@corewire/core 0.0.0 → 1.0.0-next.1

package/dist/crypto-CXSIS6si.mjs

@@ -0,0 +1,3093 @@
+import { n as __exportAll } from "./chunk-wE0WeVzl.mjs";
+import { c as DecryptionError } from "./errors-DVv1n4fL.mjs";
+import { createCipheriv, createDecipheriv, hkdfSync } from "node:crypto";
+
+//#region src/crypto/aes.ts
+var aes_exports = /* @__PURE__ */ __exportAll({
+	decrypt: () => decrypt$1,
+	encrypt: () => encrypt$1
+});
+/**
+* AES-128-CTR fallback for legacy HAP pairing. It has no authentication tag; the pairing flow relies on Ed25519 signatures in the TLV payload.
+*
+* @param key - 16-byte AES key.
+* @param iv - 16-byte initialization vector.
+*/
+function encrypt$1(key, iv, plaintext) {
+	const cipher = createCipheriv("aes-128-ctr", key, iv);
+	return Buffer.concat([cipher.update(plaintext), cipher.final()]);
+}
+/**
+* Decrypts data using AES-128-CTR.
+*
+* @param key - 16-byte AES key.
+* @param iv - 16-byte initialization vector.
+*/
+function decrypt$1(key, iv, ciphertext) {
+	const decipher = createDecipheriv("aes-128-ctr", key, iv);
+	return Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+}
+
+//#endregion
+//#region ../../node_modules/.bun/@stablelib+int@2.0.1/node_modules/@stablelib/int/lib/int.js
+/**
+* Returns true if the argument is an integer number.
+*/
+const isInteger = Number.isInteger;
+/**
+*  Math.pow(2, 53) - 1
+*/
+const MAX_SAFE_INTEGER = Number.MAX_SAFE_INTEGER;
+/**
+* Returns true if the argument is a safe integer number
+* (-MIN_SAFE_INTEGER < number <= MAX_SAFE_INTEGER)
+*/
+const isSafeInteger = Number.isSafeInteger;
+
+//#endregion
+//#region ../../node_modules/.bun/@stablelib+binary@2.0.1/node_modules/@stablelib/binary/lib/binary.js
+/**
+* Reads 4 bytes from array starting at offset as big-endian
+* unsigned 32-bit integer and returns it.
+*/
+function readUint32BE(array, offset = 0) {
+	return (array[offset] << 24 | array[offset + 1] << 16 | array[offset + 2] << 8 | array[offset + 3]) >>> 0;
+}
+/**
+* Writes 4-byte big-endian representation of 32-bit unsigned
+* value to byte array starting at offset.
+*
+* If byte array is not given, creates a new 4-byte one.
+*
+* Returns the output byte array.
+*/
+function writeUint32BE(value, out = new Uint8Array(4), offset = 0) {
+	out[offset + 0] = value >>> 24;
+	out[offset + 1] = value >>> 16;
+	out[offset + 2] = value >>> 8;
+	out[offset + 3] = value >>> 0;
+	return out;
+}
+/**
+* Writes 4-byte little-endian representation of 32-bit unsigned
+* value to array starting at offset.
+*
+* If byte array is not given, creates a new 4-byte one.
+*
+* Returns the output byte array.
+*/
+function writeUint32LE(value, out = new Uint8Array(4), offset = 0) {
+	out[offset + 0] = value >>> 0;
+	out[offset + 1] = value >>> 8;
+	out[offset + 2] = value >>> 16;
+	out[offset + 3] = value >>> 24;
+	return out;
+}
+/**
+* Writes 8-byte little-endian representation of 64-bit unsigned
+* value to byte array starting at offset.
+*
+* Due to JavaScript limitation, supports values up to 2^53-1.
+*
+* If byte array is not given, creates a new 8-byte one.
+*
+* Returns the output byte array.
+*/
+function writeUint64LE(value, out = new Uint8Array(8), offset = 0) {
+	writeUint32LE(value >>> 0, out, offset);
+	writeUint32LE(value / 4294967296 >>> 0, out, offset + 4);
+	return out;
+}
+
+//#endregion
+//#region ../../node_modules/.bun/@stablelib+wipe@2.0.1/node_modules/@stablelib/wipe/lib/wipe.js
+/**
+* Sets all values in the given array to zero and returns it.
+*
+* The fact that it sets bytes to zero can be relied on.
+*
+* There is no guarantee that this function makes data disappear from memory,
+* as runtime implementation can, for example, have copying garbage collector
+* that will make copies of sensitive data before we wipe it. Or that an
+* operating system will write our data to swap or sleep image. Another thing
+* is that an optimizing compiler can remove calls to this function or make it
+* no-op. There's nothing we can do with it, so we just do our best and hope
+* that everything will be okay and good will triumph over evil.
+*/
+function wipe(array) {
+	for (let i = 0; i < array.length; i++) array[i] = 0;
+	return array;
+}
+
+//#endregion
+//#region ../../node_modules/.bun/@stablelib+chacha@2.0.1/node_modules/@stablelib/chacha/lib/chacha.js
+/**
+* Package chacha implements ChaCha stream cipher.
+*/
+const ROUNDS = 20;
+function core(out, input, key) {
+	let j0 = 1634760805;
+	let j1 = 857760878;
+	let j2 = 2036477234;
+	let j3 = 1797285236;
+	let j4 = key[3] << 24 | key[2] << 16 | key[1] << 8 | key[0];
+	let j5 = key[7] << 24 | key[6] << 16 | key[5] << 8 | key[4];
+	let j6 = key[11] << 24 | key[10] << 16 | key[9] << 8 | key[8];
+	let j7 = key[15] << 24 | key[14] << 16 | key[13] << 8 | key[12];
+	let j8 = key[19] << 24 | key[18] << 16 | key[17] << 8 | key[16];
+	let j9 = key[23] << 24 | key[22] << 16 | key[21] << 8 | key[20];
+	let j10 = key[27] << 24 | key[26] << 16 | key[25] << 8 | key[24];
+	let j11 = key[31] << 24 | key[30] << 16 | key[29] << 8 | key[28];
+	let j12 = input[3] << 24 | input[2] << 16 | input[1] << 8 | input[0];
+	let j13 = input[7] << 24 | input[6] << 16 | input[5] << 8 | input[4];
+	let j14 = input[11] << 24 | input[10] << 16 | input[9] << 8 | input[8];
+	let j15 = input[15] << 24 | input[14] << 16 | input[13] << 8 | input[12];
+	let x0 = j0;
+	let x1 = j1;
+	let x2 = j2;
+	let x3 = j3;
+	let x4 = j4;
+	let x5 = j5;
+	let x6 = j6;
+	let x7 = j7;
+	let x8 = j8;
+	let x9 = j9;
+	let x10 = j10;
+	let x11 = j11;
+	let x12 = j12;
+	let x13 = j13;
+	let x14 = j14;
+	let x15 = j15;
+	for (let i = 0; i < ROUNDS; i += 2) {
+		x0 = x0 + x4 | 0;
+		x12 ^= x0;
+		x12 = x12 >>> 16 | x12 << 16;
+		x8 = x8 + x12 | 0;
+		x4 ^= x8;
+		x4 = x4 >>> 20 | x4 << 12;
+		x1 = x1 + x5 | 0;
+		x13 ^= x1;
+		x13 = x13 >>> 16 | x13 << 16;
+		x9 = x9 + x13 | 0;
+		x5 ^= x9;
+		x5 = x5 >>> 20 | x5 << 12;
+		x2 = x2 + x6 | 0;
+		x14 ^= x2;
+		x14 = x14 >>> 16 | x14 << 16;
+		x10 = x10 + x14 | 0;
+		x6 ^= x10;
+		x6 = x6 >>> 20 | x6 << 12;
+		x3 = x3 + x7 | 0;
+		x15 ^= x3;
+		x15 = x15 >>> 16 | x15 << 16;
+		x11 = x11 + x15 | 0;
+		x7 ^= x11;
+		x7 = x7 >>> 20 | x7 << 12;
+		x2 = x2 + x6 | 0;
+		x14 ^= x2;
+		x14 = x14 >>> 24 | x14 << 8;
+		x10 = x10 + x14 | 0;
+		x6 ^= x10;
+		x6 = x6 >>> 25 | x6 << 7;
+		x3 = x3 + x7 | 0;
+		x15 ^= x3;
+		x15 = x15 >>> 24 | x15 << 8;
+		x11 = x11 + x15 | 0;
+		x7 ^= x11;
+		x7 = x7 >>> 25 | x7 << 7;
+		x1 = x1 + x5 | 0;
+		x13 ^= x1;
+		x13 = x13 >>> 24 | x13 << 8;
+		x9 = x9 + x13 | 0;
+		x5 ^= x9;
+		x5 = x5 >>> 25 | x5 << 7;
+		x0 = x0 + x4 | 0;
+		x12 ^= x0;
+		x12 = x12 >>> 24 | x12 << 8;
+		x8 = x8 + x12 | 0;
+		x4 ^= x8;
+		x4 = x4 >>> 25 | x4 << 7;
+		x0 = x0 + x5 | 0;
+		x15 ^= x0;
+		x15 = x15 >>> 16 | x15 << 16;
+		x10 = x10 + x15 | 0;
+		x5 ^= x10;
+		x5 = x5 >>> 20 | x5 << 12;
+		x1 = x1 + x6 | 0;
+		x12 ^= x1;
+		x12 = x12 >>> 16 | x12 << 16;
+		x11 = x11 + x12 | 0;
+		x6 ^= x11;
+		x6 = x6 >>> 20 | x6 << 12;
+		x2 = x2 + x7 | 0;
+		x13 ^= x2;
+		x13 = x13 >>> 16 | x13 << 16;
+		x8 = x8 + x13 | 0;
+		x7 ^= x8;
+		x7 = x7 >>> 20 | x7 << 12;
+		x3 = x3 + x4 | 0;
+		x14 ^= x3;
+		x14 = x14 >>> 16 | x14 << 16;
+		x9 = x9 + x14 | 0;
+		x4 ^= x9;
+		x4 = x4 >>> 20 | x4 << 12;
+		x2 = x2 + x7 | 0;
+		x13 ^= x2;
+		x13 = x13 >>> 24 | x13 << 8;
+		x8 = x8 + x13 | 0;
+		x7 ^= x8;
+		x7 = x7 >>> 25 | x7 << 7;
+		x3 = x3 + x4 | 0;
+		x14 ^= x3;
+		x14 = x14 >>> 24 | x14 << 8;
+		x9 = x9 + x14 | 0;
+		x4 ^= x9;
+		x4 = x4 >>> 25 | x4 << 7;
+		x1 = x1 + x6 | 0;
+		x12 ^= x1;
+		x12 = x12 >>> 24 | x12 << 8;
+		x11 = x11 + x12 | 0;
+		x6 ^= x11;
+		x6 = x6 >>> 25 | x6 << 7;
+		x0 = x0 + x5 | 0;
+		x15 ^= x0;
+		x15 = x15 >>> 24 | x15 << 8;
+		x10 = x10 + x15 | 0;
+		x5 ^= x10;
+		x5 = x5 >>> 25 | x5 << 7;
+	}
+	writeUint32LE(x0 + j0 | 0, out, 0);
+	writeUint32LE(x1 + j1 | 0, out, 4);
+	writeUint32LE(x2 + j2 | 0, out, 8);
+	writeUint32LE(x3 + j3 | 0, out, 12);
+	writeUint32LE(x4 + j4 | 0, out, 16);
+	writeUint32LE(x5 + j5 | 0, out, 20);
+	writeUint32LE(x6 + j6 | 0, out, 24);
+	writeUint32LE(x7 + j7 | 0, out, 28);
+	writeUint32LE(x8 + j8 | 0, out, 32);
+	writeUint32LE(x9 + j9 | 0, out, 36);
+	writeUint32LE(x10 + j10 | 0, out, 40);
+	writeUint32LE(x11 + j11 | 0, out, 44);
+	writeUint32LE(x12 + j12 | 0, out, 48);
+	writeUint32LE(x13 + j13 | 0, out, 52);
+	writeUint32LE(x14 + j14 | 0, out, 56);
+	writeUint32LE(x15 + j15 | 0, out, 60);
+}
+/**
+* Encrypt src with ChaCha20 stream generated for the given 32-byte key and
+* 8-byte (as in original implementation) or 12-byte (as in RFC7539) nonce and
+* write the result into dst and return it.
+*
+* dst and src may be the same, but otherwise must not overlap.
+*
+* If nonce is 12 bytes, users should not encrypt more than 256 GiB with the
+* same key and nonce, otherwise the stream will repeat. The function will
+* throw error if counter overflows to prevent this.
+*
+* If nonce is 8 bytes, the output is practically unlimited (2^70 bytes, which
+* is more than a million petabytes). However, it is not recommended to
+* generate 8-byte nonces randomly, as the chance of collision is high.
+*
+* Never use the same key and nonce to encrypt more than one message.
+*
+* If nonceInplaceCounterLength is not 0, the nonce is assumed to be a 16-byte
+* array with stream counter in first nonceInplaceCounterLength bytes and nonce
+* in the last remaining bytes. The counter will be incremented inplace for
+* each ChaCha block. This is useful if you need to encrypt one stream of data
+* in chunks.
+*/
+function streamXOR(key, nonce, src, dst, nonceInplaceCounterLength = 0) {
+	if (key.length !== 32) throw new Error("ChaCha: key size must be 32 bytes");
+	if (dst.length < src.length) throw new Error("ChaCha: destination is shorter than source");
+	let nc;
+	let counterLength;
+	if (nonceInplaceCounterLength === 0) {
+		if (nonce.length !== 8 && nonce.length !== 12) throw new Error("ChaCha nonce must be 8 or 12 bytes");
+		nc = new Uint8Array(16);
+		counterLength = nc.length - nonce.length;
+		nc.set(nonce, counterLength);
+	} else {
+		if (nonce.length !== 16) throw new Error("ChaCha nonce with counter must be 16 bytes");
+		nc = nonce;
+		counterLength = nonceInplaceCounterLength;
+	}
+	const block = new Uint8Array(64);
+	for (let i = 0; i < src.length; i += 64) {
+		core(block, nc, key);
+		for (let j = i; j < i + 64 && j < src.length; j++) dst[j] = src[j] ^ block[j - i];
+		incrementCounter(nc, 0, counterLength);
+	}
+	wipe(block);
+	if (nonceInplaceCounterLength === 0) wipe(nc);
+	return dst;
+}
+/**
+* Generate ChaCha20 stream for the given 32-byte key and 8-byte or 12-byte
+* nonce and write it into dst and return it.
+*
+* Never use the same key and nonce to generate more than one stream.
+*
+* If nonceInplaceCounterLength is not 0, it behaves the same with respect to
+* the nonce as described in the streamXOR documentation.
+*
+* stream is like streamXOR with all-zero src.
+*/
+function stream(key, nonce, dst, nonceInplaceCounterLength = 0) {
+	wipe(dst);
+	return streamXOR(key, nonce, dst, dst, nonceInplaceCounterLength);
+}
+function incrementCounter(counter, pos, len) {
+	let carry = 1;
+	while (len--) {
+		carry = carry + (counter[pos] & 255) | 0;
+		counter[pos] = carry & 255;
+		carry >>>= 8;
+		pos++;
+	}
+	if (carry > 0) throw new Error("ChaCha: counter overflow");
+}
+
+//#endregion
+//#region ../../node_modules/.bun/@stablelib+constant-time@2.0.1/node_modules/@stablelib/constant-time/lib/constant-time.js
+/**
+* Returns 1 if a and b are of equal length and their contents
+* are equal, or 0 otherwise.
+*
+* Note that unlike in equal(), zero-length inputs are considered
+* the same, so this function will return 1.
+*/
+function compare(a, b) {
+	if (a.length !== b.length) return 0;
+	let result = 0;
+	for (let i = 0; i < a.length; i++) result |= a[i] ^ b[i];
+	return 1 & result - 1 >>> 8;
+}
+/**
+* Returns true if a and b are of equal non-zero length,
+* and their contents are equal, or false otherwise.
+*
+* Note that unlike in compare() zero-length inputs are considered
+* _not_ equal, so this function will return false.
+*/
+function equal(a, b) {
+	if (a.length === 0 || b.length === 0) return false;
+	return compare(a, b) !== 0;
+}
+
+//#endregion
+//#region ../../node_modules/.bun/@stablelib+poly1305@2.0.1/node_modules/@stablelib/poly1305/lib/poly1305.js
+const DIGEST_LENGTH$1 = 16;
+/**
+* Poly1305 computes 16-byte authenticator of message using
+* a one-time 32-byte key.
+*
+* Important: key should be used for only one message,
+* it should never repeat.
+*/
+var Poly1305 = class {
+	digestLength = 16;
+	_buffer = new Uint8Array(16);
+	_r = new Uint16Array(10);
+	_h = new Uint16Array(10);
+	_pad = new Uint16Array(8);
+	_leftover = 0;
+	_fin = 0;
+	_finished = false;
+	constructor(key) {
+		let t0 = key[0] | key[1] << 8;
+		this._r[0] = t0 & 8191;
+		let t1 = key[2] | key[3] << 8;
+		this._r[1] = (t0 >>> 13 | t1 << 3) & 8191;
+		let t2 = key[4] | key[5] << 8;
+		this._r[2] = (t1 >>> 10 | t2 << 6) & 7939;
+		let t3 = key[6] | key[7] << 8;
+		this._r[3] = (t2 >>> 7 | t3 << 9) & 8191;
+		let t4 = key[8] | key[9] << 8;
+		this._r[4] = (t3 >>> 4 | t4 << 12) & 255;
+		this._r[5] = t4 >>> 1 & 8190;
+		let t5 = key[10] | key[11] << 8;
+		this._r[6] = (t4 >>> 14 | t5 << 2) & 8191;
+		let t6 = key[12] | key[13] << 8;
+		this._r[7] = (t5 >>> 11 | t6 << 5) & 8065;
+		let t7 = key[14] | key[15] << 8;
+		this._r[8] = (t6 >>> 8 | t7 << 8) & 8191;
+		this._r[9] = t7 >>> 5 & 127;
+		this._pad[0] = key[16] | key[17] << 8;
+		this._pad[1] = key[18] | key[19] << 8;
+		this._pad[2] = key[20] | key[21] << 8;
+		this._pad[3] = key[22] | key[23] << 8;
+		this._pad[4] = key[24] | key[25] << 8;
+		this._pad[5] = key[26] | key[27] << 8;
+		this._pad[6] = key[28] | key[29] << 8;
+		this._pad[7] = key[30] | key[31] << 8;
+	}
+	_blocks(m, mpos, bytes) {
+		let hibit = this._fin ? 0 : 2048;
+		let h0 = this._h[0], h1 = this._h[1], h2 = this._h[2], h3 = this._h[3], h4 = this._h[4], h5 = this._h[5], h6 = this._h[6], h7 = this._h[7], h8 = this._h[8], h9 = this._h[9];
+		let r0 = this._r[0], r1 = this._r[1], r2 = this._r[2], r3 = this._r[3], r4 = this._r[4], r5 = this._r[5], r6 = this._r[6], r7 = this._r[7], r8 = this._r[8], r9 = this._r[9];
+		while (bytes >= 16) {
+			let t0 = m[mpos + 0] | m[mpos + 1] << 8;
+			h0 += t0 & 8191;
+			let t1 = m[mpos + 2] | m[mpos + 3] << 8;
+			h1 += (t0 >>> 13 | t1 << 3) & 8191;
+			let t2 = m[mpos + 4] | m[mpos + 5] << 8;
+			h2 += (t1 >>> 10 | t2 << 6) & 8191;
+			let t3 = m[mpos + 6] | m[mpos + 7] << 8;
+			h3 += (t2 >>> 7 | t3 << 9) & 8191;
+			let t4 = m[mpos + 8] | m[mpos + 9] << 8;
+			h4 += (t3 >>> 4 | t4 << 12) & 8191;
+			h5 += t4 >>> 1 & 8191;
+			let t5 = m[mpos + 10] | m[mpos + 11] << 8;
+			h6 += (t4 >>> 14 | t5 << 2) & 8191;
+			let t6 = m[mpos + 12] | m[mpos + 13] << 8;
+			h7 += (t5 >>> 11 | t6 << 5) & 8191;
+			let t7 = m[mpos + 14] | m[mpos + 15] << 8;
+			h8 += (t6 >>> 8 | t7 << 8) & 8191;
+			h9 += t7 >>> 5 | hibit;
+			let c = 0;
+			let d0 = c;
+			d0 += h0 * r0;
+			d0 += h1 * (5 * r9);
+			d0 += h2 * (5 * r8);
+			d0 += h3 * (5 * r7);
+			d0 += h4 * (5 * r6);
+			c = d0 >>> 13;
+			d0 &= 8191;
+			d0 += h5 * (5 * r5);
+			d0 += h6 * (5 * r4);
+			d0 += h7 * (5 * r3);
+			d0 += h8 * (5 * r2);
+			d0 += h9 * (5 * r1);
+			c += d0 >>> 13;
+			d0 &= 8191;
+			let d1 = c;
+			d1 += h0 * r1;
+			d1 += h1 * r0;
+			d1 += h2 * (5 * r9);
+			d1 += h3 * (5 * r8);
+			d1 += h4 * (5 * r7);
+			c = d1 >>> 13;
+			d1 &= 8191;
+			d1 += h5 * (5 * r6);
+			d1 += h6 * (5 * r5);
+			d1 += h7 * (5 * r4);
+			d1 += h8 * (5 * r3);
+			d1 += h9 * (5 * r2);
+			c += d1 >>> 13;
+			d1 &= 8191;
+			let d2 = c;
+			d2 += h0 * r2;
+			d2 += h1 * r1;
+			d2 += h2 * r0;
+			d2 += h3 * (5 * r9);
+			d2 += h4 * (5 * r8);
+			c = d2 >>> 13;
+			d2 &= 8191;
+			d2 += h5 * (5 * r7);
+			d2 += h6 * (5 * r6);
+			d2 += h7 * (5 * r5);
+			d2 += h8 * (5 * r4);
+			d2 += h9 * (5 * r3);
+			c += d2 >>> 13;
+			d2 &= 8191;
+			let d3 = c;
+			d3 += h0 * r3;
+			d3 += h1 * r2;
+			d3 += h2 * r1;
+			d3 += h3 * r0;
+			d3 += h4 * (5 * r9);
+			c = d3 >>> 13;
+			d3 &= 8191;
+			d3 += h5 * (5 * r8);
+			d3 += h6 * (5 * r7);
+			d3 += h7 * (5 * r6);
+			d3 += h8 * (5 * r5);
+			d3 += h9 * (5 * r4);
+			c += d3 >>> 13;
+			d3 &= 8191;
+			let d4 = c;
+			d4 += h0 * r4;
+			d4 += h1 * r3;
+			d4 += h2 * r2;
+			d4 += h3 * r1;
+			d4 += h4 * r0;
+			c = d4 >>> 13;
+			d4 &= 8191;
+			d4 += h5 * (5 * r9);
+			d4 += h6 * (5 * r8);
+			d4 += h7 * (5 * r7);
+			d4 += h8 * (5 * r6);
+			d4 += h9 * (5 * r5);
+			c += d4 >>> 13;
+			d4 &= 8191;
+			let d5 = c;
+			d5 += h0 * r5;
+			d5 += h1 * r4;
+			d5 += h2 * r3;
+			d5 += h3 * r2;
+			d5 += h4 * r1;
+			c = d5 >>> 13;
+			d5 &= 8191;
+			d5 += h5 * r0;
+			d5 += h6 * (5 * r9);
+			d5 += h7 * (5 * r8);
+			d5 += h8 * (5 * r7);
+			d5 += h9 * (5 * r6);
+			c += d5 >>> 13;
+			d5 &= 8191;
+			let d6 = c;
+			d6 += h0 * r6;
+			d6 += h1 * r5;
+			d6 += h2 * r4;
+			d6 += h3 * r3;
+			d6 += h4 * r2;
+			c = d6 >>> 13;
+			d6 &= 8191;
+			d6 += h5 * r1;
+			d6 += h6 * r0;
+			d6 += h7 * (5 * r9);
+			d6 += h8 * (5 * r8);
+			d6 += h9 * (5 * r7);
+			c += d6 >>> 13;
+			d6 &= 8191;
+			let d7 = c;
+			d7 += h0 * r7;
+			d7 += h1 * r6;
+			d7 += h2 * r5;
+			d7 += h3 * r4;
+			d7 += h4 * r3;
+			c = d7 >>> 13;
+			d7 &= 8191;
+			d7 += h5 * r2;
+			d7 += h6 * r1;
+			d7 += h7 * r0;
+			d7 += h8 * (5 * r9);
+			d7 += h9 * (5 * r8);
+			c += d7 >>> 13;
+			d7 &= 8191;
+			let d8 = c;
+			d8 += h0 * r8;
+			d8 += h1 * r7;
+			d8 += h2 * r6;
+			d8 += h3 * r5;
+			d8 += h4 * r4;
+			c = d8 >>> 13;
+			d8 &= 8191;
+			d8 += h5 * r3;
+			d8 += h6 * r2;
+			d8 += h7 * r1;
+			d8 += h8 * r0;
+			d8 += h9 * (5 * r9);
+			c += d8 >>> 13;
+			d8 &= 8191;
+			let d9 = c;
+			d9 += h0 * r9;
+			d9 += h1 * r8;
+			d9 += h2 * r7;
+			d9 += h3 * r6;
+			d9 += h4 * r5;
+			c = d9 >>> 13;
+			d9 &= 8191;
+			d9 += h5 * r4;
+			d9 += h6 * r3;
+			d9 += h7 * r2;
+			d9 += h8 * r1;
+			d9 += h9 * r0;
+			c += d9 >>> 13;
+			d9 &= 8191;
+			c = (c << 2) + c | 0;
+			c = c + d0 | 0;
+			d0 = c & 8191;
+			c = c >>> 13;
+			d1 += c;
+			h0 = d0;
+			h1 = d1;
+			h2 = d2;
+			h3 = d3;
+			h4 = d4;
+			h5 = d5;
+			h6 = d6;
+			h7 = d7;
+			h8 = d8;
+			h9 = d9;
+			mpos += 16;
+			bytes -= 16;
+		}
+		this._h[0] = h0;
+		this._h[1] = h1;
+		this._h[2] = h2;
+		this._h[3] = h3;
+		this._h[4] = h4;
+		this._h[5] = h5;
+		this._h[6] = h6;
+		this._h[7] = h7;
+		this._h[8] = h8;
+		this._h[9] = h9;
+	}
+	finish(mac, macpos = 0) {
+		const g = new Uint16Array(10);
+		let c;
+		let mask;
+		let f;
+		let i;
+		if (this._leftover) {
+			i = this._leftover;
+			this._buffer[i++] = 1;
+			for (; i < 16; i++) this._buffer[i] = 0;
+			this._fin = 1;
+			this._blocks(this._buffer, 0, 16);
+		}
+		c = this._h[1] >>> 13;
+		this._h[1] &= 8191;
+		for (i = 2; i < 10; i++) {
+			this._h[i] += c;
+			c = this._h[i] >>> 13;
+			this._h[i] &= 8191;
+		}
+		this._h[0] += c * 5;
+		c = this._h[0] >>> 13;
+		this._h[0] &= 8191;
+		this._h[1] += c;
+		c = this._h[1] >>> 13;
+		this._h[1] &= 8191;
+		this._h[2] += c;
+		g[0] = this._h[0] + 5;
+		c = g[0] >>> 13;
+		g[0] &= 8191;
+		for (i = 1; i < 10; i++) {
+			g[i] = this._h[i] + c;
+			c = g[i] >>> 13;
+			g[i] &= 8191;
+		}
+		g[9] -= 8192;
+		mask = (c ^ 1) - 1;
+		for (i = 0; i < 10; i++) g[i] &= mask;
+		mask = ~mask;
+		for (i = 0; i < 10; i++) this._h[i] = this._h[i] & mask | g[i];
+		this._h[0] = (this._h[0] | this._h[1] << 13) & 65535;
+		this._h[1] = (this._h[1] >>> 3 | this._h[2] << 10) & 65535;
+		this._h[2] = (this._h[2] >>> 6 | this._h[3] << 7) & 65535;
+		this._h[3] = (this._h[3] >>> 9 | this._h[4] << 4) & 65535;
+		this._h[4] = (this._h[4] >>> 12 | this._h[5] << 1 | this._h[6] << 14) & 65535;
+		this._h[5] = (this._h[6] >>> 2 | this._h[7] << 11) & 65535;
+		this._h[6] = (this._h[7] >>> 5 | this._h[8] << 8) & 65535;
+		this._h[7] = (this._h[8] >>> 8 | this._h[9] << 5) & 65535;
+		f = this._h[0] + this._pad[0];
+		this._h[0] = f & 65535;
+		for (i = 1; i < 8; i++) {
+			f = (this._h[i] + this._pad[i] | 0) + (f >>> 16) | 0;
+			this._h[i] = f & 65535;
+		}
+		mac[macpos + 0] = this._h[0] >>> 0;
+		mac[macpos + 1] = this._h[0] >>> 8;
+		mac[macpos + 2] = this._h[1] >>> 0;
+		mac[macpos + 3] = this._h[1] >>> 8;
+		mac[macpos + 4] = this._h[2] >>> 0;
+		mac[macpos + 5] = this._h[2] >>> 8;
+		mac[macpos + 6] = this._h[3] >>> 0;
+		mac[macpos + 7] = this._h[3] >>> 8;
+		mac[macpos + 8] = this._h[4] >>> 0;
+		mac[macpos + 9] = this._h[4] >>> 8;
+		mac[macpos + 10] = this._h[5] >>> 0;
+		mac[macpos + 11] = this._h[5] >>> 8;
+		mac[macpos + 12] = this._h[6] >>> 0;
+		mac[macpos + 13] = this._h[6] >>> 8;
+		mac[macpos + 14] = this._h[7] >>> 0;
+		mac[macpos + 15] = this._h[7] >>> 8;
+		this._finished = true;
+		return this;
+	}
+	update(m) {
+		let mpos = 0;
+		let bytes = m.length;
+		let want;
+		if (this._leftover) {
+			want = 16 - this._leftover;
+			if (want > bytes) want = bytes;
+			for (let i = 0; i < want; i++) this._buffer[this._leftover + i] = m[mpos + i];
+			bytes -= want;
+			mpos += want;
+			this._leftover += want;
+			if (this._leftover < 16) return this;
+			this._blocks(this._buffer, 0, 16);
+			this._leftover = 0;
+		}
+		if (bytes >= 16) {
+			want = bytes - bytes % 16;
+			this._blocks(m, mpos, want);
+			mpos += want;
+			bytes -= want;
+		}
+		if (bytes) {
+			for (let i = 0; i < bytes; i++) this._buffer[this._leftover + i] = m[mpos + i];
+			this._leftover += bytes;
+		}
+		return this;
+	}
+	digest() {
+		if (this._finished) throw new Error("Poly1305 was finished");
+		let mac = new Uint8Array(16);
+		this.finish(mac);
+		return mac;
+	}
+	clean() {
+		wipe(this._buffer);
+		wipe(this._r);
+		wipe(this._h);
+		wipe(this._pad);
+		this._leftover = 0;
+		this._fin = 0;
+		this._finished = true;
+		return this;
+	}
+};
+
+//#endregion
+//#region ../../node_modules/.bun/@stablelib+chacha20poly1305@2.0.1/node_modules/@stablelib/chacha20poly1305/lib/chacha20poly1305.js
+const KEY_LENGTH = 32;
+const NONCE_LENGTH = 12;
+const TAG_LENGTH = 16;
+const ZEROS = new Uint8Array(16);
+/**
+* ChaCha20-Poly1305 Authenticated Encryption with Associated Data.
+*
+* Defined in RFC7539.
+*/
+var ChaCha20Poly1305 = class {
+	nonceLength = 12;
+	tagLength = 16;
+	_key;
+	/**
+	* Creates a new instance with the given 32-byte key.
+	*/
+	constructor(key) {
+		if (key.length !== 32) throw new Error("ChaCha20Poly1305 needs 32-byte key");
+		this._key = new Uint8Array(key);
+	}
+	/**
+	* Encrypts and authenticates plaintext, authenticates associated data,
+	* and returns sealed ciphertext, which includes authentication tag.
+	*
+	* RFC7539 specifies 12 bytes for nonce. It may be this 12-byte nonce
+	* ("IV"), or full 16-byte counter (called "32-bit fixed-common part")
+	* and nonce.
+	*
+	* If dst is given (it must be the size of plaintext + the size of tag
+	* length) the result will be put into it. Dst and plaintext must not
+	* overlap.
+	*/
+	seal(nonce, plaintext, associatedData, dst) {
+		if (nonce.length > 16) throw new Error("ChaCha20Poly1305: incorrect nonce length");
+		const counter = new Uint8Array(16);
+		counter.set(nonce, counter.length - nonce.length);
+		const authKey = new Uint8Array(32);
+		stream(this._key, counter, authKey, 4);
+		const resultLength = plaintext.length + this.tagLength;
+		let result;
+		if (dst) {
+			if (dst.length !== resultLength) throw new Error("ChaCha20Poly1305: incorrect destination length");
+			result = dst;
+		} else result = new Uint8Array(resultLength);
+		streamXOR(this._key, counter, plaintext, result, 4);
+		this._authenticate(result.subarray(result.length - this.tagLength, result.length), authKey, result.subarray(0, result.length - this.tagLength), associatedData);
+		wipe(counter);
+		return result;
+	}
+	/**
+	* Authenticates sealed ciphertext (which includes authentication tag) and
+	* associated data, decrypts ciphertext and returns decrypted plaintext.
+	*
+	* RFC7539 specifies 12 bytes for nonce. It may be this 12-byte nonce
+	* ("IV"), or full 16-byte counter (called "32-bit fixed-common part")
+	* and nonce.
+	*
+	* If authentication fails, it returns null.
+	*
+	* If dst is given (it must be of ciphertext length minus tag length),
+	* the result will be put into it. Dst and plaintext must not overlap.
+	*/
+	open(nonce, sealed, associatedData, dst) {
+		if (nonce.length > 16) throw new Error("ChaCha20Poly1305: incorrect nonce length");
+		if (sealed.length < this.tagLength) return null;
+		const counter = new Uint8Array(16);
+		counter.set(nonce, counter.length - nonce.length);
+		const authKey = new Uint8Array(32);
+		stream(this._key, counter, authKey, 4);
+		const calculatedTag = new Uint8Array(this.tagLength);
+		this._authenticate(calculatedTag, authKey, sealed.subarray(0, sealed.length - this.tagLength), associatedData);
+		if (!equal(calculatedTag, sealed.subarray(sealed.length - this.tagLength, sealed.length))) return null;
+		const resultLength = sealed.length - this.tagLength;
+		let result;
+		if (dst) {
+			if (dst.length !== resultLength) throw new Error("ChaCha20Poly1305: incorrect destination length");
+			result = dst;
+		} else result = new Uint8Array(resultLength);
+		streamXOR(this._key, counter, sealed.subarray(0, sealed.length - this.tagLength), result, 4);
+		wipe(counter);
+		return result;
+	}
+	clean() {
+		wipe(this._key);
+		return this;
+	}
+	_authenticate(tagOut, authKey, ciphertext, associatedData) {
+		const h = new Poly1305(authKey);
+		if (associatedData) {
+			h.update(associatedData);
+			if (associatedData.length % 16 > 0) h.update(ZEROS.subarray(associatedData.length % 16));
+		}
+		h.update(ciphertext);
+		if (ciphertext.length % 16 > 0) h.update(ZEROS.subarray(ciphertext.length % 16));
+		const length = new Uint8Array(8);
+		if (associatedData) writeUint64LE(associatedData.length, length);
+		h.update(length);
+		writeUint64LE(ciphertext.length, length);
+		h.update(length);
+		const tag = h.digest();
+		for (let i = 0; i < tag.length; i++) tagOut[i] = tag[i];
+		h.clean();
+		wipe(tag);
+		wipe(length);
+	}
+};
+
+//#endregion
+//#region src/crypto/chacha20.ts
+var chacha20_exports = /* @__PURE__ */ __exportAll({
+	CHACHA20_AUTH_TAG_LENGTH: () => 16,
+	CHACHA20_NONCE_LENGTH: () => 12,
+	decrypt: () => decrypt,
+	encrypt: () => encrypt,
+	padNonce: () => padNonce
+});
+/** Length in bytes of the Poly1305 authentication tag appended to ciphertext. */
+const CHACHA20_AUTH_TAG_LENGTH = 16;
+/** Required nonce length in bytes for ChaCha20-Poly1305. Shorter nonces are zero-padded. */
+const CHACHA20_NONCE_LENGTH = 12;
+/**
+* Decrypts a ChaCha20-Poly1305 sealed message and verifies its authentication tag.
+*
+* @param key - 256-bit encryption key.
+* @param nonce - Nonce (up to 12 bytes; shorter nonces are left-padded with zeros).
+* @param aad - Additional authenticated data, or null if none.
+* @param ciphertext - The encrypted payload (without the auth tag).
+* @param authTag - The 16-byte Poly1305 authentication tag.
+* @throws DecryptionError if the authentication tag does not match.
+*/
+function decrypt(key, nonce, aad, ciphertext, authTag) {
+	nonce = padNonce(nonce);
+	const chacha = new ChaCha20Poly1305(key);
+	const sealed = Buffer.concat([ciphertext, authTag]);
+	const plaintext = chacha.open(nonce, sealed, aad ?? void 0);
+	if (!plaintext) throw new DecryptionError();
+	return Buffer.from(plaintext);
+}
+/**
+* Encrypts a plaintext message using ChaCha20-Poly1305 authenticated encryption.
+*
+* @param key - 256-bit encryption key.
+* @param nonce - Nonce (up to 12 bytes; shorter nonces are left-padded with zeros).
+* @param aad - Additional authenticated data, or null if none.
+* @returns The ciphertext and its Poly1305 authentication tag.
+*/
+function encrypt(key, nonce, aad, plaintext) {
+	nonce = padNonce(nonce);
+	const sealed = new ChaCha20Poly1305(key).seal(nonce, plaintext, aad ?? void 0);
+	return {
+		ciphertext: Buffer.from(sealed.subarray(0, sealed.length - 16)),
+		authTag: Buffer.from(sealed.subarray(sealed.length - 16))
+	};
+}
+/** Left-pads a nonce with zero bytes to 12 bytes. A nonce of 12 bytes or more comes back unchanged. */
+function padNonce(nonce) {
+	if (nonce.length >= 12) return nonce;
+	return Buffer.concat([Buffer.alloc(12 - nonce.length, 0), nonce]);
+}
+
+//#endregion
+//#region ../../node_modules/.bun/@stablelib+random@2.0.1/node_modules/@stablelib/random/lib/source/system.js
+const QUOTA = 65536;
+var SystemRandomSource = class {
+	isAvailable = false;
+	isInstantiated = false;
+	constructor() {
+		if (typeof crypto !== "undefined" && "getRandomValues" in crypto) {
+			this.isAvailable = true;
+			this.isInstantiated = true;
+		}
+	}
+	randomBytes(length) {
+		if (!this.isAvailable) throw new Error("System random byte generator is not available.");
+		const out = new Uint8Array(length);
+		for (let i = 0; i < out.length; i += QUOTA) crypto.getRandomValues(out.subarray(i, i + Math.min(out.length - i, QUOTA)));
+		return out;
+	}
+};
+
+//#endregion
+//#region ../../node_modules/.bun/@stablelib+random@2.0.1/node_modules/@stablelib/random/lib/random.js
+const defaultRandomSource = new SystemRandomSource();
+function randomBytes$1(length, prng = defaultRandomSource) {
+	return prng.randomBytes(length);
+}
+
+//#endregion
+//#region ../../node_modules/.bun/@stablelib+x25519@2.0.1/node_modules/@stablelib/x25519/lib/x25519.js
+const PUBLIC_KEY_LENGTH$1 = 32;
+const SECRET_KEY_LENGTH$1 = 32;
+function gf$1(init) {
+	const r = new Float64Array(16);
+	if (init) for (let i = 0; i < init.length; i++) r[i] = init[i];
+	return r;
+}
+const _9$1 = new Uint8Array(32);
+_9$1[0] = 9;
+const _121665 = gf$1([56129, 1]);
+function car25519$1(o) {
+	let c = 1;
+	for (let i = 0; i < 16; i++) {
+		let v = o[i] + c + 65535;
+		c = Math.floor(v / 65536);
+		o[i] = v - c * 65536;
+	}
+	o[0] += c - 1 + 37 * (c - 1);
+}
+function sel25519$1(p, q, b) {
+	const c = ~(b - 1);
+	for (let i = 0; i < 16; i++) {
+		const t = c & (p[i] ^ q[i]);
+		p[i] ^= t;
+		q[i] ^= t;
+	}
+}
+function pack25519$1(o, n) {
+	const m = gf$1();
+	const t = gf$1();
+	for (let i = 0; i < 16; i++) t[i] = n[i];
+	car25519$1(t);
+	car25519$1(t);
+	car25519$1(t);
+	for (let j = 0; j < 2; j++) {
+		m[0] = t[0] - 65517;
+		for (let i = 1; i < 15; i++) {
+			m[i] = t[i] - 65535 - (m[i - 1] >> 16 & 1);
+			m[i - 1] &= 65535;
+		}
+		m[15] = t[15] - 32767 - (m[14] >> 16 & 1);
+		const b = m[15] >> 16 & 1;
+		m[14] &= 65535;
+		sel25519$1(t, m, 1 - b);
+	}
+	for (let i = 0; i < 16; i++) {
+		o[2 * i] = t[i] & 255;
+		o[2 * i + 1] = t[i] >> 8;
+	}
+}
+function unpack25519$1(o, n) {
+	for (let i = 0; i < 16; i++) o[i] = n[2 * i] + (n[2 * i + 1] << 8);
+	o[15] &= 32767;
+}
+function add$1(o, a, b) {
+	for (let i = 0; i < 16; i++) o[i] = a[i] + b[i];
+}
+function sub$1(o, a, b) {
+	for (let i = 0; i < 16; i++) o[i] = a[i] - b[i];
+}
+function mul$1(o, a, b) {
+	let v, c, t0 = 0, t1 = 0, t2 = 0, t3 = 0, t4 = 0, t5 = 0, t6 = 0, t7 = 0, t8 = 0, t9 = 0, t10 = 0, t11 = 0, t12 = 0, t13 = 0, t14 = 0, t15 = 0, t16 = 0, t17 = 0, t18 = 0, t19 = 0, t20 = 0, t21 = 0, t22 = 0, t23 = 0, t24 = 0, t25 = 0, t26 = 0, t27 = 0, t28 = 0, t29 = 0, t30 = 0, b0 = b[0], b1 = b[1], b2 = b[2], b3 = b[3], b4 = b[4], b5 = b[5], b6 = b[6], b7 = b[7], b8 = b[8], b9 = b[9], b10 = b[10], b11 = b[11], b12 = b[12], b13 = b[13], b14 = b[14], b15 = b[15];
+	v = a[0];
+	t0 += v * b0;
+	t1 += v * b1;
+	t2 += v * b2;
+	t3 += v * b3;
+	t4 += v * b4;
+	t5 += v * b5;
+	t6 += v * b6;
+	t7 += v * b7;
+	t8 += v * b8;
+	t9 += v * b9;
+	t10 += v * b10;
+	t11 += v * b11;
+	t12 += v * b12;
+	t13 += v * b13;
+	t14 += v * b14;
+	t15 += v * b15;
+	v = a[1];
+	t1 += v * b0;
+	t2 += v * b1;
+	t3 += v * b2;
+	t4 += v * b3;
+	t5 += v * b4;
+	t6 += v * b5;
+	t7 += v * b6;
+	t8 += v * b7;
+	t9 += v * b8;
+	t10 += v * b9;
+	t11 += v * b10;
+	t12 += v * b11;
+	t13 += v * b12;
+	t14 += v * b13;
+	t15 += v * b14;
+	t16 += v * b15;
+	v = a[2];
+	t2 += v * b0;
+	t3 += v * b1;
+	t4 += v * b2;
+	t5 += v * b3;
+	t6 += v * b4;
+	t7 += v * b5;
+	t8 += v * b6;
+	t9 += v * b7;
+	t10 += v * b8;
+	t11 += v * b9;
+	t12 += v * b10;
+	t13 += v * b11;
+	t14 += v * b12;
+	t15 += v * b13;
+	t16 += v * b14;
+	t17 += v * b15;
+	v = a[3];
+	t3 += v * b0;
+	t4 += v * b1;
+	t5 += v * b2;
+	t6 += v * b3;
+	t7 += v * b4;
+	t8 += v * b5;
+	t9 += v * b6;
+	t10 += v * b7;
+	t11 += v * b8;
+	t12 += v * b9;
+	t13 += v * b10;
+	t14 += v * b11;
+	t15 += v * b12;
+	t16 += v * b13;
+	t17 += v * b14;
+	t18 += v * b15;
+	v = a[4];
+	t4 += v * b0;
+	t5 += v * b1;
+	t6 += v * b2;
+	t7 += v * b3;
+	t8 += v * b4;
+	t9 += v * b5;
+	t10 += v * b6;
+	t11 += v * b7;
+	t12 += v * b8;
+	t13 += v * b9;
+	t14 += v * b10;
+	t15 += v * b11;
+	t16 += v * b12;
+	t17 += v * b13;
+	t18 += v * b14;
+	t19 += v * b15;
+	v = a[5];
+	t5 += v * b0;
+	t6 += v * b1;
+	t7 += v * b2;
+	t8 += v * b3;
+	t9 += v * b4;
+	t10 += v * b5;
+	t11 += v * b6;
+	t12 += v * b7;
+	t13 += v * b8;
+	t14 += v * b9;
+	t15 += v * b10;
+	t16 += v * b11;
+	t17 += v * b12;
+	t18 += v * b13;
+	t19 += v * b14;
+	t20 += v * b15;
+	v = a[6];
+	t6 += v * b0;
+	t7 += v * b1;
+	t8 += v * b2;
+	t9 += v * b3;
+	t10 += v * b4;
+	t11 += v * b5;
+	t12 += v * b6;
+	t13 += v * b7;
+	t14 += v * b8;
+	t15 += v * b9;
+	t16 += v * b10;
+	t17 += v * b11;
+	t18 += v * b12;
+	t19 += v * b13;
+	t20 += v * b14;
+	t21 += v * b15;
+	v = a[7];
+	t7 += v * b0;
+	t8 += v * b1;
+	t9 += v * b2;
+	t10 += v * b3;
+	t11 += v * b4;
+	t12 += v * b5;
+	t13 += v * b6;
+	t14 += v * b7;
+	t15 += v * b8;
+	t16 += v * b9;
+	t17 += v * b10;
+	t18 += v * b11;
+	t19 += v * b12;
+	t20 += v * b13;
+	t21 += v * b14;
+	t22 += v * b15;
+	v = a[8];
+	t8 += v * b0;
+	t9 += v * b1;
+	t10 += v * b2;
+	t11 += v * b3;
+	t12 += v * b4;
+	t13 += v * b5;
+	t14 += v * b6;
+	t15 += v * b7;
+	t16 += v * b8;
+	t17 += v * b9;
+	t18 += v * b10;
+	t19 += v * b11;
+	t20 += v * b12;
+	t21 += v * b13;
+	t22 += v * b14;
+	t23 += v * b15;
+	v = a[9];
+	t9 += v * b0;
+	t10 += v * b1;
+	t11 += v * b2;
+	t12 += v * b3;
+	t13 += v * b4;
+	t14 += v * b5;
+	t15 += v * b6;
+	t16 += v * b7;
+	t17 += v * b8;
+	t18 += v * b9;
+	t19 += v * b10;
+	t20 += v * b11;
+	t21 += v * b12;
+	t22 += v * b13;
+	t23 += v * b14;
+	t24 += v * b15;
+	v = a[10];
+	t10 += v * b0;
+	t11 += v * b1;
+	t12 += v * b2;
+	t13 += v * b3;
+	t14 += v * b4;
+	t15 += v * b5;
+	t16 += v * b6;
+	t17 += v * b7;
+	t18 += v * b8;
+	t19 += v * b9;
+	t20 += v * b10;
+	t21 += v * b11;
+	t22 += v * b12;
+	t23 += v * b13;
+	t24 += v * b14;
+	t25 += v * b15;
+	v = a[11];
+	t11 += v * b0;
+	t12 += v * b1;
+	t13 += v * b2;
+	t14 += v * b3;
+	t15 += v * b4;
+	t16 += v * b5;
+	t17 += v * b6;
+	t18 += v * b7;
+	t19 += v * b8;
+	t20 += v * b9;
+	t21 += v * b10;
+	t22 += v * b11;
+	t23 += v * b12;
+	t24 += v * b13;
+	t25 += v * b14;
+	t26 += v * b15;
+	v = a[12];
+	t12 += v * b0;
+	t13 += v * b1;
+	t14 += v * b2;
+	t15 += v * b3;
+	t16 += v * b4;
+	t17 += v * b5;
+	t18 += v * b6;
+	t19 += v * b7;
+	t20 += v * b8;
+	t21 += v * b9;
+	t22 += v * b10;
+	t23 += v * b11;
+	t24 += v * b12;
+	t25 += v * b13;
+	t26 += v * b14;
+	t27 += v * b15;
+	v = a[13];
+	t13 += v * b0;
+	t14 += v * b1;
+	t15 += v * b2;
+	t16 += v * b3;
+	t17 += v * b4;
+	t18 += v * b5;
+	t19 += v * b6;
+	t20 += v * b7;
+	t21 += v * b8;
+	t22 += v * b9;
+	t23 += v * b10;
+	t24 += v * b11;
+	t25 += v * b12;
+	t26 += v * b13;
+	t27 += v * b14;
+	t28 += v * b15;
+	v = a[14];
+	t14 += v * b0;
+	t15 += v * b1;
+	t16 += v * b2;
+	t17 += v * b3;
+	t18 += v * b4;
+	t19 += v * b5;
+	t20 += v * b6;
+	t21 += v * b7;
+	t22 += v * b8;
+	t23 += v * b9;
+	t24 += v * b10;
+	t25 += v * b11;
+	t26 += v * b12;
+	t27 += v * b13;
+	t28 += v * b14;
+	t29 += v * b15;
+	v = a[15];
+	t15 += v * b0;
+	t16 += v * b1;
+	t17 += v * b2;
+	t18 += v * b3;
+	t19 += v * b4;
+	t20 += v * b5;
+	t21 += v * b6;
+	t22 += v * b7;
+	t23 += v * b8;
+	t24 += v * b9;
+	t25 += v * b10;
+	t26 += v * b11;
+	t27 += v * b12;
+	t28 += v * b13;
+	t29 += v * b14;
+	t30 += v * b15;
+	t0 += 38 * t16;
+	t1 += 38 * t17;
+	t2 += 38 * t18;
+	t3 += 38 * t19;
+	t4 += 38 * t20;
+	t5 += 38 * t21;
+	t6 += 38 * t22;
+	t7 += 38 * t23;
+	t8 += 38 * t24;
+	t9 += 38 * t25;
+	t10 += 38 * t26;
+	t11 += 38 * t27;
+	t12 += 38 * t28;
+	t13 += 38 * t29;
+	t14 += 38 * t30;
+	c = 1;
+	v = t0 + c + 65535;
+	c = Math.floor(v / 65536);
+	t0 = v - c * 65536;
+	v = t1 + c + 65535;
+	c = Math.floor(v / 65536);
+	t1 = v - c * 65536;
+	v = t2 + c + 65535;
+	c = Math.floor(v / 65536);
+	t2 = v - c * 65536;
+	v = t3 + c + 65535;
+	c = Math.floor(v / 65536);
+	t3 = v - c * 65536;
+	v = t4 + c + 65535;
+	c = Math.floor(v / 65536);
+	t4 = v - c * 65536;
+	v = t5 + c + 65535;
+	c = Math.floor(v / 65536);
+	t5 = v - c * 65536;
+	v = t6 + c + 65535;
+	c = Math.floor(v / 65536);
+	t6 = v - c * 65536;
+	v = t7 + c + 65535;
+	c = Math.floor(v / 65536);
+	t7 = v - c * 65536;
+	v = t8 + c + 65535;
+	c = Math.floor(v / 65536);
+	t8 = v - c * 65536;
+	v = t9 + c + 65535;
+	c = Math.floor(v / 65536);
+	t9 = v - c * 65536;
+	v = t10 + c + 65535;
+	c = Math.floor(v / 65536);
+	t10 = v - c * 65536;
+	v = t11 + c + 65535;
+	c = Math.floor(v / 65536);
+	t11 = v - c * 65536;
+	v = t12 + c + 65535;
+	c = Math.floor(v / 65536);
+	t12 = v - c * 65536;
+	v = t13 + c + 65535;
+	c = Math.floor(v / 65536);
+	t13 = v - c * 65536;
+	v = t14 + c + 65535;
+	c = Math.floor(v / 65536);
+	t14 = v - c * 65536;
+	v = t15 + c + 65535;
+	c = Math.floor(v / 65536);
+	t15 = v - c * 65536;
+	t0 += c - 1 + 37 * (c - 1);
+	c = 1;
+	v = t0 + c + 65535;
+	c = Math.floor(v / 65536);
+	t0 = v - c * 65536;
+	v = t1 + c + 65535;
+	c = Math.floor(v / 65536);
+	t1 = v - c * 65536;
+	v = t2 + c + 65535;
+	c = Math.floor(v / 65536);
+	t2 = v - c * 65536;
+	v = t3 + c + 65535;
+	c = Math.floor(v / 65536);
+	t3 = v - c * 65536;
+	v = t4 + c + 65535;
+	c = Math.floor(v / 65536);
+	t4 = v - c * 65536;
+	v = t5 + c + 65535;
+	c = Math.floor(v / 65536);
+	t5 = v - c * 65536;
+	v = t6 + c + 65535;
+	c = Math.floor(v / 65536);
+	t6 = v - c * 65536;
+	v = t7 + c + 65535;
+	c = Math.floor(v / 65536);
+	t7 = v - c * 65536;
+	v = t8 + c + 65535;
+	c = Math.floor(v / 65536);
+	t8 = v - c * 65536;
+	v = t9 + c + 65535;
+	c = Math.floor(v / 65536);
+	t9 = v - c * 65536;
+	v = t10 + c + 65535;
+	c = Math.floor(v / 65536);
+	t10 = v - c * 65536;
+	v = t11 + c + 65535;
+	c = Math.floor(v / 65536);
+	t11 = v - c * 65536;
+	v = t12 + c + 65535;
+	c = Math.floor(v / 65536);
+	t12 = v - c * 65536;
+	v = t13 + c + 65535;
+	c = Math.floor(v / 65536);
+	t13 = v - c * 65536;
+	v = t14 + c + 65535;
+	c = Math.floor(v / 65536);
+	t14 = v - c * 65536;
+	v = t15 + c + 65535;
+	c = Math.floor(v / 65536);
+	t15 = v - c * 65536;
+	t0 += c - 1 + 37 * (c - 1);
+	o[0] = t0;
+	o[1] = t1;
+	o[2] = t2;
+	o[3] = t3;
+	o[4] = t4;
+	o[5] = t5;
+	o[6] = t6;
+	o[7] = t7;
+	o[8] = t8;
+	o[9] = t9;
+	o[10] = t10;
+	o[11] = t11;
+	o[12] = t12;
+	o[13] = t13;
+	o[14] = t14;
+	o[15] = t15;
+}
+function square$1(o, a) {
+	mul$1(o, a, a);
+}
+function inv25519$1(o, inp) {
+	const c = gf$1();
+	for (let i = 0; i < 16; i++) c[i] = inp[i];
+	for (let i = 253; i >= 0; i--) {
+		square$1(c, c);
+		if (i !== 2 && i !== 4) mul$1(c, c, inp);
+	}
+	for (let i = 0; i < 16; i++) o[i] = c[i];
+}
+function scalarMult(n, p) {
+	const z = new Uint8Array(32);
+	const x = new Float64Array(80);
+	const a = gf$1(), b = gf$1(), c = gf$1(), d = gf$1(), e = gf$1(), f = gf$1();
+	for (let i = 0; i < 31; i++) z[i] = n[i];
+	z[31] = n[31] & 127 | 64;
+	z[0] &= 248;
+	unpack25519$1(x, p);
+	for (let i = 0; i < 16; i++) b[i] = x[i];
+	a[0] = d[0] = 1;
+	for (let i = 254; i >= 0; --i) {
+		const r = z[i >>> 3] >>> (i & 7) & 1;
+		sel25519$1(a, b, r);
+		sel25519$1(c, d, r);
+		add$1(e, a, c);
+		sub$1(a, a, c);
+		add$1(c, b, d);
+		sub$1(b, b, d);
+		square$1(d, e);
+		square$1(f, a);
+		mul$1(a, c, a);
+		mul$1(c, b, e);
+		add$1(e, a, c);
+		sub$1(a, a, c);
+		square$1(b, a);
+		sub$1(c, d, f);
+		mul$1(a, c, _121665);
+		add$1(a, a, d);
+		mul$1(c, c, a);
+		mul$1(a, d, f);
+		mul$1(d, b, x);
+		square$1(b, e);
+		sel25519$1(a, b, r);
+		sel25519$1(c, d, r);
+	}
+	for (let i = 0; i < 16; i++) {
+		x[i + 16] = a[i];
+		x[i + 32] = c[i];
+		x[i + 48] = b[i];
+		x[i + 64] = d[i];
+	}
+	const x32 = x.subarray(32);
+	const x16 = x.subarray(16);
+	inv25519$1(x32, x32);
+	mul$1(x16, x16, x32);
+	const q = new Uint8Array(32);
+	pack25519$1(q, x16);
+	return q;
+}
+function scalarMultBase(n) {
+	return scalarMult(n, _9$1);
+}
+function generateKeyPairFromSeed$1(seed) {
+	if (seed.length !== 32) throw new Error(`x25519: seed must be ${32} bytes`);
+	const secretKey = new Uint8Array(seed);
+	return {
+		publicKey: scalarMultBase(secretKey),
+		secretKey
+	};
+}
+function generateKeyPair$3(prng) {
+	const seed = randomBytes$1(32, prng);
+	const result = generateKeyPairFromSeed$1(seed);
+	wipe(seed);
+	return result;
+}
+/**
+* Returns a shared key between our secret key and a peer's public key.
+*
+* Throws an error if the given keys are of wrong length.
+*
+* If rejectZero is true throws if the calculated shared key is all-zero.
+* From RFC 7748:
+*
+* > Protocol designers using Diffie-Hellman over the curves defined in
+* > this document must not assume "contributory behavior".  Specially,
+* > contributory behavior means that both parties' private keys
+* > contribute to the resulting shared key.  Since curve25519 and
+* > curve448 have cofactors of 8 and 4 (respectively), an input point of
+* > small order will eliminate any contribution from the other party's
+* > private key.  This situation can be detected by checking for the all-
+* > zero output, which implementations MAY do, as specified in Section 6.
+* > However, a large number of existing implementations do not do this.
+*
+* IMPORTANT: the returned key is a raw result of scalar multiplication.
+* To use it as a key material, hash it with a cryptographic hash function.
+*/
+function sharedKey(mySecretKey, theirPublicKey, rejectZero = false) {
+	if (mySecretKey.length !== 32) throw new Error("X25519: incorrect secret key length");
+	if (theirPublicKey.length !== 32) throw new Error("X25519: incorrect public key length");
+	const result = scalarMult(mySecretKey, theirPublicKey);
+	if (rejectZero) {
+		let zeros = 0;
+		for (let i = 0; i < result.length; i++) zeros |= result[i];
+		if (zeros === 0) throw new Error("X25519: invalid shared key");
+	}
+	return result;
+}
+
+//#endregion
+//#region src/crypto/curve25519.ts
+var curve25519_exports = /* @__PURE__ */ __exportAll({
+	generateKeyPair: () => generateKeyPair$2,
+	generateSharedSecKey: () => generateSharedSecKey
+});
+/**
+* Generates a new Curve25519 key pair for Diffie-Hellman key exchange.
+*/
+function generateKeyPair$2() {
+	return generateKeyPair$3();
+}
+/**
+* Derives a Curve25519 shared secret.
+*
+* @param priKey - Local private key.
+* @param pubKey - Remote public key.
+* @returns 32-byte shared secret.
+*/
+function generateSharedSecKey(priKey, pubKey) {
+	return sharedKey(priKey, pubKey);
+}
+
+//#endregion
+//#region ../../node_modules/.bun/@stablelib+sha512@2.0.1/node_modules/@stablelib/sha512/lib/sha512.js
+const DIGEST_LENGTH = 64;
+const BLOCK_SIZE = 128;
+/**
+* SHA-2-512 cryptographic hash algorithm.
+*/
+var SHA512 = class {
+	/** Length of hash output */
+	digestLength = 64;
+	/** Block size */
+	blockSize = 128;
+	_stateHi = new Int32Array(8);
+	_stateLo = new Int32Array(8);
+	_tempHi = new Int32Array(16);
+	_tempLo = new Int32Array(16);
+	_buffer = new Uint8Array(256);
+	_bufferLength = 0;
+	_bytesHashed = 0;
+	_finished = false;
+	constructor() {
+		this.reset();
+	}
+	_initState() {
+		this._stateHi[0] = 1779033703;
+		this._stateHi[1] = 3144134277;
+		this._stateHi[2] = 1013904242;
+		this._stateHi[3] = 2773480762;
+		this._stateHi[4] = 1359893119;
+		this._stateHi[5] = 2600822924;
+		this._stateHi[6] = 528734635;
+		this._stateHi[7] = 1541459225;
+		this._stateLo[0] = 4089235720;
+		this._stateLo[1] = 2227873595;
+		this._stateLo[2] = 4271175723;
+		this._stateLo[3] = 1595750129;
+		this._stateLo[4] = 2917565137;
+		this._stateLo[5] = 725511199;
+		this._stateLo[6] = 4215389547;
+		this._stateLo[7] = 327033209;
+	}
+	/**
+	* Resets hash state making it possible
+	* to re-use this instance to hash other data.
+	*/
+	reset() {
+		this._initState();
+		this._bufferLength = 0;
+		this._bytesHashed = 0;
+		this._finished = false;
+		return this;
+	}
+	/**
+	* Cleans internal buffers and resets hash state.
+	*/
+	clean() {
+		wipe(this._buffer);
+		wipe(this._tempHi);
+		wipe(this._tempLo);
+		this.reset();
+	}
+	/**
+	* Updates hash state with the given data.
+	*
+	* Throws error when trying to update already finalized hash:
+	* instance must be reset to update it again.
+	*/
+	update(data, dataLength = data.length) {
+		if (this._finished) throw new Error("SHA512: can't update because hash was finished.");
+		let dataPos = 0;
+		this._bytesHashed += dataLength;
+		if (this._bufferLength > 0) {
+			while (this._bufferLength < 128 && dataLength > 0) {
+				this._buffer[this._bufferLength++] = data[dataPos++];
+				dataLength--;
+			}
+			if (this._bufferLength === this.blockSize) {
+				hashBlocks(this._tempHi, this._tempLo, this._stateHi, this._stateLo, this._buffer, 0, this.blockSize);
+				this._bufferLength = 0;
+			}
+		}
+		if (dataLength >= this.blockSize) {
+			dataPos = hashBlocks(this._tempHi, this._tempLo, this._stateHi, this._stateLo, data, dataPos, dataLength);
+			dataLength %= this.blockSize;
+		}
+		while (dataLength > 0) {
+			this._buffer[this._bufferLength++] = data[dataPos++];
+			dataLength--;
+		}
+		return this;
+	}
+	/**
+	* Finalizes hash state and puts hash into out.
+	* If hash was already finalized, puts the same value.
+	*/
+	finish(out) {
+		if (!this._finished) {
+			const bytesHashed = this._bytesHashed;
+			const left = this._bufferLength;
+			const bitLenHi = bytesHashed / 536870912 | 0;
+			const bitLenLo = bytesHashed << 3;
+			const padLength = bytesHashed % 128 < 112 ? 128 : 256;
+			this._buffer[left] = 128;
+			for (let i = left + 1; i < padLength - 8; i++) this._buffer[i] = 0;
+			writeUint32BE(bitLenHi, this._buffer, padLength - 8);
+			writeUint32BE(bitLenLo, this._buffer, padLength - 4);
+			hashBlocks(this._tempHi, this._tempLo, this._stateHi, this._stateLo, this._buffer, 0, padLength);
+			this._finished = true;
+		}
+		for (let i = 0; i < this.digestLength / 8; i++) {
+			writeUint32BE(this._stateHi[i], out, i * 8);
+			writeUint32BE(this._stateLo[i], out, i * 8 + 4);
+		}
+		return this;
+	}
+	/**
+	* Returns the final hash digest.
+	*/
+	digest() {
+		const out = new Uint8Array(this.digestLength);
+		this.finish(out);
+		return out;
+	}
+	/**
+	* Function useful for HMAC/PBKDF2 optimization. Returns hash state to be
+	* used with restoreState(). Only chain value is saved, not buffers or
+	* other state variables.
+	*/
+	saveState() {
+		if (this._finished) throw new Error("SHA256: cannot save finished state");
+		return {
+			stateHi: new Int32Array(this._stateHi),
+			stateLo: new Int32Array(this._stateLo),
+			buffer: this._bufferLength > 0 ? new Uint8Array(this._buffer) : void 0,
+			bufferLength: this._bufferLength,
+			bytesHashed: this._bytesHashed
+		};
+	}
+	/**
+	* Function useful for HMAC/PBKDF2 optimization. Restores state saved by
+	* saveState() and sets bytesHashed to the given value.
+	*/
+	restoreState(savedState) {
+		this._stateHi.set(savedState.stateHi);
+		this._stateLo.set(savedState.stateLo);
+		this._bufferLength = savedState.bufferLength;
+		if (savedState.buffer) this._buffer.set(savedState.buffer);
+		this._bytesHashed = savedState.bytesHashed;
+		this._finished = false;
+		return this;
+	}
+	/**
+	* Cleans state returned by saveState().
+	*/
+	cleanSavedState(savedState) {
+		wipe(savedState.stateHi);
+		wipe(savedState.stateLo);
+		if (savedState.buffer) wipe(savedState.buffer);
+		savedState.bufferLength = 0;
+		savedState.bytesHashed = 0;
+	}
+};
+const K = new Int32Array([
+	1116352408,
+	3609767458,
+	1899447441,
+	602891725,
+	3049323471,
+	3964484399,
+	3921009573,
+	2173295548,
+	961987163,
+	4081628472,
+	1508970993,
+	3053834265,
+	2453635748,
+	2937671579,
+	2870763221,
+	3664609560,
+	3624381080,
+	2734883394,
+	310598401,
+	1164996542,
+	607225278,
+	1323610764,
+	1426881987,
+	3590304994,
+	1925078388,
+	4068182383,
+	2162078206,
+	991336113,
+	2614888103,
+	633803317,
+	3248222580,
+	3479774868,
+	3835390401,
+	2666613458,
+	4022224774,
+	944711139,
+	264347078,
+	2341262773,
+	604807628,
+	2007800933,
+	770255983,
+	1495990901,
+	1249150122,
+	1856431235,
+	1555081692,
+	3175218132,
+	1996064986,
+	2198950837,
+	2554220882,
+	3999719339,
+	2821834349,
+	766784016,
+	2952996808,
+	2566594879,
+	3210313671,
+	3203337956,
+	3336571891,
+	1034457026,
+	3584528711,
+	2466948901,
+	113926993,
+	3758326383,
+	338241895,
+	168717936,
+	666307205,
+	1188179964,
+	773529912,
+	1546045734,
+	1294757372,
+	1522805485,
+	1396182291,
+	2643833823,
+	1695183700,
+	2343527390,
+	1986661051,
+	1014477480,
+	2177026350,
+	1206759142,
+	2456956037,
+	344077627,
+	2730485921,
+	1290863460,
+	2820302411,
+	3158454273,
+	3259730800,
+	3505952657,
+	3345764771,
+	106217008,
+	3516065817,
+	3606008344,
+	3600352804,
+	1432725776,
+	4094571909,
+	1467031594,
+	275423344,
+	851169720,
+	430227734,
+	3100823752,
+	506948616,
+	1363258195,
+	659060556,
+	3750685593,
+	883997877,
+	3785050280,
+	958139571,
+	3318307427,
+	1322822218,
+	3812723403,
+	1537002063,
+	2003034995,
+	1747873779,
+	3602036899,
+	1955562222,
+	1575990012,
+	2024104815,
+	1125592928,
+	2227730452,
+	2716904306,
+	2361852424,
+	442776044,
+	2428436474,
+	593698344,
+	2756734187,
+	3733110249,
+	3204031479,
+	2999351573,
+	3329325298,
+	3815920427,
+	3391569614,
+	3928383900,
+	3515267271,
+	566280711,
+	3940187606,
+	3454069534,
+	4118630271,
+	4000239992,
+	116418474,
+	1914138554,
+	174292421,
+	2731055270,
+	289380356,
+	3203993006,
+	460393269,
+	320620315,
+	685471733,
+	587496836,
+	852142971,
+	1086792851,
+	1017036298,
+	365543100,
+	1126000580,
+	2618297676,
+	1288033470,
+	3409855158,
+	1501505948,
+	4234509866,
+	1607167915,
+	987167468,
+	1816402316,
+	1246189591
+]);
+function hashBlocks(wh, wl, hh, hl, m, pos, len) {
+	let ah0 = hh[0], ah1 = hh[1], ah2 = hh[2], ah3 = hh[3], ah4 = hh[4], ah5 = hh[5], ah6 = hh[6], ah7 = hh[7], al0 = hl[0], al1 = hl[1], al2 = hl[2], al3 = hl[3], al4 = hl[4], al5 = hl[5], al6 = hl[6], al7 = hl[7];
+	let h, l;
+	let th, tl;
+	let a, b, c, d;
+	while (len >= 128) {
+		for (let i = 0; i < 16; i++) {
+			const j = 8 * i + pos;
+			wh[i] = readUint32BE(m, j);
+			wl[i] = readUint32BE(m, j + 4);
+		}
+		for (let i = 0; i < 80; i++) {
+			let bh0 = ah0;
+			let bh1 = ah1;
+			let bh2 = ah2;
+			let bh3 = ah3;
+			let bh4 = ah4;
+			let bh5 = ah5;
+			let bh6 = ah6;
+			let bh7 = ah7;
+			let bl0 = al0;
+			let bl1 = al1;
+			let bl2 = al2;
+			let bl3 = al3;
+			let bl4 = al4;
+			let bl5 = al5;
+			let bl6 = al6;
+			let bl7 = al7;
+			h = ah7;
+			l = al7;
+			a = l & 65535;
+			b = l >>> 16;
+			c = h & 65535;
+			d = h >>> 16;
+			h = (ah4 >>> 14 | al4 << 18) ^ (ah4 >>> 18 | al4 << 14) ^ (al4 >>> 9 | ah4 << 23);
+			l = (al4 >>> 14 | ah4 << 18) ^ (al4 >>> 18 | ah4 << 14) ^ (ah4 >>> 9 | al4 << 23);
+			a += l & 65535;
+			b += l >>> 16;
+			c += h & 65535;
+			d += h >>> 16;
+			h = ah4 & ah5 ^ ~ah4 & ah6;
+			l = al4 & al5 ^ ~al4 & al6;
+			a += l & 65535;
+			b += l >>> 16;
+			c += h & 65535;
+			d += h >>> 16;
+			h = K[i * 2];
+			l = K[i * 2 + 1];
+			a += l & 65535;
+			b += l >>> 16;
+			c += h & 65535;
+			d += h >>> 16;
+			h = wh[i % 16];
+			l = wl[i % 16];
+			a += l & 65535;
+			b += l >>> 16;
+			c += h & 65535;
+			d += h >>> 16;
+			b += a >>> 16;
+			c += b >>> 16;
+			d += c >>> 16;
+			th = c & 65535 | d << 16;
+			tl = a & 65535 | b << 16;
+			h = th;
+			l = tl;
+			a = l & 65535;
+			b = l >>> 16;
+			c = h & 65535;
+			d = h >>> 16;
+			h = (ah0 >>> 28 | al0 << 4) ^ (al0 >>> 2 | ah0 << 30) ^ (al0 >>> 7 | ah0 << 25);
+			l = (al0 >>> 28 | ah0 << 4) ^ (ah0 >>> 2 | al0 << 30) ^ (ah0 >>> 7 | al0 << 25);
+			a += l & 65535;
+			b += l >>> 16;
+			c += h & 65535;
+			d += h >>> 16;
+			h = ah0 & ah1 ^ ah0 & ah2 ^ ah1 & ah2;
+			l = al0 & al1 ^ al0 & al2 ^ al1 & al2;
+			a += l & 65535;
+			b += l >>> 16;
+			c += h & 65535;
+			d += h >>> 16;
+			b += a >>> 16;
+			c += b >>> 16;
+			d += c >>> 16;
+			bh7 = c & 65535 | d << 16;
+			bl7 = a & 65535 | b << 16;
+			h = bh3;
+			l = bl3;
+			a = l & 65535;
+			b = l >>> 16;
+			c = h & 65535;
+			d = h >>> 16;
+			h = th;
+			l = tl;
+			a += l & 65535;
+			b += l >>> 16;
+			c += h & 65535;
+			d += h >>> 16;
+			b += a >>> 16;
+			c += b >>> 16;
+			d += c >>> 16;
+			bh3 = c & 65535 | d << 16;
+			bl3 = a & 65535 | b << 16;
+			ah1 = bh0;
+			ah2 = bh1;
+			ah3 = bh2;
+			ah4 = bh3;
+			ah5 = bh4;
+			ah6 = bh5;
+			ah7 = bh6;
+			ah0 = bh7;
+			al1 = bl0;
+			al2 = bl1;
+			al3 = bl2;
+			al4 = bl3;
+			al5 = bl4;
+			al6 = bl5;
+			al7 = bl6;
+			al0 = bl7;
+			if (i % 16 === 15) for (let j = 0; j < 16; j++) {
+				h = wh[j];
+				l = wl[j];
+				a = l & 65535;
+				b = l >>> 16;
+				c = h & 65535;
+				d = h >>> 16;
+				h = wh[(j + 9) % 16];
+				l = wl[(j + 9) % 16];
+				a += l & 65535;
+				b += l >>> 16;
+				c += h & 65535;
+				d += h >>> 16;
+				th = wh[(j + 1) % 16];
+				tl = wl[(j + 1) % 16];
+				h = (th >>> 1 | tl << 31) ^ (th >>> 8 | tl << 24) ^ th >>> 7;
+				l = (tl >>> 1 | th << 31) ^ (tl >>> 8 | th << 24) ^ (tl >>> 7 | th << 25);
+				a += l & 65535;
+				b += l >>> 16;
+				c += h & 65535;
+				d += h >>> 16;
+				th = wh[(j + 14) % 16];
+				tl = wl[(j + 14) % 16];
+				h = (th >>> 19 | tl << 13) ^ (tl >>> 29 | th << 3) ^ th >>> 6;
+				l = (tl >>> 19 | th << 13) ^ (th >>> 29 | tl << 3) ^ (tl >>> 6 | th << 26);
+				a += l & 65535;
+				b += l >>> 16;
+				c += h & 65535;
+				d += h >>> 16;
+				b += a >>> 16;
+				c += b >>> 16;
+				d += c >>> 16;
+				wh[j] = c & 65535 | d << 16;
+				wl[j] = a & 65535 | b << 16;
+			}
+		}
+		h = ah0;
+		l = al0;
+		a = l & 65535;
+		b = l >>> 16;
+		c = h & 65535;
+		d = h >>> 16;
+		h = hh[0];
+		l = hl[0];
+		a += l & 65535;
+		b += l >>> 16;
+		c += h & 65535;
+		d += h >>> 16;
+		b += a >>> 16;
+		c += b >>> 16;
+		d += c >>> 16;
+		hh[0] = ah0 = c & 65535 | d << 16;
+		hl[0] = al0 = a & 65535 | b << 16;
+		h = ah1;
+		l = al1;
+		a = l & 65535;
+		b = l >>> 16;
+		c = h & 65535;
+		d = h >>> 16;
+		h = hh[1];
+		l = hl[1];
+		a += l & 65535;
+		b += l >>> 16;
+		c += h & 65535;
+		d += h >>> 16;
+		b += a >>> 16;
+		c += b >>> 16;
+		d += c >>> 16;
+		hh[1] = ah1 = c & 65535 | d << 16;
+		hl[1] = al1 = a & 65535 | b << 16;
+		h = ah2;
+		l = al2;
+		a = l & 65535;
+		b = l >>> 16;
+		c = h & 65535;
+		d = h >>> 16;
+		h = hh[2];
+		l = hl[2];
+		a += l & 65535;
+		b += l >>> 16;
+		c += h & 65535;
+		d += h >>> 16;
+		b += a >>> 16;
+		c += b >>> 16;
+		d += c >>> 16;
+		hh[2] = ah2 = c & 65535 | d << 16;
+		hl[2] = al2 = a & 65535 | b << 16;
+		h = ah3;
+		l = al3;
+		a = l & 65535;
+		b = l >>> 16;
+		c = h & 65535;
+		d = h >>> 16;
+		h = hh[3];
+		l = hl[3];
+		a += l & 65535;
+		b += l >>> 16;
+		c += h & 65535;
+		d += h >>> 16;
+		b += a >>> 16;
+		c += b >>> 16;
+		d += c >>> 16;
+		hh[3] = ah3 = c & 65535 | d << 16;
+		hl[3] = al3 = a & 65535 | b << 16;
+		h = ah4;
+		l = al4;
+		a = l & 65535;
+		b = l >>> 16;
+		c = h & 65535;
+		d = h >>> 16;
+		h = hh[4];
+		l = hl[4];
+		a += l & 65535;
+		b += l >>> 16;
+		c += h & 65535;
+		d += h >>> 16;
+		b += a >>> 16;
+		c += b >>> 16;
+		d += c >>> 16;
+		hh[4] = ah4 = c & 65535 | d << 16;
+		hl[4] = al4 = a & 65535 | b << 16;
+		h = ah5;
+		l = al5;
+		a = l & 65535;
+		b = l >>> 16;
+		c = h & 65535;
+		d = h >>> 16;
+		h = hh[5];
+		l = hl[5];
+		a += l & 65535;
+		b += l >>> 16;
+		c += h & 65535;
+		d += h >>> 16;
+		b += a >>> 16;
+		c += b >>> 16;
+		d += c >>> 16;
+		hh[5] = ah5 = c & 65535 | d << 16;
+		hl[5] = al5 = a & 65535 | b << 16;
+		h = ah6;
+		l = al6;
+		a = l & 65535;
+		b = l >>> 16;
+		c = h & 65535;
+		d = h >>> 16;
+		h = hh[6];
+		l = hl[6];
+		a += l & 65535;
+		b += l >>> 16;
+		c += h & 65535;
+		d += h >>> 16;
+		b += a >>> 16;
+		c += b >>> 16;
+		d += c >>> 16;
+		hh[6] = ah6 = c & 65535 | d << 16;
+		hl[6] = al6 = a & 65535 | b << 16;
+		h = ah7;
+		l = al7;
+		a = l & 65535;
+		b = l >>> 16;
+		c = h & 65535;
+		d = h >>> 16;
+		h = hh[7];
+		l = hl[7];
+		a += l & 65535;
+		b += l >>> 16;
+		c += h & 65535;
+		d += h >>> 16;
+		b += a >>> 16;
+		c += b >>> 16;
+		d += c >>> 16;
+		hh[7] = ah7 = c & 65535 | d << 16;
+		hl[7] = al7 = a & 65535 | b << 16;
+		pos += 128;
+		len -= 128;
+	}
+	return pos;
+}
+function hash(data) {
+	const h = new SHA512();
+	h.update(data);
+	const digest = h.digest();
+	h.clean();
+	return digest;
+}
+
+//#endregion
+//#region ../../node_modules/.bun/@stablelib+ed25519@2.1.0/node_modules/@stablelib/ed25519/lib/ed25519.js
+const SIGNATURE_LENGTH = 64;
+const PUBLIC_KEY_LENGTH = 32;
+const SECRET_KEY_LENGTH = 64;
+const SEED_LENGTH = 32;
+function gf(init) {
+	const r = new Float64Array(16);
+	if (init) for (let i = 0; i < init.length; i++) r[i] = init[i];
+	return r;
+}
+const _9 = new Uint8Array(32);
+_9[0] = 9;
+const gf0 = gf();
+const gf1 = gf([1]);
+const D = gf([
+	30883,
+	4953,
+	19914,
+	30187,
+	55467,
+	16705,
+	2637,
+	112,
+	59544,
+	30585,
+	16505,
+	36039,
+	65139,
+	11119,
+	27886,
+	20995
+]);
+const D2 = gf([
+	61785,
+	9906,
+	39828,
+	60374,
+	45398,
+	33411,
+	5274,
+	224,
+	53552,
+	61171,
+	33010,
+	6542,
+	64743,
+	22239,
+	55772,
+	9222
+]);
+const X = gf([
+	54554,
+	36645,
+	11616,
+	51542,
+	42930,
+	38181,
+	51040,
+	26924,
+	56412,
+	64982,
+	57905,
+	49316,
+	21502,
+	52590,
+	14035,
+	8553
+]);
+const Y = gf([
+	26200,
+	26214,
+	26214,
+	26214,
+	26214,
+	26214,
+	26214,
+	26214,
+	26214,
+	26214,
+	26214,
+	26214,
+	26214,
+	26214,
+	26214,
+	26214
+]);
+const I = gf([
+	41136,
+	18958,
+	6951,
+	50414,
+	58488,
+	44335,
+	6150,
+	12099,
+	55207,
+	15867,
+	153,
+	11085,
+	57099,
+	20417,
+	9344,
+	11139
+]);
+function set25519(r, a) {
+	for (let i = 0; i < 16; i++) r[i] = a[i] | 0;
+}
+function car25519(o) {
+	let c = 1;
+	for (let i = 0; i < 16; i++) {
+		let v = o[i] + c + 65535;
+		c = Math.floor(v / 65536);
+		o[i] = v - c * 65536;
+	}
+	o[0] += c - 1 + 37 * (c - 1);
+}
+function sel25519(p, q, b) {
+	const c = ~(b - 1);
+	for (let i = 0; i < 16; i++) {
+		const t = c & (p[i] ^ q[i]);
+		p[i] ^= t;
+		q[i] ^= t;
+	}
+}
+function pack25519(o, n) {
+	const m = gf();
+	const t = gf();
+	for (let i = 0; i < 16; i++) t[i] = n[i];
+	car25519(t);
+	car25519(t);
+	car25519(t);
+	for (let j = 0; j < 2; j++) {
+		m[0] = t[0] - 65517;
+		for (let i = 1; i < 15; i++) {
+			m[i] = t[i] - 65535 - (m[i - 1] >> 16 & 1);
+			m[i - 1] &= 65535;
+		}
+		m[15] = t[15] - 32767 - (m[14] >> 16 & 1);
+		const b = m[15] >> 16 & 1;
+		m[14] &= 65535;
+		sel25519(t, m, 1 - b);
+	}
+	for (let i = 0; i < 16; i++) {
+		o[2 * i] = t[i] & 255;
+		o[2 * i + 1] = t[i] >> 8;
+	}
+}
+function verify32(x, y) {
+	let d = 0;
+	for (let i = 0; i < 32; i++) d |= x[i] ^ y[i];
+	return (1 & d - 1 >>> 8) - 1;
+}
+function neq25519(a, b) {
+	const c = new Uint8Array(32);
+	const d = new Uint8Array(32);
+	pack25519(c, a);
+	pack25519(d, b);
+	return verify32(c, d);
+}
+function par25519(a) {
+	const d = new Uint8Array(32);
+	pack25519(d, a);
+	return d[0] & 1;
+}
+function unpack25519(o, n) {
+	for (let i = 0; i < 16; i++) o[i] = n[2 * i] + (n[2 * i + 1] << 8);
+	o[15] &= 32767;
+}
+function add(o, a, b) {
+	for (let i = 0; i < 16; i++) o[i] = a[i] + b[i];
+}
+function sub(o, a, b) {
+	for (let i = 0; i < 16; i++) o[i] = a[i] - b[i];
+}
+function mul(o, a, b) {
+	let v, c, t0 = 0, t1 = 0, t2 = 0, t3 = 0, t4 = 0, t5 = 0, t6 = 0, t7 = 0, t8 = 0, t9 = 0, t10 = 0, t11 = 0, t12 = 0, t13 = 0, t14 = 0, t15 = 0, t16 = 0, t17 = 0, t18 = 0, t19 = 0, t20 = 0, t21 = 0, t22 = 0, t23 = 0, t24 = 0, t25 = 0, t26 = 0, t27 = 0, t28 = 0, t29 = 0, t30 = 0, b0 = b[0], b1 = b[1], b2 = b[2], b3 = b[3], b4 = b[4], b5 = b[5], b6 = b[6], b7 = b[7], b8 = b[8], b9 = b[9], b10 = b[10], b11 = b[11], b12 = b[12], b13 = b[13], b14 = b[14], b15 = b[15];
+	v = a[0];
+	t0 += v * b0;
+	t1 += v * b1;
+	t2 += v * b2;
+	t3 += v * b3;
+	t4 += v * b4;
+	t5 += v * b5;
+	t6 += v * b6;
+	t7 += v * b7;
+	t8 += v * b8;
+	t9 += v * b9;
+	t10 += v * b10;
+	t11 += v * b11;
+	t12 += v * b12;
+	t13 += v * b13;
+	t14 += v * b14;
+	t15 += v * b15;
+	v = a[1];
+	t1 += v * b0;
+	t2 += v * b1;
+	t3 += v * b2;
+	t4 += v * b3;
+	t5 += v * b4;
+	t6 += v * b5;
+	t7 += v * b6;
+	t8 += v * b7;
+	t9 += v * b8;
+	t10 += v * b9;
+	t11 += v * b10;
+	t12 += v * b11;
+	t13 += v * b12;
+	t14 += v * b13;
+	t15 += v * b14;
+	t16 += v * b15;
+	v = a[2];
+	t2 += v * b0;
+	t3 += v * b1;
+	t4 += v * b2;
+	t5 += v * b3;
+	t6 += v * b4;
+	t7 += v * b5;
+	t8 += v * b6;
+	t9 += v * b7;
+	t10 += v * b8;
+	t11 += v * b9;
+	t12 += v * b10;
+	t13 += v * b11;
+	t14 += v * b12;
+	t15 += v * b13;
+	t16 += v * b14;
+	t17 += v * b15;
+	v = a[3];
+	t3 += v * b0;
+	t4 += v * b1;
+	t5 += v * b2;
+	t6 += v * b3;
+	t7 += v * b4;
+	t8 += v * b5;
+	t9 += v * b6;
+	t10 += v * b7;
+	t11 += v * b8;
+	t12 += v * b9;
+	t13 += v * b10;
+	t14 += v * b11;
+	t15 += v * b12;
+	t16 += v * b13;
+	t17 += v * b14;
+	t18 += v * b15;
+	v = a[4];
+	t4 += v * b0;
+	t5 += v * b1;
+	t6 += v * b2;
+	t7 += v * b3;
+	t8 += v * b4;
+	t9 += v * b5;
+	t10 += v * b6;
+	t11 += v * b7;
+	t12 += v * b8;
+	t13 += v * b9;
+	t14 += v * b10;
+	t15 += v * b11;
+	t16 += v * b12;
+	t17 += v * b13;
+	t18 += v * b14;
+	t19 += v * b15;
+	v = a[5];
+	t5 += v * b0;
+	t6 += v * b1;
+	t7 += v * b2;
+	t8 += v * b3;
+	t9 += v * b4;
+	t10 += v * b5;
+	t11 += v * b6;
+	t12 += v * b7;
+	t13 += v * b8;
+	t14 += v * b9;
+	t15 += v * b10;
+	t16 += v * b11;
+	t17 += v * b12;
+	t18 += v * b13;
+	t19 += v * b14;
+	t20 += v * b15;
+	v = a[6];
+	t6 += v * b0;
+	t7 += v * b1;
+	t8 += v * b2;
+	t9 += v * b3;
+	t10 += v * b4;
+	t11 += v * b5;
+	t12 += v * b6;
+	t13 += v * b7;
+	t14 += v * b8;
+	t15 += v * b9;
+	t16 += v * b10;
+	t17 += v * b11;
+	t18 += v * b12;
+	t19 += v * b13;
+	t20 += v * b14;
+	t21 += v * b15;
+	v = a[7];
+	t7 += v * b0;
+	t8 += v * b1;
+	t9 += v * b2;
+	t10 += v * b3;
+	t11 += v * b4;
+	t12 += v * b5;
+	t13 += v * b6;
+	t14 += v * b7;
+	t15 += v * b8;
+	t16 += v * b9;
+	t17 += v * b10;
+	t18 += v * b11;
+	t19 += v * b12;
+	t20 += v * b13;
+	t21 += v * b14;
+	t22 += v * b15;
+	v = a[8];
+	t8 += v * b0;
+	t9 += v * b1;
+	t10 += v * b2;
+	t11 += v * b3;
+	t12 += v * b4;
+	t13 += v * b5;
+	t14 += v * b6;
+	t15 += v * b7;
+	t16 += v * b8;
+	t17 += v * b9;
+	t18 += v * b10;
+	t19 += v * b11;
+	t20 += v * b12;
+	t21 += v * b13;
+	t22 += v * b14;
+	t23 += v * b15;
+	v = a[9];
+	t9 += v * b0;
+	t10 += v * b1;
+	t11 += v * b2;
+	t12 += v * b3;
+	t13 += v * b4;
+	t14 += v * b5;
+	t15 += v * b6;
+	t16 += v * b7;
+	t17 += v * b8;
+	t18 += v * b9;
+	t19 += v * b10;
+	t20 += v * b11;
+	t21 += v * b12;
+	t22 += v * b13;
+	t23 += v * b14;
+	t24 += v * b15;
+	v = a[10];
+	t10 += v * b0;
+	t11 += v * b1;
+	t12 += v * b2;
+	t13 += v * b3;
+	t14 += v * b4;
+	t15 += v * b5;
+	t16 += v * b6;
+	t17 += v * b7;
+	t18 += v * b8;
+	t19 += v * b9;
+	t20 += v * b10;
+	t21 += v * b11;
+	t22 += v * b12;
+	t23 += v * b13;
+	t24 += v * b14;
+	t25 += v * b15;
+	v = a[11];
+	t11 += v * b0;
+	t12 += v * b1;
+	t13 += v * b2;
+	t14 += v * b3;
+	t15 += v * b4;
+	t16 += v * b5;
+	t17 += v * b6;
+	t18 += v * b7;
+	t19 += v * b8;
+	t20 += v * b9;
+	t21 += v * b10;
+	t22 += v * b11;
+	t23 += v * b12;
+	t24 += v * b13;
+	t25 += v * b14;
+	t26 += v * b15;
+	v = a[12];
+	t12 += v * b0;
+	t13 += v * b1;
+	t14 += v * b2;
+	t15 += v * b3;
+	t16 += v * b4;
+	t17 += v * b5;
+	t18 += v * b6;
+	t19 += v * b7;
+	t20 += v * b8;
+	t21 += v * b9;
+	t22 += v * b10;
+	t23 += v * b11;
+	t24 += v * b12;
+	t25 += v * b13;
+	t26 += v * b14;
+	t27 += v * b15;
+	v = a[13];
+	t13 += v * b0;
+	t14 += v * b1;
+	t15 += v * b2;
+	t16 += v * b3;
+	t17 += v * b4;
+	t18 += v * b5;
+	t19 += v * b6;
+	t20 += v * b7;
+	t21 += v * b8;
+	t22 += v * b9;
+	t23 += v * b10;
+	t24 += v * b11;
+	t25 += v * b12;
+	t26 += v * b13;
+	t27 += v * b14;
+	t28 += v * b15;
+	v = a[14];
+	t14 += v * b0;
+	t15 += v * b1;
+	t16 += v * b2;
+	t17 += v * b3;
+	t18 += v * b4;
+	t19 += v * b5;
+	t20 += v * b6;
+	t21 += v * b7;
+	t22 += v * b8;
+	t23 += v * b9;
+	t24 += v * b10;
+	t25 += v * b11;
+	t26 += v * b12;
+	t27 += v * b13;
+	t28 += v * b14;
+	t29 += v * b15;
+	v = a[15];
+	t15 += v * b0;
+	t16 += v * b1;
+	t17 += v * b2;
+	t18 += v * b3;
+	t19 += v * b4;
+	t20 += v * b5;
+	t21 += v * b6;
+	t22 += v * b7;
+	t23 += v * b8;
+	t24 += v * b9;
+	t25 += v * b10;
+	t26 += v * b11;
+	t27 += v * b12;
+	t28 += v * b13;
+	t29 += v * b14;
+	t30 += v * b15;
+	t0 += 38 * t16;
+	t1 += 38 * t17;
+	t2 += 38 * t18;
+	t3 += 38 * t19;
+	t4 += 38 * t20;
+	t5 += 38 * t21;
+	t6 += 38 * t22;
+	t7 += 38 * t23;
+	t8 += 38 * t24;
+	t9 += 38 * t25;
+	t10 += 38 * t26;
+	t11 += 38 * t27;
+	t12 += 38 * t28;
+	t13 += 38 * t29;
+	t14 += 38 * t30;
+	c = 1;
+	v = t0 + c + 65535;
+	c = Math.floor(v / 65536);
+	t0 = v - c * 65536;
+	v = t1 + c + 65535;
+	c = Math.floor(v / 65536);
+	t1 = v - c * 65536;
+	v = t2 + c + 65535;
+	c = Math.floor(v / 65536);
+	t2 = v - c * 65536;
+	v = t3 + c + 65535;
+	c = Math.floor(v / 65536);
+	t3 = v - c * 65536;
+	v = t4 + c + 65535;
+	c = Math.floor(v / 65536);
+	t4 = v - c * 65536;
+	v = t5 + c + 65535;
+	c = Math.floor(v / 65536);
+	t5 = v - c * 65536;
+	v = t6 + c + 65535;
+	c = Math.floor(v / 65536);
+	t6 = v - c * 65536;
+	v = t7 + c + 65535;
+	c = Math.floor(v / 65536);
+	t7 = v - c * 65536;
+	v = t8 + c + 65535;
+	c = Math.floor(v / 65536);
+	t8 = v - c * 65536;
+	v = t9 + c + 65535;
+	c = Math.floor(v / 65536);
+	t9 = v - c * 65536;
+	v = t10 + c + 65535;
+	c = Math.floor(v / 65536);
+	t10 = v - c * 65536;
+	v = t11 + c + 65535;
+	c = Math.floor(v / 65536);
+	t11 = v - c * 65536;
+	v = t12 + c + 65535;
+	c = Math.floor(v / 65536);
+	t12 = v - c * 65536;
+	v = t13 + c + 65535;
+	c = Math.floor(v / 65536);
+	t13 = v - c * 65536;
+	v = t14 + c + 65535;
+	c = Math.floor(v / 65536);
+	t14 = v - c * 65536;
+	v = t15 + c + 65535;
+	c = Math.floor(v / 65536);
+	t15 = v - c * 65536;
+	t0 += c - 1 + 37 * (c - 1);
+	c = 1;
+	v = t0 + c + 65535;
+	c = Math.floor(v / 65536);
+	t0 = v - c * 65536;
+	v = t1 + c + 65535;
+	c = Math.floor(v / 65536);
+	t1 = v - c * 65536;
+	v = t2 + c + 65535;
+	c = Math.floor(v / 65536);
+	t2 = v - c * 65536;
+	v = t3 + c + 65535;
+	c = Math.floor(v / 65536);
+	t3 = v - c * 65536;
+	v = t4 + c + 65535;
+	c = Math.floor(v / 65536);
+	t4 = v - c * 65536;
+	v = t5 + c + 65535;
+	c = Math.floor(v / 65536);
+	t5 = v - c * 65536;
+	v = t6 + c + 65535;
+	c = Math.floor(v / 65536);
+	t6 = v - c * 65536;
+	v = t7 + c + 65535;
+	c = Math.floor(v / 65536);
+	t7 = v - c * 65536;
+	v = t8 + c + 65535;
+	c = Math.floor(v / 65536);
+	t8 = v - c * 65536;
+	v = t9 + c + 65535;
+	c = Math.floor(v / 65536);
+	t9 = v - c * 65536;
+	v = t10 + c + 65535;
+	c = Math.floor(v / 65536);
+	t10 = v - c * 65536;
+	v = t11 + c + 65535;
+	c = Math.floor(v / 65536);
+	t11 = v - c * 65536;
+	v = t12 + c + 65535;
+	c = Math.floor(v / 65536);
+	t12 = v - c * 65536;
+	v = t13 + c + 65535;
+	c = Math.floor(v / 65536);
+	t13 = v - c * 65536;
+	v = t14 + c + 65535;
+	c = Math.floor(v / 65536);
+	t14 = v - c * 65536;
+	v = t15 + c + 65535;
+	c = Math.floor(v / 65536);
+	t15 = v - c * 65536;
+	t0 += c - 1 + 37 * (c - 1);
+	o[0] = t0;
+	o[1] = t1;
+	o[2] = t2;
+	o[3] = t3;
+	o[4] = t4;
+	o[5] = t5;
+	o[6] = t6;
+	o[7] = t7;
+	o[8] = t8;
+	o[9] = t9;
+	o[10] = t10;
+	o[11] = t11;
+	o[12] = t12;
+	o[13] = t13;
+	o[14] = t14;
+	o[15] = t15;
+}
+function square(o, a) {
+	mul(o, a, a);
+}
+function inv25519(o, i) {
+	const c = gf();
+	let a;
+	for (a = 0; a < 16; a++) c[a] = i[a];
+	for (a = 253; a >= 0; a--) {
+		square(c, c);
+		if (a !== 2 && a !== 4) mul(c, c, i);
+	}
+	for (a = 0; a < 16; a++) o[a] = c[a];
+}
+function pow2523(o, i) {
+	const c = gf();
+	let a;
+	for (a = 0; a < 16; a++) c[a] = i[a];
+	for (a = 250; a >= 0; a--) {
+		square(c, c);
+		if (a !== 1) mul(c, c, i);
+	}
+	for (a = 0; a < 16; a++) o[a] = c[a];
+}
+function edadd(p, q) {
+	const a = gf(), b = gf(), c = gf(), d = gf(), e = gf(), f = gf(), g = gf(), h = gf(), t = gf();
+	sub(a, p[1], p[0]);
+	sub(t, q[1], q[0]);
+	mul(a, a, t);
+	add(b, p[0], p[1]);
+	add(t, q[0], q[1]);
+	mul(b, b, t);
+	mul(c, p[3], q[3]);
+	mul(c, c, D2);
+	mul(d, p[2], q[2]);
+	add(d, d, d);
+	sub(e, b, a);
+	sub(f, d, c);
+	add(g, d, c);
+	add(h, b, a);
+	mul(p[0], e, f);
+	mul(p[1], h, g);
+	mul(p[2], g, f);
+	mul(p[3], e, h);
+}
+function cswap(p, q, b) {
+	for (let i = 0; i < 4; i++) sel25519(p[i], q[i], b);
+}
+function pack(r, p) {
+	const tx = gf(), ty = gf(), zi = gf();
+	inv25519(zi, p[2]);
+	mul(tx, p[0], zi);
+	mul(ty, p[1], zi);
+	pack25519(r, ty);
+	r[31] ^= par25519(tx) << 7;
+}
+function scalarmult(p, q, s) {
+	set25519(p[0], gf0);
+	set25519(p[1], gf1);
+	set25519(p[2], gf1);
+	set25519(p[3], gf0);
+	for (let i = 255; i >= 0; --i) {
+		const b = s[i / 8 | 0] >> (i & 7) & 1;
+		cswap(p, q, b);
+		edadd(q, p);
+		edadd(p, p);
+		cswap(p, q, b);
+	}
+}
+function scalarbase(p, s) {
+	const q = [
+		gf(),
+		gf(),
+		gf(),
+		gf()
+	];
+	set25519(q[0], X);
+	set25519(q[1], Y);
+	set25519(q[2], gf1);
+	mul(q[3], X, Y);
+	scalarmult(p, q, s);
+}
+function generateKeyPairFromSeed(seed) {
+	if (seed.length !== 32) throw new Error(`ed25519: seed must be ${32} bytes`);
+	const d = hash(seed);
+	d[0] &= 248;
+	d[31] &= 127;
+	d[31] |= 64;
+	const publicKey = new Uint8Array(32);
+	const p = [
+		gf(),
+		gf(),
+		gf(),
+		gf()
+	];
+	scalarbase(p, d);
+	pack(publicKey, p);
+	const secretKey = new Uint8Array(64);
+	secretKey.set(seed);
+	secretKey.set(publicKey, 32);
+	return {
+		publicKey,
+		secretKey
+	};
+}
+function generateKeyPair$1(prng) {
+	const seed = randomBytes$1(32, prng);
+	const result = generateKeyPairFromSeed(seed);
+	wipe(seed);
+	return result;
+}
+const L = new Uint8Array([
+	237,
+	211,
+	245,
+	92,
+	26,
+	99,
+	18,
+	88,
+	214,
+	156,
+	247,
+	162,
+	222,
+	249,
+	222,
+	20,
+	0,
+	0,
+	0,
+	0,
+	0,
+	0,
+	0,
+	0,
+	0,
+	0,
+	0,
+	0,
+	0,
+	0,
+	0,
+	16
+]);
+function modL(r, x) {
+	let carry;
+	let i;
+	let j;
+	let k;
+	for (i = 63; i >= 32; --i) {
+		carry = 0;
+		for (j = i - 32, k = i - 12; j < k; ++j) {
+			x[j] += carry - 16 * x[i] * L[j - (i - 32)];
+			carry = Math.floor((x[j] + 128) / 256);
+			x[j] -= carry * 256;
+		}
+		x[j] += carry;
+		x[i] = 0;
+	}
+	carry = 0;
+	for (j = 0; j < 32; j++) {
+		x[j] += carry - (x[31] >> 4) * L[j];
+		carry = x[j] >> 8;
+		x[j] &= 255;
+	}
+	for (j = 0; j < 32; j++) x[j] -= carry * L[j];
+	for (i = 0; i < 32; i++) {
+		x[i + 1] += x[i] >> 8;
+		r[i] = x[i] & 255;
+	}
+}
+function iscanonical(s) {
+	let c = 0;
+	let n = 1;
+	for (let i = 31; i >= 0; i--) {
+		c |= s[i] - L[i] >> 8 & n;
+		n &= (s[i] ^ L[i]) - 1 >> 8;
+	}
+	return c !== 0;
+}
+function ispkcanonical(p) {
+	let c = p[0] - 237 >> 8 & 1;
+	for (let i = 1; i < 31; i++) c |= p[i] ^ 255;
+	c |= p[31] & 127 ^ 127;
+	return c !== 0;
+}
+function reduce(r) {
+	const x = new Float64Array(64);
+	for (let i = 0; i < 64; i++) x[i] = r[i];
+	for (let i = 0; i < 64; i++) r[i] = 0;
+	modL(r, x);
+}
+function sign$1(secretKey, message) {
+	if (secretKey.length !== 64) throw new Error(`ed25519: secret key must be ${64} bytes`);
+	const x = new Float64Array(64);
+	const p = [
+		gf(),
+		gf(),
+		gf(),
+		gf()
+	];
+	const d = hash(secretKey.subarray(0, 32));
+	d[0] &= 248;
+	d[31] &= 127;
+	d[31] |= 64;
+	const signature = new Uint8Array(64);
+	signature.set(d.subarray(32), 32);
+	const hs = new SHA512();
+	hs.update(signature.subarray(32));
+	hs.update(message);
+	const r = hs.digest();
+	hs.clean();
+	reduce(r);
+	scalarbase(p, r);
+	pack(signature, p);
+	hs.reset();
+	hs.update(signature.subarray(0, 32));
+	hs.update(secretKey.subarray(32));
+	hs.update(message);
+	const h = hs.digest();
+	reduce(h);
+	for (let i = 0; i < 32; i++) x[i] = r[i];
+	for (let i = 0; i < 32; i++) for (let j = 0; j < 32; j++) x[i + j] += h[i] * d[j];
+	modL(signature.subarray(32), x);
+	return signature;
+}
+function unpackneg(r, p) {
+	const t = gf(), chk = gf(), num = gf(), den = gf(), den2 = gf(), den4 = gf(), den6 = gf();
+	set25519(r[2], gf1);
+	unpack25519(r[1], p);
+	square(num, r[1]);
+	mul(den, num, D);
+	sub(num, num, r[2]);
+	add(den, r[2], den);
+	square(den2, den);
+	square(den4, den2);
+	mul(den6, den4, den2);
+	mul(t, den6, num);
+	mul(t, t, den);
+	pow2523(t, t);
+	mul(t, t, num);
+	mul(t, t, den);
+	mul(t, t, den);
+	mul(r[0], t, den);
+	square(chk, r[0]);
+	mul(chk, chk, den);
+	if (neq25519(chk, num)) mul(r[0], r[0], I);
+	square(chk, r[0]);
+	mul(chk, chk, den);
+	if (neq25519(chk, num)) return -1;
+	if (par25519(r[0]) === p[31] >> 7) sub(r[0], gf0, r[0]);
+	mul(r[3], r[0], r[1]);
+	return 0;
+}
+function verify$1(publicKey, message, signature) {
+	const t = new Uint8Array(32);
+	const p = [
+		gf(),
+		gf(),
+		gf(),
+		gf()
+	];
+	const q = [
+		gf(),
+		gf(),
+		gf(),
+		gf()
+	];
+	if (signature.length !== 64) throw new Error(`ed25519: signature must be ${64} bytes`);
+	if (publicKey.length !== 32) throw new Error(`ed25519: public key must be ${32} bytes`);
+	if (!iscanonical(signature.subarray(32))) return false;
+	if (!ispkcanonical(publicKey)) return false;
+	if (unpackneg(q, publicKey)) return false;
+	const hs = new SHA512();
+	hs.update(signature.subarray(0, 32));
+	hs.update(publicKey);
+	hs.update(message);
+	const h = hs.digest();
+	reduce(h);
+	scalarmult(p, q, h);
+	scalarbase(q, signature.subarray(32));
+	edadd(p, q);
+	pack(t, p);
+	if (verify32(signature, t)) return false;
+	return true;
+}
+
+//#endregion
+//#region src/crypto/ed25519.ts
+var ed25519_exports = /* @__PURE__ */ __exportAll({
+	generateKeyPair: () => generateKeyPair,
+	sign: () => sign,
+	verify: () => verify
+});
+/**
+* Generates a new Ed25519 key pair for digital signature operations.
+*/
+function generateKeyPair() {
+	return generateKeyPair$1();
+}
+/** Signs a message with an Ed25519 secret key and returns the 64-byte signature. */
+function sign(message, secretKey) {
+	return sign$1(secretKey, message);
+}
+/** Checks a 64-byte Ed25519 signature over a message against the signer's public key. */
+function verify(message, signature, publicKey) {
+	return verify$1(publicKey, message, signature);
+}
+
+//#endregion
+//#region src/crypto/hkdf.ts
+var hkdf_exports = /* @__PURE__ */ __exportAll({
+	derive: () => derive,
+	deriveEncryptionKeys: () => deriveEncryptionKeys
+});
+/** HKDF key derivation as defined in RFC 5869. */
+function derive(options) {
+	return Buffer.from(hkdfSync(options.hash, options.key, options.salt, options.info, options.length));
+}
+/**
+* Derives 32-byte read and write keys with HKDF-SHA512. Salt and info strings depend on the protocol and stream.
+*
+* @param sharedSecret - Pair-verify or pair-setup shared secret.
+* @param salt - Protocol-specific salt, such as `Control-Salt`.
+* @param readInfo - Info string for the decrypt key.
+* @param writeInfo - Info string for the encrypt key.
+*/
+function deriveEncryptionKeys(sharedSecret, salt, readInfo, writeInfo) {
+	const saltBuffer = Buffer.from(salt);
+	return {
+		readKey: derive({
+			hash: "sha512",
+			key: sharedSecret,
+			length: 32,
+			salt: saltBuffer,
+			info: Buffer.from(readInfo)
+		}),
+		writeKey: derive({
+			hash: "sha512",
+			key: sharedSecret,
+			length: 32,
+			salt: saltBuffer,
+			info: Buffer.from(writeInfo)
+		})
+	};
+}
+
+//#endregion
+export { generateKeyPair as a, curve25519_exports as c, chacha20_exports as d, decrypt as f, encrypt$1 as g, decrypt$1 as h, ed25519_exports as i, generateKeyPair$2 as l, aes_exports as m, deriveEncryptionKeys as n, sign as o, encrypt as p, hkdf_exports as r, verify as s, derive as t, generateSharedSecKey as u };