@blamejs/blamejs-shop 0.5.12 → 0.5.14

package/lib/vendor/blamejs/lib/vendor/noble-post-quantum.cjs

@@ -3,7 +3,2743 @@
 // Bundled with esbuild. Exports: ml_kem512 / ml_kem768 / ml_kem1024 (FIPS 203 KEM),
 //   ml_dsa44 / ml_dsa65 / ml_dsa87 (FIPS 204 lattice signatures),
 //   slh_dsa_sha2_*f / slh_dsa_shake_*f (FIPS 205 hash signatures).
-var Nt=Object.defineProperty;var ar=Object.getOwnPropertyDescriptor;var fr=Object.getOwnPropertyNames;var ur=Object.prototype.hasOwnProperty;var dr=(e,t)=>{for(var n in t)Nt(e,n,{get:t[n],enumerable:!0})},lr=(e,t,n,r)=>{if(t&&typeof t=="object"||typeof t=="function")for(let o of fr(t))!ur.call(e,o)&&o!==n&&Nt(e,o,{get:()=>t[o],enumerable:!(r=ar(t,o))||r.enumerable});return e};var hr=e=>lr(Nt({},"__esModule",{value:!0}),e);var Zr={};dr(Zr,{ml_dsa44:()=>Wn,ml_dsa65:()=>$n,ml_dsa87:()=>Vn,ml_kem1024:()=>jn,ml_kem512:()=>Kn,ml_kem768:()=>Pn,slh_dsa_sha2_128f:()=>sr,slh_dsa_sha2_192f:()=>cr,slh_dsa_sha2_256f:()=>ir,slh_dsa_shake_128f:()=>er,slh_dsa_shake_192f:()=>tr,slh_dsa_shake_256f:()=>nr});module.exports=hr(Zr);var _t=BigInt(4294967295),nn=BigInt(32);function pr(e,t=!1){return t?{h:Number(e&_t),l:Number(e>>nn&_t)}:{h:Number(e>>nn&_t)|0,l:Number(e&_t)|0}}function kt(e,t=!1){let n=e.length,r=new Uint32Array(n),o=new Uint32Array(n);for(let c=0;c<n;c++){let{h:s,l:i}=pr(e[c],t);[r[c],o[c]]=[s,i]}return[r,o]}var Mt=(e,t,n)=>e>>>n,Kt=(e,t,n)=>e<<32-n|t>>>n,We=(e,t,n)=>e>>>n|t<<32-n,$e=(e,t,n)=>e<<32-n|t>>>n,ut=(e,t,n)=>e<<64-n|t>>>n-32,dt=(e,t,n)=>e>>>n-32|t<<64-n;var rn=(e,t,n)=>e<<n|t>>>32-n,on=(e,t,n)=>t<<n|e>>>32-n,sn=(e,t,n)=>t<<n-32|e>>>64-n,cn=(e,t,n)=>e<<n-32|t>>>64-n;function Be(e,t,n,r){let o=(t>>>0)+(r>>>0);return{h:e+n+(o/2**32|0)|0,l:o|0}}var an=(e,t,n)=>(e>>>0)+(t>>>0)+(n>>>0),fn=(e,t,n,r)=>t+n+r+(e/2**32|0)|0,un=(e,t,n,r)=>(e>>>0)+(t>>>0)+(n>>>0)+(r>>>0),dn=(e,t,n,r,o)=>t+n+r+o+(e/2**32|0)|0,ln=(e,t,n,r,o)=>(e>>>0)+(t>>>0)+(n>>>0)+(r>>>0)+(o>>>0),hn=(e,t,n,r,o,c)=>t+n+r+o+c+(e/2**32|0)|0;function yr(e){return e instanceof Uint8Array||ArrayBuffer.isView(e)&&e.constructor.name==="Uint8Array"&&"BYTES_PER_ELEMENT"in e&&e.BYTES_PER_ELEMENT===1}function Ve(e,t=""){if(typeof e!="number"){let n=t&&`"${t}" `;throw new TypeError(`${n}expected number, got ${typeof e}`)}if(!Number.isSafeInteger(e)||e<0){let n=t&&`"${t}" `;throw new RangeError(`${n}expected integer >= 0, got ${e}`)}}function Q(e,t,n=""){let r=yr(e),o=e?.length,c=t!==void 0;if(!r||c&&o!==t){let s=n&&`"${n}" `,i=c?` of length ${t}`:"",a=r?`length=${o}`:`type=${typeof e}`,w=s+"expected Uint8Array"+i+", got "+a;throw r?new RangeError(w):new TypeError(w)}return e}function xn(e){if(typeof e!="function"||typeof e.create!="function")throw new TypeError("Hash must wrapped by utils.createHasher");if(Ve(e.outputLen),Ve(e.blockLen),e.outputLen<1)throw new Error('"outputLen" must be >= 1');if(e.blockLen<1)throw new Error('"blockLen" must be >= 1')}function He(e,t=!0){if(e.destroyed)throw new Error("Hash instance has been destroyed");if(t&&e.finished)throw new Error("Hash#digest() has already been called")}function et(e,t){Q(e,void 0,"digestInto() output");let n=t.outputLen;if(e.length<n)throw new RangeError('"digestInto() output" expected to be of length >='+n)}function Bt(e){return new Uint32Array(e.buffer,e.byteOffset,Math.floor(e.byteLength/4))}function Ee(...e){for(let t=0;t<e.length;t++)e[t].fill(0)}function Xe(e){return new DataView(e.buffer,e.byteOffset,e.byteLength)}function ke(e,t){return e<<32-t|e>>>t}var yn=new Uint8Array(new Uint32Array([287454020]).buffer)[0]===68;function br(e){return e<<24&4278190080|e<<8&16711680|e>>>8&65280|e>>>24&255}function gr(e){for(let t=0;t<e.length;t++)e[t]=br(e[t]);return e}var tt=yn?e=>e:gr,bn=typeof Uint8Array.from([]).toHex=="function"&&typeof Uint8Array.fromHex=="function",wr=Array.from({length:256},(e,t)=>t.toString(16).padStart(2,"0"));function gn(e){if(Q(e),bn)return e.toHex();let t="";for(let n=0;n<e.length;n++)t+=wr[e[n]];return t}var Oe={_0:48,_9:57,A:65,F:70,a:97,f:102};function pn(e){if(e>=Oe._0&&e<=Oe._9)return e-Oe._0;if(e>=Oe.A&&e<=Oe.F)return e-(Oe.A-10);if(e>=Oe.a&&e<=Oe.f)return e-(Oe.a-10)}function wn(e){if(typeof e!="string")throw new TypeError("hex string expected, got "+typeof e);if(bn)try{return Uint8Array.fromHex(e)}catch(o){throw o instanceof SyntaxError?new RangeError(o.message):o}let t=e.length,n=t/2;if(t%2)throw new RangeError("hex string expected, got unpadded hex of length "+t);let r=new Uint8Array(n);for(let o=0,c=0;o<n;o++,c+=2){let s=pn(e.charCodeAt(c)),i=pn(e.charCodeAt(c+1));if(s===void 0||i===void 0){let a=e[c]+e[c+1];throw new RangeError('hex string expected, got non-hex character "'+a+'" at index '+c)}r[o]=s*16+i}return r}function Ye(...e){let t=0;for(let r=0;r<e.length;r++){let o=e[r];Q(o),t+=o.length}let n=new Uint8Array(t);for(let r=0,o=0;r<e.length;r++){let c=e[r];n.set(c,o),o+=c.length}return n}function nt(e,t={}){let n=(o,c)=>e(c).update(o).digest(),r=e(void 0);return n.outputLen=r.outputLen,n.blockLen=r.blockLen,n.canXOF=r.canXOF,n.create=o=>e(o),Object.assign(n,t),Object.freeze(n)}function mn(e=32){Ve(e,"bytesLength");let t=typeof globalThis=="object"?globalThis.crypto:null;if(typeof t?.getRandomValues!="function")throw new Error("crypto.getRandomValues must be defined");if(e>65536)throw new RangeError(`"bytesLength" expected <= 65536, got ${e}`);return t.getRandomValues(new Uint8Array(e))}var Fe=e=>({oid:Uint8Array.from([6,9,96,134,72,1,101,3,4,2,e])});var mr=BigInt(0),lt=BigInt(1),Ar=BigInt(2),Tr=BigInt(7),Er=BigInt(256),_r=BigInt(113),En=[],_n=[],kn=[];for(let e=0,t=lt,n=1,r=0;e<24;e++){[n,r]=[r,(2*n+3*r)%5],En.push(2*(5*r+n)),_n.push((e+1)*(e+2)/2%64);let o=mr;for(let c=0;c<7;c++)t=(t<<lt^(t>>Tr)*_r)%Er,t&Ar&&(o^=lt<<(lt<<BigInt(c))-lt);kn.push(o)}var Bn=kt(kn,!0),kr=Bn[0],Br=Bn[1],An=(e,t,n)=>n>32?sn(e,t,n):rn(e,t,n),Tn=(e,t,n)=>n>32?cn(e,t,n):on(e,t,n);function Lr(e,t=24){if(Ve(t,"rounds"),t<1||t>24)throw new Error('"rounds" expected integer 1..24');let n=new Uint32Array(10);for(let r=24-t;r<24;r++){for(let s=0;s<10;s++)n[s]=e[s]^e[s+10]^e[s+20]^e[s+30]^e[s+40];for(let s=0;s<10;s+=2){let i=(s+8)%10,a=(s+2)%10,w=n[a],h=n[a+1],y=An(w,h,1)^n[i],_=Tn(w,h,1)^n[i+1];for(let k=0;k<50;k+=10)e[s+k]^=y,e[s+k+1]^=_}let o=e[2],c=e[3];for(let s=0;s<24;s++){let i=_n[s],a=An(o,c,i),w=Tn(o,c,i),h=En[s];o=e[h],c=e[h+1],e[h]=a,e[h+1]=w}for(let s=0;s<50;s+=10){let i=e[s],a=e[s+1],w=e[s+2],h=e[s+3];e[s]^=~e[s+2]&e[s+4],e[s+1]^=~e[s+3]&e[s+5],e[s+2]^=~e[s+4]&e[s+6],e[s+3]^=~e[s+5]&e[s+7],e[s+4]^=~e[s+6]&e[s+8],e[s+5]^=~e[s+7]&e[s+9],e[s+6]^=~e[s+8]&i,e[s+7]^=~e[s+9]&a,e[s+8]^=~i&w,e[s+9]^=~a&h}e[0]^=kr[r],e[1]^=Br[r]}Ee(n)}var Lt=class e{state;pos=0;posOut=0;finished=!1;state32;destroyed=!1;blockLen;suffix;outputLen;canXOF;enableXOF=!1;rounds;constructor(t,n,r,o=!1,c=24){if(this.blockLen=t,this.suffix=n,this.outputLen=r,this.enableXOF=o,this.canXOF=o,this.rounds=c,Ve(r,"outputLen"),!(0<t&&t<200))throw new Error("only keccak-f1600 function is supported");this.state=new Uint8Array(200),this.state32=Bt(this.state)}clone(){return this._cloneInto()}keccak(){tt(this.state32),Lr(this.state32,this.rounds),tt(this.state32),this.posOut=0,this.pos=0}update(t){He(this),Q(t);let{blockLen:n,state:r}=this,o=t.length;for(let c=0;c<o;){let s=Math.min(n-this.pos,o-c);for(let i=0;i<s;i++)r[this.pos++]^=t[c++];this.pos===n&&this.keccak()}return this}finish(){if(this.finished)return;this.finished=!0;let{state:t,suffix:n,pos:r,blockLen:o}=this;t[r]^=n,(n&128)!==0&&r===o-1&&this.keccak(),t[o-1]^=128,this.keccak()}writeInto(t){He(this,!1),Q(t),this.finish();let n=this.state,{blockLen:r}=this;for(let o=0,c=t.length;o<c;){this.posOut>=r&&this.keccak();let s=Math.min(r-this.posOut,c-o);t.set(n.subarray(this.posOut,this.posOut+s),o),this.posOut+=s,o+=s}return t}xofInto(t){if(!this.enableXOF)throw new Error("XOF is not possible for this instance");return this.writeInto(t)}xof(t){return Ve(t),this.xofInto(new Uint8Array(t))}digestInto(t){if(et(t,this),this.finished)throw new Error("digest() was already called");this.writeInto(t.subarray(0,this.outputLen)),this.destroy()}digest(){let t=new Uint8Array(this.outputLen);return this.digestInto(t),t}destroy(){this.destroyed=!0,Ee(this.state)}_cloneInto(t){let{blockLen:n,suffix:r,outputLen:o,rounds:c,enableXOF:s}=this;return t||=new e(n,r,o,s,c),t.blockLen=n,t.state32.set(this.state32),t.pos=this.pos,t.posOut=this.posOut,t.finished=this.finished,t.rounds=c,t.suffix=r,t.outputLen=o,t.enableXOF=s,t.canXOF=this.canXOF,t.destroyed=this.destroyed,t}},Ln=(e,t,n,r={})=>nt(()=>new Lt(t,e,n),r);var On=Ln(6,136,32,Fe(8));var Hn=Ln(6,72,64,Fe(10));var Sn=(e,t,n,r={})=>nt((o={})=>new Lt(t,e,o.dkLen===void 0?n:o.dkLen,!0),r),In=Sn(31,168,16,Fe(11)),re=Sn(31,136,32,Fe(12));function Pt(e){if(!Number.isSafeInteger(e)||e<0||e>4294967295)throw new Error("wrong u32 integer:"+e);return e}function Un(e){return Pt(e),(e&e-1)===0&&e!==0}function jt(e,t){if(Pt(e),!Number.isSafeInteger(t)||t<0||t>32)throw new Error(`expected integer 0 <= bits <= 32, got ${t}`);let n=0;for(let r=0;r<t;r++,e>>>=1)n=n<<1|e&1;return n>>>0}function Cn(e){return Pt(e),31-Math.clz32(e)}function Rn(e){let t=e.length;if(!Un(t))throw new Error("expected positive power-of-two length, got "+t);let n=Cn(t);for(let r=0;r<t;r++){let o=jt(r,n);if(r<o){let c=e[r];e[r]=e[o],e[o]=c}}return e}var vt=(e,t)=>{let{N:n,roots:r,dit:o,invertButterflies:c=!1,skipStages:s=0,brp:i=!0}=t,a=Cn(n);if(!Un(n))throw new Error("FFT: Polynomial size should be power of two");if(r.length!==n)throw new Error(`FFT: wrong roots length: expected ${n}, got ${r.length}`);let w=o!==c;return h=>{if(h.length!==n)throw new Error("FFT: wrong Polynomial length");o&&i&&Rn(h);for(let y=0,_=1;y<a-s;y++){let k=o?y+1+s:a-y,O=1<<k,E=O>>1,U=n>>k;for(let N=0;N<n;N+=O)for(let b=0,l=_++;b<E;b++){let I=c?o?n-l:l:b*U,F=N+b,P=N+b+E,v=r[I],K=h[P],g=h[F];if(w){let M=e.mul(K,v);h[F]=e.add(g,M),h[P]=e.sub(g,M)}else c?(h[F]=e.add(K,g),h[P]=e.mul(e.sub(K,g),v)):(h[F]=e.add(g,K),h[P]=e.mul(e.sub(g,K),v))}}return!o&&i&&Rn(h),h}};var be=Q;var Se=mn;function Ie(e,t){if(e.length!==t.length)return!1;let n=0;for(let r=0;r<e.length;r++)n|=e[r]^t[r];return n===0}function rt(e){return Uint8Array.from(Q(e))}function Dt(e){if(Object.prototype.toString.call(e)!=="[object Object]")throw new TypeError("expected valid options object")}function Ze(e){Dt(e),e.context!==void 0&&Q(e.context,void 0,"opts.context")}function Ne(e){Ze(e),e.extraEntropy!==!1&&e.extraEntropy!==void 0&&Q(e.extraEntropy,void 0,"opts.extraEntropy")}function ce(e,...t){let n=o=>typeof o=="number"?o:o.bytesLen,r=t.reduce((o,c)=>o+n(c),0);return{bytesLen:r,encode:o=>{let c=new Uint8Array(r);for(let s=0,i=0;s<t.length;s++){let a=t[s],w=n(a),h=typeof a=="number"?o[s]:a.encode(o[s]);Q(h,w,e),c.set(h,i),typeof a!="number"&&h.fill(0),i+=w}return c},decode:o=>{Q(o,r,e);let c=[];for(let s of t){let i=n(s),a=o.subarray(0,i);c.push(typeof s=="number"?a:s.decode(a)),o=o.subarray(i)}return c}}}function ge(e,t){let n=e,r=t*n.bytesLen;return{bytesLen:r,encode:o=>{if(o.length!==t)throw new RangeError(`vecCoder.encode: wrong length=${o.length}. Expected: ${t}`);let c=new Uint8Array(r);for(let s=0,i=0;s<o.length;s++){let a=n.encode(o[s]);c.set(a,i),a.fill(0),i+=a.length}return c},decode:o=>{Q(o,r);let c=[];for(let s=0;s<o.length;s+=n.bytesLen)c.push(n.decode(o.subarray(s,s+n.bytesLen)));return c}}}function V(...e){for(let t of e)if(Array.isArray(t))for(let n of t)n.fill(0);else t.fill(0)}function qe(e){if(!Number.isSafeInteger(e)||e<0||e>32)throw new RangeError(`expected bits in [0..32], got ${e}`);return e===32?4294967295:~(-1<<e)>>>0}var Fn=Uint8Array.of();function ot(e,t=Fn){if(Q(e),Q(t),t.length>255)throw new RangeError("context should be 255 bytes or less");return Ye(new Uint8Array([0,t.length]),t,e)}var Or=Uint8Array.from([6,9,96,134,72,1,101,3,4,2]);function Ot(e,t=0){if(!e.oid||!Ie(e.oid.subarray(0,10),Or))throw new Error("hash.oid is invalid: expected NIST hash");let n=e.outputLen*8/2;if(t>n)throw new Error("Pre-hash security strength too low: "+n+", required: "+t)}function st(e,t,n=Fn){if(Q(t),Q(n),n.length>255)throw new RangeError("context should be 255 bytes or less");let r=e(t);return Ye(new Uint8Array([1,n.length]),n,e.oid,r)}var Ht=e=>{let{newPoly:t,N:n,Q:r,F:o,ROOT_OF_UNITY:c,brvBits:s,isKyber:i}=e,a=(b,l=r)=>{let I=b%l|0;return(I>=0?I|0:l+I|0)|0},w=(b,l=r)=>{let I=a(b,l)|0;return(I>l>>1?I-l|0:I)|0};function h(){let b=t(n);for(let l=0;l<n;l++){let I=jt(l,s),F=BigInt(c)**BigInt(I)%BigInt(r);b[l]=Number(F)|0}return b}let y=h(),_={add:(b,l)=>a((b|0)+(l|0))|0,sub:(b,l)=>a((b|0)-(l|0))|0,mul:(b,l)=>a((b|0)*(l|0))|0,inv:b=>{throw new Error("not implemented")}},k={N:n,roots:y,invertButterflies:!0,skipStages:i?1:0,brp:!1},O=vt(_,{dit:!1,...k}),E=vt(_,{dit:!0,...k}),U={encode:b=>O(b),decode:b=>{E(b);for(let l=0;l<b.length;l++)b[l]=a(o*b[l]);return b}};return{mod:a,smod:w,nttZetas:y,NTT:{encode:b=>U.encode(b),decode:b=>U.decode(b)},bitsCoder:(b,l)=>{let I=qe(b),F=b*(n/8);return{bytesLen:F,encode:P=>{let v=P,K=new Uint8Array(F);for(let g=0,M=0,J=0,$=0;g<v.length;g++)for(M|=(l.encode(v[g])&I)<<J,J+=b;J>=8;J-=8,M>>=8)K[$++]=M&qe(J);return K},decode:P=>{let v=t(n);for(let K=0,g=0,M=0,J=0;K<P.length;K++)for(g|=P[K]<<M,M+=8;M>=b;M-=b,g>>=b)v[J++]=l.decode(g&I);return v}}}}},Nn=e=>(t,n)=>{n||(n=e.blockLen);let r=new Uint8Array(t.length+2);r.set(t);let o=t.length,c=new Uint8Array(n),s=e.create({}),i=0,a=0;return{stats:()=>({calls:i,xofs:a}),get:(w,h)=>(r[o+0]=w,r[o+1]=h,s.destroy(),s=e.create({}).update(r),i++,()=>(a++,s.xofInto(c))),clean:()=>{s.destroy(),V(c,r)}}},ct=Nn(In),St=Nn(re);var le=256,we=3329,Hr=3303,Sr=17,ye=Ht({N:le,Q:we,F:Hr,ROOT_OF_UNITY:Sr,newPoly:e=>new Uint16Array(e),brvBits:7,isKyber:!0}),Gt=Object.freeze({512:Object.freeze({N:le,Q:we,K:2,ETA1:3,ETA2:2,du:10,dv:4,RBGstrength:128}),768:Object.freeze({N:le,Q:we,K:3,ETA1:2,ETA2:2,du:10,dv:4,RBGstrength:192}),1024:Object.freeze({N:le,Q:we,K:4,ETA1:2,ETA2:2,du:11,dv:5,RBGstrength:256})}),Ir=e=>{if(e>=12)return{encode:n=>n,decode:n=>n>=we?n-we:n};let t=2**(e-1);return{encode:n=>((n<<e)+we/2)/we,decode:n=>n*we+t>>>e}},Rr=e=>ye.bitsCoder(e,e===12?{encode:t=>t,decode:t=>t>=we?t-we:t}:{encode:t=>t,decode:t=>t}),ht=e=>e===12?Rr(12):ye.bitsCoder(e,Ir(e));function Qe(e,t){let n=e,r=t;for(let o=0;o<le;o++)n[o]=ye.mod(n[o]+r[o])}function Ur(e,t){let n=e,r=t;for(let o=0;o<le;o++)n[o]=ye.mod(n[o]-r[o])}function Cr(e,t,n,r,o){let c=ye.mod(t*r*o+e*n),s=ye.mod(e*r+t*n);return{c0:c,c1:s}}function It(e,t){let n=e,r=t;for(let o=0;o<le/2;o++){let c=ye.nttZetas[64+(o>>1)];o&1&&(c=-c);let{c0:s,c1:i}=Cr(n[2*o+0],n[2*o+1],r[2*o+0],r[2*o+1],c);n[2*o+0]=s,n[2*o+1]=i}return n}function Mn(e){let t=e,n=new Uint16Array(le);for(let r=0;r<le;){let o=t();if(o.length%3)throw new Error("SampleNTT: unaligned block");for(let c=0;r<le&&c+3<=o.length;c+=3){let s=(o[c+0]>>0|o[c+1]<<8)&4095,i=(o[c+1]>>4|o[c+2]<<4)&4095;s<we&&(n[r++]=s),r<le&&i<we&&(n[r++]=i)}}return n}var Fr=(e,t)=>{let n=new Uint16Array(le),r=Bt(e);tt(r);let o=0;for(let c=0,s=0,i=0,a=0;c<r.length;c++){let w=r[c];for(let h=0;h<32;h++)i+=w&1,w>>=1,o+=1,o===t?(a=i,i=0):o===2*t&&(n[s++]=ye.mod(a-i),i=0,o=0)}if(tt(r),o)throw new Error(`sampleCBD: leftover bits: ${o}`);return n};function pt(e,t,n,r){return Fr(e(r*le/4,t,n),r)}var Nr=e=>{let t=e,{K:n,PRF:r,XOF:o,HASH512:c,ETA1:s,ETA2:i,du:a,dv:w}=t,h=ht(1),y=ht(w),_=ht(a),k=ce("publicKey",ge(ht(12),n),32),O=ge(ht(12),n),E=ce("ciphertext",ge(_,n),y),U=ce("seed",32,32);return{secretCoder:O,lengths:{secretKey:O.bytesLen,publicKey:k.bytesLen,cipherText:E.bytesLen},keygen:N=>{be(N,32,"seed");let b=new Uint8Array(33);b.set(N),b[32]=n;let l=c(b),[I,F]=U.decode(l),P=[],v=[];for(let M=0;M<n;M++)P.push(ye.NTT.encode(pt(r,F,M,s)));let K=o(I);for(let M=0;M<n;M++){let J=ye.NTT.encode(pt(r,F,n+M,s));for(let $=0;$<n;$++){let fe=Mn(K.get($,M));Qe(J,It(fe,P[$]))}v.push(J)}K.clean();let g={publicKey:k.encode([v,I]),secretKey:O.encode(P)};return V(I,F,P,v,b,l),g},encrypt:(N,b,l)=>{let[I,F]=k.decode(N),P=[];for(let $=0;$<n;$++)P.push(ye.NTT.encode(pt(r,l,$,s)));let v=o(F),K=new Uint16Array(le),g=[];for(let $=0;$<n;$++){let fe=pt(r,l,n+$,i),Ae=new Uint16Array(le);for(let pe=0;pe<n;pe++){let Ge=Mn(v.get($,pe));Qe(Ae,It(Ge,P[pe]))}Qe(fe,ye.NTT.decode(Ae)),g.push(fe),Qe(K,It(I[$],P[$])),V(Ae)}v.clean();let M=pt(r,l,2*n,i);Qe(M,ye.NTT.decode(K));let J=h.decode(b);return Qe(J,M),V(I,P,K,M),E.encode([g,J])},decrypt:(N,b)=>{let[l,I]=E.decode(N),F=O.decode(b),P=new Uint16Array(le);for(let v=0;v<n;v++)Qe(P,It(F[v],ye.NTT.encode(l[v])));return Ur(I,ye.NTT.decode(P)),V(P,F,l),h.encode(I)}}};function Mr(e){let t=e,n=Nr(t),{HASH256:r,HASH512:o,KDF:c}=t,{secretCoder:s,lengths:i}=n,a=ce("secretKey",i.secretKey,i.publicKey,32,32),w=32,h=64,y=Object.freeze({...i,seed:64,msg:w,msgRand:w,secretKey:a.bytesLen});return Object.freeze({info:Object.freeze({type:"ml-kem"}),lengths:y,keygen:(_=Se(h))=>{be(_,h,"seed");let{publicKey:k,secretKey:O}=n.keygen(_.subarray(0,32)),E=r(k),U=a.encode([O,k,E,_.subarray(32)]);return V(O,E),{publicKey:k,secretKey:U}},getPublicKey:_=>{let[k,O,E,U]=a.decode(_);return Uint8Array.from(O)},encapsulate:(_,k=Se(w))=>{be(_,i.publicKey,"publicKey"),be(k,w,"message");let O=_.subarray(0,384*e.K),E=s.encode(s.decode(rt(O)));if(!Ie(E,O))throw V(E),new Error("ML-KEM.encapsulate: wrong publicKey modulus");V(E);let U=o.create().update(k).update(r(_)).digest(),N=n.encrypt(_,k,U.subarray(32,64));return V(U.subarray(32)),{cipherText:N,sharedSecret:U.subarray(0,32)}},decapsulate:(_,k)=>{be(k,a.bytesLen,"secretKey"),be(_,i.cipherText,"cipherText");let O=a.bytesLen-96,E=O+32,U=r(k.subarray(O/2,E));if(!Ie(U,k.subarray(E,E+32)))throw new Error("invalid secretKey: hash check failed");let[N,b,l,I]=a.decode(k),F=n.decrypt(_,N),P=o.create().update(F).update(l).digest(),v=P.subarray(0,32),K=n.encrypt(b,F,P.subarray(32,64)),g=Ie(_,K),M=c.create({dkLen:32}).update(I).update(_).digest();return V(F,K,g?M:v),g?v:M}})}function Kr(e,t,n){return re.create({dkLen:e}).update(t).update(new Uint8Array([n])).digest()}var Pr={HASH256:On,HASH512:Hn,KDF:re,XOF:ct,PRF:Kr},zt=e=>Mr({...Pr,...e}),Kn=zt(Gt[512]),Pn=zt(Gt[768]),jn=zt(Gt[1024]);function vn(e,t=""){if(typeof e!="boolean"){let n=t&&`"${t}" `;throw new TypeError(n+"expected boolean, got type="+typeof e)}return e}function Dn(e){Dt(e),e.externalMu!==void 0&&vn(e.externalMu,"opts.externalMu")}var Z=256,Pe=8380417,jr=1753,vr=8347681,Je=13,Wt=Math.floor((Pe-1)/88)|0,$t=Math.floor((Pe-1)/32)|0,Vt=Object.freeze({2:Object.freeze({K:4,L:4,D:Je,GAMMA1:2**17,GAMMA2:Wt,TAU:39,ETA:2,OMEGA:80}),3:Object.freeze({K:6,L:5,D:Je,GAMMA1:2**19,GAMMA2:$t,TAU:49,ETA:4,OMEGA:55}),5:Object.freeze({K:8,L:7,D:Je,GAMMA1:2**19,GAMMA2:$t,TAU:60,ETA:2,OMEGA:75})}),me=e=>new Int32Array(e),W=Ht({N:Z,Q:Pe,F:vr,ROOT_OF_UNITY:jr,newPoly:me,isKyber:!1,brvBits:8}),Gn=e=>e,xt=(e,t=Gn,n=Gn)=>W.bitsCoder(e,{encode:r=>t(n(r)),decode:r=>n(t(r))}),Me=(e,t)=>{let n=e,r=t;for(let o=0;o<n.length;o++)n[o]=W.mod(n[o]+r[o]);return n},zn=(e,t)=>{let n=e,r=t;for(let o=0;o<n.length;o++)n[o]=W.mod(n[o]-r[o]);return n},Dr=e=>{let t=e;for(let n=0;n<Z;n++)t[n]<<=Je;return t},yt=(e,t)=>{let n=e;for(let r=0;r<Z;r++)if(Math.abs(W.smod(n[r]))>=t)return!0;return!1},Ke=(e,t)=>{let n=e,r=t,o=me(Z);for(let c=0;c<n.length;c++)o[c]=W.mod(n[c]*r[c]);return o};function Rt(e){let t=e,n=me(Z);for(let r=0;r<Z;){let o=t();if(o.length%3)throw new Error("RejNTTPoly: unaligned block");for(let c=0;r<Z&&c<=o.length-3;c+=3){let s=(o[c+0]|o[c+1]<<8|o[c+2]<<16)&8388607;s<Pe&&(n[r++]=s)}}return n}function Xt(e){let t=e,{K:n,L:r,GAMMA1:o,GAMMA2:c,TAU:s,ETA:i,OMEGA:a}=t,{CRH_BYTES:w,TR_BYTES:h,C_TILDE_BYTES:y,XOF128:_,XOF256:k,securityLevel:O}=t;if(![2,4].includes(i))throw new Error("Wrong ETA");if(![1<<17,1<<19].includes(o))throw new Error("Wrong GAMMA1");if(![Wt,$t].includes(c))throw new Error("Wrong GAMMA2");let E=s*i,U=p=>{let L=W.mod(p),T=W.smod(L,2*c)|0;return L-T===Pe-1?{r1:0,r0:T-1|0}:{r1:Math.floor((L-T)/(2*c))|0,r0:T}},N=p=>U(p).r1,b=p=>U(p).r0,l=(p,L)=>p<=c||p>Pe-c||p===Pe-c&&L===0?0:1,I=(p,L)=>{let T=Math.floor((Pe-1)/(2*c)),{r1:x,r0:u}=U(L);return p===1?u>0?W.mod(x+1,T)|0:W.mod(x-1,T)|0:x|0},F=p=>{let L=W.mod(p),T=W.smod(L,2**Je)|0;return{r1:Math.floor((L-T)/2**Je)|0,r0:T}},P={bytesLen:a+n,encode:p=>{let L=p;if(L===!1)throw new Error("hint.encode: hint is false");let T=new Uint8Array(a+n);for(let x=0,u=0;x<n;x++){for(let f=0;f<Z;f++)L[x][f]!==0&&(T[u++]=f);T[a+x]=u}return T},decode:p=>{let L=[],T=0;for(let x=0;x<n;x++){let u=me(Z);if(p[a+x]<T||p[a+x]>a)return!1;for(let f=T;f<p[a+x];f++){if(f>T&&p[f]<=p[f-1])return!1;u[p[f]]=1}T=p[a+x],L.push(u)}for(let x=T;x<a;x++)if(p[x]!==0)return!1;return L}},v=xt(i===2?3:4,p=>i-p,p=>{if(!(-i<=p&&p<=i))throw new Error(`malformed key s1/s3 ${p} outside of ETA range [${-i}, ${i}]`);return p}),K=xt(13,p=>(1<<Je-1)-p),g=xt(10),M=xt(o===1<<17?18:20,p=>W.smod(o-p)),J=xt(c===Wt?6:4),$=ge(J,n),fe=ce("publicKey",32,ge(g,n)),Ae=ce("secretKey",32,32,h,ge(v,r),ge(v,n),ge(K,n)),pe=ce("signature",y,ge(M,r),P),Ge=i===2?p=>p<15?2-p%5:!1:p=>p<9?4-p:!1;function ft(p){let L=p,T=me(Z);for(let x=0;x<Z;){let u=L();for(let f=0;x<Z&&f<u.length;f+=1){let A=Ge(u[f]&15),d=Ge(u[f]>>4&15);A!==!1&&(T[x++]=A),x<Z&&d!==!1&&(T[x++]=d)}}return T}let gt=p=>{let L=me(Z),T=re.create({}).update(p),x=new Uint8Array(re.blockLen);T.xofInto(x);let u=x.slice(0,8);for(let f=Z-s,A=8,d=0,B=0;f<Z;f++){let H=f+1;for(;H>f;)H=x[A++],!(A<re.blockLen)&&(T.xofInto(x),A=0);L[f]=L[H],L[H]=1-((u[d]>>B++&1)<<1),B>=8&&(d++,B=0)}return L},wt=p=>{let L=p,T=me(Z),x=me(Z);for(let u=0;u<L.length;u++){let{r0:f,r1:A}=F(L[u]);T[u]=f,x[u]=A}return{r0:T,r1:x}},mt=(p,L)=>{let T=p,x=L;for(let u=0;u<Z;u++)T[u]=I(x[u],T[u]);return T},At=(p,L)=>{let T=p,x=L,u=me(Z),f=0;for(let A=0;A<Z;A++){let d=l(T[A],x[A]);u[A]=d,f+=d}return{v:u,cnt:f}},ze=32,Ue=ce("seed",32,64,32),ue=Object.freeze({info:Object.freeze({type:"internal-ml-dsa"}),lengths:Object.freeze({secretKey:Ae.bytesLen,publicKey:fe.bytesLen,seed:32,signature:pe.bytesLen,signRand:ze}),keygen:p=>{let L=new Uint8Array(34),T=p===void 0;T&&(p=Se(32)),be(p,32,"seed"),L.set(p),T&&V(p),L[32]=n,L[33]=r;let[x,u,f]=Ue.decode(re(L,{dkLen:Ue.bytesLen})),A=k(u),d=[];for(let m=0;m<r;m++)d.push(ft(A.get(m&255,m>>8&255)));let B=[];for(let m=r;m<r+n;m++)B.push(ft(A.get(m&255,m>>8&255)));let H=d.map(m=>W.NTT.encode(m.slice())),R=[],C=[],G=_(x),S=me(Z);for(let m=0;m<n;m++){V(S);for(let Y=0;Y<r;Y++){let oe=Rt(G.get(Y,m));Me(S,Ke(oe,H[Y]))}W.NTT.decode(S);let{r0:X,r1:q}=wt(Me(S,B[m]));R.push(X),C.push(q)}let j=fe.encode([x,C]),D=re(j,{dkLen:h}),ee=Ae.encode([x,f,D,d,B,R]);return G.clean(),A.clean(),V(x,u,f,d,B,H,S,R,C,D,L),{publicKey:j,secretKey:ee}},getPublicKey:p=>{let[L,T,x,u,f,A]=Ae.decode(p),d=_(L),B=u.map(C=>W.NTT.encode(C.slice())),H=[],R=me(Z);for(let C=0;C<n;C++){R.fill(0);for(let S=0;S<r;S++){let j=Rt(d.get(S,C));Me(R,Ke(j,B[S]))}W.NTT.decode(R),Me(R,f[C]);let{r1:G}=wt(R);H.push(G)}return d.clean(),V(R,B,A,u,f),fe.encode([L,H])},sign:(p,L,T={})=>{Ne(T),Dn(T);let{extraEntropy:x,externalMu:u=!1}=T,[f,A,d,B,H,R]=Ae.decode(L),C=[],G=_(f);for(let m=0;m<n;m++){let X=[];for(let q=0;q<r;q++)X.push(Rt(G.get(q,m)));C.push(X)}G.clean();for(let m=0;m<r;m++)W.NTT.encode(B[m]);for(let m=0;m<n;m++)W.NTT.encode(H[m]),W.NTT.encode(R[m]);let S=u?p:re.create({dkLen:w}).update(d).update(p).digest(),j=x===!1?new Uint8Array(32):x===void 0?Se(ze):x;be(j,32,"extraEntropy");let D=re.create({dkLen:w}).update(A).update(j).update(S).digest();be(D,w);let ee=k(D,M.bytesLen);e:for(let m=0;;){let X=[];for(let z=0;z<r;z++,m++)X.push(M.decode(ee.get(m&255,m>>8)()));let q=X.map(z=>W.NTT.encode(z.slice())),Y=[];for(let z=0;z<n;z++){let ne=me(Z);for(let ie=0;ie<r;ie++)Me(ne,Ke(C[z][ie],q[ie]));W.NTT.decode(ne),Y.push(ne)}let oe=Y.map(z=>z.map(N)),te=re.create({dkLen:y}).update(S).update($.encode(oe)).digest(),de=W.NTT.encode(gt(te)),Te=B.map(z=>Ke(z,de));for(let z=0;z<r;z++)if(Me(W.NTT.decode(Te[z]),X[z]),yt(Te[z],o-E))continue e;let _e=0,se=[];for(let z=0;z<n;z++){let ne=W.NTT.decode(Ke(H[z],de)),ie=zn(Y[z],ne).map(b);if(yt(ie,c-E))continue e;let xe=W.NTT.decode(Ke(R[z],de));if(yt(xe,c))continue e;Me(ie,xe);let Le=At(ie,oe[z]);se.push(Le.v),_e+=Le.cnt}if(_e>a)continue;ee.clean();let Ce=pe.encode([te,Te,se]);return V(te,Te,se,de,oe,Y,q,X,D,B,H,R,...C),u||V(S),Ce}throw new Error("Unreachable code path reached, report this error")},verify:(p,L,T,x={})=>{Dn(x);let{externalMu:u=!1}=x,[f,A]=fe.decode(T),d=re(T,{dkLen:h});if(p.length!==pe.bytesLen)return!1;let[B,H,R]=pe.decode(p);if(R===!1)return!1;for(let m=0;m<r;m++)if(yt(H[m],o-E))return!1;let C=u?L:re.create({dkLen:w}).update(d).update(L).digest(),G=W.NTT.encode(gt(B)),S=H.map(m=>m.slice());for(let m=0;m<r;m++)W.NTT.encode(S[m]);let j=[],D=_(f);for(let m=0;m<n;m++){let X=Ke(W.NTT.encode(Dr(A[m])),G),q=me(Z);for(let oe=0;oe<r;oe++){let te=Rt(D.get(oe,m));Me(q,Ke(te,S[oe]))}let Y=W.NTT.decode(zn(q,X));j.push(mt(Y,R[m]))}D.clean();let ee=re.create({dkLen:y}).update(C).update($.encode(j)).digest();for(let m of R)if(!(m.reduce((q,Y)=>q+Y,0)<=a))return!1;for(let m of H)if(yt(m,o-E))return!1;return Ie(B,ee)}});return Object.freeze({info:Object.freeze({type:"ml-dsa"}),internal:ue,securityLevel:O,keygen:ue.keygen,lengths:ue.lengths,getPublicKey:ue.getPublicKey,sign:(p,L,T={})=>{Ne(T);let x=ot(p,T.context),u=ue.sign(x,L,T);return V(x),u},verify:(p,L,T,x={})=>(Ze(x),ue.verify(p,ot(L,x.context),T)),prehash:p=>(Ot(p,O),Object.freeze({info:Object.freeze({type:"hashml-dsa"}),securityLevel:O,lengths:ue.lengths,keygen:ue.keygen,getPublicKey:ue.getPublicKey,sign:(L,T,x={})=>{Ne(x);let u=st(p,L,x.context),f=ue.sign(u,T,x);return V(u),f},verify:(L,T,x,u={})=>(Ze(u),ue.verify(L,st(p,T,u.context),x))}))})}var Wn=Xt({...Vt[2],CRH_BYTES:64,TR_BYTES:64,C_TILDE_BYTES:32,XOF128:ct,XOF256:St,securityLevel:128}),$n=Xt({...Vt[3],CRH_BYTES:64,TR_BYTES:64,C_TILDE_BYTES:48,XOF128:ct,XOF256:St,securityLevel:192}),Vn=Xt({...Vt[5],CRH_BYTES:64,TR_BYTES:64,C_TILDE_BYTES:64,XOF128:ct,XOF256:St,securityLevel:256});var Ut=class{oHash;iHash;blockLen;outputLen;canXOF=!1;finished=!1;destroyed=!1;constructor(t,n){if(xn(t),Q(n,void 0,"key"),this.iHash=t.create(),typeof this.iHash.update!="function")throw new Error("Expected instance of class which extends utils.Hash");this.blockLen=this.iHash.blockLen,this.outputLen=this.iHash.outputLen;let r=this.blockLen,o=new Uint8Array(r);o.set(n.length>r?t.create().update(n).digest():n);for(let c=0;c<o.length;c++)o[c]^=54;this.iHash.update(o),this.oHash=t.create();for(let c=0;c<o.length;c++)o[c]^=106;this.oHash.update(o),Ee(o)}update(t){return He(this),this.iHash.update(t),this}digestInto(t){He(this),et(t,this),this.finished=!0;let n=t.subarray(0,this.outputLen);this.iHash.digestInto(n),this.oHash.update(n),this.oHash.digestInto(n),this.destroy()}digest(){let t=new Uint8Array(this.oHash.outputLen);return this.digestInto(t),t}_cloneInto(t){t||=Object.create(Object.getPrototypeOf(this),{});let{oHash:n,iHash:r,finished:o,destroyed:c,blockLen:s,outputLen:i}=this;return t=t,t.finished=o,t.destroyed=c,t.blockLen=s,t.outputLen=i,t.oHash=n._cloneInto(t.oHash),t.iHash=r._cloneInto(t.iHash),t}clone(){return this._cloneInto()}destroy(){this.destroyed=!0,this.oHash.destroy(),this.iHash.destroy()}},Xn=(()=>{let e=((t,n,r)=>new Ut(t,n).update(r).digest());return e.create=(t,n)=>new Ut(t,n),e})();function Yn(e,t,n){return e&t^~e&n}function Zn(e,t,n){return e&t^e&n^t&n}var bt=class{blockLen;outputLen;canXOF=!1;padOffset;isLE;buffer;view;finished=!1;length=0;pos=0;destroyed=!1;constructor(t,n,r,o){this.blockLen=t,this.outputLen=n,this.padOffset=r,this.isLE=o,this.buffer=new Uint8Array(t),this.view=Xe(this.buffer)}update(t){He(this),Q(t);let{view:n,buffer:r,blockLen:o}=this,c=t.length;for(let s=0;s<c;){let i=Math.min(o-this.pos,c-s);if(i===o){let a=Xe(t);for(;o<=c-s;s+=o)this.process(a,s);continue}r.set(t.subarray(s,s+i),this.pos),this.pos+=i,s+=i,this.pos===o&&(this.process(n,0),this.pos=0)}return this.length+=t.length,this.roundClean(),this}digestInto(t){He(this),et(t,this),this.finished=!0;let{buffer:n,view:r,blockLen:o,isLE:c}=this,{pos:s}=this;n[s++]=128,Ee(this.buffer.subarray(s)),this.padOffset>o-s&&(this.process(r,0),s=0);for(let y=s;y<o;y++)n[y]=0;r.setBigUint64(o-8,BigInt(this.length*8),c),this.process(r,0);let i=Xe(t),a=this.outputLen;if(a%4)throw new Error("_sha2: outputLen must be aligned to 32bit");let w=a/4,h=this.get();if(w>h.length)throw new Error("_sha2: outputLen bigger than state");for(let y=0;y<w;y++)i.setUint32(4*y,h[y],c)}digest(){let{buffer:t,outputLen:n}=this;this.digestInto(t);let r=t.slice(0,n);return this.destroy(),r}_cloneInto(t){t||=new this.constructor,t.set(...this.get());let{blockLen:n,buffer:r,length:o,finished:c,destroyed:s,pos:i}=this;return t.destroyed=s,t.finished=c,t.length=o,t.pos=i,o%n&&t.buffer.set(r),t}clone(){return this._cloneInto()}},Re=Uint32Array.from([1779033703,3144134277,1013904242,2773480762,1359893119,2600822924,528734635,1541459225]);var ae=Uint32Array.from([1779033703,4089235720,3144134277,2227873595,1013904242,4271175723,2773480762,1595750129,1359893119,2917565137,2600822924,725511199,528734635,4215389547,1541459225,327033209]);var Gr=Uint32Array.from([1116352408,1899447441,3049323471,3921009573,961987163,1508970993,2453635748,2870763221,3624381080,310598401,607225278,1426881987,1925078388,2162078206,2614888103,3248222580,3835390401,4022224774,264347078,604807628,770255983,1249150122,1555081692,1996064986,2554220882,2821834349,2952996808,3210313671,3336571891,3584528711,113926993,338241895,666307205,773529912,1294757372,1396182291,1695183700,1986661051,2177026350,2456956037,2730485921,2820302411,3259730800,3345764771,3516065817,3600352804,4094571909,275423344,430227734,506948616,659060556,883997877,958139571,1322822218,1537002063,1747873779,1955562222,2024104815,2227730452,2361852424,2428436474,2756734187,3204031479,3329325298]),je=new Uint32Array(64),Yt=class extends bt{constructor(t){super(64,t,8,!1)}get(){let{A:t,B:n,C:r,D:o,E:c,F:s,G:i,H:a}=this;return[t,n,r,o,c,s,i,a]}set(t,n,r,o,c,s,i,a){this.A=t|0,this.B=n|0,this.C=r|0,this.D=o|0,this.E=c|0,this.F=s|0,this.G=i|0,this.H=a|0}process(t,n){for(let y=0;y<16;y++,n+=4)je[y]=t.getUint32(n,!1);for(let y=16;y<64;y++){let _=je[y-15],k=je[y-2],O=ke(_,7)^ke(_,18)^_>>>3,E=ke(k,17)^ke(k,19)^k>>>10;je[y]=E+je[y-7]+O+je[y-16]|0}let{A:r,B:o,C:c,D:s,E:i,F:a,G:w,H:h}=this;for(let y=0;y<64;y++){let _=ke(i,6)^ke(i,11)^ke(i,25),k=h+_+Yn(i,a,w)+Gr[y]+je[y]|0,E=(ke(r,2)^ke(r,13)^ke(r,22))+Zn(r,o,c)|0;h=w,w=a,a=i,i=s+k|0,s=c,c=o,o=r,r=k+E|0}r=r+this.A|0,o=o+this.B|0,c=c+this.C|0,s=s+this.D|0,i=i+this.E|0,a=a+this.F|0,w=w+this.G|0,h=h+this.H|0,this.set(r,o,c,s,i,a,w,h)}roundClean(){Ee(je)}destroy(){this.destroyed=!0,this.set(0,0,0,0,0,0,0,0),Ee(this.buffer)}},Zt=class extends Yt{A=Re[0]|0;B=Re[1]|0;C=Re[2]|0;D=Re[3]|0;E=Re[4]|0;F=Re[5]|0;G=Re[6]|0;H=Re[7]|0;constructor(){super(32)}};var qn=kt(["0x428a2f98d728ae22","0x7137449123ef65cd","0xb5c0fbcfec4d3b2f","0xe9b5dba58189dbbc","0x3956c25bf348b538","0x59f111f1b605d019","0x923f82a4af194f9b","0xab1c5ed5da6d8118","0xd807aa98a3030242","0x12835b0145706fbe","0x243185be4ee4b28c","0x550c7dc3d5ffb4e2","0x72be5d74f27b896f","0x80deb1fe3b1696b1","0x9bdc06a725c71235","0xc19bf174cf692694","0xe49b69c19ef14ad2","0xefbe4786384f25e3","0x0fc19dc68b8cd5b5","0x240ca1cc77ac9c65","0x2de92c6f592b0275","0x4a7484aa6ea6e483","0x5cb0a9dcbd41fbd4","0x76f988da831153b5","0x983e5152ee66dfab","0xa831c66d2db43210","0xb00327c898fb213f","0xbf597fc7beef0ee4","0xc6e00bf33da88fc2","0xd5a79147930aa725","0x06ca6351e003826f","0x142929670a0e6e70","0x27b70a8546d22ffc","0x2e1b21385c26c926","0x4d2c6dfc5ac42aed","0x53380d139d95b3df","0x650a73548baf63de","0x766a0abb3c77b2a8","0x81c2c92e47edaee6","0x92722c851482353b","0xa2bfe8a14cf10364","0xa81a664bbc423001","0xc24b8b70d0f89791","0xc76c51a30654be30","0xd192e819d6ef5218","0xd69906245565a910","0xf40e35855771202a","0x106aa07032bbd1b8","0x19a4c116b8d2d0c8","0x1e376c085141ab53","0x2748774cdf8eeb99","0x34b0bcb5e19b48a8","0x391c0cb3c5c95a63","0x4ed8aa4ae3418acb","0x5b9cca4f7763e373","0x682e6ff3d6b2b8a3","0x748f82ee5defb2fc","0x78a5636f43172f60","0x84c87814a1f0ab72","0x8cc702081a6439ec","0x90befffa23631e28","0xa4506cebde82bde9","0xbef9a3f7b2c67915","0xc67178f2e372532b","0xca273eceea26619c","0xd186b8c721c0c207","0xeada7dd6cde0eb1e","0xf57d4f7fee6ed178","0x06f067aa72176fba","0x0a637dc5a2c898a6","0x113f9804bef90dae","0x1b710b35131c471b","0x28db77f523047d84","0x32caab7b40c72493","0x3c9ebe0a15c9bebc","0x431d67c49c100d4c","0x4cc5d4becb3e42b6","0x597f299cfc657e2a","0x5fcb6fab3ad6faec","0x6c44198c4a475817"].map(e=>BigInt(e))),zr=qn[0],Wr=qn[1],ve=new Uint32Array(80),De=new Uint32Array(80),qt=class extends bt{constructor(t){super(128,t,16,!1)}get(){let{Ah:t,Al:n,Bh:r,Bl:o,Ch:c,Cl:s,Dh:i,Dl:a,Eh:w,El:h,Fh:y,Fl:_,Gh:k,Gl:O,Hh:E,Hl:U}=this;return[t,n,r,o,c,s,i,a,w,h,y,_,k,O,E,U]}set(t,n,r,o,c,s,i,a,w,h,y,_,k,O,E,U){this.Ah=t|0,this.Al=n|0,this.Bh=r|0,this.Bl=o|0,this.Ch=c|0,this.Cl=s|0,this.Dh=i|0,this.Dl=a|0,this.Eh=w|0,this.El=h|0,this.Fh=y|0,this.Fl=_|0,this.Gh=k|0,this.Gl=O|0,this.Hh=E|0,this.Hl=U|0}process(t,n){for(let l=0;l<16;l++,n+=4)ve[l]=t.getUint32(n),De[l]=t.getUint32(n+=4);for(let l=16;l<80;l++){let I=ve[l-15]|0,F=De[l-15]|0,P=We(I,F,1)^We(I,F,8)^Mt(I,F,7),v=$e(I,F,1)^$e(I,F,8)^Kt(I,F,7),K=ve[l-2]|0,g=De[l-2]|0,M=We(K,g,19)^ut(K,g,61)^Mt(K,g,6),J=$e(K,g,19)^dt(K,g,61)^Kt(K,g,6),$=un(v,J,De[l-7],De[l-16]),fe=dn($,P,M,ve[l-7],ve[l-16]);ve[l]=fe|0,De[l]=$|0}let{Ah:r,Al:o,Bh:c,Bl:s,Ch:i,Cl:a,Dh:w,Dl:h,Eh:y,El:_,Fh:k,Fl:O,Gh:E,Gl:U,Hh:N,Hl:b}=this;for(let l=0;l<80;l++){let I=We(y,_,14)^We(y,_,18)^ut(y,_,41),F=$e(y,_,14)^$e(y,_,18)^dt(y,_,41),P=y&k^~y&E,v=_&O^~_&U,K=ln(b,F,v,Wr[l],De[l]),g=hn(K,N,I,P,zr[l],ve[l]),M=K|0,J=We(r,o,28)^ut(r,o,34)^ut(r,o,39),$=$e(r,o,28)^dt(r,o,34)^dt(r,o,39),fe=r&c^r&i^c&i,Ae=o&s^o&a^s&a;N=E|0,b=U|0,E=k|0,U=O|0,k=y|0,O=_|0,{h:y,l:_}=Be(w|0,h|0,g|0,M|0),w=i|0,h=a|0,i=c|0,a=s|0,c=r|0,s=o|0;let pe=an(M,$,Ae);r=fn(pe,g,J,fe),o=pe|0}({h:r,l:o}=Be(this.Ah|0,this.Al|0,r|0,o|0)),{h:c,l:s}=Be(this.Bh|0,this.Bl|0,c|0,s|0),{h:i,l:a}=Be(this.Ch|0,this.Cl|0,i|0,a|0),{h:w,l:h}=Be(this.Dh|0,this.Dl|0,w|0,h|0),{h:y,l:_}=Be(this.Eh|0,this.El|0,y|0,_|0),{h:k,l:O}=Be(this.Fh|0,this.Fl|0,k|0,O|0),{h:E,l:U}=Be(this.Gh|0,this.Gl|0,E|0,U|0),{h:N,l:b}=Be(this.Hh|0,this.Hl|0,N|0,b|0),this.set(r,o,c,s,i,a,w,h,y,_,k,O,E,U,N,b)}roundClean(){Ee(ve,De)}destroy(){this.destroyed=!0,Ee(this.buffer),this.set(0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)}},Qt=class extends qt{Ah=ae[0]|0;Al=ae[1]|0;Bh=ae[2]|0;Bl=ae[3]|0;Ch=ae[4]|0;Cl=ae[5]|0;Dh=ae[6]|0;Dl=ae[7]|0;Eh=ae[8]|0;El=ae[9]|0;Fh=ae[10]|0;Fl=ae[11]|0;Gh=ae[12]|0;Gl=ae[13]|0;Hh=ae[14]|0;Hl=ae[15]|0;constructor(){super(64)}};var Ct=nt(()=>new Zt,Fe(1));var Qn=nt(()=>new Qt,Fe(3));var it=Object.freeze({"128f":Object.freeze({W:16,N:16,H:66,D:22,K:33,A:6,securityLevel:128}),"128s":Object.freeze({W:16,N:16,H:63,D:7,K:14,A:12,securityLevel:128}),"192f":Object.freeze({W:16,N:24,H:66,D:22,K:33,A:8,securityLevel:192}),"192s":Object.freeze({W:16,N:24,H:63,D:7,K:17,A:14,securityLevel:192}),"256f":Object.freeze({W:16,N:32,H:68,D:17,K:35,A:9,securityLevel:256}),"256s":Object.freeze({W:16,N:32,H:64,D:8,K:22,A:14,securityLevel:256})}),he={WOTS:0,WOTSPK:1,HASHTREE:2,FORSTREE:3,FORSPK:4,WOTSPRF:5,FORSPRF:6};function $r(e){if(typeof e!="string")throw new Error("hex string expected, got "+typeof e);return BigInt(e===""?"0":"0x"+e)}function Jn(e){return $r(gn(e))}function Vr(e,t){return wn(e.toString(16).padStart(t*2,"0"))}var Jt=(e,t)=>{let n=qe(t);return r=>{let o=new Uint32Array(e);for(let c=0,s=0,i=0,a=0;c<e;c++){for(;i<t;)a=a<<8|r[s++],i+=8;i-=t,o[c]=a>>>i&n}return o}};function en(e){return(1n<<BigInt(e))-1n}function at(e,t){let n=t,{N:r,W:o,H:c,D:s,K:i,A:a,securityLevel:w}=e,h=n.getContext(e);if(o!==16)throw new Error("Unsupported Winternitz parameter");let y=4,_=Math.floor(8*r/y),k=r<=8?2:r<=136?3:4,O=Math.floor(c/s),E=_+k,U=22,N=0,b=1,l=9,I=12,F=13,P=17,v=18,K=21;n.isCompressed||(U=32,N+=3,b+=7,l+=10,I+=10,F+=10,P+=10,v+=10,K+=10);let g=(u,f=new Uint8Array(U))=>{let{type:A,height:d,tree:B,layer:H,index:R,chain:C,hash:G,keypair:S}=u,{subtreeAddr:j,keypairAddr:D}=u,ee=Xe(f);return d!==void 0&&(f[P]=d),H!==void 0&&(f[N]=H),A!==void 0&&(f[l]=A),C!==void 0&&(f[P]=C),G!==void 0&&(f[K]=G),R!==void 0&&ee.setUint32(v,R,!1),j&&f.set(j.subarray(0,b+8)),B!==void 0&&ee.setBigUint64(b,B,!1),S!==void 0&&(f[F]=S,O>8&&(f[I]=S>>>8)),D&&(f.set(D.subarray(0,b+8)),f[F]=D[F],O>8&&(f[I]=D[I])),f},M=Jt(k,y),J=u=>{let f=Jt(_,y)(u),A=0;for(let H=0;H<f.length;H++)A+=o-1-f[H];A<<=(8-k*y%8)%8;let d=M(Vr(A,Math.ceil(k*y/8))),B=new Uint32Array(E);return B.set(f),B.set(d,f.length),B},$=Jt(i,a),fe=O*(s-1),Ae=O,pe=ce("hashedMessage",Math.ceil(a*i/8),Math.ceil(fe/8),Math.ceil(O/8)),Ge=(u,f,A,d)=>{let H=d.Hmsg(u,f,A,pe.bytesLen),[R,C,G]=pe.decode(H),S=Jn(C)&en(fe),j=Number(Jn(G))&qe(Ae);return{tree:S,leafIdx:j,md:R}},ft=(u,f)=>function(d,B,H,R,C){let G=d,S=f,j=(1<<u)-1,D=new Uint8Array(u*r),ee=new Uint8Array(u*r);for(let m=0;;m++){let X=new Uint8Array(2*r),q=X.subarray(0,r),Y=X.subarray(r),oe=m+H;Y.set(S(B,oe,G,C));let te=0;for(let de=m,Te=H,_e=B;;te++,de>>>=1,_e>>>=1,Te>>>=1){if(te===u)return{root:Y,authPath:ee};if((de^_e)===1&&ee.subarray(te*r).set(Y),(de&1)===0&&m<j)break;g({height:te+1,index:(de>>1)+(Te>>1)},R),q.set(D.subarray(te*r).subarray(0,r)),Y.set(G.thashN(2,X,R))}D.subarray(te*r).set(Y)}throw new Error("Unreachable code path reached, report this error")},gt=ft(O,(u,f,A,d)=>{let B=A,H=new Uint8Array(E*r),R=f===u?0:-1>>>0;g({keypair:f},d.leafAddr),g({keypair:f},d.pkAddr);for(let C=0;C<E;C++){let G=d.wotsSteps[C]|R,S=H.subarray(C*r,(C+1)*r);g({chain:C,hash:0,type:he.WOTSPRF},d.leafAddr),S.set(B.PRFaddr(d.leafAddr)),g({type:he.WOTS},d.leafAddr);for(let j=0;j===G&&d.wotsSig.subarray(C*r).set(S),j!==o-1;j++)g({hash:j},d.leafAddr),S.set(B.thash1(S,d.leafAddr))}return B.thashN(E,H,d.pkAddr)}),wt=ft(a,(u,f,A,d)=>{let B=A;g({type:he.FORSPRF,index:f},d);let H=B.PRFaddr(d);return g({type:he.FORSTREE},d),B.thash1(H,d)}),mt=(u,f,A,d,B=new Uint8Array(r))=>{g({type:he.HASHTREE},A);let H={wotsSig:new Uint8Array(L.bytesLen),wotsSteps:J(B),leafAddr:g({subtreeAddr:f}),pkAddr:g({type:he.WOTSPK,subtreeAddr:f})},{root:R,authPath:C}=gt(u,d,0,A,H);return{root:R,sigWots:H.wotsSig.subarray(0,E*r),sigAuth:C}},At=(u,f,A,d,B,H,R)=>{let C=H,G=new Uint8Array(2*r),S=G.subarray(0,r),j=G.subarray(r,2*r);(f&1)!==0?(j.set(u.subarray(0,r)),S.set(d.subarray(0,r))):(S.set(u.subarray(0,r)),j.set(d.subarray(0,r))),f>>>=1,A>>>=1;for(let D=0;D<B-1;D++,f>>=1,A>>=1){g({height:D+1,index:f+A},R);let ee=d.subarray((D+1)*r,(D+2)*r);(f&1)!==0?(j.set(C.thashN(2,G,R)),S.set(ee)):(G.set(C.thashN(2,G,R)),j.set(ee))}return g({height:B,index:f+A},R),C.thashN(2,G,R)},ze=ce("seed",r,r,r),Ue=ce("publicKey",r,r),ue=ce("secretKey",r,r,Ue.bytesLen),p=ge(ce("fors",r,r*a),i),L=ge(ce("wots",E*r,O*r),s),T=ce("signature",r,p,L),x=Object.freeze({info:Object.freeze({type:"internal-slh-dsa"}),lengths:Object.freeze({publicKey:Ue.bytesLen,secretKey:ue.bytesLen,signature:T.bytesLen,seed:ze.bytesLen,signRand:r}),keygen(u){u!==void 0&&be(u,ze.bytesLen,"seed"),u=u===void 0?Se(ze.bytesLen):rt(u);let[f,A,d]=ze.decode(u),B=h(d,f),H=g({layer:s-1}),R=g({layer:s-1}),{root:C}=mt(B,R,H,-1>>>0),G=Ue.encode([d,C]),S=ue.encode([f,A,G]);return B.clean(),V(f,A,C,R,H),{publicKey:G,secretKey:S}},getPublicKey:u=>{let[f,A,d]=ue.decode(u);return Uint8Array.from(d)},sign:(u,f,A={})=>{Ne(A);let{extraEntropy:d}=A,[B,H,R]=ue.decode(f),[C,G]=Ue.decode(R);d===!1?d=rt(C):d===void 0?d=Se(r):d=rt(d),be(d,r);let S=h(C,B),j=S.PRFmsg(H,d,u),{tree:D,leafIdx:ee,md:m}=Ge(j,R,u,S),X=g({type:he.WOTS,tree:D,keypair:ee}),q=[],Y=g({keypairAddr:X}),oe=g({keypairAddr:X}),te=$(m),de=[];for(let ne=0;ne<te.length;ne++){let ie=ne<<a;g({type:he.FORSPRF,height:0,index:te[ne]+ie},oe);let xe=S.PRFaddr(oe);g({type:he.FORSTREE},oe);let{root:Le,authPath:Tt}=wt(S,te[ne],ie,oe,Y);q.push(Le),de.push([xe,Tt])}let Te=g({type:he.FORSPK,keypairAddr:X}),_e=S.thashN(i,Ye(...q),Te),se=g({type:he.HASHTREE}),Ce=[];for(let ne=0;ne<s;ne++,D>>=BigInt(O)){g({tree:D,layer:ne},se),g({subtreeAddr:se,keypair:ee},X);let{sigWots:ie,sigAuth:xe,root:Le}=mt(S,X,se,ee,_e);_e.set(Le),V(Le),Ce.push([ie,xe]),ee=Number(D&en(O))}S.clean();let z=T.encode([j,de,Ce]);return V(j,d,se,X,Y,oe,te,q),z},verify:(u,f,A)=>{let[d,B]=Ue.decode(A),[H,R,C]=T.decode(u),G=A;if(u.length!==T.bytesLen)return!1;let S=h(d),{tree:j,leafIdx:D,md:ee}=Ge(H,G,f,S),m=g({type:he.WOTS,tree:j,keypair:D}),X=[],q=g({type:he.FORSTREE,keypairAddr:m}),Y=$(ee);for(let se=0;se<R.length;se++){let[Ce,z]=R[se],ne=se<<a;g({height:0,index:Y[se]+ne},q);let ie=S.thash1(Ce,q);X.push(At(ie,Y[se],ne,z,a,S,q))}let oe=g({type:he.FORSPK,keypairAddr:m}),te=S.thashN(i,Ye(...X),oe),de=g({type:he.HASHTREE}),Te=g({type:he.WOTSPK}),_e=new Uint8Array(E*r);for(let se=0;se<C.length;se++,j>>=BigInt(O)){let[Ce,z]=C[se];g({tree:j,layer:se},de),g({subtreeAddr:de,keypair:D},m),g({keypairAddr:m},Te);let ne=J(te);for(let xe=0;xe<E;xe++){g({chain:xe},m);let Le=o-1-ne[xe],Tt=ne[xe],Ft=_e.subarray(xe*r);Ft.set(Ce.subarray(xe*r,(xe+1)*r));for(let Et=Tt;Et<Tt+Le&&Et<o;Et++)g({hash:Et},m),Ft.set(S.thash1(Ft,m))}let ie=S.thashN(E,_e,Te);te=At(ie,D,0,z,O,S,de),D=Number(j&en(O))}return Ie(te,B)}});return Object.freeze({info:Object.freeze({type:"slh-dsa"}),internal:x,securityLevel:w,lengths:x.lengths,keygen:x.keygen,getPublicKey:x.getPublicKey,sign:(u,f,A={})=>{Ne(A);let d=ot(u,A.context),B=x.sign(d,f,A);return V(d),B},verify:(u,f,A,d={})=>(Ze(d),x.verify(u,ot(f,d.context),A)),prehash:u=>{Ot(u,w);let f=u;return Object.freeze({info:Object.freeze({type:"hashslh-dsa"}),lengths:x.lengths,keygen:x.keygen,getPublicKey:x.getPublicKey,sign:(A,d,B={})=>{Ne(B);let H=st(f,A,B.context),R=x.sign(H,d,B);return V(H),R},verify:(A,d,B,H={})=>(Ze(H),x.verify(A,st(f,d,H.context),B))})}})}var Xr=()=>e=>(t,n)=>{let{N:r}=e,o={prf:0,thash:0,hmsg:0,gen_message_random:0},c=re.create({}).update(t),s=c.clone(),i=(a,w,h)=>(o.thash++,c._cloneInto(s).update(h).update(w.subarray(0,a*r)).xof(r));return{PRFaddr:a=>{if(!n)throw new Error("no sk seed");return o.prf++,c._cloneInto(s).update(a).update(n).xof(r)},PRFmsg:(a,w,h)=>(o.gen_message_random++,re.create({}).update(a).update(w).update(h).digest().subarray(0,r)),Hmsg:(a,w,h,y)=>(o.hmsg++,re.create({}).update(a.subarray(0,r)).update(w).update(h).xof(y)),thash1:i.bind(null,1),thashN:i,clean:()=>{c.destroy(),s.destroy()}}},tn={getContext:Xr()},er=at(it["128f"],tn);var tr=at(it["192f"],tn);var nr=at(it["256f"],tn);var rr=(e,t)=>n=>(r,o)=>{let{N:c}=n,s={prf:0,thash:0,hmsg:0,gen_message_random:0,mgf1:0},i=new Uint8Array(4),a=Xe(i),w=e.create().update(r).update(new Uint8Array(e.blockLen-c)),h=t.create().update(r).update(new Uint8Array(t.blockLen-c)),y=w.clone(),_=h.clone();function k(E,U,N){s.mgf1++;let b=new Uint8Array(Math.ceil(U/N.outputLen)*N.outputLen);if(U>2**32)throw new Error("mask too long");for(let l=0,I=b;I.length;l++)a.setUint32(0,l,!1),N.create().update(E).update(i).digestInto(I),I=I.subarray(N.outputLen);return V(b.subarray(U)),b.subarray(0,U)}let O=(E,U,N)=>(b,l,I)=>(s.thash++,U._cloneInto(N).update(I).update(l.subarray(0,b*c)).digest().subarray(0,c));return{PRFaddr:E=>{if(!o)throw new Error("No sk seed");return s.prf++,w._cloneInto(y).update(E).update(o).digest().subarray(0,c)},PRFmsg:(E,U,N)=>(s.gen_message_random++,Xn.create(t,E).update(U).update(N).digest().subarray(0,c)),Hmsg:(E,U,N,b)=>{s.hmsg++;let l=Ye(E.subarray(0,c),U.subarray(0,c),t.create().update(E.subarray(0,c)).update(U).update(N).digest());return k(l,b,t)},thash1:O(e,w,y).bind(null,1),thashN:O(t,h,_),clean:()=>{w.destroy(),h.destroy(),y.destroy(),_.destroy()}}},Yr={isCompressed:!0,getContext:rr(Ct,Ct)},or={isCompressed:!0,getContext:rr(Ct,Qn)},sr=at(it["128f"],Yr);var cr=at(it["192f"],or);var ir=at(it["256f"],or);0&&(module.exports={ml_dsa44,ml_dsa65,ml_dsa87,ml_kem1024,ml_kem512,ml_kem768,slh_dsa_sha2_128f,slh_dsa_sha2_192f,slh_dsa_sha2_256f,slh_dsa_shake_128f,slh_dsa_shake_192f,slh_dsa_shake_256f});
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// _entry.mjs
+var entry_exports = {};
+__export(entry_exports, {
+  ml_dsa44: () => ml_dsa44,
+  ml_dsa65: () => ml_dsa65,
+  ml_dsa87: () => ml_dsa87,
+  ml_kem1024: () => ml_kem1024,
+  ml_kem512: () => ml_kem512,
+  ml_kem768: () => ml_kem768,
+  slh_dsa_sha2_128f: () => slh_dsa_sha2_128f,
+  slh_dsa_sha2_192f: () => slh_dsa_sha2_192f,
+  slh_dsa_sha2_256f: () => slh_dsa_sha2_256f,
+  slh_dsa_shake_128f: () => slh_dsa_shake_128f,
+  slh_dsa_shake_192f: () => slh_dsa_shake_192f,
+  slh_dsa_shake_256f: () => slh_dsa_shake_256f
+});
+module.exports = __toCommonJS(entry_exports);
+
+// node_modules/@noble/hashes/_u64.js
+var U32_MASK64 = /* @__PURE__ */ BigInt(2 ** 32 - 1);
+var _32n = /* @__PURE__ */ BigInt(32);
+function fromBig(n, le = false) {
+  if (le)
+    return { h: Number(n & U32_MASK64), l: Number(n >> _32n & U32_MASK64) };
+  return { h: Number(n >> _32n & U32_MASK64) | 0, l: Number(n & U32_MASK64) | 0 };
+}
+function split(lst, le = false) {
+  const len = lst.length;
+  let Ah = new Uint32Array(len);
+  let Al = new Uint32Array(len);
+  for (let i = 0; i < len; i++) {
+    const { h, l } = fromBig(lst[i], le);
+    [Ah[i], Al[i]] = [h, l];
+  }
+  return [Ah, Al];
+}
+var shrSH = (h, _l, s) => h >>> s;
+var shrSL = (h, l, s) => h << 32 - s | l >>> s;
+var rotrSH = (h, l, s) => h >>> s | l << 32 - s;
+var rotrSL = (h, l, s) => h << 32 - s | l >>> s;
+var rotrBH = (h, l, s) => h << 64 - s | l >>> s - 32;
+var rotrBL = (h, l, s) => h >>> s - 32 | l << 64 - s;
+var rotlSH = (h, l, s) => h << s | l >>> 32 - s;
+var rotlSL = (h, l, s) => l << s | h >>> 32 - s;
+var rotlBH = (h, l, s) => l << s - 32 | h >>> 64 - s;
+var rotlBL = (h, l, s) => h << s - 32 | l >>> 64 - s;
+function add(Ah, Al, Bh, Bl) {
+  const l = (Al >>> 0) + (Bl >>> 0);
+  return { h: Ah + Bh + (l / 2 ** 32 | 0) | 0, l: l | 0 };
+}
+var add3L = (Al, Bl, Cl) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0);
+var add3H = (low, Ah, Bh, Ch) => Ah + Bh + Ch + (low / 2 ** 32 | 0) | 0;
+var add4L = (Al, Bl, Cl, Dl) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0);
+var add4H = (low, Ah, Bh, Ch, Dh) => Ah + Bh + Ch + Dh + (low / 2 ** 32 | 0) | 0;
+var add5L = (Al, Bl, Cl, Dl, El) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0) + (El >>> 0);
+var add5H = (low, Ah, Bh, Ch, Dh, Eh) => Ah + Bh + Ch + Dh + Eh + (low / 2 ** 32 | 0) | 0;
+
+// node_modules/@noble/hashes/utils.js
+function isBytes(a) {
+  return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array" && "BYTES_PER_ELEMENT" in a && a.BYTES_PER_ELEMENT === 1;
+}
+function anumber(n, title = "") {
+  if (typeof n !== "number") {
+    const prefix = title && `"${title}" `;
+    throw new TypeError(`${prefix}expected number, got ${typeof n}`);
+  }
+  if (!Number.isSafeInteger(n) || n < 0) {
+    const prefix = title && `"${title}" `;
+    throw new RangeError(`${prefix}expected integer >= 0, got ${n}`);
+  }
+}
+function abytes(value, length, title = "") {
+  const bytes = isBytes(value);
+  const len = value?.length;
+  const needsLen = length !== void 0;
+  if (!bytes || needsLen && len !== length) {
+    const prefix = title && `"${title}" `;
+    const ofLen = needsLen ? ` of length ${length}` : "";
+    const got = bytes ? `length=${len}` : `type=${typeof value}`;
+    const message = prefix + "expected Uint8Array" + ofLen + ", got " + got;
+    if (!bytes)
+      throw new TypeError(message);
+    throw new RangeError(message);
+  }
+  return value;
+}
+function ahash(h) {
+  if (typeof h !== "function" || typeof h.create !== "function")
+    throw new TypeError("Hash must wrapped by utils.createHasher");
+  anumber(h.outputLen);
+  anumber(h.blockLen);
+  if (h.outputLen < 1)
+    throw new Error('"outputLen" must be >= 1');
+  if (h.blockLen < 1)
+    throw new Error('"blockLen" must be >= 1');
+}
+function aexists(instance, checkFinished = true) {
+  if (instance.destroyed)
+    throw new Error("Hash instance has been destroyed");
+  if (checkFinished && instance.finished)
+    throw new Error("Hash#digest() has already been called");
+}
+function aoutput(out, instance) {
+  abytes(out, void 0, "digestInto() output");
+  const min = instance.outputLen;
+  if (out.length < min) {
+    throw new RangeError('"digestInto() output" expected to be of length >=' + min);
+  }
+}
+function u32(arr) {
+  return new Uint32Array(arr.buffer, arr.byteOffset, Math.floor(arr.byteLength / 4));
+}
+function clean(...arrays) {
+  for (let i = 0; i < arrays.length; i++) {
+    arrays[i].fill(0);
+  }
+}
+function createView(arr) {
+  return new DataView(arr.buffer, arr.byteOffset, arr.byteLength);
+}
+function rotr(word, shift) {
+  return word << 32 - shift | word >>> shift;
+}
+var isLE = /* @__PURE__ */ (() => new Uint8Array(new Uint32Array([287454020]).buffer)[0] === 68)();
+function byteSwap(word) {
+  return word << 24 & 4278190080 | word << 8 & 16711680 | word >>> 8 & 65280 | word >>> 24 & 255;
+}
+function byteSwap32(arr) {
+  for (let i = 0; i < arr.length; i++) {
+    arr[i] = byteSwap(arr[i]);
+  }
+  return arr;
+}
+var swap32IfBE = isLE ? (u) => u : byteSwap32;
+var hasHexBuiltin = /* @__PURE__ */ (() => (
+  // @ts-ignore
+  typeof Uint8Array.from([]).toHex === "function" && typeof Uint8Array.fromHex === "function"
+))();
+var hexes = /* @__PURE__ */ Array.from({ length: 256 }, (_, i) => i.toString(16).padStart(2, "0"));
+function bytesToHex(bytes) {
+  abytes(bytes);
+  if (hasHexBuiltin)
+    return bytes.toHex();
+  let hex = "";
+  for (let i = 0; i < bytes.length; i++) {
+    hex += hexes[bytes[i]];
+  }
+  return hex;
+}
+var asciis = { _0: 48, _9: 57, A: 65, F: 70, a: 97, f: 102 };
+function asciiToBase16(ch) {
+  if (ch >= asciis._0 && ch <= asciis._9)
+    return ch - asciis._0;
+  if (ch >= asciis.A && ch <= asciis.F)
+    return ch - (asciis.A - 10);
+  if (ch >= asciis.a && ch <= asciis.f)
+    return ch - (asciis.a - 10);
+  return;
+}
+function hexToBytes(hex) {
+  if (typeof hex !== "string")
+    throw new TypeError("hex string expected, got " + typeof hex);
+  if (hasHexBuiltin) {
+    try {
+      return Uint8Array.fromHex(hex);
+    } catch (error) {
+      if (error instanceof SyntaxError)
+        throw new RangeError(error.message);
+      throw error;
+    }
+  }
+  const hl = hex.length;
+  const al = hl / 2;
+  if (hl % 2)
+    throw new RangeError("hex string expected, got unpadded hex of length " + hl);
+  const array = new Uint8Array(al);
+  for (let ai = 0, hi = 0; ai < al; ai++, hi += 2) {
+    const n1 = asciiToBase16(hex.charCodeAt(hi));
+    const n2 = asciiToBase16(hex.charCodeAt(hi + 1));
+    if (n1 === void 0 || n2 === void 0) {
+      const char = hex[hi] + hex[hi + 1];
+      throw new RangeError('hex string expected, got non-hex character "' + char + '" at index ' + hi);
+    }
+    array[ai] = n1 * 16 + n2;
+  }
+  return array;
+}
+function concatBytes(...arrays) {
+  let sum = 0;
+  for (let i = 0; i < arrays.length; i++) {
+    const a = arrays[i];
+    abytes(a);
+    sum += a.length;
+  }
+  const res = new Uint8Array(sum);
+  for (let i = 0, pad = 0; i < arrays.length; i++) {
+    const a = arrays[i];
+    res.set(a, pad);
+    pad += a.length;
+  }
+  return res;
+}
+function createHasher(hashCons, info = {}) {
+  const hashC = (msg, opts2) => hashCons(opts2).update(msg).digest();
+  const tmp = hashCons(void 0);
+  hashC.outputLen = tmp.outputLen;
+  hashC.blockLen = tmp.blockLen;
+  hashC.canXOF = tmp.canXOF;
+  hashC.create = (opts2) => hashCons(opts2);
+  Object.assign(hashC, info);
+  return Object.freeze(hashC);
+}
+function randomBytes(bytesLength = 32) {
+  anumber(bytesLength, "bytesLength");
+  const cr = typeof globalThis === "object" ? globalThis.crypto : null;
+  if (typeof cr?.getRandomValues !== "function")
+    throw new Error("crypto.getRandomValues must be defined");
+  if (bytesLength > 65536)
+    throw new RangeError(`"bytesLength" expected <= 65536, got ${bytesLength}`);
+  return cr.getRandomValues(new Uint8Array(bytesLength));
+}
+var oidNist = (suffix) => ({
+  // Current NIST hashAlgs suffixes used here fit in one DER subidentifier octet.
+  // Larger suffix values would need base-128 OID encoding and a different length byte.
+  oid: Uint8Array.from([6, 9, 96, 134, 72, 1, 101, 3, 4, 2, suffix])
+});
+
+// node_modules/@noble/hashes/sha3.js
+var _0n = BigInt(0);
+var _1n = BigInt(1);
+var _2n = BigInt(2);
+var _7n = BigInt(7);
+var _256n = BigInt(256);
+var _0x71n = BigInt(113);
+var SHA3_PI = [];
+var SHA3_ROTL = [];
+var _SHA3_IOTA = [];
+for (let round = 0, R = _1n, x = 1, y = 0; round < 24; round++) {
+  [x, y] = [y, (2 * x + 3 * y) % 5];
+  SHA3_PI.push(2 * (5 * y + x));
+  SHA3_ROTL.push((round + 1) * (round + 2) / 2 % 64);
+  let t = _0n;
+  for (let j = 0; j < 7; j++) {
+    R = (R << _1n ^ (R >> _7n) * _0x71n) % _256n;
+    if (R & _2n)
+      t ^= _1n << (_1n << BigInt(j)) - _1n;
+  }
+  _SHA3_IOTA.push(t);
+}
+var IOTAS = split(_SHA3_IOTA, true);
+var SHA3_IOTA_H = IOTAS[0];
+var SHA3_IOTA_L = IOTAS[1];
+var rotlH = (h, l, s) => s > 32 ? rotlBH(h, l, s) : rotlSH(h, l, s);
+var rotlL = (h, l, s) => s > 32 ? rotlBL(h, l, s) : rotlSL(h, l, s);
+function keccakP(s, rounds = 24) {
+  anumber(rounds, "rounds");
+  if (rounds < 1 || rounds > 24)
+    throw new Error('"rounds" expected integer 1..24');
+  const B = new Uint32Array(5 * 2);
+  for (let round = 24 - rounds; round < 24; round++) {
+    for (let x = 0; x < 10; x++)
+      B[x] = s[x] ^ s[x + 10] ^ s[x + 20] ^ s[x + 30] ^ s[x + 40];
+    for (let x = 0; x < 10; x += 2) {
+      const idx1 = (x + 8) % 10;
+      const idx0 = (x + 2) % 10;
+      const B0 = B[idx0];
+      const B1 = B[idx0 + 1];
+      const Th = rotlH(B0, B1, 1) ^ B[idx1];
+      const Tl = rotlL(B0, B1, 1) ^ B[idx1 + 1];
+      for (let y = 0; y < 50; y += 10) {
+        s[x + y] ^= Th;
+        s[x + y + 1] ^= Tl;
+      }
+    }
+    let curH = s[2];
+    let curL = s[3];
+    for (let t = 0; t < 24; t++) {
+      const shift = SHA3_ROTL[t];
+      const Th = rotlH(curH, curL, shift);
+      const Tl = rotlL(curH, curL, shift);
+      const PI = SHA3_PI[t];
+      curH = s[PI];
+      curL = s[PI + 1];
+      s[PI] = Th;
+      s[PI + 1] = Tl;
+    }
+    for (let y = 0; y < 50; y += 10) {
+      const b0 = s[y], b1 = s[y + 1], b2 = s[y + 2], b3 = s[y + 3];
+      s[y] ^= ~s[y + 2] & s[y + 4];
+      s[y + 1] ^= ~s[y + 3] & s[y + 5];
+      s[y + 2] ^= ~s[y + 4] & s[y + 6];
+      s[y + 3] ^= ~s[y + 5] & s[y + 7];
+      s[y + 4] ^= ~s[y + 6] & s[y + 8];
+      s[y + 5] ^= ~s[y + 7] & s[y + 9];
+      s[y + 6] ^= ~s[y + 8] & b0;
+      s[y + 7] ^= ~s[y + 9] & b1;
+      s[y + 8] ^= ~b0 & b2;
+      s[y + 9] ^= ~b1 & b3;
+    }
+    s[0] ^= SHA3_IOTA_H[round];
+    s[1] ^= SHA3_IOTA_L[round];
+  }
+  clean(B);
+}
+var Keccak = class _Keccak {
+  state;
+  pos = 0;
+  posOut = 0;
+  finished = false;
+  state32;
+  destroyed = false;
+  blockLen;
+  suffix;
+  outputLen;
+  canXOF;
+  enableXOF = false;
+  rounds;
+  // NOTE: we accept arguments in bytes instead of bits here.
+  constructor(blockLen, suffix, outputLen, enableXOF = false, rounds = 24) {
+    this.blockLen = blockLen;
+    this.suffix = suffix;
+    this.outputLen = outputLen;
+    this.enableXOF = enableXOF;
+    this.canXOF = enableXOF;
+    this.rounds = rounds;
+    anumber(outputLen, "outputLen");
+    if (!(0 < blockLen && blockLen < 200))
+      throw new Error("only keccak-f1600 function is supported");
+    this.state = new Uint8Array(200);
+    this.state32 = u32(this.state);
+  }
+  clone() {
+    return this._cloneInto();
+  }
+  keccak() {
+    swap32IfBE(this.state32);
+    keccakP(this.state32, this.rounds);
+    swap32IfBE(this.state32);
+    this.posOut = 0;
+    this.pos = 0;
+  }
+  update(data) {
+    aexists(this);
+    abytes(data);
+    const { blockLen, state } = this;
+    const len = data.length;
+    for (let pos = 0; pos < len; ) {
+      const take = Math.min(blockLen - this.pos, len - pos);
+      for (let i = 0; i < take; i++)
+        state[this.pos++] ^= data[pos++];
+      if (this.pos === blockLen)
+        this.keccak();
+    }
+    return this;
+  }
+  finish() {
+    if (this.finished)
+      return;
+    this.finished = true;
+    const { state, suffix, pos, blockLen } = this;
+    state[pos] ^= suffix;
+    if ((suffix & 128) !== 0 && pos === blockLen - 1)
+      this.keccak();
+    state[blockLen - 1] ^= 128;
+    this.keccak();
+  }
+  writeInto(out) {
+    aexists(this, false);
+    abytes(out);
+    this.finish();
+    const bufferOut = this.state;
+    const { blockLen } = this;
+    for (let pos = 0, len = out.length; pos < len; ) {
+      if (this.posOut >= blockLen)
+        this.keccak();
+      const take = Math.min(blockLen - this.posOut, len - pos);
+      out.set(bufferOut.subarray(this.posOut, this.posOut + take), pos);
+      this.posOut += take;
+      pos += take;
+    }
+    return out;
+  }
+  xofInto(out) {
+    if (!this.enableXOF)
+      throw new Error("XOF is not possible for this instance");
+    return this.writeInto(out);
+  }
+  xof(bytes) {
+    anumber(bytes);
+    return this.xofInto(new Uint8Array(bytes));
+  }
+  digestInto(out) {
+    aoutput(out, this);
+    if (this.finished)
+      throw new Error("digest() was already called");
+    this.writeInto(out.subarray(0, this.outputLen));
+    this.destroy();
+  }
+  digest() {
+    const out = new Uint8Array(this.outputLen);
+    this.digestInto(out);
+    return out;
+  }
+  destroy() {
+    this.destroyed = true;
+    clean(this.state);
+  }
+  _cloneInto(to) {
+    const { blockLen, suffix, outputLen, rounds, enableXOF } = this;
+    to ||= new _Keccak(blockLen, suffix, outputLen, enableXOF, rounds);
+    to.blockLen = blockLen;
+    to.state32.set(this.state32);
+    to.pos = this.pos;
+    to.posOut = this.posOut;
+    to.finished = this.finished;
+    to.rounds = rounds;
+    to.suffix = suffix;
+    to.outputLen = outputLen;
+    to.enableXOF = enableXOF;
+    to.canXOF = this.canXOF;
+    to.destroyed = this.destroyed;
+    return to;
+  }
+};
+var genKeccak = (suffix, blockLen, outputLen, info = {}) => createHasher(() => new Keccak(blockLen, suffix, outputLen), info);
+var sha3_256 = /* @__PURE__ */ genKeccak(
+  6,
+  136,
+  32,
+  /* @__PURE__ */ oidNist(8)
+);
+var sha3_512 = /* @__PURE__ */ genKeccak(
+  6,
+  72,
+  64,
+  /* @__PURE__ */ oidNist(10)
+);
+var genShake = (suffix, blockLen, outputLen, info = {}) => createHasher((opts2 = {}) => new Keccak(blockLen, suffix, opts2.dkLen === void 0 ? outputLen : opts2.dkLen, true), info);
+var shake128 = /* @__PURE__ */ genShake(31, 168, 16, /* @__PURE__ */ oidNist(11));
+var shake256 = /* @__PURE__ */ genShake(31, 136, 32, /* @__PURE__ */ oidNist(12));
+
+// node_modules/@noble/curves/abstract/fft.js
+function checkU32(n) {
+  if (!Number.isSafeInteger(n) || n < 0 || n > 4294967295)
+    throw new Error("wrong u32 integer:" + n);
+  return n;
+}
+function isPowerOfTwo(x) {
+  checkU32(x);
+  return (x & x - 1) === 0 && x !== 0;
+}
+function reverseBits(n, bits) {
+  checkU32(n);
+  if (!Number.isSafeInteger(bits) || bits < 0 || bits > 32)
+    throw new Error(`expected integer 0 <= bits <= 32, got ${bits}`);
+  let reversed = 0;
+  for (let i = 0; i < bits; i++, n >>>= 1)
+    reversed = reversed << 1 | n & 1;
+  return reversed >>> 0;
+}
+function log2(n) {
+  checkU32(n);
+  return 31 - Math.clz32(n);
+}
+function bitReversalInplace(values) {
+  const n = values.length;
+  if (!isPowerOfTwo(n))
+    throw new Error("expected positive power-of-two length, got " + n);
+  const bits = log2(n);
+  for (let i = 0; i < n; i++) {
+    const j = reverseBits(i, bits);
+    if (i < j) {
+      const tmp = values[i];
+      values[i] = values[j];
+      values[j] = tmp;
+    }
+  }
+  return values;
+}
+var FFTCore = (F3, coreOpts) => {
+  const { N: N3, roots, dit, invertButterflies = false, skipStages = 0, brp = true } = coreOpts;
+  const bits = log2(N3);
+  if (!isPowerOfTwo(N3))
+    throw new Error("FFT: Polynomial size should be power of two");
+  if (roots.length !== N3)
+    throw new Error(`FFT: wrong roots length: expected ${N3}, got ${roots.length}`);
+  const isDit = dit !== invertButterflies;
+  isDit;
+  return (values) => {
+    if (values.length !== N3)
+      throw new Error("FFT: wrong Polynomial length");
+    if (dit && brp)
+      bitReversalInplace(values);
+    for (let i = 0, g = 1; i < bits - skipStages; i++) {
+      const s = dit ? i + 1 + skipStages : bits - i;
+      const m = 1 << s;
+      const m2 = m >> 1;
+      const stride = N3 >> s;
+      for (let k = 0; k < N3; k += m) {
+        for (let j = 0, grp = g++; j < m2; j++) {
+          const rootPos = invertButterflies ? dit ? N3 - grp : grp : j * stride;
+          const i0 = k + j;
+          const i1 = k + j + m2;
+          const omega = roots[rootPos];
+          const b = values[i1];
+          const a = values[i0];
+          if (isDit) {
+            const t = F3.mul(b, omega);
+            values[i0] = F3.add(a, t);
+            values[i1] = F3.sub(a, t);
+          } else if (invertButterflies) {
+            values[i0] = F3.add(b, a);
+            values[i1] = F3.mul(F3.sub(b, a), omega);
+          } else {
+            values[i0] = F3.add(a, b);
+            values[i1] = F3.mul(F3.sub(a, b), omega);
+          }
+        }
+      }
+    }
+    if (!dit && brp)
+      bitReversalInplace(values);
+    return values;
+  };
+};
+
+// node_modules/@noble/post-quantum/utils.js
+var abytesDoc = abytes;
+var randomBytes2 = randomBytes;
+function equalBytes(a, b) {
+  if (a.length !== b.length)
+    return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++)
+    diff |= a[i] ^ b[i];
+  return diff === 0;
+}
+function copyBytes(bytes) {
+  return Uint8Array.from(abytes(bytes));
+}
+function validateOpts(opts2) {
+  if (Object.prototype.toString.call(opts2) !== "[object Object]")
+    throw new TypeError("expected valid options object");
+}
+function validateVerOpts(opts2) {
+  validateOpts(opts2);
+  if (opts2.context !== void 0)
+    abytes(opts2.context, void 0, "opts.context");
+}
+function validateSigOpts(opts2) {
+  validateVerOpts(opts2);
+  if (opts2.extraEntropy !== false && opts2.extraEntropy !== void 0)
+    abytes(opts2.extraEntropy, void 0, "opts.extraEntropy");
+}
+function splitCoder(label, ...lengths) {
+  const getLength = (c) => typeof c === "number" ? c : c.bytesLen;
+  const bytesLen = lengths.reduce((sum, a) => sum + getLength(a), 0);
+  return {
+    bytesLen,
+    encode: (bufs) => {
+      const res = new Uint8Array(bytesLen);
+      for (let i = 0, pos = 0; i < lengths.length; i++) {
+        const c = lengths[i];
+        const l = getLength(c);
+        const b = typeof c === "number" ? bufs[i] : c.encode(bufs[i]);
+        abytes(b, l, label);
+        res.set(b, pos);
+        if (typeof c !== "number")
+          b.fill(0);
+        pos += l;
+      }
+      return res;
+    },
+    decode: (buf) => {
+      abytes(buf, bytesLen, label);
+      const res = [];
+      for (const c of lengths) {
+        const l = getLength(c);
+        const b = buf.subarray(0, l);
+        res.push(typeof c === "number" ? b : c.decode(b));
+        buf = buf.subarray(l);
+      }
+      return res;
+    }
+  };
+}
+function vecCoder(c, vecLen) {
+  const coder = c;
+  const bytesLen = vecLen * coder.bytesLen;
+  return {
+    bytesLen,
+    encode: (u) => {
+      if (u.length !== vecLen)
+        throw new RangeError(`vecCoder.encode: wrong length=${u.length}. Expected: ${vecLen}`);
+      const res = new Uint8Array(bytesLen);
+      for (let i = 0, pos = 0; i < u.length; i++) {
+        const b = coder.encode(u[i]);
+        res.set(b, pos);
+        b.fill(0);
+        pos += b.length;
+      }
+      return res;
+    },
+    decode: (a) => {
+      abytes(a, bytesLen);
+      const r = [];
+      for (let i = 0; i < a.length; i += coder.bytesLen)
+        r.push(coder.decode(a.subarray(i, i + coder.bytesLen)));
+      return r;
+    }
+  };
+}
+function cleanBytes(...list) {
+  for (const t of list) {
+    if (Array.isArray(t))
+      for (const b of t)
+        b.fill(0);
+    else
+      t.fill(0);
+  }
+}
+function getMask(bits) {
+  if (!Number.isSafeInteger(bits) || bits < 0 || bits > 32)
+    throw new RangeError(`expected bits in [0..32], got ${bits}`);
+  return bits === 32 ? 4294967295 : ~(-1 << bits) >>> 0;
+}
+var EMPTY = /* @__PURE__ */ Uint8Array.of();
+function getMessage(msg, ctx = EMPTY) {
+  abytes(msg);
+  abytes(ctx);
+  if (ctx.length > 255)
+    throw new RangeError("context should be 255 bytes or less");
+  return concatBytes(new Uint8Array([0, ctx.length]), ctx, msg);
+}
+var oidNistP = /* @__PURE__ */ Uint8Array.from([6, 9, 96, 134, 72, 1, 101, 3, 4, 2]);
+function checkHash(hash, requiredStrength = 0) {
+  if (!hash.oid || !equalBytes(hash.oid.subarray(0, 10), oidNistP))
+    throw new Error("hash.oid is invalid: expected NIST hash");
+  const collisionResistance = hash.outputLen * 8 / 2;
+  if (requiredStrength > collisionResistance) {
+    throw new Error("Pre-hash security strength too low: " + collisionResistance + ", required: " + requiredStrength);
+  }
+}
+function getMessagePrehash(hash, msg, ctx = EMPTY) {
+  abytes(msg);
+  abytes(ctx);
+  if (ctx.length > 255)
+    throw new RangeError("context should be 255 bytes or less");
+  const hashed = hash(msg);
+  return concatBytes(new Uint8Array([1, ctx.length]), ctx, hash.oid, hashed);
+}
+
+// node_modules/@noble/post-quantum/_crystals.js
+var genCrystals = (opts2) => {
+  const { newPoly: newPoly2, N: N3, Q: Q3, F: F3, ROOT_OF_UNITY: ROOT_OF_UNITY3, brvBits, isKyber } = opts2;
+  const mod = (a, modulo = Q3) => {
+    const result = a % modulo | 0;
+    return (result >= 0 ? result | 0 : modulo + result | 0) | 0;
+  };
+  const smod = (a, modulo = Q3) => {
+    const r = mod(a, modulo) | 0;
+    return (r > modulo >> 1 ? r - modulo | 0 : r) | 0;
+  };
+  function getZettas() {
+    const out = newPoly2(N3);
+    for (let i = 0; i < N3; i++) {
+      const b = reverseBits(i, brvBits);
+      const p = BigInt(ROOT_OF_UNITY3) ** BigInt(b) % BigInt(Q3);
+      out[i] = Number(p) | 0;
+    }
+    return out;
+  }
+  const nttZetas = getZettas();
+  const field = {
+    add: (a, b) => mod((a | 0) + (b | 0)) | 0,
+    sub: (a, b) => mod((a | 0) - (b | 0)) | 0,
+    mul: (a, b) => mod((a | 0) * (b | 0)) | 0,
+    inv: (_a) => {
+      throw new Error("not implemented");
+    }
+  };
+  const nttOpts = {
+    N: N3,
+    roots: nttZetas,
+    invertButterflies: true,
+    skipStages: isKyber ? 1 : 0,
+    brp: false
+  };
+  const dif = FFTCore(field, { dit: false, ...nttOpts });
+  const dit = FFTCore(field, { dit: true, ...nttOpts });
+  const NTT = {
+    encode: (r) => {
+      return dif(r);
+    },
+    decode: (r) => {
+      dit(r);
+      for (let i = 0; i < r.length; i++)
+        r[i] = mod(F3 * r[i]);
+      return r;
+    }
+  };
+  const bitsCoder = (d, c) => {
+    const mask = getMask(d);
+    const bytesLen = d * (N3 / 8);
+    return {
+      bytesLen,
+      encode: (poly_) => {
+        const poly = poly_;
+        const r = new Uint8Array(bytesLen);
+        for (let i = 0, buf = 0, bufLen = 0, pos = 0; i < poly.length; i++) {
+          buf |= (c.encode(poly[i]) & mask) << bufLen;
+          bufLen += d;
+          for (; bufLen >= 8; bufLen -= 8, buf >>= 8)
+            r[pos++] = buf & getMask(bufLen);
+        }
+        return r;
+      },
+      decode: (bytes) => {
+        const r = newPoly2(N3);
+        for (let i = 0, buf = 0, bufLen = 0, pos = 0; i < bytes.length; i++) {
+          buf |= bytes[i] << bufLen;
+          bufLen += 8;
+          for (; bufLen >= d; bufLen -= d, buf >>= d)
+            r[pos++] = c.decode(buf & mask);
+        }
+        return r;
+      }
+    };
+  };
+  return {
+    mod,
+    smod,
+    nttZetas,
+    NTT: {
+      encode: (r) => NTT.encode(r),
+      decode: (r) => NTT.decode(r)
+    },
+    bitsCoder
+  };
+};
+var createXofShake = (shake) => (seed, blockLen) => {
+  if (!blockLen)
+    blockLen = shake.blockLen;
+  const _seed = new Uint8Array(seed.length + 2);
+  _seed.set(seed);
+  const seedLen = seed.length;
+  const buf = new Uint8Array(blockLen);
+  let h = shake.create({});
+  let calls = 0;
+  let xofs = 0;
+  return {
+    stats: () => ({ calls, xofs }),
+    get: (x, y) => {
+      _seed[seedLen + 0] = x;
+      _seed[seedLen + 1] = y;
+      h.destroy();
+      h = shake.create({}).update(_seed);
+      calls++;
+      return () => {
+        xofs++;
+        return h.xofInto(buf);
+      };
+    },
+    clean: () => {
+      h.destroy();
+      cleanBytes(buf, _seed);
+    }
+  };
+};
+var XOF128 = /* @__PURE__ */ createXofShake(shake128);
+var XOF256 = /* @__PURE__ */ createXofShake(shake256);
+
+// node_modules/@noble/post-quantum/ml-kem.js
+var N = 256;
+var Q = 3329;
+var F = 3303;
+var ROOT_OF_UNITY = 17;
+var crystals = /* @__PURE__ */ genCrystals({
+  N,
+  Q,
+  F,
+  ROOT_OF_UNITY,
+  newPoly: (n) => new Uint16Array(n),
+  brvBits: 7,
+  isKyber: true
+});
+var PARAMS = /* @__PURE__ */ (() => Object.freeze({
+  512: Object.freeze({ N, Q, K: 2, ETA1: 3, ETA2: 2, du: 10, dv: 4, RBGstrength: 128 }),
+  768: Object.freeze({ N, Q, K: 3, ETA1: 2, ETA2: 2, du: 10, dv: 4, RBGstrength: 192 }),
+  1024: Object.freeze({ N, Q, K: 4, ETA1: 2, ETA2: 2, du: 11, dv: 5, RBGstrength: 256 })
+}))();
+var compress = (d) => {
+  if (d >= 12)
+    return { encode: (i) => i, decode: (i) => i >= Q ? i - Q : i };
+  const a = 2 ** (d - 1);
+  return {
+    // This only matches standalone Compress_d after bitsCoder masks the result into Z_(2^d).
+    encode: (i) => ((i << d) + Q / 2) / Q,
+    // const decompress = (i: number) => round((Q / 2 ** d) * i);
+    decode: (i) => i * Q + a >>> d
+  };
+};
+var byteCoder = (d) => crystals.bitsCoder(d, d === 12 ? { encode: (i) => i, decode: (i) => i >= Q ? i - Q : i } : { encode: (i) => i, decode: (i) => i });
+var polyCoder = (d) => d === 12 ? byteCoder(12) : crystals.bitsCoder(d, compress(d));
+function polyAdd(a_, b_) {
+  const a = a_;
+  const b = b_;
+  for (let i = 0; i < N; i++)
+    a[i] = crystals.mod(a[i] + b[i]);
+}
+function polySub(a_, b_) {
+  const a = a_;
+  const b = b_;
+  for (let i = 0; i < N; i++)
+    a[i] = crystals.mod(a[i] - b[i]);
+}
+function BaseCaseMultiply(a0, a1, b0, b1, zeta) {
+  const c0 = crystals.mod(a1 * b1 * zeta + a0 * b0);
+  const c1 = crystals.mod(a0 * b1 + a1 * b0);
+  return { c0, c1 };
+}
+function MultiplyNTTs(f_, g_) {
+  const f = f_;
+  const g = g_;
+  for (let i = 0; i < N / 2; i++) {
+    let z = crystals.nttZetas[64 + (i >> 1)];
+    if (i & 1)
+      z = -z;
+    const { c0, c1 } = BaseCaseMultiply(f[2 * i + 0], f[2 * i + 1], g[2 * i + 0], g[2 * i + 1], z);
+    f[2 * i + 0] = c0;
+    f[2 * i + 1] = c1;
+  }
+  return f;
+}
+function SampleNTT(xof_) {
+  const xof = xof_;
+  const r = new Uint16Array(N);
+  for (let j = 0; j < N; ) {
+    const b = xof();
+    if (b.length % 3)
+      throw new Error("SampleNTT: unaligned block");
+    for (let i = 0; j < N && i + 3 <= b.length; i += 3) {
+      const d1 = (b[i + 0] >> 0 | b[i + 1] << 8) & 4095;
+      const d2 = (b[i + 1] >> 4 | b[i + 2] << 4) & 4095;
+      if (d1 < Q)
+        r[j++] = d1;
+      if (j < N && d2 < Q)
+        r[j++] = d2;
+    }
+  }
+  return r;
+}
+var sampleCBDBytes = (buf, eta) => {
+  const r = new Uint16Array(N);
+  const b32 = u32(buf);
+  swap32IfBE(b32);
+  let len = 0;
+  for (let i = 0, p = 0, bb = 0, t0 = 0; i < b32.length; i++) {
+    let b = b32[i];
+    for (let j = 0; j < 32; j++) {
+      bb += b & 1;
+      b >>= 1;
+      len += 1;
+      if (len === eta) {
+        t0 = bb;
+        bb = 0;
+      } else if (len === 2 * eta) {
+        r[p++] = crystals.mod(t0 - bb);
+        bb = 0;
+        len = 0;
+      }
+    }
+  }
+  swap32IfBE(b32);
+  if (len)
+    throw new Error(`sampleCBD: leftover bits: ${len}`);
+  return r;
+};
+function sampleCBD(PRF_, seed, nonce, eta) {
+  const PRF = PRF_;
+  return sampleCBDBytes(PRF(eta * N / 4, seed, nonce), eta);
+}
+var genKPKE = (opts_) => {
+  const opts2 = opts_;
+  const { K, PRF, XOF, HASH512, ETA1, ETA2, du, dv } = opts2;
+  const poly1 = polyCoder(1);
+  const polyV = polyCoder(dv);
+  const polyU = polyCoder(du);
+  const publicCoder = splitCoder("publicKey", vecCoder(polyCoder(12), K), 32);
+  const secretCoder = vecCoder(polyCoder(12), K);
+  const cipherCoder = splitCoder("ciphertext", vecCoder(polyU, K), polyV);
+  const seedCoder = splitCoder("seed", 32, 32);
+  return {
+    secretCoder,
+    lengths: {
+      secretKey: secretCoder.bytesLen,
+      publicKey: publicCoder.bytesLen,
+      cipherText: cipherCoder.bytesLen
+    },
+    keygen: (seed) => {
+      abytesDoc(seed, 32, "seed");
+      const seedDst = new Uint8Array(33);
+      seedDst.set(seed);
+      seedDst[32] = K;
+      const seedHash = HASH512(seedDst);
+      const [rho, sigma] = seedCoder.decode(seedHash);
+      const sHat = [];
+      const tHat = [];
+      for (let i = 0; i < K; i++)
+        sHat.push(crystals.NTT.encode(sampleCBD(PRF, sigma, i, ETA1)));
+      const x = XOF(rho);
+      for (let i = 0; i < K; i++) {
+        const e = crystals.NTT.encode(sampleCBD(PRF, sigma, K + i, ETA1));
+        for (let j = 0; j < K; j++) {
+          const aji = SampleNTT(x.get(j, i));
+          polyAdd(e, MultiplyNTTs(aji, sHat[j]));
+        }
+        tHat.push(e);
+      }
+      x.clean();
+      const res = {
+        publicKey: publicCoder.encode([tHat, rho]),
+        secretKey: secretCoder.encode(sHat)
+      };
+      cleanBytes(rho, sigma, sHat, tHat, seedDst, seedHash);
+      return res;
+    },
+    encrypt: (publicKey, msg, seed) => {
+      const [tHat, rho] = publicCoder.decode(publicKey);
+      const rHat = [];
+      for (let i = 0; i < K; i++)
+        rHat.push(crystals.NTT.encode(sampleCBD(PRF, seed, i, ETA1)));
+      const x = XOF(rho);
+      const tmp2 = new Uint16Array(N);
+      const u = [];
+      for (let i = 0; i < K; i++) {
+        const e1 = sampleCBD(PRF, seed, K + i, ETA2);
+        const tmp = new Uint16Array(N);
+        for (let j = 0; j < K; j++) {
+          const aij = SampleNTT(x.get(i, j));
+          polyAdd(tmp, MultiplyNTTs(aij, rHat[j]));
+        }
+        polyAdd(e1, crystals.NTT.decode(tmp));
+        u.push(e1);
+        polyAdd(tmp2, MultiplyNTTs(tHat[i], rHat[i]));
+        cleanBytes(tmp);
+      }
+      x.clean();
+      const e2 = sampleCBD(PRF, seed, 2 * K, ETA2);
+      polyAdd(e2, crystals.NTT.decode(tmp2));
+      const v = poly1.decode(msg);
+      polyAdd(v, e2);
+      cleanBytes(tHat, rHat, tmp2, e2);
+      return cipherCoder.encode([u, v]);
+    },
+    decrypt: (cipherText, privateKey) => {
+      const [u, v] = cipherCoder.decode(cipherText);
+      const sk = secretCoder.decode(privateKey);
+      const tmp = new Uint16Array(N);
+      for (let i = 0; i < K; i++)
+        polyAdd(tmp, MultiplyNTTs(sk[i], crystals.NTT.encode(u[i])));
+      polySub(v, crystals.NTT.decode(tmp));
+      cleanBytes(tmp, sk, u);
+      return poly1.encode(v);
+    }
+  };
+};
+function createKyber(opts2) {
+  const rawOpts = opts2;
+  const KPKE = genKPKE(rawOpts);
+  const { HASH256, HASH512, KDF } = rawOpts;
+  const { secretCoder: KPKESecretCoder, lengths } = KPKE;
+  const secretCoder = splitCoder("secretKey", lengths.secretKey, lengths.publicKey, 32, 32);
+  const msgLen = 32;
+  const seedLen = 64;
+  const kemLengths = Object.freeze({
+    ...lengths,
+    seed: 64,
+    msg: msgLen,
+    msgRand: msgLen,
+    secretKey: secretCoder.bytesLen
+  });
+  return Object.freeze({
+    info: Object.freeze({ type: "ml-kem" }),
+    lengths: kemLengths,
+    keygen: (seed = randomBytes2(seedLen)) => {
+      abytesDoc(seed, seedLen, "seed");
+      const { publicKey, secretKey: sk } = KPKE.keygen(seed.subarray(0, 32));
+      const publicKeyHash = HASH256(publicKey);
+      const secretKey = secretCoder.encode([sk, publicKey, publicKeyHash, seed.subarray(32)]);
+      cleanBytes(sk, publicKeyHash);
+      return {
+        publicKey,
+        secretKey
+      };
+    },
+    getPublicKey: (secretKey) => {
+      const [_sk, publicKey, _publicKeyHash, _z] = secretCoder.decode(secretKey);
+      return Uint8Array.from(publicKey);
+    },
+    encapsulate: (publicKey, msg = randomBytes2(msgLen)) => {
+      abytesDoc(publicKey, lengths.publicKey, "publicKey");
+      abytesDoc(msg, msgLen, "message");
+      const eke = publicKey.subarray(0, 384 * opts2.K);
+      const ek = KPKESecretCoder.encode(KPKESecretCoder.decode(copyBytes(eke)));
+      if (!equalBytes(ek, eke)) {
+        cleanBytes(ek);
+        throw new Error("ML-KEM.encapsulate: wrong publicKey modulus");
+      }
+      cleanBytes(ek);
+      const kr = HASH512.create().update(msg).update(HASH256(publicKey)).digest();
+      const cipherText = KPKE.encrypt(publicKey, msg, kr.subarray(32, 64));
+      cleanBytes(kr.subarray(32));
+      return {
+        cipherText,
+        sharedSecret: kr.subarray(0, 32)
+      };
+    },
+    decapsulate: (cipherText, secretKey) => {
+      abytesDoc(secretKey, secretCoder.bytesLen, "secretKey");
+      abytesDoc(cipherText, lengths.cipherText, "cipherText");
+      const k768 = secretCoder.bytesLen - 96;
+      const start = k768 + 32;
+      const test = HASH256(secretKey.subarray(k768 / 2, start));
+      if (!equalBytes(test, secretKey.subarray(start, start + 32)))
+        throw new Error("invalid secretKey: hash check failed");
+      const [sk, publicKey, publicKeyHash, z] = secretCoder.decode(secretKey);
+      const msg = KPKE.decrypt(cipherText, sk);
+      const kr = HASH512.create().update(msg).update(publicKeyHash).digest();
+      const Khat = kr.subarray(0, 32);
+      const cipherText2 = KPKE.encrypt(publicKey, msg, kr.subarray(32, 64));
+      const isValid = equalBytes(cipherText, cipherText2);
+      const Kbar = KDF.create({ dkLen: 32 }).update(z).update(cipherText).digest();
+      cleanBytes(msg, cipherText2, !isValid ? Khat : Kbar);
+      return isValid ? Khat : Kbar;
+    }
+  });
+}
+function shakePRF(dkLen, key, nonce) {
+  return shake256.create({ dkLen }).update(key).update(new Uint8Array([nonce])).digest();
+}
+var opts = /* @__PURE__ */ (() => ({
+  HASH256: sha3_256,
+  HASH512: sha3_512,
+  KDF: shake256,
+  XOF: XOF128,
+  PRF: shakePRF
+}))();
+var mk = (params) => createKyber({
+  ...opts,
+  ...params
+});
+var ml_kem512 = /* @__PURE__ */ (() => mk(PARAMS[512]))();
+var ml_kem768 = /* @__PURE__ */ (() => mk(PARAMS[768]))();
+var ml_kem1024 = /* @__PURE__ */ (() => mk(PARAMS[1024]))();
+
+// node_modules/@noble/curves/utils.js
+function abool(value, title = "") {
+  if (typeof value !== "boolean") {
+    const prefix = title && `"${title}" `;
+    throw new TypeError(prefix + "expected boolean, got type=" + typeof value);
+  }
+  return value;
+}
+
+// node_modules/@noble/post-quantum/ml-dsa.js
+function validateInternalOpts(opts2) {
+  validateOpts(opts2);
+  if (opts2.externalMu !== void 0)
+    abool(opts2.externalMu, "opts.externalMu");
+}
+var N2 = 256;
+var Q2 = 8380417;
+var ROOT_OF_UNITY2 = 1753;
+var F2 = 8347681;
+var D = 13;
+var GAMMA2_1 = Math.floor((Q2 - 1) / 88) | 0;
+var GAMMA2_2 = Math.floor((Q2 - 1) / 32) | 0;
+var PARAMS2 = /* @__PURE__ */ (() => Object.freeze({
+  2: Object.freeze({
+    K: 4,
+    L: 4,
+    D,
+    GAMMA1: 2 ** 17,
+    GAMMA2: GAMMA2_1,
+    TAU: 39,
+    ETA: 2,
+    OMEGA: 80
+  }),
+  3: Object.freeze({
+    K: 6,
+    L: 5,
+    D,
+    GAMMA1: 2 ** 19,
+    GAMMA2: GAMMA2_2,
+    TAU: 49,
+    ETA: 4,
+    OMEGA: 55
+  }),
+  5: Object.freeze({
+    K: 8,
+    L: 7,
+    D,
+    GAMMA1: 2 ** 19,
+    GAMMA2: GAMMA2_2,
+    TAU: 60,
+    ETA: 2,
+    OMEGA: 75
+  })
+}))();
+var newPoly = (n) => new Int32Array(n);
+var crystals2 = /* @__PURE__ */ genCrystals({
+  N: N2,
+  Q: Q2,
+  F: F2,
+  ROOT_OF_UNITY: ROOT_OF_UNITY2,
+  newPoly,
+  isKyber: false,
+  brvBits: 8
+});
+var id = (n) => n;
+var polyCoder2 = (d, compress2 = id, verify = id) => crystals2.bitsCoder(d, {
+  encode: (i) => compress2(verify(i)),
+  decode: (i) => verify(compress2(i))
+});
+var polyAdd2 = (a_, b_) => {
+  const a = a_;
+  const b = b_;
+  for (let i = 0; i < a.length; i++)
+    a[i] = crystals2.mod(a[i] + b[i]);
+  return a;
+};
+var polySub2 = (a_, b_) => {
+  const a = a_;
+  const b = b_;
+  for (let i = 0; i < a.length; i++)
+    a[i] = crystals2.mod(a[i] - b[i]);
+  return a;
+};
+var polyShiftl = (p_) => {
+  const p = p_;
+  for (let i = 0; i < N2; i++)
+    p[i] <<= D;
+  return p;
+};
+var polyChknorm = (p_, B) => {
+  const p = p_;
+  for (let i = 0; i < N2; i++)
+    if (Math.abs(crystals2.smod(p[i])) >= B)
+      return true;
+  return false;
+};
+var MultiplyNTTs2 = (a_, b_) => {
+  const a = a_;
+  const b = b_;
+  const c = newPoly(N2);
+  for (let i = 0; i < a.length; i++)
+    c[i] = crystals2.mod(a[i] * b[i]);
+  return c;
+};
+function RejNTTPoly(xof_) {
+  const xof = xof_;
+  const r = newPoly(N2);
+  for (let j = 0; j < N2; ) {
+    const b = xof();
+    if (b.length % 3)
+      throw new Error("RejNTTPoly: unaligned block");
+    for (let i = 0; j < N2 && i <= b.length - 3; i += 3) {
+      const t = (b[i + 0] | b[i + 1] << 8 | b[i + 2] << 16) & 8388607;
+      if (t < Q2)
+        r[j++] = t;
+    }
+  }
+  return r;
+}
+function getDilithium(opts_) {
+  const opts2 = opts_;
+  const { K, L, GAMMA1, GAMMA2, TAU, ETA, OMEGA } = opts2;
+  const { CRH_BYTES, TR_BYTES, C_TILDE_BYTES, XOF128: XOF1282, XOF256: XOF2562, securityLevel } = opts2;
+  if (![2, 4].includes(ETA))
+    throw new Error("Wrong ETA");
+  if (![1 << 17, 1 << 19].includes(GAMMA1))
+    throw new Error("Wrong GAMMA1");
+  if (![GAMMA2_1, GAMMA2_2].includes(GAMMA2))
+    throw new Error("Wrong GAMMA2");
+  const BETA = TAU * ETA;
+  const decompose = (r) => {
+    const rPlus = crystals2.mod(r);
+    const r0 = crystals2.smod(rPlus, 2 * GAMMA2) | 0;
+    if (rPlus - r0 === Q2 - 1)
+      return { r1: 0 | 0, r0: r0 - 1 | 0 };
+    const r1 = Math.floor((rPlus - r0) / (2 * GAMMA2)) | 0;
+    return { r1, r0 };
+  };
+  const HighBits = (r) => decompose(r).r1;
+  const LowBits = (r) => decompose(r).r0;
+  const MakeHint = (z, r) => {
+    const res0 = z <= GAMMA2 || z > Q2 - GAMMA2 || z === Q2 - GAMMA2 && r === 0 ? 0 : 1;
+    return res0;
+  };
+  const UseHint = (h, r) => {
+    const m = Math.floor((Q2 - 1) / (2 * GAMMA2));
+    const { r1, r0 } = decompose(r);
+    if (h === 1)
+      return r0 > 0 ? crystals2.mod(r1 + 1, m) | 0 : crystals2.mod(r1 - 1, m) | 0;
+    return r1 | 0;
+  };
+  const Power2Round = (r) => {
+    const rPlus = crystals2.mod(r);
+    const r0 = crystals2.smod(rPlus, 2 ** D) | 0;
+    return { r1: Math.floor((rPlus - r0) / 2 ** D) | 0, r0 };
+  };
+  const hintCoder = {
+    bytesLen: OMEGA + K,
+    encode: (h_) => {
+      const h = h_;
+      if (h === false)
+        throw new Error("hint.encode: hint is false");
+      const res = new Uint8Array(OMEGA + K);
+      for (let i = 0, k = 0; i < K; i++) {
+        for (let j = 0; j < N2; j++)
+          if (h[i][j] !== 0)
+            res[k++] = j;
+        res[OMEGA + i] = k;
+      }
+      return res;
+    },
+    decode: (buf) => {
+      const h = [];
+      let k = 0;
+      for (let i = 0; i < K; i++) {
+        const hi = newPoly(N2);
+        if (buf[OMEGA + i] < k || buf[OMEGA + i] > OMEGA)
+          return false;
+        for (let j = k; j < buf[OMEGA + i]; j++) {
+          if (j > k && buf[j] <= buf[j - 1])
+            return false;
+          hi[buf[j]] = 1;
+        }
+        k = buf[OMEGA + i];
+        h.push(hi);
+      }
+      for (let j = k; j < OMEGA; j++)
+        if (buf[j] !== 0)
+          return false;
+      return h;
+    }
+  };
+  const ETACoder = polyCoder2(ETA === 2 ? 3 : 4, (i) => ETA - i, (i) => {
+    if (!(-ETA <= i && i <= ETA))
+      throw new Error(`malformed key s1/s3 ${i} outside of ETA range [${-ETA}, ${ETA}]`);
+    return i;
+  });
+  const T0Coder = polyCoder2(13, (i) => (1 << D - 1) - i);
+  const T1Coder = polyCoder2(10);
+  const ZCoder = polyCoder2(GAMMA1 === 1 << 17 ? 18 : 20, (i) => crystals2.smod(GAMMA1 - i));
+  const W1Coder = polyCoder2(GAMMA2 === GAMMA2_1 ? 6 : 4);
+  const W1Vec = vecCoder(W1Coder, K);
+  const publicCoder = splitCoder("publicKey", 32, vecCoder(T1Coder, K));
+  const secretCoder = splitCoder("secretKey", 32, 32, TR_BYTES, vecCoder(ETACoder, L), vecCoder(ETACoder, K), vecCoder(T0Coder, K));
+  const sigCoder = splitCoder("signature", C_TILDE_BYTES, vecCoder(ZCoder, L), hintCoder);
+  const CoefFromHalfByte = ETA === 2 ? (n) => n < 15 ? 2 - n % 5 : false : (n) => n < 9 ? 4 - n : false;
+  function RejBoundedPoly(xof_) {
+    const xof = xof_;
+    const r = newPoly(N2);
+    for (let j = 0; j < N2; ) {
+      const b = xof();
+      for (let i = 0; j < N2 && i < b.length; i += 1) {
+        const d1 = CoefFromHalfByte(b[i] & 15);
+        const d2 = CoefFromHalfByte(b[i] >> 4 & 15);
+        if (d1 !== false)
+          r[j++] = d1;
+        if (j < N2 && d2 !== false)
+          r[j++] = d2;
+      }
+    }
+    return r;
+  }
+  const SampleInBall = (seed) => {
+    const pre = newPoly(N2);
+    const s = shake256.create({}).update(seed);
+    const buf = new Uint8Array(shake256.blockLen);
+    s.xofInto(buf);
+    const masks = buf.slice(0, 8);
+    for (let i = N2 - TAU, pos = 8, maskPos = 0, maskBit = 0; i < N2; i++) {
+      let b = i + 1;
+      for (; b > i; ) {
+        b = buf[pos++];
+        if (pos < shake256.blockLen)
+          continue;
+        s.xofInto(buf);
+        pos = 0;
+      }
+      pre[i] = pre[b];
+      pre[b] = 1 - ((masks[maskPos] >> maskBit++ & 1) << 1);
+      if (maskBit >= 8) {
+        maskPos++;
+        maskBit = 0;
+      }
+    }
+    return pre;
+  };
+  const polyPowerRound = (p_) => {
+    const p = p_;
+    const res0 = newPoly(N2);
+    const res1 = newPoly(N2);
+    for (let i = 0; i < p.length; i++) {
+      const { r0, r1 } = Power2Round(p[i]);
+      res0[i] = r0;
+      res1[i] = r1;
+    }
+    return { r0: res0, r1: res1 };
+  };
+  const polyUseHint = (u_, h_) => {
+    const u = u_;
+    const h = h_;
+    for (let i = 0; i < N2; i++)
+      u[i] = UseHint(h[i], u[i]);
+    return u;
+  };
+  const polyMakeHint = (a_, b_) => {
+    const a = a_;
+    const b = b_;
+    const v = newPoly(N2);
+    let cnt = 0;
+    for (let i = 0; i < N2; i++) {
+      const h = MakeHint(a[i], b[i]);
+      v[i] = h;
+      cnt += h;
+    }
+    return { v, cnt };
+  };
+  const signRandBytes = 32;
+  const seedCoder = splitCoder("seed", 32, 64, 32);
+  const internal = Object.freeze({
+    info: Object.freeze({ type: "internal-ml-dsa" }),
+    lengths: Object.freeze({
+      secretKey: secretCoder.bytesLen,
+      publicKey: publicCoder.bytesLen,
+      seed: 32,
+      signature: sigCoder.bytesLen,
+      signRand: signRandBytes
+    }),
+    keygen: (seed) => {
+      const seedDst = new Uint8Array(32 + 2);
+      const randSeed = seed === void 0;
+      if (randSeed)
+        seed = randomBytes2(32);
+      abytesDoc(seed, 32, "seed");
+      seedDst.set(seed);
+      if (randSeed)
+        cleanBytes(seed);
+      seedDst[32] = K;
+      seedDst[33] = L;
+      const [rho, rhoPrime, K_] = seedCoder.decode(shake256(seedDst, { dkLen: seedCoder.bytesLen }));
+      const xofPrime = XOF2562(rhoPrime);
+      const s1 = [];
+      for (let i = 0; i < L; i++)
+        s1.push(RejBoundedPoly(xofPrime.get(i & 255, i >> 8 & 255)));
+      const s2 = [];
+      for (let i = L; i < L + K; i++)
+        s2.push(RejBoundedPoly(xofPrime.get(i & 255, i >> 8 & 255)));
+      const s1Hat = s1.map((i) => crystals2.NTT.encode(i.slice()));
+      const t0 = [];
+      const t1 = [];
+      const xof = XOF1282(rho);
+      const t = newPoly(N2);
+      for (let i = 0; i < K; i++) {
+        cleanBytes(t);
+        for (let j = 0; j < L; j++) {
+          const aij = RejNTTPoly(xof.get(j, i));
+          polyAdd2(t, MultiplyNTTs2(aij, s1Hat[j]));
+        }
+        crystals2.NTT.decode(t);
+        const { r0, r1 } = polyPowerRound(polyAdd2(t, s2[i]));
+        t0.push(r0);
+        t1.push(r1);
+      }
+      const publicKey = publicCoder.encode([rho, t1]);
+      const tr = shake256(publicKey, { dkLen: TR_BYTES });
+      const secretKey = secretCoder.encode([rho, K_, tr, s1, s2, t0]);
+      xof.clean();
+      xofPrime.clean();
+      cleanBytes(rho, rhoPrime, K_, s1, s2, s1Hat, t, t0, t1, tr, seedDst);
+      return {
+        publicKey,
+        secretKey
+      };
+    },
+    getPublicKey: (secretKey) => {
+      const [rho, _K, _tr, s1, s2, _t0] = secretCoder.decode(secretKey);
+      const xof = XOF1282(rho);
+      const s1Hat = s1.map((p) => crystals2.NTT.encode(p.slice()));
+      const t1 = [];
+      const tmp = newPoly(N2);
+      for (let i = 0; i < K; i++) {
+        tmp.fill(0);
+        for (let j = 0; j < L; j++) {
+          const aij = RejNTTPoly(xof.get(j, i));
+          polyAdd2(tmp, MultiplyNTTs2(aij, s1Hat[j]));
+        }
+        crystals2.NTT.decode(tmp);
+        polyAdd2(tmp, s2[i]);
+        const { r1 } = polyPowerRound(tmp);
+        t1.push(r1);
+      }
+      xof.clean();
+      cleanBytes(tmp, s1Hat, _t0, s1, s2);
+      return publicCoder.encode([rho, t1]);
+    },
+    // NOTE: random is optional.
+    sign: (msg, secretKey, opts3 = {}) => {
+      validateSigOpts(opts3);
+      validateInternalOpts(opts3);
+      let { extraEntropy: random, externalMu = false } = opts3;
+      const [rho, _K, tr, s1, s2, t0] = secretCoder.decode(secretKey);
+      const A = [];
+      const xof = XOF1282(rho);
+      for (let i = 0; i < K; i++) {
+        const pv = [];
+        for (let j = 0; j < L; j++)
+          pv.push(RejNTTPoly(xof.get(j, i)));
+        A.push(pv);
+      }
+      xof.clean();
+      for (let i = 0; i < L; i++)
+        crystals2.NTT.encode(s1[i]);
+      for (let i = 0; i < K; i++) {
+        crystals2.NTT.encode(s2[i]);
+        crystals2.NTT.encode(t0[i]);
+      }
+      const mu = externalMu ? msg : (
+        // 6: µ ← H(tr||M, 512)
+        //    ▷ Compute message representative µ
+        shake256.create({ dkLen: CRH_BYTES }).update(tr).update(msg).digest()
+      );
+      const rnd = random === false ? new Uint8Array(32) : random === void 0 ? randomBytes2(signRandBytes) : random;
+      abytesDoc(rnd, 32, "extraEntropy");
+      const rhoprime = shake256.create({ dkLen: CRH_BYTES }).update(_K).update(rnd).update(mu).digest();
+      abytesDoc(rhoprime, CRH_BYTES);
+      const x256 = XOF2562(rhoprime, ZCoder.bytesLen);
+      main_loop: for (let kappa = 0; ; ) {
+        const y = [];
+        for (let i = 0; i < L; i++, kappa++)
+          y.push(ZCoder.decode(x256.get(kappa & 255, kappa >> 8)()));
+        const z = y.map((i) => crystals2.NTT.encode(i.slice()));
+        const w = [];
+        for (let i = 0; i < K; i++) {
+          const wi = newPoly(N2);
+          for (let j = 0; j < L; j++)
+            polyAdd2(wi, MultiplyNTTs2(A[i][j], z[j]));
+          crystals2.NTT.decode(wi);
+          w.push(wi);
+        }
+        const w1 = w.map((j) => j.map(HighBits));
+        const cTilde = shake256.create({ dkLen: C_TILDE_BYTES }).update(mu).update(W1Vec.encode(w1)).digest();
+        const cHat = crystals2.NTT.encode(SampleInBall(cTilde));
+        const cs1 = s1.map((i) => MultiplyNTTs2(i, cHat));
+        for (let i = 0; i < L; i++) {
+          polyAdd2(crystals2.NTT.decode(cs1[i]), y[i]);
+          if (polyChknorm(cs1[i], GAMMA1 - BETA))
+            continue main_loop;
+        }
+        let cnt = 0;
+        const h = [];
+        for (let i = 0; i < K; i++) {
+          const cs2 = crystals2.NTT.decode(MultiplyNTTs2(s2[i], cHat));
+          const r0 = polySub2(w[i], cs2).map(LowBits);
+          if (polyChknorm(r0, GAMMA2 - BETA))
+            continue main_loop;
+          const ct0 = crystals2.NTT.decode(MultiplyNTTs2(t0[i], cHat));
+          if (polyChknorm(ct0, GAMMA2))
+            continue main_loop;
+          polyAdd2(r0, ct0);
+          const hint = polyMakeHint(r0, w1[i]);
+          h.push(hint.v);
+          cnt += hint.cnt;
+        }
+        if (cnt > OMEGA)
+          continue;
+        x256.clean();
+        const res = sigCoder.encode([cTilde, cs1, h]);
+        cleanBytes(cTilde, cs1, h, cHat, w1, w, z, y, rhoprime, s1, s2, t0, ...A);
+        if (!externalMu)
+          cleanBytes(mu);
+        return res;
+      }
+      throw new Error("Unreachable code path reached, report this error");
+    },
+    verify: (sig, msg, publicKey, opts3 = {}) => {
+      validateInternalOpts(opts3);
+      const { externalMu = false } = opts3;
+      const [rho, t1] = publicCoder.decode(publicKey);
+      const tr = shake256(publicKey, { dkLen: TR_BYTES });
+      if (sig.length !== sigCoder.bytesLen)
+        return false;
+      const [cTilde, z, h] = sigCoder.decode(sig);
+      if (h === false)
+        return false;
+      for (let i = 0; i < L; i++)
+        if (polyChknorm(z[i], GAMMA1 - BETA))
+          return false;
+      const mu = externalMu ? msg : (
+        // 7: µ ← H(tr||M, 512)
+        shake256.create({ dkLen: CRH_BYTES }).update(tr).update(msg).digest()
+      );
+      const c = crystals2.NTT.encode(SampleInBall(cTilde));
+      const zNtt = z.map((i) => i.slice());
+      for (let i = 0; i < L; i++)
+        crystals2.NTT.encode(zNtt[i]);
+      const wTick1 = [];
+      const xof = XOF1282(rho);
+      for (let i = 0; i < K; i++) {
+        const ct12d = MultiplyNTTs2(crystals2.NTT.encode(polyShiftl(t1[i])), c);
+        const Az = newPoly(N2);
+        for (let j = 0; j < L; j++) {
+          const aij = RejNTTPoly(xof.get(j, i));
+          polyAdd2(Az, MultiplyNTTs2(aij, zNtt[j]));
+        }
+        const wApprox = crystals2.NTT.decode(polySub2(Az, ct12d));
+        wTick1.push(polyUseHint(wApprox, h[i]));
+      }
+      xof.clean();
+      const c2 = shake256.create({ dkLen: C_TILDE_BYTES }).update(mu).update(W1Vec.encode(wTick1)).digest();
+      for (const t of h) {
+        const sum = t.reduce((acc, i) => acc + i, 0);
+        if (!(sum <= OMEGA))
+          return false;
+      }
+      for (const t of z)
+        if (polyChknorm(t, GAMMA1 - BETA))
+          return false;
+      return equalBytes(cTilde, c2);
+    }
+  });
+  return Object.freeze({
+    info: Object.freeze({ type: "ml-dsa" }),
+    internal,
+    securityLevel,
+    keygen: internal.keygen,
+    lengths: internal.lengths,
+    getPublicKey: internal.getPublicKey,
+    sign: (msg, secretKey, opts3 = {}) => {
+      validateSigOpts(opts3);
+      const M = getMessage(msg, opts3.context);
+      const res = internal.sign(M, secretKey, opts3);
+      cleanBytes(M);
+      return res;
+    },
+    verify: (sig, msg, publicKey, opts3 = {}) => {
+      validateVerOpts(opts3);
+      return internal.verify(sig, getMessage(msg, opts3.context), publicKey);
+    },
+    prehash: (hash) => {
+      checkHash(hash, securityLevel);
+      return Object.freeze({
+        info: Object.freeze({ type: "hashml-dsa" }),
+        securityLevel,
+        lengths: internal.lengths,
+        keygen: internal.keygen,
+        getPublicKey: internal.getPublicKey,
+        sign: (msg, secretKey, opts3 = {}) => {
+          validateSigOpts(opts3);
+          const M = getMessagePrehash(hash, msg, opts3.context);
+          const res = internal.sign(M, secretKey, opts3);
+          cleanBytes(M);
+          return res;
+        },
+        verify: (sig, msg, publicKey, opts3 = {}) => {
+          validateVerOpts(opts3);
+          return internal.verify(sig, getMessagePrehash(hash, msg, opts3.context), publicKey);
+        }
+      });
+    }
+  });
+}
+var ml_dsa44 = /* @__PURE__ */ (() => getDilithium({
+  ...PARAMS2[2],
+  CRH_BYTES: 64,
+  TR_BYTES: 64,
+  C_TILDE_BYTES: 32,
+  XOF128,
+  XOF256,
+  securityLevel: 128
+}))();
+var ml_dsa65 = /* @__PURE__ */ (() => getDilithium({
+  ...PARAMS2[3],
+  CRH_BYTES: 64,
+  TR_BYTES: 64,
+  C_TILDE_BYTES: 48,
+  XOF128,
+  XOF256,
+  securityLevel: 192
+}))();
+var ml_dsa87 = /* @__PURE__ */ (() => getDilithium({
+  ...PARAMS2[5],
+  CRH_BYTES: 64,
+  TR_BYTES: 64,
+  C_TILDE_BYTES: 64,
+  XOF128,
+  XOF256,
+  securityLevel: 256
+}))();
+
+// node_modules/@noble/hashes/hmac.js
+var _HMAC = class {
+  oHash;
+  iHash;
+  blockLen;
+  outputLen;
+  canXOF = false;
+  finished = false;
+  destroyed = false;
+  constructor(hash, key) {
+    ahash(hash);
+    abytes(key, void 0, "key");
+    this.iHash = hash.create();
+    if (typeof this.iHash.update !== "function")
+      throw new Error("Expected instance of class which extends utils.Hash");
+    this.blockLen = this.iHash.blockLen;
+    this.outputLen = this.iHash.outputLen;
+    const blockLen = this.blockLen;
+    const pad = new Uint8Array(blockLen);
+    pad.set(key.length > blockLen ? hash.create().update(key).digest() : key);
+    for (let i = 0; i < pad.length; i++)
+      pad[i] ^= 54;
+    this.iHash.update(pad);
+    this.oHash = hash.create();
+    for (let i = 0; i < pad.length; i++)
+      pad[i] ^= 54 ^ 92;
+    this.oHash.update(pad);
+    clean(pad);
+  }
+  update(buf) {
+    aexists(this);
+    this.iHash.update(buf);
+    return this;
+  }
+  digestInto(out) {
+    aexists(this);
+    aoutput(out, this);
+    this.finished = true;
+    const buf = out.subarray(0, this.outputLen);
+    this.iHash.digestInto(buf);
+    this.oHash.update(buf);
+    this.oHash.digestInto(buf);
+    this.destroy();
+  }
+  digest() {
+    const out = new Uint8Array(this.oHash.outputLen);
+    this.digestInto(out);
+    return out;
+  }
+  _cloneInto(to) {
+    to ||= Object.create(Object.getPrototypeOf(this), {});
+    const { oHash, iHash, finished, destroyed, blockLen, outputLen } = this;
+    to = to;
+    to.finished = finished;
+    to.destroyed = destroyed;
+    to.blockLen = blockLen;
+    to.outputLen = outputLen;
+    to.oHash = oHash._cloneInto(to.oHash);
+    to.iHash = iHash._cloneInto(to.iHash);
+    return to;
+  }
+  clone() {
+    return this._cloneInto();
+  }
+  destroy() {
+    this.destroyed = true;
+    this.oHash.destroy();
+    this.iHash.destroy();
+  }
+};
+var hmac = /* @__PURE__ */ (() => {
+  const hmac_ = ((hash, key, message) => new _HMAC(hash, key).update(message).digest());
+  hmac_.create = (hash, key) => new _HMAC(hash, key);
+  return hmac_;
+})();
+
+// node_modules/@noble/hashes/_md.js
+function Chi(a, b, c) {
+  return a & b ^ ~a & c;
+}
+function Maj(a, b, c) {
+  return a & b ^ a & c ^ b & c;
+}
+var HashMD = class {
+  blockLen;
+  outputLen;
+  canXOF = false;
+  padOffset;
+  isLE;
+  // For partial updates less than block size
+  buffer;
+  view;
+  finished = false;
+  length = 0;
+  pos = 0;
+  destroyed = false;
+  constructor(blockLen, outputLen, padOffset, isLE2) {
+    this.blockLen = blockLen;
+    this.outputLen = outputLen;
+    this.padOffset = padOffset;
+    this.isLE = isLE2;
+    this.buffer = new Uint8Array(blockLen);
+    this.view = createView(this.buffer);
+  }
+  update(data) {
+    aexists(this);
+    abytes(data);
+    const { view, buffer, blockLen } = this;
+    const len = data.length;
+    for (let pos = 0; pos < len; ) {
+      const take = Math.min(blockLen - this.pos, len - pos);
+      if (take === blockLen) {
+        const dataView = createView(data);
+        for (; blockLen <= len - pos; pos += blockLen)
+          this.process(dataView, pos);
+        continue;
+      }
+      buffer.set(data.subarray(pos, pos + take), this.pos);
+      this.pos += take;
+      pos += take;
+      if (this.pos === blockLen) {
+        this.process(view, 0);
+        this.pos = 0;
+      }
+    }
+    this.length += data.length;
+    this.roundClean();
+    return this;
+  }
+  digestInto(out) {
+    aexists(this);
+    aoutput(out, this);
+    this.finished = true;
+    const { buffer, view, blockLen, isLE: isLE2 } = this;
+    let { pos } = this;
+    buffer[pos++] = 128;
+    clean(this.buffer.subarray(pos));
+    if (this.padOffset > blockLen - pos) {
+      this.process(view, 0);
+      pos = 0;
+    }
+    for (let i = pos; i < blockLen; i++)
+      buffer[i] = 0;
+    view.setBigUint64(blockLen - 8, BigInt(this.length * 8), isLE2);
+    this.process(view, 0);
+    const oview = createView(out);
+    const len = this.outputLen;
+    if (len % 4)
+      throw new Error("_sha2: outputLen must be aligned to 32bit");
+    const outLen = len / 4;
+    const state = this.get();
+    if (outLen > state.length)
+      throw new Error("_sha2: outputLen bigger than state");
+    for (let i = 0; i < outLen; i++)
+      oview.setUint32(4 * i, state[i], isLE2);
+  }
+  digest() {
+    const { buffer, outputLen } = this;
+    this.digestInto(buffer);
+    const res = buffer.slice(0, outputLen);
+    this.destroy();
+    return res;
+  }
+  _cloneInto(to) {
+    to ||= new this.constructor();
+    to.set(...this.get());
+    const { blockLen, buffer, length, finished, destroyed, pos } = this;
+    to.destroyed = destroyed;
+    to.finished = finished;
+    to.length = length;
+    to.pos = pos;
+    if (length % blockLen)
+      to.buffer.set(buffer);
+    return to;
+  }
+  clone() {
+    return this._cloneInto();
+  }
+};
+var SHA256_IV = /* @__PURE__ */ Uint32Array.from([
+  1779033703,
+  3144134277,
+  1013904242,
+  2773480762,
+  1359893119,
+  2600822924,
+  528734635,
+  1541459225
+]);
+var SHA512_IV = /* @__PURE__ */ Uint32Array.from([
+  1779033703,
+  4089235720,
+  3144134277,
+  2227873595,
+  1013904242,
+  4271175723,
+  2773480762,
+  1595750129,
+  1359893119,
+  2917565137,
+  2600822924,
+  725511199,
+  528734635,
+  4215389547,
+  1541459225,
+  327033209
+]);
+
+// node_modules/@noble/hashes/sha2.js
+var SHA256_K = /* @__PURE__ */ Uint32Array.from([
+  1116352408,
+  1899447441,
+  3049323471,
+  3921009573,
+  961987163,
+  1508970993,
+  2453635748,
+  2870763221,
+  3624381080,
+  310598401,
+  607225278,
+  1426881987,
+  1925078388,
+  2162078206,
+  2614888103,
+  3248222580,
+  3835390401,
+  4022224774,
+  264347078,
+  604807628,
+  770255983,
+  1249150122,
+  1555081692,
+  1996064986,
+  2554220882,
+  2821834349,
+  2952996808,
+  3210313671,
+  3336571891,
+  3584528711,
+  113926993,
+  338241895,
+  666307205,
+  773529912,
+  1294757372,
+  1396182291,
+  1695183700,
+  1986661051,
+  2177026350,
+  2456956037,
+  2730485921,
+  2820302411,
+  3259730800,
+  3345764771,
+  3516065817,
+  3600352804,
+  4094571909,
+  275423344,
+  430227734,
+  506948616,
+  659060556,
+  883997877,
+  958139571,
+  1322822218,
+  1537002063,
+  1747873779,
+  1955562222,
+  2024104815,
+  2227730452,
+  2361852424,
+  2428436474,
+  2756734187,
+  3204031479,
+  3329325298
+]);
+var SHA256_W = /* @__PURE__ */ new Uint32Array(64);
+var SHA2_32B = class extends HashMD {
+  constructor(outputLen) {
+    super(64, outputLen, 8, false);
+  }
+  get() {
+    const { A, B, C, D: D2, E, F: F3, G, H } = this;
+    return [A, B, C, D2, E, F3, G, H];
+  }
+  // prettier-ignore
+  set(A, B, C, D2, E, F3, G, H) {
+    this.A = A | 0;
+    this.B = B | 0;
+    this.C = C | 0;
+    this.D = D2 | 0;
+    this.E = E | 0;
+    this.F = F3 | 0;
+    this.G = G | 0;
+    this.H = H | 0;
+  }
+  process(view, offset) {
+    for (let i = 0; i < 16; i++, offset += 4)
+      SHA256_W[i] = view.getUint32(offset, false);
+    for (let i = 16; i < 64; i++) {
+      const W15 = SHA256_W[i - 15];
+      const W2 = SHA256_W[i - 2];
+      const s0 = rotr(W15, 7) ^ rotr(W15, 18) ^ W15 >>> 3;
+      const s1 = rotr(W2, 17) ^ rotr(W2, 19) ^ W2 >>> 10;
+      SHA256_W[i] = s1 + SHA256_W[i - 7] + s0 + SHA256_W[i - 16] | 0;
+    }
+    let { A, B, C, D: D2, E, F: F3, G, H } = this;
+    for (let i = 0; i < 64; i++) {
+      const sigma1 = rotr(E, 6) ^ rotr(E, 11) ^ rotr(E, 25);
+      const T1 = H + sigma1 + Chi(E, F3, G) + SHA256_K[i] + SHA256_W[i] | 0;
+      const sigma0 = rotr(A, 2) ^ rotr(A, 13) ^ rotr(A, 22);
+      const T2 = sigma0 + Maj(A, B, C) | 0;
+      H = G;
+      G = F3;
+      F3 = E;
+      E = D2 + T1 | 0;
+      D2 = C;
+      C = B;
+      B = A;
+      A = T1 + T2 | 0;
+    }
+    A = A + this.A | 0;
+    B = B + this.B | 0;
+    C = C + this.C | 0;
+    D2 = D2 + this.D | 0;
+    E = E + this.E | 0;
+    F3 = F3 + this.F | 0;
+    G = G + this.G | 0;
+    H = H + this.H | 0;
+    this.set(A, B, C, D2, E, F3, G, H);
+  }
+  roundClean() {
+    clean(SHA256_W);
+  }
+  destroy() {
+    this.destroyed = true;
+    this.set(0, 0, 0, 0, 0, 0, 0, 0);
+    clean(this.buffer);
+  }
+};
+var _SHA256 = class extends SHA2_32B {
+  // We cannot use array here since array allows indexing by variable
+  // which means optimizer/compiler cannot use registers.
+  A = SHA256_IV[0] | 0;
+  B = SHA256_IV[1] | 0;
+  C = SHA256_IV[2] | 0;
+  D = SHA256_IV[3] | 0;
+  E = SHA256_IV[4] | 0;
+  F = SHA256_IV[5] | 0;
+  G = SHA256_IV[6] | 0;
+  H = SHA256_IV[7] | 0;
+  constructor() {
+    super(32);
+  }
+};
+var K512 = /* @__PURE__ */ (() => split([
+  "0x428a2f98d728ae22",
+  "0x7137449123ef65cd",
+  "0xb5c0fbcfec4d3b2f",
+  "0xe9b5dba58189dbbc",
+  "0x3956c25bf348b538",
+  "0x59f111f1b605d019",
+  "0x923f82a4af194f9b",
+  "0xab1c5ed5da6d8118",
+  "0xd807aa98a3030242",
+  "0x12835b0145706fbe",
+  "0x243185be4ee4b28c",
+  "0x550c7dc3d5ffb4e2",
+  "0x72be5d74f27b896f",
+  "0x80deb1fe3b1696b1",
+  "0x9bdc06a725c71235",
+  "0xc19bf174cf692694",
+  "0xe49b69c19ef14ad2",
+  "0xefbe4786384f25e3",
+  "0x0fc19dc68b8cd5b5",
+  "0x240ca1cc77ac9c65",
+  "0x2de92c6f592b0275",
+  "0x4a7484aa6ea6e483",
+  "0x5cb0a9dcbd41fbd4",
+  "0x76f988da831153b5",
+  "0x983e5152ee66dfab",
+  "0xa831c66d2db43210",
+  "0xb00327c898fb213f",
+  "0xbf597fc7beef0ee4",
+  "0xc6e00bf33da88fc2",
+  "0xd5a79147930aa725",
+  "0x06ca6351e003826f",
+  "0x142929670a0e6e70",
+  "0x27b70a8546d22ffc",
+  "0x2e1b21385c26c926",
+  "0x4d2c6dfc5ac42aed",
+  "0x53380d139d95b3df",
+  "0x650a73548baf63de",
+  "0x766a0abb3c77b2a8",
+  "0x81c2c92e47edaee6",
+  "0x92722c851482353b",
+  "0xa2bfe8a14cf10364",
+  "0xa81a664bbc423001",
+  "0xc24b8b70d0f89791",
+  "0xc76c51a30654be30",
+  "0xd192e819d6ef5218",
+  "0xd69906245565a910",
+  "0xf40e35855771202a",
+  "0x106aa07032bbd1b8",
+  "0x19a4c116b8d2d0c8",
+  "0x1e376c085141ab53",
+  "0x2748774cdf8eeb99",
+  "0x34b0bcb5e19b48a8",
+  "0x391c0cb3c5c95a63",
+  "0x4ed8aa4ae3418acb",
+  "0x5b9cca4f7763e373",
+  "0x682e6ff3d6b2b8a3",
+  "0x748f82ee5defb2fc",
+  "0x78a5636f43172f60",
+  "0x84c87814a1f0ab72",
+  "0x8cc702081a6439ec",
+  "0x90befffa23631e28",
+  "0xa4506cebde82bde9",
+  "0xbef9a3f7b2c67915",
+  "0xc67178f2e372532b",
+  "0xca273eceea26619c",
+  "0xd186b8c721c0c207",
+  "0xeada7dd6cde0eb1e",
+  "0xf57d4f7fee6ed178",
+  "0x06f067aa72176fba",
+  "0x0a637dc5a2c898a6",
+  "0x113f9804bef90dae",
+  "0x1b710b35131c471b",
+  "0x28db77f523047d84",
+  "0x32caab7b40c72493",
+  "0x3c9ebe0a15c9bebc",
+  "0x431d67c49c100d4c",
+  "0x4cc5d4becb3e42b6",
+  "0x597f299cfc657e2a",
+  "0x5fcb6fab3ad6faec",
+  "0x6c44198c4a475817"
+].map((n) => BigInt(n))))();
+var SHA512_Kh = /* @__PURE__ */ (() => K512[0])();
+var SHA512_Kl = /* @__PURE__ */ (() => K512[1])();
+var SHA512_W_H = /* @__PURE__ */ new Uint32Array(80);
+var SHA512_W_L = /* @__PURE__ */ new Uint32Array(80);
+var SHA2_64B = class extends HashMD {
+  constructor(outputLen) {
+    super(128, outputLen, 16, false);
+  }
+  // prettier-ignore
+  get() {
+    const { Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl } = this;
+    return [Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl];
+  }
+  // prettier-ignore
+  set(Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl) {
+    this.Ah = Ah | 0;
+    this.Al = Al | 0;
+    this.Bh = Bh | 0;
+    this.Bl = Bl | 0;
+    this.Ch = Ch | 0;
+    this.Cl = Cl | 0;
+    this.Dh = Dh | 0;
+    this.Dl = Dl | 0;
+    this.Eh = Eh | 0;
+    this.El = El | 0;
+    this.Fh = Fh | 0;
+    this.Fl = Fl | 0;
+    this.Gh = Gh | 0;
+    this.Gl = Gl | 0;
+    this.Hh = Hh | 0;
+    this.Hl = Hl | 0;
+  }
+  process(view, offset) {
+    for (let i = 0; i < 16; i++, offset += 4) {
+      SHA512_W_H[i] = view.getUint32(offset);
+      SHA512_W_L[i] = view.getUint32(offset += 4);
+    }
+    for (let i = 16; i < 80; i++) {
+      const W15h = SHA512_W_H[i - 15] | 0;
+      const W15l = SHA512_W_L[i - 15] | 0;
+      const s0h = rotrSH(W15h, W15l, 1) ^ rotrSH(W15h, W15l, 8) ^ shrSH(W15h, W15l, 7);
+      const s0l = rotrSL(W15h, W15l, 1) ^ rotrSL(W15h, W15l, 8) ^ shrSL(W15h, W15l, 7);
+      const W2h = SHA512_W_H[i - 2] | 0;
+      const W2l = SHA512_W_L[i - 2] | 0;
+      const s1h = rotrSH(W2h, W2l, 19) ^ rotrBH(W2h, W2l, 61) ^ shrSH(W2h, W2l, 6);
+      const s1l = rotrSL(W2h, W2l, 19) ^ rotrBL(W2h, W2l, 61) ^ shrSL(W2h, W2l, 6);
+      const SUMl = add4L(s0l, s1l, SHA512_W_L[i - 7], SHA512_W_L[i - 16]);
+      const SUMh = add4H(SUMl, s0h, s1h, SHA512_W_H[i - 7], SHA512_W_H[i - 16]);
+      SHA512_W_H[i] = SUMh | 0;
+      SHA512_W_L[i] = SUMl | 0;
+    }
+    let { Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl } = this;
+    for (let i = 0; i < 80; i++) {
+      const sigma1h = rotrSH(Eh, El, 14) ^ rotrSH(Eh, El, 18) ^ rotrBH(Eh, El, 41);
+      const sigma1l = rotrSL(Eh, El, 14) ^ rotrSL(Eh, El, 18) ^ rotrBL(Eh, El, 41);
+      const CHIh = Eh & Fh ^ ~Eh & Gh;
+      const CHIl = El & Fl ^ ~El & Gl;
+      const T1ll = add5L(Hl, sigma1l, CHIl, SHA512_Kl[i], SHA512_W_L[i]);
+      const T1h = add5H(T1ll, Hh, sigma1h, CHIh, SHA512_Kh[i], SHA512_W_H[i]);
+      const T1l = T1ll | 0;
+      const sigma0h = rotrSH(Ah, Al, 28) ^ rotrBH(Ah, Al, 34) ^ rotrBH(Ah, Al, 39);
+      const sigma0l = rotrSL(Ah, Al, 28) ^ rotrBL(Ah, Al, 34) ^ rotrBL(Ah, Al, 39);
+      const MAJh = Ah & Bh ^ Ah & Ch ^ Bh & Ch;
+      const MAJl = Al & Bl ^ Al & Cl ^ Bl & Cl;
+      Hh = Gh | 0;
+      Hl = Gl | 0;
+      Gh = Fh | 0;
+      Gl = Fl | 0;
+      Fh = Eh | 0;
+      Fl = El | 0;
+      ({ h: Eh, l: El } = add(Dh | 0, Dl | 0, T1h | 0, T1l | 0));
+      Dh = Ch | 0;
+      Dl = Cl | 0;
+      Ch = Bh | 0;
+      Cl = Bl | 0;
+      Bh = Ah | 0;
+      Bl = Al | 0;
+      const All = add3L(T1l, sigma0l, MAJl);
+      Ah = add3H(All, T1h, sigma0h, MAJh);
+      Al = All | 0;
+    }
+    ({ h: Ah, l: Al } = add(this.Ah | 0, this.Al | 0, Ah | 0, Al | 0));
+    ({ h: Bh, l: Bl } = add(this.Bh | 0, this.Bl | 0, Bh | 0, Bl | 0));
+    ({ h: Ch, l: Cl } = add(this.Ch | 0, this.Cl | 0, Ch | 0, Cl | 0));
+    ({ h: Dh, l: Dl } = add(this.Dh | 0, this.Dl | 0, Dh | 0, Dl | 0));
+    ({ h: Eh, l: El } = add(this.Eh | 0, this.El | 0, Eh | 0, El | 0));
+    ({ h: Fh, l: Fl } = add(this.Fh | 0, this.Fl | 0, Fh | 0, Fl | 0));
+    ({ h: Gh, l: Gl } = add(this.Gh | 0, this.Gl | 0, Gh | 0, Gl | 0));
+    ({ h: Hh, l: Hl } = add(this.Hh | 0, this.Hl | 0, Hh | 0, Hl | 0));
+    this.set(Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl);
+  }
+  roundClean() {
+    clean(SHA512_W_H, SHA512_W_L);
+  }
+  destroy() {
+    this.destroyed = true;
+    clean(this.buffer);
+    this.set(0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0);
+  }
+};
+var _SHA512 = class extends SHA2_64B {
+  Ah = SHA512_IV[0] | 0;
+  Al = SHA512_IV[1] | 0;
+  Bh = SHA512_IV[2] | 0;
+  Bl = SHA512_IV[3] | 0;
+  Ch = SHA512_IV[4] | 0;
+  Cl = SHA512_IV[5] | 0;
+  Dh = SHA512_IV[6] | 0;
+  Dl = SHA512_IV[7] | 0;
+  Eh = SHA512_IV[8] | 0;
+  El = SHA512_IV[9] | 0;
+  Fh = SHA512_IV[10] | 0;
+  Fl = SHA512_IV[11] | 0;
+  Gh = SHA512_IV[12] | 0;
+  Gl = SHA512_IV[13] | 0;
+  Hh = SHA512_IV[14] | 0;
+  Hl = SHA512_IV[15] | 0;
+  constructor() {
+    super(64);
+  }
+};
+var sha256 = /* @__PURE__ */ createHasher(
+  () => new _SHA256(),
+  /* @__PURE__ */ oidNist(1)
+);
+var sha512 = /* @__PURE__ */ createHasher(
+  () => new _SHA512(),
+  /* @__PURE__ */ oidNist(3)
+);
+
+// node_modules/@noble/post-quantum/slh-dsa.js
+var PARAMS3 = /* @__PURE__ */ (() => Object.freeze({
+  "128f": Object.freeze({ W: 16, N: 16, H: 66, D: 22, K: 33, A: 6, securityLevel: 128 }),
+  "128s": Object.freeze({ W: 16, N: 16, H: 63, D: 7, K: 14, A: 12, securityLevel: 128 }),
+  "192f": Object.freeze({ W: 16, N: 24, H: 66, D: 22, K: 33, A: 8, securityLevel: 192 }),
+  "192s": Object.freeze({ W: 16, N: 24, H: 63, D: 7, K: 17, A: 14, securityLevel: 192 }),
+  "256f": Object.freeze({ W: 16, N: 32, H: 68, D: 17, K: 35, A: 9, securityLevel: 256 }),
+  "256s": Object.freeze({ W: 16, N: 32, H: 64, D: 8, K: 22, A: 14, securityLevel: 256 })
+}))();
+var AddressType = {
+  WOTS: 0,
+  WOTSPK: 1,
+  HASHTREE: 2,
+  FORSTREE: 3,
+  FORSPK: 4,
+  WOTSPRF: 5,
+  FORSPRF: 6
+};
+function hexToNumber(hex) {
+  if (typeof hex !== "string")
+    throw new Error("hex string expected, got " + typeof hex);
+  return BigInt(hex === "" ? "0" : "0x" + hex);
+}
+function bytesToNumberBE(bytes) {
+  return hexToNumber(bytesToHex(bytes));
+}
+function numberToBytesBE(n, len) {
+  return hexToBytes(n.toString(16).padStart(len * 2, "0"));
+}
+var base2b = (outLen, b) => {
+  const mask = getMask(b);
+  return (bytes) => {
+    const baseB = new Uint32Array(outLen);
+    for (let out = 0, pos = 0, bits = 0, total = 0; out < outLen; out++) {
+      while (bits < b) {
+        total = total << 8 | bytes[pos++];
+        bits += 8;
+      }
+      bits -= b;
+      baseB[out] = total >>> bits & mask;
+    }
+    return baseB;
+  };
+};
+function getMaskBig(bits) {
+  return (1n << BigInt(bits)) - 1n;
+}
+function gen(opts2, hashOpts_) {
+  const hashOpts = hashOpts_;
+  const { N: N3, W, H, D: D2, K, A, securityLevel } = opts2;
+  const getContext = hashOpts.getContext(opts2);
+  if (W !== 16)
+    throw new Error("Unsupported Winternitz parameter");
+  const WOTS_LOGW = 4;
+  const WOTS_LEN1 = Math.floor(8 * N3 / WOTS_LOGW);
+  const WOTS_LEN2 = N3 <= 8 ? 2 : N3 <= 136 ? 3 : 4;
+  const TREE_HEIGHT = Math.floor(H / D2);
+  const WOTS_LEN = WOTS_LEN1 + WOTS_LEN2;
+  let ADDR_BYTES = 22;
+  let OFFSET_LAYER = 0;
+  let OFFSET_TREE = 1;
+  let OFFSET_TYPE = 9;
+  let OFFSET_KP_ADDR2 = 12;
+  let OFFSET_KP_ADDR1 = 13;
+  let OFFSET_CHAIN_ADDR = 17;
+  let OFFSET_TREE_INDEX = 18;
+  let OFFSET_HASH_ADDR = 21;
+  if (!hashOpts.isCompressed) {
+    ADDR_BYTES = 32;
+    OFFSET_LAYER += 3;
+    OFFSET_TREE += 7;
+    OFFSET_TYPE += 10;
+    OFFSET_KP_ADDR2 += 10;
+    OFFSET_KP_ADDR1 += 10;
+    OFFSET_CHAIN_ADDR += 10;
+    OFFSET_TREE_INDEX += 10;
+    OFFSET_HASH_ADDR += 10;
+  }
+  const setAddr = (opts3, addr = new Uint8Array(ADDR_BYTES)) => {
+    const { type, height, tree, layer, index, chain, hash, keypair } = opts3;
+    const { subtreeAddr, keypairAddr } = opts3;
+    const v = createView(addr);
+    if (height !== void 0)
+      addr[OFFSET_CHAIN_ADDR] = height;
+    if (layer !== void 0)
+      addr[OFFSET_LAYER] = layer;
+    if (type !== void 0)
+      addr[OFFSET_TYPE] = type;
+    if (chain !== void 0)
+      addr[OFFSET_CHAIN_ADDR] = chain;
+    if (hash !== void 0)
+      addr[OFFSET_HASH_ADDR] = hash;
+    if (index !== void 0)
+      v.setUint32(OFFSET_TREE_INDEX, index, false);
+    if (subtreeAddr)
+      addr.set(subtreeAddr.subarray(0, OFFSET_TREE + 8));
+    if (tree !== void 0)
+      v.setBigUint64(OFFSET_TREE, tree, false);
+    if (keypair !== void 0) {
+      addr[OFFSET_KP_ADDR1] = keypair;
+      if (TREE_HEIGHT > 8)
+        addr[OFFSET_KP_ADDR2] = keypair >>> 8;
+    }
+    if (keypairAddr) {
+      addr.set(keypairAddr.subarray(0, OFFSET_TREE + 8));
+      addr[OFFSET_KP_ADDR1] = keypairAddr[OFFSET_KP_ADDR1];
+      if (TREE_HEIGHT > 8)
+        addr[OFFSET_KP_ADDR2] = keypairAddr[OFFSET_KP_ADDR2];
+    }
+    return addr;
+  };
+  const chainCoder = base2b(WOTS_LEN2, WOTS_LOGW);
+  const chainLengths = (msg) => {
+    const W1 = base2b(WOTS_LEN1, WOTS_LOGW)(msg);
+    let csum = 0;
+    for (let i = 0; i < W1.length; i++)
+      csum += W - 1 - W1[i];
+    csum <<= (8 - WOTS_LEN2 * WOTS_LOGW % 8) % 8;
+    const W2 = chainCoder(numberToBytesBE(csum, Math.ceil(WOTS_LEN2 * WOTS_LOGW / 8)));
+    const lengths = new Uint32Array(WOTS_LEN);
+    lengths.set(W1);
+    lengths.set(W2, W1.length);
+    return lengths;
+  };
+  const messageToIndices = base2b(K, A);
+  const TREE_BITS = TREE_HEIGHT * (D2 - 1);
+  const LEAF_BITS = TREE_HEIGHT;
+  const hashMsgCoder = splitCoder("hashedMessage", Math.ceil(A * K / 8), Math.ceil(TREE_BITS / 8), Math.ceil(TREE_HEIGHT / 8));
+  const hashMessage = (R, pkSeed, msg, context) => {
+    const rawContext = context;
+    const digest = rawContext.Hmsg(R, pkSeed, msg, hashMsgCoder.bytesLen);
+    const [md, tmpIdxTree, tmpIdxLeaf] = hashMsgCoder.decode(digest);
+    const tree = bytesToNumberBE(tmpIdxTree) & getMaskBig(TREE_BITS);
+    const leafIdx = Number(bytesToNumberBE(tmpIdxLeaf)) & getMask(LEAF_BITS);
+    return { tree, leafIdx, md };
+  };
+  const treehash = (height, fn) => function treehash_i(context, leafIdx, idxOffset, treeAddr, info) {
+    const rawContext = context;
+    const leafFn = fn;
+    const maxIdx = (1 << height) - 1;
+    const stack = new Uint8Array(height * N3);
+    const authPath = new Uint8Array(height * N3);
+    for (let idx = 0; ; idx++) {
+      const current = new Uint8Array(2 * N3);
+      const cur0 = current.subarray(0, N3);
+      const cur1 = current.subarray(N3);
+      const addrOffset = idx + idxOffset;
+      cur1.set(leafFn(leafIdx, addrOffset, rawContext, info));
+      let h = 0;
+      for (let i = idx, o = idxOffset, l = leafIdx; ; h++, i >>>= 1, l >>>= 1, o >>>= 1) {
+        if (h === height)
+          return { root: cur1, authPath };
+        if ((i ^ l) === 1)
+          authPath.subarray(h * N3).set(cur1);
+        if ((i & 1) === 0 && idx < maxIdx)
+          break;
+        setAddr({ height: h + 1, index: (i >> 1) + (o >> 1) }, treeAddr);
+        cur0.set(stack.subarray(h * N3).subarray(0, N3));
+        cur1.set(rawContext.thashN(2, current, treeAddr));
+      }
+      stack.subarray(h * N3).set(cur1);
+    }
+    throw new Error("Unreachable code path reached, report this error");
+  };
+  const wotsTreehash = treehash(TREE_HEIGHT, (leafIdx, addrOffset, context, info) => {
+    const rawContext = context;
+    const wotsPk = new Uint8Array(WOTS_LEN * N3);
+    const wotsKmask = addrOffset === leafIdx ? 0 : ~0 >>> 0;
+    setAddr({ keypair: addrOffset }, info.leafAddr);
+    setAddr({ keypair: addrOffset }, info.pkAddr);
+    for (let i = 0; i < WOTS_LEN; i++) {
+      const wotsK = info.wotsSteps[i] | wotsKmask;
+      const pk = wotsPk.subarray(i * N3, (i + 1) * N3);
+      setAddr({ chain: i, hash: 0, type: AddressType.WOTSPRF }, info.leafAddr);
+      pk.set(rawContext.PRFaddr(info.leafAddr));
+      setAddr({ type: AddressType.WOTS }, info.leafAddr);
+      for (let k = 0; ; k++) {
+        if (k === wotsK)
+          info.wotsSig.subarray(i * N3).set(pk);
+        if (k === W - 1)
+          break;
+        setAddr({ hash: k }, info.leafAddr);
+        pk.set(rawContext.thash1(pk, info.leafAddr));
+      }
+    }
+    return rawContext.thashN(WOTS_LEN, wotsPk, info.pkAddr);
+  });
+  const forsTreehash = treehash(A, (_, addrOffset, context, forsLeafAddr) => {
+    const rawContext = context;
+    setAddr({ type: AddressType.FORSPRF, index: addrOffset }, forsLeafAddr);
+    const prf = rawContext.PRFaddr(forsLeafAddr);
+    setAddr({ type: AddressType.FORSTREE }, forsLeafAddr);
+    return rawContext.thash1(prf, forsLeafAddr);
+  });
+  const merkleSign = (context, wotsAddr, treeAddr, leafIdx, prevRoot = new Uint8Array(N3)) => {
+    setAddr({ type: AddressType.HASHTREE }, treeAddr);
+    const info = {
+      wotsSig: new Uint8Array(wotsCoder.bytesLen),
+      wotsSteps: chainLengths(prevRoot),
+      leafAddr: setAddr({ subtreeAddr: wotsAddr }),
+      pkAddr: setAddr({ type: AddressType.WOTSPK, subtreeAddr: wotsAddr })
+    };
+    const { root, authPath } = wotsTreehash(context, leafIdx, 0, treeAddr, info);
+    return {
+      root,
+      sigWots: info.wotsSig.subarray(0, WOTS_LEN * N3),
+      sigAuth: authPath
+    };
+  };
+  const computeRoot = (leaf, leafIdx, idxOffset, authPath, treeHeight, context, addr) => {
+    const rawContext = context;
+    const buffer = new Uint8Array(2 * N3);
+    const b0 = buffer.subarray(0, N3);
+    const b1 = buffer.subarray(N3, 2 * N3);
+    if ((leafIdx & 1) !== 0) {
+      b1.set(leaf.subarray(0, N3));
+      b0.set(authPath.subarray(0, N3));
+    } else {
+      b0.set(leaf.subarray(0, N3));
+      b1.set(authPath.subarray(0, N3));
+    }
+    leafIdx >>>= 1;
+    idxOffset >>>= 1;
+    for (let i = 0; i < treeHeight - 1; i++, leafIdx >>= 1, idxOffset >>= 1) {
+      setAddr({ height: i + 1, index: leafIdx + idxOffset }, addr);
+      const a = authPath.subarray((i + 1) * N3, (i + 2) * N3);
+      if ((leafIdx & 1) !== 0) {
+        b1.set(rawContext.thashN(2, buffer, addr));
+        b0.set(a);
+      } else {
+        buffer.set(rawContext.thashN(2, buffer, addr));
+        b1.set(a);
+      }
+    }
+    setAddr({ height: treeHeight, index: leafIdx + idxOffset }, addr);
+    return rawContext.thashN(2, buffer, addr);
+  };
+  const seedCoder = splitCoder("seed", N3, N3, N3);
+  const publicCoder = splitCoder("publicKey", N3, N3);
+  const secretCoder = splitCoder("secretKey", N3, N3, publicCoder.bytesLen);
+  const forsCoder = vecCoder(splitCoder("fors", N3, N3 * A), K);
+  const wotsCoder = vecCoder(splitCoder("wots", WOTS_LEN * N3, TREE_HEIGHT * N3), D2);
+  const sigCoder = splitCoder("signature", N3, forsCoder, wotsCoder);
+  const internal = Object.freeze({
+    info: Object.freeze({ type: "internal-slh-dsa" }),
+    lengths: Object.freeze({
+      publicKey: publicCoder.bytesLen,
+      secretKey: secretCoder.bytesLen,
+      signature: sigCoder.bytesLen,
+      seed: seedCoder.bytesLen,
+      signRand: N3
+    }),
+    keygen(seed) {
+      if (seed !== void 0)
+        abytesDoc(seed, seedCoder.bytesLen, "seed");
+      seed = seed === void 0 ? randomBytes2(seedCoder.bytesLen) : copyBytes(seed);
+      const [secretSeed, secretPRF, publicSeed] = seedCoder.decode(seed);
+      const context = getContext(publicSeed, secretSeed);
+      const topTreeAddr = setAddr({ layer: D2 - 1 });
+      const wotsAddr = setAddr({ layer: D2 - 1 });
+      const { root } = merkleSign(context, wotsAddr, topTreeAddr, ~0 >>> 0);
+      const publicKey = publicCoder.encode([publicSeed, root]);
+      const secretKey = secretCoder.encode([secretSeed, secretPRF, publicKey]);
+      context.clean();
+      cleanBytes(secretSeed, secretPRF, root, wotsAddr, topTreeAddr);
+      return {
+        publicKey,
+        secretKey
+      };
+    },
+    getPublicKey: (secretKey) => {
+      const [_skSeed, _skPRF, pk] = secretCoder.decode(secretKey);
+      return Uint8Array.from(pk);
+    },
+    sign: (msg, sk, opts3 = {}) => {
+      validateSigOpts(opts3);
+      let { extraEntropy: random } = opts3;
+      const [skSeed, skPRF, pk] = secretCoder.decode(sk);
+      const [pkSeed, _] = publicCoder.decode(pk);
+      if (random === false)
+        random = copyBytes(pkSeed);
+      else if (random === void 0)
+        random = randomBytes2(N3);
+      else
+        random = copyBytes(random);
+      abytesDoc(random, N3);
+      const context = getContext(pkSeed, skSeed);
+      const R = context.PRFmsg(skPRF, random, msg);
+      let { tree, leafIdx, md } = hashMessage(R, pk, msg, context);
+      const wotsAddr = setAddr({
+        type: AddressType.WOTS,
+        tree,
+        keypair: leafIdx
+      });
+      const roots = [];
+      const forsLeaf = setAddr({ keypairAddr: wotsAddr });
+      const forsTreeAddr = setAddr({ keypairAddr: wotsAddr });
+      const indices = messageToIndices(md);
+      const fors = [];
+      for (let i = 0; i < indices.length; i++) {
+        const idxOffset = i << A;
+        setAddr({
+          type: AddressType.FORSPRF,
+          height: 0,
+          index: indices[i] + idxOffset
+        }, forsTreeAddr);
+        const prf = context.PRFaddr(forsTreeAddr);
+        setAddr({ type: AddressType.FORSTREE }, forsTreeAddr);
+        const { root: root2, authPath } = forsTreehash(context, indices[i], idxOffset, forsTreeAddr, forsLeaf);
+        roots.push(root2);
+        fors.push([prf, authPath]);
+      }
+      const forsPkAddr = setAddr({
+        type: AddressType.FORSPK,
+        keypairAddr: wotsAddr
+      });
+      const root = context.thashN(K, concatBytes(...roots), forsPkAddr);
+      const treeAddr = setAddr({ type: AddressType.HASHTREE });
+      const wots = [];
+      for (let i = 0; i < D2; i++, tree >>= BigInt(TREE_HEIGHT)) {
+        setAddr({ tree, layer: i }, treeAddr);
+        setAddr({ subtreeAddr: treeAddr, keypair: leafIdx }, wotsAddr);
+        const { sigWots, sigAuth, root: r } = merkleSign(context, wotsAddr, treeAddr, leafIdx, root);
+        root.set(r);
+        cleanBytes(r);
+        wots.push([sigWots, sigAuth]);
+        leafIdx = Number(tree & getMaskBig(TREE_HEIGHT));
+      }
+      context.clean();
+      const SIG = sigCoder.encode([R, fors, wots]);
+      cleanBytes(R, random, treeAddr, wotsAddr, forsLeaf, forsTreeAddr, indices, roots);
+      return SIG;
+    },
+    verify: (sig, msg, publicKey) => {
+      const [pkSeed, pubRoot] = publicCoder.decode(publicKey);
+      const [random, forsVec, wotsVec] = sigCoder.decode(sig);
+      const pk = publicKey;
+      if (sig.length !== sigCoder.bytesLen)
+        return false;
+      const context = getContext(pkSeed);
+      let { tree, leafIdx, md } = hashMessage(random, pk, msg, context);
+      const wotsAddr = setAddr({
+        type: AddressType.WOTS,
+        tree,
+        keypair: leafIdx
+      });
+      const roots = [];
+      const forsTreeAddr = setAddr({
+        type: AddressType.FORSTREE,
+        keypairAddr: wotsAddr
+      });
+      const indices = messageToIndices(md);
+      for (let i = 0; i < forsVec.length; i++) {
+        const [prf, authPath] = forsVec[i];
+        const idxOffset = i << A;
+        setAddr({ height: 0, index: indices[i] + idxOffset }, forsTreeAddr);
+        const leaf = context.thash1(prf, forsTreeAddr);
+        roots.push(computeRoot(leaf, indices[i], idxOffset, authPath, A, context, forsTreeAddr));
+      }
+      const forsPkAddr = setAddr({
+        type: AddressType.FORSPK,
+        keypairAddr: wotsAddr
+      });
+      let root = context.thashN(K, concatBytes(...roots), forsPkAddr);
+      const treeAddr = setAddr({ type: AddressType.HASHTREE });
+      const wotsPkAddr = setAddr({ type: AddressType.WOTSPK });
+      const wotsPk = new Uint8Array(WOTS_LEN * N3);
+      for (let i = 0; i < wotsVec.length; i++, tree >>= BigInt(TREE_HEIGHT)) {
+        const [wots, sigAuth] = wotsVec[i];
+        setAddr({ tree, layer: i }, treeAddr);
+        setAddr({ subtreeAddr: treeAddr, keypair: leafIdx }, wotsAddr);
+        setAddr({ keypairAddr: wotsAddr }, wotsPkAddr);
+        const lengths = chainLengths(root);
+        for (let i2 = 0; i2 < WOTS_LEN; i2++) {
+          setAddr({ chain: i2 }, wotsAddr);
+          const steps = W - 1 - lengths[i2];
+          const start = lengths[i2];
+          const out = wotsPk.subarray(i2 * N3);
+          out.set(wots.subarray(i2 * N3, (i2 + 1) * N3));
+          for (let j = start; j < start + steps && j < W; j++) {
+            setAddr({ hash: j }, wotsAddr);
+            out.set(context.thash1(out, wotsAddr));
+          }
+        }
+        const leaf = context.thashN(WOTS_LEN, wotsPk, wotsPkAddr);
+        root = computeRoot(leaf, leafIdx, 0, sigAuth, TREE_HEIGHT, context, treeAddr);
+        leafIdx = Number(tree & getMaskBig(TREE_HEIGHT));
+      }
+      return equalBytes(root, pubRoot);
+    }
+  });
+  return Object.freeze({
+    info: Object.freeze({ type: "slh-dsa" }),
+    internal,
+    securityLevel,
+    lengths: internal.lengths,
+    keygen: internal.keygen,
+    getPublicKey: internal.getPublicKey,
+    sign: (msg, secretKey, opts3 = {}) => {
+      validateSigOpts(opts3);
+      const M = getMessage(msg, opts3.context);
+      const res = internal.sign(M, secretKey, opts3);
+      cleanBytes(M);
+      return res;
+    },
+    verify: (sig, msg, publicKey, opts3 = {}) => {
+      validateVerOpts(opts3);
+      return internal.verify(sig, getMessage(msg, opts3.context), publicKey);
+    },
+    prehash: (hash) => {
+      checkHash(hash, securityLevel);
+      const rawHash = hash;
+      return Object.freeze({
+        info: Object.freeze({ type: "hashslh-dsa" }),
+        lengths: internal.lengths,
+        keygen: internal.keygen,
+        getPublicKey: internal.getPublicKey,
+        sign: (msg, secretKey, opts3 = {}) => {
+          validateSigOpts(opts3);
+          const M = getMessagePrehash(rawHash, msg, opts3.context);
+          const res = internal.sign(M, secretKey, opts3);
+          cleanBytes(M);
+          return res;
+        },
+        verify: (sig, msg, publicKey, opts3 = {}) => {
+          validateVerOpts(opts3);
+          return internal.verify(sig, getMessagePrehash(rawHash, msg, opts3.context), publicKey);
+        }
+      });
+    }
+  });
+}
+var genShake2 = () => (opts2) => (pubSeed, skSeed) => {
+  const { N: N3 } = opts2;
+  const stats = { prf: 0, thash: 0, hmsg: 0, gen_message_random: 0 };
+  const h0 = shake256.create({}).update(pubSeed);
+  const h0tmp = h0.clone();
+  const thash = (blocks, input, addr) => {
+    stats.thash++;
+    return h0._cloneInto(h0tmp).update(addr).update(input.subarray(0, blocks * N3)).xof(N3);
+  };
+  return {
+    PRFaddr: (addr) => {
+      if (!skSeed)
+        throw new Error("no sk seed");
+      stats.prf++;
+      const res = h0._cloneInto(h0tmp).update(addr).update(skSeed).xof(N3);
+      return res;
+    },
+    PRFmsg: (skPRF, random, msg) => {
+      stats.gen_message_random++;
+      return shake256.create({}).update(skPRF).update(random).update(msg).digest().subarray(0, N3);
+    },
+    Hmsg: (R, pk, m, outLen) => {
+      stats.hmsg++;
+      return shake256.create({}).update(R.subarray(0, N3)).update(pk).update(m).xof(outLen);
+    },
+    thash1: thash.bind(null, 1),
+    thashN: thash,
+    clean: () => {
+      h0.destroy();
+      h0tmp.destroy();
+    }
+  };
+};
+var SHAKE_SIMPLE = /* @__PURE__ */ (() => ({ getContext: genShake2() }))();
+var slh_dsa_shake_128f = /* @__PURE__ */ (() => gen(PARAMS3["128f"], SHAKE_SIMPLE))();
+var slh_dsa_shake_192f = /* @__PURE__ */ (() => gen(PARAMS3["192f"], SHAKE_SIMPLE))();
+var slh_dsa_shake_256f = /* @__PURE__ */ (() => gen(PARAMS3["256f"], SHAKE_SIMPLE))();
+var genSha = (h0, h1) => (opts2) => (pub_seed, sk_seed) => {
+  const { N: N3 } = opts2;
+  const stats = { prf: 0, thash: 0, hmsg: 0, gen_message_random: 0, mgf1: 0 };
+  const counterB = new Uint8Array(4);
+  const counterV = createView(counterB);
+  const h0ps = h0.create().update(pub_seed).update(new Uint8Array(h0.blockLen - N3));
+  const h1ps = h1.create().update(pub_seed).update(new Uint8Array(h1.blockLen - N3));
+  const h0tmp = h0ps.clone();
+  const h1tmp = h1ps.clone();
+  function mgf1(seed, length, hash) {
+    stats.mgf1++;
+    const out = new Uint8Array(Math.ceil(length / hash.outputLen) * hash.outputLen);
+    if (length > 2 ** 32)
+      throw new Error("mask too long");
+    for (let counter = 0, o = out; o.length; counter++) {
+      counterV.setUint32(0, counter, false);
+      hash.create().update(seed).update(counterB).digestInto(o);
+      o = o.subarray(hash.outputLen);
+    }
+    cleanBytes(out.subarray(length));
+    return out.subarray(0, length);
+  }
+  const thash = (_, h, hTmp) => (blocks, input, addr) => {
+    stats.thash++;
+    const d = h._cloneInto(hTmp).update(addr).update(input.subarray(0, blocks * N3)).digest();
+    return d.subarray(0, N3);
+  };
+  return {
+    PRFaddr: (addr) => {
+      if (!sk_seed)
+        throw new Error("No sk seed");
+      stats.prf++;
+      const res = h0ps._cloneInto(h0tmp).update(addr).update(sk_seed).digest().subarray(0, N3);
+      return res;
+    },
+    PRFmsg: (skPRF, random, msg) => {
+      stats.gen_message_random++;
+      return hmac.create(h1, skPRF).update(random).update(msg).digest().subarray(0, N3);
+    },
+    Hmsg: (R, pk, m, outLen) => {
+      stats.hmsg++;
+      const seed = concatBytes(R.subarray(0, N3), pk.subarray(0, N3), h1.create().update(R.subarray(0, N3)).update(pk).update(m).digest());
+      return mgf1(seed, outLen, h1);
+    },
+    thash1: thash(h0, h0ps, h0tmp).bind(null, 1),
+    thashN: thash(h1, h1ps, h1tmp),
+    clean: () => {
+      h0ps.destroy();
+      h1ps.destroy();
+      h0tmp.destroy();
+      h1tmp.destroy();
+    }
+  };
+};
+var SHA256_SIMPLE = /* @__PURE__ */ (() => ({
+  isCompressed: true,
+  getContext: genSha(sha256, sha256)
+}))();
+var SHA512_SIMPLE = /* @__PURE__ */ (() => ({
+  isCompressed: true,
+  getContext: genSha(sha256, sha512)
+}))();
+var slh_dsa_sha2_128f = /* @__PURE__ */ (() => gen(PARAMS3["128f"], SHA256_SIMPLE))();
+var slh_dsa_sha2_192f = /* @__PURE__ */ (() => gen(PARAMS3["192f"], SHA512_SIMPLE))();
+var slh_dsa_sha2_256f = /* @__PURE__ */ (() => gen(PARAMS3["256f"], SHA512_SIMPLE))();
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  ml_dsa44,
+  ml_dsa65,
+  ml_dsa87,
+  ml_kem1024,
+  ml_kem512,
+  ml_kem768,
+  slh_dsa_sha2_128f,
+  slh_dsa_sha2_192f,
+  slh_dsa_sha2_256f,
+  slh_dsa_shake_128f,
+  slh_dsa_shake_192f,
+  slh_dsa_shake_256f
+});
 /*! Bundled license information:
 
 @noble/post-quantum/utils.js: