toiljs 0.0.120 → 0.0.122

package/build/cli/index.js

@@ -663,11 +663,11 @@ var require_clean = __commonJS({
   "node_modules/semver/functions/clean.js"(exports, module) {
     "use strict";
     var parse = require_parse();
-    var clean = (version2, options) => {
+    var clean2 = (version2, options) => {
       const s = parse(version2.trim().replace(/^[=v]+/, ""), options);
       return s ? s.version : null;
     };
-    module.exports = clean;
+    module.exports = clean2;
   }
 });
 
@@ -2064,7 +2064,7 @@ var require_semver2 = __commonJS({
     var identifiers = require_identifiers();
     var parse = require_parse();
     var valid = require_valid();
-    var clean = require_clean();
+    var clean2 = require_clean();
     var inc = require_inc();
     var diff = require_diff();
     var major = require_major();
@@ -2103,7 +2103,7 @@ var require_semver2 = __commonJS({
     module.exports = {
       parse,
       valid,
-      clean,
+      clean: clean2,
       inc,
       diff,
       major,
@@ -3256,8 +3256,8 @@ var C = (o, e, s) => {
 var note = (o = "", e = "", s) => {
   const a2 = s?.output ?? process$1.stdout, i2 = s?.withGuide ?? settings.withGuide, c2 = s?.format ?? W$1, g = ["", ...C(o, getColumns(a2) - 6, c2).split(`
 `).map(c2), ""], n3 = dist_default2(e), t2 = Math.max(
-    g.reduce((m2, F) => {
-      const O = dist_default2(F);
+    g.reduce((m2, F2) => {
+      const O = dist_default2(F2);
       return O > m2 ? O : m2;
     }, 0),
     n3
@@ -3284,7 +3284,7 @@ var spinner = ({
   cancelMessage: G,
   errorMessage: O,
   frames: E = unicode ? ["\u25D2", "\u25D0", "\u25D3", "\u25D1"] : ["\u2022", "o", "O", "0"],
-  delay: F = unicode ? 80 : 120,
+  delay: F2 = unicode ? 80 : 120,
   signal: m2,
   ...I2
 } = {}) => {
@@ -3310,8 +3310,8 @@ var spinner = ({
   }, C2 = (e) => e.replace(/\.+$/, ""), _ = (e) => {
     const r2 = (performance.now() - e) / 1e3, t2 = Math.floor(r2 / 60), o = Math.floor(r2 % 60);
     return t2 > 0 ? `[${t2}m ${o}s]` : `[${o}s]`;
-  }, N = I2.withGuide ?? settings.withGuide, P = (e = "") => {
-    d = true, M = block({ output: n3 }), s = C2(e), w = performance.now(), N && n3.write(`${styleText2("gray", S_BAR)}
+  }, N2 = I2.withGuide ?? settings.withGuide, P = (e = "") => {
+    d = true, M = block({ output: n3 }), s = C2(e), w = performance.now(), N2 && n3.write(`${styleText2("gray", S_BAR)}
 `);
     let r2 = 0, t2 = 0;
     A(), T = setInterval(() => {
@@ -3333,7 +3333,7 @@ var spinner = ({
         trim: false
       });
       n3.write(j), r2 = r2 + 1 < E.length ? r2 + 1 : 0, t2 = t2 < 4 ? t2 + 0.125 : 0;
-    }, F);
+    }, F2);
   }, a2 = (e = "", r2 = 0, t2 = false) => {
     if (!d) return;
     d = false, clearInterval(T), y2();
@@ -3611,10 +3611,10 @@ function detectTailwind(deps) {
 
 // src/cli/proc.ts
 import { spawn } from "node:child_process";
-function run(cmd, args, cwd, opts = {}) {
+function run(cmd, args, cwd, opts2 = {}) {
   return new Promise((resolve, reject) => {
     const onWindows = process.platform === "win32";
-    const stdio = opts.stdio ?? "ignore";
+    const stdio = opts2.stdio ?? "ignore";
     const child = onWindows ? spawn([cmd, ...args].join(" "), { cwd, stdio, shell: true }) : spawn(cmd, args, { cwd, stdio });
     child.on("error", reject);
     child.on(
@@ -3923,9 +3923,9 @@ function describe(from, to) {
   if (remove.length) lines.push(`- ${remove.join(", ")}`);
   return lines.map((l2) => dim("  ") + l2).join("\n");
 }
-async function runConfigure(opts) {
+async function runConfigure(opts2) {
   intro(accent(" toiljs configure "));
-  const root = path2.resolve(opts.root ?? opts.cwd);
+  const root = path2.resolve(opts2.root ?? opts2.cwd);
   const pkgPath = path2.join(root, "package.json");
   let pkg;
   try {
@@ -3941,15 +3941,15 @@ async function runConfigure(opts) {
     tailwind: detectTailwind(deps)
   };
   const currentImages = await resolveImages(root);
-  const nonInteractive = opts.preprocessor !== void 0 || opts.tailwind !== void 0 || opts.images !== void 0;
+  const nonInteractive = opts2.preprocessor !== void 0 || opts2.tailwind !== void 0 || opts2.images !== void 0;
   let target;
   let targetImages;
   if (nonInteractive) {
     target = {
-      preprocessor: opts.preprocessor ?? current.preprocessor,
-      tailwind: opts.tailwind ?? current.tailwind
+      preprocessor: opts2.preprocessor ?? current.preprocessor,
+      tailwind: opts2.tailwind ?? current.tailwind
     };
-    targetImages = opts.images ?? currentImages;
+    targetImages = opts2.images ?? currentImages;
   } else {
     const ppChoice = await select({
       message: "CSS preprocessor",
@@ -3988,7 +3988,7 @@ async function runConfigure(opts) {
   s.stop("Updated project files");
   if (styleChanged) {
     const pm = await detectPackageManager(root);
-    if (opts.install === false) {
+    if (opts2.install === false) {
       note(`${import_picocolors2.default.cyan(`${pm} install`)} to sync the dependency changes.`, "Next step");
     } else {
       const i2 = spinner();
@@ -4066,7 +4066,7 @@ function scaffold(name, template, features, aiTools, images) {
     oxlint: "^1.83.0",
     "oxlint-tsgolint": "^7.0.2001",
     prettier: "^3.9.6",
-    toilscript: "^0.1.60",
+    toilscript: "^0.1.63",
     typescript: "^7.0.2"
   };
   for (const dep of requiredPackages(features).sort()) {
@@ -4094,10 +4094,8 @@ function scaffold(name, template, features, aiTools, images) {
   };
   const files = {
     "package.json": JSON.stringify(pkg, null, 4) + "\n",
-    "toil.config.ts": `import { defineConfig } from 'toiljs/compiler';
-
-export default defineConfig({
-    client: {
+    "toil.config.ts": "import { defineConfig } from 'toiljs/compiler';\n\nexport default defineConfig({\n" + // The app starter's session routes use the identity fields injected by built-in auth.
+    (template === "app" ? "    server: { auth: true },\n" : "") + `    client: {
         // Optimize images at build time (resize/compress imported images).
         images: ${String(images)},
     },
@@ -4407,11 +4405,11 @@ async function writeFiles(dir, files) {
     await fs3.writeFile(full, contents, "utf8");
   }
 }
-async function runCreate(opts) {
+async function runCreate(opts2) {
   intro(accent(" toiljs create "));
-  let name = opts.name;
+  let name = opts2.name;
   if (!name) {
-    if (opts.yes) {
+    if (opts2.yes) {
       name = "my-toil-app";
     } else {
       const answer = await text({
@@ -4432,14 +4430,14 @@ async function runCreate(opts) {
     cancel(valid);
     process.exit(1);
   }
-  const targetDir = resolveProjectDir(opts.cwd, name);
+  const targetDir = resolveProjectDir(opts2.cwd, name);
   if (targetDir === null) {
     cancel('Project name must stay inside the current directory (no "..", no absolute paths).');
     process.exit(1);
   }
-  const rel = path4.relative(opts.cwd, targetDir) || ".";
+  const rel = path4.relative(opts2.cwd, targetDir) || ".";
   if (!await isEmptyDir(targetDir)) {
-    if (opts.yes) {
+    if (opts2.yes) {
       cancel(`Directory ${import_picocolors3.default.cyan(rel)} is not empty.`);
       process.exit(1);
     }
@@ -4453,8 +4451,8 @@ async function runCreate(opts) {
       process.exit(0);
     }
   }
-  let template = opts.template ?? "app";
-  if (!opts.template && !opts.yes) {
+  let template = opts2.template ?? "app";
+  if (!opts2.template && !opts2.yes) {
     const templateOptions = [
       {
         value: "app",
@@ -4476,10 +4474,10 @@ async function runCreate(opts) {
     bail2(choice);
     template = choice === "minimal" || choice === "agent" ? choice : "app";
   }
-  let preprocessor = opts.preprocessor ?? "css";
-  let tailwind = opts.tailwind ?? false;
-  if (!opts.yes) {
-    if (opts.preprocessor === void 0) {
+  let preprocessor = opts2.preprocessor ?? "css";
+  let tailwind = opts2.tailwind ?? false;
+  if (!opts2.yes) {
+    if (opts2.preprocessor === void 0) {
       const choice = await select({
         message: "Styling",
         options: PREPROCESSORS.map((value) => ({
@@ -4491,15 +4489,15 @@ async function runCreate(opts) {
       bail2(choice);
       preprocessor = choice;
     }
-    if (opts.tailwind === void 0) {
+    if (opts2.tailwind === void 0) {
       const tw = await confirm({ message: "Add Tailwind CSS?", initialValue: false });
       bail2(tw);
       tailwind = tw;
     }
   }
   const features = { preprocessor, tailwind };
-  let aiTools = opts.ai === false ? [] : [...AI_HELPER_IDS];
-  if (opts.ai === void 0 && !opts.yes) {
+  let aiTools = opts2.ai === false ? [] : [...AI_HELPER_IDS];
+  if (opts2.ai === void 0 && !opts2.yes) {
     const picked = await multiselect({
       message: "AI assistant files (read by Claude, Cursor, Codex, Copilot)",
       options: [
@@ -4512,21 +4510,21 @@ async function runCreate(opts) {
     bail2(picked);
     aiTools = picked.includes("none") ? [] : picked;
   }
-  let images = opts.images ?? true;
-  if (opts.images === void 0 && !opts.yes) {
+  let images = opts2.images ?? true;
+  if (opts2.images === void 0 && !opts2.yes) {
     const im = await confirm({ message: "Optimize images at build time?", initialValue: true });
     bail2(im);
     images = im;
   }
-  let initGit = opts.git ?? false;
-  let install = opts.install ?? true;
-  const pm = opts.pm ?? "npm";
+  let initGit = opts2.git ?? false;
+  let install = opts2.install ?? true;
+  const pm = opts2.pm ?? "npm";
   if (!isPackageManager(pm)) {
     cancel(`Unsupported package manager: ${pm} (use npm, pnpm, yarn, or bun).`);
     process.exit(1);
   }
-  if (!opts.yes) {
-    if (opts.git === void 0) {
+  if (!opts2.yes) {
+    if (opts2.git === void 0) {
       const g = await confirm({
         message: "Initialize a git repository?",
         initialValue: true
@@ -4534,7 +4532,7 @@ async function runCreate(opts) {
       bail2(g);
       initGit = g;
     }
-    if (opts.install === void 0) {
+    if (opts2.install === void 0) {
       const i2 = await confirm({ message: "Install dependencies now?", initialValue: true });
       bail2(i2);
       install = i2;
@@ -4547,6 +4545,8 @@ async function runCreate(opts) {
     await fs3.cp(appClientDir(), path4.join(targetDir, "client"), { recursive: true });
     const serverAllow = /* @__PURE__ */ new Set([
       "main.ts",
+      "main.stream.ts",
+      "SsrHelloRender.ts",
       "README.md",
       "tsconfig.json",
       "toil-server-env.d.ts",
@@ -4554,6 +4554,7 @@ async function runCreate(opts) {
       "models",
       "routes",
       "services",
+      "streams",
       "scheduled"
     ]);
     const serverSrc = appServerDir();
@@ -4611,8 +4612,8 @@ async function runCreate(opts) {
 import fs4 from "node:fs";
 import path5 from "node:path";
 var FAMILIES = ["store", "views", "members", "counters", "events", "eventDedup", "capacity"];
-function devdataPath(opts) {
-  return path5.join(path5.resolve(opts.root ?? process.cwd()), ".toil", "devdata.json");
+function devdataPath(opts2) {
+  return path5.join(path5.resolve(opts2.root ?? process.cwd()), ".toil", "devdata.json");
 }
 function out(line) {
   process.stdout.write(line + "\n");
@@ -4634,8 +4635,8 @@ function familyCounts(file) {
 function isSnapshot(v) {
   return typeof v === "object" && v !== null && FAMILIES.every((f) => f in v);
 }
-function runDb(action, fileArg, opts) {
-  const file = devdataPath(opts);
+function runDb(action, fileArg, opts2) {
+  const file = devdataPath(opts2);
   const rel = path5.relative(process.cwd(), file) || file;
   switch (action) {
     case "reset":
@@ -5061,7 +5062,7 @@ function checkWasmBuilt(exists) {
     fix: "Run your server build (toilscript) before toiljs start."
   };
 }
-var RPC_TOILSCRIPT_MIN = "0.1.27";
+var RPC_TOILSCRIPT_MIN = "0.1.63";
 function checkRpcWiring(f) {
   const missing = [];
   if (!f.toilscriptOk) missing.push(`toilscript >=${RPC_TOILSCRIPT_MIN}`);
@@ -5722,8 +5723,8 @@ function renderHuman(groups) {
   out2.push("");
   process.stdout.write(out2.join("\n") + "\n");
 }
-async function runDoctor(opts) {
-  const root = path6.resolve(opts.root ?? opts.cwd);
+async function runDoctor(opts2) {
+  const root = path6.resolve(opts2.root ?? opts2.cwd);
   const meta = frameworkMeta();
   const projectPkg = readJsonObject(path6.join(root, "package.json"));
   const deps = {
@@ -5782,7 +5783,7 @@ async function runDoctor(opts) {
   }
   const peerName = (n3) => checkPeer(n3, deps[n3] ?? null, meta.peers[n3] ?? "*");
   const peerChecks = Object.keys(meta.peers).filter((n3) => n3 !== "typescript").map(peerName);
-  const typeScriptFix = opts.fix ? applyTypeScriptFix(root) : null;
+  const typeScriptFix = opts2.fix ? applyTypeScriptFix(root) : null;
   const declaredTypeScript = (() => {
     const pkg = readJsonObject(path6.join(root, "package.json"));
     if (pkg === null) return deps.typescript ?? null;
@@ -5798,9 +5799,9 @@ async function runDoctor(opts) {
     installedVersion(root, "typescript"),
     declaredTypeScript
   );
-  const rpcFix = serverPresent && opts.fix ? applyRpcFix(root) : null;
-  const prettierFix = serverPresent && opts.fix ? applyPrettierFix(root, projectPkg) : null;
-  const editorFix = opts.fix ? applyServerEditorFix(root, toilconfig) : null;
+  const rpcFix = serverPresent && opts2.fix ? applyRpcFix(root) : null;
+  const prettierFix = serverPresent && opts2.fix ? applyPrettierFix(root, projectPkg) : null;
+  const editorFix = opts2.fix ? applyServerEditorFix(root, toilconfig) : null;
   const rpcFacts = gatherRpcFacts(root);
   const restFacts = gatherRestFacts(root, toilconfig);
   const authFacts = gatherAuthFacts(root, toilconfig);
@@ -5887,7 +5888,7 @@ async function runDoctor(opts) {
     groups.push({ title: "Security", checks: [checkAuthSecrets(authFacts)] });
   }
   const summary = summarize(groups);
-  if (opts.json) {
+  if (opts2.json) {
     process.stdout.write(JSON.stringify({ groups, summary, fixed: serverFix }, null, 2) + "\n");
   } else {
     process.stdout.write("\n" + accent("  Doctor") + dim(`  ${root}`) + "\n\n");
@@ -5912,15 +5913,1019 @@ function renderFix(result) {
   process.stdout.write(out2.join("\n") + "\n\n");
 }
 
+// src/cli/generate.ts
+import { randomBytes as randomBytes3, timingSafeEqual } from "node:crypto";
+import fs6 from "node:fs";
+import path7 from "node:path";
+import { parseEnv } from "node:util";
+
+// node_modules/@noble/hashes/_u64.js
+var U32_MASK64 = /* @__PURE__ */ BigInt(2 ** 32 - 1);
+var _32n = /* @__PURE__ */ BigInt(32);
+function fromBig(n3, le = false) {
+  if (le)
+    return { h: Number(n3 & U32_MASK64), l: Number(n3 >> _32n & U32_MASK64) };
+  return { h: Number(n3 >> _32n & U32_MASK64) | 0, l: Number(n3 & U32_MASK64) | 0 };
+}
+function split(lst, le = false) {
+  const len = lst.length;
+  let Ah = new Uint32Array(len);
+  let Al = new Uint32Array(len);
+  for (let i2 = 0; i2 < len; i2++) {
+    const { h: h2, l: l2 } = fromBig(lst[i2], le);
+    [Ah[i2], Al[i2]] = [h2, l2];
+  }
+  return [Ah, Al];
+}
+var rotlSH = (h2, l2, s) => h2 << s | l2 >>> 32 - s;
+var rotlSL = (h2, l2, s) => l2 << s | h2 >>> 32 - s;
+var rotlBH = (h2, l2, s) => l2 << s - 32 | h2 >>> 64 - s;
+var rotlBL = (h2, l2, s) => h2 << s - 32 | l2 >>> 64 - s;
+
+// node_modules/@noble/hashes/utils.js
+function isBytes(a2) {
+  return a2 instanceof Uint8Array || ArrayBuffer.isView(a2) && a2.constructor.name === "Uint8Array" && "BYTES_PER_ELEMENT" in a2 && a2.BYTES_PER_ELEMENT === 1;
+}
+function anumber(n3, title = "") {
+  if (typeof n3 !== "number") {
+    const prefix = title && `"${title}" `;
+    throw new TypeError(`${prefix}expected number, got ${typeof n3}`);
+  }
+  if (!Number.isSafeInteger(n3) || n3 < 0) {
+    const prefix = title && `"${title}" `;
+    throw new RangeError(`${prefix}expected integer >= 0, got ${n3}`);
+  }
+}
+function abytes(value, length, title = "") {
+  const bytes = isBytes(value);
+  const len = value?.length;
+  const needsLen = length !== void 0;
+  if (!bytes || needsLen && len !== length) {
+    const prefix = title && `"${title}" `;
+    const ofLen = needsLen ? ` of length ${length}` : "";
+    const got = bytes ? `length=${len}` : `type=${typeof value}`;
+    const message = prefix + "expected Uint8Array" + ofLen + ", got " + got;
+    if (!bytes)
+      throw new TypeError(message);
+    throw new RangeError(message);
+  }
+  return value;
+}
+function aexists(instance, checkFinished = true) {
+  if (instance.destroyed)
+    throw new Error("Hash instance has been destroyed");
+  if (checkFinished && instance.finished)
+    throw new Error("Hash#digest() has already been called");
+}
+function aoutput(out2, instance) {
+  abytes(out2, void 0, "digestInto() output");
+  const min = instance.outputLen;
+  if (out2.length < min) {
+    throw new RangeError('"digestInto() output" expected to be of length >=' + min);
+  }
+}
+function u32(arr) {
+  return new Uint32Array(arr.buffer, arr.byteOffset, Math.floor(arr.byteLength / 4));
+}
+function clean(...arrays) {
+  for (let i2 = 0; i2 < arrays.length; i2++) {
+    arrays[i2].fill(0);
+  }
+}
+var isLE = /* @__PURE__ */ (() => new Uint8Array(new Uint32Array([287454020]).buffer)[0] === 68)();
+function byteSwap(word) {
+  return word << 24 & 4278190080 | word << 8 & 16711680 | word >>> 8 & 65280 | word >>> 24 & 255;
+}
+function byteSwap32(arr) {
+  for (let i2 = 0; i2 < arr.length; i2++) {
+    arr[i2] = byteSwap(arr[i2]);
+  }
+  return arr;
+}
+var swap32IfBE = isLE ? (u3) => u3 : byteSwap32;
+function createHasher(hashCons, info = {}) {
+  const hashC = (msg, opts2) => hashCons(opts2).update(msg).digest();
+  const tmp = hashCons(void 0);
+  hashC.outputLen = tmp.outputLen;
+  hashC.blockLen = tmp.blockLen;
+  hashC.canXOF = tmp.canXOF;
+  hashC.create = (opts2) => hashCons(opts2);
+  Object.assign(hashC, info);
+  return Object.freeze(hashC);
+}
+function randomBytes(bytesLength = 32) {
+  anumber(bytesLength, "bytesLength");
+  const cr = typeof globalThis === "object" ? globalThis.crypto : null;
+  if (typeof cr?.getRandomValues !== "function")
+    throw new Error("crypto.getRandomValues must be defined");
+  if (bytesLength > 65536)
+    throw new RangeError(`"bytesLength" expected <= 65536, got ${bytesLength}`);
+  return cr.getRandomValues(new Uint8Array(bytesLength));
+}
+var oidNist = (suffix) => ({
+  // Current NIST hashAlgs suffixes used here fit in one DER subidentifier octet.
+  // Larger suffix values would need base-128 OID encoding and a different length byte.
+  oid: Uint8Array.from([6, 9, 96, 134, 72, 1, 101, 3, 4, 2, suffix])
+});
+
+// node_modules/@noble/hashes/sha3.js
+var _0n = BigInt(0);
+var _1n = BigInt(1);
+var _2n = BigInt(2);
+var _7n = BigInt(7);
+var _256n = BigInt(256);
+var _0x71n = BigInt(113);
+var SHA3_PI = [];
+var SHA3_ROTL = [];
+var _SHA3_IOTA = [];
+for (let round = 0, R2 = _1n, x = 1, y2 = 0; round < 24; round++) {
+  [x, y2] = [y2, (2 * x + 3 * y2) % 5];
+  SHA3_PI.push(2 * (5 * y2 + x));
+  SHA3_ROTL.push((round + 1) * (round + 2) / 2 % 64);
+  let t2 = _0n;
+  for (let j = 0; j < 7; j++) {
+    R2 = (R2 << _1n ^ (R2 >> _7n) * _0x71n) % _256n;
+    if (R2 & _2n)
+      t2 ^= _1n << (_1n << BigInt(j)) - _1n;
+  }
+  _SHA3_IOTA.push(t2);
+}
+var IOTAS = split(_SHA3_IOTA, true);
+var SHA3_IOTA_H = IOTAS[0];
+var SHA3_IOTA_L = IOTAS[1];
+var rotlH = (h2, l2, s) => s > 32 ? rotlBH(h2, l2, s) : rotlSH(h2, l2, s);
+var rotlL = (h2, l2, s) => s > 32 ? rotlBL(h2, l2, s) : rotlSL(h2, l2, s);
+function keccakP(s, rounds = 24) {
+  anumber(rounds, "rounds");
+  if (rounds < 1 || rounds > 24)
+    throw new Error('"rounds" expected integer 1..24');
+  const B = new Uint32Array(5 * 2);
+  for (let round = 24 - rounds; round < 24; round++) {
+    for (let x = 0; x < 10; x++)
+      B[x] = s[x] ^ s[x + 10] ^ s[x + 20] ^ s[x + 30] ^ s[x + 40];
+    for (let x = 0; x < 10; x += 2) {
+      const idx1 = (x + 8) % 10;
+      const idx0 = (x + 2) % 10;
+      const B0 = B[idx0];
+      const B1 = B[idx0 + 1];
+      const Th = rotlH(B0, B1, 1) ^ B[idx1];
+      const Tl = rotlL(B0, B1, 1) ^ B[idx1 + 1];
+      for (let y2 = 0; y2 < 50; y2 += 10) {
+        s[x + y2] ^= Th;
+        s[x + y2 + 1] ^= Tl;
+      }
+    }
+    let curH = s[2];
+    let curL = s[3];
+    for (let t2 = 0; t2 < 24; t2++) {
+      const shift = SHA3_ROTL[t2];
+      const Th = rotlH(curH, curL, shift);
+      const Tl = rotlL(curH, curL, shift);
+      const PI = SHA3_PI[t2];
+      curH = s[PI];
+      curL = s[PI + 1];
+      s[PI] = Th;
+      s[PI + 1] = Tl;
+    }
+    for (let y2 = 0; y2 < 50; y2 += 10) {
+      const b0 = s[y2], b1 = s[y2 + 1], b2 = s[y2 + 2], b3 = s[y2 + 3];
+      s[y2] ^= ~s[y2 + 2] & s[y2 + 4];
+      s[y2 + 1] ^= ~s[y2 + 3] & s[y2 + 5];
+      s[y2 + 2] ^= ~s[y2 + 4] & s[y2 + 6];
+      s[y2 + 3] ^= ~s[y2 + 5] & s[y2 + 7];
+      s[y2 + 4] ^= ~s[y2 + 6] & s[y2 + 8];
+      s[y2 + 5] ^= ~s[y2 + 7] & s[y2 + 9];
+      s[y2 + 6] ^= ~s[y2 + 8] & b0;
+      s[y2 + 7] ^= ~s[y2 + 9] & b1;
+      s[y2 + 8] ^= ~b0 & b2;
+      s[y2 + 9] ^= ~b1 & b3;
+    }
+    s[0] ^= SHA3_IOTA_H[round];
+    s[1] ^= SHA3_IOTA_L[round];
+  }
+  clean(B);
+}
+var Keccak = class _Keccak {
+  state;
+  pos = 0;
+  posOut = 0;
+  finished = false;
+  state32;
+  destroyed = false;
+  blockLen;
+  suffix;
+  outputLen;
+  canXOF;
+  enableXOF = false;
+  rounds;
+  // NOTE: we accept arguments in bytes instead of bits here.
+  constructor(blockLen, suffix, outputLen, enableXOF = false, rounds = 24) {
+    this.blockLen = blockLen;
+    this.suffix = suffix;
+    this.outputLen = outputLen;
+    this.enableXOF = enableXOF;
+    this.canXOF = enableXOF;
+    this.rounds = rounds;
+    anumber(outputLen, "outputLen");
+    if (!(0 < blockLen && blockLen < 200))
+      throw new Error("only keccak-f1600 function is supported");
+    this.state = new Uint8Array(200);
+    this.state32 = u32(this.state);
+  }
+  clone() {
+    return this._cloneInto();
+  }
+  keccak() {
+    swap32IfBE(this.state32);
+    keccakP(this.state32, this.rounds);
+    swap32IfBE(this.state32);
+    this.posOut = 0;
+    this.pos = 0;
+  }
+  update(data) {
+    aexists(this);
+    abytes(data);
+    const { blockLen, state } = this;
+    const len = data.length;
+    for (let pos = 0; pos < len; ) {
+      const take = Math.min(blockLen - this.pos, len - pos);
+      for (let i2 = 0; i2 < take; i2++)
+        state[this.pos++] ^= data[pos++];
+      if (this.pos === blockLen)
+        this.keccak();
+    }
+    return this;
+  }
+  finish() {
+    if (this.finished)
+      return;
+    this.finished = true;
+    const { state, suffix, pos, blockLen } = this;
+    state[pos] ^= suffix;
+    if ((suffix & 128) !== 0 && pos === blockLen - 1)
+      this.keccak();
+    state[blockLen - 1] ^= 128;
+    this.keccak();
+  }
+  writeInto(out2) {
+    aexists(this, false);
+    abytes(out2);
+    this.finish();
+    const bufferOut = this.state;
+    const { blockLen } = this;
+    for (let pos = 0, len = out2.length; pos < len; ) {
+      if (this.posOut >= blockLen)
+        this.keccak();
+      const take = Math.min(blockLen - this.posOut, len - pos);
+      out2.set(bufferOut.subarray(this.posOut, this.posOut + take), pos);
+      this.posOut += take;
+      pos += take;
+    }
+    return out2;
+  }
+  xofInto(out2) {
+    if (!this.enableXOF)
+      throw new Error("XOF is not possible for this instance");
+    return this.writeInto(out2);
+  }
+  xof(bytes) {
+    anumber(bytes);
+    return this.xofInto(new Uint8Array(bytes));
+  }
+  digestInto(out2) {
+    aoutput(out2, this);
+    if (this.finished)
+      throw new Error("digest() was already called");
+    this.writeInto(out2.subarray(0, this.outputLen));
+    this.destroy();
+  }
+  digest() {
+    const out2 = new Uint8Array(this.outputLen);
+    this.digestInto(out2);
+    return out2;
+  }
+  destroy() {
+    this.destroyed = true;
+    clean(this.state);
+  }
+  _cloneInto(to) {
+    const { blockLen, suffix, outputLen, rounds, enableXOF } = this;
+    to ||= new _Keccak(blockLen, suffix, outputLen, enableXOF, rounds);
+    to.blockLen = blockLen;
+    to.state32.set(this.state32);
+    to.pos = this.pos;
+    to.posOut = this.posOut;
+    to.finished = this.finished;
+    to.rounds = rounds;
+    to.suffix = suffix;
+    to.outputLen = outputLen;
+    to.enableXOF = enableXOF;
+    to.canXOF = this.canXOF;
+    to.destroyed = this.destroyed;
+    return to;
+  }
+};
+var genKeccak = (suffix, blockLen, outputLen, info = {}) => createHasher(() => new Keccak(blockLen, suffix, outputLen), info);
+var sha3_256 = /* @__PURE__ */ genKeccak(
+  6,
+  136,
+  32,
+  /* @__PURE__ */ oidNist(8)
+);
+var sha3_512 = /* @__PURE__ */ genKeccak(
+  6,
+  72,
+  64,
+  /* @__PURE__ */ oidNist(10)
+);
+var genShake = (suffix, blockLen, outputLen, info = {}) => createHasher((opts2 = {}) => new Keccak(blockLen, suffix, opts2.dkLen === void 0 ? outputLen : opts2.dkLen, true), info);
+var shake128 = /* @__PURE__ */ genShake(31, 168, 16, /* @__PURE__ */ oidNist(11));
+var shake256 = /* @__PURE__ */ genShake(31, 136, 32, /* @__PURE__ */ oidNist(12));
+
+// node_modules/@dacely/noble-post-quantum/node_modules/@noble/curves/abstract/fft.js
+function checkU32(n3) {
+  if (!Number.isSafeInteger(n3) || n3 < 0 || n3 > 4294967295)
+    throw new Error("wrong u32 integer:" + n3);
+  return n3;
+}
+function isPowerOfTwo(x) {
+  checkU32(x);
+  return (x & x - 1) === 0 && x !== 0;
+}
+function reverseBits(n3, bits) {
+  checkU32(n3);
+  if (!Number.isSafeInteger(bits) || bits < 0 || bits > 32)
+    throw new Error(`expected integer 0 <= bits <= 32, got ${bits}`);
+  let reversed = 0;
+  for (let i2 = 0; i2 < bits; i2++, n3 >>>= 1)
+    reversed = reversed << 1 | n3 & 1;
+  return reversed >>> 0;
+}
+function log2(n3) {
+  checkU32(n3);
+  return 31 - Math.clz32(n3);
+}
+function bitReversalInplace(values) {
+  const n3 = values.length;
+  if (!isPowerOfTwo(n3))
+    throw new Error("expected positive power-of-two length, got " + n3);
+  const bits = log2(n3);
+  for (let i2 = 0; i2 < n3; i2++) {
+    const j = reverseBits(i2, bits);
+    if (i2 < j) {
+      const tmp = values[i2];
+      values[i2] = values[j];
+      values[j] = tmp;
+    }
+  }
+  return values;
+}
+var FFTCore = (F2, coreOpts) => {
+  const { N: N2, roots, dit, invertButterflies = false, skipStages = 0, brp = true } = coreOpts;
+  const bits = log2(N2);
+  if (!isPowerOfTwo(N2))
+    throw new Error("FFT: Polynomial size should be power of two");
+  if (roots.length !== N2)
+    throw new Error(`FFT: wrong roots length: expected ${N2}, got ${roots.length}`);
+  const isDit = dit !== invertButterflies;
+  isDit;
+  return (values) => {
+    if (values.length !== N2)
+      throw new Error("FFT: wrong Polynomial length");
+    if (dit && brp)
+      bitReversalInplace(values);
+    for (let i2 = 0, g = 1; i2 < bits - skipStages; i2++) {
+      const s = dit ? i2 + 1 + skipStages : bits - i2;
+      const m2 = 1 << s;
+      const m22 = m2 >> 1;
+      const stride = N2 >> s;
+      for (let k = 0; k < N2; k += m2) {
+        for (let j = 0, grp = g++; j < m22; j++) {
+          const rootPos = invertButterflies ? dit ? N2 - grp : grp : j * stride;
+          const i0 = k + j;
+          const i1 = k + j + m22;
+          const omega = roots[rootPos];
+          const b = values[i1];
+          const a2 = values[i0];
+          if (isDit) {
+            const t2 = F2.mul(b, omega);
+            values[i0] = F2.add(a2, t2);
+            values[i1] = F2.sub(a2, t2);
+          } else if (invertButterflies) {
+            values[i0] = F2.add(b, a2);
+            values[i1] = F2.mul(F2.sub(b, a2), omega);
+          } else {
+            values[i0] = F2.add(a2, b);
+            values[i1] = F2.mul(F2.sub(a2, b), omega);
+          }
+        }
+      }
+    }
+    if (!dit && brp)
+      bitReversalInplace(values);
+    return values;
+  };
+};
+
+// node_modules/@dacely/noble-post-quantum/utils.js
+var abytesDoc = abytes;
+var randomBytes2 = randomBytes;
+function aarray(item, title, inner = () => {
+}) {
+  if (!Array.isArray(item))
+    throw new TypeError(`"${title}" expected array, got type=${typeof item}`);
+  for (let i2 = 0; i2 < item.length; i2++)
+    inner(item[i2], `${title}[${i2}]`);
+  return item;
+}
+function equalBytes(a2, b) {
+  if (a2.length !== b.length)
+    return false;
+  let diff = 0;
+  for (let i2 = 0; i2 < a2.length; i2++)
+    diff |= a2[i2] ^ b[i2];
+  return diff === 0;
+}
+function copyBytes(bytes) {
+  return Uint8Array.from(abytes(bytes));
+}
+function splitCoder(label, ...lengths) {
+  const getLength = (c2) => typeof c2 === "number" ? c2 : c2.bytesLen;
+  const bytesLen = lengths.reduce((sum, a2) => sum + getLength(a2), 0);
+  return {
+    bytesLen,
+    encode: (bufs) => {
+      const res = new Uint8Array(bytesLen);
+      for (let i2 = 0, pos = 0; i2 < lengths.length; i2++) {
+        const c2 = lengths[i2];
+        const l2 = getLength(c2);
+        const b = typeof c2 === "number" ? bufs[i2] : c2.encode(bufs[i2]);
+        abytes(b, l2, label);
+        res.set(b, pos);
+        if (typeof c2 !== "number")
+          b.fill(0);
+        pos += l2;
+      }
+      return res;
+    },
+    decode: (buf) => {
+      abytes(buf, bytesLen, label);
+      const res = [];
+      for (const c2 of lengths) {
+        const l2 = getLength(c2);
+        const b = buf.subarray(0, l2);
+        res.push(typeof c2 === "number" ? b : c2.decode(b));
+        buf = buf.subarray(l2);
+      }
+      return res;
+    }
+  };
+}
+function vecCoder(c2, vecLen) {
+  const coder = c2;
+  const bytesLen = vecLen * coder.bytesLen;
+  return {
+    bytesLen,
+    encode: (u3) => {
+      const uArr = aarray(u3, "u");
+      if (uArr.length !== vecLen)
+        throw new RangeError(`vecCoder.encode: wrong length=${uArr.length}. Expected: ${vecLen}`);
+      const res = new Uint8Array(bytesLen);
+      for (let i2 = 0, pos = 0; i2 < uArr.length; i2++) {
+        const b = coder.encode(uArr[i2]);
+        res.set(b, pos);
+        b.fill(0);
+        pos += b.length;
+      }
+      return res;
+    },
+    decode: (a2) => {
+      abytes(a2, bytesLen);
+      const r2 = [];
+      for (let i2 = 0; i2 < a2.length; i2 += coder.bytesLen)
+        r2.push(coder.decode(a2.subarray(i2, i2 + coder.bytesLen)));
+      return r2;
+    }
+  };
+}
+function cleanBytes(...list) {
+  for (const t2 of list) {
+    if (Array.isArray(t2))
+      for (const b of t2)
+        b.fill(0);
+    else
+      t2.fill(0);
+  }
+}
+function getMask(bits) {
+  anumber(bits, "bits");
+  if (bits > 32)
+    throw new RangeError('"bits" expected <= 32, got ' + bits);
+  return bits === 32 ? 4294967295 : ~(-1 << bits) >>> 0;
+}
+
+// node_modules/@dacely/noble-post-quantum/_crystals.js
+var genCrystals = (opts2) => {
+  const { newPoly, N: N2, Q: Q2, F: F2, ROOT_OF_UNITY: ROOT_OF_UNITY2, brvBits, isKyber } = opts2;
+  const mod = (a2, modulo = Q2) => {
+    const result = a2 % modulo | 0;
+    return (result >= 0 ? result | 0 : modulo + result | 0) | 0;
+  };
+  const smod = (a2, modulo = Q2) => {
+    const r2 = mod(a2, modulo) | 0;
+    return (r2 > modulo >> 1 ? r2 - modulo | 0 : r2) | 0;
+  };
+  function getZettas() {
+    const out2 = newPoly(N2);
+    for (let i2 = 0; i2 < N2; i2++) {
+      const b = reverseBits(i2, brvBits);
+      const p = BigInt(ROOT_OF_UNITY2) ** BigInt(b) % BigInt(Q2);
+      out2[i2] = Number(p) | 0;
+    }
+    return out2;
+  }
+  const nttZetas = getZettas();
+  const field = {
+    add: (a2, b) => mod((a2 | 0) + (b | 0)) | 0,
+    sub: (a2, b) => mod((a2 | 0) - (b | 0)) | 0,
+    mul: (a2, b) => mod((a2 | 0) * (b | 0)) | 0,
+    inv: (_a) => {
+      throw new Error("not implemented");
+    }
+  };
+  const nttOpts = {
+    N: N2,
+    roots: nttZetas,
+    invertButterflies: true,
+    skipStages: isKyber ? 1 : 0,
+    brp: false
+  };
+  const dif = FFTCore(field, { dit: false, ...nttOpts });
+  const dit = FFTCore(field, { dit: true, ...nttOpts });
+  const NTT = {
+    encode: (r2) => {
+      return dif(r2);
+    },
+    decode: (r2) => {
+      dit(r2);
+      for (let i2 = 0; i2 < r2.length; i2++)
+        r2[i2] = mod(F2 * r2[i2]);
+      return r2;
+    }
+  };
+  const bitsCoder = (d, c2) => {
+    const mask = getMask(d);
+    const bytesLen = d * (N2 / 8);
+    return {
+      bytesLen,
+      encode: (poly_) => {
+        const poly = poly_;
+        const r2 = new Uint8Array(bytesLen);
+        for (let i2 = 0, buf = 0, bufLen = 0, pos = 0; i2 < poly.length; i2++) {
+          buf |= (c2.encode(poly[i2]) & mask) << bufLen;
+          bufLen += d;
+          for (; bufLen >= 8; bufLen -= 8, buf >>= 8)
+            r2[pos++] = buf & getMask(bufLen);
+        }
+        return r2;
+      },
+      decode: (bytes) => {
+        const r2 = newPoly(N2);
+        for (let i2 = 0, buf = 0, bufLen = 0, pos = 0; i2 < bytes.length; i2++) {
+          buf |= bytes[i2] << bufLen;
+          bufLen += 8;
+          for (; bufLen >= d; bufLen -= d, buf >>= d)
+            r2[pos++] = c2.decode(buf & mask);
+        }
+        return r2;
+      }
+    };
+  };
+  return {
+    mod,
+    smod,
+    nttZetas,
+    NTT: {
+      encode: (r2) => NTT.encode(r2),
+      decode: (r2) => NTT.decode(r2)
+    },
+    bitsCoder
+  };
+};
+var createXofShake = (shake) => (seed, blockLen) => {
+  if (!blockLen)
+    blockLen = shake.blockLen;
+  const _seed = new Uint8Array(seed.length + 2);
+  _seed.set(seed);
+  const seedLen = seed.length;
+  const buf = new Uint8Array(blockLen);
+  let h2 = shake.create({});
+  let calls = 0;
+  let xofs = 0;
+  return {
+    stats: () => ({ calls, xofs }),
+    get: (x, y2) => {
+      _seed[seedLen + 0] = x;
+      _seed[seedLen + 1] = y2;
+      h2.destroy();
+      h2 = shake.create({}).update(_seed);
+      calls++;
+      return () => {
+        xofs++;
+        return h2.xofInto(buf);
+      };
+    },
+    clean: () => {
+      h2.destroy();
+      cleanBytes(buf, _seed);
+    }
+  };
+};
+var XOF128 = /* @__PURE__ */ createXofShake(shake128);
+
+// node_modules/@dacely/noble-post-quantum/ml-kem.js
+var N = 256;
+var Q = 3329;
+var F = 3303;
+var ROOT_OF_UNITY = 17;
+var crystals = /* @__PURE__ */ genCrystals({
+  N,
+  Q,
+  F,
+  ROOT_OF_UNITY,
+  newPoly: (n3) => new Uint16Array(n3),
+  brvBits: 7,
+  isKyber: true
+});
+var PARAMS = /* @__PURE__ */ (() => Object.freeze({
+  512: Object.freeze({ N, Q, K: 2, ETA1: 3, ETA2: 2, du: 10, dv: 4, RBGstrength: 128 }),
+  768: Object.freeze({ N, Q, K: 3, ETA1: 2, ETA2: 2, du: 10, dv: 4, RBGstrength: 192 }),
+  1024: Object.freeze({ N, Q, K: 4, ETA1: 2, ETA2: 2, du: 11, dv: 5, RBGstrength: 256 })
+}))();
+var compress = (d) => {
+  if (d >= 12)
+    return { encode: (i2) => i2, decode: (i2) => i2 >= Q ? i2 - Q : i2 };
+  const a2 = 2 ** (d - 1);
+  return {
+    // This only matches standalone Compress_d after bitsCoder masks the result into Z_(2^d).
+    encode: (i2) => ((i2 << d) + Q / 2) / Q,
+    // const decompress = (i: number) => round((Q / 2 ** d) * i);
+    decode: (i2) => i2 * Q + a2 >>> d
+  };
+};
+var byteCoder = (d) => crystals.bitsCoder(d, d === 12 ? { encode: (i2) => i2, decode: (i2) => i2 >= Q ? i2 - Q : i2 } : { encode: (i2) => i2, decode: (i2) => i2 });
+var polyCoder = (d) => d === 12 ? byteCoder(12) : crystals.bitsCoder(d, compress(d));
+function polyAdd(a_, b_) {
+  const a2 = a_;
+  const b = b_;
+  for (let i2 = 0; i2 < N; i2++)
+    a2[i2] = crystals.mod(a2[i2] + b[i2]);
+}
+function polySub(a_, b_) {
+  const a2 = a_;
+  const b = b_;
+  for (let i2 = 0; i2 < N; i2++)
+    a2[i2] = crystals.mod(a2[i2] - b[i2]);
+}
+function BaseCaseMultiply(a0, a1, b0, b1, zeta) {
+  const c0 = crystals.mod(a1 * b1 * zeta + a0 * b0);
+  const c1 = crystals.mod(a0 * b1 + a1 * b0);
+  return { c0, c1 };
+}
+function MultiplyNTTs(f_, g_) {
+  const f = f_;
+  const g = g_;
+  for (let i2 = 0; i2 < N / 2; i2++) {
+    let z = crystals.nttZetas[64 + (i2 >> 1)];
+    if (i2 & 1)
+      z = -z;
+    const { c0, c1 } = BaseCaseMultiply(f[2 * i2 + 0], f[2 * i2 + 1], g[2 * i2 + 0], g[2 * i2 + 1], z);
+    f[2 * i2 + 0] = c0;
+    f[2 * i2 + 1] = c1;
+  }
+  return f;
+}
+function SampleNTT(xof_) {
+  const xof = xof_;
+  const r2 = new Uint16Array(N);
+  for (let j = 0; j < N; ) {
+    const b = xof();
+    if (b.length % 3)
+      throw new Error("SampleNTT: unaligned block");
+    for (let i2 = 0; j < N && i2 + 3 <= b.length; i2 += 3) {
+      const d1 = (b[i2 + 0] >> 0 | b[i2 + 1] << 8) & 4095;
+      const d2 = (b[i2 + 1] >> 4 | b[i2 + 2] << 4) & 4095;
+      if (d1 < Q)
+        r2[j++] = d1;
+      if (j < N && d2 < Q)
+        r2[j++] = d2;
+    }
+  }
+  return r2;
+}
+var sampleCBDBytes = (buf, eta) => {
+  const r2 = new Uint16Array(N);
+  const b32 = u32(buf);
+  swap32IfBE(b32);
+  let len = 0;
+  for (let i2 = 0, p = 0, bb = 0, t0 = 0; i2 < b32.length; i2++) {
+    let b = b32[i2];
+    for (let j = 0; j < 32; j++) {
+      bb += b & 1;
+      b >>= 1;
+      len += 1;
+      if (len === eta) {
+        t0 = bb;
+        bb = 0;
+      } else if (len === 2 * eta) {
+        r2[p++] = crystals.mod(t0 - bb);
+        bb = 0;
+        len = 0;
+      }
+    }
+  }
+  swap32IfBE(b32);
+  if (len)
+    throw new Error(`sampleCBD: leftover bits: ${len}`);
+  return r2;
+};
+function sampleCBD(PRF_, seed, nonce, eta) {
+  const PRF = PRF_;
+  return sampleCBDBytes(PRF(eta * N / 4, seed, nonce), eta);
+}
+var genKPKE = (opts_) => {
+  const opts2 = opts_;
+  const { K, PRF, XOF, HASH512, ETA1, ETA2, du, dv } = opts2;
+  const poly1 = polyCoder(1);
+  const polyV = polyCoder(dv);
+  const polyU = polyCoder(du);
+  const publicCoder = splitCoder("publicKey", vecCoder(polyCoder(12), K), 32);
+  const secretCoder = vecCoder(polyCoder(12), K);
+  const cipherCoder = splitCoder("ciphertext", vecCoder(polyU, K), polyV);
+  const seedCoder = splitCoder("seed", 32, 32);
+  return {
+    secretCoder,
+    lengths: {
+      secretKey: secretCoder.bytesLen,
+      publicKey: publicCoder.bytesLen,
+      cipherText: cipherCoder.bytesLen
+    },
+    keygen: (seed) => {
+      abytesDoc(seed, 32, "seed");
+      const seedDst = new Uint8Array(33);
+      seedDst.set(seed);
+      seedDst[32] = K;
+      const seedHash = HASH512(seedDst);
+      const [rho, sigma] = seedCoder.decode(seedHash);
+      const sHat = [];
+      const tHat = [];
+      for (let i2 = 0; i2 < K; i2++)
+        sHat.push(crystals.NTT.encode(sampleCBD(PRF, sigma, i2, ETA1)));
+      const x = XOF(rho);
+      for (let i2 = 0; i2 < K; i2++) {
+        const e = crystals.NTT.encode(sampleCBD(PRF, sigma, K + i2, ETA1));
+        for (let j = 0; j < K; j++) {
+          const aji = SampleNTT(x.get(j, i2));
+          polyAdd(e, MultiplyNTTs(aji, sHat[j]));
+        }
+        tHat.push(e);
+      }
+      x.clean();
+      const res = {
+        publicKey: publicCoder.encode([tHat, rho]),
+        secretKey: secretCoder.encode(sHat)
+      };
+      cleanBytes(rho, sigma, sHat, tHat, seedDst, seedHash);
+      return res;
+    },
+    encrypt: (publicKey, msg, seed) => {
+      const [tHat, rho] = publicCoder.decode(publicKey);
+      const rHat = [];
+      for (let i2 = 0; i2 < K; i2++)
+        rHat.push(crystals.NTT.encode(sampleCBD(PRF, seed, i2, ETA1)));
+      const x = XOF(rho);
+      const tmp2 = new Uint16Array(N);
+      const u3 = [];
+      for (let i2 = 0; i2 < K; i2++) {
+        const e1 = sampleCBD(PRF, seed, K + i2, ETA2);
+        const tmp = new Uint16Array(N);
+        for (let j = 0; j < K; j++) {
+          const aij = SampleNTT(x.get(i2, j));
+          polyAdd(tmp, MultiplyNTTs(aij, rHat[j]));
+        }
+        polyAdd(e1, crystals.NTT.decode(tmp));
+        u3.push(e1);
+        polyAdd(tmp2, MultiplyNTTs(tHat[i2], rHat[i2]));
+        cleanBytes(tmp);
+      }
+      x.clean();
+      const e2 = sampleCBD(PRF, seed, 2 * K, ETA2);
+      polyAdd(e2, crystals.NTT.decode(tmp2));
+      const v = poly1.decode(msg);
+      polyAdd(v, e2);
+      cleanBytes(tHat, rHat, tmp2, e2);
+      return cipherCoder.encode([u3, v]);
+    },
+    decrypt: (cipherText, privateKey) => {
+      const [u3, v] = cipherCoder.decode(cipherText);
+      const sk = secretCoder.decode(privateKey);
+      const tmp = new Uint16Array(N);
+      for (let i2 = 0; i2 < K; i2++)
+        polyAdd(tmp, MultiplyNTTs(sk[i2], crystals.NTT.encode(u3[i2])));
+      polySub(v, crystals.NTT.decode(tmp));
+      cleanBytes(tmp, sk, u3);
+      return poly1.encode(v);
+    }
+  };
+};
+function createKyber(opts2) {
+  const rawOpts = opts2;
+  const KPKE = genKPKE(rawOpts);
+  const { HASH256, HASH512, KDF } = rawOpts;
+  const { secretCoder: KPKESecretCoder, lengths } = KPKE;
+  const secretCoder = splitCoder("secretKey", lengths.secretKey, lengths.publicKey, 32, 32);
+  const msgLen = 32;
+  const seedLen = 64;
+  const kemLengths = Object.freeze({
+    ...lengths,
+    seed: 64,
+    msg: msgLen,
+    msgRand: msgLen,
+    secretKey: secretCoder.bytesLen
+  });
+  return Object.freeze({
+    info: Object.freeze({ type: "ml-kem" }),
+    lengths: kemLengths,
+    keygen: (seed = randomBytes2(seedLen)) => {
+      abytesDoc(seed, seedLen, "seed");
+      const { publicKey, secretKey: sk } = KPKE.keygen(seed.subarray(0, 32));
+      const publicKeyHash = HASH256(publicKey);
+      const secretKey = secretCoder.encode([sk, publicKey, publicKeyHash, seed.subarray(32)]);
+      cleanBytes(sk, publicKeyHash);
+      return {
+        publicKey,
+        secretKey
+      };
+    },
+    getPublicKey: (secretKey) => {
+      const [_sk, publicKey, _publicKeyHash, _z] = secretCoder.decode(secretKey);
+      return Uint8Array.from(publicKey);
+    },
+    encapsulate: (publicKey, msg = randomBytes2(msgLen)) => {
+      abytesDoc(publicKey, lengths.publicKey, "publicKey");
+      abytesDoc(msg, msgLen, "message");
+      const eke = publicKey.subarray(0, 384 * opts2.K);
+      const ek = KPKESecretCoder.encode(KPKESecretCoder.decode(copyBytes(eke)));
+      if (!equalBytes(ek, eke)) {
+        cleanBytes(ek);
+        throw new Error("ML-KEM.encapsulate: wrong publicKey modulus");
+      }
+      cleanBytes(ek);
+      const kr = HASH512.create().update(msg).update(HASH256(publicKey)).digest();
+      const cipherText = KPKE.encrypt(publicKey, msg, kr.subarray(32, 64));
+      cleanBytes(kr.subarray(32));
+      return {
+        cipherText,
+        sharedSecret: kr.subarray(0, 32)
+      };
+    },
+    decapsulate: (cipherText, secretKey) => {
+      abytesDoc(secretKey, secretCoder.bytesLen, "secretKey");
+      abytesDoc(cipherText, lengths.cipherText, "cipherText");
+      const k768 = secretCoder.bytesLen - 96;
+      const start2 = k768 + 32;
+      const test = HASH256(secretKey.subarray(k768 / 2, start2));
+      if (!equalBytes(test, secretKey.subarray(start2, start2 + 32)))
+        throw new Error("invalid secretKey: hash check failed");
+      const [sk, publicKey, publicKeyHash, z] = secretCoder.decode(secretKey);
+      const msg = KPKE.decrypt(cipherText, sk);
+      const kr = HASH512.create().update(msg).update(publicKeyHash).digest();
+      const Khat = kr.subarray(0, 32);
+      const cipherText2 = KPKE.encrypt(publicKey, msg, kr.subarray(32, 64));
+      const isValid = equalBytes(cipherText, cipherText2);
+      const Kbar = KDF.create({ dkLen: 32 }).update(z).update(cipherText).digest();
+      cleanBytes(msg, cipherText2, !isValid ? Khat : Kbar);
+      return isValid ? Khat : Kbar;
+    }
+  });
+}
+function shakePRF(dkLen, key, nonce) {
+  return shake256.create({ dkLen }).update(key).update(new Uint8Array([nonce])).digest();
+}
+var opts = /* @__PURE__ */ (() => ({
+  HASH256: sha3_256,
+  HASH512: sha3_512,
+  KDF: shake256,
+  XOF: XOF128,
+  PRF: shakePRF
+}))();
+var mk = (params) => createKyber({
+  ...opts,
+  ...params
+});
+var ml_kem768 = /* @__PURE__ */ (() => mk(PARAMS[768]))();
+
+// src/cli/generate.ts
+var PRIVATE_KEYS = ["AUTH_SESSION_SECRET", "AUTH_OPRF_SEED", "AUTH_KEM_SK"];
+var PUBLIC_KEY = "VITE_AUTH_KEM_PUBLIC_KEY";
+function read(file) {
+  const stat = fs6.lstatSync(file, { throwIfNoEntry: false });
+  if (!stat) return "";
+  if (!stat.isFile()) throw new Error(`Expected a regular file: ${file}`);
+  return fs6.readFileSync(file, "utf8");
+}
+function append(text2, lines) {
+  if (!lines.length) return text2;
+  return text2 + (text2 && !text2.endsWith("\n") ? "\n" : "") + lines.join("\n") + "\n";
+}
+function publicKeyFor(secret) {
+  try {
+    if (!/^[0-9a-fA-F]{4800}$/.test(secret)) throw new Error();
+    const sk = Buffer.from(secret, "hex");
+    const pk = ml_kem768.getPublicKey(sk);
+    const { cipherText, sharedSecret } = ml_kem768.encapsulate(pk);
+    if (!timingSafeEqual(sharedSecret, ml_kem768.decapsulate(cipherText, sk)))
+      throw new Error();
+    return Buffer.from(pk).toString("hex");
+  } catch {
+    throw new Error(
+      "AUTH_KEM_SK is not a valid ML-KEM-768 secret key. Existing files were not changed."
+    );
+  }
+}
+function runGenerate(target, opts2 = {}) {
+  if (target !== "auth") throw new Error("Usage: toiljs generate auth [--root <dir>]");
+  const root = path7.resolve(opts2.root ?? process.cwd());
+  const envFile = path7.join(root, ".env");
+  const secretsFile = path7.join(root, ".env.secrets");
+  const ignoreFile = path7.join(root, ".gitignore");
+  const envText = read(envFile);
+  const secretsText = read(secretsFile);
+  const ignoreText = read(ignoreFile);
+  const env = parseEnv(envText);
+  const secrets = parseEnv(secretsText);
+  for (const key of PRIVATE_KEYS) {
+    if (Object.hasOwn(env, key))
+      throw new Error(`Move ${key} from .env to .env.secrets before generating auth keys.`);
+    if (Object.hasOwn(secrets, key) && !secrets[key]?.trim())
+      throw new Error(
+        `${key} is empty in .env.secrets. Remove the empty assignment to generate it.`
+      );
+  }
+  if (Object.hasOwn(env, PUBLIC_KEY) && !secrets.AUTH_KEM_SK)
+    throw new Error(
+      "A public key already exists. Restore its matching AUTH_KEM_SK in .env.secrets; no keys were changed."
+    );
+  const additions = [];
+  let publicKey;
+  if (secrets.AUTH_KEM_SK) {
+    publicKey = publicKeyFor(secrets.AUTH_KEM_SK);
+  } else {
+    const pair = ml_kem768.keygen();
+    publicKey = Buffer.from(pair.publicKey).toString("hex");
+    additions.push(`AUTH_KEM_SK=${Buffer.from(pair.secretKey).toString("hex")}`);
+  }
+  if (Object.hasOwn(env, PUBLIC_KEY) && env[PUBLIC_KEY] !== publicKey)
+    throw new Error(
+      "VITE_AUTH_KEM_PUBLIC_KEY does not match AUTH_KEM_SK. Existing files were not changed. Restore the matching pair before continuing."
+    );
+  for (const key of ["AUTH_SESSION_SECRET", "AUTH_OPRF_SEED"]) {
+    if (!Object.hasOwn(secrets, key))
+      additions.push(`${key}=${randomBytes3(32).toString("hex")}`);
+  }
+  const publicAdditions = Object.hasOwn(env, PUBLIC_KEY) ? [] : [`${PUBLIC_KEY}=${publicKey}`];
+  const ignoreLines = new Set(ignoreText.split(/\r?\n/));
+  const ignoreAdditions = ["/.env", "/.env.secrets"].filter((line) => !ignoreLines.has(line));
+  if (ignoreAdditions.length) fs6.writeFileSync(ignoreFile, append(ignoreText, ignoreAdditions));
+  if (fs6.existsSync(secretsFile)) fs6.chmodSync(secretsFile, 384);
+  if (additions.length)
+    fs6.writeFileSync(secretsFile, append(secretsText, additions), { mode: 384 });
+  if (publicAdditions.length)
+    fs6.writeFileSync(envFile, append(envText, publicAdditions), { mode: 384 });
+  process.stdout.write(
+    [
+      `Authentication keys ready in ${root}. Existing credentials were preserved.`,
+      "  .env.secrets: AUTH_SESSION_SECRET, AUTH_OPRF_SEED, AUTH_KEM_SK (private; mode 0600)",
+      "  .env: VITE_AUTH_KEM_PUBLIC_KEY (public; pin it with Auth login/register options)",
+      "Back up .env.secrets securely. This command does not rotate existing keys.",
+      "For toil-backend, merge private settings into /run/toil/env/<host>.env.secrets",
+      "(or TOIL_ENV_DIR); use toil env sync <host> if the env store is database-backed.",
+      "Keep VITE_AUTH_KEM_PUBLIC_KEY in the project .env on the build machine, then rebuild",
+      "and deploy the client. Backend runtime env changes cannot update the browser bundle.",
+      ""
+    ].join("\n")
+  );
+}
+
 // src/cli/notify.ts
-import fs7 from "node:fs";
+import fs8 from "node:fs";
 import os from "node:os";
-import path8 from "node:path";
+import path9 from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 
 // src/cli/update.ts
-import fs6 from "node:fs";
-import path7 from "node:path";
+import fs7 from "node:fs";
+import path8 from "node:path";
 
 // src/cli/updates.ts
 function parseVersion2(v) {
@@ -5963,13 +6968,13 @@ function buildRows(upgraded, currentDeps) {
 
 // src/cli/update.ts
 function detectPackageManager2(root) {
-  if (fs6.existsSync(path7.join(root, "pnpm-lock.yaml"))) return { name: "pnpm", ncuName: "pnpm" };
-  if (fs6.existsSync(path7.join(root, "yarn.lock"))) return { name: "yarn", ncuName: "yarn" };
-  if (fs6.existsSync(path7.join(root, "bun.lockb"))) return { name: "bun", ncuName: "bun" };
+  if (fs7.existsSync(path8.join(root, "pnpm-lock.yaml"))) return { name: "pnpm", ncuName: "pnpm" };
+  if (fs7.existsSync(path8.join(root, "yarn.lock"))) return { name: "yarn", ncuName: "yarn" };
+  if (fs7.existsSync(path8.join(root, "bun.lockb"))) return { name: "bun", ncuName: "bun" };
   return { name: "npm", ncuName: "npm" };
 }
 function readDependencies(pkgPath) {
-  const parsed = JSON.parse(fs6.readFileSync(pkgPath, "utf8"));
+  const parsed = JSON.parse(fs7.readFileSync(pkgPath, "utf8"));
   if (typeof parsed !== "object" || parsed === null) return {};
   const pkg = parsed;
   const merge = (v) => {
@@ -5997,26 +7002,26 @@ function serverDirs(root) {
   const dirs = /* @__PURE__ */ new Set();
   try {
     const parsed = JSON.parse(
-      fs6.readFileSync(path7.join(root, "toilconfig.json"), "utf8")
+      fs7.readFileSync(path8.join(root, "toilconfig.json"), "utf8")
     );
     const entries = typeof parsed === "object" && parsed !== null && Array.isArray(parsed.entries) ? parsed.entries.filter(
       (e) => typeof e === "string"
     ) : [];
-    for (const e of entries) dirs.add(path7.dirname(path7.resolve(root, e)));
+    for (const e of entries) dirs.add(path8.dirname(path8.resolve(root, e)));
   } catch {
   }
-  if (dirs.size === 0) dirs.add(path7.join(root, "server"));
+  if (dirs.size === 0) dirs.add(path8.join(root, "server"));
   return [...dirs];
 }
 function ensureMigrationsDirs(root) {
   const created = [];
   for (const dir of serverDirs(root)) {
-    if (!fs6.existsSync(dir)) continue;
-    const migrations = path7.join(dir, "migrations");
-    if (fs6.existsSync(migrations)) continue;
-    fs6.mkdirSync(migrations, { recursive: true });
-    fs6.writeFileSync(path7.join(migrations, "README.md"), MIGRATIONS_README);
-    created.push(path7.relative(root, migrations) || "migrations");
+    if (!fs7.existsSync(dir)) continue;
+    const migrations = path8.join(dir, "migrations");
+    if (fs7.existsSync(migrations)) continue;
+    fs7.mkdirSync(migrations, { recursive: true });
+    fs7.writeFileSync(path8.join(migrations, "README.md"), MIGRATIONS_README);
+    created.push(path8.relative(root, migrations) || "migrations");
   }
   return created;
 }
@@ -6038,15 +7043,15 @@ function noteWithheld(names) {
   );
 }
 var TARGETS = /* @__PURE__ */ new Set(["latest", "minor", "patch", "newest", "greatest"]);
-async function runUpdate(opts) {
-  const root = path7.resolve(opts.root ?? opts.cwd);
-  const pkgPath = path7.join(root, "package.json");
-  if (!fs6.existsSync(pkgPath)) {
+async function runUpdate(opts2) {
+  const root = path8.resolve(opts2.root ?? opts2.cwd);
+  const pkgPath = path8.join(root, "package.json");
+  if (!fs7.existsSync(pkgPath)) {
     throw new Error("No package.json here. Run from your project root or pass --root <dir>.");
   }
   const currentDeps = readDependencies(pkgPath);
   const pm = detectPackageManager2(root);
-  const target = opts.target && TARGETS.has(opts.target) ? opts.target : "latest";
+  const target = opts2.target && TARGETS.has(opts2.target) ? opts2.target : "latest";
   const ncuArgs = (extra) => [
     "--yes",
     "npm-check-updates",
@@ -6103,7 +7108,7 @@ async function runUpdate(opts) {
     `${danger(`${String(counts.major)} major`)}  ${warn(`${String(counts.minor)} minor`)}  ${success(`${String(counts.patch)} patch`)}`
   );
   let selected;
-  if (opts.yes) {
+  if (opts2.yes) {
     selected = rows.map((r2) => r2.name);
   } else {
     const answer = await multiselect({
@@ -6126,7 +7131,7 @@ async function runUpdate(opts) {
     outro(dim("No packages selected."));
     return;
   }
-  const pkg = JSON.parse(fs6.readFileSync(pkgPath, "utf8"));
+  const pkg = JSON.parse(fs7.readFileSync(pkgPath, "utf8"));
   const targetTypeScript = selected.includes("typescript") ? upgraded.typescript : currentDeps.typescript;
   if (!targetTypeScript || !isSupportedTypeScriptRange(targetTypeScript)) {
     throw new Error("Select the TypeScript 7 migration before installing updates.");
@@ -6152,7 +7157,7 @@ async function runUpdate(opts) {
       pkg.devDependencies = deps;
     }
   }
-  fs6.writeFileSync(pkgPath, JSON.stringify(pkg, null, 4) + "\n");
+  fs7.writeFileSync(pkgPath, JSON.stringify(pkg, null, 4) + "\n");
   s.stop("package.json updated");
   note(dim(`Running ${pm.name} install\u2026`), "Install");
   try {
@@ -6243,8 +7248,8 @@ function findOutdated(latest, projectVersion, cliVersion, cliIsLocal, pm) {
 var REGISTRY_URL = "https://registry.npmjs.org/toiljs/latest";
 var FETCH_TIMEOUT_MS = 2e3;
 function cacheFile() {
-  const base = process.env.XDG_CACHE_HOME ?? path8.join(os.homedir(), ".cache");
-  return path8.join(base, "toiljs", "update-check.json");
+  const base = process.env.XDG_CACHE_HOME ?? path9.join(os.homedir(), ".cache");
+  return path9.join(base, "toiljs", "update-check.json");
 }
 async function fetchLatest() {
   const ctrl = new AbortController();
@@ -6270,22 +7275,22 @@ async function fetchLatest() {
 async function resolveLatest() {
   const file = cacheFile();
   try {
-    const cached = parseCheckCache(fs7.readFileSync(file, "utf8"));
+    const cached = parseCheckCache(fs8.readFileSync(file, "utf8"));
     if (cached && isCacheFresh(cached, Date.now())) return cached.latest;
   } catch {
   }
   const latest = await fetchLatest();
   try {
-    fs7.mkdirSync(path8.dirname(file), { recursive: true });
-    fs7.writeFileSync(file, JSON.stringify({ latest, checkedAt: Date.now() }));
+    fs8.mkdirSync(path9.dirname(file), { recursive: true });
+    fs8.writeFileSync(file, JSON.stringify({ latest, checkedAt: Date.now() }));
   } catch {
   }
   return latest;
 }
 function projectToiljsVersion(root) {
   try {
-    const raw = fs7.readFileSync(
-      path8.join(root, "node_modules", "toiljs", "package.json"),
+    const raw = fs8.readFileSync(
+      path9.join(root, "node_modules", "toiljs", "package.json"),
       "utf8"
     );
     const parsed = JSON.parse(raw);
@@ -6310,9 +7315,9 @@ async function notifyIfOutdated(rootArg) {
     if (env.TOILJS_NO_UPDATE_CHECK || env.NO_UPDATE_NOTIFIER || env.CI) return;
     const latest = await resolveLatest();
     if (!latest) return;
-    const root = path8.resolve(rootArg ?? process.cwd());
-    const cliDir = path8.dirname(fileURLToPath4(import.meta.url));
-    const cliIsLocal = cliDir.startsWith(path8.join(root, "node_modules") + path8.sep);
+    const root = path9.resolve(rootArg ?? process.cwd());
+    const cliDir = path9.dirname(fileURLToPath4(import.meta.url));
+    const cliIsLocal = cliDir.startsWith(path9.join(root, "node_modules") + path9.sep);
     const rows = findOutdated(
       latest,
       projectToiljsVersion(root),
@@ -6431,6 +7436,7 @@ function printHelp() {
       bold("Commands"),
       cmd("create [name]", "scaffold a new toiljs app"),
       cmd("configure", "toggle styling features (Sass/Less/Stylus, Tailwind)"),
+      cmd("generate auth", "generate private auth keys and the matching client public key"),
       cmd("dev", "start the dev server with HMR"),
       cmd("build", "build the optimized production bundle"),
       cmd("start", "self-host the built app (hyper-express / uWS)"),
@@ -6497,6 +7503,9 @@ async function main() {
         cwd: process.cwd()
       });
       break;
+    case "generate":
+      runGenerate(flags.name, { root: flags.root });
+      break;
     case "dev":
       banner();
       process.stdout.write(dim("  starting dev server\u2026") + "\n\n");
@@ -6522,7 +7531,7 @@ async function main() {
         threads: flags.threads
       });
       const wildcard = server.host === "0.0.0.0" || server.host === "::" || server.host === "";
-      const shownHost = wildcard ? "localhost" : server.host;
+      const shownHost = wildcard || server.host === "127.0.0.1" ? "localhost" : server.host;
       const exposed = server.host !== "127.0.0.1" && server.host !== "localhost" && server.host !== "::1";
       process.stdout.write(
         accent("  \u279C ") + bold(`http://${shownHost}:${String(server.port)}`) + dim(`   ws channel: ${server.wsPath}`) + (exposed ? "\n" + dim(`     bound to ${server.host}:${String(server.port)} (exposed beyond loopback)`) : "") + "\n\n"
@@ -6572,3 +7581,10 @@ main().catch((err) => {
   process.stderr.write("\n" + danger("  \u2717 ") + message + "\n");
   process.exitCode = 1;
 });
+/*! Bundled license information:
+
+@dacely/noble-post-quantum/utils.js:
+@dacely/noble-post-quantum/_crystals.js:
+@dacely/noble-post-quantum/ml-kem.js:
+  (*! noble-post-quantum - MIT License (c) 2024 Paul Miller (paulmillr.com) *)
+*/