertyDescriptor(extObj, prop);
+      } else {
+        return Reflect.getOwnPropertyDescriptor(baseObj, prop);
+      }
+    },
+    has(_target, prop) {
+      return prop in extObj || prop in baseObj;
+    }
+  });
+}
+
+// node_modules/mlkem/esm/src/utils.js
+function byte(n) {
+  return n % 256;
+}
+function int16(n) {
+  const end = -32768;
+  const start = 32767;
+  if (n >= end && n <= start) {
+    return n;
+  }
+  if (n < end) {
+    n = n + 32769;
+    n = n % 65536;
+    return start + n;
+  }
+  n = n - 32768;
+  n = n % 65536;
+  return end + n;
+}
+function uint16(n) {
+  return n % 65536;
+}
+function int32(n) {
+  const end = -2147483648;
+  const start = 2147483647;
+  if (n >= end && n <= start) {
+    return n;
+  }
+  if (n < end) {
+    n = n + 2147483649;
+    n = n % 4294967296;
+    return start + n;
+  }
+  n = n - 2147483648;
+  n = n % 4294967296;
+  return end + n;
+}
+function uint32(n) {
+  return n % 4294967296;
+}
+function constantTimeCompare(x, y) {
+  if (x.length != y.length) {
+    return 0;
+  }
+  const v = new Uint8Array([0]);
+  for (let i = 0; i < x.length; i++) {
+    v[0] |= x[i] ^ y[i];
+  }
+  const z = new Uint8Array([0]);
+  z[0] = ~(v[0] ^ z[0]);
+  z[0] &= z[0] >> 4;
+  z[0] &= z[0] >> 2;
+  z[0] &= z[0] >> 1;
+  return z[0];
+}
+function equalUint8Array(x, y) {
+  if (x.length != y.length) {
+    return false;
+  }
+  for (let i = 0; i < x.length; i++) {
+    if (x[i] !== y[i]) {
+      return false;
+    }
+  }
+  return true;
+}
+async function loadCrypto() {
+  if (typeof dntGlobalThis !== "undefined" && globalThis.crypto !== void 0) {
+    return globalThis.crypto;
+  }
+  try {
+    const { webcrypto } = await import("crypto");
+    return webcrypto;
+  } catch (_e) {
+    throw new Error("failed to load Crypto");
+  }
+}
+function prf(len, seed, nonce) {
+  return shake256.create({ dkLen: len }).update(seed).update(new Uint8Array([nonce])).digest();
+}
+function byteopsLoad32(x) {
+  let r = uint32(x[0]);
+  r |= uint32(x[1]) << 8;
+  r |= uint32(x[2]) << 16;
+  r |= uint32(x[3]) << 24;
+  return uint32(r);
+}
+
+// node_modules/mlkem/esm/src/mlKemBase.js
+var MlKemBase = class {
+  /**
+   * Creates a new instance of the MlKemBase class.
+   */
+  constructor() {
+    Object.defineProperty(this, "_api", {
+      enumerable: true,
+      configurable: true,
+      writable: true,
+      value: void 0
+    });
+    Object.defineProperty(this, "_k", {
+      enumerable: true,
+      configurable: true,
+      writable: true,
+      value: 0
+    });
+    Object.defineProperty(this, "_du", {
+      enumerable: true,
+      configurable: true,
+      writable: true,
+      value: 0
+    });
+    Object.defineProperty(this, "_dv", {
+      enumerable: true,
+      configurable: true,
+      writable: true,
+      value: 0
+    });
+    Object.defineProperty(this, "_eta1", {
+      enumerable: true,
+      configurable: true,
+      writable: true,
+      value: 0
+    });
+    Object.defineProperty(this, "_eta2", {
+      enumerable: true,
+      configurable: true,
+      writable: true,
+      value: 0
+    });
+    Object.defineProperty(this, "_skSize", {
+      enumerable: true,
+      configurable: true,
+      writable: true,
+      value: 0
+    });
+    Object.defineProperty(this, "_pkSize", {
+      enumerable: true,
+      configurable: true,
+      writable: true,
+      value: 0
+    });
+    Object.defineProperty(this, "_compressedUSize", {
+      enumerable: true,
+      configurable: true,
+      writable: true,
+      value: 0
+    });
+    Object.defineProperty(this, "_compressedVSize", {
+      enumerable: true,
+      configurable: true,
+      writable: true,
+      value: 0
+    });
+  }
+  /**
+   * Generates a keypair [publicKey, privateKey].
+   *
+   * If an error occurred, throws {@link MlKemError}.
+   *
+   * @returns A kaypair [publicKey, privateKey].
+   * @throws {@link MlKemError}
+   *
+   * @example Generates a {@link MlKem768} keypair.
+   *
+   * ```ts
+   * // Using jsr:
+   * import { MlKem768 } from "@dajiaji/mlkem";
+   * // Using npm:
+   * // import { MlKem768 } from "mlkem"; // or "crystals-kyber-js"
+   *
+   * const kyber = new MlKem768();
+   * const [pk, sk] = await kyber.generateKeyPair();
+   * ```
+   */
+  async generateKeyPair() {
+    await this._setup();
+    try {
+      const rnd = new Uint8Array(64);
+      this._api.getRandomValues(rnd);
+      return this._deriveKeyPair(rnd);
+    } catch (e) {
+      throw new MlKemError(e);
+    }
+  }
+  /**
+   * Derives a keypair [publicKey, privateKey] deterministically from a 64-octet seed.
+   *
+   * If an error occurred, throws {@link MlKemError}.
+   *
+   * @param seed A 64-octet seed for the deterministic key generation.
+   * @returns A kaypair [publicKey, privateKey].
+   * @throws {@link MlKemError}
+   *
+   * @example Derives a {@link MlKem768} keypair deterministically.
+   *
+   * ```ts
+   * // Using jsr:
+   * import { MlKem768 } from "@dajiaji/mlkem";
+   * // Using npm:
+   * // import { MlKem768 } from "mlkem"; // or "crystals-kyber-js"
+   *
+   * const kyber = new MlKem768();
+   * const seed = new Uint8Array(64);
+   * globalThis.crypto.getRandomValues(seed);
+   * const [pk, sk] = await kyber.deriveKeyPair(seed);
+   * ```
+   */
+  async deriveKeyPair(seed) {
+    await this._setup();
+    try {
+      if (seed.byteLength !== 64) {
+        throw new Error("seed must be 64 bytes in length");
+      }
+      return this._deriveKeyPair(seed);
+    } catch (e) {
+      throw new MlKemError(e);
+    }
+  }
+  /**
+   * Generates a shared secret from the encapsulated ciphertext and the private key.
+   *
+   * If an error occurred, throws {@link MlKemError}.
+   *
+   * @param pk A public key.
+   * @param seed An optional 32-octet seed for the deterministic shared secret generation.
+   * @returns A ciphertext (encapsulated public key) and a shared secret.
+   * @throws {@link MlKemError}
+   *
+   * @example The {@link MlKem768} encapsulation.
+   *
+   * ```ts
+   * // Using jsr:
+   * import { MlKem768 } from "@dajiaji/mlkem";
+   * // Using npm:
+   * // import { MlKem768 } from "mlkem"; // or "crystals-kyber-js"
+   *
+   * const kyber = new MlKem768();
+   * const [pk, sk] = await kyber.generateKeyPair();
+   * const [ct, ss] = await kyber.encap(pk);
+   * ```
+   */
+  async encap(pk, seed) {
+    await this._setup();
+    try {
+      if (pk.length !== 384 * this._k + 32) {
+        throw new Error("invalid encapsulation key");
+      }
+      const m = this._getSeed(seed);
+      const [k, r] = g(m, h(pk));
+      const ct = this._encap(pk, m, r);
+      return [ct, k];
+    } catch (e) {
+      throw new MlKemError(e);
+    }
+  }
+  /**
+   * Generates a ciphertext for the public key and a shared secret.
+   *
+   * If an error occurred, throws {@link MlKemError}.
+   *
+   * @param ct A ciphertext generated by {@link encap}.
+   * @param sk A private key.
+   * @returns A shared secret.
+   * @throws {@link MlKemError}
+   *
+   * @example The {@link MlKem768} decapsulation.
+   *
+   * ```ts
+   * // Using jsr:
+   * import { MlKem768 } from "@dajiaji/mlkem";
+   * // Using npm:
+   * // import { MlKem768 } from "mlkem"; // or "crystals-kyber-js"
+   *
+   * const kyber = new MlKem768();
+   * const [pk, sk] = await kyber.generateKeyPair();
+   * const [ct, ssS] = await kyber.encap(pk);
+   * const ssR = await kyber.decap(ct, sk);
+   * // ssS === ssR
+   * ```
+   */
+  async decap(ct, sk) {
+    await this._setup();
+    try {
+      if (ct.byteLength !== this._compressedUSize + this._compressedVSize) {
+        throw new Error("Invalid ct size");
+      }
+      if (sk.length !== 768 * this._k + 96) {
+        throw new Error("Invalid decapsulation key");
+      }
+      const sk2 = sk.subarray(0, this._skSize);
+      const pk = sk.subarray(this._skSize, this._skSize + this._pkSize);
+      const hpk = sk.subarray(this._skSize + this._pkSize, this._skSize + this._pkSize + 32);
+      const z = sk.subarray(this._skSize + this._pkSize + 32, this._skSize + this._pkSize + 64);
+      const m2 = this._decap(ct, sk2);
+      const [k2, r2] = g(m2, hpk);
+      const kBar = kdf(z, ct);
+      const ct2 = this._encap(pk, m2, r2);
+      return constantTimeCompare(ct, ct2) === 1 ? k2 : kBar;
+    } catch (e) {
+      throw new MlKemError(e);
+    }
+  }
+  /**
+   * Sets up the MlKemBase instance by loading the necessary crypto library.
+   * If the crypto library is already loaded, this method does nothing.
+   * @returns {Promise<void>} A promise that resolves when the setup is complete.
+   */
+  async _setup() {
+    if (this._api !== void 0) {
+      return;
+    }
+    this._api = await loadCrypto();
+  }
+  /**
+   * Returns a Uint8Array seed for cryptographic operations.
+   * If no seed is provided, a random seed of length 32 bytes is generated.
+   * If a seed is provided, it must be exactly 32 bytes in length.
+   *
+   * @param seed - Optional seed for cryptographic operations.
+   * @returns A Uint8Array seed.
+   * @throws Error if the provided seed is not 32 bytes in length.
+   */
+  _getSeed(seed) {
+    if (seed == void 0) {
+      const s = new Uint8Array(32);
+      this._api.getRandomValues(s);
+      return s;
+    }
+    if (seed.byteLength !== 32) {
+      throw new Error("seed must be 32 bytes in length");
+    }
+    return seed;
+  }
+  /**
+   * Derives a key pair from a given seed.
+   *
+   * @param seed - The seed used for key derivation.
+   * @returns An array containing the public key and secret key.
+   */
+  _deriveKeyPair(seed) {
+    const cpaSeed = seed.subarray(0, 32);
+    const z = seed.subarray(32, 64);
+    const [pk, skBody] = this._deriveCpaKeyPair(cpaSeed);
+    const pkh = h(pk);
+    const sk = new Uint8Array(this._skSize + this._pkSize + 64);
+    sk.set(skBody, 0);
+    sk.set(pk, this._skSize);
+    sk.set(pkh, this._skSize + this._pkSize);
+    sk.set(z, this._skSize + this._pkSize + 32);
+    return [pk, sk];
+  }
+  // indcpaKeyGen generates public and private keys for the CPA-secure
+  // public-key encryption scheme underlying ML-KEM.
+  /**
+   * Derives a CPA key pair using the provided CPA seed.
+   *
+   * @param cpaSeed - The CPA seed used for key derivation.
+   * @returns An array containing the public key and private key.
+   */
+  _deriveCpaKeyPair(cpaSeed) {
+    const [publicSeed, noiseSeed] = g(cpaSeed, new Uint8Array([this._k]));
+    const a = this._sampleMatrix(publicSeed, false);
+    const s = this._sampleNoise1(noiseSeed, 0, this._k);
+    const e = this._sampleNoise1(noiseSeed, this._k, this._k);
+    for (let i = 0; i < this._k; i++) {
+      s[i] = ntt(s[i]);
+      s[i] = reduce(s[i]);
+      e[i] = ntt(e[i]);
+    }
+    const pk = new Array(this._k);
+    for (let i = 0; i < this._k; i++) {
+      pk[i] = polyToMont(multiply(a[i], s));
+      pk[i] = add(pk[i], e[i]);
+      pk[i] = reduce(pk[i]);
+    }
+    const pubKey = new Uint8Array(this._pkSize);
+    for (let i = 0; i < this._k; i++) {
+      pubKey.set(polyToBytes(pk[i]), i * 384);
+    }
+    pubKey.set(publicSeed, this._skSize);
+    const privKey = new Uint8Array(this._skSize);
+    for (let i = 0; i < this._k; i++) {
+      privKey.set(polyToBytes(s[i]), i * 384);
+    }
+    return [pubKey, privKey];
+  }
+  // _encap is the encapsulation function of the CPA-secure
+  // public-key encryption scheme underlying ML-KEM.
+  /**
+   * Encapsulates a message using the ML-KEM encryption scheme.
+   *
+   * @param pk - The public key.
+   * @param msg - The message to be encapsulated.
+   * @param seed - The seed used for generating random values.
+   * @returns The encapsulated message as a Uint8Array.
+   */
+  _encap(pk, msg, seed) {
+    const tHat = new Array(this._k);
+    const pkCheck = new Uint8Array(384 * this._k);
+    for (let i = 0; i < this._k; i++) {
+      tHat[i] = polyFromBytes(pk.subarray(i * 384, (i + 1) * 384));
+      pkCheck.set(polyToBytes(tHat[i]), i * 384);
+    }
+    if (!equalUint8Array(pk.subarray(0, pkCheck.length), pkCheck)) {
+      throw new Error("invalid encapsulation key");
+    }
+    const rho = pk.subarray(this._skSize);
+    const a = this._sampleMatrix(rho, true);
+    const r = this._sampleNoise1(seed, 0, this._k);
+    const e1 = this._sampleNoise2(seed, this._k, this._k);
+    const e2 = this._sampleNoise2(seed, this._k * 2, 1)[0];
+    for (let i = 0; i < this._k; i++) {
+      r[i] = ntt(r[i]);
+      r[i] = reduce(r[i]);
+    }
+    const u = new Array(this._k);
+    for (let i = 0; i < this._k; i++) {
+      u[i] = multiply(a[i], r);
+      u[i] = nttInverse(u[i]);
+      u[i] = add(u[i], e1[i]);
+      u[i] = reduce(u[i]);
+    }
+    const m = polyFromMsg(msg);
+    let v = multiply(tHat, r);
+    v = nttInverse(v);
+    v = add(v, e2);
+    v = add(v, m);
+    v = reduce(v);
+    const ret = new Uint8Array(this._compressedUSize + this._compressedVSize);
+    this._compressU(ret.subarray(0, this._compressedUSize), u);
+    this._compressV(ret.subarray(this._compressedUSize), v);
+    return ret;
+  }
+  // indcpaDecrypt is the decryption function of the CPA-secure
+  // public-key encryption scheme underlying ML-KEM.
+  /**
+   * Decapsulates the ciphertext using the provided secret key.
+   *
+   * @param ct - The ciphertext to be decapsulated.
+   * @param sk - The secret key used for decapsulation.
+   * @returns The decapsulated message as a Uint8Array.
+   */
+  _decap(ct, sk) {
+    const u = this._decompressU(ct.subarray(0, this._compressedUSize));
+    const v = this._decompressV(ct.subarray(this._compressedUSize));
+    const privateKeyPolyvec = this._polyvecFromBytes(sk);
+    for (let i = 0; i < this._k; i++) {
+      u[i] = ntt(u[i]);
+    }
+    let mp = multiply(privateKeyPolyvec, u);
+    mp = nttInverse(mp);
+    mp = subtract(v, mp);
+    mp = reduce(mp);
+    return polyToMsg(mp);
+  }
+  // generateMatrixA deterministically generates a matrix `A` (or the transpose of `A`)
+  // from a seed. Entries of the matrix are polynomials that look uniformly random.
+  // Performs rejection sampling on the output of an extendable-output function (XOF).
+  /**
+   * Generates a sample matrix based on the provided seed and transposition flag.
+   *
+   * @param seed - The seed used for generating the matrix.
+   * @param transposed - A flag indicating whether the matrix should be transposed or not.
+   * @returns The generated sample matrix.
+   */
+  _sampleMatrix(seed, transposed) {
+    const a = new Array(this._k);
+    const transpose = new Uint8Array(2);
+    for (let ctr = 0, i = 0; i < this._k; i++) {
+      a[i] = new Array(this._k);
+      for (let j = 0; j < this._k; j++) {
+        if (transposed) {
+          transpose[0] = i;
+          transpose[1] = j;
+        } else {
+          transpose[0] = j;
+          transpose[1] = i;
+        }
+        const output = xof(seed, transpose);
+        const result = indcpaRejUniform(output.subarray(0, 504), 504, N);
+        a[i][j] = result[0];
+        ctr = result[1];
+        while (ctr < N) {
+          const outputn = output.subarray(504, 672);
+          const result1 = indcpaRejUniform(outputn, 168, N - ctr);
+          const missing = result1[0];
+          const ctrn = result1[1];
+          for (let k = ctr; k < N; k++) {
+            a[i][j][k] = missing[k - ctr];
+          }
+          ctr = ctr + ctrn;
+        }
+      }
+    }
+    return a;
+  }
+  /**
+   * Generates a 2D array of noise samples.
+   *
+   * @param sigma - The noise parameter.
+   * @param offset - The offset value.
+   * @param size - The size of the array.
+   * @returns The generated 2D array of noise samples.
+   */
+  _sampleNoise1(sigma, offset, size) {
+    const r = new Array(size);
+    for (let i = 0; i < size; i++) {
+      r[i] = byteopsCbd(prf(this._eta1 * N / 4, sigma, offset), this._eta1);
+      offset++;
+    }
+    return r;
+  }
+  /**
+   * Generates a 2-dimensional array of noise samples.
+   *
+   * @param sigma - The noise parameter.
+   * @param offset - The offset value.
+   * @param size - The size of the array.
+   * @returns The generated 2-dimensional array of noise samples.
+   */
+  _sampleNoise2(sigma, offset, size) {
+    const r = new Array(size);
+    for (let i = 0; i < size; i++) {
+      r[i] = byteopsCbd(prf(this._eta2 * N / 4, sigma, offset), this._eta2);
+      offset++;
+    }
+    return r;
+  }
+  // polyvecFromBytes deserializes a vector of polynomials.
+  /**
+   * Converts a Uint8Array to a 2D array of numbers representing a polynomial vector.
+   * Each element in the resulting array represents a polynomial.
+   * @param a The Uint8Array to convert.
+   * @returns The 2D array of numbers representing the polynomial vector.
+   */
+  _polyvecFromBytes(a) {
+    const r = new Array(this._k);
+    for (let i = 0; i < this._k; i++) {
+      r[i] = polyFromBytes(a.subarray(i * 384, (i + 1) * 384));
+    }
+    return r;
+  }
+  // compressU lossily compresses and serializes a vector of polynomials.
+  /**
+   * Compresses the given array of coefficients into a Uint8Array.
+   *
+   * @param r - The output Uint8Array.
+   * @param u - The array of coefficients.
+   * @returns The compressed Uint8Array.
+   */
+  _compressU(r, u) {
+    const t = new Array(4);
+    for (let rr = 0, i = 0; i < this._k; i++) {
+      for (let j = 0; j < N / 4; j++) {
+        for (let k = 0; k < 4; k++) {
+          t[k] = ((u[i][4 * j + k] << 10) + Q / 2) / Q & 1023;
+        }
+        r[rr++] = byte(t[0] >> 0);
+        r[rr++] = byte(t[0] >> 8 | t[1] << 2);
+        r[rr++] = byte(t[1] >> 6 | t[2] << 4);
+        r[rr++] = byte(t[2] >> 4 | t[3] << 6);
+        r[rr++] = byte(t[3] >> 2);
+      }
+    }
+    return r;
+  }
+  // compressV lossily compresses and subsequently serializes a polynomial.
+  /**
+   * Compresses the given array of numbers into a Uint8Array.
+   *
+   * @param r - The Uint8Array to store the compressed values.
+   * @param v - The array of numbers to compress.
+   * @returns The compressed Uint8Array.
+   */
+  _compressV(r, v) {
+    const t = new Uint8Array(8);
+    for (let rr = 0, i = 0; i < N / 8; i++) {
+      for (let j = 0; j < 8; j++) {
+        t[j] = byte(((v[8 * i + j] << 4) + Q / 2) / Q) & 15;
+      }
+      r[rr++] = t[0] | t[1] << 4;
+      r[rr++] = t[2] | t[3] << 4;
+      r[rr++] = t[4] | t[5] << 4;
+      r[rr++] = t[6] | t[7] << 4;
+    }
+    return r;
+  }
+  // decompressU de-serializes and decompresses a vector of polynomials and
+  // represents the approximate inverse of compress1. Since compression is lossy,
+  // the results of decompression will may not match the original vector of polynomials.
+  /**
+   * Decompresses a Uint8Array into a two-dimensional array of numbers.
+   *
+   * @param a The Uint8Array to decompress.
+   * @returns The decompressed two-dimensional array.
+   */
+  _decompressU(a) {
+    const r = new Array(this._k);
+    for (let i = 0; i < this._k; i++) {
+      r[i] = new Array(384);
+    }
+    const t = new Array(4);
+    for (let aa = 0, i = 0; i < this._k; i++) {
+      for (let j = 0; j < N / 4; j++) {
+        t[0] = uint16(a[aa + 0]) >> 0 | uint16(a[aa + 1]) << 8;
+        t[1] = uint16(a[aa + 1]) >> 2 | uint16(a[aa + 2]) << 6;
+        t[2] = uint16(a[aa + 2]) >> 4 | uint16(a[aa + 3]) << 4;
+        t[3] = uint16(a[aa + 3]) >> 6 | uint16(a[aa + 4]) << 2;
+        aa = aa + 5;
+        for (let k = 0; k < 4; k++) {
+          r[i][4 * j + k] = int16(uint32(t[k] & 1023) * uint32(Q) + 512 >> 10);
+        }
+      }
+    }
+    return r;
+  }
+  // decompressV de-serializes and subsequently decompresses a polynomial,
+  // representing the approximate inverse of compress2.
+  // Note that compression is lossy, and thus decompression will not match the
+  // original input.
+  /**
+   * Decompresses a Uint8Array into an array of numbers.
+   *
+   * @param a - The Uint8Array to decompress.
+   * @returns An array of numbers.
+   */
+  _decompressV(a) {
+    const r = new Array(384);
+    for (let aa = 0, i = 0; i < N / 2; i++, aa++) {
+      r[2 * i + 0] = int16(uint16(a[aa] & 15) * uint16(Q) + 8 >> 4);
+      r[2 * i + 1] = int16(uint16(a[aa] >> 4) * uint16(Q) + 8 >> 4);
+    }
+    return r;
+  }
+};
+function g(a, b) {
+  const hash = sha3_512.create().update(a);
+  if (b !== void 0) {
+    hash.update(b);
+  }
+  const res = hash.digest();
+  return [res.subarray(0, 32), res.subarray(32, 64)];
+}
+function h(msg) {
+  return sha3_256.create().update(msg).digest();
+}
+function kdf(a, b) {
+  const hash = shake256.create({ dkLen: 32 }).update(a);
+  if (b !== void 0) {
+    hash.update(b);
+  }
+  return hash.digest();
+}
+function xof(seed, transpose) {
+  return shake128.create({ dkLen: 672 }).update(seed).update(transpose).digest();
+}
+function polyToBytes(a) {
+  let t0 = 0;
+  let t1 = 0;
+  const r = new Uint8Array(384);
+  const a2 = subtractQ(a);
+  for (let i = 0; i < N / 2; i++) {
+    t0 = uint16(a2[2 * i]);
+    t1 = uint16(a2[2 * i + 1]);
+    r[3 * i + 0] = byte(t0 >> 0);
+    r[3 * i + 1] = byte(t0 >> 8) | byte(t1 << 4);
+    r[3 * i + 2] = byte(t1 >> 4);
+  }
+  return r;
+}
+function polyFromBytes(a) {
+  const r = new Array(384).fill(0);
+  for (let i = 0; i < N / 2; i++) {
+    r[2 * i] = int16((uint16(a[3 * i + 0]) >> 0 | uint16(a[3 * i + 1]) << 8) & 4095);
+    r[2 * i + 1] = int16((uint16(a[3 * i + 1]) >> 4 | uint16(a[3 * i + 2]) << 4) & 4095);
+  }
+  return r;
+}
+function polyToMsg(a) {
+  const msg = new Uint8Array(32);
+  let t;
+  const a2 = subtractQ(a);
+  for (let i = 0; i < N / 8; i++) {
+    msg[i] = 0;
+    for (let j = 0; j < 8; j++) {
+      t = ((uint16(a2[8 * i + j]) << 1) + uint16(Q / 2)) / uint16(Q) & 1;
+      msg[i] |= byte(t << j);
+    }
+  }
+  return msg;
+}
+function polyFromMsg(msg) {
+  const r = new Array(384).fill(0);
+  let mask;
+  for (let i = 0; i < N / 8; i++) {
+    for (let j = 0; j < 8; j++) {
+      mask = -1 * int16(msg[i] >> j & 1);
+      r[8 * i + j] = mask & int16((Q + 1) / 2);
+    }
+  }
+  return r;
+}
+function indcpaRejUniform(buf, bufl, len) {
+  const r = new Array(384).fill(0);
+  let ctr = 0;
+  let val0, val1;
+  for (let pos = 0; ctr < len && pos + 3 <= bufl; ) {
+    val0 = (uint16(buf[pos] >> 0) | uint16(buf[pos + 1]) << 8) & 4095;
+    val1 = (uint16(buf[pos + 1] >> 4) | uint16(buf[pos + 2]) << 4) & 4095;
+    pos = pos + 3;
+    if (val0 < Q) {
+      r[ctr] = val0;
+      ctr = ctr + 1;
+    }
+    if (ctr < len && val1 < Q) {
+      r[ctr] = val1;
+      ctr = ctr + 1;
+    }
+  }
+  return [r, ctr];
+}
+function byteopsCbd(buf, eta) {
+  let t, d;
+  let a, b;
+  const r = new Array(384).fill(0);
+  for (let i = 0; i < N / 8; i++) {
+    t = byteopsLoad32(buf.subarray(4 * i, buf.length));
+    d = t & 1431655765;
+    d = d + (t >> 1 & 1431655765);
+    for (let j = 0; j < 8; j++) {
+      a = int16(d >> 4 * j + 0 & 3);
+      b = int16(d >> 4 * j + eta & 3);
+      r[8 * i + j] = a - b;
+    }
+  }
+  return r;
+}
+function ntt(r) {
+  for (let j = 0, k = 1, l = 128; l >= 2; l >>= 1) {
+    for (let start = 0; start < 256; start = j + l) {
+      const zeta = NTT_ZETAS[k];
+      k = k + 1;
+      for (j = start; j < start + l; j++) {
+        const t = nttFqMul(zeta, r[j + l]);
+        r[j + l] = r[j] - t;
+        r[j] = r[j] + t;
+      }
+    }
+  }
+  return r;
+}
+function nttFqMul(a, b) {
+  return byteopsMontgomeryReduce(a * b);
+}
+function reduce(r) {
+  for (let i = 0; i < N; i++) {
+    r[i] = barrett(r[i]);
+  }
+  return r;
+}
+function barrett(a) {
+  const v = ((1 << 24) + Q / 2) / Q;
+  let t = v * a >> 24;
+  t = t * Q;
+  return a - t;
+}
+function byteopsMontgomeryReduce(a) {
+  const u = int16(int32(a) * Q_INV);
+  let t = u * Q;
+  t = a - t;
+  t >>= 16;
+  return int16(t);
+}
+function polyToMont(r) {
+  const f = 1353;
+  for (let i = 0; i < N; i++) {
+    r[i] = byteopsMontgomeryReduce(int32(r[i]) * int32(f));
+  }
+  return r;
+}
+function multiply(a, b) {
+  let r = polyBaseMulMontgomery(a[0], b[0]);
+  let t;
+  for (let i = 1; i < a.length; i++) {
+    t = polyBaseMulMontgomery(a[i], b[i]);
+    r = add(r, t);
+  }
+  return reduce(r);
+}
+function polyBaseMulMontgomery(a, b) {
+  let rx, ry;
+  for (let i = 0; i < N / 4; i++) {
+    rx = nttBaseMul(a[4 * i + 0], a[4 * i + 1], b[4 * i + 0], b[4 * i + 1], NTT_ZETAS[64 + i]);
+    ry = nttBaseMul(a[4 * i + 2], a[4 * i + 3], b[4 * i + 2], b[4 * i + 3], -NTT_ZETAS[64 + i]);
+    a[4 * i + 0] = rx[0];
+    a[4 * i + 1] = rx[1];
+    a[4 * i + 2] = ry[0];
+    a[4 * i + 3] = ry[1];
+  }
+  return a;
+}
+function nttBaseMul(a0, a1, b0, b1, zeta) {
+  const r = new Array(2);
+  r[0] = nttFqMul(a1, b1);
+  r[0] = nttFqMul(r[0], zeta);
+  r[0] += nttFqMul(a0, b0);
+  r[1] = nttFqMul(a0, b1);
+  r[1] += nttFqMul(a1, b0);
+  return r;
+}
+function add(a, b) {
+  const c = new Array(384);
+  for (let i = 0; i < N; i++) {
+    c[i] = a[i] + b[i];
+  }
+  return c;
+}
+function subtract(a, b) {
+  for (let i = 0; i < N; i++) {
+    a[i] -= b[i];
+  }
+  return a;
+}
+function nttInverse(r) {
+  let j = 0;
+  for (let k = 0, l = 2; l <= 128; l <<= 1) {
+    for (let start = 0; start < 256; start = j + l) {
+      const zeta = NTT_ZETAS_INV[k];
+      k = k + 1;
+      for (j = start; j < start + l; j++) {
+        const t = r[j];
+        r[j] = barrett(t + r[j + l]);
+        r[j + l] = t - r[j + l];
+        r[j + l] = nttFqMul(zeta, r[j + l]);
+      }
+    }
+  }
+  for (j = 0; j < 256; j++) {
+    r[j] = nttFqMul(r[j], NTT_ZETAS_INV[127]);
+  }
+  return r;
+}
+function subtractQ(r) {
+  for (let i = 0; i < N; i++) {
+    r[i] -= Q;
+    r[i] += r[i] >> 31 & Q;
+  }
+  return r;
+}
+
+// node_modules/mlkem/esm/src/mlKem768.js
+var MlKem768 = class extends MlKemBase {
+  constructor() {
+    super();
+    Object.defineProperty(this, "_k", {
+      enumerable: true,
+      configurable: true,
+      writable: true,
+      value: 3
+    });
+    Object.defineProperty(this, "_du", {
+      enumerable: true,
+      configurable: true,
+      writable: true,
+      value: 10
+    });
+    Object.defineProperty(this, "_dv", {
+      enumerable: true,
+      configurable: true,
+      writable: true,
+      value: 4
+    });
+    Object.defineProperty(this, "_eta1", {
+      enumerable: true,
+      configurable: true,
+      writable: true,
+      value: 2
+    });
+    Object.defineProperty(this, "_eta2", {
+      enumerable: true,
+      configurable: true,
+      writable: true,
+      value: 2
+    });
+    this._skSize = 12 * this._k * N / 8;
+    this._pkSize = this._skSize + 32;
+    this._compressedUSize = this._k * this._du * N / 8;
+    this._compressedVSize = this._dv * N / 8;
+  }
+};
+
+// src/index.ts
 async function sha256(data) {
   if (typeof globalThis.crypto?.subtle !== "undefined") {
     const encoder = new TextEncoder();
@@ -2409,6 +4006,9 @@ var PROTO_MARKER = 86;
 var FLAG_PADDED = 1;
 var FLAG_SEALED = 2;
 var FLAG_RATCHET = 4;
+var FLAG_PQ = 8;
+var FLAG_DH_RATCHET = 16;
+var FLAG_DENIABLE = 32;
 function makeProtoHeader(flags, ratchetStep2) {
   return new Uint8Array([PROTO_MARKER, flags, ratchetStep2 >> 8 & 255, ratchetStep2 & 255]);
 }
@@ -2420,6 +4020,30 @@ function parseProtoHeader(data) {
     content: data.slice(4)
   };
 }
+async function kdfRK(rootKey, dhOutput) {
+  const combined = new Uint8Array(rootKey.length + dhOutput.length);
+  combined.set(rootKey, 0);
+  combined.set(dhOutput, rootKey.length);
+  if (typeof globalThis.crypto?.subtle !== "undefined") {
+    const prk2 = new Uint8Array(await globalThis.crypto.subtle.digest("SHA-256", combined.buffer));
+    const newRootKey2 = new Uint8Array(await globalThis.crypto.subtle.digest("SHA-256", new Uint8Array([...prk2, 1]).buffer));
+    const newChainKey2 = new Uint8Array(await globalThis.crypto.subtle.digest("SHA-256", new Uint8Array([...prk2, 2]).buffer));
+    return { newRootKey: newRootKey2, newChainKey: newChainKey2 };
+  }
+  const { createHash } = await import("crypto");
+  const prk = new Uint8Array(createHash("sha256").update(Buffer.from(combined)).digest());
+  const newRootKey = new Uint8Array(createHash("sha256").update(Buffer.from([...prk, 1])).digest());
+  const newChainKey = new Uint8Array(createHash("sha256").update(Buffer.from([...prk, 2])).digest());
+  return { newRootKey, newChainKey };
+}
+async function hmacSha256(key, data) {
+  if (typeof globalThis.crypto?.subtle !== "undefined") {
+    const cryptoKey = await globalThis.crypto.subtle.importKey("raw", key.buffer, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+    return new Uint8Array(await globalThis.crypto.subtle.sign("HMAC", cryptoKey, data.buffer));
+  }
+  const { createHmac } = await import("crypto");
+  return new Uint8Array(createHmac("sha256", Buffer.from(key)).update(Buffer.from(data)).digest());
+}
 var MAX_SKIP = 200;
 var BASE58_ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
 function toBase58(bytes) {
@@ -2431,14 +4055,16 @@ function toBase58(bytes) {
     num = num / 58n;
     result = BASE58_ALPHABET[Number(remainder)] + result;
   }
-  for (const byte of bytes) {
-    if (byte === 0) result = "1" + result;
+  for (const byte2 of bytes) {
+    if (byte2 === 0) result = "1" + result;
     else break;
   }
   return result || "1";
 }
 var VoidlyAgent = class _VoidlyAgent {
   constructor(identity, config) {
+    this._signedPrekey = null;
+    this._signedPrekeyId = 0;
     this._pinnedDids = /* @__PURE__ */ new Set();
     this._listeners = /* @__PURE__ */ new Set();
     this._conversations = /* @__PURE__ */ new Map();
@@ -2459,6 +4085,13 @@ var VoidlyAgent = class _VoidlyAgent {
     this.sealedSender = config?.sealedSender || false;
     this.requireSignatures = config?.requireSignatures || false;
     this.timeout = config?.timeout ?? 3e4;
+    this.postQuantum = config?.postQuantum !== false;
+    this.deniable = config?.deniable || false;
+    this.doubleRatchet = config?.doubleRatchet !== false;
+    this.jitterMs = config?.jitterMs || 0;
+    this.longPoll = config?.longPoll !== false;
+    this.mlkemPublicKey = identity.mlkemPublicKey || null;
+    this.mlkemSecretKey = identity.mlkemSecretKey || null;
   }
   // ─── Factory Methods ────────────────────────────────────────────────────────
   /**
@@ -2469,15 +4102,33 @@ var VoidlyAgent = class _VoidlyAgent {
     const baseUrl = config?.baseUrl || "https://api.voidly.ai";
     const signingKeyPair = import_tweetnacl.default.sign.keyPair();
     const encryptionKeyPair = import_tweetnacl.default.box.keyPair();
+    const usePQ = config?.postQuantum !== false;
+    let mlkemPk;
+    let mlkemSk;
+    if (usePQ) {
+      const kem = new MlKem768();
+      [mlkemPk, mlkemSk] = await kem.generateKeyPair();
+    }
+    const signedPrekeyPair = import_tweetnacl.default.box.keyPair();
+    const signedPrekeyId = 1;
+    const prekeySignature = import_tweetnacl.default.sign.detached(signedPrekeyPair.publicKey, signingKeyPair.secretKey);
+    const regBody = {
+      name: options.name,
+      capabilities: options.capabilities,
+      signing_public_key: (0, import_tweetnacl_util.encodeBase64)(signingKeyPair.publicKey),
+      encryption_public_key: (0, import_tweetnacl_util.encodeBase64)(encryptionKeyPair.publicKey),
+      // X3DH signed prekey
+      signed_prekey_public: (0, import_tweetnacl_util.encodeBase64)(signedPrekeyPair.publicKey),
+      signed_prekey_signature: (0, import_tweetnacl_util.encodeBase64)(prekeySignature),
+      signed_prekey_id: signedPrekeyId
+    };
+    if (mlkemPk) {
+      regBody.mlkem_public_key = (0, import_tweetnacl_util.encodeBase64)(mlkemPk);
+    }
     const res = await fetch(`${baseUrl}/v1/agent/register`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({
-        name: options.name,
-        capabilities: options.capabilities,
-        signing_public_key: (0, import_tweetnacl_util.encodeBase64)(signingKeyPair.publicKey),
-        encryption_public_key: (0, import_tweetnacl_util.encodeBase64)(encryptionKeyPair.publicKey)
-      })
+      body: JSON.stringify(regBody)
     });
     if (!res.ok) {
       const err = await res.json().catch(() => ({}));
@@ -2485,12 +4136,17 @@ var VoidlyAgent = class _VoidlyAgent {
       throw new Error(`Registration failed: ${errMsg}`);
     }
     const data = await res.json();
-    return new _VoidlyAgent({
+    const agent = new _VoidlyAgent({
       did: data.did,
       apiKey: data.api_key,
       signingKeyPair,
-      encryptionKeyPair
+      encryptionKeyPair,
+      mlkemPublicKey: mlkemPk,
+      mlkemSecretKey: mlkemSk
     }, config);
+    agent._signedPrekey = signedPrekeyPair;
+    agent._signedPrekeyId = signedPrekeyId;
+    return agent;
   }
   /**
    * Restore an agent from saved credentials.
@@ -2520,28 +4176,124 @@ var VoidlyAgent = class _VoidlyAgent {
     if (encryptionSecret.length !== 32) {
       throw new Error(`Invalid credentials: encryption key must be 32 bytes, got ${encryptionSecret.length}`);
     }
-    return new _VoidlyAgent({
+    let mlkemPk;
+    let mlkemSk;
+    if (creds.mlkemPublicKey && creds.mlkemSecretKey) {
+      try {
+        mlkemPk = (0, import_tweetnacl_util.decodeBase64)(creds.mlkemPublicKey);
+        mlkemSk = (0, import_tweetnacl_util.decodeBase64)(creds.mlkemSecretKey);
+        if (mlkemPk.length !== 1184 || mlkemSk.length !== 2400) {
+          mlkemPk = void 0;
+          mlkemSk = void 0;
+        }
+      } catch {
+      }
+    }
+    const agent = new _VoidlyAgent({
       did: creds.did,
       apiKey: creds.apiKey,
       signingKeyPair: import_tweetnacl.default.sign.keyPair.fromSecretKey(signingSecret),
       encryptionKeyPair: {
         publicKey: import_tweetnacl.default.box.keyPair.fromSecretKey(encryptionSecret).publicKey,
         secretKey: encryptionSecret
-      }
+      },
+      mlkemPublicKey: mlkemPk,
+      mlkemSecretKey: mlkemSk
     }, config);
+    if (creds.ratchetStates) {
+      for (const [pairId, rs] of Object.entries(creds.ratchetStates)) {
+        try {
+          const sendChainKey = (0, import_tweetnacl_util.decodeBase64)(rs.sendChainKey);
+          const recvChainKey = (0, import_tweetnacl_util.decodeBase64)(rs.recvChainKey);
+          if (sendChainKey.length !== 32 || recvChainKey.length !== 32) continue;
+          const state = {
+            sendChainKey,
+            sendStep: rs.sendStep || 0,
+            recvChainKey,
+            recvStep: rs.recvStep || 0,
+            skippedKeys: /* @__PURE__ */ new Map()
+          };
+          if (rs.rootKey) {
+            try {
+              state.rootKey = (0, import_tweetnacl_util.decodeBase64)(rs.rootKey);
+              if (state.rootKey.length !== 32) state.rootKey = void 0;
+            } catch {
+            }
+          }
+          if (rs.dhSendSecretKey && rs.dhSendPublicKey) {
+            try {
+              const sk = (0, import_tweetnacl_util.decodeBase64)(rs.dhSendSecretKey);
+              const pk = (0, import_tweetnacl_util.decodeBase64)(rs.dhSendPublicKey);
+              if (sk.length === 32 && pk.length === 32) {
+                state.dhSendKeyPair = { publicKey: pk, secretKey: sk };
+              }
+            } catch {
+            }
+          }
+          if (rs.dhRecvPubKey) {
+            try {
+              const pk = (0, import_tweetnacl_util.decodeBase64)(rs.dhRecvPubKey);
+              if (pk.length === 32) state.dhRecvPubKey = pk;
+            } catch {
+            }
+          }
+          if (rs.prevSendStep !== void 0) state.prevSendStep = rs.prevSendStep;
+          state.dhSkippedKeys = /* @__PURE__ */ new Map();
+          agent._ratchetStates.set(pairId, state);
+        } catch {
+        }
+      }
+    }
+    if (creds.signedPrekeySecret && creds.signedPrekeyPublic) {
+      try {
+        const sk = (0, import_tweetnacl_util.decodeBase64)(creds.signedPrekeySecret);
+        const pk = (0, import_tweetnacl_util.decodeBase64)(creds.signedPrekeyPublic);
+        if (sk.length === 32 && pk.length === 32) {
+          agent._signedPrekey = { publicKey: pk, secretKey: sk };
+          agent._signedPrekeyId = creds.signedPrekeyId || 0;
+        }
+      } catch {
+      }
+    }
+    return agent;
   }
   /**
    * Export credentials for persistence.
    * Store these securely — they contain private keys.
    */
   exportCredentials() {
+    const ratchetStates = {};
+    for (const [pairId, state] of this._ratchetStates) {
+      const rs = {
+        sendChainKey: (0, import_tweetnacl_util.encodeBase64)(state.sendChainKey),
+        sendStep: state.sendStep,
+        recvChainKey: (0, import_tweetnacl_util.encodeBase64)(state.recvChainKey),
+        recvStep: state.recvStep
+      };
+      if (state.rootKey) rs.rootKey = (0, import_tweetnacl_util.encodeBase64)(state.rootKey);
+      if (state.dhSendKeyPair) {
+        rs.dhSendSecretKey = (0, import_tweetnacl_util.encodeBase64)(state.dhSendKeyPair.secretKey);
+        rs.dhSendPublicKey = (0, import_tweetnacl_util.encodeBase64)(state.dhSendKeyPair.publicKey);
+      }
+      if (state.dhRecvPubKey) rs.dhRecvPubKey = (0, import_tweetnacl_util.encodeBase64)(state.dhRecvPubKey);
+      if (state.prevSendStep !== void 0) rs.prevSendStep = state.prevSendStep;
+      ratchetStates[pairId] = rs;
+    }
     return {
       did: this.did,
       apiKey: this.apiKey,
       signingSecretKey: (0, import_tweetnacl_util.encodeBase64)(this.signingKeyPair.secretKey),
       encryptionSecretKey: (0, import_tweetnacl_util.encodeBase64)(this.encryptionKeyPair.secretKey),
       signingPublicKey: (0, import_tweetnacl_util.encodeBase64)(this.signingKeyPair.publicKey),
-      encryptionPublicKey: (0, import_tweetnacl_util.encodeBase64)(this.encryptionKeyPair.publicKey)
+      encryptionPublicKey: (0, import_tweetnacl_util.encodeBase64)(this.encryptionKeyPair.publicKey),
+      ...Object.keys(ratchetStates).length > 0 ? { ratchetStates } : {},
+      ...this.mlkemPublicKey ? { mlkemPublicKey: (0, import_tweetnacl_util.encodeBase64)(this.mlkemPublicKey) } : {},
+      ...this.mlkemSecretKey ? { mlkemSecretKey: (0, import_tweetnacl_util.encodeBase64)(this.mlkemSecretKey) } : {},
+      ...this._signedPrekey ? {
+        signedPrekeySecret: (0, import_tweetnacl_util.encodeBase64)(this._signedPrekey.secretKey),
+        signedPrekeyPublic: (0, import_tweetnacl_util.encodeBase64)(this._signedPrekey.publicKey),
+        signedPrekeyId: this._signedPrekeyId
+      } : {}
     };
   }
   /**
@@ -2601,17 +4353,58 @@ var VoidlyAgent = class _VoidlyAgent {
     }
     const pairId = `${this.did}:${recipientDid}`;
     let state = this._ratchetStates.get(pairId);
+    let pqCiphertext = null;
+    let dhRatchetPub = null;
     if (!state) {
-      const sharedSecret = import_tweetnacl.default.box.before(recipientPubKey, this.encryptionKeyPair.secretKey);
-      state = {
-        sendChainKey: sharedSecret,
-        sendStep: 0,
-        recvChainKey: sharedSecret,
-        // Will be synced on first receive
-        recvStep: 0,
-        skippedKeys: /* @__PURE__ */ new Map()
-      };
+      const x25519Shared = import_tweetnacl.default.box.before(recipientPubKey, this.encryptionKeyPair.secretKey);
+      let initialKey;
+      if (this.postQuantum && profile.mlkem_public_key) {
+        try {
+          const recipientPqPk = (0, import_tweetnacl_util.decodeBase64)(profile.mlkem_public_key);
+          const kem = new MlKem768();
+          const [ct, pqShared] = await kem.encap(recipientPqPk);
+          pqCiphertext = ct;
+          const combined = new Uint8Array(x25519Shared.length + pqShared.length);
+          combined.set(x25519Shared, 0);
+          combined.set(pqShared, x25519Shared.length);
+          initialKey = new Uint8Array(await crypto.subtle.digest("SHA-256", combined));
+        } catch {
+          initialKey = x25519Shared;
+        }
+      } else {
+        initialKey = x25519Shared;
+      }
+      if (this.doubleRatchet) {
+        const dhSendKeyPair = import_tweetnacl.default.box.keyPair();
+        const dhOutput = import_tweetnacl.default.box.before(recipientPubKey, dhSendKeyPair.secretKey);
+        const { newRootKey, newChainKey } = await kdfRK(initialKey, dhOutput);
+        dhRatchetPub = dhSendKeyPair.publicKey;
+        state = {
+          sendChainKey: newChainKey,
+          sendStep: 0,
+          recvChainKey: initialKey,
+          // Will be updated on first receive
+          recvStep: 0,
+          skippedKeys: /* @__PURE__ */ new Map(),
+          // Double Ratchet state
+          rootKey: newRootKey,
+          dhSendKeyPair,
+          dhRecvPubKey: void 0,
+          prevSendStep: 0,
+          dhSkippedKeys: /* @__PURE__ */ new Map()
+        };
+      } else {
+        state = {
+          sendChainKey: initialKey,
+          sendStep: 0,
+          recvChainKey: initialKey,
+          recvStep: 0,
+          skippedKeys: /* @__PURE__ */ new Map()
+        };
+      }
       this._ratchetStates.set(pairId, state);
+    } else if (state.rootKey && state.dhSendKeyPair) {
+      dhRatchetPub = state.dhSendKeyPair.publicKey;
     }
     const { nextChainKey, messageKey } = await ratchetStep(state.sendChainKey);
     state.sendChainKey = nextChainKey;
@@ -2620,6 +4413,9 @@ var VoidlyAgent = class _VoidlyAgent {
     let flags = FLAG_RATCHET;
     if (usePadding) flags |= FLAG_PADDED;
     if (useSealed) flags |= FLAG_SEALED;
+    if (pqCiphertext) flags |= FLAG_PQ;
+    if (dhRatchetPub) flags |= FLAG_DH_RATCHET;
+    if (this.deniable) flags |= FLAG_DENIABLE;
     const header = makeProtoHeader(flags, currentStep);
     const messageBytes = new Uint8Array(header.length + contentBytes.length);
     messageBytes.set(header, 0);
@@ -2629,15 +4425,33 @@ var VoidlyAgent = class _VoidlyAgent {
     if (!ciphertext) {
       throw new Error("Encryption failed");
     }
-    const envelopeData = JSON.stringify({
+    if (this.jitterMs > 0) {
+      const jitter = Math.random() * this.jitterMs;
+      await new Promise((r) => setTimeout(r, jitter));
+    }
+    const envelopeObj = {
       from: this.did,
       to: recipientDid,
       timestamp: (/* @__PURE__ */ new Date()).toISOString(),
       nonce: (0, import_tweetnacl_util.encodeBase64)(nonce),
       ciphertext_hash: await sha256((0, import_tweetnacl_util.encodeBase64)(ciphertext)),
       ratchet_step: currentStep
-    });
-    const signature = import_tweetnacl.default.sign.detached((0, import_tweetnacl_util.decodeUTF8)(envelopeData), this.signingKeyPair.secretKey);
+    };
+    if (pqCiphertext) {
+      envelopeObj.pq_ciphertext = (0, import_tweetnacl_util.encodeBase64)(pqCiphertext);
+    }
+    if (dhRatchetPub) {
+      envelopeObj.dh_ratchet_key = (0, import_tweetnacl_util.encodeBase64)(dhRatchetPub);
+      envelopeObj.pn = state.prevSendStep || 0;
+    }
+    const envelopeData = JSON.stringify(envelopeObj);
+    let signature;
+    if (this.deniable) {
+      const sharedSecret = import_tweetnacl.default.box.before(recipientPubKey, this.encryptionKeyPair.secretKey);
+      signature = await hmacSha256(sharedSecret, (0, import_tweetnacl_util.decodeUTF8)(envelopeData));
+    } else {
+      signature = import_tweetnacl.default.sign.detached((0, import_tweetnacl_util.decodeUTF8)(envelopeData), this.signingKeyPair.secretKey);
+    }
     const payload = {
       to: recipientDid,
       ciphertext: (0, import_tweetnacl_util.encodeBase64)(ciphertext),
@@ -2700,7 +4514,7 @@ var VoidlyAgent = class _VoidlyAgent {
     if (options.contentType) params.set("content_type", options.contentType);
     if (options.messageType) params.set("message_type", options.messageType);
     if (options.unreadOnly) params.set("unread", "true");
-    const res = await fetch(`${this.baseUrl}/v1/agent/receive/raw?${params}`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/receive/raw?${params}`, {
       headers: { "X-Agent-Key": this.apiKey }
     });
     if (!res.ok) {
@@ -2717,12 +4531,25 @@ var VoidlyAgent = class _VoidlyAgent {
         const nonce = (0, import_tweetnacl_util.decodeBase64)(msg.nonce);
         let rawPlaintext = null;
         let envelopeRatchetStep = 0;
+        let envelopePqCiphertext = null;
+        let envelopeDhRatchetKey = null;
+        let envelopePn = 0;
+        let envelopeDeniable = false;
         if (msg.envelope) {
           try {
             const env = JSON.parse(msg.envelope);
             if (typeof env.ratchet_step === "number") {
               envelopeRatchetStep = env.ratchet_step;
             }
+            if (typeof env.pq_ciphertext === "string") {
+              envelopePqCiphertext = env.pq_ciphertext;
+            }
+            if (typeof env.dh_ratchet_key === "string") {
+              envelopeDhRatchetKey = env.dh_ratchet_key;
+            }
+            if (typeof env.pn === "number") {
+              envelopePn = env.pn;
+            }
           } catch {
           }
         }
@@ -2730,20 +4557,90 @@ var VoidlyAgent = class _VoidlyAgent {
           const pairId = `${msg.from}:${this.did}`;
           let state = this._ratchetStates.get(pairId);
           if (!state) {
-            const sharedSecret = import_tweetnacl.default.box.before(senderEncPub, this.encryptionKeyPair.secretKey);
-            state = {
-              sendChainKey: sharedSecret,
-              // Our sending chain to this peer
-              sendStep: 0,
-              recvChainKey: sharedSecret,
-              // Their sending chain (our receiving)
-              recvStep: 0,
-              skippedKeys: /* @__PURE__ */ new Map()
-            };
+            const x25519Shared = import_tweetnacl.default.box.before(senderEncPub, this.encryptionKeyPair.secretKey);
+            let initialKey;
+            if (envelopePqCiphertext && this.mlkemSecretKey) {
+              try {
+                const pqCt = (0, import_tweetnacl_util.decodeBase64)(envelopePqCiphertext);
+                const kem = new MlKem768();
+                const pqShared = await kem.decap(pqCt, this.mlkemSecretKey);
+                const combined = new Uint8Array(x25519Shared.length + pqShared.length);
+                combined.set(x25519Shared, 0);
+                combined.set(pqShared, x25519Shared.length);
+                initialKey = new Uint8Array(await crypto.subtle.digest("SHA-256", combined));
+              } catch {
+                initialKey = x25519Shared;
+              }
+            } else {
+              initialKey = x25519Shared;
+            }
+            if (envelopeDhRatchetKey && this.doubleRatchet) {
+              const senderDhPub = (0, import_tweetnacl_util.decodeBase64)(envelopeDhRatchetKey);
+              const dhOutput = import_tweetnacl.default.box.before(senderDhPub, this.encryptionKeyPair.secretKey);
+              const { newRootKey, newChainKey } = await kdfRK(initialKey, dhOutput);
+              state = {
+                sendChainKey: initialKey,
+                sendStep: 0,
+                recvChainKey: newChainKey,
+                recvStep: 0,
+                skippedKeys: /* @__PURE__ */ new Map(),
+                rootKey: newRootKey,
+                dhSendKeyPair: void 0,
+                dhRecvPubKey: senderDhPub,
+                prevSendStep: 0,
+                dhSkippedKeys: /* @__PURE__ */ new Map()
+              };
+            } else {
+              state = {
+                sendChainKey: initialKey,
+                sendStep: 0,
+                recvChainKey: initialKey,
+                recvStep: 0,
+                skippedKeys: /* @__PURE__ */ new Map()
+              };
+            }
             this._ratchetStates.set(pairId, state);
+          } else if (envelopeDhRatchetKey && state.rootKey) {
+            const senderDhPub = (0, import_tweetnacl_util.decodeBase64)(envelopeDhRatchetKey);
+            const currentDhRecv = state.dhRecvPubKey;
+            if (!currentDhRecv || (0, import_tweetnacl_util.encodeBase64)(senderDhPub) !== (0, import_tweetnacl_util.encodeBase64)(currentDhRecv)) {
+              if (envelopePn > state.recvStep) {
+                let ck = state.recvChainKey;
+                for (let i = state.recvStep + 1; i <= envelopePn && i - state.recvStep <= MAX_SKIP; i++) {
+                  const { nextChainKey, messageKey: skippedMk } = await ratchetStep(ck);
+                  const skipKey = `${currentDhRecv ? (0, import_tweetnacl_util.encodeBase64)(currentDhRecv) : "init"}:${i}`;
+                  if (!state.dhSkippedKeys) state.dhSkippedKeys = /* @__PURE__ */ new Map();
+                  state.dhSkippedKeys.set(skipKey, skippedMk);
+                  ck = nextChainKey;
+                  if (state.dhSkippedKeys.size > MAX_SKIP) {
+                    const oldest = state.dhSkippedKeys.keys().next().value;
+                    if (oldest !== void 0) state.dhSkippedKeys.delete(oldest);
+                  }
+                }
+              }
+              state.dhRecvPubKey = senderDhPub;
+              const myKey = state.dhSendKeyPair || this.encryptionKeyPair;
+              const dhOutput1 = import_tweetnacl.default.box.before(senderDhPub, myKey.secretKey);
+              const kdf1 = await kdfRK(state.rootKey, dhOutput1);
+              state.rootKey = kdf1.newRootKey;
+              state.recvChainKey = kdf1.newChainKey;
+              state.recvStep = 0;
+              state.prevSendStep = state.sendStep;
+              state.dhSendKeyPair = import_tweetnacl.default.box.keyPair();
+              state.sendStep = 0;
+              const dhOutput2 = import_tweetnacl.default.box.before(senderDhPub, state.dhSendKeyPair.secretKey);
+              const kdf2 = await kdfRK(state.rootKey, dhOutput2);
+              state.rootKey = kdf2.newRootKey;
+              state.sendChainKey = kdf2.newChainKey;
+            }
           }
           const targetStep = envelopeRatchetStep;
-          if (state.skippedKeys.has(targetStep)) {
+          const dhSkipKey = envelopeDhRatchetKey ? `${envelopeDhRatchetKey}:${targetStep}` : `init:${targetStep}`;
+          if (state.dhSkippedKeys?.has(dhSkipKey)) {
+            const mk = state.dhSkippedKeys.get(dhSkipKey);
+            rawPlaintext = import_tweetnacl.default.secretbox.open(ciphertext, nonce, mk);
+            state.dhSkippedKeys.delete(dhSkipKey);
+          } else if (state.skippedKeys.has(targetStep)) {
             const mk = state.skippedKeys.get(targetStep);
             rawPlaintext = import_tweetnacl.default.secretbox.open(ciphertext, nonce, mk);
             state.skippedKeys.delete(targetStep);
@@ -2806,7 +4703,6 @@ var VoidlyAgent = class _VoidlyAgent {
         }
         let signatureValid = false;
         try {
-          const senderSignPub = (0, import_tweetnacl_util.decodeBase64)(msg.sender_signing_key);
           const signatureBytes = (0, import_tweetnacl_util.decodeBase64)(msg.signature);
           const envelopeStr = msg.envelope || JSON.stringify({
             from: senderDid,
@@ -2815,11 +4711,22 @@ var VoidlyAgent = class _VoidlyAgent {
             nonce: msg.nonce,
             ciphertext_hash: await sha256(msg.ciphertext)
           });
-          signatureValid = import_tweetnacl.default.sign.detached.verify(
-            (0, import_tweetnacl_util.decodeUTF8)(envelopeStr),
-            signatureBytes,
-            senderSignPub
-          );
+          if (signatureBytes.length === 32) {
+            const sharedSecret = import_tweetnacl.default.box.before(senderEncPub, this.encryptionKeyPair.secretKey);
+            const expectedHmac = await hmacSha256(sharedSecret, (0, import_tweetnacl_util.decodeUTF8)(envelopeStr));
+            if (expectedHmac.length === signatureBytes.length) {
+              let diff = 0;
+              for (let i = 0; i < expectedHmac.length; i++) diff |= expectedHmac[i] ^ signatureBytes[i];
+              signatureValid = diff === 0;
+            }
+          } else {
+            const senderSignPub = (0, import_tweetnacl_util.decodeBase64)(msg.sender_signing_key);
+            signatureValid = import_tweetnacl.default.sign.detached.verify(
+              (0, import_tweetnacl_util.decodeUTF8)(envelopeStr),
+              signatureBytes,
+              senderSignPub
+            );
+          }
         } catch {
           signatureValid = false;
         }
@@ -2856,7 +4763,7 @@ var VoidlyAgent = class _VoidlyAgent {
    * Delete a message by ID (must be sender or recipient).
    */
   async deleteMessage(messageId) {
-    const res = await fetch(`${this.baseUrl}/v1/agent/messages/${messageId}`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/messages/${messageId}`, {
       method: "DELETE",
       headers: { "X-Agent-Key": this.apiKey }
     });
@@ -2867,7 +4774,7 @@ var VoidlyAgent = class _VoidlyAgent {
    * Get this agent's own profile.
    */
   async getProfile() {
-    const res = await fetch(`${this.baseUrl}/v1/agent/profile`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/profile`, {
       headers: { "X-Agent-Key": this.apiKey }
     });
     if (!res.ok) {
@@ -2879,7 +4786,7 @@ var VoidlyAgent = class _VoidlyAgent {
    * Update this agent's profile (name, capabilities, metadata).
    */
   async updateProfile(updates) {
-    const res = await fetch(`${this.baseUrl}/v1/agent/profile`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/profile`, {
       method: "PATCH",
       headers: {
         "Content-Type": "application/json",
@@ -2901,7 +4808,7 @@ var VoidlyAgent = class _VoidlyAgent {
     if (cached && Date.now() - cached.cachedAt < 3e5) {
       return cached.profile;
     }
-    const res = await fetch(`${this.baseUrl}/v1/agent/identity/${did}`);
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/identity/${did}`);
     if (!res.ok) return null;
     const profile = await res.json();
     this._identityCache.set(did, { profile, cachedAt: Date.now() });
@@ -2919,7 +4826,7 @@ var VoidlyAgent = class _VoidlyAgent {
     if (options.query) params.set("query", options.query);
     if (options.capability) params.set("capability", options.capability);
     if (options.limit) params.set("limit", String(options.limit));
-    const res = await fetch(`${this.baseUrl}/v1/agent/discover?${params}`);
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/discover?${params}`);
     if (!res.ok) return [];
     const data = await res.json();
     return data.agents;
@@ -2928,7 +4835,7 @@ var VoidlyAgent = class _VoidlyAgent {
    * Get relay network statistics.
    */
   async stats() {
-    const res = await fetch(`${this.baseUrl}/v1/agent/stats`);
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/stats`);
     return await res.json();
   }
   // ─── Webhooks ──────────────────────────────────────────────────────────────
@@ -2937,7 +4844,7 @@ var VoidlyAgent = class _VoidlyAgent {
    * Instead of polling receive(), messages are POSTed to your URL with HMAC signatures.
    */
   async registerWebhook(webhookUrl, options = {}) {
-    const res = await fetch(`${this.baseUrl}/v1/agent/webhooks`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/webhooks`, {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
@@ -2958,7 +4865,7 @@ var VoidlyAgent = class _VoidlyAgent {
    * List registered webhooks.
    */
   async listWebhooks() {
-    const res = await fetch(`${this.baseUrl}/v1/agent/webhooks`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/webhooks`, {
       headers: { "X-Agent-Key": this.apiKey }
     });
     if (!res.ok) return [];
@@ -2969,7 +4876,7 @@ var VoidlyAgent = class _VoidlyAgent {
    * Delete a webhook.
    */
   async deleteWebhook(webhookId) {
-    const res = await fetch(`${this.baseUrl}/v1/agent/webhooks/${webhookId}`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/webhooks/${webhookId}`, {
       method: "DELETE",
       headers: { "X-Agent-Key": this.apiKey }
     });
@@ -3013,22 +4920,35 @@ var VoidlyAgent = class _VoidlyAgent {
   async rotateKeys() {
     const newSigningKeyPair = import_tweetnacl.default.sign.keyPair();
     const newEncryptionKeyPair = import_tweetnacl.default.box.keyPair();
-    const res = await fetch(`${this.baseUrl}/v1/agent/rotate-keys`, {
+    const newSignedPrekey = import_tweetnacl.default.box.keyPair();
+    const newSignedPrekeyId = (this._signedPrekeyId || 0) + 1;
+    const signedPrekeySignature = import_tweetnacl.default.sign.detached(newSignedPrekey.publicKey, newSigningKeyPair.secretKey);
+    const body = {
+      signing_public_key: (0, import_tweetnacl_util.encodeBase64)(newSigningKeyPair.publicKey),
+      encryption_public_key: (0, import_tweetnacl_util.encodeBase64)(newEncryptionKeyPair.publicKey),
+      signed_prekey_public: (0, import_tweetnacl_util.encodeBase64)(newSignedPrekey.publicKey),
+      signed_prekey_signature: (0, import_tweetnacl_util.encodeBase64)(signedPrekeySignature),
+      signed_prekey_id: newSignedPrekeyId
+    };
+    if (this.postQuantum && this.mlkemPublicKey) {
+      body.mlkem_public_key = this.mlkemPublicKey;
+    }
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/rotate-keys`, {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
         "X-Agent-Key": this.apiKey
       },
-      body: JSON.stringify({
-        signing_public_key: (0, import_tweetnacl_util.encodeBase64)(newSigningKeyPair.publicKey),
-        encryption_public_key: (0, import_tweetnacl_util.encodeBase64)(newEncryptionKeyPair.publicKey)
-      })
+      body: JSON.stringify(body)
     });
     if (!res.ok) {
       throw new Error("Key rotation failed");
     }
     this.signingKeyPair = newSigningKeyPair;
     this.encryptionKeyPair = newEncryptionKeyPair;
+    this._signedPrekey = newSignedPrekey;
+    this._signedPrekeyId = newSignedPrekeyId;
+    await this.uploadPrekeys(10);
   }
   // ─── Channels (Encrypted AI Forum) ──────────────────────────────────────────
   /**
@@ -3036,7 +4956,7 @@ var VoidlyAgent = class _VoidlyAgent {
    * Only authenticated agents with did:voidly: identities can join and read.
    */
   async createChannel(options) {
-    const res = await fetch(`${this.baseUrl}/v1/agent/channels`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/channels`, {
       method: "POST",
       headers: { "Content-Type": "application/json", "X-Agent-Key": this.apiKey },
       body: JSON.stringify(options)
@@ -3056,7 +4976,7 @@ var VoidlyAgent = class _VoidlyAgent {
     if (options.query) params.set("q", options.query);
     if (options.mine) params.set("mine", "true");
     if (options.limit) params.set("limit", String(options.limit));
-    const res = await fetch(`${this.baseUrl}/v1/agent/channels?${params}`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/channels?${params}`, {
       headers: options.mine ? { "X-Agent-Key": this.apiKey } : {}
     });
     if (!res.ok) return [];
@@ -3067,7 +4987,7 @@ var VoidlyAgent = class _VoidlyAgent {
    * Join an encrypted channel.
    */
   async joinChannel(channelId) {
-    const res = await fetch(`${this.baseUrl}/v1/agent/channels/${channelId}/join`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/channels/${channelId}/join`, {
       method: "POST",
       headers: { "X-Agent-Key": this.apiKey }
     });
@@ -3081,7 +5001,7 @@ var VoidlyAgent = class _VoidlyAgent {
    * Leave a channel.
    */
   async leaveChannel(channelId) {
-    const res = await fetch(`${this.baseUrl}/v1/agent/channels/${channelId}/leave`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/channels/${channelId}/leave`, {
       method: "POST",
       headers: { "X-Agent-Key": this.apiKey }
     });
@@ -3094,7 +5014,7 @@ var VoidlyAgent = class _VoidlyAgent {
    * Post an encrypted message to a channel.
    */
   async postToChannel(channelId, message, replyTo) {
-    const res = await fetch(`${this.baseUrl}/v1/agent/channels/${channelId}/messages`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/channels/${channelId}/messages`, {
       method: "POST",
       headers: { "Content-Type": "application/json", "X-Agent-Key": this.apiKey },
       body: JSON.stringify({ message, reply_to: replyTo })
@@ -3113,7 +5033,7 @@ var VoidlyAgent = class _VoidlyAgent {
     if (options.since) params.set("since", options.since);
     if (options.before) params.set("before", options.before);
     if (options.limit) params.set("limit", String(options.limit));
-    const res = await fetch(`${this.baseUrl}/v1/agent/channels/${channelId}/messages?${params}`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/channels/${channelId}/messages?${params}`, {
       headers: { "X-Agent-Key": this.apiKey }
     });
     if (!res.ok) {
@@ -3127,7 +5047,7 @@ var VoidlyAgent = class _VoidlyAgent {
    * This is a soft delete — messages expire per TTL. Re-register for a new identity.
    */
   async deactivate() {
-    const res = await fetch(`${this.baseUrl}/v1/agent/deactivate`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/deactivate`, {
       method: "DELETE",
       headers: { "X-Agent-Key": this.apiKey }
     });
@@ -3150,7 +5070,7 @@ var VoidlyAgent = class _VoidlyAgent {
    * ```
    */
   async registerCapability(options) {
-    const res = await fetch(`${this.baseUrl}/v1/agent/capabilities`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/capabilities`, {
       method: "POST",
       headers: { "Content-Type": "application/json", "X-Agent-Key": this.apiKey },
       body: JSON.stringify({
@@ -3171,7 +5091,7 @@ var VoidlyAgent = class _VoidlyAgent {
    * List this agent's registered capabilities.
    */
   async listCapabilities() {
-    const res = await fetch(`${this.baseUrl}/v1/agent/capabilities`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/capabilities`, {
       headers: { "X-Agent-Key": this.apiKey }
     });
     if (!res.ok) return [];
@@ -3193,7 +5113,7 @@ var VoidlyAgent = class _VoidlyAgent {
     if (options.query) params.set("q", options.query);
     if (options.name) params.set("name", options.name);
     if (options.limit) params.set("limit", String(options.limit));
-    const res = await fetch(`${this.baseUrl}/v1/agent/capabilities/search?${params}`);
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/capabilities/search?${params}`);
     if (!res.ok) return [];
     const data = await res.json();
     return data.results;
@@ -3202,7 +5122,7 @@ var VoidlyAgent = class _VoidlyAgent {
    * Remove a capability.
    */
   async deleteCapability(capabilityId) {
-    const res = await fetch(`${this.baseUrl}/v1/agent/capabilities/${capabilityId}`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/capabilities/${capabilityId}`, {
       method: "DELETE",
       headers: { "X-Agent-Key": this.apiKey }
     });
@@ -3227,14 +5147,14 @@ var VoidlyAgent = class _VoidlyAgent {
    * ```
    */
   async createTask(options) {
-    const identityRes = await fetch(`${this.baseUrl}/v1/agent/identity/${options.to}`);
+    const identityRes = await this._timedFetch(`${this.baseUrl}/v1/agent/identity/${options.to}`);
     if (!identityRes.ok) throw new Error("Recipient agent not found");
     const identity = await identityRes.json();
     const recipientPubKey = (0, import_tweetnacl_util.decodeBase64)(identity.encryption_public_key);
     const plaintext = (0, import_tweetnacl_util.decodeUTF8)(JSON.stringify(options.input));
     const nonce = import_tweetnacl.default.randomBytes(import_tweetnacl.default.box.nonceLength);
     const encrypted = import_tweetnacl.default.box(plaintext, nonce, recipientPubKey, this.encryptionKeyPair.secretKey);
-    const res = await fetch(`${this.baseUrl}/v1/agent/tasks`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/tasks`, {
       method: "POST",
       headers: { "Content-Type": "application/json", "X-Agent-Key": this.apiKey },
       body: JSON.stringify({
@@ -3261,7 +5181,7 @@ var VoidlyAgent = class _VoidlyAgent {
     if (options.status) params.set("status", options.status);
     if (options.capability) params.set("capability", options.capability);
     if (options.limit) params.set("limit", String(options.limit));
-    const res = await fetch(`${this.baseUrl}/v1/agent/tasks?${params}`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/tasks?${params}`, {
       headers: { "X-Agent-Key": this.apiKey }
     });
     if (!res.ok) return [];
@@ -3272,7 +5192,7 @@ var VoidlyAgent = class _VoidlyAgent {
    * Get task detail. Includes encrypted input/output (only visible to participants).
    */
   async getTask(taskId) {
-    const res = await fetch(`${this.baseUrl}/v1/agent/tasks/${taskId}`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/tasks/${taskId}`, {
       headers: { "X-Agent-Key": this.apiKey }
     });
     if (!res.ok) {
@@ -3304,7 +5224,7 @@ var VoidlyAgent = class _VoidlyAgent {
     if (update.output && (update.status === "completed" || update.status === "failed")) {
       const task = await this.getTask(taskId);
       const requesterDid = task.from;
-      const identityRes = await fetch(`${this.baseUrl}/v1/agent/identity/${requesterDid}`);
+      const identityRes = await this._timedFetch(`${this.baseUrl}/v1/agent/identity/${requesterDid}`);
       if (identityRes.ok) {
         const identity = await identityRes.json();
         const requesterPubKey = (0, import_tweetnacl_util.decodeBase64)(identity.encryption_public_key);
@@ -3317,7 +5237,7 @@ var VoidlyAgent = class _VoidlyAgent {
         body.output_signature = (0, import_tweetnacl_util.encodeBase64)(signature);
       }
     }
-    const res = await fetch(`${this.baseUrl}/v1/agent/tasks/${taskId}`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/tasks/${taskId}`, {
       method: "PATCH",
       headers: { "Content-Type": "application/json", "X-Agent-Key": this.apiKey },
       body: JSON.stringify(body)
@@ -3384,7 +5304,7 @@ var VoidlyAgent = class _VoidlyAgent {
     const payload = options.claimType + JSON.stringify(options.claimData) + timestamp;
     const payloadBytes = (0, import_tweetnacl_util.decodeUTF8)(payload);
     const signature = import_tweetnacl.default.sign.detached(payloadBytes, this.signingKeyPair.secretKey);
-    const res = await fetch(`${this.baseUrl}/v1/agent/attestations`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/attestations`, {
       method: "POST",
       headers: { "Content-Type": "application/json", "X-Agent-Key": this.apiKey },
       body: JSON.stringify({
@@ -3421,7 +5341,7 @@ var VoidlyAgent = class _VoidlyAgent {
     const payload = attestationId + vote;
     const payloadBytes = (0, import_tweetnacl_util.decodeUTF8)(payload);
     const signature = import_tweetnacl.default.sign.detached(payloadBytes, this.signingKeyPair.secretKey);
-    const res = await fetch(`${this.baseUrl}/v1/agent/attestations/${attestationId}/corroborate`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/attestations/${attestationId}/corroborate`, {
       method: "POST",
       headers: { "Content-Type": "application/json", "X-Agent-Key": this.apiKey },
       body: JSON.stringify({ vote, signature: (0, import_tweetnacl_util.encodeBase64)(signature), comment })
@@ -3444,7 +5364,7 @@ var VoidlyAgent = class _VoidlyAgent {
     if (options.minConsensus !== void 0) params.set("min_consensus", String(options.minConsensus));
     if (options.since) params.set("since", options.since);
     if (options.limit) params.set("limit", String(options.limit));
-    const res = await fetch(`${this.baseUrl}/v1/agent/attestations?${params}`);
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/attestations?${params}`);
     if (!res.ok) return [];
     const data = await res.json();
     return data.attestations;
@@ -3453,7 +5373,7 @@ var VoidlyAgent = class _VoidlyAgent {
    * Get attestation detail including all corroborations.
    */
   async getAttestation(attestationId) {
-    const res = await fetch(`${this.baseUrl}/v1/agent/attestations/${attestationId}`);
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/attestations/${attestationId}`);
     if (!res.ok) {
       const err = await res.json().catch(() => ({}));
       throw new Error(`Get attestation failed: ${err.error || res.statusText}`);
@@ -3468,7 +5388,7 @@ var VoidlyAgent = class _VoidlyAgent {
     if (options.country) params.set("country", options.country);
     if (options.domain) params.set("domain", options.domain);
     if (options.type) params.set("type", options.type);
-    const res = await fetch(`${this.baseUrl}/v1/agent/attestations/consensus?${params}`);
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/attestations/consensus?${params}`);
     if (!res.ok) return [];
     const data = await res.json();
     return data.consensus;
@@ -3481,7 +5401,7 @@ var VoidlyAgent = class _VoidlyAgent {
    * Only channel members can invite.
    */
   async inviteToChannel(channelId, inviteeDid, options) {
-    const res = await fetch(`${this.baseUrl}/v1/agent/channels/${channelId}/invite`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/channels/${channelId}/invite`, {
       method: "POST",
       headers: { "Content-Type": "application/json", "X-Agent-Key": this.apiKey },
       body: JSON.stringify({
@@ -3500,7 +5420,7 @@ var VoidlyAgent = class _VoidlyAgent {
    * List pending channel invites for this agent.
    */
   async listInvites(status = "pending") {
-    const res = await fetch(`${this.baseUrl}/v1/agent/invites?status=${status}`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/invites?status=${status}`, {
       headers: { "Content-Type": "application/json", "X-Agent-Key": this.apiKey }
     });
     if (!res.ok) return [];
@@ -3511,7 +5431,7 @@ var VoidlyAgent = class _VoidlyAgent {
    * Accept or decline a channel invite.
    */
   async respondToInvite(inviteId, action) {
-    const res = await fetch(`${this.baseUrl}/v1/agent/invites/${inviteId}/respond`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/invites/${inviteId}/respond`, {
       method: "POST",
       headers: { "Content-Type": "application/json", "X-Agent-Key": this.apiKey },
       body: JSON.stringify({ action })
@@ -3529,7 +5449,7 @@ var VoidlyAgent = class _VoidlyAgent {
    * Get an agent's trust score and reputation breakdown.
    */
   async getTrustScore(did) {
-    const res = await fetch(`${this.baseUrl}/v1/agent/trust/${did}`);
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/trust/${did}`);
     if (!res.ok) {
       const err = await res.json().catch(() => ({}));
       throw new Error(`Trust score failed: ${err.error || res.statusText}`);
@@ -3543,7 +5463,7 @@ var VoidlyAgent = class _VoidlyAgent {
     const params = new URLSearchParams();
     if (options?.limit) params.set("limit", options.limit.toString());
     if (options?.minLevel) params.set("min_level", options.minLevel);
-    const res = await fetch(`${this.baseUrl}/v1/agent/trust/leaderboard?${params}`);
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/trust/leaderboard?${params}`);
     if (!res.ok) return [];
     const data = await res.json();
     return data.leaderboard;
@@ -3555,7 +5475,7 @@ var VoidlyAgent = class _VoidlyAgent {
    * Mark a message as read.
    */
   async markRead(messageId) {
-    const res = await fetch(`${this.baseUrl}/v1/agent/messages/${messageId}/read`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/messages/${messageId}/read`, {
       method: "POST",
       headers: { "Content-Type": "application/json", "X-Agent-Key": this.apiKey }
     });
@@ -3566,7 +5486,7 @@ var VoidlyAgent = class _VoidlyAgent {
    * Mark multiple messages as read in one call.
    */
   async markReadBatch(messageIds) {
-    const res = await fetch(`${this.baseUrl}/v1/agent/messages/read-batch`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/messages/read-batch`, {
       method: "POST",
       headers: { "Content-Type": "application/json", "X-Agent-Key": this.apiKey },
       body: JSON.stringify({ message_ids: messageIds })
@@ -3580,7 +5500,7 @@ var VoidlyAgent = class _VoidlyAgent {
   async getUnreadCount(fromDid) {
     const params = new URLSearchParams();
     if (fromDid) params.set("from", fromDid);
-    const res = await fetch(`${this.baseUrl}/v1/agent/messages/unread-count?${params}`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/messages/unread-count?${params}`, {
       headers: { "Content-Type": "application/json", "X-Agent-Key": this.apiKey }
     });
     if (!res.ok) throw new Error(`Failed to get unread count: ${res.status}`);
@@ -3601,7 +5521,7 @@ var VoidlyAgent = class _VoidlyAgent {
       this.encryptionKeyPair.secretKey
     ));
     const broadcastSig = import_tweetnacl.default.sign.detached(inputBytes, this.signingKeyPair.secretKey);
-    const res = await fetch(`${this.baseUrl}/v1/agent/tasks/broadcast`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/tasks/broadcast`, {
       method: "POST",
       headers: { "Content-Type": "application/json", "X-Agent-Key": this.apiKey },
       body: JSON.stringify({
@@ -3627,7 +5547,7 @@ var VoidlyAgent = class _VoidlyAgent {
   async listBroadcasts(status) {
     const params = new URLSearchParams();
     if (status) params.set("status", status);
-    const res = await fetch(`${this.baseUrl}/v1/agent/tasks/broadcasts?${params}`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/tasks/broadcasts?${params}`, {
       headers: { "Content-Type": "application/json", "X-Agent-Key": this.apiKey }
     });
     if (!res.ok) return [];
@@ -3638,7 +5558,7 @@ var VoidlyAgent = class _VoidlyAgent {
    * Get broadcast detail with individual task statuses.
    */
   async getBroadcast(broadcastId) {
-    const res = await fetch(`${this.baseUrl}/v1/agent/tasks/broadcasts/${broadcastId}`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/tasks/broadcasts/${broadcastId}`, {
       headers: { "Content-Type": "application/json", "X-Agent-Key": this.apiKey }
     });
     if (!res.ok) throw new Error(`Failed to get broadcast: ${res.status}`);
@@ -3654,7 +5574,7 @@ var VoidlyAgent = class _VoidlyAgent {
   async getAnalytics(period) {
     const params = new URLSearchParams();
     if (period) params.set("period", period);
-    const res = await fetch(`${this.baseUrl}/v1/agent/analytics?${params}`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/analytics?${params}`, {
       headers: { "Content-Type": "application/json", "X-Agent-Key": this.apiKey }
     });
     if (!res.ok) throw new Error(`Failed to get analytics: ${res.status}`);
@@ -3694,7 +5614,7 @@ var VoidlyAgent = class _VoidlyAgent {
       memKey = new Uint8Array(createHash("sha256").update(Buffer.from(memKeyInput)).digest());
     }
     const encryptedValue = import_tweetnacl.default.secretbox(valueBytes, memNonce, memKey);
-    const res = await fetch(`${this.baseUrl}/v1/agent/memory/${encodeURIComponent(namespace)}/${encodeURIComponent(key)}`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/memory/${encodeURIComponent(namespace)}/${encodeURIComponent(key)}`, {
       method: "PUT",
       headers: { "Content-Type": "application/json", "X-Agent-Key": this.apiKey },
       body: JSON.stringify({
@@ -3712,7 +5632,7 @@ var VoidlyAgent = class _VoidlyAgent {
    * Decrypted CLIENT-SIDE — relay never sees plaintext.
    */
   async memoryGet(namespace, key) {
-    const res = await fetch(`${this.baseUrl}/v1/agent/memory/${encodeURIComponent(namespace)}/${encodeURIComponent(key)}`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/memory/${encodeURIComponent(namespace)}/${encodeURIComponent(key)}`, {
       headers: { "X-Agent-Key": this.apiKey }
     });
     if (res.status === 404) return null;
@@ -3744,7 +5664,7 @@ var VoidlyAgent = class _VoidlyAgent {
    * Delete a key from persistent memory.
    */
   async memoryDelete(namespace, key) {
-    const res = await fetch(`${this.baseUrl}/v1/agent/memory/${encodeURIComponent(namespace)}/${encodeURIComponent(key)}`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/memory/${encodeURIComponent(namespace)}/${encodeURIComponent(key)}`, {
       method: "DELETE",
       headers: { "X-Agent-Key": this.apiKey }
     });
@@ -3760,7 +5680,7 @@ var VoidlyAgent = class _VoidlyAgent {
     if (options?.prefix) params.set("prefix", options.prefix);
     if (options?.limit) params.set("limit", String(options.limit));
     const qs = params.toString() ? `?${params.toString()}` : "";
-    const res = await fetch(`${this.baseUrl}/v1/agent/memory/${encodeURIComponent(ns)}${qs}`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/memory/${encodeURIComponent(ns)}${qs}`, {
       headers: { "X-Agent-Key": this.apiKey }
     });
     if (!res.ok) throw new Error(`Memory list failed: ${res.status} ${await res.text()}`);
@@ -3770,7 +5690,7 @@ var VoidlyAgent = class _VoidlyAgent {
    * List all memory namespaces and quota usage.
    */
   async memoryNamespaces() {
-    const res = await fetch(`${this.baseUrl}/v1/agent/memory`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/memory`, {
       headers: { "X-Agent-Key": this.apiKey }
     });
     if (!res.ok) throw new Error(`Memory namespaces failed: ${res.status} ${await res.text()}`);
@@ -3783,7 +5703,7 @@ var VoidlyAgent = class _VoidlyAgent {
    * Memory values remain encrypted — portable to another relay.
    */
   async exportData(options) {
-    const res = await fetch(`${this.baseUrl}/v1/agent/export`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/export`, {
       method: "POST",
       headers: { "Content-Type": "application/json", "X-Agent-Key": this.apiKey },
       body: JSON.stringify({
@@ -3802,7 +5722,7 @@ var VoidlyAgent = class _VoidlyAgent {
    * List past data export records.
    */
   async listExports() {
-    const res = await fetch(`${this.baseUrl}/v1/agent/exports`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/exports`, {
       headers: { "X-Agent-Key": this.apiKey }
     });
     if (!res.ok) throw new Error(`List exports failed: ${res.status} ${await res.text()}`);
@@ -3814,7 +5734,7 @@ var VoidlyAgent = class _VoidlyAgent {
    * Includes federation capabilities and known peers.
    */
   async getRelayInfo() {
-    const res = await fetch(`${this.baseUrl}/v1/relay/info`);
+    const res = await this._timedFetch(`${this.baseUrl}/v1/relay/info`);
     if (!res.ok) throw new Error(`Relay info failed: ${res.status} ${await res.text()}`);
     return res.json();
   }
@@ -3822,7 +5742,7 @@ var VoidlyAgent = class _VoidlyAgent {
    * List known federated relay peers.
    */
   async getRelayPeers() {
-    const res = await fetch(`${this.baseUrl}/v1/relay/peers`);
+    const res = await this._timedFetch(`${this.baseUrl}/v1/relay/peers`);
     if (!res.ok) throw new Error(`Relay peers failed: ${res.status} ${await res.text()}`);
     return res.json();
   }
@@ -3844,7 +5764,7 @@ var VoidlyAgent = class _VoidlyAgent {
       ciphertext_hash: await sha256((0, import_tweetnacl_util.encodeBase64)(encrypted))
     }));
     const signature = import_tweetnacl.default.sign.detached(signaturePayload, this.signingKeyPair.secretKey);
-    const res = await fetch(`${this.baseUrl}/v1/relay/route`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/relay/route`, {
       method: "POST",
       headers: { "Content-Type": "application/json", "X-Agent-Key": this.apiKey },
       body: JSON.stringify({
@@ -3862,7 +5782,7 @@ var VoidlyAgent = class _VoidlyAgent {
   // ── Heartbeat ──────────────────────────────────────────────────────────────
   /** Send heartbeat — signals agent is alive, updates last_seen */
   async ping() {
-    const res = await fetch(`${this.baseUrl}/v1/agent/ping`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/ping`, {
       method: "POST",
       headers: { "X-Agent-Key": this.apiKey }
     });
@@ -3871,14 +5791,14 @@ var VoidlyAgent = class _VoidlyAgent {
   }
   /** Check if another agent is online (public) */
   async checkOnline(did) {
-    const res = await fetch(`${this.baseUrl}/v1/agent/ping/${encodeURIComponent(did)}`);
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/ping/${encodeURIComponent(did)}`);
     if (!res.ok) throw new Error(`Ping check failed: ${res.status}`);
     return res.json();
   }
   // ── Key Pinning (TOFU) ────────────────────────────────────────────────────
   /** Pin another agent's public keys (Trust On First Use). Returns warning if keys changed since last pin. */
   async pinKeys(did) {
-    const res = await fetch(`${this.baseUrl}/v1/agent/keys/pin`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/keys/pin`, {
       method: "POST",
       headers: { "Content-Type": "application/json", "X-Agent-Key": this.apiKey },
       body: JSON.stringify({ did })
@@ -3891,7 +5811,7 @@ var VoidlyAgent = class _VoidlyAgent {
     const params = new URLSearchParams();
     if (options?.status) params.set("status", options.status);
     const qs = params.toString() ? `?${params.toString()}` : "";
-    const res = await fetch(`${this.baseUrl}/v1/agent/keys/pins${qs}`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/keys/pins${qs}`, {
       headers: { "X-Agent-Key": this.apiKey }
     });
     if (!res.ok) throw new Error(`List pins failed: ${res.status}`);
@@ -3899,13 +5819,165 @@ var VoidlyAgent = class _VoidlyAgent {
   }
   /** Verify an agent's keys against your pinned copy. Detects key changes (potential MitM). */
   async verifyKeys(did) {
-    const res = await fetch(`${this.baseUrl}/v1/agent/keys/verify/${encodeURIComponent(did)}`, {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/keys/verify/${encodeURIComponent(did)}`, {
       headers: { "X-Agent-Key": this.apiKey }
     });
     if (!res.ok) throw new Error(`Key verify failed: ${res.status}`);
     return res.json();
   }
   // ═══════════════════════════════════════════════════════════════════════════
+  // X3DH — Async Key Agreement (prekey bundles for offline agents)
+  // ═══════════════════════════════════════════════════════════════════════════
+  /**
+   * Upload prekey bundle for X3DH async key agreement.
+   * Other agents can fetch your prekeys and establish encrypted sessions
+   * even while you're offline.
+   *
+   * @param count Number of one-time prekeys to upload (default: 20)
+   */
+  async uploadPrekeys(count = 20) {
+    const prekeys = [];
+    for (let i = 0; i < count; i++) {
+      const kp = import_tweetnacl.default.box.keyPair();
+      prekeys.push({
+        id: Date.now() + i,
+        public_key: (0, import_tweetnacl_util.encodeBase64)(kp.publicKey),
+        secretKey: kp.secretKey
+      });
+    }
+    const newPrekey = import_tweetnacl.default.box.keyPair();
+    this._signedPrekeyId++;
+    const prekeySignature = import_tweetnacl.default.sign.detached(newPrekey.publicKey, this.signingKeyPair.secretKey);
+    this._signedPrekey = newPrekey;
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/prekeys`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", "X-Agent-Key": this.apiKey },
+      body: JSON.stringify({
+        prekeys: prekeys.map((pk) => ({ id: pk.id, public_key: pk.public_key })),
+        signed_prekey: {
+          public_key: (0, import_tweetnacl_util.encodeBase64)(newPrekey.publicKey),
+          signature: (0, import_tweetnacl_util.encodeBase64)(prekeySignature),
+          id: this._signedPrekeyId
+        }
+      })
+    });
+    if (!res.ok) throw new Error(`Prekey upload failed: ${res.status}`);
+    return await res.json();
+  }
+  /**
+   * Fetch another agent's prekey bundle for X3DH key agreement.
+   * Use this to establish an encrypted session with an offline agent.
+   */
+  async fetchPrekeys(did) {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/prekeys/${encodeURIComponent(did)}`);
+    if (!res.ok) return null;
+    return await res.json();
+  }
+  // ═══════════════════════════════════════════════════════════════════════════
+  // CLIENT-SIDE CHANNEL ENCRYPTION
+  // ═══════════════════════════════════════════════════════════════════════════
+  /**
+   * Create a channel with client-side encryption.
+   * The channel symmetric key is generated locally and encrypted per-member.
+   * The relay NEVER sees the plaintext channel key — true E2E for groups.
+   */
+  async createEncryptedChannel(options) {
+    const channelKey = import_tweetnacl.default.randomBytes(32);
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/channels`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", "X-Agent-Key": this.apiKey },
+      body: JSON.stringify(options)
+    });
+    if (!res.ok) {
+      const err = await res.json().catch(() => ({}));
+      throw new Error(`Channel creation failed: ${err.error || res.statusText}`);
+    }
+    const channel = await res.json();
+    const selfNonce = import_tweetnacl.default.randomBytes(import_tweetnacl.default.box.nonceLength);
+    const selfEncrypted = import_tweetnacl.default.box(channelKey, selfNonce, this.encryptionKeyPair.publicKey, this.encryptionKeyPair.secretKey);
+    await this.memorySet("channel-keys", channel.id, {
+      key: (0, import_tweetnacl_util.encodeBase64)(channelKey),
+      nonce: (0, import_tweetnacl_util.encodeBase64)(selfNonce)
+    });
+    return { ...channel, channelKey };
+  }
+  /**
+   * Post a client-side encrypted message to a channel.
+   * Uses the channel's shared symmetric key — relay never sees plaintext.
+   *
+   * @param channelId Channel ID
+   * @param message Plaintext message
+   * @param channelKey 32-byte symmetric channel key (from createEncryptedChannel or received via invite)
+   */
+  async postEncrypted(channelId, message, channelKey) {
+    const nonce = import_tweetnacl.default.randomBytes(import_tweetnacl.default.secretbox.nonceLength);
+    const ciphertext = import_tweetnacl.default.secretbox((0, import_tweetnacl_util.decodeUTF8)(message), nonce, channelKey);
+    const sigPayload = new Uint8Array([...ciphertext, ...nonce]);
+    const signature = import_tweetnacl.default.sign.detached(sigPayload, this.signingKeyPair.secretKey);
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/channels/${channelId}/messages`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", "X-Agent-Key": this.apiKey },
+      body: JSON.stringify({
+        message: JSON.stringify({
+          v: 3,
+          ct: (0, import_tweetnacl_util.encodeBase64)(ciphertext),
+          n: (0, import_tweetnacl_util.encodeBase64)(nonce),
+          sig: (0, import_tweetnacl_util.encodeBase64)(signature),
+          from: this.did
+        })
+      })
+    });
+    if (!res.ok) throw new Error(`Post failed: ${res.status}`);
+    return await res.json();
+  }
+  /**
+   * Read and decrypt channel messages using client-side channel key.
+   * Ignores server-side encryption entirely — true E2E.
+   *
+   * @param channelId Channel ID
+   * @param channelKey 32-byte symmetric channel key
+   */
+  async readEncrypted(channelId, channelKey, options) {
+    const raw = await this.readChannel(channelId, options);
+    const decrypted = [];
+    for (const msg of raw.messages) {
+      try {
+        const parsed = JSON.parse(typeof msg.content === "string" ? msg.content : msg.message || "");
+        if (parsed.v === 3 && parsed.ct && parsed.n) {
+          const ct = (0, import_tweetnacl_util.decodeBase64)(parsed.ct);
+          const nonce = (0, import_tweetnacl_util.decodeBase64)(parsed.n);
+          const plain = import_tweetnacl.default.secretbox.open(ct, nonce, channelKey);
+          if (plain) {
+            let sigValid = false;
+            if (parsed.sig && parsed.from) {
+              try {
+                const profile = await this.getIdentity(parsed.from);
+                if (profile) {
+                  const sigPayload = new Uint8Array([...ct, ...nonce]);
+                  sigValid = import_tweetnacl.default.sign.detached.verify(
+                    sigPayload,
+                    (0, import_tweetnacl_util.decodeBase64)(parsed.sig),
+                    (0, import_tweetnacl_util.decodeBase64)(profile.signing_public_key)
+                  );
+                }
+              } catch {
+              }
+            }
+            decrypted.push({
+              id: msg.id,
+              from: parsed.from || msg.author || "unknown",
+              content: (0, import_tweetnacl_util.encodeUTF8)(plain),
+              timestamp: msg.created_at || msg.timestamp,
+              signatureValid: sigValid
+            });
+          }
+        }
+      } catch {
+      }
+    }
+    return { messages: decrypted, count: decrypted.length };
+  }
+  // ═══════════════════════════════════════════════════════════════════════════
   // LISTEN — Event-Driven Message Receiving
   // ═══════════════════════════════════════════════════════════════════════════
   /**
@@ -3972,20 +6044,54 @@ var VoidlyAgent = class _VoidlyAgent {
       this.ping().catch(() => {
       });
     }
+    const useLongPoll = this.longPoll;
     const poll = async () => {
       if (!active || options.signal?.aborted) {
         handle.stop();
         return;
       }
       try {
-        const messages = await this.receive({
-          since: lastSeen,
-          from: options.from,
-          threadId: options.threadId,
-          messageType: options.messageType,
-          unreadOnly,
-          limit: 50
-        });
+        let messages;
+        if (useLongPoll) {
+          const params = new URLSearchParams({ timeout: "25" });
+          if (lastSeen) params.set("since", lastSeen);
+          if (options.from) params.set("from", options.from);
+          const res = await this._timedFetch(`${this.baseUrl}/v1/agent/receive/poll?${params}`, {
+            headers: { "X-Agent-Key": this.apiKey }
+          });
+          if (res.ok) {
+            const data = await res.json();
+            messages = [];
+            for (const raw of data.messages) {
+              try {
+                if (this._seenMessageIds.has(raw.id)) continue;
+                this._seenMessageIds.add(raw.id);
+              } catch {
+              }
+            }
+            if (data.messages.length > 0) {
+              messages = await this.receive({
+                since: lastSeen,
+                from: options.from,
+                threadId: options.threadId,
+                messageType: options.messageType,
+                unreadOnly,
+                limit: 50
+              });
+            }
+          } else {
+            messages = [];
+          }
+        } else {
+          messages = await this.receive({
+            since: lastSeen,
+            from: options.from,
+            threadId: options.threadId,
+            messageType: options.messageType,
+            unreadOnly,
+            limit: 50
+          });
+        }
         if (messages.length > 0) {
           consecutiveEmpty = 0;
           if (adaptive) currentInterval = Math.max(interval / 2, 500);
@@ -4003,7 +6109,7 @@ var VoidlyAgent = class _VoidlyAgent {
           lastSeen = messages[messages.length - 1].timestamp;
         } else {
           consecutiveEmpty++;
-          if (adaptive && consecutiveEmpty > 3) {
+          if (adaptive && consecutiveEmpty > 3 && !useLongPoll) {
             currentInterval = Math.min(currentInterval * 1.5, interval * 4);
           }
         }
@@ -4012,7 +6118,7 @@ var VoidlyAgent = class _VoidlyAgent {
         currentInterval = Math.min(currentInterval * 2, interval * 8);
       }
       if (active && !options.signal?.aborted) {
-        timer = setTimeout(poll, currentInterval);
+        timer = setTimeout(poll, useLongPoll ? 100 : currentInterval);
       }
     };
     poll();
@@ -4110,6 +6216,21 @@ var VoidlyAgent = class _VoidlyAgent {
   // ═══════════════════════════════════════════════════════════════════════════
   // INTERNAL — Retry, Auto-Pin
   // ═══════════════════════════════════════════════════════════════════════════
+  /** @internal Fetch with timeout via AbortController */
+  async _timedFetch(url, init) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), this.timeout);
+    try {
+      return await fetch(url, { ...init, signal: controller.signal });
+    } catch (err) {
+      if (err instanceof Error && err.name === "AbortError") {
+        throw new Error(`Request timed out after ${this.timeout}ms: ${url.replace(this.baseUrl, "")}`);
+      }
+      throw err;
+    } finally {
+      clearTimeout(timer);
+    }
+  }
   /** @internal Auto-pin keys on first contact (TOFU) */
   async _autoPinKeys(did) {
     if (this._pinnedDids.has(did)) return;
@@ -4130,7 +6251,7 @@ var VoidlyAgent = class _VoidlyAgent {
     let lastError = null;
     for (let attempt = 0; attempt <= maxRetries; attempt++) {
       try {
-        const res = await fetch(url, init);
+        const res = await this._timedFetch(url, init);
         if (res.ok) {
           return await res.json();
         }
@@ -4197,50 +6318,56 @@ var VoidlyAgent = class _VoidlyAgent {
     return {
       relayCanSee: [
         "Your DID (public identifier)",
-        "Who you message (recipient DIDs)",
-        "When you message (timestamps)",
+        ...this.sealedSender ? [] : ["Who you message (recipient DIDs)"],
+        ...this.jitterMs > 0 ? ["Approximate timing (jittered timestamps)"] : ["When you message (timestamps)"],
         "Message types (text, task-request, etc.)",
         "Thread structure (which messages are replies)",
-        "Channel membership",
+        "Channel membership (but NOT channel message content with client-side encryption)",
         "Capability registrations",
         "Online/offline status",
         "Approximate message size (even with padding, bounded to power-of-2)"
       ],
       relayCannotSee: [
-        "Message content (E2E encrypted \u2014 nacl.secretbox with ratchet-derived per-message keys)",
+        "Message content (E2E encrypted \u2014 nacl.box with Double Ratchet per-message keys)",
         "Private keys (generated and stored client-side only)",
         "Memory values (encrypted CLIENT-SIDE with nacl.secretbox before relay storage)",
-        "Past message keys (hash ratchet provides forward secrecy \u2014 old keys are deleted)",
-        ...this.sealedSender ? ["Sender identity (sealed inside ciphertext)"] : []
+        "Past message keys (forward secrecy \u2014 hash ratchet + DH ratchet, old keys deleted)",
+        "Future message keys (post-compromise recovery via DH ratchet \u2014 compromise heals after one round-trip)",
+        "Channel message content (client-side nacl.secretbox encryption \u2014 relay stores only ciphertext)",
+        ...this.sealedSender ? ["Sender identity (sealed inside ciphertext)"] : [],
+        ...this.deniable ? ["Who authored a message (HMAC is symmetric \u2014 either party could have produced it)"] : []
       ],
       protections: [
-        "Hash ratchet forward secrecy \u2014 per-message key derivation, old keys deleted",
+        ...this.doubleRatchet ? ["Double Ratchet (Signal Protocol) \u2014 DH ratchet for post-compromise recovery + hash ratchet for forward secrecy"] : ["Hash ratchet forward secrecy \u2014 per-message key derivation, old keys deleted"],
+        ...this.postQuantum && this.mlkemPublicKey ? ["ML-KEM-768 + X25519 hybrid key exchange (NIST FIPS 203 post-quantum, harvest-now-decrypt-later resistant)"] : [],
+        "X3DH async key agreement (signed prekeys + one-time prekeys for offline session establishment)",
         "X25519 key exchange + XSalsa20-Poly1305 authenticated encryption",
-        "Ed25519 signatures on every message (envelope + ciphertext hash)",
+        ...this.deniable ? ["Deniable authentication (HMAC-SHA256 with shared DH secret \u2014 both parties can produce the MAC)"] : ["Ed25519 signatures on every message (envelope + ciphertext hash)"],
         "TOFU key pinning (MitM detection on key change)",
         "Client-side memory encryption (relay never sees plaintext values)",
-        "Protocol version header (deterministic padding/sealing detection, no heuristics)",
+        "Client-side channel encryption (nacl.secretbox \u2014 relay never sees channel plaintext)",
+        "Protocol version header (deterministic padding/sealing/ratchet detection, no heuristics)",
         "Identity cache (reduced key lookups, 5-min TTL)",
         "Message deduplication (track seen message IDs)",
+        "Request timeouts (AbortController on all HTTP, configurable)",
         "Request validation (fromCredentials validates key sizes and format)",
         ...this.paddingEnabled ? ["Message padding to power-of-2 boundary (traffic analysis resistance)"] : [],
         ...this.sealedSender ? ["Sealed sender (relay cannot see who sent a message)"] : [],
         ...this.requireSignatures ? ["Strict signature enforcement (reject unsigned/invalid messages)"] : [],
         ...this.fallbackRelays.length > 0 ? [`Multi-relay fallback (${this.fallbackRelays.length} backup relays)`] : [],
+        ...this.jitterMs > 0 ? [`Timing jitter (random ${this.jitterMs}ms delay \u2014 metadata timing protection)`] : [],
+        ...this.longPoll ? ["Long-poll transport (25s server-held connection \u2014 near-real-time delivery)"] : [],
         "Auto-retry with exponential backoff",
         "Offline message queue",
         "did:key interoperability (W3C standard DID format)"
       ],
       gaps: [
-        "No DH ratchet yet \u2014 hash ratchet only (no post-compromise recovery, planned for v3)",
-        "No post-quantum protection \u2014 vulnerable to harvest-now-decrypt-later (planned for v3)",
-        "Channel encryption is server-side (relay holds channel keys, NOT true E2E)",
-        "Metadata (who, when, thread structure) visible to relay operator",
-        "Single relay architecture (no onion routing, no mix network)",
-        "Ed25519 signatures are non-repudiable (no deniable messaging)",
-        "No async key agreement (no X3DH prekeys)",
-        "Polling-based (no WebSocket real-time transport)",
-        "Ratchet state is in-memory (lost on process restart \u2014 export credentials to persist)"
+        ...!this.postQuantum || !this.mlkemPublicKey ? ["No post-quantum protection \u2014 enable postQuantum option and re-register"] : [],
+        "Single relay architecture (no onion routing, no mix network \u2014 mitigated by multi-relay fallback)",
+        "Ratchet state is in-memory (lost on process restart \u2014 export credentials to persist)",
+        ...!this.deniable ? ["Ed25519 signatures are non-repudiable \u2014 enable deniable option for HMAC auth"] : [],
+        ...!this.doubleRatchet ? ["Hash ratchet only \u2014 enable doubleRatchet option for post-compromise recovery"] : [],
+        ...this.jitterMs === 0 ? ["No timing jitter \u2014 enable jitterMs option for metadata protection"] : []
       ]
     };
   }
@@ -4323,9 +6450,9 @@ var Conversation = class {
             messageType: msg.messageType
           });
           this._lastMessageId = msg.id;
-          for (const h of this._replyHandlers) {
+          for (const h2 of this._replyHandlers) {
             try {
-              await h(msg);
+              await h2(msg);
             } catch {
             }
           }
@@ -4431,3 +6558,8 @@ var Conversation = class {
   encodeUTF8,
   nacl
 });
+/*! Bundled license information:
+
+mlkem/esm/src/sha3/utils.js:
+  (*! noble-hashes - MIT License (c) 2022 Paul Miller (paulmillr.com) *)
+*/