fix(sdk): honor the requested encrypted-blob encoding

packages/sdk/src/encrypted-blob.test.ts

@@ -250,6 +250,70 @@ test("rejects string with mixed valid/invalid hex characters", () => {
   assert.equal(result.issues[0].code, "invalid_encoding");
 });
 
+// ── Explicit encoding option tests ───────────────────────────────────────
+
+test("forced hex accepts valid hex and 0x-prefixed hex", () => {
+  const raw = u8(32);
+  const plainHex = hex(raw);
+  const prefixedHex = "0x" + plainHex;
+
+  const res1 = validateEncryptedBlob(plainHex, "evidence_ciphertext", {
+    encoding: "hex",
+  });
+  assert.equal(res1.valid, true);
+
+  const res2 = validateEncryptedBlob(prefixedHex, "evidence_ciphertext", {
+    encoding: "hex",
+  });
+  assert.equal(res2.valid, true);
+});
+
+test("forced hex rejects valid base64 strings containing non-hex characters", () => {
+  const res = validateEncryptedBlob("dGVzdA==", "evidence_ciphertext", {
+    encoding: "hex",
+  });
+  assert.equal(res.valid, false);
+  assert.equal(res.issues[0].code, "invalid_encoding");
+});
+
+test("forced base64 accepts valid base64 strings", () => {
+  const raw = u8(32);
+  const b64Str = b64(raw);
+  const res = validateEncryptedBlob(b64Str, "evidence_ciphertext", {
+    encoding: "base64",
+  });
+  assert.equal(res.valid, true);
+});
+
+test("forced base64 uses base64 decoder instead of hex", () => {
+  // "AAAA" is valid hex (2 bytes: 0xaa, 0xaa) and valid base64 (3 bytes: 0x00, 0x00, 0x00).
+  // If forced base64, decoded length is 3 bytes.
+  // With maxBytes: 2, forced hex passes (2 bytes <= 2), but forced base64 fails (3 bytes > 2).
+  const resHex = validateEncryptedBlob("AAAA", "ciphertext", {
+    encoding: "hex",
+    maxBytes: 2,
+  });
+  assert.equal(resHex.valid, true);
+
+  const resB64 = validateEncryptedBlob("AAAA", "ciphertext", {
+    encoding: "base64",
+    maxBytes: 2,
+  });
+  assert.equal(resB64.valid, false);
+  assert.equal(resB64.issues[0].code, "blob_too_large");
+});
+
+test("omitted encoding auto-detects hex first, then base64", () => {
+  const raw = u8(16);
+  const hexStr = hex(raw);
+  const resHex = validateEncryptedBlob(hexStr, "evidence_ciphertext");
+  assert.equal(resHex.valid, true);
+
+  // "dGVzdA==" is valid base64 but invalid hex
+  const resB64 = validateEncryptedBlob("dGVzdA==", "evidence_ciphertext");
+  assert.equal(resB64.valid, true);
+});
+
 // ── Invalid type ─────────────────────────────────────────────────────────
 
 test("rejects non-Uint8Array, non-string input", () => {