@blamejs/blamejs-shop 0.5.12 → 0.5.14

package/lib/vendor/blamejs/lib/vendor/noble-curves.cjs

@@ -4,7 +4,3449 @@
 //   ristretto255_oprf (ristretto255-SHA512), p256_oprf (P-256-SHA256),
 //   p384_oprf (P-384-SHA384), p521_oprf (P-521-SHA512) — each with
 //   oprf / voprf / poprf modes. Backs b.crypto.oprf.
-var Re=Object.defineProperty;var rr=Object.getOwnPropertyDescriptor;var or=Object.getOwnPropertyNames;var sr=Object.prototype.hasOwnProperty;var fr=(n,t)=>{for(var e in t)Re(n,e,{get:t[e],enumerable:!0})},ir=(n,t,e,r)=>{if(t&&typeof t=="object"||typeof t=="function")for(let o of or(t))!sr.call(n,o)&&o!==e&&Re(n,o,{get:()=>t[o],enumerable:!(r=rr(t,o))||r.enumerable});return n};var cr=n=>ir(Re({},"__esModule",{value:!0}),n);var Xr={};fr(Xr,{p256_oprf:()=>tr,p384_oprf:()=>er,p521_oprf:()=>nr,ristretto255_oprf:()=>Gn});module.exports=cr(Xr);function Oe(n){return n instanceof Uint8Array||ArrayBuffer.isView(n)&&n.constructor.name==="Uint8Array"&&"BYTES_PER_ELEMENT"in n&&n.BYTES_PER_ELEMENT===1}function ne(n,t=""){if(typeof n!="number"){let e=t&&`"${t}" `;throw new TypeError(`${e}expected number, got ${typeof n}`)}if(!Number.isSafeInteger(n)||n<0){let e=t&&`"${t}" `;throw new RangeError(`${e}expected integer >= 0, got ${n}`)}}function ot(n,t,e=""){let r=Oe(n),o=n?.length,s=t!==void 0;if(!r||s&&o!==t){let f=e&&`"${e}" `,c=s?` of length ${t}`:"",a=r?`length=${o}`:`type=${typeof n}`,i=f+"expected Uint8Array"+c+", got "+a;throw r?new RangeError(i):new TypeError(i)}return n}function Te(n,t=!0){if(n.destroyed)throw new Error("Hash instance has been destroyed");if(t&&n.finished)throw new Error("Hash#digest() has already been called")}function cn(n,t){ot(n,void 0,"digestInto() output");let e=t.outputLen;if(n.length<e)throw new RangeError('"digestInto() output" expected to be of length >='+e)}function St(...n){for(let t=0;t<n.length;t++)n[t].fill(0)}function re(n){return new DataView(n.buffer,n.byteOffset,n.byteLength)}function st(n,t){return n<<32-t|n>>>t}var an=typeof Uint8Array.from([]).toHex=="function"&&typeof Uint8Array.fromHex=="function",ar=Array.from({length:256},(n,t)=>t.toString(16).padStart(2,"0"));function oe(n){if(ot(n),an)return n.toHex();let t="";for(let e=0;e<n.length;e++)t+=ar[n[e]];return t}var ut={_0:48,_9:57,A:65,F:70,a:97,f:102};function fn(n){if(n>=ut._0&&n<=ut._9)return n-ut._0;if(n>=ut.A&&n<=ut.F)return n-(ut.A-10);if(n>=ut.a&&n<=ut.f)return n-(ut.a-10)}function kt(n){if(typeof n!="string")throw new TypeError("hex string expected, got "+typeof n);if(an)try{return Uint8Array.fromHex(n)}catch(o){throw o instanceof SyntaxError?new RangeError(o.message):o}let t=n.length,e=t/2;if(t%2)throw new RangeError("hex string expected, got unpadded hex of length "+t);let r=new Uint8Array(e);for(let o=0,s=0;o<e;o++,s+=2){let f=fn(n.charCodeAt(s)),c=fn(n.charCodeAt(s+1));if(f===void 0||c===void 0){let a=n[s]+n[s+1];throw new RangeError('hex string expected, got non-hex character "'+a+'" at index '+s)}r[o]=f*16+c}return r}function Ae(...n){let t=0;for(let r=0;r<n.length;r++){let o=n[r];ot(o),t+=o.length}let e=new Uint8Array(t);for(let r=0,o=0;r<n.length;r++){let s=n[r];e.set(s,o),o+=s.length}return e}function se(n,t={}){let e=(o,s)=>n(s).update(o).digest(),r=n(void 0);return e.outputLen=r.outputLen,e.blockLen=r.blockLen,e.canXOF=r.canXOF,e.create=o=>n(o),Object.assign(e,t),Object.freeze(e)}function un(n=32){ne(n,"bytesLength");let t=typeof globalThis=="object"?globalThis.crypto:null;if(typeof t?.getRandomValues!="function")throw new Error("crypto.getRandomValues must be defined");if(n>65536)throw new RangeError(`"bytesLength" expected <= 65536, got ${n}`);return t.getRandomValues(new Uint8Array(n))}var fe=n=>({oid:Uint8Array.from([6,9,96,134,72,1,101,3,4,2,n])});function dn(n,t,e){return n&t^~n&e}function ln(n,t,e){return n&t^n&e^t&e}var Xt=class{blockLen;outputLen;canXOF=!1;padOffset;isLE;buffer;view;finished=!1;length=0;pos=0;destroyed=!1;constructor(t,e,r,o){this.blockLen=t,this.outputLen=e,this.padOffset=r,this.isLE=o,this.buffer=new Uint8Array(t),this.view=re(this.buffer)}update(t){Te(this),ot(t);let{view:e,buffer:r,blockLen:o}=this,s=t.length;for(let f=0;f<s;){let c=Math.min(o-this.pos,s-f);if(c===o){let a=re(t);for(;o<=s-f;f+=o)this.process(a,f);continue}r.set(t.subarray(f,f+c),this.pos),this.pos+=c,f+=c,this.pos===o&&(this.process(e,0),this.pos=0)}return this.length+=t.length,this.roundClean(),this}digestInto(t){Te(this),cn(t,this),this.finished=!0;let{buffer:e,view:r,blockLen:o,isLE:s}=this,{pos:f}=this;e[f++]=128,St(this.buffer.subarray(f)),this.padOffset>o-f&&(this.process(r,0),f=0);for(let d=f;d<o;d++)e[d]=0;r.setBigUint64(o-8,BigInt(this.length*8),s),this.process(r,0);let c=re(t),a=this.outputLen;if(a%4)throw new Error("_sha2: outputLen must be aligned to 32bit");let i=a/4,l=this.get();if(i>l.length)throw new Error("_sha2: outputLen bigger than state");for(let d=0;d<i;d++)c.setUint32(4*d,l[d],s)}digest(){let{buffer:t,outputLen:e}=this;this.digestInto(t);let r=t.slice(0,e);return this.destroy(),r}_cloneInto(t){t||=new this.constructor,t.set(...this.get());let{blockLen:e,buffer:r,length:o,finished:s,destroyed:f,pos:c}=this;return t.destroyed=f,t.finished=s,t.length=o,t.pos=c,o%e&&t.buffer.set(r),t}clone(){return this._cloneInto()}},dt=Uint32Array.from([1779033703,3144134277,1013904242,2773480762,1359893119,2600822924,528734635,1541459225]);var G=Uint32Array.from([3418070365,3238371032,1654270250,914150663,2438529370,812702999,355462360,4144912697,1731405415,4290775857,2394180231,1750603025,3675008525,1694076839,1203062813,3204075428]),P=Uint32Array.from([1779033703,4089235720,3144134277,2227873595,1013904242,4271175723,2773480762,1595750129,1359893119,2917565137,2600822924,725511199,528734635,4215389547,1541459225,327033209]);var ie=BigInt(4294967295),hn=BigInt(32);function ur(n,t=!1){return t?{h:Number(n&ie),l:Number(n>>hn&ie)}:{h:Number(n>>hn&ie)|0,l:Number(n&ie)|0}}function pn(n,t=!1){let e=n.length,r=new Uint32Array(e),o=new Uint32Array(e);for(let s=0;s<e;s++){let{h:f,l:c}=ur(n[s],t);[r[s],o[s]]=[f,c]}return[r,o]}var Ie=(n,t,e)=>n>>>e,Fe=(n,t,e)=>n<<32-e|t>>>e,_t=(n,t,e)=>n>>>e|t<<32-e,Rt=(n,t,e)=>n<<32-e|t>>>e,Kt=(n,t,e)=>n<<64-e|t>>>e-32,Gt=(n,t,e)=>n>>>e-32|t<<64-e;function ct(n,t,e,r){let o=(t>>>0)+(r>>>0);return{h:n+e+(o/2**32|0)|0,l:o|0}}var bn=(n,t,e)=>(n>>>0)+(t>>>0)+(e>>>0),xn=(n,t,e,r)=>t+e+r+(n/2**32|0)|0,mn=(n,t,e,r)=>(n>>>0)+(t>>>0)+(e>>>0)+(r>>>0),yn=(n,t,e,r,o)=>t+e+r+o+(n/2**32|0)|0,wn=(n,t,e,r,o)=>(n>>>0)+(t>>>0)+(e>>>0)+(r>>>0)+(o>>>0),gn=(n,t,e,r,o,s)=>t+e+r+o+s+(n/2**32|0)|0;var lr=Uint32Array.from([1116352408,1899447441,3049323471,3921009573,961987163,1508970993,2453635748,2870763221,3624381080,310598401,607225278,1426881987,1925078388,2162078206,2614888103,3248222580,3835390401,4022224774,264347078,604807628,770255983,1249150122,1555081692,1996064986,2554220882,2821834349,2952996808,3210313671,3336571891,3584528711,113926993,338241895,666307205,773529912,1294757372,1396182291,1695183700,1986661051,2177026350,2456956037,2730485921,2820302411,3259730800,3345764771,3516065817,3600352804,4094571909,275423344,430227734,506948616,659060556,883997877,958139571,1322822218,1537002063,1747873779,1955562222,2024104815,2227730452,2361852424,2428436474,2756734187,3204031479,3329325298]),wt=new Uint32Array(64),Le=class extends Xt{constructor(t){super(64,t,8,!1)}get(){let{A:t,B:e,C:r,D:o,E:s,F:f,G:c,H:a}=this;return[t,e,r,o,s,f,c,a]}set(t,e,r,o,s,f,c,a){this.A=t|0,this.B=e|0,this.C=r|0,this.D=o|0,this.E=s|0,this.F=f|0,this.G=c|0,this.H=a|0}process(t,e){for(let d=0;d<16;d++,e+=4)wt[d]=t.getUint32(e,!1);for(let d=16;d<64;d++){let m=wt[d-15],b=wt[d-2],A=st(m,7)^st(m,18)^m>>>3,B=st(b,17)^st(b,19)^b>>>10;wt[d]=B+wt[d-7]+A+wt[d-16]|0}let{A:r,B:o,C:s,D:f,E:c,F:a,G:i,H:l}=this;for(let d=0;d<64;d++){let m=st(c,6)^st(c,11)^st(c,25),b=l+m+dn(c,a,i)+lr[d]+wt[d]|0,B=(st(r,2)^st(r,13)^st(r,22))+ln(r,o,s)|0;l=i,i=a,a=c,c=f+b|0,f=s,s=o,o=r,r=b+B|0}r=r+this.A|0,o=o+this.B|0,s=s+this.C|0,f=f+this.D|0,c=c+this.E|0,a=a+this.F|0,i=i+this.G|0,l=l+this.H|0,this.set(r,o,s,f,c,a,i,l)}roundClean(){St(wt)}destroy(){this.destroyed=!0,this.set(0,0,0,0,0,0,0,0),St(this.buffer)}},De=class extends Le{A=dt[0]|0;B=dt[1]|0;C=dt[2]|0;D=dt[3]|0;E=dt[4]|0;F=dt[5]|0;G=dt[6]|0;H=dt[7]|0;constructor(){super(32)}};var En=pn(["0x428a2f98d728ae22","0x7137449123ef65cd","0xb5c0fbcfec4d3b2f","0xe9b5dba58189dbbc","0x3956c25bf348b538","0x59f111f1b605d019","0x923f82a4af194f9b","0xab1c5ed5da6d8118","0xd807aa98a3030242","0x12835b0145706fbe","0x243185be4ee4b28c","0x550c7dc3d5ffb4e2","0x72be5d74f27b896f","0x80deb1fe3b1696b1","0x9bdc06a725c71235","0xc19bf174cf692694","0xe49b69c19ef14ad2","0xefbe4786384f25e3","0x0fc19dc68b8cd5b5","0x240ca1cc77ac9c65","0x2de92c6f592b0275","0x4a7484aa6ea6e483","0x5cb0a9dcbd41fbd4","0x76f988da831153b5","0x983e5152ee66dfab","0xa831c66d2db43210","0xb00327c898fb213f","0xbf597fc7beef0ee4","0xc6e00bf33da88fc2","0xd5a79147930aa725","0x06ca6351e003826f","0x142929670a0e6e70","0x27b70a8546d22ffc","0x2e1b21385c26c926","0x4d2c6dfc5ac42aed","0x53380d139d95b3df","0x650a73548baf63de","0x766a0abb3c77b2a8","0x81c2c92e47edaee6","0x92722c851482353b","0xa2bfe8a14cf10364","0xa81a664bbc423001","0xc24b8b70d0f89791","0xc76c51a30654be30","0xd192e819d6ef5218","0xd69906245565a910","0xf40e35855771202a","0x106aa07032bbd1b8","0x19a4c116b8d2d0c8","0x1e376c085141ab53","0x2748774cdf8eeb99","0x34b0bcb5e19b48a8","0x391c0cb3c5c95a63","0x4ed8aa4ae3418acb","0x5b9cca4f7763e373","0x682e6ff3d6b2b8a3","0x748f82ee5defb2fc","0x78a5636f43172f60","0x84c87814a1f0ab72","0x8cc702081a6439ec","0x90befffa23631e28","0xa4506cebde82bde9","0xbef9a3f7b2c67915","0xc67178f2e372532b","0xca273eceea26619c","0xd186b8c721c0c207","0xeada7dd6cde0eb1e","0xf57d4f7fee6ed178","0x06f067aa72176fba","0x0a637dc5a2c898a6","0x113f9804bef90dae","0x1b710b35131c471b","0x28db77f523047d84","0x32caab7b40c72493","0x3c9ebe0a15c9bebc","0x431d67c49c100d4c","0x4cc5d4becb3e42b6","0x597f299cfc657e2a","0x5fcb6fab3ad6faec","0x6c44198c4a475817"].map(n=>BigInt(n))),hr=En[0],pr=En[1],gt=new Uint32Array(80),Et=new Uint32Array(80),ce=class extends Xt{constructor(t){super(128,t,16,!1)}get(){let{Ah:t,Al:e,Bh:r,Bl:o,Ch:s,Cl:f,Dh:c,Dl:a,Eh:i,El:l,Fh:d,Fl:m,Gh:b,Gl:A,Hh:B,Hl:p}=this;return[t,e,r,o,s,f,c,a,i,l,d,m,b,A,B,p]}set(t,e,r,o,s,f,c,a,i,l,d,m,b,A,B,p){this.Ah=t|0,this.Al=e|0,this.Bh=r|0,this.Bl=o|0,this.Ch=s|0,this.Cl=f|0,this.Dh=c|0,this.Dl=a|0,this.Eh=i|0,this.El=l|0,this.Fh=d|0,this.Fl=m|0,this.Gh=b|0,this.Gl=A|0,this.Hh=B|0,this.Hl=p|0}process(t,e){for(let _=0;_<16;_++,e+=4)gt[_]=t.getUint32(e),Et[_]=t.getUint32(e+=4);for(let _=16;_<80;_++){let D=gt[_-15]|0,L=Et[_-15]|0,C=_t(D,L,1)^_t(D,L,8)^Ie(D,L,7),Z=Rt(D,L,1)^Rt(D,L,8)^Fe(D,L,7),R=gt[_-2]|0,N=Et[_-2]|0,j=_t(R,N,19)^Kt(R,N,61)^Ie(R,N,6),U=Rt(R,N,19)^Gt(R,N,61)^Fe(R,N,6),w=mn(Z,U,Et[_-7],Et[_-16]),T=yn(w,C,j,gt[_-7],gt[_-16]);gt[_]=T|0,Et[_]=w|0}let{Ah:r,Al:o,Bh:s,Bl:f,Ch:c,Cl:a,Dh:i,Dl:l,Eh:d,El:m,Fh:b,Fl:A,Gh:B,Gl:p,Hh:y,Hl:O}=this;for(let _=0;_<80;_++){let D=_t(d,m,14)^_t(d,m,18)^Kt(d,m,41),L=Rt(d,m,14)^Rt(d,m,18)^Gt(d,m,41),C=d&b^~d&B,Z=m&A^~m&p,R=wn(O,L,Z,pr[_],Et[_]),N=gn(R,y,D,C,hr[_],gt[_]),j=R|0,U=_t(r,o,28)^Kt(r,o,34)^Kt(r,o,39),w=Rt(r,o,28)^Gt(r,o,34)^Gt(r,o,39),T=r&s^r&c^s&c,I=o&f^o&a^f&a;y=B|0,O=p|0,B=b|0,p=A|0,b=d|0,A=m|0,{h:d,l:m}=ct(i|0,l|0,N|0,j|0),i=c|0,l=a|0,c=s|0,a=f|0,s=r|0,f=o|0;let u=bn(j,w,I);r=xn(u,N,U,T),o=u|0}({h:r,l:o}=ct(this.Ah|0,this.Al|0,r|0,o|0)),{h:s,l:f}=ct(this.Bh|0,this.Bl|0,s|0,f|0),{h:c,l:a}=ct(this.Ch|0,this.Cl|0,c|0,a|0),{h:i,l}=ct(this.Dh|0,this.Dl|0,i|0,l|0),{h:d,l:m}=ct(this.Eh|0,this.El|0,d|0,m|0),{h:b,l:A}=ct(this.Fh|0,this.Fl|0,b|0,A|0),{h:B,l:p}=ct(this.Gh|0,this.Gl|0,B|0,p|0),{h:y,l:O}=ct(this.Hh|0,this.Hl|0,y|0,O|0),this.set(r,o,s,f,c,a,i,l,d,m,b,A,B,p,y,O)}roundClean(){St(gt,Et)}destroy(){this.destroyed=!0,St(this.buffer),this.set(0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)}},He=class extends ce{Ah=P[0]|0;Al=P[1]|0;Bh=P[2]|0;Bl=P[3]|0;Ch=P[4]|0;Cl=P[5]|0;Dh=P[6]|0;Dl=P[7]|0;Eh=P[8]|0;El=P[9]|0;Fh=P[10]|0;Fl=P[11]|0;Gh=P[12]|0;Gl=P[13]|0;Hh=P[14]|0;Hl=P[15]|0;constructor(){super(64)}},qe=class extends ce{Ah=G[0]|0;Al=G[1]|0;Bh=G[2]|0;Bl=G[3]|0;Ch=G[4]|0;Cl=G[5]|0;Dh=G[6]|0;Dl=G[7]|0;Eh=G[8]|0;El=G[9]|0;Fh=G[10]|0;Fl=G[11]|0;Gh=G[12]|0;Gl=G[13]|0;Hh=G[14]|0;Hl=G[15]|0;constructor(){super(48)}};var Ne=se(()=>new De,fe(1));var Ot=se(()=>new He,fe(3)),Ue=se(()=>new qe,fe(2));var k=(n,t,e)=>ot(n,t,e),Ce=ne,Pt=oe,K=(...n)=>Ae(...n),de=n=>kt(n),Ct=Oe,nt=n=>un(n),ue=BigInt(0),Ze=BigInt(1);function Tt(n,t=""){if(typeof n!="boolean"){let e=t&&`"${t}" `;throw new TypeError(e+"expected boolean, got type="+typeof n)}return n}function le(n){if(typeof n=="bigint"){if(!ae(n))throw new RangeError("positive bigint expected, got "+n)}else Ce(n);return n}function J(n,t=""){if(typeof n!="number"){let e=t&&`"${t}" `;throw new TypeError(e+"expected number, got type="+typeof n)}if(!Number.isSafeInteger(n)){let e=t&&`"${t}" `;throw new RangeError(e+"expected safe integer, got "+n)}}function $t(n){let t=le(n).toString(16);return t.length&1?"0"+t:t}function Bn(n){if(typeof n!="string")throw new TypeError("hex string expected, got "+typeof n);return n===""?ue:BigInt("0x"+n)}function lt(n){return Bn(oe(n))}function at(n){return Bn(oe(It(ot(n)).reverse()))}function At(n,t){if(ne(t),t===0)throw new RangeError("zero length");n=le(n);let e=n.toString(16);if(e.length>t*2)throw new RangeError("number too large");return kt(e.padStart(t*2,"0"))}function je(n,t){return At(n,t).reverse()}function vn(n,t){if(n=k(n),t=k(t),n.length!==t.length)return!1;let e=0;for(let r=0;r<n.length;r++)e|=n[r]^t[r];return e===0}function It(n){return Uint8Array.from(k(n))}function tt(n){if(typeof n!="string")throw new TypeError("ascii string expected, got "+typeof n);return Uint8Array.from(n,(t,e)=>{let r=t.charCodeAt(0);if(t.length!==1||r>127)throw new RangeError(`string contains non-ASCII character "${n[e]}" with code ${r} at position ${e}`);return r})}var ae=n=>typeof n=="bigint"&&ue<=n;function br(n,t,e){return ae(n)&&ae(t)&&ae(e)&&t<=n&&n<e}function Wt(n,t,e,r){if(!br(t,e,r))throw new RangeError("expected valid "+n+": "+e+" <= n < "+r+", got "+t)}function Ft(n){if(n<ue)throw new Error("expected non-negative bigint, got "+n);let t;for(t=0;n>ue;n>>=Ze,t+=1);return t}var Qt=n=>(Ze<<BigInt(n))-Ze;function rt(n,t={},e={}){if(Object.prototype.toString.call(n)!=="[object Object]")throw new TypeError("expected valid options object");function r(s,f,c){if(!c&&f!=="function"&&!Object.hasOwn(n,s))throw new TypeError(`param "${s}" is invalid: expected own property`);let a=n[s];if(c&&a===void 0)return;let i=typeof a;if(i!==f||a===null)throw new TypeError(`param "${s}" is invalid: expected ${f}, got ${i}`)}let o=(s,f)=>Object.entries(s).forEach(([c,a])=>r(c,a,f));o(t,!1),o(e,!0)}var Ve=()=>{throw new Error("not implemented")};var $=BigInt(0),X=BigInt(1),Lt=BigInt(2),Rn=BigInt(3),On=BigInt(4),Tn=BigInt(5),xr=BigInt(7),An=BigInt(8),mr=BigInt(9),In=BigInt(16);function z(n,t){if(t<=$)throw new Error("mod: expected positive modulus, got "+t);let e=n%t;return e>=$?e:t+e}function ft(n,t,e){if(t<$)throw new Error("pow2: expected non-negative exponent, got "+t);let r=n;for(;t-- >$;)r*=r,r%=e;return r}function Sn(n,t){if(n===$)throw new Error("invert: expected non-zero number");if(t<=$)throw new Error("invert: expected positive modulus, got "+t);let e=z(n,t),r=t,o=$,s=X,f=X,c=$;for(;e!==$;){let i=r/e,l=r-e*i,d=o-f*i,m=s-c*i;r=e,e=l,o=f,s=c,f=d,c=m}if(r!==X)throw new Error("invert: does not exist");return z(o,t)}function ze(n,t,e){let r=n;if(!r.eql(r.sqr(t),e))throw new Error("Cannot find square root")}function Fn(n,t){let e=n,r=(e.ORDER+X)/On,o=e.pow(t,r);return ze(e,o,t),o}function yr(n,t){let e=n,r=(e.ORDER-Tn)/An,o=e.mul(t,Lt),s=e.pow(o,r),f=e.mul(t,s),c=e.mul(e.mul(f,Lt),s),a=e.mul(f,e.sub(c,e.ONE));return ze(e,a,t),a}function wr(n){let t=pe(n),e=Ln(n),r=e(t,t.neg(t.ONE)),o=e(t,r),s=e(t,t.neg(r)),f=(n+xr)/In;return((c,a)=>{let i=c,l=i.pow(a,f),d=i.mul(l,r),m=i.mul(l,o),b=i.mul(l,s),A=i.eql(i.sqr(d),a),B=i.eql(i.sqr(m),a);l=i.cmov(l,d,A),d=i.cmov(b,m,B);let p=i.eql(i.sqr(d),a),y=i.cmov(l,d,p);return ze(i,y,a),y})}function Ln(n){if(n<Rn)throw new Error("sqrt is not defined for small field");let t=n-X,e=0;for(;t%Lt===$;)t/=Lt,e++;let r=Lt,o=pe(n);for(;Me(o,r)===1;)if(r++>1e3)throw new Error("Cannot find square root: probably non-prime P");if(e===1)return Fn;let s=o.pow(r,t),f=(t+X)/Lt;return function(a,i){let l=a;if(l.is0(i))return i;if(Me(l,i)!==1)throw new Error("Cannot find square root");let d=e,m=l.mul(l.ONE,s),b=l.pow(i,t),A=l.pow(i,f);for(;!l.eql(b,l.ONE);){if(l.is0(b))return l.ZERO;let B=1,p=l.sqr(b);for(;!l.eql(p,l.ONE);)if(B++,p=l.sqr(p),B===d)throw new Error("Cannot find square root");let y=X<<BigInt(d-B-1),O=l.pow(m,y);d=B,m=l.sqr(O),b=l.mul(b,m),A=l.mul(A,O)}return A}}function gr(n){return n%On===Rn?Fn:n%An===Tn?yr:n%In===mr?wr(n):Ln(n)}var ht=(n,t)=>(z(n,t)&X)===X,Er=["create","isValid","is0","neg","inv","sqrt","sqr","eql","add","sub","mul","pow","div","addN","subN","mulN","sqrN"];function Dt(n){let t={ORDER:"bigint",BYTES:"number",BITS:"number"},e=Er.reduce((r,o)=>(r[o]="function",r),t);if(rt(n,e),J(n.BYTES,"BYTES"),J(n.BITS,"BITS"),n.BYTES<1||n.BITS<1)throw new Error("invalid field: expected BYTES/BITS > 0");if(n.ORDER<=X)throw new Error("invalid field: expected ORDER > 1, got "+n.ORDER);return n}function Br(n,t,e){let r=n;if(e<$)throw new Error("invalid exponent, negatives unsupported");if(e===$)return r.ONE;if(e===X)return t;let o=r.ONE,s=t;for(;e>$;)e&X&&(o=r.mul(o,s)),s=r.sqr(s),e>>=X;return o}function Ht(n,t,e=!1){let r=n,o=new Array(t.length).fill(e?r.ZERO:void 0),s=t.reduce((c,a,i)=>r.is0(a)?c:(o[i]=c,r.mul(c,a)),r.ONE),f=r.inv(s);return t.reduceRight((c,a,i)=>r.is0(a)?c:(o[i]=r.mul(c,o[i]),r.mul(c,a)),f),o}function Me(n,t){let e=n,r=(e.ORDER-X)/Lt,o=e.pow(t,r),s=e.eql(o,e.ONE),f=e.eql(o,e.ZERO),c=e.eql(o,e.neg(e.ONE));if(!s&&!f&&!c)throw new Error("invalid Legendre symbol result");return s?1:f?0:-1}function Ye(n,t){return Me(n,t)!==-1}function vr(n,t){if(t!==void 0&&Ce(t),n<=$)throw new Error("invalid n length: expected positive n, got "+n);if(t!==void 0&&t<1)throw new Error("invalid n length: expected positive bit length, got "+t);let e=Ft(n);if(t!==void 0&&t<e)throw new Error(`invalid n length: expected bit length (${e}) >= n.length (${t})`);let r=t!==void 0?t:e,o=Math.ceil(r/8);return{nBitLength:r,nByteLength:o}}var _n=new WeakMap,he=class{ORDER;BITS;BYTES;isLE;ZERO=$;ONE=X;_lengths;_mod;constructor(t,e={}){if(t<=X)throw new Error("invalid field: expected ORDER > 1, got "+t);let r;this.isLE=!1,e!=null&&typeof e=="object"&&(typeof e.BITS=="number"&&(r=e.BITS),typeof e.sqrt=="function"&&Object.defineProperty(this,"sqrt",{value:e.sqrt,enumerable:!0}),typeof e.isLE=="boolean"&&(this.isLE=e.isLE),e.allowedLengths&&(this._lengths=Object.freeze(e.allowedLengths.slice())),typeof e.modFromBytes=="boolean"&&(this._mod=e.modFromBytes));let{nBitLength:o,nByteLength:s}=vr(t,r);if(s>2048)throw new Error("invalid field: expected ORDER of <= 2048 bytes");this.ORDER=t,this.BITS=o,this.BYTES=s,Object.freeze(this)}create(t){return z(t,this.ORDER)}isValid(t){if(typeof t!="bigint")throw new TypeError("invalid field element: expected bigint, got "+typeof t);return $<=t&&t<this.ORDER}is0(t){return t===$}isValidNot0(t){return!this.is0(t)&&this.isValid(t)}isOdd(t){return(t&X)===X}neg(t){return z(-t,this.ORDER)}eql(t,e){return t===e}sqr(t){return z(t*t,this.ORDER)}add(t,e){return z(t+e,this.ORDER)}sub(t,e){return z(t-e,this.ORDER)}mul(t,e){return z(t*e,this.ORDER)}pow(t,e){return Br(this,t,e)}div(t,e){return z(t*Sn(e,this.ORDER),this.ORDER)}sqrN(t){return t*t}addN(t,e){return t+e}subN(t,e){return t-e}mulN(t,e){return t*e}inv(t){return Sn(t,this.ORDER)}sqrt(t){let e=_n.get(this);return e||_n.set(this,e=gr(this.ORDER)),e(this,t)}toBytes(t){return this.isLE?je(t,this.BYTES):At(t,this.BYTES)}fromBytes(t,e=!1){k(t);let{_lengths:r,BYTES:o,isLE:s,ORDER:f,_mod:c}=this;if(r){if(t.length<1||!r.includes(t.length)||t.length>o)throw new Error("Field.fromBytes: expected "+r+" bytes, got "+t.length);let i=new Uint8Array(o);i.set(t,s?0:i.length-t.length),t=i}if(t.length!==o)throw new Error("Field.fromBytes: expected "+o+" bytes, got "+t.length);let a=s?at(t):lt(t);if(c&&(a=z(a,f)),!e&&!this.isValid(a))throw new Error("invalid field element: outside of range 0..ORDER");return a}invertBatch(t){return Ht(this,t)}cmov(t,e,r){return Tt(r,"condition"),r?e:t}};Object.freeze(he.prototype);function pe(n,t={}){return new he(n,t)}function Dn(n){if(typeof n!="bigint")throw new Error("field order must be bigint");if(n<=X)throw new Error("field order must be greater than 1");let t=Ft(n-X);return Math.ceil(t/8)}function be(n){let t=Dn(n);return t+Math.ceil(t/2)}function ke(n,t,e=!1){k(n);let r=n.length,o=Dn(t),s=Math.max(be(t),16);if(r<s||r>1024)throw new Error("expected "+s+"-1024 bytes of input, got "+r);let f=e?at(n):lt(n),c=z(f,t-X)+X;return e?je(c,o):At(c,o)}var jt=BigInt(0),qt=BigInt(1);function Un(n){let t=n;if(typeof t!="function")throw new TypeError("Point must be a constructor");rt({Fp:t.Fp,Fn:t.Fn,fromAffine:t.fromAffine,fromBytes:t.fromBytes,fromHex:t.fromHex},{Fp:"object",Fn:"object",fromAffine:"function",fromBytes:"function",fromHex:"function"}),Dt(t.Fp),Dt(t.Fn)}function Jt(n,t){let e=t.negate();return n?e:t}function Nt(n,t){let e=Ht(n.Fp,t.map(r=>r.Z));return t.map((r,o)=>n.fromAffine(r.toAffine(e[o])))}function Zn(n,t){if(!Number.isSafeInteger(n)||n<=0||n>t)throw new Error("invalid window size, expected [1.."+t+"], got W="+n)}function Xe(n,t){Zn(n,t);let e=Math.ceil(t/n)+1,r=2**(n-1),o=2**n,s=Qt(n),f=BigInt(n);return{windows:e,windowSize:r,mask:s,maxNumber:o,shiftBy:f}}function Hn(n,t,e){let{windowSize:r,mask:o,maxNumber:s,shiftBy:f}=e,c=Number(n&o),a=n>>f;c>r&&(c-=s,a+=qt);let i=t*r,l=i+Math.abs(c)-1,d=c===0,m=c<0,b=t%2!==0;return{nextN:a,offset:l,isZero:d,isNeg:m,isNegF:b,offsetF:i}}function Sr(n,t){if(!Array.isArray(n))throw new Error("array expected");n.forEach((e,r)=>{if(!(e instanceof t))throw new Error("invalid point at index "+r)})}function _r(n,t){if(!Array.isArray(n))throw new Error("array of scalars expected");n.forEach((e,r)=>{if(!t.isValid(e))throw new Error("invalid scalar at index "+r)})}var Ke=new WeakMap,Cn=new WeakMap;function Ge(n){return Cn.get(n)||1}function qn(n){if(n!==jt)throw new Error("invalid wNAF")}var Vt=class{BASE;ZERO;Fn;bits;constructor(t,e){this.BASE=t.BASE,this.ZERO=t.ZERO,this.Fn=t.Fn,this.bits=e}_unsafeLadder(t,e,r=this.ZERO){let o=t;for(;e>jt;)e&qt&&(r=r.add(o)),o=o.double(),e>>=qt;return r}precomputeWindow(t,e){let{windows:r,windowSize:o}=Xe(e,this.bits),s=[],f=t,c=f;for(let a=0;a<r;a++){c=f,s.push(c);for(let i=1;i<o;i++)c=c.add(f),s.push(c);f=c.double()}return s}wNAF(t,e,r){if(!this.Fn.isValid(r))throw new Error("invalid scalar");let o=this.ZERO,s=this.BASE,f=Xe(t,this.bits);for(let c=0;c<f.windows;c++){let{nextN:a,offset:i,isZero:l,isNeg:d,isNegF:m,offsetF:b}=Hn(r,c,f);r=a,l?s=s.add(Jt(m,e[b])):o=o.add(Jt(d,e[i]))}return qn(r),{p:o,f:s}}wNAFUnsafe(t,e,r,o=this.ZERO){let s=Xe(t,this.bits);for(let f=0;f<s.windows&&r!==jt;f++){let{nextN:c,offset:a,isZero:i,isNeg:l}=Hn(r,f,s);if(r=c,!i){let d=e[a];o=o.add(l?d.negate():d)}}return qn(r),o}getPrecomputes(t,e,r){let o=Ke.get(e);return o||(o=this.precomputeWindow(e,t),t!==1&&(typeof r=="function"&&(o=r(o)),Ke.set(e,o))),o}cached(t,e,r){let o=Ge(t);return this.wNAF(o,this.getPrecomputes(o,t,r),e)}unsafe(t,e,r,o){let s=Ge(t);return s===1?this._unsafeLadder(t,e,o):this.wNAFUnsafe(s,this.getPrecomputes(s,t,r),e,o)}createCache(t,e){Zn(e,this.bits),Cn.set(t,e),Ke.delete(t)}hasCache(t){return Ge(t)!==1}};function jn(n,t,e,r){let o=t,s=n.ZERO,f=n.ZERO;for(;e>jt||r>jt;)e&qt&&(s=s.add(o)),r&qt&&(f=f.add(o)),o=o.double(),e>>=qt,r>>=qt;return{p1:s,p2:f}}function Vn(n,t,e){let r=n.Fn;Sr(t,n),_r(e,r);let o=t.length,s=e.length;if(o!==s)throw new Error("arrays of points and scalars must have equal length");let f=n.ZERO,c=Ft(BigInt(o)),a=1;c>12?a=c-3:c>4?a=c-2:c>0&&(a=2);let i=Qt(a),l=new Array(Number(i)+1).fill(f),d=Math.floor((r.BITS-1)/a)*a,m=f;for(let b=d;b>=0;b-=a){l.fill(f);for(let B=0;B<s;B++){let p=e[B],y=Number(p>>BigInt(b)&i);l[y]=l[y].add(t[B])}let A=f;for(let B=l.length-1,p=f;B>0;B--)p=p.add(l[B]),A=A.add(p);if(m=m.add(A),b!==0)for(let B=0;B<a;B++)m=m.double()}return m}function Nn(n,t,e){if(t){if(t.ORDER!==n)throw new Error("Field.ORDER must match order: Fp == p, Fn == n");return Dt(t),t}else return pe(n,{isLE:e})}function xe(n,t,e={},r){if(r===void 0&&(r=n==="edwards"),!t||typeof t!="object")throw new Error(`expected valid ${n} CURVE object`);for(let a of["p","n","h"]){let i=t[a];if(!(typeof i=="bigint"&&i>jt))throw new Error(`CURVE.${a} must be positive bigint`)}let o=Nn(t.p,e.Fp,r),s=Nn(t.n,e.Fn,r),c=["Gx","Gy","a",n==="weierstrass"?"b":"d"];for(let a of c)if(!o.isValid(t[a]))throw new Error(`CURVE.${a} must be valid field element of CURVE.Fp`);return t=Object.freeze(Object.assign({},t)),{CURVE:t,Fp:o,Fn:s}}var Bt=BigInt(0),Q=BigInt(1),Pe=BigInt(2),Or=BigInt(8);function Tr(n,t,e,r){let o=n.sqr(e),s=n.sqr(r),f=n.add(n.mul(t.a,o),s),c=n.add(n.ONE,n.mul(t.d,n.mul(o,s)));return n.eql(f,c)}function Mn(n,t={}){let e=t,r=xe("edwards",n,e,e.FpFnLE),{Fp:o,Fn:s}=r,f=r.CURVE,{h:c}=f;rt(e,{},{uvRatio:"function"});let a=Pe<<BigInt(s.BYTES*8)-Q,i=B=>o.create(B),l=e.uvRatio===void 0?(B,p)=>{try{return{isValid:!0,value:o.sqrt(o.div(B,p))}}catch{return{isValid:!1,value:Bt}}}:e.uvRatio;if(!Tr(o,f,f.Gx,f.Gy))throw new Error("bad curve params: generator point");function d(B,p,y=!1){let O=y?Q:Bt;return Wt("coordinate "+B,p,O,a),p}function m(B){if(!(B instanceof b))throw new Error("EdwardsPoint expected")}class b{static BASE=new b(f.Gx,f.Gy,Q,i(f.Gx*f.Gy));static ZERO=new b(Bt,Q,Q,Bt);static Fp=o;static Fn=s;X;Y;Z;T;constructor(p,y,O,_){this.X=d("x",p),this.Y=d("y",y),this.Z=d("z",O,!0),this.T=d("t",_),Object.freeze(this)}static CURVE(){return f}static fromAffine(p){if(p instanceof b)throw new Error("extended point not allowed");let{x:y,y:O}=p||{};return d("x",y),d("y",O),new b(y,O,Q,i(y*O))}static fromBytes(p,y=!1){let O=o.BYTES,{a:_,d:D}=f;p=It(k(p,O,"point")),Tt(y,"zip215");let L=It(p),C=p[O-1];L[O-1]=C&-129;let Z=at(L),R=y?a:o.ORDER;Wt("point.y",Z,Bt,R);let N=i(Z*Z),j=i(N-Q),U=i(D*N-_),{isValid:w,value:T}=l(j,U);if(!w)throw new Error("bad point: invalid y coordinate");let I=(T&Q)===Q,u=(C&128)!==0;if(!y&&T===Bt&&u)throw new Error("bad point: x=0 and x_0=1");return u!==I&&(T=i(-T)),b.fromAffine({x:T,y:Z})}static fromHex(p,y=!1){return b.fromBytes(de(p),y)}get x(){return this.toAffine().x}get y(){return this.toAffine().y}precompute(p=8,y=!0){return A.createCache(this,p),y||this.multiply(Pe),this}assertValidity(){let p=this,{a:y,d:O}=f;if(p.is0())throw new Error("bad point: ZERO");let{X:_,Y:D,Z:L,T:C}=p,Z=i(_*_),R=i(D*D),N=i(L*L),j=i(N*N),U=i(Z*y),w=i(N*i(U+R)),T=i(j+i(O*i(Z*R)));if(w!==T)throw new Error("bad point: equation left != right (1)");let I=i(_*D),u=i(L*C);if(I!==u)throw new Error("bad point: equation left != right (2)")}equals(p){m(p);let{X:y,Y:O,Z:_}=this,{X:D,Y:L,Z:C}=p,Z=i(y*C),R=i(D*_),N=i(O*C),j=i(L*_);return Z===R&&N===j}is0(){return this.equals(b.ZERO)}negate(){return new b(i(-this.X),this.Y,this.Z,i(-this.T))}double(){let{a:p}=f,{X:y,Y:O,Z:_}=this,D=i(y*y),L=i(O*O),C=i(Pe*i(_*_)),Z=i(p*D),R=y+O,N=i(i(R*R)-D-L),j=Z+L,U=j-C,w=Z-L,T=i(N*U),I=i(j*w),u=i(N*w),h=i(U*j);return new b(T,I,h,u)}add(p){m(p);let{a:y,d:O}=f,{X:_,Y:D,Z:L,T:C}=this,{X:Z,Y:R,Z:N,T:j}=p,U=i(_*Z),w=i(D*R),T=i(C*O*j),I=i(L*N),u=i((_+D)*(Z+R)-U-w),h=I-T,g=I+T,E=i(w-y*U),x=i(u*h),S=i(g*E),v=i(u*E),q=i(h*g);return new b(x,S,q,v)}subtract(p){return m(p),this.add(p.negate())}multiply(p){if(!s.isValidNot0(p))throw new RangeError("invalid scalar: expected 1 <= sc < curve.n");let{p:y,f:O}=A.cached(this,p,_=>Nt(b,_));return Nt(b,[y,O])[0]}multiplyUnsafe(p){if(!s.isValid(p))throw new RangeError("invalid scalar: expected 0 <= sc < curve.n");return p===Bt?b.ZERO:this.is0()||p===Q?this:A.unsafe(this,p,y=>Nt(b,y))}isSmallOrder(){return this.clearCofactor().is0()}isTorsionFree(){return A.unsafe(this,f.n).is0()}toAffine(p){let y=this,O=p,{X:_,Y:D,Z:L}=y,C=y.is0();O==null&&(O=C?Or:o.inv(L));let Z=i(_*O),R=i(D*O),N=o.mul(L,O);if(C)return{x:Bt,y:Q};if(N!==Q)throw new Error("invZ was invalid");return{x:Z,y:R}}clearCofactor(){return c===Q?this:this.multiplyUnsafe(c)}toBytes(){let{x:p,y}=this.toAffine(),O=o.toBytes(y);return O[O.length-1]|=p&Q?128:0,O}toHex(){return Pt(this.toBytes())}toString(){return`<Point ${this.is0()?"ZERO":this.toHex()}>`}}let A=new Vt(b,s.BITS);return s.BITS>=8&&b.BASE.precompute(8),Object.freeze(b.prototype),Object.freeze(b),b}var me=class{static BASE;static ZERO;static Fp;static Fn;ep;constructor(t){this.ep=t}static fromBytes(t){Ve()}static fromHex(t){Ve()}get x(){return this.toAffine().x}get y(){return this.toAffine().y}clearCofactor(){return this}assertValidity(){this.ep.assertValidity()}toAffine(t){return this.ep.toAffine(t)}toHex(){return Pt(this.toBytes())}toString(){return this.toHex()}isTorsionFree(){return!0}isSmallOrder(){return!1}add(t){return this.assertSame(t),this.init(this.ep.add(t.ep))}subtract(t){return this.assertSame(t),this.init(this.ep.subtract(t.ep))}multiply(t){return this.init(this.ep.multiply(t))}multiplyUnsafe(t){return this.init(this.ep.multiplyUnsafe(t))}double(){return this.init(this.ep.double())}negate(){return this.init(this.ep.negate())}precompute(t,e){return this.ep.precompute(t,e),this}};var Ar=lt;function Ut(n,t){if(J(n),J(t),t<0||t>4)throw new Error("invalid I2OSP length: "+t);if(n<0||n>2**(8*t)-1)throw new Error("invalid I2OSP input: "+n);let e=Array.from({length:t}).fill(0);for(let r=t-1;r>=0;r--)e[r]=n&255,n>>>=8;return new Uint8Array(e)}function Ir(n,t){let e=new Uint8Array(n.length);for(let r=0;r<n.length;r++)e[r]=n[r]^t[r];return e}function zn(n){if(!Ct(n)&&typeof n!="string")throw new Error("DST must be Uint8Array or ascii string");let t=typeof n=="string"?tt(n):n;if(t.length===0)throw new Error("DST must be non-empty");return t}function ye(n,t,e,r){k(n),J(e),t=zn(t),t.length>255&&(t=r(K(tt("H2C-OVERSIZE-DST-"),t)));let{outputLen:o,blockLen:s}=r,f=Math.ceil(e/o);if(e>65535||f>255)throw new Error("expand_message_xmd: invalid lenInBytes");let c=K(t,Ut(t.length,1)),a=new Uint8Array(s),i=Ut(e,2),l=new Array(f),d=r(K(a,n,i,Ut(0,1),c));l[0]=r(K(d,Ut(1,1),c));for(let b=1;b<f;b++){let A=[Ir(d,l[b-1]),Ut(b+1,1),c];l[b]=r(K(...A))}return K(...l).slice(0,e)}function Fr(n,t,e,r,o){if(k(n),J(e),t=zn(t),t.length>255){let s=Math.ceil(2*r/8);t=o.create({dkLen:s}).update(tt("H2C-OVERSIZE-DST-")).update(t).digest()}if(e>65535||t.length>255)throw new Error("expand_message_xof: invalid lenInBytes");return o.create({dkLen:e}).update(n).update(Ut(e,2)).update(t).update(Ut(t.length,1)).digest()}function $e(n,t,e){rt(e,{p:"bigint",m:"number",k:"number",hash:"function"});let{p:r,k:o,m:s,hash:f,expand:c,DST:a}=e;if(J(f.outputLen,"valid hash"),k(n),J(t),t<1)throw new Error("hash_to_field: expected count >= 1");if(s<1)throw new Error("hash_to_field: expected m >= 1");let i=r.toString(2).length,l=Math.ceil((i+o)/8),d=t*s*l,m;if(c==="xmd")m=ye(n,a,d,f);else if(c==="xof")m=Fr(n,a,d,o,f);else if(c==="_internal_pass")m=n;else throw new Error('expand must be "xmd" or "xof"');let b=new Array(t);for(let A=0;A<t;A++){let B=new Array(s);for(let p=0;p<s;p++){let y=l*(p+A*s),O=m.subarray(y,y+l);B[p]=z(Ar(O),r)}b[A]=B}return b}var te="HashToScalar-";function ee(n,t,e){if(typeof t!="function")throw new Error("mapToCurve() must be defined");let r=c=>Object.freeze({...c,DST:Ct(c.DST)?It(c.DST):c.DST,...c.encodeDST===void 0?{}:{encodeDST:Ct(c.encodeDST)?It(c.encodeDST):c.encodeDST}}),o=r(e);function s(c){return n.fromAffine(t(c))}function f(c){let a=c.clearCofactor();return a.equals(n.ZERO)?n.ZERO:(a.assertValidity(),a)}return Object.freeze({get defaults(){return r(o)},Point:n,hashToCurve(c,a){let i=Object.assign({},o,a),l=$e(c,2,i),d=s(l[0]),m=s(l[1]);return f(d.add(m))},encodeToCurve(c,a){let i=o.encodeDST?{DST:o.encodeDST}:{},l=Object.assign({},o,i,a),d=$e(c,1,l),m=s(d[0]);return f(m)},mapToCurve(c){if(o.m===1){if(typeof c!="bigint")throw new Error("expected bigint (m=1)");return f(s([c]))}if(!Array.isArray(c))throw new Error("expected array of bigints");for(let a of c)if(typeof a!="bigint")throw new Error("expected array of bigints");return f(s(c))},hashToScalar(c,a){let i=n.Fn.ORDER,l=Object.assign({},o,{p:i,m:1,DST:te},a);return $e(c,1,l)[0][0]}})}var Lr=tt(te);function Mt(n){rt(n,{name:"string",hash:"function",hashToScalar:"function",hashToGroup:"function"}),Un(n.Point);let{name:t,Point:e,hash:r}=n,{Fn:o}=e,s=(u,h)=>n.hashToGroup(u,{DST:K(tt("HashToGroup-"),h)}),f=(u,h)=>n.hashToScalar(u,{DST:K(Lr,h)}),c=(u=nt)=>{let h=ke(u(be(o.ORDER)),o.ORDER,o.isLE);return o.isLE?at(h):lt(h)},a=(u,h)=>Vn(e,u,h),i=u=>K(tt("OPRFV1-"),new Uint8Array([u]),tt("-"+t)),l=i(0),d=i(1),m=i(2);function b(...u){let h=[];for(let g of u)typeof g=="number"?h.push(At(g,2)):typeof g=="string"?h.push(tt(g)):(k(g),h.push(At(g.length,2),g));return K(...h)}let A=(u,h)=>{if(k(h,void 0,u),h.length>65535)throw new Error(`"${u}" expected Uint8Array of length <= 65535, got length=${h.length}`);return h},B=(...u)=>r(b(...u,"Finalize"));function p(u,h,g,E){let x=u.toBytes(),S=r(b(x,K(tt("Seed-"),E))),v=[];for(let q=0;q<h.length;q++){let H=h[q].toBytes(),F=g[q].toBytes(),V=f(b(S,q,H,F,"Composite"),E);v.push(V)}return v}function y(u,h,g,E){let x=p(u,h,g,E),S=a(h,x),v=a(g,x);return{M:S,Z:v}}function O(u,h,g,E,x){let S=p(h,g,E,x),v=a(g,S),q=v.multiply(u);return{M:v,Z:q}}function _(u,h,g,E,x,S){let[v,q,H,F,V]=[u,h,g,E,x].map(Y=>Y.toBytes());return f(b(v,q,H,F,V,"Challenge"),S)}function D(u,h,g,E,x,S){let{M:v,Z:q}=O(h,g,E,x,u),H=c(S),F=e.BASE.multiply(H),V=v.multiply(H),Y=_(g,v,q,F,V,u),et=o.sub(H,o.mul(Y,h));return K(...[Y,et].map(M=>o.toBytes(M)))}function L(u,h,g,E,x){k(x,2*o.BYTES);let{M:S,Z:v}=y(h,g,E,u),[q,H]=[x.subarray(0,o.BYTES),x.subarray(o.BYTES)].map(et=>o.fromBytes(et)),F=e.BASE.multiply(H).add(h.multiply(q)),V=S.multiply(H).add(v.multiply(q)),Y=_(h,S,v,F,V,u);if(!o.eql(q,Y))throw new Error("proof verification failed")}function C(){let u=c(),h=e.BASE.multiply(u);return{secretKey:o.toBytes(u),publicKey:h.toBytes()}}function Z(u,h,g){k(h,32,"seed"),g=A("keyInfo",g);let E=K(tt("DeriveKeyPair"),u),x=K(h,b(g),Uint8Array.of(0));for(let S=0;S<=255;S++){x[x.length-1]=S;let v=n.hashToScalar(x,{DST:E});if(!o.is0(v))return{secretKey:o.toBytes(v),publicKey:e.BASE.multiply(v).toBytes()}}throw new Error("Cannot derive key")}let R=(u,h)=>{let g=e.fromBytes(h);if(g.equals(e.ZERO))throw new Error(u+" point at infinity");return g};function N(u,h,g=nt){h=A("input",h);let E=c(g),x=s(h,u);if(x.equals(e.ZERO))throw new Error("Input point at infinity");let S=x.multiply(E);return{blind:o.toBytes(E),blinded:S.toBytes()}}function j(u,h,g){g=A("input",g);let E=o.fromBytes(h),x=s(g,u);if(x.equals(e.ZERO))throw new Error("Input point at infinity");let S=x.multiply(E).toBytes();return B(g,S)}let U=Object.freeze({generateKeyPair:C,deriveKeyPair:(u,h)=>Z(l,u,h),blind:(u,h=nt)=>N(l,u,h),blindEvaluate(u,h){let g=o.fromBytes(u);return R("blinded",h).multiply(g).toBytes()},finalize(u,h,g){u=A("input",u);let E=o.fromBytes(h),S=R("evaluated",g).multiply(o.inv(E)).toBytes();return B(u,S)},evaluate:(u,h)=>j(l,u,h)}),w=Object.freeze({generateKeyPair:C,deriveKeyPair:(u,h)=>Z(d,u,h),blind:(u,h=nt)=>N(d,u,h),blindEvaluateBatch(u,h,g,E=nt){if(!Array.isArray(g))throw new Error("expected array");let x=o.fromBytes(u),S=R("public key",h),v=g.map(F=>R("blinded",F)),q=v.map(F=>F.multiply(x)),H=D(d,x,S,v,q,E);return{evaluated:q.map(F=>F.toBytes()),proof:H}},blindEvaluate(u,h,g,E=nt){let x=this.blindEvaluateBatch(u,h,[g],E);return{evaluated:x.evaluated[0],proof:x.proof}},finalizeBatch(u,h,g){if(!Array.isArray(u))throw new Error("expected array");let E=R("public key",h),x=u.map(v=>R("blinded",v.blinded)),S=u.map(v=>R("evaluated",v.evaluated));return L(d,E,x,S,g),u.map(v=>U.finalize(v.input,v.blind,v.evaluated))},finalize(u,h,g,E,x,S){return this.finalizeBatch([{input:u,blind:h,evaluated:g,blinded:E}],x,S)[0]},evaluate:(u,h)=>j(d,u,h)}),I={name:t,oprf:U,voprf:w,poprf:u=>{u=A("info",u);let h=f(b("Info",u),m),g=e.BASE.multiply(h);return Object.freeze({generateKeyPair:C,deriveKeyPair:(E,x)=>Z(m,E,x),blind(E,x,S=nt){E=A("input",E);let v=R("public key",x),q=g.add(v);if(q.equals(e.ZERO))throw new Error("tweakedKey point at infinity");let H=c(S),F=s(E,m);if(F.equals(e.ZERO))throw new Error("Input point at infinity");let V=F.multiply(H);return{blind:o.toBytes(H),blinded:V.toBytes(),tweakedKey:q.toBytes()}},blindEvaluateBatch(E,x,S=nt){if(!Array.isArray(x))throw new Error("expected array");let v=o.fromBytes(E),q=o.add(v,h),H=o.inv(q),F=x.map(M=>R("blinded",M)),V=F.map(M=>M.multiply(H)),Y=e.BASE.multiply(q),et=D(m,q,Y,V,F,S);return{evaluated:V.map(M=>M.toBytes()),proof:et}},blindEvaluate(E,x,S=nt){let v=this.blindEvaluateBatch(E,[x],S);return{evaluated:v.evaluated[0],proof:v.proof}},finalizeBatch(E,x,S){if(!Array.isArray(E))throw new Error("expected array");let v=E.map(H=>A("input",H.input)),q=E.map(H=>R("evaluated",H.evaluated));return L(m,R("tweakedKey",S),q,E.map(H=>R("blinded",H.blinded)),x),E.map((H,F)=>{let V=o.fromBytes(H.blind),Y=q[F].multiply(o.inv(V)).toBytes();return B(v[F],u,Y)})},finalize(E,x,S,v,q,H){return this.finalizeBatch([{input:E,blind:x,evaluated:S,blinded:v}],q,H)[0]},evaluate(E,x){x=A("input",x);let S=o.fromBytes(E),v=s(x,m);if(v.equals(e.ZERO))throw new Error("Input point at infinity");let q=o.add(S,h),H=o.inv(q),F=v.multiply(H).toBytes();return B(x,u,F)}})},__tests:Object.freeze({Fn:o})};return Object.freeze(I)}var Dr=BigInt(0),pt=BigInt(1),Yn=BigInt(2);var Hr=BigInt(5),qr=BigInt(8),zt=BigInt("0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffed"),en={p:zt,n:BigInt("0x1000000000000000000000000000000014def9dea2f79cd65812631a5cf5d3ed"),h:qr,a:BigInt("0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffec"),d:BigInt("0x52036cee2b6ffe738cc740797779e89800700a4d4141d8ab75eb4dca135978a3"),Gx:BigInt("0x216936d3cd6e53fec0a4e231fdd6dc5c692cc7609525a7b2c9562d608f25d51a"),Gy:BigInt("0x6666666666666666666666666666666666666666666666666666666666666658")};function Nr(n){let t=BigInt(10),e=BigInt(20),r=BigInt(40),o=BigInt(80),s=zt,c=n*n%s*n%s,a=ft(c,Yn,s)*c%s,i=ft(a,pt,s)*n%s,l=ft(i,Hr,s)*i%s,d=ft(l,t,s)*l%s,m=ft(d,e,s)*d%s,b=ft(m,r,s)*m%s,A=ft(b,o,s)*b%s,B=ft(A,o,s)*b%s,p=ft(B,t,s)*l%s;return{pow_p_5_8:ft(p,Yn,s)*n%s,b2:c}}var We=BigInt("19681161376707505956807079304988542015446066515923890162744021073123829784752");function nn(n,t){let e=zt,r=z(t*t*t,e),o=z(r*r*t,e),s=Nr(n*o).pow_p_5_8,f=z(n*r*s,e),c=z(t*f*f,e),a=f,i=z(f*We,e),l=c===n,d=c===z(-n,e),m=c===z(-n*We,e);return l&&(f=a),(d||m)&&(f=i),ht(f,e)&&(f=z(-f,e)),{isValid:l||d,value:f}}var Zt=Mn(en,{uvRatio:nn}),vt=Zt.Fp,Kn=Zt.Fn;var Qe=We,Ur=BigInt("25063068953384623474111414158702152701244531502492656460079210482610430750235"),Zr=BigInt("54469307008909316920995813868745141605393597292927456921205312896311721017578"),Cr=BigInt("1159843021668779879193775521855586647937357759715417654439879720876111806838"),jr=BigInt("40440834346308536858101042469323190826248399146238708352240133220865137265952"),kn=n=>nn(pt,n),Vr=BigInt("0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"),Je=n=>vt.create(at(n)&Vr);function Xn(n){let{d:t}=en,e=zt,r=y=>vt.create(y),o=r(Qe*n*n),s=r((o+pt)*Cr),f=BigInt(-1),c=r((f-t*o)*r(o+t)),{isValid:a,value:i}=nn(s,c),l=r(i*n);ht(l,e)||(l=r(-l)),a||(i=l),a||(f=o);let d=r(f*(o-pt)*jr-c),m=i*i,b=r((i+i)*c),A=r(d*Ur),B=r(pt-m),p=r(pt+m);return new Zt(r(b*p),r(B*A),r(A*p),r(b*B))}var bt=class n extends me{static BASE=new n(Zt.BASE);static ZERO=new n(Zt.ZERO);static Fp=vt;static Fn=Kn;constructor(t){super(t)}static fromAffine(t){return new n(Zt.fromAffine(t))}assertSame(t){if(!(t instanceof n))throw new Error("RistrettoPoint expected")}init(t){return new n(t)}static fromBytes(t){ot(t,32);let{a:e,d:r}=en,o=zt,s=D=>vt.create(D),f=Je(t);if(!vn(vt.toBytes(f),t)||ht(f,o))throw new Error("invalid ristretto255 encoding 1");let c=s(f*f),a=s(pt+e*c),i=s(pt-e*c),l=s(a*a),d=s(i*i),m=s(e*r*l-d),{isValid:b,value:A}=kn(s(m*d)),B=s(A*i),p=s(A*B*m),y=s((f+f)*B);ht(y,o)&&(y=s(-y));let O=s(a*p),_=s(y*O);if(!b||ht(_,o)||O===Dr)throw new Error("invalid ristretto255 encoding 2");return new n(new Zt(y,O,pt,_))}static fromHex(t){return n.fromBytes(kt(t))}toBytes(){let{X:t,Y:e,Z:r,T:o}=this.ep,s=zt,f=p=>vt.create(p),c=f(f(r+e)*f(r-e)),a=f(t*e),i=f(a*a),{value:l}=kn(f(c*i)),d=f(l*c),m=f(l*a),b=f(d*m*o),A;if(ht(o*b,s)){let p=f(e*Qe),y=f(t*Qe);t=p,e=y,A=f(d*Zr)}else A=m;ht(t*b,s)&&(e=f(-e));let B=f((r-e)*A);return ht(B,s)&&(B=f(-B)),vt.toBytes(B)}equals(t){this.assertSame(t);let{X:e,Y:r}=this.ep,{X:o,Y:s}=t.ep,f=i=>vt.create(i),c=f(e*s)===f(r*o),a=f(r*s)===f(e*o);return c||a}is0(){return this.equals(n.ZERO)}};Object.freeze(bt.BASE);Object.freeze(bt.ZERO);Object.freeze(bt.prototype);Object.freeze(bt);var tn=Object.freeze({Point:bt,hashToCurve(n,t){let e=t?.DST===void 0?"ristretto255_XMD:SHA-512_R255MAP_RO_":t.DST,r=ye(n,e,64,Ot);return tn.deriveToCurve(r)},hashToScalar(n,t={DST:te}){let e=ye(n,t.DST,64,Ot);return Kn.create(at(e))},deriveToCurve(n){ot(n,64);let t=Je(n.subarray(0,32)),e=Xn(t),r=Je(n.subarray(32,64)),o=Xn(r);return new bt(e.add(o))}}),Gn=Mt({name:"ristretto255-SHA512",Point:bt,hash:Ot,hashToGroup:tn.hashToCurve,hashToScalar:tn.hashToScalar});var Pn=(n,t)=>(n+(n>=0?t:-t)/xt)/t;function Mr(n,t,e){Wt("scalar",n,yt,e);let[[r,o],[s,f]]=t,c=Pn(f*n,e),a=Pn(-o*n,e),i=n-c*r-a*s,l=-c*o-a*f,d=i<yt,m=l<yt;d&&(i=-i),m&&(l=-l);let b=Qt(Math.ceil(Ft(e)/2))+W;if(i<yt||i>=b||l<yt||l>=b)throw new Error("splitScalar (endomorphism): failed for k");return{k1neg:d,k1:i,k2neg:m,k2:l}}var rn=class extends Error{constructor(t=""){super(t)}},mt={Err:rn,_tlv:{encode:(n,t)=>{let{Err:e}=mt;if(J(n,"tag"),n<0||n>255)throw new e("tlv.encode: wrong tag");if(typeof t!="string")throw new TypeError('"data" expected string, got type='+typeof t);if(t.length&1)throw new e("tlv.encode: unpadded data");let r=t.length/2,o=$t(r);if(o.length/2&128)throw new e("tlv.encode: long form length too big");let s=r>127?$t(o.length/2|128):"";return $t(n)+s+o+t},decode(n,t){let{Err:e}=mt;t=k(t,void 0,"DER data");let r=0;if(n<0||n>255)throw new e("tlv.encode: wrong tag");if(t.length<2||t[r++]!==n)throw new e("tlv.decode: wrong tlv");let o=t[r++],s=!!(o&128),f=0;if(!s)f=o;else{let a=o&127;if(!a)throw new e("tlv.decode(long): indefinite length not supported");if(a>4)throw new e("tlv.decode(long): byte length is too big");let i=t.subarray(r,r+a);if(i.length!==a)throw new e("tlv.decode: length bytes not complete");if(i[0]===0)throw new e("tlv.decode(long): zero leftmost byte");for(let l of i)f=f<<8|l;if(r+=a,f<128)throw new e("tlv.decode(long): not minimal encoding")}let c=t.subarray(r,r+f);if(c.length!==f)throw new e("tlv.decode: wrong value length");return{v:c,l:t.subarray(r+f)}}},_int:{encode(n){let{Err:t}=mt;if(le(n),n<yt)throw new t("integer: negative integers are not allowed");let e=$t(n);if(Number.parseInt(e[0],16)&8&&(e="00"+e),e.length&1)throw new t("unexpected DER parsing assertion: unpadded hex");return e},decode(n){let{Err:t}=mt;if(n.length<1)throw new t("invalid signature integer: empty");if(n[0]&128)throw new t("invalid signature integer: negative");if(n.length>1&&n[0]===0&&!(n[1]&128))throw new t("invalid signature integer: unnecessary leading zero");return lt(n)}},toSig(n){let{Err:t,_int:e,_tlv:r}=mt,o=k(n,void 0,"signature"),{v:s,l:f}=r.decode(48,o);if(f.length)throw new t("invalid signature: left bytes after parsing");let{v:c,l:a}=r.decode(2,s),{v:i,l}=r.decode(2,a);if(l.length)throw new t("invalid signature: left bytes after parsing");return{r:e.decode(c),s:e.decode(i)}},hexFromSig(n){let{_tlv:t,_int:e}=mt,r=t.encode(2,e.encode(n.r)),o=t.encode(2,e.encode(n.s)),s=r+o;return t.encode(48,s)}};Object.freeze(mt._tlv);Object.freeze(mt._int);Object.freeze(mt);var yt=BigInt(0),W=BigInt(1),xt=BigInt(2),Yt=BigInt(3),on=BigInt(4);function we(n,t={}){let e=xe("weierstrass",n,t),r=e.Fp,o=e.Fn,s=e.CURVE,{h:f,n:c}=s;rt(t,{},{allowInfinityPoint:"boolean",clearCofactor:"function",isTorsionFree:"function",fromBytes:"function",toBytes:"function",endo:"object"});let{endo:a,allowInfinityPoint:i}=t;if(a&&(!r.is0(s.a)||typeof a.beta!="bigint"||!Array.isArray(a.basises)))throw new Error('invalid endo: expected "beta": bigint and "basises": array');let l=kr(r,o);function d(){if(!r.isOdd)throw new Error("compression is not supported: Field does not have .isOdd()")}function m(U,w,T){if(i&&w.is0())return Uint8Array.of(0);let{x:I,y:u}=w.toAffine(),h=r.toBytes(I);if(Tt(T,"isCompressed"),T){d();let g=!r.isOdd(u);return K(zr(g),h)}else return K(Uint8Array.of(4),h,r.toBytes(u))}function b(U){k(U,void 0,"Point");let{publicKey:w,publicKeyUncompressed:T}=l,I=U.length,u=U[0],h=U.subarray(1);if(i&&I===1&&u===0)return{x:r.ZERO,y:r.ZERO};if(I===w&&(u===2||u===3)){let g=r.fromBytes(h);if(!r.isValid(g))throw new Error("bad point: is not on curve, wrong x");let E=p(g),x;try{x=r.sqrt(E)}catch(q){let H=q instanceof Error?": "+q.message:"";throw new Error("bad point: is not on curve, sqrt error"+H)}d();let S=r.isOdd(x);return(u&1)===1!==S&&(x=r.neg(x)),{x:g,y:x}}else if(I===T&&u===4){let g=r.BYTES,E=r.fromBytes(h.subarray(0,g)),x=r.fromBytes(h.subarray(g,g*2));if(!y(E,x))throw new Error("bad point: is not on curve");return{x:E,y:x}}else throw new Error(`bad point: got length ${I}, expected compressed=${w} or uncompressed=${T}`)}let A=t.toBytes===void 0?m:t.toBytes,B=t.fromBytes===void 0?b:t.fromBytes;function p(U){let w=r.sqr(U),T=r.mul(w,U);return r.add(r.add(T,r.mul(U,s.a)),s.b)}function y(U,w){let T=r.sqr(w),I=p(U);return r.eql(T,I)}if(!y(s.Gx,s.Gy))throw new Error("bad curve params: generator point");let O=r.mul(r.pow(s.a,Yt),on),_=r.mul(r.sqr(s.b),BigInt(27));if(r.is0(r.add(O,_)))throw new Error("bad curve params: a or b");function D(U,w,T=!1){if(!r.isValid(w)||T&&r.is0(w))throw new Error(`bad point coordinate ${U}`);return w}function L(U){if(!(U instanceof R))throw new Error("Weierstrass Point expected")}function C(U){if(!a||!a.basises)throw new Error("no endo");return Mr(U,a.basises,o.ORDER)}function Z(U,w,T,I,u){return T=new R(r.mul(T.X,U),T.Y,T.Z),w=Jt(I,w),T=Jt(u,T),w.add(T)}class R{static BASE=new R(s.Gx,s.Gy,r.ONE);static ZERO=new R(r.ZERO,r.ONE,r.ZERO);static Fp=r;static Fn=o;X;Y;Z;constructor(w,T,I){this.X=D("x",w),this.Y=D("y",T,!0),this.Z=D("z",I),Object.freeze(this)}static CURVE(){return s}static fromAffine(w){let{x:T,y:I}=w||{};if(!w||!r.isValid(T)||!r.isValid(I))throw new Error("invalid affine point");if(w instanceof R)throw new Error("projective point not allowed");return r.is0(T)&&r.is0(I)?R.ZERO:new R(T,I,r.ONE)}static fromBytes(w){let T=R.fromAffine(B(k(w,void 0,"point")));return T.assertValidity(),T}static fromHex(w){return R.fromBytes(de(w))}get x(){return this.toAffine().x}get y(){return this.toAffine().y}precompute(w=8,T=!0){return j.createCache(this,w),T||this.multiply(Yt),this}assertValidity(){let w=this;if(w.is0()){if(t.allowInfinityPoint&&r.is0(w.X)&&r.eql(w.Y,r.ONE)&&r.is0(w.Z))return;throw new Error("bad point: ZERO")}let{x:T,y:I}=w.toAffine();if(!r.isValid(T)||!r.isValid(I))throw new Error("bad point: x or y not field elements");if(!y(T,I))throw new Error("bad point: equation left != right");if(!w.isTorsionFree())throw new Error("bad point: not in prime-order subgroup")}hasEvenY(){let{y:w}=this.toAffine();if(!r.isOdd)throw new Error("Field doesn't support isOdd");return!r.isOdd(w)}equals(w){L(w);let{X:T,Y:I,Z:u}=this,{X:h,Y:g,Z:E}=w,x=r.eql(r.mul(T,E),r.mul(h,u)),S=r.eql(r.mul(I,E),r.mul(g,u));return x&&S}negate(){return new R(this.X,r.neg(this.Y),this.Z)}double(){let{a:w,b:T}=s,I=r.mul(T,Yt),{X:u,Y:h,Z:g}=this,E=r.ZERO,x=r.ZERO,S=r.ZERO,v=r.mul(u,u),q=r.mul(h,h),H=r.mul(g,g),F=r.mul(u,h);return F=r.add(F,F),S=r.mul(u,g),S=r.add(S,S),E=r.mul(w,S),x=r.mul(I,H),x=r.add(E,x),E=r.sub(q,x),x=r.add(q,x),x=r.mul(E,x),E=r.mul(F,E),S=r.mul(I,S),H=r.mul(w,H),F=r.sub(v,H),F=r.mul(w,F),F=r.add(F,S),S=r.add(v,v),v=r.add(S,v),v=r.add(v,H),v=r.mul(v,F),x=r.add(x,v),H=r.mul(h,g),H=r.add(H,H),v=r.mul(H,F),E=r.sub(E,v),S=r.mul(H,q),S=r.add(S,S),S=r.add(S,S),new R(E,x,S)}add(w){L(w);let{X:T,Y:I,Z:u}=this,{X:h,Y:g,Z:E}=w,x=r.ZERO,S=r.ZERO,v=r.ZERO,q=s.a,H=r.mul(s.b,Yt),F=r.mul(T,h),V=r.mul(I,g),Y=r.mul(u,E),et=r.add(T,I),M=r.add(h,g);et=r.mul(et,M),M=r.add(F,V),et=r.sub(et,M),M=r.add(T,u);let it=r.add(h,E);return M=r.mul(M,it),it=r.add(F,Y),M=r.sub(M,it),it=r.add(I,u),x=r.add(g,E),it=r.mul(it,x),x=r.add(V,Y),it=r.sub(it,x),v=r.mul(q,M),x=r.mul(H,Y),v=r.add(x,v),x=r.sub(V,v),v=r.add(V,v),S=r.mul(x,v),V=r.add(F,F),V=r.add(V,F),Y=r.mul(q,Y),M=r.mul(H,M),V=r.add(V,Y),Y=r.sub(F,Y),Y=r.mul(q,Y),M=r.add(M,Y),F=r.mul(V,M),S=r.add(S,F),F=r.mul(it,M),x=r.mul(et,x),x=r.sub(x,F),F=r.mul(et,V),v=r.mul(it,v),v=r.add(v,F),new R(x,S,v)}subtract(w){return L(w),this.add(w.negate())}is0(){return this.equals(R.ZERO)}multiply(w){let{endo:T}=t;if(!o.isValidNot0(w))throw new RangeError("invalid scalar: out of range");let I,u,h=g=>j.cached(this,g,E=>Nt(R,E));if(T){let{k1neg:g,k1:E,k2neg:x,k2:S}=C(w),{p:v,f:q}=h(E),{p:H,f:F}=h(S);u=q.add(F),I=Z(T.beta,v,H,g,x)}else{let{p:g,f:E}=h(w);I=g,u=E}return Nt(R,[I,u])[0]}multiplyUnsafe(w){let{endo:T}=t,I=this,u=w;if(!o.isValid(u))throw new RangeError("invalid scalar: out of range");if(u===yt||I.is0())return R.ZERO;if(u===W)return I;if(j.hasCache(this))return this.multiply(u);if(T){let{k1neg:h,k1:g,k2neg:E,k2:x}=C(u),{p1:S,p2:v}=jn(R,I,g,x);return Z(T.beta,S,v,h,E)}else return j.unsafe(I,u)}toAffine(w){let T=this,I=w,{X:u,Y:h,Z:g}=T;if(r.eql(g,r.ONE))return{x:u,y:h};let E=T.is0();I==null&&(I=E?r.ONE:r.inv(g));let x=r.mul(u,I),S=r.mul(h,I),v=r.mul(g,I);if(E)return{x:r.ZERO,y:r.ZERO};if(!r.eql(v,r.ONE))throw new Error("invZ was invalid");return{x,y:S}}isTorsionFree(){let{isTorsionFree:w}=t;return f===W?!0:w?w(R,this):j.unsafe(this,c).is0()}clearCofactor(){let{clearCofactor:w}=t;return f===W?this:w?w(R,this):this.multiplyUnsafe(f)}isSmallOrder(){return f===W?this.is0():this.clearCofactor().is0()}toBytes(w=!0){return Tt(w,"isCompressed"),this.assertValidity(),A(R,this,w)}toHex(w=!0){return Pt(this.toBytes(w))}toString(){return`<Point ${this.is0()?"ZERO":this.toHex()}>`}}let N=o.BITS,j=new Vt(R,t.endo?Math.ceil(N/2):N);return N>=8&&R.BASE.precompute(8),Object.freeze(R.prototype),Object.freeze(R),R}function zr(n){return Uint8Array.of(n?2:3)}function Yr(n,t){let e=Dt(n),r=e.ORDER,o=yt;for(let B=r-W;B%xt===yt;B/=xt)o+=W;let s=o,f=xt<<s-W-W,c=f*xt,a=(r-W)/c,i=(a-W)/xt,l=c-W,d=f,m=e.pow(t,a),b=e.pow(t,(a+W)/xt),A=(B,p)=>{let y=m,O=e.pow(p,l),_=e.sqr(O);_=e.mul(_,p);let D=e.mul(B,_);D=e.pow(D,i),D=e.mul(D,O),O=e.mul(D,p),_=e.mul(D,B);let L=e.mul(_,O);D=e.pow(L,d);let C=e.eql(D,e.ONE);O=e.mul(_,b),D=e.mul(L,y),_=e.cmov(O,_,C),L=e.cmov(D,L,C);for(let Z=s;Z>W;Z--){let R=Z-xt;R=xt<<R-W;let N=e.pow(L,R),j=e.eql(N,e.ONE);O=e.mul(_,y),y=e.mul(y,y),N=e.mul(L,y),_=e.cmov(O,_,j),L=e.cmov(N,L,j)}return{isValid:!e.is0(p)&&(C||e.is0(B)),value:_}};if(e.ORDER%on===Yt){let B=(e.ORDER-Yt)/on,p=e.sqrt(e.neg(t));A=(y,O)=>{let _=e.sqr(O),D=e.mul(y,O);_=e.mul(_,D);let L=e.pow(_,B);L=e.mul(L,D);let C=e.mul(L,p),Z=e.mul(e.sqr(L),O),R=e.eql(Z,y),N=e.cmov(C,L,R);return{isValid:!e.is0(O)&&R,value:N}}}return A}function $n(n,t){let e=Dt(n),{A:r,B:o,Z:s}=t;if(!e.isValidNot0(r)||!e.isValidNot0(o)||!e.isValid(s))throw new Error("mapToCurveSimpleSWU: invalid opts");if(e.eql(s,e.neg(e.ONE))||Ye(e,s))throw new Error("mapToCurveSimpleSWU: invalid opts");let f=e.mul(o,e.inv(e.mul(s,r))),c=e.add(e.add(e.mul(e.sqr(f),f),e.mul(r,f)),o);if(!Ye(e,c))throw new Error("mapToCurveSimpleSWU: invalid opts");let a=Yr(e,s);if(!e.isOdd)throw new Error("Field does not have .isOdd()");return i=>{let l,d,m,b,A,B,p,y;l=e.sqr(i),l=e.mul(l,s),d=e.sqr(l),d=e.add(d,l),m=e.add(d,e.ONE),m=e.mul(m,o),b=e.cmov(s,e.neg(d),!e.eql(d,e.ZERO)),b=e.mul(b,r),d=e.sqr(m),B=e.sqr(b),A=e.mul(B,r),d=e.add(d,A),d=e.mul(d,m),B=e.mul(B,b),A=e.mul(B,o),d=e.add(d,A),p=e.mul(l,m);let{isValid:O,value:_}=a(d,B);y=e.mul(l,i),y=e.mul(y,_),p=e.cmov(p,m,O),y=e.cmov(y,_,O);let D=e.isOdd(i)===e.isOdd(y);y=e.cmov(e.neg(y),y,D);let L=Ht(e,[b],!0)[0];return p=e.mul(p,L),{x:p,y}}}function kr(n,t){return{secretKey:t.BYTES,publicKey:1+n.BYTES,publicKeyUncompressed:1+2*n.BYTES,publicKeyHasPrefix:!0,signature:2*t.BYTES}}var ge={p:BigInt("0xffffffff00000001000000000000000000000000ffffffffffffffffffffffff"),n:BigInt("0xffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551"),h:BigInt(1),a:BigInt("0xffffffff00000001000000000000000000000000fffffffffffffffffffffffc"),b:BigInt("0x5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b"),Gx:BigInt("0x6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296"),Gy:BigInt("0x4fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5")},Ee={p:BigInt("0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffffff0000000000000000ffffffff"),n:BigInt("0xffffffffffffffffffffffffffffffffffffffffffffffffc7634d81f4372ddf581a0db248b0a77aecec196accc52973"),h:BigInt(1),a:BigInt("0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffffff0000000000000000fffffffc"),b:BigInt("0xb3312fa7e23ee7e4988e056be3f82d19181d9c6efe8141120314088f5013875ac656398d8a2ed19d2a85c8edd3ec2aef"),Gx:BigInt("0xaa87ca22be8b05378eb1c71ef320ad746e1d3b628ba79b9859f741e082542a385502f25dbf55296c3a545e3872760ab7"),Gy:BigInt("0x3617de4a96262c6f5d9e98bf9292dc29f8f41dbd289a147ce9da3113b5f0b8c00a60b1ce1d7e819d7a431d7c90ea0e5f")},Be={p:BigInt("0x1ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"),n:BigInt("0x01fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffa51868783bf2f966b7fcc0148f709a5d03bb5c9b8899c47aebb6fb71e91386409"),h:BigInt(1),a:BigInt("0x1fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc"),b:BigInt("0x0051953eb9618e1c9a1f929a21a0b68540eea2da725b99b315f3b8b489918ef109e156193951ec7e937b1652c0bd3bb1bf073573df883d2c34f1ef451fd46b503f00"),Gx:BigInt("0x00c6858e06b70404e9cd9e3ecb662395b4429c648139053fb521f828af606b4d3dbaa14b5e77efe75928fe1dc127a2ffa8de3348b3c1856a429bf97e7e31c2e5bd66"),Gy:BigInt("0x011839296a789a3bc0045c8a5fb42c7d1bd998f54449579b446817afbd17273e662c97ee72995ef42640c550b9013fad0761353c7086a272c24088be94769fd16650")};function sn(n,t){let e;return r=>(e||(e=$n(n.Fp,t)))(r[0])}var ve=we(ge);var Wn=ee(ve,sn(ve,{A:ge.a,B:ge.b,Z:ve.Fp.create(BigInt("-10"))}),{DST:"P256_XMD:SHA-256_SSWU_RO_",encodeDST:"P256_XMD:SHA-256_SSWU_NU_",p:ge.p,m:1,k:128,expand:"xmd",hash:Ne}),tr=Mt({name:"P256-SHA256",Point:ve,hash:Ne,hashToGroup:Wn.hashToCurve,hashToScalar:Wn.hashToScalar});var Se=we(Ee);var Qn=ee(Se,sn(Se,{A:Ee.a,B:Ee.b,Z:Se.Fp.create(BigInt("-12"))}),{DST:"P384_XMD:SHA-384_SSWU_RO_",encodeDST:"P384_XMD:SHA-384_SSWU_NU_",p:Ee.p,m:1,k:192,expand:"xmd",hash:Ue}),er=Mt({name:"P384-SHA384",Point:Se,hash:Ue,hashToGroup:Qn.hashToCurve,hashToScalar:Qn.hashToScalar}),_e=we(Be);var Jn=ee(_e,sn(_e,{A:Be.a,B:Be.b,Z:_e.Fp.create(BigInt("-4"))}),{DST:"P521_XMD:SHA-512_SSWU_RO_",encodeDST:"P521_XMD:SHA-512_SSWU_NU_",p:Be.p,m:1,k:256,expand:"xmd",hash:Ot}),nr=Mt({name:"P521-SHA512",Point:_e,hash:Ot,hashToGroup:Jn.hashToCurve,hashToScalar:Jn.hashToScalar});0&&(module.exports={p256_oprf,p384_oprf,p521_oprf,ristretto255_oprf});
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod2) => __copyProps(__defProp({}, "__esModule", { value: true }), mod2);
+
+// _entry.mjs
+var entry_exports = {};
+__export(entry_exports, {
+  p256_oprf: () => p256_oprf,
+  p384_oprf: () => p384_oprf,
+  p521_oprf: () => p521_oprf,
+  ristretto255_oprf: () => ristretto255_oprf
+});
+module.exports = __toCommonJS(entry_exports);
+
+// node_modules/@noble/hashes/utils.js
+function isBytes(a) {
+  return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array" && "BYTES_PER_ELEMENT" in a && a.BYTES_PER_ELEMENT === 1;
+}
+function anumber(n, title = "") {
+  if (typeof n !== "number") {
+    const prefix = title && `"${title}" `;
+    throw new TypeError(`${prefix}expected number, got ${typeof n}`);
+  }
+  if (!Number.isSafeInteger(n) || n < 0) {
+    const prefix = title && `"${title}" `;
+    throw new RangeError(`${prefix}expected integer >= 0, got ${n}`);
+  }
+}
+function abytes(value, length, title = "") {
+  const bytes = isBytes(value);
+  const len = value?.length;
+  const needsLen = length !== void 0;
+  if (!bytes || needsLen && len !== length) {
+    const prefix = title && `"${title}" `;
+    const ofLen = needsLen ? ` of length ${length}` : "";
+    const got = bytes ? `length=${len}` : `type=${typeof value}`;
+    const message = prefix + "expected Uint8Array" + ofLen + ", got " + got;
+    if (!bytes)
+      throw new TypeError(message);
+    throw new RangeError(message);
+  }
+  return value;
+}
+function aexists(instance, checkFinished = true) {
+  if (instance.destroyed)
+    throw new Error("Hash instance has been destroyed");
+  if (checkFinished && instance.finished)
+    throw new Error("Hash#digest() has already been called");
+}
+function aoutput(out, instance) {
+  abytes(out, void 0, "digestInto() output");
+  const min = instance.outputLen;
+  if (out.length < min) {
+    throw new RangeError('"digestInto() output" expected to be of length >=' + min);
+  }
+}
+function clean(...arrays) {
+  for (let i = 0; i < arrays.length; i++) {
+    arrays[i].fill(0);
+  }
+}
+function createView(arr) {
+  return new DataView(arr.buffer, arr.byteOffset, arr.byteLength);
+}
+function rotr(word, shift) {
+  return word << 32 - shift | word >>> shift;
+}
+var hasHexBuiltin = /* @__PURE__ */ (() => (
+  // @ts-ignore
+  typeof Uint8Array.from([]).toHex === "function" && typeof Uint8Array.fromHex === "function"
+))();
+var hexes = /* @__PURE__ */ Array.from({ length: 256 }, (_, i) => i.toString(16).padStart(2, "0"));
+function bytesToHex(bytes) {
+  abytes(bytes);
+  if (hasHexBuiltin)
+    return bytes.toHex();
+  let hex = "";
+  for (let i = 0; i < bytes.length; i++) {
+    hex += hexes[bytes[i]];
+  }
+  return hex;
+}
+var asciis = { _0: 48, _9: 57, A: 65, F: 70, a: 97, f: 102 };
+function asciiToBase16(ch) {
+  if (ch >= asciis._0 && ch <= asciis._9)
+    return ch - asciis._0;
+  if (ch >= asciis.A && ch <= asciis.F)
+    return ch - (asciis.A - 10);
+  if (ch >= asciis.a && ch <= asciis.f)
+    return ch - (asciis.a - 10);
+  return;
+}
+function hexToBytes(hex) {
+  if (typeof hex !== "string")
+    throw new TypeError("hex string expected, got " + typeof hex);
+  if (hasHexBuiltin) {
+    try {
+      return Uint8Array.fromHex(hex);
+    } catch (error) {
+      if (error instanceof SyntaxError)
+        throw new RangeError(error.message);
+      throw error;
+    }
+  }
+  const hl = hex.length;
+  const al = hl / 2;
+  if (hl % 2)
+    throw new RangeError("hex string expected, got unpadded hex of length " + hl);
+  const array = new Uint8Array(al);
+  for (let ai = 0, hi = 0; ai < al; ai++, hi += 2) {
+    const n1 = asciiToBase16(hex.charCodeAt(hi));
+    const n2 = asciiToBase16(hex.charCodeAt(hi + 1));
+    if (n1 === void 0 || n2 === void 0) {
+      const char = hex[hi] + hex[hi + 1];
+      throw new RangeError('hex string expected, got non-hex character "' + char + '" at index ' + hi);
+    }
+    array[ai] = n1 * 16 + n2;
+  }
+  return array;
+}
+function concatBytes(...arrays) {
+  let sum = 0;
+  for (let i = 0; i < arrays.length; i++) {
+    const a = arrays[i];
+    abytes(a);
+    sum += a.length;
+  }
+  const res = new Uint8Array(sum);
+  for (let i = 0, pad = 0; i < arrays.length; i++) {
+    const a = arrays[i];
+    res.set(a, pad);
+    pad += a.length;
+  }
+  return res;
+}
+function createHasher(hashCons, info = {}) {
+  const hashC = (msg, opts) => hashCons(opts).update(msg).digest();
+  const tmp = hashCons(void 0);
+  hashC.outputLen = tmp.outputLen;
+  hashC.blockLen = tmp.blockLen;
+  hashC.canXOF = tmp.canXOF;
+  hashC.create = (opts) => hashCons(opts);
+  Object.assign(hashC, info);
+  return Object.freeze(hashC);
+}
+function randomBytes(bytesLength = 32) {
+  anumber(bytesLength, "bytesLength");
+  const cr = typeof globalThis === "object" ? globalThis.crypto : null;
+  if (typeof cr?.getRandomValues !== "function")
+    throw new Error("crypto.getRandomValues must be defined");
+  if (bytesLength > 65536)
+    throw new RangeError(`"bytesLength" expected <= 65536, got ${bytesLength}`);
+  return cr.getRandomValues(new Uint8Array(bytesLength));
+}
+var oidNist = (suffix) => ({
+  // Current NIST hashAlgs suffixes used here fit in one DER subidentifier octet.
+  // Larger suffix values would need base-128 OID encoding and a different length byte.
+  oid: Uint8Array.from([6, 9, 96, 134, 72, 1, 101, 3, 4, 2, suffix])
+});
+
+// node_modules/@noble/hashes/_md.js
+function Chi(a, b, c) {
+  return a & b ^ ~a & c;
+}
+function Maj(a, b, c) {
+  return a & b ^ a & c ^ b & c;
+}
+var HashMD = class {
+  blockLen;
+  outputLen;
+  canXOF = false;
+  padOffset;
+  isLE;
+  // For partial updates less than block size
+  buffer;
+  view;
+  finished = false;
+  length = 0;
+  pos = 0;
+  destroyed = false;
+  constructor(blockLen, outputLen, padOffset, isLE) {
+    this.blockLen = blockLen;
+    this.outputLen = outputLen;
+    this.padOffset = padOffset;
+    this.isLE = isLE;
+    this.buffer = new Uint8Array(blockLen);
+    this.view = createView(this.buffer);
+  }
+  update(data) {
+    aexists(this);
+    abytes(data);
+    const { view, buffer, blockLen } = this;
+    const len = data.length;
+    for (let pos = 0; pos < len; ) {
+      const take = Math.min(blockLen - this.pos, len - pos);
+      if (take === blockLen) {
+        const dataView = createView(data);
+        for (; blockLen <= len - pos; pos += blockLen)
+          this.process(dataView, pos);
+        continue;
+      }
+      buffer.set(data.subarray(pos, pos + take), this.pos);
+      this.pos += take;
+      pos += take;
+      if (this.pos === blockLen) {
+        this.process(view, 0);
+        this.pos = 0;
+      }
+    }
+    this.length += data.length;
+    this.roundClean();
+    return this;
+  }
+  digestInto(out) {
+    aexists(this);
+    aoutput(out, this);
+    this.finished = true;
+    const { buffer, view, blockLen, isLE } = this;
+    let { pos } = this;
+    buffer[pos++] = 128;
+    clean(this.buffer.subarray(pos));
+    if (this.padOffset > blockLen - pos) {
+      this.process(view, 0);
+      pos = 0;
+    }
+    for (let i = pos; i < blockLen; i++)
+      buffer[i] = 0;
+    view.setBigUint64(blockLen - 8, BigInt(this.length * 8), isLE);
+    this.process(view, 0);
+    const oview = createView(out);
+    const len = this.outputLen;
+    if (len % 4)
+      throw new Error("_sha2: outputLen must be aligned to 32bit");
+    const outLen = len / 4;
+    const state = this.get();
+    if (outLen > state.length)
+      throw new Error("_sha2: outputLen bigger than state");
+    for (let i = 0; i < outLen; i++)
+      oview.setUint32(4 * i, state[i], isLE);
+  }
+  digest() {
+    const { buffer, outputLen } = this;
+    this.digestInto(buffer);
+    const res = buffer.slice(0, outputLen);
+    this.destroy();
+    return res;
+  }
+  _cloneInto(to) {
+    to ||= new this.constructor();
+    to.set(...this.get());
+    const { blockLen, buffer, length, finished, destroyed, pos } = this;
+    to.destroyed = destroyed;
+    to.finished = finished;
+    to.length = length;
+    to.pos = pos;
+    if (length % blockLen)
+      to.buffer.set(buffer);
+    return to;
+  }
+  clone() {
+    return this._cloneInto();
+  }
+};
+var SHA256_IV = /* @__PURE__ */ Uint32Array.from([
+  1779033703,
+  3144134277,
+  1013904242,
+  2773480762,
+  1359893119,
+  2600822924,
+  528734635,
+  1541459225
+]);
+var SHA384_IV = /* @__PURE__ */ Uint32Array.from([
+  3418070365,
+  3238371032,
+  1654270250,
+  914150663,
+  2438529370,
+  812702999,
+  355462360,
+  4144912697,
+  1731405415,
+  4290775857,
+  2394180231,
+  1750603025,
+  3675008525,
+  1694076839,
+  1203062813,
+  3204075428
+]);
+var SHA512_IV = /* @__PURE__ */ Uint32Array.from([
+  1779033703,
+  4089235720,
+  3144134277,
+  2227873595,
+  1013904242,
+  4271175723,
+  2773480762,
+  1595750129,
+  1359893119,
+  2917565137,
+  2600822924,
+  725511199,
+  528734635,
+  4215389547,
+  1541459225,
+  327033209
+]);
+
+// node_modules/@noble/hashes/_u64.js
+var U32_MASK64 = /* @__PURE__ */ BigInt(2 ** 32 - 1);
+var _32n = /* @__PURE__ */ BigInt(32);
+function fromBig(n, le = false) {
+  if (le)
+    return { h: Number(n & U32_MASK64), l: Number(n >> _32n & U32_MASK64) };
+  return { h: Number(n >> _32n & U32_MASK64) | 0, l: Number(n & U32_MASK64) | 0 };
+}
+function split(lst, le = false) {
+  const len = lst.length;
+  let Ah = new Uint32Array(len);
+  let Al = new Uint32Array(len);
+  for (let i = 0; i < len; i++) {
+    const { h, l } = fromBig(lst[i], le);
+    [Ah[i], Al[i]] = [h, l];
+  }
+  return [Ah, Al];
+}
+var shrSH = (h, _l, s) => h >>> s;
+var shrSL = (h, l, s) => h << 32 - s | l >>> s;
+var rotrSH = (h, l, s) => h >>> s | l << 32 - s;
+var rotrSL = (h, l, s) => h << 32 - s | l >>> s;
+var rotrBH = (h, l, s) => h << 64 - s | l >>> s - 32;
+var rotrBL = (h, l, s) => h >>> s - 32 | l << 64 - s;
+function add(Ah, Al, Bh, Bl) {
+  const l = (Al >>> 0) + (Bl >>> 0);
+  return { h: Ah + Bh + (l / 2 ** 32 | 0) | 0, l: l | 0 };
+}
+var add3L = (Al, Bl, Cl) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0);
+var add3H = (low, Ah, Bh, Ch) => Ah + Bh + Ch + (low / 2 ** 32 | 0) | 0;
+var add4L = (Al, Bl, Cl, Dl) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0);
+var add4H = (low, Ah, Bh, Ch, Dh) => Ah + Bh + Ch + Dh + (low / 2 ** 32 | 0) | 0;
+var add5L = (Al, Bl, Cl, Dl, El) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0) + (El >>> 0);
+var add5H = (low, Ah, Bh, Ch, Dh, Eh) => Ah + Bh + Ch + Dh + Eh + (low / 2 ** 32 | 0) | 0;
+
+// node_modules/@noble/hashes/sha2.js
+var SHA256_K = /* @__PURE__ */ Uint32Array.from([
+  1116352408,
+  1899447441,
+  3049323471,
+  3921009573,
+  961987163,
+  1508970993,
+  2453635748,
+  2870763221,
+  3624381080,
+  310598401,
+  607225278,
+  1426881987,
+  1925078388,
+  2162078206,
+  2614888103,
+  3248222580,
+  3835390401,
+  4022224774,
+  264347078,
+  604807628,
+  770255983,
+  1249150122,
+  1555081692,
+  1996064986,
+  2554220882,
+  2821834349,
+  2952996808,
+  3210313671,
+  3336571891,
+  3584528711,
+  113926993,
+  338241895,
+  666307205,
+  773529912,
+  1294757372,
+  1396182291,
+  1695183700,
+  1986661051,
+  2177026350,
+  2456956037,
+  2730485921,
+  2820302411,
+  3259730800,
+  3345764771,
+  3516065817,
+  3600352804,
+  4094571909,
+  275423344,
+  430227734,
+  506948616,
+  659060556,
+  883997877,
+  958139571,
+  1322822218,
+  1537002063,
+  1747873779,
+  1955562222,
+  2024104815,
+  2227730452,
+  2361852424,
+  2428436474,
+  2756734187,
+  3204031479,
+  3329325298
+]);
+var SHA256_W = /* @__PURE__ */ new Uint32Array(64);
+var SHA2_32B = class extends HashMD {
+  constructor(outputLen) {
+    super(64, outputLen, 8, false);
+  }
+  get() {
+    const { A, B, C, D, E, F, G, H } = this;
+    return [A, B, C, D, E, F, G, H];
+  }
+  // prettier-ignore
+  set(A, B, C, D, E, F, G, H) {
+    this.A = A | 0;
+    this.B = B | 0;
+    this.C = C | 0;
+    this.D = D | 0;
+    this.E = E | 0;
+    this.F = F | 0;
+    this.G = G | 0;
+    this.H = H | 0;
+  }
+  process(view, offset) {
+    for (let i = 0; i < 16; i++, offset += 4)
+      SHA256_W[i] = view.getUint32(offset, false);
+    for (let i = 16; i < 64; i++) {
+      const W15 = SHA256_W[i - 15];
+      const W2 = SHA256_W[i - 2];
+      const s0 = rotr(W15, 7) ^ rotr(W15, 18) ^ W15 >>> 3;
+      const s1 = rotr(W2, 17) ^ rotr(W2, 19) ^ W2 >>> 10;
+      SHA256_W[i] = s1 + SHA256_W[i - 7] + s0 + SHA256_W[i - 16] | 0;
+    }
+    let { A, B, C, D, E, F, G, H } = this;
+    for (let i = 0; i < 64; i++) {
+      const sigma1 = rotr(E, 6) ^ rotr(E, 11) ^ rotr(E, 25);
+      const T1 = H + sigma1 + Chi(E, F, G) + SHA256_K[i] + SHA256_W[i] | 0;
+      const sigma0 = rotr(A, 2) ^ rotr(A, 13) ^ rotr(A, 22);
+      const T2 = sigma0 + Maj(A, B, C) | 0;
+      H = G;
+      G = F;
+      F = E;
+      E = D + T1 | 0;
+      D = C;
+      C = B;
+      B = A;
+      A = T1 + T2 | 0;
+    }
+    A = A + this.A | 0;
+    B = B + this.B | 0;
+    C = C + this.C | 0;
+    D = D + this.D | 0;
+    E = E + this.E | 0;
+    F = F + this.F | 0;
+    G = G + this.G | 0;
+    H = H + this.H | 0;
+    this.set(A, B, C, D, E, F, G, H);
+  }
+  roundClean() {
+    clean(SHA256_W);
+  }
+  destroy() {
+    this.destroyed = true;
+    this.set(0, 0, 0, 0, 0, 0, 0, 0);
+    clean(this.buffer);
+  }
+};
+var _SHA256 = class extends SHA2_32B {
+  // We cannot use array here since array allows indexing by variable
+  // which means optimizer/compiler cannot use registers.
+  A = SHA256_IV[0] | 0;
+  B = SHA256_IV[1] | 0;
+  C = SHA256_IV[2] | 0;
+  D = SHA256_IV[3] | 0;
+  E = SHA256_IV[4] | 0;
+  F = SHA256_IV[5] | 0;
+  G = SHA256_IV[6] | 0;
+  H = SHA256_IV[7] | 0;
+  constructor() {
+    super(32);
+  }
+};
+var K512 = /* @__PURE__ */ (() => split([
+  "0x428a2f98d728ae22",
+  "0x7137449123ef65cd",
+  "0xb5c0fbcfec4d3b2f",
+  "0xe9b5dba58189dbbc",
+  "0x3956c25bf348b538",
+  "0x59f111f1b605d019",
+  "0x923f82a4af194f9b",
+  "0xab1c5ed5da6d8118",
+  "0xd807aa98a3030242",
+  "0x12835b0145706fbe",
+  "0x243185be4ee4b28c",
+  "0x550c7dc3d5ffb4e2",
+  "0x72be5d74f27b896f",
+  "0x80deb1fe3b1696b1",
+  "0x9bdc06a725c71235",
+  "0xc19bf174cf692694",
+  "0xe49b69c19ef14ad2",
+  "0xefbe4786384f25e3",
+  "0x0fc19dc68b8cd5b5",
+  "0x240ca1cc77ac9c65",
+  "0x2de92c6f592b0275",
+  "0x4a7484aa6ea6e483",
+  "0x5cb0a9dcbd41fbd4",
+  "0x76f988da831153b5",
+  "0x983e5152ee66dfab",
+  "0xa831c66d2db43210",
+  "0xb00327c898fb213f",
+  "0xbf597fc7beef0ee4",
+  "0xc6e00bf33da88fc2",
+  "0xd5a79147930aa725",
+  "0x06ca6351e003826f",
+  "0x142929670a0e6e70",
+  "0x27b70a8546d22ffc",
+  "0x2e1b21385c26c926",
+  "0x4d2c6dfc5ac42aed",
+  "0x53380d139d95b3df",
+  "0x650a73548baf63de",
+  "0x766a0abb3c77b2a8",
+  "0x81c2c92e47edaee6",
+  "0x92722c851482353b",
+  "0xa2bfe8a14cf10364",
+  "0xa81a664bbc423001",
+  "0xc24b8b70d0f89791",
+  "0xc76c51a30654be30",
+  "0xd192e819d6ef5218",
+  "0xd69906245565a910",
+  "0xf40e35855771202a",
+  "0x106aa07032bbd1b8",
+  "0x19a4c116b8d2d0c8",
+  "0x1e376c085141ab53",
+  "0x2748774cdf8eeb99",
+  "0x34b0bcb5e19b48a8",
+  "0x391c0cb3c5c95a63",
+  "0x4ed8aa4ae3418acb",
+  "0x5b9cca4f7763e373",
+  "0x682e6ff3d6b2b8a3",
+  "0x748f82ee5defb2fc",
+  "0x78a5636f43172f60",
+  "0x84c87814a1f0ab72",
+  "0x8cc702081a6439ec",
+  "0x90befffa23631e28",
+  "0xa4506cebde82bde9",
+  "0xbef9a3f7b2c67915",
+  "0xc67178f2e372532b",
+  "0xca273eceea26619c",
+  "0xd186b8c721c0c207",
+  "0xeada7dd6cde0eb1e",
+  "0xf57d4f7fee6ed178",
+  "0x06f067aa72176fba",
+  "0x0a637dc5a2c898a6",
+  "0x113f9804bef90dae",
+  "0x1b710b35131c471b",
+  "0x28db77f523047d84",
+  "0x32caab7b40c72493",
+  "0x3c9ebe0a15c9bebc",
+  "0x431d67c49c100d4c",
+  "0x4cc5d4becb3e42b6",
+  "0x597f299cfc657e2a",
+  "0x5fcb6fab3ad6faec",
+  "0x6c44198c4a475817"
+].map((n) => BigInt(n))))();
+var SHA512_Kh = /* @__PURE__ */ (() => K512[0])();
+var SHA512_Kl = /* @__PURE__ */ (() => K512[1])();
+var SHA512_W_H = /* @__PURE__ */ new Uint32Array(80);
+var SHA512_W_L = /* @__PURE__ */ new Uint32Array(80);
+var SHA2_64B = class extends HashMD {
+  constructor(outputLen) {
+    super(128, outputLen, 16, false);
+  }
+  // prettier-ignore
+  get() {
+    const { Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl } = this;
+    return [Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl];
+  }
+  // prettier-ignore
+  set(Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl) {
+    this.Ah = Ah | 0;
+    this.Al = Al | 0;
+    this.Bh = Bh | 0;
+    this.Bl = Bl | 0;
+    this.Ch = Ch | 0;
+    this.Cl = Cl | 0;
+    this.Dh = Dh | 0;
+    this.Dl = Dl | 0;
+    this.Eh = Eh | 0;
+    this.El = El | 0;
+    this.Fh = Fh | 0;
+    this.Fl = Fl | 0;
+    this.Gh = Gh | 0;
+    this.Gl = Gl | 0;
+    this.Hh = Hh | 0;
+    this.Hl = Hl | 0;
+  }
+  process(view, offset) {
+    for (let i = 0; i < 16; i++, offset += 4) {
+      SHA512_W_H[i] = view.getUint32(offset);
+      SHA512_W_L[i] = view.getUint32(offset += 4);
+    }
+    for (let i = 16; i < 80; i++) {
+      const W15h = SHA512_W_H[i - 15] | 0;
+      const W15l = SHA512_W_L[i - 15] | 0;
+      const s0h = rotrSH(W15h, W15l, 1) ^ rotrSH(W15h, W15l, 8) ^ shrSH(W15h, W15l, 7);
+      const s0l = rotrSL(W15h, W15l, 1) ^ rotrSL(W15h, W15l, 8) ^ shrSL(W15h, W15l, 7);
+      const W2h = SHA512_W_H[i - 2] | 0;
+      const W2l = SHA512_W_L[i - 2] | 0;
+      const s1h = rotrSH(W2h, W2l, 19) ^ rotrBH(W2h, W2l, 61) ^ shrSH(W2h, W2l, 6);
+      const s1l = rotrSL(W2h, W2l, 19) ^ rotrBL(W2h, W2l, 61) ^ shrSL(W2h, W2l, 6);
+      const SUMl = add4L(s0l, s1l, SHA512_W_L[i - 7], SHA512_W_L[i - 16]);
+      const SUMh = add4H(SUMl, s0h, s1h, SHA512_W_H[i - 7], SHA512_W_H[i - 16]);
+      SHA512_W_H[i] = SUMh | 0;
+      SHA512_W_L[i] = SUMl | 0;
+    }
+    let { Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl } = this;
+    for (let i = 0; i < 80; i++) {
+      const sigma1h = rotrSH(Eh, El, 14) ^ rotrSH(Eh, El, 18) ^ rotrBH(Eh, El, 41);
+      const sigma1l = rotrSL(Eh, El, 14) ^ rotrSL(Eh, El, 18) ^ rotrBL(Eh, El, 41);
+      const CHIh = Eh & Fh ^ ~Eh & Gh;
+      const CHIl = El & Fl ^ ~El & Gl;
+      const T1ll = add5L(Hl, sigma1l, CHIl, SHA512_Kl[i], SHA512_W_L[i]);
+      const T1h = add5H(T1ll, Hh, sigma1h, CHIh, SHA512_Kh[i], SHA512_W_H[i]);
+      const T1l = T1ll | 0;
+      const sigma0h = rotrSH(Ah, Al, 28) ^ rotrBH(Ah, Al, 34) ^ rotrBH(Ah, Al, 39);
+      const sigma0l = rotrSL(Ah, Al, 28) ^ rotrBL(Ah, Al, 34) ^ rotrBL(Ah, Al, 39);
+      const MAJh = Ah & Bh ^ Ah & Ch ^ Bh & Ch;
+      const MAJl = Al & Bl ^ Al & Cl ^ Bl & Cl;
+      Hh = Gh | 0;
+      Hl = Gl | 0;
+      Gh = Fh | 0;
+      Gl = Fl | 0;
+      Fh = Eh | 0;
+      Fl = El | 0;
+      ({ h: Eh, l: El } = add(Dh | 0, Dl | 0, T1h | 0, T1l | 0));
+      Dh = Ch | 0;
+      Dl = Cl | 0;
+      Ch = Bh | 0;
+      Cl = Bl | 0;
+      Bh = Ah | 0;
+      Bl = Al | 0;
+      const All = add3L(T1l, sigma0l, MAJl);
+      Ah = add3H(All, T1h, sigma0h, MAJh);
+      Al = All | 0;
+    }
+    ({ h: Ah, l: Al } = add(this.Ah | 0, this.Al | 0, Ah | 0, Al | 0));
+    ({ h: Bh, l: Bl } = add(this.Bh | 0, this.Bl | 0, Bh | 0, Bl | 0));
+    ({ h: Ch, l: Cl } = add(this.Ch | 0, this.Cl | 0, Ch | 0, Cl | 0));
+    ({ h: Dh, l: Dl } = add(this.Dh | 0, this.Dl | 0, Dh | 0, Dl | 0));
+    ({ h: Eh, l: El } = add(this.Eh | 0, this.El | 0, Eh | 0, El | 0));
+    ({ h: Fh, l: Fl } = add(this.Fh | 0, this.Fl | 0, Fh | 0, Fl | 0));
+    ({ h: Gh, l: Gl } = add(this.Gh | 0, this.Gl | 0, Gh | 0, Gl | 0));
+    ({ h: Hh, l: Hl } = add(this.Hh | 0, this.Hl | 0, Hh | 0, Hl | 0));
+    this.set(Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl);
+  }
+  roundClean() {
+    clean(SHA512_W_H, SHA512_W_L);
+  }
+  destroy() {
+    this.destroyed = true;
+    clean(this.buffer);
+    this.set(0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0);
+  }
+};
+var _SHA512 = class extends SHA2_64B {
+  Ah = SHA512_IV[0] | 0;
+  Al = SHA512_IV[1] | 0;
+  Bh = SHA512_IV[2] | 0;
+  Bl = SHA512_IV[3] | 0;
+  Ch = SHA512_IV[4] | 0;
+  Cl = SHA512_IV[5] | 0;
+  Dh = SHA512_IV[6] | 0;
+  Dl = SHA512_IV[7] | 0;
+  Eh = SHA512_IV[8] | 0;
+  El = SHA512_IV[9] | 0;
+  Fh = SHA512_IV[10] | 0;
+  Fl = SHA512_IV[11] | 0;
+  Gh = SHA512_IV[12] | 0;
+  Gl = SHA512_IV[13] | 0;
+  Hh = SHA512_IV[14] | 0;
+  Hl = SHA512_IV[15] | 0;
+  constructor() {
+    super(64);
+  }
+};
+var _SHA384 = class extends SHA2_64B {
+  Ah = SHA384_IV[0] | 0;
+  Al = SHA384_IV[1] | 0;
+  Bh = SHA384_IV[2] | 0;
+  Bl = SHA384_IV[3] | 0;
+  Ch = SHA384_IV[4] | 0;
+  Cl = SHA384_IV[5] | 0;
+  Dh = SHA384_IV[6] | 0;
+  Dl = SHA384_IV[7] | 0;
+  Eh = SHA384_IV[8] | 0;
+  El = SHA384_IV[9] | 0;
+  Fh = SHA384_IV[10] | 0;
+  Fl = SHA384_IV[11] | 0;
+  Gh = SHA384_IV[12] | 0;
+  Gl = SHA384_IV[13] | 0;
+  Hh = SHA384_IV[14] | 0;
+  Hl = SHA384_IV[15] | 0;
+  constructor() {
+    super(48);
+  }
+};
+var sha256 = /* @__PURE__ */ createHasher(
+  () => new _SHA256(),
+  /* @__PURE__ */ oidNist(1)
+);
+var sha512 = /* @__PURE__ */ createHasher(
+  () => new _SHA512(),
+  /* @__PURE__ */ oidNist(3)
+);
+var sha384 = /* @__PURE__ */ createHasher(
+  () => new _SHA384(),
+  /* @__PURE__ */ oidNist(2)
+);
+
+// node_modules/@noble/curves/utils.js
+var abytes2 = (value, length, title) => abytes(value, length, title);
+var anumber2 = anumber;
+var bytesToHex2 = bytesToHex;
+var concatBytes2 = (...arrays) => concatBytes(...arrays);
+var hexToBytes2 = (hex) => hexToBytes(hex);
+var isBytes2 = isBytes;
+var randomBytes2 = (bytesLength) => randomBytes(bytesLength);
+var _0n = /* @__PURE__ */ BigInt(0);
+var _1n = /* @__PURE__ */ BigInt(1);
+function abool(value, title = "") {
+  if (typeof value !== "boolean") {
+    const prefix = title && `"${title}" `;
+    throw new TypeError(prefix + "expected boolean, got type=" + typeof value);
+  }
+  return value;
+}
+function abignumber(n) {
+  if (typeof n === "bigint") {
+    if (!isPosBig(n))
+      throw new RangeError("positive bigint expected, got " + n);
+  } else
+    anumber2(n);
+  return n;
+}
+function asafenumber(value, title = "") {
+  if (typeof value !== "number") {
+    const prefix = title && `"${title}" `;
+    throw new TypeError(prefix + "expected number, got type=" + typeof value);
+  }
+  if (!Number.isSafeInteger(value)) {
+    const prefix = title && `"${title}" `;
+    throw new RangeError(prefix + "expected safe integer, got " + value);
+  }
+}
+function numberToHexUnpadded(num) {
+  const hex = abignumber(num).toString(16);
+  return hex.length & 1 ? "0" + hex : hex;
+}
+function hexToNumber(hex) {
+  if (typeof hex !== "string")
+    throw new TypeError("hex string expected, got " + typeof hex);
+  return hex === "" ? _0n : BigInt("0x" + hex);
+}
+function bytesToNumberBE(bytes) {
+  return hexToNumber(bytesToHex(bytes));
+}
+function bytesToNumberLE(bytes) {
+  return hexToNumber(bytesToHex(copyBytes(abytes(bytes)).reverse()));
+}
+function numberToBytesBE(n, len) {
+  anumber(len);
+  if (len === 0)
+    throw new RangeError("zero length");
+  n = abignumber(n);
+  const hex = n.toString(16);
+  if (hex.length > len * 2)
+    throw new RangeError("number too large");
+  return hexToBytes(hex.padStart(len * 2, "0"));
+}
+function numberToBytesLE(n, len) {
+  return numberToBytesBE(n, len).reverse();
+}
+function equalBytes(a, b) {
+  a = abytes2(a);
+  b = abytes2(b);
+  if (a.length !== b.length)
+    return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++)
+    diff |= a[i] ^ b[i];
+  return diff === 0;
+}
+function copyBytes(bytes) {
+  return Uint8Array.from(abytes2(bytes));
+}
+function asciiToBytes(ascii) {
+  if (typeof ascii !== "string")
+    throw new TypeError("ascii string expected, got " + typeof ascii);
+  return Uint8Array.from(ascii, (c, i) => {
+    const charCode = c.charCodeAt(0);
+    if (c.length !== 1 || charCode > 127) {
+      throw new RangeError(`string contains non-ASCII character "${ascii[i]}" with code ${charCode} at position ${i}`);
+    }
+    return charCode;
+  });
+}
+var isPosBig = (n) => typeof n === "bigint" && _0n <= n;
+function inRange(n, min, max) {
+  return isPosBig(n) && isPosBig(min) && isPosBig(max) && min <= n && n < max;
+}
+function aInRange(title, n, min, max) {
+  if (!inRange(n, min, max))
+    throw new RangeError("expected valid " + title + ": " + min + " <= n < " + max + ", got " + n);
+}
+function bitLen(n) {
+  if (n < _0n)
+    throw new Error("expected non-negative bigint, got " + n);
+  let len;
+  for (len = 0; n > _0n; n >>= _1n, len += 1)
+    ;
+  return len;
+}
+var bitMask = (n) => (_1n << BigInt(n)) - _1n;
+function validateObject(object, fields = {}, optFields = {}) {
+  if (Object.prototype.toString.call(object) !== "[object Object]")
+    throw new TypeError("expected valid options object");
+  function checkField(fieldName, expectedType, isOpt) {
+    if (!isOpt && expectedType !== "function" && !Object.hasOwn(object, fieldName))
+      throw new TypeError(`param "${fieldName}" is invalid: expected own property`);
+    const val = object[fieldName];
+    if (isOpt && val === void 0)
+      return;
+    const current = typeof val;
+    if (current !== expectedType || val === null)
+      throw new TypeError(`param "${fieldName}" is invalid: expected ${expectedType}, got ${current}`);
+  }
+  const iter = (f, isOpt) => Object.entries(f).forEach(([k, v]) => checkField(k, v, isOpt));
+  iter(fields, false);
+  iter(optFields, true);
+}
+var notImplemented = () => {
+  throw new Error("not implemented");
+};
+
+// node_modules/@noble/curves/abstract/modular.js
+var _0n2 = /* @__PURE__ */ BigInt(0);
+var _1n2 = /* @__PURE__ */ BigInt(1);
+var _2n = /* @__PURE__ */ BigInt(2);
+var _3n = /* @__PURE__ */ BigInt(3);
+var _4n = /* @__PURE__ */ BigInt(4);
+var _5n = /* @__PURE__ */ BigInt(5);
+var _7n = /* @__PURE__ */ BigInt(7);
+var _8n = /* @__PURE__ */ BigInt(8);
+var _9n = /* @__PURE__ */ BigInt(9);
+var _16n = /* @__PURE__ */ BigInt(16);
+function mod(a, b) {
+  if (b <= _0n2)
+    throw new Error("mod: expected positive modulus, got " + b);
+  const result = a % b;
+  return result >= _0n2 ? result : b + result;
+}
+function pow2(x, power, modulo) {
+  if (power < _0n2)
+    throw new Error("pow2: expected non-negative exponent, got " + power);
+  let res = x;
+  while (power-- > _0n2) {
+    res *= res;
+    res %= modulo;
+  }
+  return res;
+}
+function invert(number, modulo) {
+  if (number === _0n2)
+    throw new Error("invert: expected non-zero number");
+  if (modulo <= _0n2)
+    throw new Error("invert: expected positive modulus, got " + modulo);
+  let a = mod(number, modulo);
+  let b = modulo;
+  let x = _0n2, y = _1n2, u = _1n2, v = _0n2;
+  while (a !== _0n2) {
+    const q = b / a;
+    const r = b - a * q;
+    const m = x - u * q;
+    const n = y - v * q;
+    b = a, a = r, x = u, y = v, u = m, v = n;
+  }
+  const gcd = b;
+  if (gcd !== _1n2)
+    throw new Error("invert: does not exist");
+  return mod(x, modulo);
+}
+function assertIsSquare(Fp2, root, n) {
+  const F = Fp2;
+  if (!F.eql(F.sqr(root), n))
+    throw new Error("Cannot find square root");
+}
+function sqrt3mod4(Fp2, n) {
+  const F = Fp2;
+  const p1div4 = (F.ORDER + _1n2) / _4n;
+  const root = F.pow(n, p1div4);
+  assertIsSquare(F, root, n);
+  return root;
+}
+function sqrt5mod8(Fp2, n) {
+  const F = Fp2;
+  const p5div8 = (F.ORDER - _5n) / _8n;
+  const n2 = F.mul(n, _2n);
+  const v = F.pow(n2, p5div8);
+  const nv = F.mul(n, v);
+  const i = F.mul(F.mul(nv, _2n), v);
+  const root = F.mul(nv, F.sub(i, F.ONE));
+  assertIsSquare(F, root, n);
+  return root;
+}
+function sqrt9mod16(P) {
+  const Fp_ = Field(P);
+  const tn = tonelliShanks(P);
+  const c1 = tn(Fp_, Fp_.neg(Fp_.ONE));
+  const c2 = tn(Fp_, c1);
+  const c3 = tn(Fp_, Fp_.neg(c1));
+  const c4 = (P + _7n) / _16n;
+  return ((Fp2, n) => {
+    const F = Fp2;
+    let tv1 = F.pow(n, c4);
+    let tv2 = F.mul(tv1, c1);
+    const tv3 = F.mul(tv1, c2);
+    const tv4 = F.mul(tv1, c3);
+    const e1 = F.eql(F.sqr(tv2), n);
+    const e2 = F.eql(F.sqr(tv3), n);
+    tv1 = F.cmov(tv1, tv2, e1);
+    tv2 = F.cmov(tv4, tv3, e2);
+    const e3 = F.eql(F.sqr(tv2), n);
+    const root = F.cmov(tv1, tv2, e3);
+    assertIsSquare(F, root, n);
+    return root;
+  });
+}
+function tonelliShanks(P) {
+  if (P < _3n)
+    throw new Error("sqrt is not defined for small field");
+  let Q = P - _1n2;
+  let S = 0;
+  while (Q % _2n === _0n2) {
+    Q /= _2n;
+    S++;
+  }
+  let Z = _2n;
+  const _Fp = Field(P);
+  while (FpLegendre(_Fp, Z) === 1) {
+    if (Z++ > 1e3)
+      throw new Error("Cannot find square root: probably non-prime P");
+  }
+  if (S === 1)
+    return sqrt3mod4;
+  let cc = _Fp.pow(Z, Q);
+  const Q1div2 = (Q + _1n2) / _2n;
+  return function tonelliSlow(Fp2, n) {
+    const F = Fp2;
+    if (F.is0(n))
+      return n;
+    if (FpLegendre(F, n) !== 1)
+      throw new Error("Cannot find square root");
+    let M = S;
+    let c = F.mul(F.ONE, cc);
+    let t = F.pow(n, Q);
+    let R = F.pow(n, Q1div2);
+    while (!F.eql(t, F.ONE)) {
+      if (F.is0(t))
+        return F.ZERO;
+      let i = 1;
+      let t_tmp = F.sqr(t);
+      while (!F.eql(t_tmp, F.ONE)) {
+        i++;
+        t_tmp = F.sqr(t_tmp);
+        if (i === M)
+          throw new Error("Cannot find square root");
+      }
+      const exponent = _1n2 << BigInt(M - i - 1);
+      const b = F.pow(c, exponent);
+      M = i;
+      c = F.sqr(b);
+      t = F.mul(t, c);
+      R = F.mul(R, b);
+    }
+    return R;
+  };
+}
+function FpSqrt(P) {
+  if (P % _4n === _3n)
+    return sqrt3mod4;
+  if (P % _8n === _5n)
+    return sqrt5mod8;
+  if (P % _16n === _9n)
+    return sqrt9mod16(P);
+  return tonelliShanks(P);
+}
+var isNegativeLE = (num, modulo) => (mod(num, modulo) & _1n2) === _1n2;
+var FIELD_FIELDS = [
+  "create",
+  "isValid",
+  "is0",
+  "neg",
+  "inv",
+  "sqrt",
+  "sqr",
+  "eql",
+  "add",
+  "sub",
+  "mul",
+  "pow",
+  "div",
+  "addN",
+  "subN",
+  "mulN",
+  "sqrN"
+];
+function validateField(field) {
+  const initial = {
+    ORDER: "bigint",
+    BYTES: "number",
+    BITS: "number"
+  };
+  const opts = FIELD_FIELDS.reduce((map, val) => {
+    map[val] = "function";
+    return map;
+  }, initial);
+  validateObject(field, opts);
+  asafenumber(field.BYTES, "BYTES");
+  asafenumber(field.BITS, "BITS");
+  if (field.BYTES < 1 || field.BITS < 1)
+    throw new Error("invalid field: expected BYTES/BITS > 0");
+  if (field.ORDER <= _1n2)
+    throw new Error("invalid field: expected ORDER > 1, got " + field.ORDER);
+  return field;
+}
+function FpPow(Fp2, num, power) {
+  const F = Fp2;
+  if (power < _0n2)
+    throw new Error("invalid exponent, negatives unsupported");
+  if (power === _0n2)
+    return F.ONE;
+  if (power === _1n2)
+    return num;
+  let p = F.ONE;
+  let d = num;
+  while (power > _0n2) {
+    if (power & _1n2)
+      p = F.mul(p, d);
+    d = F.sqr(d);
+    power >>= _1n2;
+  }
+  return p;
+}
+function FpInvertBatch(Fp2, nums, passZero = false) {
+  const F = Fp2;
+  const inverted = new Array(nums.length).fill(passZero ? F.ZERO : void 0);
+  const multipliedAcc = nums.reduce((acc, num, i) => {
+    if (F.is0(num))
+      return acc;
+    inverted[i] = acc;
+    return F.mul(acc, num);
+  }, F.ONE);
+  const invertedAcc = F.inv(multipliedAcc);
+  nums.reduceRight((acc, num, i) => {
+    if (F.is0(num))
+      return acc;
+    inverted[i] = F.mul(acc, inverted[i]);
+    return F.mul(acc, num);
+  }, invertedAcc);
+  return inverted;
+}
+function FpLegendre(Fp2, n) {
+  const F = Fp2;
+  const p1mod2 = (F.ORDER - _1n2) / _2n;
+  const powered = F.pow(n, p1mod2);
+  const yes = F.eql(powered, F.ONE);
+  const zero = F.eql(powered, F.ZERO);
+  const no = F.eql(powered, F.neg(F.ONE));
+  if (!yes && !zero && !no)
+    throw new Error("invalid Legendre symbol result");
+  return yes ? 1 : zero ? 0 : -1;
+}
+function FpIsSquare(Fp2, n) {
+  const l = FpLegendre(Fp2, n);
+  return l !== -1;
+}
+function nLength(n, nBitLength) {
+  if (nBitLength !== void 0)
+    anumber2(nBitLength);
+  if (n <= _0n2)
+    throw new Error("invalid n length: expected positive n, got " + n);
+  if (nBitLength !== void 0 && nBitLength < 1)
+    throw new Error("invalid n length: expected positive bit length, got " + nBitLength);
+  const bits = bitLen(n);
+  if (nBitLength !== void 0 && nBitLength < bits)
+    throw new Error(`invalid n length: expected bit length (${bits}) >= n.length (${nBitLength})`);
+  const _nBitLength = nBitLength !== void 0 ? nBitLength : bits;
+  const nByteLength = Math.ceil(_nBitLength / 8);
+  return { nBitLength: _nBitLength, nByteLength };
+}
+var FIELD_SQRT = /* @__PURE__ */ new WeakMap();
+var _Field = class {
+  ORDER;
+  BITS;
+  BYTES;
+  isLE;
+  ZERO = _0n2;
+  ONE = _1n2;
+  _lengths;
+  _mod;
+  constructor(ORDER, opts = {}) {
+    if (ORDER <= _1n2)
+      throw new Error("invalid field: expected ORDER > 1, got " + ORDER);
+    let _nbitLength = void 0;
+    this.isLE = false;
+    if (opts != null && typeof opts === "object") {
+      if (typeof opts.BITS === "number")
+        _nbitLength = opts.BITS;
+      if (typeof opts.sqrt === "function")
+        Object.defineProperty(this, "sqrt", { value: opts.sqrt, enumerable: true });
+      if (typeof opts.isLE === "boolean")
+        this.isLE = opts.isLE;
+      if (opts.allowedLengths)
+        this._lengths = Object.freeze(opts.allowedLengths.slice());
+      if (typeof opts.modFromBytes === "boolean")
+        this._mod = opts.modFromBytes;
+    }
+    const { nBitLength, nByteLength } = nLength(ORDER, _nbitLength);
+    if (nByteLength > 2048)
+      throw new Error("invalid field: expected ORDER of <= 2048 bytes");
+    this.ORDER = ORDER;
+    this.BITS = nBitLength;
+    this.BYTES = nByteLength;
+    Object.freeze(this);
+  }
+  create(num) {
+    return mod(num, this.ORDER);
+  }
+  isValid(num) {
+    if (typeof num !== "bigint")
+      throw new TypeError("invalid field element: expected bigint, got " + typeof num);
+    return _0n2 <= num && num < this.ORDER;
+  }
+  is0(num) {
+    return num === _0n2;
+  }
+  // is valid and invertible
+  isValidNot0(num) {
+    return !this.is0(num) && this.isValid(num);
+  }
+  isOdd(num) {
+    return (num & _1n2) === _1n2;
+  }
+  neg(num) {
+    return mod(-num, this.ORDER);
+  }
+  eql(lhs, rhs) {
+    return lhs === rhs;
+  }
+  sqr(num) {
+    return mod(num * num, this.ORDER);
+  }
+  add(lhs, rhs) {
+    return mod(lhs + rhs, this.ORDER);
+  }
+  sub(lhs, rhs) {
+    return mod(lhs - rhs, this.ORDER);
+  }
+  mul(lhs, rhs) {
+    return mod(lhs * rhs, this.ORDER);
+  }
+  pow(num, power) {
+    return FpPow(this, num, power);
+  }
+  div(lhs, rhs) {
+    return mod(lhs * invert(rhs, this.ORDER), this.ORDER);
+  }
+  // Same as above, but doesn't normalize
+  sqrN(num) {
+    return num * num;
+  }
+  addN(lhs, rhs) {
+    return lhs + rhs;
+  }
+  subN(lhs, rhs) {
+    return lhs - rhs;
+  }
+  mulN(lhs, rhs) {
+    return lhs * rhs;
+  }
+  inv(num) {
+    return invert(num, this.ORDER);
+  }
+  sqrt(num) {
+    let sqrt = FIELD_SQRT.get(this);
+    if (!sqrt)
+      FIELD_SQRT.set(this, sqrt = FpSqrt(this.ORDER));
+    return sqrt(this, num);
+  }
+  toBytes(num) {
+    return this.isLE ? numberToBytesLE(num, this.BYTES) : numberToBytesBE(num, this.BYTES);
+  }
+  fromBytes(bytes, skipValidation = false) {
+    abytes2(bytes);
+    const { _lengths: allowedLengths, BYTES, isLE, ORDER, _mod: modFromBytes } = this;
+    if (allowedLengths) {
+      if (bytes.length < 1 || !allowedLengths.includes(bytes.length) || bytes.length > BYTES) {
+        throw new Error("Field.fromBytes: expected " + allowedLengths + " bytes, got " + bytes.length);
+      }
+      const padded = new Uint8Array(BYTES);
+      padded.set(bytes, isLE ? 0 : padded.length - bytes.length);
+      bytes = padded;
+    }
+    if (bytes.length !== BYTES)
+      throw new Error("Field.fromBytes: expected " + BYTES + " bytes, got " + bytes.length);
+    let scalar = isLE ? bytesToNumberLE(bytes) : bytesToNumberBE(bytes);
+    if (modFromBytes)
+      scalar = mod(scalar, ORDER);
+    if (!skipValidation) {
+      if (!this.isValid(scalar))
+        throw new Error("invalid field element: outside of range 0..ORDER");
+    }
+    return scalar;
+  }
+  // TODO: we don't need it here, move out to separate fn
+  invertBatch(lst) {
+    return FpInvertBatch(this, lst);
+  }
+  // We can't move this out because Fp6, Fp12 implement it
+  // and it's unclear what to return in there.
+  cmov(a, b, condition) {
+    abool(condition, "condition");
+    return condition ? b : a;
+  }
+};
+Object.freeze(_Field.prototype);
+function Field(ORDER, opts = {}) {
+  return new _Field(ORDER, opts);
+}
+function getFieldBytesLength(fieldOrder) {
+  if (typeof fieldOrder !== "bigint")
+    throw new Error("field order must be bigint");
+  if (fieldOrder <= _1n2)
+    throw new Error("field order must be greater than 1");
+  const bitLength = bitLen(fieldOrder - _1n2);
+  return Math.ceil(bitLength / 8);
+}
+function getMinHashLength(fieldOrder) {
+  const length = getFieldBytesLength(fieldOrder);
+  return length + Math.ceil(length / 2);
+}
+function mapHashToField(key, fieldOrder, isLE = false) {
+  abytes2(key);
+  const len = key.length;
+  const fieldLen = getFieldBytesLength(fieldOrder);
+  const minLen = Math.max(getMinHashLength(fieldOrder), 16);
+  if (len < minLen || len > 1024)
+    throw new Error("expected " + minLen + "-1024 bytes of input, got " + len);
+  const num = isLE ? bytesToNumberLE(key) : bytesToNumberBE(key);
+  const reduced = mod(num, fieldOrder - _1n2) + _1n2;
+  return isLE ? numberToBytesLE(reduced, fieldLen) : numberToBytesBE(reduced, fieldLen);
+}
+
+// node_modules/@noble/curves/abstract/curve.js
+var _0n3 = /* @__PURE__ */ BigInt(0);
+var _1n3 = /* @__PURE__ */ BigInt(1);
+function validatePointCons(Point) {
+  const pc = Point;
+  if (typeof pc !== "function")
+    throw new TypeError("Point must be a constructor");
+  validateObject({
+    Fp: pc.Fp,
+    Fn: pc.Fn,
+    fromAffine: pc.fromAffine,
+    fromBytes: pc.fromBytes,
+    fromHex: pc.fromHex
+  }, {
+    Fp: "object",
+    Fn: "object",
+    fromAffine: "function",
+    fromBytes: "function",
+    fromHex: "function"
+  });
+  validateField(pc.Fp);
+  validateField(pc.Fn);
+}
+function negateCt(condition, item) {
+  const neg = item.negate();
+  return condition ? neg : item;
+}
+function normalizeZ(c, points) {
+  const invertedZs = FpInvertBatch(c.Fp, points.map((p) => p.Z));
+  return points.map((p, i) => c.fromAffine(p.toAffine(invertedZs[i])));
+}
+function validateW(W, bits) {
+  if (!Number.isSafeInteger(W) || W <= 0 || W > bits)
+    throw new Error("invalid window size, expected [1.." + bits + "], got W=" + W);
+}
+function calcWOpts(W, scalarBits) {
+  validateW(W, scalarBits);
+  const windows = Math.ceil(scalarBits / W) + 1;
+  const windowSize = 2 ** (W - 1);
+  const maxNumber = 2 ** W;
+  const mask = bitMask(W);
+  const shiftBy = BigInt(W);
+  return { windows, windowSize, mask, maxNumber, shiftBy };
+}
+function calcOffsets(n, window, wOpts) {
+  const { windowSize, mask, maxNumber, shiftBy } = wOpts;
+  let wbits = Number(n & mask);
+  let nextN = n >> shiftBy;
+  if (wbits > windowSize) {
+    wbits -= maxNumber;
+    nextN += _1n3;
+  }
+  const offsetStart = window * windowSize;
+  const offset = offsetStart + Math.abs(wbits) - 1;
+  const isZero = wbits === 0;
+  const isNeg = wbits < 0;
+  const isNegF = window % 2 !== 0;
+  const offsetF = offsetStart;
+  return { nextN, offset, isZero, isNeg, isNegF, offsetF };
+}
+function validateMSMPoints(points, c) {
+  if (!Array.isArray(points))
+    throw new Error("array expected");
+  points.forEach((p, i) => {
+    if (!(p instanceof c))
+      throw new Error("invalid point at index " + i);
+  });
+}
+function validateMSMScalars(scalars, field) {
+  if (!Array.isArray(scalars))
+    throw new Error("array of scalars expected");
+  scalars.forEach((s, i) => {
+    if (!field.isValid(s))
+      throw new Error("invalid scalar at index " + i);
+  });
+}
+var pointPrecomputes = /* @__PURE__ */ new WeakMap();
+var pointWindowSizes = /* @__PURE__ */ new WeakMap();
+function getW(P) {
+  return pointWindowSizes.get(P) || 1;
+}
+function assert0(n) {
+  if (n !== _0n3)
+    throw new Error("invalid wNAF");
+}
+var wNAF = class {
+  BASE;
+  ZERO;
+  Fn;
+  bits;
+  // Parametrized with a given Point class (not individual point)
+  constructor(Point, bits) {
+    this.BASE = Point.BASE;
+    this.ZERO = Point.ZERO;
+    this.Fn = Point.Fn;
+    this.bits = bits;
+  }
+  // non-const time multiplication ladder
+  _unsafeLadder(elm, n, p = this.ZERO) {
+    let d = elm;
+    while (n > _0n3) {
+      if (n & _1n3)
+        p = p.add(d);
+      d = d.double();
+      n >>= _1n3;
+    }
+    return p;
+  }
+  /**
+   * Creates a wNAF precomputation window. Used for caching.
+   * Default window size is set by `utils.precompute()` and is equal to 8.
+   * Number of precomputed points depends on the curve size:
+   * 2^(𝑊−1) * (Math.ceil(𝑛 / 𝑊) + 1), where:
+   * - 𝑊 is the window size
+   * - 𝑛 is the bitlength of the curve order.
+   * For a 256-bit curve and window size 8, the number of precomputed points is 128 * 33 = 4224.
+   * @param point - Point instance
+   * @param W - window size
+   * @returns precomputed point tables flattened to a single array
+   */
+  precomputeWindow(point, W) {
+    const { windows, windowSize } = calcWOpts(W, this.bits);
+    const points = [];
+    let p = point;
+    let base = p;
+    for (let window = 0; window < windows; window++) {
+      base = p;
+      points.push(base);
+      for (let i = 1; i < windowSize; i++) {
+        base = base.add(p);
+        points.push(base);
+      }
+      p = base.double();
+    }
+    return points;
+  }
+  /**
+   * Implements ec multiplication using precomputed tables and w-ary non-adjacent form.
+   * More compact implementation:
+   * https://github.com/paulmillr/noble-secp256k1/blob/47cb1669b6e506ad66b35fe7d76132ae97465da2/index.ts#L502-L541
+   * @returns real and fake (for const-time) points
+   */
+  wNAF(W, precomputes, n) {
+    if (!this.Fn.isValid(n))
+      throw new Error("invalid scalar");
+    let p = this.ZERO;
+    let f = this.BASE;
+    const wo = calcWOpts(W, this.bits);
+    for (let window = 0; window < wo.windows; window++) {
+      const { nextN, offset, isZero, isNeg, isNegF, offsetF } = calcOffsets(n, window, wo);
+      n = nextN;
+      if (isZero) {
+        f = f.add(negateCt(isNegF, precomputes[offsetF]));
+      } else {
+        p = p.add(negateCt(isNeg, precomputes[offset]));
+      }
+    }
+    assert0(n);
+    return { p, f };
+  }
+  /**
+   * Implements unsafe EC multiplication using precomputed tables
+   * and w-ary non-adjacent form.
+   * @param acc - accumulator point to add result of multiplication
+   * @returns point
+   */
+  wNAFUnsafe(W, precomputes, n, acc = this.ZERO) {
+    const wo = calcWOpts(W, this.bits);
+    for (let window = 0; window < wo.windows; window++) {
+      if (n === _0n3)
+        break;
+      const { nextN, offset, isZero, isNeg } = calcOffsets(n, window, wo);
+      n = nextN;
+      if (isZero) {
+        continue;
+      } else {
+        const item = precomputes[offset];
+        acc = acc.add(isNeg ? item.negate() : item);
+      }
+    }
+    assert0(n);
+    return acc;
+  }
+  getPrecomputes(W, point, transform) {
+    let comp = pointPrecomputes.get(point);
+    if (!comp) {
+      comp = this.precomputeWindow(point, W);
+      if (W !== 1) {
+        if (typeof transform === "function")
+          comp = transform(comp);
+        pointPrecomputes.set(point, comp);
+      }
+    }
+    return comp;
+  }
+  cached(point, scalar, transform) {
+    const W = getW(point);
+    return this.wNAF(W, this.getPrecomputes(W, point, transform), scalar);
+  }
+  unsafe(point, scalar, transform, prev) {
+    const W = getW(point);
+    if (W === 1)
+      return this._unsafeLadder(point, scalar, prev);
+    return this.wNAFUnsafe(W, this.getPrecomputes(W, point, transform), scalar, prev);
+  }
+  // We calculate precomputes for elliptic curve point multiplication
+  // using windowed method. This specifies window size and
+  // stores precomputed values. Usually only base point would be precomputed.
+  createCache(P, W) {
+    validateW(W, this.bits);
+    pointWindowSizes.set(P, W);
+    pointPrecomputes.delete(P);
+  }
+  hasCache(elm) {
+    return getW(elm) !== 1;
+  }
+};
+function mulEndoUnsafe(Point, point, k1, k2) {
+  let acc = point;
+  let p1 = Point.ZERO;
+  let p2 = Point.ZERO;
+  while (k1 > _0n3 || k2 > _0n3) {
+    if (k1 & _1n3)
+      p1 = p1.add(acc);
+    if (k2 & _1n3)
+      p2 = p2.add(acc);
+    acc = acc.double();
+    k1 >>= _1n3;
+    k2 >>= _1n3;
+  }
+  return { p1, p2 };
+}
+function pippenger(c, points, scalars) {
+  const fieldN = c.Fn;
+  validateMSMPoints(points, c);
+  validateMSMScalars(scalars, fieldN);
+  const plength = points.length;
+  const slength = scalars.length;
+  if (plength !== slength)
+    throw new Error("arrays of points and scalars must have equal length");
+  const zero = c.ZERO;
+  const wbits = bitLen(BigInt(plength));
+  let windowSize = 1;
+  if (wbits > 12)
+    windowSize = wbits - 3;
+  else if (wbits > 4)
+    windowSize = wbits - 2;
+  else if (wbits > 0)
+    windowSize = 2;
+  const MASK = bitMask(windowSize);
+  const buckets = new Array(Number(MASK) + 1).fill(zero);
+  const lastBits = Math.floor((fieldN.BITS - 1) / windowSize) * windowSize;
+  let sum = zero;
+  for (let i = lastBits; i >= 0; i -= windowSize) {
+    buckets.fill(zero);
+    for (let j = 0; j < slength; j++) {
+      const scalar = scalars[j];
+      const wbits2 = Number(scalar >> BigInt(i) & MASK);
+      buckets[wbits2] = buckets[wbits2].add(points[j]);
+    }
+    let resI = zero;
+    for (let j = buckets.length - 1, sumI = zero; j > 0; j--) {
+      sumI = sumI.add(buckets[j]);
+      resI = resI.add(sumI);
+    }
+    sum = sum.add(resI);
+    if (i !== 0)
+      for (let j = 0; j < windowSize; j++)
+        sum = sum.double();
+  }
+  return sum;
+}
+function createField(order, field, isLE) {
+  if (field) {
+    if (field.ORDER !== order)
+      throw new Error("Field.ORDER must match order: Fp == p, Fn == n");
+    validateField(field);
+    return field;
+  } else {
+    return Field(order, { isLE });
+  }
+}
+function createCurveFields(type, CURVE, curveOpts = {}, FpFnLE) {
+  if (FpFnLE === void 0)
+    FpFnLE = type === "edwards";
+  if (!CURVE || typeof CURVE !== "object")
+    throw new Error(`expected valid ${type} CURVE object`);
+  for (const p of ["p", "n", "h"]) {
+    const val = CURVE[p];
+    if (!(typeof val === "bigint" && val > _0n3))
+      throw new Error(`CURVE.${p} must be positive bigint`);
+  }
+  const Fp2 = createField(CURVE.p, curveOpts.Fp, FpFnLE);
+  const Fn2 = createField(CURVE.n, curveOpts.Fn, FpFnLE);
+  const _b = type === "weierstrass" ? "b" : "d";
+  const params = ["Gx", "Gy", "a", _b];
+  for (const p of params) {
+    if (!Fp2.isValid(CURVE[p]))
+      throw new Error(`CURVE.${p} must be valid field element of CURVE.Fp`);
+  }
+  CURVE = Object.freeze(Object.assign({}, CURVE));
+  return { CURVE, Fp: Fp2, Fn: Fn2 };
+}
+
+// node_modules/@noble/curves/abstract/edwards.js
+var _0n4 = /* @__PURE__ */ BigInt(0);
+var _1n4 = /* @__PURE__ */ BigInt(1);
+var _2n2 = /* @__PURE__ */ BigInt(2);
+var _8n2 = /* @__PURE__ */ BigInt(8);
+function isEdValidXY(Fp2, CURVE, x, y) {
+  const x2 = Fp2.sqr(x);
+  const y2 = Fp2.sqr(y);
+  const left = Fp2.add(Fp2.mul(CURVE.a, x2), y2);
+  const right = Fp2.add(Fp2.ONE, Fp2.mul(CURVE.d, Fp2.mul(x2, y2)));
+  return Fp2.eql(left, right);
+}
+function edwards(params, extraOpts = {}) {
+  const opts = extraOpts;
+  const validated = createCurveFields("edwards", params, opts, opts.FpFnLE);
+  const { Fp: Fp2, Fn: Fn2 } = validated;
+  let CURVE = validated.CURVE;
+  const { h: cofactor } = CURVE;
+  validateObject(opts, {}, { uvRatio: "function" });
+  const MASK = _2n2 << BigInt(Fn2.BYTES * 8) - _1n4;
+  const modP = (n) => Fp2.create(n);
+  const uvRatio2 = opts.uvRatio === void 0 ? (u, v) => {
+    try {
+      return { isValid: true, value: Fp2.sqrt(Fp2.div(u, v)) };
+    } catch (e) {
+      return { isValid: false, value: _0n4 };
+    }
+  } : opts.uvRatio;
+  if (!isEdValidXY(Fp2, CURVE, CURVE.Gx, CURVE.Gy))
+    throw new Error("bad curve params: generator point");
+  function acoord(title, n, banZero = false) {
+    const min = banZero ? _1n4 : _0n4;
+    aInRange("coordinate " + title, n, min, MASK);
+    return n;
+  }
+  function aedpoint(other) {
+    if (!(other instanceof Point))
+      throw new Error("EdwardsPoint expected");
+  }
+  class Point {
+    // base / generator point
+    static BASE = new Point(CURVE.Gx, CURVE.Gy, _1n4, modP(CURVE.Gx * CURVE.Gy));
+    // zero / infinity / identity point
+    static ZERO = new Point(_0n4, _1n4, _1n4, _0n4);
+    // 0, 1, 1, 0
+    // math field
+    static Fp = Fp2;
+    // scalar field
+    static Fn = Fn2;
+    X;
+    Y;
+    Z;
+    T;
+    constructor(X, Y, Z, T) {
+      this.X = acoord("x", X);
+      this.Y = acoord("y", Y);
+      this.Z = acoord("z", Z, true);
+      this.T = acoord("t", T);
+      Object.freeze(this);
+    }
+    static CURVE() {
+      return CURVE;
+    }
+    /**
+     * Create one extended Edwards point from affine coordinates.
+     * Does NOT validate that the point is on-curve or torsion-free.
+     * Use `.assertValidity()` on adversarial inputs.
+     */
+    static fromAffine(p) {
+      if (p instanceof Point)
+        throw new Error("extended point not allowed");
+      const { x, y } = p || {};
+      acoord("x", x);
+      acoord("y", y);
+      return new Point(x, y, _1n4, modP(x * y));
+    }
+    // Uses algo from RFC8032 5.1.3.
+    static fromBytes(bytes, zip215 = false) {
+      const len = Fp2.BYTES;
+      const { a, d } = CURVE;
+      bytes = copyBytes(abytes2(bytes, len, "point"));
+      abool(zip215, "zip215");
+      const normed = copyBytes(bytes);
+      const lastByte = bytes[len - 1];
+      normed[len - 1] = lastByte & ~128;
+      const y = bytesToNumberLE(normed);
+      const max = zip215 ? MASK : Fp2.ORDER;
+      aInRange("point.y", y, _0n4, max);
+      const y2 = modP(y * y);
+      const u = modP(y2 - _1n4);
+      const v = modP(d * y2 - a);
+      let { isValid, value: x } = uvRatio2(u, v);
+      if (!isValid)
+        throw new Error("bad point: invalid y coordinate");
+      const isXOdd = (x & _1n4) === _1n4;
+      const isLastByteOdd = (lastByte & 128) !== 0;
+      if (!zip215 && x === _0n4 && isLastByteOdd)
+        throw new Error("bad point: x=0 and x_0=1");
+      if (isLastByteOdd !== isXOdd)
+        x = modP(-x);
+      return Point.fromAffine({ x, y });
+    }
+    static fromHex(hex, zip215 = false) {
+      return Point.fromBytes(hexToBytes2(hex), zip215);
+    }
+    get x() {
+      return this.toAffine().x;
+    }
+    get y() {
+      return this.toAffine().y;
+    }
+    precompute(windowSize = 8, isLazy = true) {
+      wnaf.createCache(this, windowSize);
+      if (!isLazy)
+        this.multiply(_2n2);
+      return this;
+    }
+    // Useful in fromAffine() - not for fromBytes(), which always created valid points.
+    assertValidity() {
+      const p = this;
+      const { a, d } = CURVE;
+      if (p.is0())
+        throw new Error("bad point: ZERO");
+      const { X, Y, Z, T } = p;
+      const X2 = modP(X * X);
+      const Y2 = modP(Y * Y);
+      const Z2 = modP(Z * Z);
+      const Z4 = modP(Z2 * Z2);
+      const aX2 = modP(X2 * a);
+      const left = modP(Z2 * modP(aX2 + Y2));
+      const right = modP(Z4 + modP(d * modP(X2 * Y2)));
+      if (left !== right)
+        throw new Error("bad point: equation left != right (1)");
+      const XY = modP(X * Y);
+      const ZT = modP(Z * T);
+      if (XY !== ZT)
+        throw new Error("bad point: equation left != right (2)");
+    }
+    // Compare one point to another.
+    equals(other) {
+      aedpoint(other);
+      const { X: X1, Y: Y1, Z: Z1 } = this;
+      const { X: X2, Y: Y2, Z: Z2 } = other;
+      const X1Z2 = modP(X1 * Z2);
+      const X2Z1 = modP(X2 * Z1);
+      const Y1Z2 = modP(Y1 * Z2);
+      const Y2Z1 = modP(Y2 * Z1);
+      return X1Z2 === X2Z1 && Y1Z2 === Y2Z1;
+    }
+    is0() {
+      return this.equals(Point.ZERO);
+    }
+    negate() {
+      return new Point(modP(-this.X), this.Y, this.Z, modP(-this.T));
+    }
+    // Fast algo for doubling Extended Point.
+    // https://hyperelliptic.org/EFD/g1p/auto-twisted-extended.html#doubling-dbl-2008-hwcd
+    // Cost: 4M + 4S + 1*a + 6add + 1*2.
+    double() {
+      const { a } = CURVE;
+      const { X: X1, Y: Y1, Z: Z1 } = this;
+      const A = modP(X1 * X1);
+      const B = modP(Y1 * Y1);
+      const C = modP(_2n2 * modP(Z1 * Z1));
+      const D = modP(a * A);
+      const x1y1 = X1 + Y1;
+      const E = modP(modP(x1y1 * x1y1) - A - B);
+      const G = D + B;
+      const F = G - C;
+      const H = D - B;
+      const X3 = modP(E * F);
+      const Y3 = modP(G * H);
+      const T3 = modP(E * H);
+      const Z3 = modP(F * G);
+      return new Point(X3, Y3, Z3, T3);
+    }
+    // Fast algo for adding 2 Extended Points.
+    // https://hyperelliptic.org/EFD/g1p/auto-twisted-extended.html#addition-add-2008-hwcd
+    // Cost: 9M + 1*a + 1*d + 7add.
+    add(other) {
+      aedpoint(other);
+      const { a, d } = CURVE;
+      const { X: X1, Y: Y1, Z: Z1, T: T1 } = this;
+      const { X: X2, Y: Y2, Z: Z2, T: T2 } = other;
+      const A = modP(X1 * X2);
+      const B = modP(Y1 * Y2);
+      const C = modP(T1 * d * T2);
+      const D = modP(Z1 * Z2);
+      const E = modP((X1 + Y1) * (X2 + Y2) - A - B);
+      const F = D - C;
+      const G = D + C;
+      const H = modP(B - a * A);
+      const X3 = modP(E * F);
+      const Y3 = modP(G * H);
+      const T3 = modP(E * H);
+      const Z3 = modP(F * G);
+      return new Point(X3, Y3, Z3, T3);
+    }
+    subtract(other) {
+      aedpoint(other);
+      return this.add(other.negate());
+    }
+    // Constant-time multiplication.
+    multiply(scalar) {
+      if (!Fn2.isValidNot0(scalar))
+        throw new RangeError("invalid scalar: expected 1 <= sc < curve.n");
+      const { p, f } = wnaf.cached(this, scalar, (p2) => normalizeZ(Point, p2));
+      return normalizeZ(Point, [p, f])[0];
+    }
+    // Non-constant-time multiplication. Uses double-and-add algorithm.
+    // It's faster, but should only be used when you don't care about
+    // an exposed private key e.g. sig verification.
+    // Keeps the same subgroup-scalar contract: 0 is allowed for public-scalar callers, but
+    // n and larger values are rejected instead of being reduced mod n to the identity point.
+    multiplyUnsafe(scalar) {
+      if (!Fn2.isValid(scalar))
+        throw new RangeError("invalid scalar: expected 0 <= sc < curve.n");
+      if (scalar === _0n4)
+        return Point.ZERO;
+      if (this.is0() || scalar === _1n4)
+        return this;
+      return wnaf.unsafe(this, scalar, (p) => normalizeZ(Point, p));
+    }
+    // Checks if point is of small order.
+    // If you add something to small order point, you will have "dirty"
+    // point with torsion component.
+    // Clears cofactor and checks if the result is 0.
+    isSmallOrder() {
+      return this.clearCofactor().is0();
+    }
+    // Multiplies point by curve order and checks if the result is 0.
+    // Returns `false` is the point is dirty.
+    isTorsionFree() {
+      return wnaf.unsafe(this, CURVE.n).is0();
+    }
+    // Converts Extended point to default (x, y) coordinates.
+    // Can accept precomputed Z^-1 - for example, from invertBatch.
+    toAffine(invertedZ) {
+      const p = this;
+      let iz = invertedZ;
+      const { X, Y, Z } = p;
+      const is0 = p.is0();
+      if (iz == null)
+        iz = is0 ? _8n2 : Fp2.inv(Z);
+      const x = modP(X * iz);
+      const y = modP(Y * iz);
+      const zz = Fp2.mul(Z, iz);
+      if (is0)
+        return { x: _0n4, y: _1n4 };
+      if (zz !== _1n4)
+        throw new Error("invZ was invalid");
+      return { x, y };
+    }
+    clearCofactor() {
+      if (cofactor === _1n4)
+        return this;
+      return this.multiplyUnsafe(cofactor);
+    }
+    toBytes() {
+      const { x, y } = this.toAffine();
+      const bytes = Fp2.toBytes(y);
+      bytes[bytes.length - 1] |= x & _1n4 ? 128 : 0;
+      return bytes;
+    }
+    toHex() {
+      return bytesToHex2(this.toBytes());
+    }
+    toString() {
+      return `<Point ${this.is0() ? "ZERO" : this.toHex()}>`;
+    }
+  }
+  const wnaf = new wNAF(Point, Fn2.BITS);
+  if (Fn2.BITS >= 8)
+    Point.BASE.precompute(8);
+  Object.freeze(Point.prototype);
+  Object.freeze(Point);
+  return Point;
+}
+var PrimeEdwardsPoint = class {
+  static BASE;
+  static ZERO;
+  static Fp;
+  static Fn;
+  ep;
+  /**
+   * Wrap one internal Edwards representative directly.
+   * This is not a canonical encoding boundary: alternate Edwards
+   * representatives may still describe the same abstract wrapper element.
+   */
+  constructor(ep) {
+    this.ep = ep;
+  }
+  // Static methods that must be implemented by subclasses
+  static fromBytes(_bytes) {
+    notImplemented();
+  }
+  static fromHex(_hex) {
+    notImplemented();
+  }
+  get x() {
+    return this.toAffine().x;
+  }
+  get y() {
+    return this.toAffine().y;
+  }
+  // Common implementations
+  clearCofactor() {
+    return this;
+  }
+  assertValidity() {
+    this.ep.assertValidity();
+  }
+  /**
+   * Return affine coordinates of the current internal Edwards representative.
+   * This is a convenience helper, not a canonical Ristretto/Decaf encoding.
+   * Equal abstract elements may expose different `x` / `y`; use
+   * `toBytes()` / `fromBytes()` for canonical roundtrips.
+   */
+  toAffine(invertedZ) {
+    return this.ep.toAffine(invertedZ);
+  }
+  toHex() {
+    return bytesToHex2(this.toBytes());
+  }
+  toString() {
+    return this.toHex();
+  }
+  isTorsionFree() {
+    return true;
+  }
+  isSmallOrder() {
+    return false;
+  }
+  add(other) {
+    this.assertSame(other);
+    return this.init(this.ep.add(other.ep));
+  }
+  subtract(other) {
+    this.assertSame(other);
+    return this.init(this.ep.subtract(other.ep));
+  }
+  multiply(scalar) {
+    return this.init(this.ep.multiply(scalar));
+  }
+  multiplyUnsafe(scalar) {
+    return this.init(this.ep.multiplyUnsafe(scalar));
+  }
+  double() {
+    return this.init(this.ep.double());
+  }
+  negate() {
+    return this.init(this.ep.negate());
+  }
+  precompute(windowSize, isLazy) {
+    this.ep.precompute(windowSize, isLazy);
+    return this;
+  }
+};
+
+// node_modules/@noble/curves/abstract/hash-to-curve.js
+var os2ip = bytesToNumberBE;
+function i2osp(value, length) {
+  asafenumber(value);
+  asafenumber(length);
+  if (length < 0 || length > 4)
+    throw new Error("invalid I2OSP length: " + length);
+  if (value < 0 || value > 2 ** (8 * length) - 1)
+    throw new Error("invalid I2OSP input: " + value);
+  const res = Array.from({ length }).fill(0);
+  for (let i = length - 1; i >= 0; i--) {
+    res[i] = value & 255;
+    value >>>= 8;
+  }
+  return new Uint8Array(res);
+}
+function strxor(a, b) {
+  const arr = new Uint8Array(a.length);
+  for (let i = 0; i < a.length; i++) {
+    arr[i] = a[i] ^ b[i];
+  }
+  return arr;
+}
+function normDST(DST) {
+  if (!isBytes2(DST) && typeof DST !== "string")
+    throw new Error("DST must be Uint8Array or ascii string");
+  const dst = typeof DST === "string" ? asciiToBytes(DST) : DST;
+  if (dst.length === 0)
+    throw new Error("DST must be non-empty");
+  return dst;
+}
+function expand_message_xmd(msg, DST, lenInBytes, H) {
+  abytes2(msg);
+  asafenumber(lenInBytes);
+  DST = normDST(DST);
+  if (DST.length > 255)
+    DST = H(concatBytes2(asciiToBytes("H2C-OVERSIZE-DST-"), DST));
+  const { outputLen: b_in_bytes, blockLen: r_in_bytes } = H;
+  const ell = Math.ceil(lenInBytes / b_in_bytes);
+  if (lenInBytes > 65535 || ell > 255)
+    throw new Error("expand_message_xmd: invalid lenInBytes");
+  const DST_prime = concatBytes2(DST, i2osp(DST.length, 1));
+  const Z_pad = new Uint8Array(r_in_bytes);
+  const l_i_b_str = i2osp(lenInBytes, 2);
+  const b = new Array(ell);
+  const b_0 = H(concatBytes2(Z_pad, msg, l_i_b_str, i2osp(0, 1), DST_prime));
+  b[0] = H(concatBytes2(b_0, i2osp(1, 1), DST_prime));
+  for (let i = 1; i < ell; i++) {
+    const args = [strxor(b_0, b[i - 1]), i2osp(i + 1, 1), DST_prime];
+    b[i] = H(concatBytes2(...args));
+  }
+  const pseudo_random_bytes = concatBytes2(...b);
+  return pseudo_random_bytes.slice(0, lenInBytes);
+}
+function expand_message_xof(msg, DST, lenInBytes, k, H) {
+  abytes2(msg);
+  asafenumber(lenInBytes);
+  DST = normDST(DST);
+  if (DST.length > 255) {
+    const dkLen = Math.ceil(2 * k / 8);
+    DST = H.create({ dkLen }).update(asciiToBytes("H2C-OVERSIZE-DST-")).update(DST).digest();
+  }
+  if (lenInBytes > 65535 || DST.length > 255)
+    throw new Error("expand_message_xof: invalid lenInBytes");
+  return H.create({ dkLen: lenInBytes }).update(msg).update(i2osp(lenInBytes, 2)).update(DST).update(i2osp(DST.length, 1)).digest();
+}
+function hash_to_field(msg, count, options) {
+  validateObject(options, {
+    p: "bigint",
+    m: "number",
+    k: "number",
+    hash: "function"
+  });
+  const { p, k, m, hash, expand, DST } = options;
+  asafenumber(hash.outputLen, "valid hash");
+  abytes2(msg);
+  asafenumber(count);
+  if (count < 1)
+    throw new Error("hash_to_field: expected count >= 1");
+  if (m < 1)
+    throw new Error("hash_to_field: expected m >= 1");
+  const log2p = p.toString(2).length;
+  const L = Math.ceil((log2p + k) / 8);
+  const len_in_bytes = count * m * L;
+  let prb;
+  if (expand === "xmd") {
+    prb = expand_message_xmd(msg, DST, len_in_bytes, hash);
+  } else if (expand === "xof") {
+    prb = expand_message_xof(msg, DST, len_in_bytes, k, hash);
+  } else if (expand === "_internal_pass") {
+    prb = msg;
+  } else {
+    throw new Error('expand must be "xmd" or "xof"');
+  }
+  const u = new Array(count);
+  for (let i = 0; i < count; i++) {
+    const e = new Array(m);
+    for (let j = 0; j < m; j++) {
+      const elm_offset = L * (j + i * m);
+      const tv = prb.subarray(elm_offset, elm_offset + L);
+      e[j] = mod(os2ip(tv), p);
+    }
+    u[i] = e;
+  }
+  return u;
+}
+var _DST_scalar = "HashToScalar-";
+function createHasher2(Point, mapToCurve, defaults) {
+  if (typeof mapToCurve !== "function")
+    throw new Error("mapToCurve() must be defined");
+  const snapshot = (src) => Object.freeze({
+    ...src,
+    DST: isBytes2(src.DST) ? copyBytes(src.DST) : src.DST,
+    ...src.encodeDST === void 0 ? {} : { encodeDST: isBytes2(src.encodeDST) ? copyBytes(src.encodeDST) : src.encodeDST }
+  });
+  const safeDefaults = snapshot(defaults);
+  function map(num) {
+    return Point.fromAffine(mapToCurve(num));
+  }
+  function clear(initial) {
+    const P = initial.clearCofactor();
+    if (P.equals(Point.ZERO))
+      return Point.ZERO;
+    P.assertValidity();
+    return P;
+  }
+  return Object.freeze({
+    get defaults() {
+      return snapshot(safeDefaults);
+    },
+    Point,
+    hashToCurve(msg, options) {
+      const opts = Object.assign({}, safeDefaults, options);
+      const u = hash_to_field(msg, 2, opts);
+      const u0 = map(u[0]);
+      const u1 = map(u[1]);
+      return clear(u0.add(u1));
+    },
+    encodeToCurve(msg, options) {
+      const optsDst = safeDefaults.encodeDST ? { DST: safeDefaults.encodeDST } : {};
+      const opts = Object.assign({}, safeDefaults, optsDst, options);
+      const u = hash_to_field(msg, 1, opts);
+      const u0 = map(u[0]);
+      return clear(u0);
+    },
+    /** See {@link H2CHasher} */
+    mapToCurve(scalars) {
+      if (safeDefaults.m === 1) {
+        if (typeof scalars !== "bigint")
+          throw new Error("expected bigint (m=1)");
+        return clear(map([scalars]));
+      }
+      if (!Array.isArray(scalars))
+        throw new Error("expected array of bigints");
+      for (const i of scalars)
+        if (typeof i !== "bigint")
+          throw new Error("expected array of bigints");
+      return clear(map(scalars));
+    },
+    // hash_to_scalar can produce 0: https://www.rfc-editor.org/errata/eid8393
+    // RFC 9380, draft-irtf-cfrg-bbs-signatures-08. Default scalar DST is the shared generic
+    // `HashToScalar-` prefix above unless the caller overrides it per invocation.
+    hashToScalar(msg, options) {
+      const N = Point.Fn.ORDER;
+      const opts = Object.assign({}, safeDefaults, { p: N, m: 1, DST: _DST_scalar }, options);
+      return hash_to_field(msg, 1, opts)[0][0];
+    }
+  });
+}
+
+// node_modules/@noble/curves/abstract/oprf.js
+var _DST_scalarBytes = /* @__PURE__ */ asciiToBytes(_DST_scalar);
+function createOPRF(opts) {
+  validateObject(opts, {
+    name: "string",
+    hash: "function",
+    hashToScalar: "function",
+    hashToGroup: "function"
+  });
+  validatePointCons(opts.Point);
+  const { name, Point, hash } = opts;
+  const { Fn: Fn2 } = Point;
+  const hashToGroup = (msg, ctx) => opts.hashToGroup(msg, {
+    DST: concatBytes2(asciiToBytes("HashToGroup-"), ctx)
+  });
+  const hashToScalarPrefixed = (msg, ctx) => opts.hashToScalar(msg, { DST: concatBytes2(_DST_scalarBytes, ctx) });
+  const randomScalar = (rng = randomBytes2) => {
+    const t = mapHashToField(rng(getMinHashLength(Fn2.ORDER)), Fn2.ORDER, Fn2.isLE);
+    return Fn2.isLE ? bytesToNumberLE(t) : bytesToNumberBE(t);
+  };
+  const msm = (points, scalars) => pippenger(Point, points, scalars);
+  const getCtx = (mode) => concatBytes2(asciiToBytes("OPRFV1-"), new Uint8Array([mode]), asciiToBytes("-" + name));
+  const ctxOPRF = getCtx(0);
+  const ctxVOPRF = getCtx(1);
+  const ctxPOPRF = getCtx(2);
+  function encode(...args) {
+    const res2 = [];
+    for (const a of args) {
+      if (typeof a === "number")
+        res2.push(numberToBytesBE(a, 2));
+      else if (typeof a === "string")
+        res2.push(asciiToBytes(a));
+      else {
+        abytes2(a);
+        res2.push(numberToBytesBE(a.length, 2), a);
+      }
+    }
+    return concatBytes2(...res2);
+  }
+  const inputBytes = (title, bytes) => {
+    abytes2(bytes, void 0, title);
+    if (bytes.length > 65535)
+      throw new Error(`"${title}" expected Uint8Array of length <= 65535, got length=${bytes.length}`);
+    return bytes;
+  };
+  const hashInput = (...bytes) => hash(encode(...bytes, "Finalize"));
+  function getTranscripts(B, C, D, ctx) {
+    const Bm = B.toBytes();
+    const seed = hash(encode(Bm, concatBytes2(asciiToBytes("Seed-"), ctx)));
+    const res2 = [];
+    for (let i = 0; i < C.length; i++) {
+      const Ci = C[i].toBytes();
+      const Di = D[i].toBytes();
+      const di = hashToScalarPrefixed(encode(seed, i, Ci, Di, "Composite"), ctx);
+      res2.push(di);
+    }
+    return res2;
+  }
+  function computeComposites(B, C, D, ctx) {
+    const T = getTranscripts(B, C, D, ctx);
+    const M = msm(C, T);
+    const Z = msm(D, T);
+    return { M, Z };
+  }
+  function computeCompositesFast(k, B, C, D, ctx) {
+    const T = getTranscripts(B, C, D, ctx);
+    const M = msm(C, T);
+    const Z = M.multiply(k);
+    return { M, Z };
+  }
+  function challengeTranscript(B, M, Z, t2, t3, ctx) {
+    const [Bm, a0, a1, a2, a3] = [B, M, Z, t2, t3].map((i) => i.toBytes());
+    return hashToScalarPrefixed(encode(Bm, a0, a1, a2, a3, "Challenge"), ctx);
+  }
+  function generateProof(ctx, k, B, C, D, rng) {
+    const { M, Z } = computeCompositesFast(k, B, C, D, ctx);
+    const r = randomScalar(rng);
+    const t2 = Point.BASE.multiply(r);
+    const t3 = M.multiply(r);
+    const c = challengeTranscript(B, M, Z, t2, t3, ctx);
+    const s = Fn2.sub(r, Fn2.mul(c, k));
+    return concatBytes2(...[c, s].map((i) => Fn2.toBytes(i)));
+  }
+  function verifyProof(ctx, B, C, D, proof) {
+    abytes2(proof, 2 * Fn2.BYTES);
+    const { M, Z } = computeComposites(B, C, D, ctx);
+    const [c, s] = [proof.subarray(0, Fn2.BYTES), proof.subarray(Fn2.BYTES)].map((f) => Fn2.fromBytes(f));
+    const t2 = Point.BASE.multiply(s).add(B.multiply(c));
+    const t3 = M.multiply(s).add(Z.multiply(c));
+    const expectedC = challengeTranscript(B, M, Z, t2, t3, ctx);
+    if (!Fn2.eql(c, expectedC))
+      throw new Error("proof verification failed");
+  }
+  function generateKeyPair() {
+    const skS = randomScalar();
+    const pkS = Point.BASE.multiply(skS);
+    return { secretKey: Fn2.toBytes(skS), publicKey: pkS.toBytes() };
+  }
+  function deriveKeyPair(ctx, seed, info) {
+    abytes2(seed, 32, "seed");
+    info = inputBytes("keyInfo", info);
+    const dst = concatBytes2(asciiToBytes("DeriveKeyPair"), ctx);
+    const msg = concatBytes2(seed, encode(info), Uint8Array.of(0));
+    for (let counter = 0; counter <= 255; counter++) {
+      msg[msg.length - 1] = counter;
+      const skS = opts.hashToScalar(msg, { DST: dst });
+      if (Fn2.is0(skS))
+        continue;
+      return {
+        secretKey: Fn2.toBytes(skS),
+        publicKey: Point.BASE.multiply(skS).toBytes()
+      };
+    }
+    throw new Error("Cannot derive key");
+  }
+  const wirePoint = (label, bytes) => {
+    const point = Point.fromBytes(bytes);
+    if (point.equals(Point.ZERO))
+      throw new Error(label + " point at infinity");
+    return point;
+  };
+  function blind(ctx, input, rng = randomBytes2) {
+    input = inputBytes("input", input);
+    const blind2 = randomScalar(rng);
+    const inputPoint = hashToGroup(input, ctx);
+    if (inputPoint.equals(Point.ZERO))
+      throw new Error("Input point at infinity");
+    const blinded = inputPoint.multiply(blind2);
+    return { blind: Fn2.toBytes(blind2), blinded: blinded.toBytes() };
+  }
+  function evaluate(ctx, secretKey, input) {
+    input = inputBytes("input", input);
+    const skS = Fn2.fromBytes(secretKey);
+    const inputPoint = hashToGroup(input, ctx);
+    if (inputPoint.equals(Point.ZERO))
+      throw new Error("Input point at infinity");
+    const unblinded = inputPoint.multiply(skS).toBytes();
+    return hashInput(input, unblinded);
+  }
+  const oprf = Object.freeze({
+    generateKeyPair,
+    deriveKeyPair: (seed, keyInfo) => deriveKeyPair(ctxOPRF, seed, keyInfo),
+    blind: (input, rng = randomBytes2) => blind(ctxOPRF, input, rng),
+    blindEvaluate(secretKey, blindedPoint) {
+      const skS = Fn2.fromBytes(secretKey);
+      const elm = wirePoint("blinded", blindedPoint);
+      return elm.multiply(skS).toBytes();
+    },
+    finalize(input, blindBytes, evaluatedBytes) {
+      input = inputBytes("input", input);
+      const blind2 = Fn2.fromBytes(blindBytes);
+      const evalPoint = wirePoint("evaluated", evaluatedBytes);
+      const unblinded = evalPoint.multiply(Fn2.inv(blind2)).toBytes();
+      return hashInput(input, unblinded);
+    },
+    evaluate: (secretKey, input) => evaluate(ctxOPRF, secretKey, input)
+  });
+  const voprf = Object.freeze({
+    generateKeyPair,
+    deriveKeyPair: (seed, keyInfo) => deriveKeyPair(ctxVOPRF, seed, keyInfo),
+    blind: (input, rng = randomBytes2) => blind(ctxVOPRF, input, rng),
+    blindEvaluateBatch(secretKey, publicKey, blinded, rng = randomBytes2) {
+      if (!Array.isArray(blinded))
+        throw new Error("expected array");
+      const skS = Fn2.fromBytes(secretKey);
+      const pkS = wirePoint("public key", publicKey);
+      const blindedPoints = blinded.map((i) => wirePoint("blinded", i));
+      const evaluated = blindedPoints.map((i) => i.multiply(skS));
+      const proof = generateProof(ctxVOPRF, skS, pkS, blindedPoints, evaluated, rng);
+      return { evaluated: evaluated.map((i) => i.toBytes()), proof };
+    },
+    blindEvaluate(secretKey, publicKey, blinded, rng = randomBytes2) {
+      const res2 = this.blindEvaluateBatch(secretKey, publicKey, [blinded], rng);
+      return { evaluated: res2.evaluated[0], proof: res2.proof };
+    },
+    finalizeBatch(items, publicKey, proof) {
+      if (!Array.isArray(items))
+        throw new Error("expected array");
+      const pkS = wirePoint("public key", publicKey);
+      const blindedPoints = items.map((i) => wirePoint("blinded", i.blinded));
+      const evalPoints = items.map((i) => wirePoint("evaluated", i.evaluated));
+      verifyProof(ctxVOPRF, pkS, blindedPoints, evalPoints, proof);
+      return items.map((i) => oprf.finalize(i.input, i.blind, i.evaluated));
+    },
+    finalize(input, blind2, evaluated, blinded, publicKey, proof) {
+      return this.finalizeBatch([{ input, blind: blind2, evaluated, blinded }], publicKey, proof)[0];
+    },
+    evaluate: (secretKey, input) => evaluate(ctxVOPRF, secretKey, input)
+  });
+  const poprf = (info) => {
+    info = inputBytes("info", info);
+    const m = hashToScalarPrefixed(encode("Info", info), ctxPOPRF);
+    const T = Point.BASE.multiply(m);
+    return Object.freeze({
+      generateKeyPair,
+      deriveKeyPair: (seed, keyInfo) => deriveKeyPair(ctxPOPRF, seed, keyInfo),
+      blind(input, publicKey, rng = randomBytes2) {
+        input = inputBytes("input", input);
+        const pkS = wirePoint("public key", publicKey);
+        const tweakedKey = T.add(pkS);
+        if (tweakedKey.equals(Point.ZERO))
+          throw new Error("tweakedKey point at infinity");
+        const blind2 = randomScalar(rng);
+        const inputPoint = hashToGroup(input, ctxPOPRF);
+        if (inputPoint.equals(Point.ZERO))
+          throw new Error("Input point at infinity");
+        const blindedPoint = inputPoint.multiply(blind2);
+        return {
+          blind: Fn2.toBytes(blind2),
+          blinded: blindedPoint.toBytes(),
+          tweakedKey: tweakedKey.toBytes()
+        };
+      },
+      blindEvaluateBatch(secretKey, blinded, rng = randomBytes2) {
+        if (!Array.isArray(blinded))
+          throw new Error("expected array");
+        const skS = Fn2.fromBytes(secretKey);
+        const t = Fn2.add(skS, m);
+        const invT = Fn2.inv(t);
+        const blindedPoints = blinded.map((i) => wirePoint("blinded", i));
+        const evalPoints = blindedPoints.map((i) => i.multiply(invT));
+        const tweakedKey = Point.BASE.multiply(t);
+        const proof = generateProof(ctxPOPRF, t, tweakedKey, evalPoints, blindedPoints, rng);
+        return { evaluated: evalPoints.map((i) => i.toBytes()), proof };
+      },
+      blindEvaluate(secretKey, blinded, rng = randomBytes2) {
+        const res2 = this.blindEvaluateBatch(secretKey, [blinded], rng);
+        return { evaluated: res2.evaluated[0], proof: res2.proof };
+      },
+      finalizeBatch(items, proof, tweakedKey) {
+        if (!Array.isArray(items))
+          throw new Error("expected array");
+        const inputs = items.map((i) => inputBytes("input", i.input));
+        const evalPoints = items.map((i) => wirePoint("evaluated", i.evaluated));
+        verifyProof(ctxPOPRF, wirePoint("tweakedKey", tweakedKey), evalPoints, items.map((i) => wirePoint("blinded", i.blinded)), proof);
+        return items.map((i, j) => {
+          const blind2 = Fn2.fromBytes(i.blind);
+          const point = evalPoints[j].multiply(Fn2.inv(blind2)).toBytes();
+          return hashInput(inputs[j], info, point);
+        });
+      },
+      finalize(input, blind2, evaluated, blinded, proof, tweakedKey) {
+        return this.finalizeBatch([{ input, blind: blind2, evaluated, blinded }], proof, tweakedKey)[0];
+      },
+      evaluate(secretKey, input) {
+        input = inputBytes("input", input);
+        const skS = Fn2.fromBytes(secretKey);
+        const inputPoint = hashToGroup(input, ctxPOPRF);
+        if (inputPoint.equals(Point.ZERO))
+          throw new Error("Input point at infinity");
+        const t = Fn2.add(skS, m);
+        const invT = Fn2.inv(t);
+        const unblinded = inputPoint.multiply(invT).toBytes();
+        return hashInput(input, info, unblinded);
+      }
+    });
+  };
+  const res = { name, oprf, voprf, poprf, __tests: Object.freeze({ Fn: Fn2 }) };
+  return Object.freeze(res);
+}
+
+// node_modules/@noble/curves/ed25519.js
+var _0n5 = /* @__PURE__ */ BigInt(0);
+var _1n5 = /* @__PURE__ */ BigInt(1);
+var _2n3 = /* @__PURE__ */ BigInt(2);
+var _5n2 = /* @__PURE__ */ BigInt(5);
+var _8n3 = /* @__PURE__ */ BigInt(8);
+var ed25519_CURVE_p = /* @__PURE__ */ BigInt("0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffed");
+var ed25519_CURVE = /* @__PURE__ */ (() => ({
+  p: ed25519_CURVE_p,
+  n: BigInt("0x1000000000000000000000000000000014def9dea2f79cd65812631a5cf5d3ed"),
+  h: _8n3,
+  a: BigInt("0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffec"),
+  d: BigInt("0x52036cee2b6ffe738cc740797779e89800700a4d4141d8ab75eb4dca135978a3"),
+  Gx: BigInt("0x216936d3cd6e53fec0a4e231fdd6dc5c692cc7609525a7b2c9562d608f25d51a"),
+  Gy: BigInt("0x6666666666666666666666666666666666666666666666666666666666666658")
+}))();
+function ed25519_pow_2_252_3(x) {
+  const _10n = BigInt(10), _20n = BigInt(20), _40n = BigInt(40), _80n = BigInt(80);
+  const P = ed25519_CURVE_p;
+  const x2 = x * x % P;
+  const b2 = x2 * x % P;
+  const b4 = pow2(b2, _2n3, P) * b2 % P;
+  const b5 = pow2(b4, _1n5, P) * x % P;
+  const b10 = pow2(b5, _5n2, P) * b5 % P;
+  const b20 = pow2(b10, _10n, P) * b10 % P;
+  const b40 = pow2(b20, _20n, P) * b20 % P;
+  const b80 = pow2(b40, _40n, P) * b40 % P;
+  const b160 = pow2(b80, _80n, P) * b80 % P;
+  const b240 = pow2(b160, _80n, P) * b80 % P;
+  const b250 = pow2(b240, _10n, P) * b10 % P;
+  const pow_p_5_8 = pow2(b250, _2n3, P) * x % P;
+  return { pow_p_5_8, b2 };
+}
+var ED25519_SQRT_M1 = /* @__PURE__ */ BigInt("19681161376707505956807079304988542015446066515923890162744021073123829784752");
+function uvRatio(u, v) {
+  const P = ed25519_CURVE_p;
+  const v3 = mod(v * v * v, P);
+  const v7 = mod(v3 * v3 * v, P);
+  const pow = ed25519_pow_2_252_3(u * v7).pow_p_5_8;
+  let x = mod(u * v3 * pow, P);
+  const vx2 = mod(v * x * x, P);
+  const root1 = x;
+  const root2 = mod(x * ED25519_SQRT_M1, P);
+  const useRoot1 = vx2 === u;
+  const useRoot2 = vx2 === mod(-u, P);
+  const noRoot = vx2 === mod(-u * ED25519_SQRT_M1, P);
+  if (useRoot1)
+    x = root1;
+  if (useRoot2 || noRoot)
+    x = root2;
+  if (isNegativeLE(x, P))
+    x = mod(-x, P);
+  return { isValid: useRoot1 || useRoot2, value: x };
+}
+var ed25519_Point = /* @__PURE__ */ edwards(ed25519_CURVE, { uvRatio });
+var Fp = /* @__PURE__ */ (() => ed25519_Point.Fp)();
+var Fn = /* @__PURE__ */ (() => ed25519_Point.Fn)();
+var SQRT_M1 = ED25519_SQRT_M1;
+var SQRT_AD_MINUS_ONE = /* @__PURE__ */ BigInt("25063068953384623474111414158702152701244531502492656460079210482610430750235");
+var INVSQRT_A_MINUS_D = /* @__PURE__ */ BigInt("54469307008909316920995813868745141605393597292927456921205312896311721017578");
+var ONE_MINUS_D_SQ = /* @__PURE__ */ BigInt("1159843021668779879193775521855586647937357759715417654439879720876111806838");
+var D_MINUS_ONE_SQ = /* @__PURE__ */ BigInt("40440834346308536858101042469323190826248399146238708352240133220865137265952");
+var invertSqrt = (number) => uvRatio(_1n5, number);
+var MAX_255B = /* @__PURE__ */ BigInt("0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
+var bytes255ToNumberLE = (bytes) => Fp.create(bytesToNumberLE(bytes) & MAX_255B);
+function calcElligatorRistrettoMap(r0) {
+  const { d } = ed25519_CURVE;
+  const P = ed25519_CURVE_p;
+  const mod2 = (n) => Fp.create(n);
+  const r = mod2(SQRT_M1 * r0 * r0);
+  const Ns = mod2((r + _1n5) * ONE_MINUS_D_SQ);
+  let c = BigInt(-1);
+  const D = mod2((c - d * r) * mod2(r + d));
+  let { isValid: Ns_D_is_sq, value: s } = uvRatio(Ns, D);
+  let s_ = mod2(s * r0);
+  if (!isNegativeLE(s_, P))
+    s_ = mod2(-s_);
+  if (!Ns_D_is_sq)
+    s = s_;
+  if (!Ns_D_is_sq)
+    c = r;
+  const Nt = mod2(c * (r - _1n5) * D_MINUS_ONE_SQ - D);
+  const s2 = s * s;
+  const W0 = mod2((s + s) * D);
+  const W1 = mod2(Nt * SQRT_AD_MINUS_ONE);
+  const W2 = mod2(_1n5 - s2);
+  const W3 = mod2(_1n5 + s2);
+  return new ed25519_Point(mod2(W0 * W3), mod2(W2 * W1), mod2(W1 * W3), mod2(W0 * W2));
+}
+var _RistrettoPoint = class __RistrettoPoint extends PrimeEdwardsPoint {
+  // Do NOT change syntax: the following gymnastics is done,
+  // because typescript strips comments, which makes bundlers disable tree-shaking.
+  // prettier-ignore
+  static BASE = /* @__PURE__ */ (() => new __RistrettoPoint(ed25519_Point.BASE))();
+  // prettier-ignore
+  static ZERO = /* @__PURE__ */ (() => new __RistrettoPoint(ed25519_Point.ZERO))();
+  // prettier-ignore
+  static Fp = /* @__PURE__ */ (() => Fp)();
+  // prettier-ignore
+  static Fn = /* @__PURE__ */ (() => Fn)();
+  constructor(ep) {
+    super(ep);
+  }
+  /**
+   * Create one Ristretto255 point from affine Edwards coordinates.
+   * This wraps the internal Edwards representative directly and is not a
+   * canonical ristretto255 decoding path.
+   * Use `toBytes()` / `fromBytes()` if canonical ristretto255 bytes matter.
+   */
+  static fromAffine(ap) {
+    return new __RistrettoPoint(ed25519_Point.fromAffine(ap));
+  }
+  assertSame(other) {
+    if (!(other instanceof __RistrettoPoint))
+      throw new Error("RistrettoPoint expected");
+  }
+  init(ep) {
+    return new __RistrettoPoint(ep);
+  }
+  static fromBytes(bytes) {
+    abytes(bytes, 32);
+    const { a, d } = ed25519_CURVE;
+    const P = ed25519_CURVE_p;
+    const mod2 = (n) => Fp.create(n);
+    const s = bytes255ToNumberLE(bytes);
+    if (!equalBytes(Fp.toBytes(s), bytes) || isNegativeLE(s, P))
+      throw new Error("invalid ristretto255 encoding 1");
+    const s2 = mod2(s * s);
+    const u1 = mod2(_1n5 + a * s2);
+    const u2 = mod2(_1n5 - a * s2);
+    const u1_2 = mod2(u1 * u1);
+    const u2_2 = mod2(u2 * u2);
+    const v = mod2(a * d * u1_2 - u2_2);
+    const { isValid, value: I } = invertSqrt(mod2(v * u2_2));
+    const Dx = mod2(I * u2);
+    const Dy = mod2(I * Dx * v);
+    let x = mod2((s + s) * Dx);
+    if (isNegativeLE(x, P))
+      x = mod2(-x);
+    const y = mod2(u1 * Dy);
+    const t = mod2(x * y);
+    if (!isValid || isNegativeLE(t, P) || y === _0n5)
+      throw new Error("invalid ristretto255 encoding 2");
+    return new __RistrettoPoint(new ed25519_Point(x, y, _1n5, t));
+  }
+  /**
+   * Converts ristretto-encoded string to ristretto point.
+   * Described in [RFC9496](https://www.rfc-editor.org/rfc/rfc9496#name-decode).
+   * @param hex - Ristretto-encoded 32 bytes. Not every 32-byte string is valid ristretto encoding
+   */
+  static fromHex(hex) {
+    return __RistrettoPoint.fromBytes(hexToBytes(hex));
+  }
+  /**
+   * Encodes ristretto point to Uint8Array.
+   * Described in [RFC9496](https://www.rfc-editor.org/rfc/rfc9496#name-encode).
+   */
+  toBytes() {
+    let { X, Y, Z, T } = this.ep;
+    const P = ed25519_CURVE_p;
+    const mod2 = (n) => Fp.create(n);
+    const u1 = mod2(mod2(Z + Y) * mod2(Z - Y));
+    const u2 = mod2(X * Y);
+    const u2sq = mod2(u2 * u2);
+    const { value: invsqrt } = invertSqrt(mod2(u1 * u2sq));
+    const D1 = mod2(invsqrt * u1);
+    const D2 = mod2(invsqrt * u2);
+    const zInv = mod2(D1 * D2 * T);
+    let D;
+    if (isNegativeLE(T * zInv, P)) {
+      let _x = mod2(Y * SQRT_M1);
+      let _y = mod2(X * SQRT_M1);
+      X = _x;
+      Y = _y;
+      D = mod2(D1 * INVSQRT_A_MINUS_D);
+    } else {
+      D = D2;
+    }
+    if (isNegativeLE(X * zInv, P))
+      Y = mod2(-Y);
+    let s = mod2((Z - Y) * D);
+    if (isNegativeLE(s, P))
+      s = mod2(-s);
+    return Fp.toBytes(s);
+  }
+  /**
+   * Compares two Ristretto points.
+   * Described in [RFC9496](https://www.rfc-editor.org/rfc/rfc9496#name-equals).
+   */
+  equals(other) {
+    this.assertSame(other);
+    const { X: X1, Y: Y1 } = this.ep;
+    const { X: X2, Y: Y2 } = other.ep;
+    const mod2 = (n) => Fp.create(n);
+    const one = mod2(X1 * Y2) === mod2(Y1 * X2);
+    const two = mod2(Y1 * Y2) === mod2(X1 * X2);
+    return one || two;
+  }
+  is0() {
+    return this.equals(__RistrettoPoint.ZERO);
+  }
+};
+Object.freeze(_RistrettoPoint.BASE);
+Object.freeze(_RistrettoPoint.ZERO);
+Object.freeze(_RistrettoPoint.prototype);
+Object.freeze(_RistrettoPoint);
+var ristretto255_hasher = Object.freeze({
+  Point: _RistrettoPoint,
+  /**
+  * Spec: https://www.rfc-editor.org/rfc/rfc9380.html#name-hashing-to-ristretto255. Caveats:
+  * * There are no test vectors
+  * * encodeToCurve / mapToCurve is undefined
+  * * mapToCurve would be `calcElligatorRistrettoMap(scalars[0])`, not ristretto255_map!
+  * * hashToScalar is undefined too, so we just use OPRF implementation
+  * * We cannot re-use 'createHasher', because ristretto255_map is different algorithm/RFC
+    (os2ip -> bytes255ToNumberLE)
+  * * mapToCurve == calcElligatorRistrettoMap, hashToCurve == ristretto255_map
+  * * hashToScalar is undefined in RFC9380 for ristretto, so we use the OPRF
+    version here. Using `bytes255ToNumblerLE` will create a different result
+    if we use `bytes255ToNumberLE` as os2ip
+  * * current version is closest to spec.
+  */
+  hashToCurve(msg, options) {
+    const DST = options?.DST === void 0 ? "ristretto255_XMD:SHA-512_R255MAP_RO_" : options.DST;
+    const xmd = expand_message_xmd(msg, DST, 64, sha512);
+    return ristretto255_hasher.deriveToCurve(xmd);
+  },
+  hashToScalar(msg, options = { DST: _DST_scalar }) {
+    const xmd = expand_message_xmd(msg, options.DST, 64, sha512);
+    return Fn.create(bytesToNumberLE(xmd));
+  },
+  /**
+   * HashToCurve-like construction based on RFC 9496 (Element Derivation).
+   * Converts 64 uniform random bytes into a curve point.
+   *
+   * WARNING: This represents an older hash-to-curve construction from before
+   * RFC 9380 was finalized.
+   * It was later reused as a component in the newer
+   * `hash_to_ristretto255` function defined in RFC 9380.
+   */
+  deriveToCurve(bytes) {
+    abytes(bytes, 64);
+    const r1 = bytes255ToNumberLE(bytes.subarray(0, 32));
+    const R1 = calcElligatorRistrettoMap(r1);
+    const r2 = bytes255ToNumberLE(bytes.subarray(32, 64));
+    const R2 = calcElligatorRistrettoMap(r2);
+    return new _RistrettoPoint(R1.add(R2));
+  }
+});
+var ristretto255_oprf = /* @__PURE__ */ (() => createOPRF({
+  name: "ristretto255-SHA512",
+  Point: _RistrettoPoint,
+  hash: sha512,
+  hashToGroup: ristretto255_hasher.hashToCurve,
+  hashToScalar: ristretto255_hasher.hashToScalar
+}))();
+
+// node_modules/@noble/curves/abstract/weierstrass.js
+var divNearest = (num, den) => (num + (num >= 0 ? den : -den) / _2n4) / den;
+function _splitEndoScalar(k, basis, n) {
+  aInRange("scalar", k, _0n6, n);
+  const [[a1, b1], [a2, b2]] = basis;
+  const c1 = divNearest(b2 * k, n);
+  const c2 = divNearest(-b1 * k, n);
+  let k1 = k - c1 * a1 - c2 * a2;
+  let k2 = -c1 * b1 - c2 * b2;
+  const k1neg = k1 < _0n6;
+  const k2neg = k2 < _0n6;
+  if (k1neg)
+    k1 = -k1;
+  if (k2neg)
+    k2 = -k2;
+  const MAX_NUM = bitMask(Math.ceil(bitLen(n) / 2)) + _1n6;
+  if (k1 < _0n6 || k1 >= MAX_NUM || k2 < _0n6 || k2 >= MAX_NUM) {
+    throw new Error("splitScalar (endomorphism): failed for k");
+  }
+  return { k1neg, k1, k2neg, k2 };
+}
+var DERErr = class extends Error {
+  constructor(m = "") {
+    super(m);
+  }
+};
+var DER = {
+  // asn.1 DER encoding utils
+  Err: DERErr,
+  // Basic building block is TLV (Tag-Length-Value)
+  _tlv: {
+    encode: (tag, data) => {
+      const { Err: E } = DER;
+      asafenumber(tag, "tag");
+      if (tag < 0 || tag > 255)
+        throw new E("tlv.encode: wrong tag");
+      if (typeof data !== "string")
+        throw new TypeError('"data" expected string, got type=' + typeof data);
+      if (data.length & 1)
+        throw new E("tlv.encode: unpadded data");
+      const dataLen = data.length / 2;
+      const len = numberToHexUnpadded(dataLen);
+      if (len.length / 2 & 128)
+        throw new E("tlv.encode: long form length too big");
+      const lenLen = dataLen > 127 ? numberToHexUnpadded(len.length / 2 | 128) : "";
+      const t = numberToHexUnpadded(tag);
+      return t + lenLen + len + data;
+    },
+    // v - value, l - left bytes (unparsed)
+    decode(tag, data) {
+      const { Err: E } = DER;
+      data = abytes2(data, void 0, "DER data");
+      let pos = 0;
+      if (tag < 0 || tag > 255)
+        throw new E("tlv.encode: wrong tag");
+      if (data.length < 2 || data[pos++] !== tag)
+        throw new E("tlv.decode: wrong tlv");
+      const first = data[pos++];
+      const isLong = !!(first & 128);
+      let length = 0;
+      if (!isLong)
+        length = first;
+      else {
+        const lenLen = first & 127;
+        if (!lenLen)
+          throw new E("tlv.decode(long): indefinite length not supported");
+        if (lenLen > 4)
+          throw new E("tlv.decode(long): byte length is too big");
+        const lengthBytes = data.subarray(pos, pos + lenLen);
+        if (lengthBytes.length !== lenLen)
+          throw new E("tlv.decode: length bytes not complete");
+        if (lengthBytes[0] === 0)
+          throw new E("tlv.decode(long): zero leftmost byte");
+        for (const b of lengthBytes)
+          length = length << 8 | b;
+        pos += lenLen;
+        if (length < 128)
+          throw new E("tlv.decode(long): not minimal encoding");
+      }
+      const v = data.subarray(pos, pos + length);
+      if (v.length !== length)
+        throw new E("tlv.decode: wrong value length");
+      return { v, l: data.subarray(pos + length) };
+    }
+  },
+  // https://crypto.stackexchange.com/a/57734 Leftmost bit of first byte is 'negative' flag,
+  // since we always use positive integers here. It must always be empty:
+  // - add zero byte if exists
+  // - if next byte doesn't have a flag, leading zero is not allowed (minimal encoding)
+  _int: {
+    encode(num) {
+      const { Err: E } = DER;
+      abignumber(num);
+      if (num < _0n6)
+        throw new E("integer: negative integers are not allowed");
+      let hex = numberToHexUnpadded(num);
+      if (Number.parseInt(hex[0], 16) & 8)
+        hex = "00" + hex;
+      if (hex.length & 1)
+        throw new E("unexpected DER parsing assertion: unpadded hex");
+      return hex;
+    },
+    decode(data) {
+      const { Err: E } = DER;
+      if (data.length < 1)
+        throw new E("invalid signature integer: empty");
+      if (data[0] & 128)
+        throw new E("invalid signature integer: negative");
+      if (data.length > 1 && data[0] === 0 && !(data[1] & 128))
+        throw new E("invalid signature integer: unnecessary leading zero");
+      return bytesToNumberBE(data);
+    }
+  },
+  toSig(bytes) {
+    const { Err: E, _int: int, _tlv: tlv } = DER;
+    const data = abytes2(bytes, void 0, "signature");
+    const { v: seqBytes, l: seqLeftBytes } = tlv.decode(48, data);
+    if (seqLeftBytes.length)
+      throw new E("invalid signature: left bytes after parsing");
+    const { v: rBytes, l: rLeftBytes } = tlv.decode(2, seqBytes);
+    const { v: sBytes, l: sLeftBytes } = tlv.decode(2, rLeftBytes);
+    if (sLeftBytes.length)
+      throw new E("invalid signature: left bytes after parsing");
+    return { r: int.decode(rBytes), s: int.decode(sBytes) };
+  },
+  hexFromSig(sig) {
+    const { _tlv: tlv, _int: int } = DER;
+    const rs = tlv.encode(2, int.encode(sig.r));
+    const ss = tlv.encode(2, int.encode(sig.s));
+    const seq = rs + ss;
+    return tlv.encode(48, seq);
+  }
+};
+Object.freeze(DER._tlv);
+Object.freeze(DER._int);
+Object.freeze(DER);
+var _0n6 = /* @__PURE__ */ BigInt(0);
+var _1n6 = /* @__PURE__ */ BigInt(1);
+var _2n4 = /* @__PURE__ */ BigInt(2);
+var _3n2 = /* @__PURE__ */ BigInt(3);
+var _4n2 = /* @__PURE__ */ BigInt(4);
+function weierstrass(params, extraOpts = {}) {
+  const validated = createCurveFields("weierstrass", params, extraOpts);
+  const Fp2 = validated.Fp;
+  const Fn2 = validated.Fn;
+  let CURVE = validated.CURVE;
+  const { h: cofactor, n: CURVE_ORDER } = CURVE;
+  validateObject(extraOpts, {}, {
+    allowInfinityPoint: "boolean",
+    clearCofactor: "function",
+    isTorsionFree: "function",
+    fromBytes: "function",
+    toBytes: "function",
+    endo: "object"
+  });
+  const { endo, allowInfinityPoint } = extraOpts;
+  if (endo) {
+    if (!Fp2.is0(CURVE.a) || typeof endo.beta !== "bigint" || !Array.isArray(endo.basises)) {
+      throw new Error('invalid endo: expected "beta": bigint and "basises": array');
+    }
+  }
+  const lengths = getWLengths(Fp2, Fn2);
+  function assertCompressionIsSupported() {
+    if (!Fp2.isOdd)
+      throw new Error("compression is not supported: Field does not have .isOdd()");
+  }
+  function pointToBytes(_c, point, isCompressed) {
+    if (allowInfinityPoint && point.is0())
+      return Uint8Array.of(0);
+    const { x, y } = point.toAffine();
+    const bx = Fp2.toBytes(x);
+    abool(isCompressed, "isCompressed");
+    if (isCompressed) {
+      assertCompressionIsSupported();
+      const hasEvenY = !Fp2.isOdd(y);
+      return concatBytes2(pprefix(hasEvenY), bx);
+    } else {
+      return concatBytes2(Uint8Array.of(4), bx, Fp2.toBytes(y));
+    }
+  }
+  function pointFromBytes(bytes) {
+    abytes2(bytes, void 0, "Point");
+    const { publicKey: comp, publicKeyUncompressed: uncomp } = lengths;
+    const length = bytes.length;
+    const head = bytes[0];
+    const tail = bytes.subarray(1);
+    if (allowInfinityPoint && length === 1 && head === 0)
+      return { x: Fp2.ZERO, y: Fp2.ZERO };
+    if (length === comp && (head === 2 || head === 3)) {
+      const x = Fp2.fromBytes(tail);
+      if (!Fp2.isValid(x))
+        throw new Error("bad point: is not on curve, wrong x");
+      const y2 = weierstrassEquation(x);
+      let y;
+      try {
+        y = Fp2.sqrt(y2);
+      } catch (sqrtError) {
+        const err = sqrtError instanceof Error ? ": " + sqrtError.message : "";
+        throw new Error("bad point: is not on curve, sqrt error" + err);
+      }
+      assertCompressionIsSupported();
+      const evenY = Fp2.isOdd(y);
+      const evenH = (head & 1) === 1;
+      if (evenH !== evenY)
+        y = Fp2.neg(y);
+      return { x, y };
+    } else if (length === uncomp && head === 4) {
+      const L = Fp2.BYTES;
+      const x = Fp2.fromBytes(tail.subarray(0, L));
+      const y = Fp2.fromBytes(tail.subarray(L, L * 2));
+      if (!isValidXY(x, y))
+        throw new Error("bad point: is not on curve");
+      return { x, y };
+    } else {
+      throw new Error(`bad point: got length ${length}, expected compressed=${comp} or uncompressed=${uncomp}`);
+    }
+  }
+  const encodePoint = extraOpts.toBytes === void 0 ? pointToBytes : extraOpts.toBytes;
+  const decodePoint = extraOpts.fromBytes === void 0 ? pointFromBytes : extraOpts.fromBytes;
+  function weierstrassEquation(x) {
+    const x2 = Fp2.sqr(x);
+    const x3 = Fp2.mul(x2, x);
+    return Fp2.add(Fp2.add(x3, Fp2.mul(x, CURVE.a)), CURVE.b);
+  }
+  function isValidXY(x, y) {
+    const left = Fp2.sqr(y);
+    const right = weierstrassEquation(x);
+    return Fp2.eql(left, right);
+  }
+  if (!isValidXY(CURVE.Gx, CURVE.Gy))
+    throw new Error("bad curve params: generator point");
+  const _4a3 = Fp2.mul(Fp2.pow(CURVE.a, _3n2), _4n2);
+  const _27b2 = Fp2.mul(Fp2.sqr(CURVE.b), BigInt(27));
+  if (Fp2.is0(Fp2.add(_4a3, _27b2)))
+    throw new Error("bad curve params: a or b");
+  function acoord(title, n, banZero = false) {
+    if (!Fp2.isValid(n) || banZero && Fp2.is0(n))
+      throw new Error(`bad point coordinate ${title}`);
+    return n;
+  }
+  function aprjpoint(other) {
+    if (!(other instanceof Point))
+      throw new Error("Weierstrass Point expected");
+  }
+  function splitEndoScalarN(k) {
+    if (!endo || !endo.basises)
+      throw new Error("no endo");
+    return _splitEndoScalar(k, endo.basises, Fn2.ORDER);
+  }
+  function finishEndo(endoBeta, k1p, k2p, k1neg, k2neg) {
+    k2p = new Point(Fp2.mul(k2p.X, endoBeta), k2p.Y, k2p.Z);
+    k1p = negateCt(k1neg, k1p);
+    k2p = negateCt(k2neg, k2p);
+    return k1p.add(k2p);
+  }
+  class Point {
+    // base / generator point
+    static BASE = new Point(CURVE.Gx, CURVE.Gy, Fp2.ONE);
+    // zero / infinity / identity point
+    static ZERO = new Point(Fp2.ZERO, Fp2.ONE, Fp2.ZERO);
+    // 0, 1, 0
+    // math field
+    static Fp = Fp2;
+    // scalar field
+    static Fn = Fn2;
+    X;
+    Y;
+    Z;
+    /** Does NOT validate if the point is valid. Use `.assertValidity()`. */
+    constructor(X, Y, Z) {
+      this.X = acoord("x", X);
+      this.Y = acoord("y", Y, true);
+      this.Z = acoord("z", Z);
+      Object.freeze(this);
+    }
+    static CURVE() {
+      return CURVE;
+    }
+    /** Does NOT validate if the point is valid. Use `.assertValidity()`. */
+    static fromAffine(p) {
+      const { x, y } = p || {};
+      if (!p || !Fp2.isValid(x) || !Fp2.isValid(y))
+        throw new Error("invalid affine point");
+      if (p instanceof Point)
+        throw new Error("projective point not allowed");
+      if (Fp2.is0(x) && Fp2.is0(y))
+        return Point.ZERO;
+      return new Point(x, y, Fp2.ONE);
+    }
+    static fromBytes(bytes) {
+      const P = Point.fromAffine(decodePoint(abytes2(bytes, void 0, "point")));
+      P.assertValidity();
+      return P;
+    }
+    static fromHex(hex) {
+      return Point.fromBytes(hexToBytes2(hex));
+    }
+    get x() {
+      return this.toAffine().x;
+    }
+    get y() {
+      return this.toAffine().y;
+    }
+    /**
+     *
+     * @param windowSize
+     * @param isLazy - true will defer table computation until the first multiplication
+     * @returns
+     */
+    precompute(windowSize = 8, isLazy = true) {
+      wnaf.createCache(this, windowSize);
+      if (!isLazy)
+        this.multiply(_3n2);
+      return this;
+    }
+    // TODO: return `this`
+    /** A point on curve is valid if it conforms to equation. */
+    assertValidity() {
+      const p = this;
+      if (p.is0()) {
+        if (extraOpts.allowInfinityPoint && Fp2.is0(p.X) && Fp2.eql(p.Y, Fp2.ONE) && Fp2.is0(p.Z))
+          return;
+        throw new Error("bad point: ZERO");
+      }
+      const { x, y } = p.toAffine();
+      if (!Fp2.isValid(x) || !Fp2.isValid(y))
+        throw new Error("bad point: x or y not field elements");
+      if (!isValidXY(x, y))
+        throw new Error("bad point: equation left != right");
+      if (!p.isTorsionFree())
+        throw new Error("bad point: not in prime-order subgroup");
+    }
+    hasEvenY() {
+      const { y } = this.toAffine();
+      if (!Fp2.isOdd)
+        throw new Error("Field doesn't support isOdd");
+      return !Fp2.isOdd(y);
+    }
+    /** Compare one point to another. */
+    equals(other) {
+      aprjpoint(other);
+      const { X: X1, Y: Y1, Z: Z1 } = this;
+      const { X: X2, Y: Y2, Z: Z2 } = other;
+      const U1 = Fp2.eql(Fp2.mul(X1, Z2), Fp2.mul(X2, Z1));
+      const U2 = Fp2.eql(Fp2.mul(Y1, Z2), Fp2.mul(Y2, Z1));
+      return U1 && U2;
+    }
+    /** Flips point to one corresponding to (x, -y) in Affine coordinates. */
+    negate() {
+      return new Point(this.X, Fp2.neg(this.Y), this.Z);
+    }
+    // Renes-Costello-Batina exception-free doubling formula.
+    // There is 30% faster Jacobian formula, but it is not complete.
+    // https://eprint.iacr.org/2015/1060, algorithm 3
+    // Cost: 8M + 3S + 3*a + 2*b3 + 15add.
+    double() {
+      const { a, b } = CURVE;
+      const b3 = Fp2.mul(b, _3n2);
+      const { X: X1, Y: Y1, Z: Z1 } = this;
+      let X3 = Fp2.ZERO, Y3 = Fp2.ZERO, Z3 = Fp2.ZERO;
+      let t0 = Fp2.mul(X1, X1);
+      let t1 = Fp2.mul(Y1, Y1);
+      let t2 = Fp2.mul(Z1, Z1);
+      let t3 = Fp2.mul(X1, Y1);
+      t3 = Fp2.add(t3, t3);
+      Z3 = Fp2.mul(X1, Z1);
+      Z3 = Fp2.add(Z3, Z3);
+      X3 = Fp2.mul(a, Z3);
+      Y3 = Fp2.mul(b3, t2);
+      Y3 = Fp2.add(X3, Y3);
+      X3 = Fp2.sub(t1, Y3);
+      Y3 = Fp2.add(t1, Y3);
+      Y3 = Fp2.mul(X3, Y3);
+      X3 = Fp2.mul(t3, X3);
+      Z3 = Fp2.mul(b3, Z3);
+      t2 = Fp2.mul(a, t2);
+      t3 = Fp2.sub(t0, t2);
+      t3 = Fp2.mul(a, t3);
+      t3 = Fp2.add(t3, Z3);
+      Z3 = Fp2.add(t0, t0);
+      t0 = Fp2.add(Z3, t0);
+      t0 = Fp2.add(t0, t2);
+      t0 = Fp2.mul(t0, t3);
+      Y3 = Fp2.add(Y3, t0);
+      t2 = Fp2.mul(Y1, Z1);
+      t2 = Fp2.add(t2, t2);
+      t0 = Fp2.mul(t2, t3);
+      X3 = Fp2.sub(X3, t0);
+      Z3 = Fp2.mul(t2, t1);
+      Z3 = Fp2.add(Z3, Z3);
+      Z3 = Fp2.add(Z3, Z3);
+      return new Point(X3, Y3, Z3);
+    }
+    // Renes-Costello-Batina exception-free addition formula.
+    // There is 30% faster Jacobian formula, but it is not complete.
+    // https://eprint.iacr.org/2015/1060, algorithm 1
+    // Cost: 12M + 0S + 3*a + 3*b3 + 23add.
+    add(other) {
+      aprjpoint(other);
+      const { X: X1, Y: Y1, Z: Z1 } = this;
+      const { X: X2, Y: Y2, Z: Z2 } = other;
+      let X3 = Fp2.ZERO, Y3 = Fp2.ZERO, Z3 = Fp2.ZERO;
+      const a = CURVE.a;
+      const b3 = Fp2.mul(CURVE.b, _3n2);
+      let t0 = Fp2.mul(X1, X2);
+      let t1 = Fp2.mul(Y1, Y2);
+      let t2 = Fp2.mul(Z1, Z2);
+      let t3 = Fp2.add(X1, Y1);
+      let t4 = Fp2.add(X2, Y2);
+      t3 = Fp2.mul(t3, t4);
+      t4 = Fp2.add(t0, t1);
+      t3 = Fp2.sub(t3, t4);
+      t4 = Fp2.add(X1, Z1);
+      let t5 = Fp2.add(X2, Z2);
+      t4 = Fp2.mul(t4, t5);
+      t5 = Fp2.add(t0, t2);
+      t4 = Fp2.sub(t4, t5);
+      t5 = Fp2.add(Y1, Z1);
+      X3 = Fp2.add(Y2, Z2);
+      t5 = Fp2.mul(t5, X3);
+      X3 = Fp2.add(t1, t2);
+      t5 = Fp2.sub(t5, X3);
+      Z3 = Fp2.mul(a, t4);
+      X3 = Fp2.mul(b3, t2);
+      Z3 = Fp2.add(X3, Z3);
+      X3 = Fp2.sub(t1, Z3);
+      Z3 = Fp2.add(t1, Z3);
+      Y3 = Fp2.mul(X3, Z3);
+      t1 = Fp2.add(t0, t0);
+      t1 = Fp2.add(t1, t0);
+      t2 = Fp2.mul(a, t2);
+      t4 = Fp2.mul(b3, t4);
+      t1 = Fp2.add(t1, t2);
+      t2 = Fp2.sub(t0, t2);
+      t2 = Fp2.mul(a, t2);
+      t4 = Fp2.add(t4, t2);
+      t0 = Fp2.mul(t1, t4);
+      Y3 = Fp2.add(Y3, t0);
+      t0 = Fp2.mul(t5, t4);
+      X3 = Fp2.mul(t3, X3);
+      X3 = Fp2.sub(X3, t0);
+      t0 = Fp2.mul(t3, t1);
+      Z3 = Fp2.mul(t5, Z3);
+      Z3 = Fp2.add(Z3, t0);
+      return new Point(X3, Y3, Z3);
+    }
+    subtract(other) {
+      aprjpoint(other);
+      return this.add(other.negate());
+    }
+    is0() {
+      return this.equals(Point.ZERO);
+    }
+    /**
+     * Constant time multiplication.
+     * Uses wNAF method. Windowed method may be 10% faster,
+     * but takes 2x longer to generate and consumes 2x memory.
+     * Uses precomputes when available.
+     * Uses endomorphism for Koblitz curves.
+     * @param scalar - by which the point would be multiplied
+     * @returns New point
+     */
+    multiply(scalar) {
+      const { endo: endo2 } = extraOpts;
+      if (!Fn2.isValidNot0(scalar))
+        throw new RangeError("invalid scalar: out of range");
+      let point, fake;
+      const mul = (n) => wnaf.cached(this, n, (p) => normalizeZ(Point, p));
+      if (endo2) {
+        const { k1neg, k1, k2neg, k2 } = splitEndoScalarN(scalar);
+        const { p: k1p, f: k1f } = mul(k1);
+        const { p: k2p, f: k2f } = mul(k2);
+        fake = k1f.add(k2f);
+        point = finishEndo(endo2.beta, k1p, k2p, k1neg, k2neg);
+      } else {
+        const { p, f } = mul(scalar);
+        point = p;
+        fake = f;
+      }
+      return normalizeZ(Point, [point, fake])[0];
+    }
+    /**
+     * Non-constant-time multiplication. Uses double-and-add algorithm.
+     * It's faster, but should only be used when you don't care about
+     * an exposed secret key e.g. sig verification, which works over *public* keys.
+     */
+    multiplyUnsafe(scalar) {
+      const { endo: endo2 } = extraOpts;
+      const p = this;
+      const sc = scalar;
+      if (!Fn2.isValid(sc))
+        throw new RangeError("invalid scalar: out of range");
+      if (sc === _0n6 || p.is0())
+        return Point.ZERO;
+      if (sc === _1n6)
+        return p;
+      if (wnaf.hasCache(this))
+        return this.multiply(sc);
+      if (endo2) {
+        const { k1neg, k1, k2neg, k2 } = splitEndoScalarN(sc);
+        const { p1, p2 } = mulEndoUnsafe(Point, p, k1, k2);
+        return finishEndo(endo2.beta, p1, p2, k1neg, k2neg);
+      } else {
+        return wnaf.unsafe(p, sc);
+      }
+    }
+    /**
+     * Converts Projective point to affine (x, y) coordinates.
+     * (X, Y, Z) ∋ (x=X/Z, y=Y/Z).
+     * @param invertedZ - Z^-1 (inverted zero) - optional, precomputation is useful for invertBatch
+     */
+    toAffine(invertedZ) {
+      const p = this;
+      let iz = invertedZ;
+      const { X, Y, Z } = p;
+      if (Fp2.eql(Z, Fp2.ONE))
+        return { x: X, y: Y };
+      const is0 = p.is0();
+      if (iz == null)
+        iz = is0 ? Fp2.ONE : Fp2.inv(Z);
+      const x = Fp2.mul(X, iz);
+      const y = Fp2.mul(Y, iz);
+      const zz = Fp2.mul(Z, iz);
+      if (is0)
+        return { x: Fp2.ZERO, y: Fp2.ZERO };
+      if (!Fp2.eql(zz, Fp2.ONE))
+        throw new Error("invZ was invalid");
+      return { x, y };
+    }
+    /**
+     * Checks whether Point is free of torsion elements (is in prime subgroup).
+     * Always torsion-free for cofactor=1 curves.
+     */
+    isTorsionFree() {
+      const { isTorsionFree } = extraOpts;
+      if (cofactor === _1n6)
+        return true;
+      if (isTorsionFree)
+        return isTorsionFree(Point, this);
+      return wnaf.unsafe(this, CURVE_ORDER).is0();
+    }
+    clearCofactor() {
+      const { clearCofactor } = extraOpts;
+      if (cofactor === _1n6)
+        return this;
+      if (clearCofactor)
+        return clearCofactor(Point, this);
+      return this.multiplyUnsafe(cofactor);
+    }
+    isSmallOrder() {
+      if (cofactor === _1n6)
+        return this.is0();
+      return this.clearCofactor().is0();
+    }
+    toBytes(isCompressed = true) {
+      abool(isCompressed, "isCompressed");
+      this.assertValidity();
+      return encodePoint(Point, this, isCompressed);
+    }
+    toHex(isCompressed = true) {
+      return bytesToHex2(this.toBytes(isCompressed));
+    }
+    toString() {
+      return `<Point ${this.is0() ? "ZERO" : this.toHex()}>`;
+    }
+  }
+  const bits = Fn2.BITS;
+  const wnaf = new wNAF(Point, extraOpts.endo ? Math.ceil(bits / 2) : bits);
+  if (bits >= 8)
+    Point.BASE.precompute(8);
+  Object.freeze(Point.prototype);
+  Object.freeze(Point);
+  return Point;
+}
+function pprefix(hasEvenY) {
+  return Uint8Array.of(hasEvenY ? 2 : 3);
+}
+function SWUFpSqrtRatio(Fp2, Z) {
+  const F = validateField(Fp2);
+  const q = F.ORDER;
+  let l = _0n6;
+  for (let o = q - _1n6; o % _2n4 === _0n6; o /= _2n4)
+    l += _1n6;
+  const c1 = l;
+  const _2n_pow_c1_1 = _2n4 << c1 - _1n6 - _1n6;
+  const _2n_pow_c1 = _2n_pow_c1_1 * _2n4;
+  const c2 = (q - _1n6) / _2n_pow_c1;
+  const c3 = (c2 - _1n6) / _2n4;
+  const c4 = _2n_pow_c1 - _1n6;
+  const c5 = _2n_pow_c1_1;
+  const c6 = F.pow(Z, c2);
+  const c7 = F.pow(Z, (c2 + _1n6) / _2n4);
+  let sqrtRatio = (u, v) => {
+    let tv1 = c6;
+    let tv2 = F.pow(v, c4);
+    let tv3 = F.sqr(tv2);
+    tv3 = F.mul(tv3, v);
+    let tv5 = F.mul(u, tv3);
+    tv5 = F.pow(tv5, c3);
+    tv5 = F.mul(tv5, tv2);
+    tv2 = F.mul(tv5, v);
+    tv3 = F.mul(tv5, u);
+    let tv4 = F.mul(tv3, tv2);
+    tv5 = F.pow(tv4, c5);
+    let isQR = F.eql(tv5, F.ONE);
+    tv2 = F.mul(tv3, c7);
+    tv5 = F.mul(tv4, tv1);
+    tv3 = F.cmov(tv2, tv3, isQR);
+    tv4 = F.cmov(tv5, tv4, isQR);
+    for (let i = c1; i > _1n6; i--) {
+      let tv52 = i - _2n4;
+      tv52 = _2n4 << tv52 - _1n6;
+      let tvv5 = F.pow(tv4, tv52);
+      const e1 = F.eql(tvv5, F.ONE);
+      tv2 = F.mul(tv3, tv1);
+      tv1 = F.mul(tv1, tv1);
+      tvv5 = F.mul(tv4, tv1);
+      tv3 = F.cmov(tv2, tv3, e1);
+      tv4 = F.cmov(tvv5, tv4, e1);
+    }
+    return { isValid: !F.is0(v) && (isQR || F.is0(u)), value: tv3 };
+  };
+  if (F.ORDER % _4n2 === _3n2) {
+    const c12 = (F.ORDER - _3n2) / _4n2;
+    const c22 = F.sqrt(F.neg(Z));
+    sqrtRatio = (u, v) => {
+      let tv1 = F.sqr(v);
+      const tv2 = F.mul(u, v);
+      tv1 = F.mul(tv1, tv2);
+      let y1 = F.pow(tv1, c12);
+      y1 = F.mul(y1, tv2);
+      const y2 = F.mul(y1, c22);
+      const tv3 = F.mul(F.sqr(y1), v);
+      const isQR = F.eql(tv3, u);
+      let y = F.cmov(y2, y1, isQR);
+      return { isValid: !F.is0(v) && isQR, value: y };
+    };
+  }
+  return sqrtRatio;
+}
+function mapToCurveSimpleSWU(Fp2, opts) {
+  const F = validateField(Fp2);
+  const { A, B, Z } = opts;
+  if (!F.isValidNot0(A) || !F.isValidNot0(B) || !F.isValid(Z))
+    throw new Error("mapToCurveSimpleSWU: invalid opts");
+  if (F.eql(Z, F.neg(F.ONE)) || FpIsSquare(F, Z))
+    throw new Error("mapToCurveSimpleSWU: invalid opts");
+  const x = F.mul(B, F.inv(F.mul(Z, A)));
+  const gx = F.add(F.add(F.mul(F.sqr(x), x), F.mul(A, x)), B);
+  if (!FpIsSquare(F, gx))
+    throw new Error("mapToCurveSimpleSWU: invalid opts");
+  const sqrtRatio = SWUFpSqrtRatio(F, Z);
+  if (!F.isOdd)
+    throw new Error("Field does not have .isOdd()");
+  return (u) => {
+    let tv1, tv2, tv3, tv4, tv5, tv6, x2, y;
+    tv1 = F.sqr(u);
+    tv1 = F.mul(tv1, Z);
+    tv2 = F.sqr(tv1);
+    tv2 = F.add(tv2, tv1);
+    tv3 = F.add(tv2, F.ONE);
+    tv3 = F.mul(tv3, B);
+    tv4 = F.cmov(Z, F.neg(tv2), !F.eql(tv2, F.ZERO));
+    tv4 = F.mul(tv4, A);
+    tv2 = F.sqr(tv3);
+    tv6 = F.sqr(tv4);
+    tv5 = F.mul(tv6, A);
+    tv2 = F.add(tv2, tv5);
+    tv2 = F.mul(tv2, tv3);
+    tv6 = F.mul(tv6, tv4);
+    tv5 = F.mul(tv6, B);
+    tv2 = F.add(tv2, tv5);
+    x2 = F.mul(tv1, tv3);
+    const { isValid, value } = sqrtRatio(tv2, tv6);
+    y = F.mul(tv1, u);
+    y = F.mul(y, value);
+    x2 = F.cmov(x2, tv3, isValid);
+    y = F.cmov(y, value, isValid);
+    const e1 = F.isOdd(u) === F.isOdd(y);
+    y = F.cmov(F.neg(y), y, e1);
+    const tv4_inv = FpInvertBatch(F, [tv4], true)[0];
+    x2 = F.mul(x2, tv4_inv);
+    return { x: x2, y };
+  };
+}
+function getWLengths(Fp2, Fn2) {
+  return {
+    secretKey: Fn2.BYTES,
+    publicKey: 1 + Fp2.BYTES,
+    publicKeyUncompressed: 1 + 2 * Fp2.BYTES,
+    publicKeyHasPrefix: true,
+    // Raw compact `(r || s)` signature width; DER and recovered signatures use
+    // different lengths outside this helper.
+    signature: 2 * Fn2.BYTES
+  };
+}
+
+// node_modules/@noble/curves/nist.js
+var p256_CURVE = /* @__PURE__ */ (() => ({
+  p: BigInt("0xffffffff00000001000000000000000000000000ffffffffffffffffffffffff"),
+  n: BigInt("0xffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551"),
+  h: BigInt(1),
+  a: BigInt("0xffffffff00000001000000000000000000000000fffffffffffffffffffffffc"),
+  b: BigInt("0x5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b"),
+  Gx: BigInt("0x6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296"),
+  Gy: BigInt("0x4fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5")
+}))();
+var p384_CURVE = /* @__PURE__ */ (() => ({
+  p: BigInt("0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffffff0000000000000000ffffffff"),
+  n: BigInt("0xffffffffffffffffffffffffffffffffffffffffffffffffc7634d81f4372ddf581a0db248b0a77aecec196accc52973"),
+  h: BigInt(1),
+  a: BigInt("0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffffff0000000000000000fffffffc"),
+  b: BigInt("0xb3312fa7e23ee7e4988e056be3f82d19181d9c6efe8141120314088f5013875ac656398d8a2ed19d2a85c8edd3ec2aef"),
+  Gx: BigInt("0xaa87ca22be8b05378eb1c71ef320ad746e1d3b628ba79b9859f741e082542a385502f25dbf55296c3a545e3872760ab7"),
+  Gy: BigInt("0x3617de4a96262c6f5d9e98bf9292dc29f8f41dbd289a147ce9da3113b5f0b8c00a60b1ce1d7e819d7a431d7c90ea0e5f")
+}))();
+var p521_CURVE = /* @__PURE__ */ (() => ({
+  p: BigInt("0x1ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"),
+  n: BigInt("0x01fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffa51868783bf2f966b7fcc0148f709a5d03bb5c9b8899c47aebb6fb71e91386409"),
+  h: BigInt(1),
+  a: BigInt("0x1fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc"),
+  b: BigInt("0x0051953eb9618e1c9a1f929a21a0b68540eea2da725b99b315f3b8b489918ef109e156193951ec7e937b1652c0bd3bb1bf073573df883d2c34f1ef451fd46b503f00"),
+  Gx: BigInt("0x00c6858e06b70404e9cd9e3ecb662395b4429c648139053fb521f828af606b4d3dbaa14b5e77efe75928fe1dc127a2ffa8de3348b3c1856a429bf97e7e31c2e5bd66"),
+  Gy: BigInt("0x011839296a789a3bc0045c8a5fb42c7d1bd998f54449579b446817afbd17273e662c97ee72995ef42640c550b9013fad0761353c7086a272c24088be94769fd16650")
+}))();
+function createSWU(Point, opts) {
+  let map;
+  return (scalars) => (map || (map = mapToCurveSimpleSWU(Point.Fp, opts)))(scalars[0]);
+}
+var p256_Point = /* @__PURE__ */ weierstrass(p256_CURVE);
+var p256_hasher = /* @__PURE__ */ (() => {
+  return createHasher2(p256_Point, createSWU(p256_Point, {
+    A: p256_CURVE.a,
+    B: p256_CURVE.b,
+    Z: p256_Point.Fp.create(BigInt("-10"))
+  }), {
+    DST: "P256_XMD:SHA-256_SSWU_RO_",
+    encodeDST: "P256_XMD:SHA-256_SSWU_NU_",
+    p: p256_CURVE.p,
+    m: 1,
+    k: 128,
+    expand: "xmd",
+    hash: sha256
+  });
+})();
+var p256_oprf = /* @__PURE__ */ (() => createOPRF({
+  name: "P256-SHA256",
+  Point: p256_Point,
+  hash: sha256,
+  hashToGroup: p256_hasher.hashToCurve,
+  hashToScalar: p256_hasher.hashToScalar
+}))();
+var p384_Point = /* @__PURE__ */ weierstrass(p384_CURVE);
+var p384_hasher = /* @__PURE__ */ (() => {
+  return createHasher2(p384_Point, createSWU(p384_Point, {
+    A: p384_CURVE.a,
+    B: p384_CURVE.b,
+    Z: p384_Point.Fp.create(BigInt("-12"))
+  }), {
+    DST: "P384_XMD:SHA-384_SSWU_RO_",
+    encodeDST: "P384_XMD:SHA-384_SSWU_NU_",
+    p: p384_CURVE.p,
+    m: 1,
+    k: 192,
+    expand: "xmd",
+    hash: sha384
+  });
+})();
+var p384_oprf = /* @__PURE__ */ (() => createOPRF({
+  name: "P384-SHA384",
+  Point: p384_Point,
+  hash: sha384,
+  hashToGroup: p384_hasher.hashToCurve,
+  hashToScalar: p384_hasher.hashToScalar
+}))();
+var p521_Point = /* @__PURE__ */ weierstrass(p521_CURVE);
+var p521_hasher = /* @__PURE__ */ (() => {
+  return createHasher2(p521_Point, createSWU(p521_Point, {
+    A: p521_CURVE.a,
+    B: p521_CURVE.b,
+    Z: p521_Point.Fp.create(BigInt("-4"))
+  }), {
+    DST: "P521_XMD:SHA-512_SSWU_RO_",
+    encodeDST: "P521_XMD:SHA-512_SSWU_NU_",
+    p: p521_CURVE.p,
+    m: 1,
+    k: 256,
+    expand: "xmd",
+    hash: sha512
+  });
+})();
+var p521_oprf = /* @__PURE__ */ (() => createOPRF({
+  name: "P521-SHA512",
+  Point: p521_Point,
+  hash: sha512,
+  hashToGroup: p521_hasher.hashToCurve,
+  hashToScalar: p521_hasher.hashToScalar
+  // produces L=98 just like in RFC
+}))();
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  p256_oprf,
+  p384_oprf,
+  p521_oprf,
+  ristretto255_oprf
+});
 /*! Bundled license information:
 
 @noble/curves/utils.js: