@flickfyi/flkr 0.0.0 → 0.0.106

package/node_modules/@flickfyi/identity/dist/curve-DALK-Fi3.js

@@ -1,2768 +0,0 @@
-//#region ../../../../../.pnpm-store/v11/links/@noble/hashes/2.4.0/a02ec2573a7b07204dfaf0508ab31b11f6a9bd74c18f15e8ab2933e00265fdfc/node_modules/@noble/hashes/_u64.js
-var U32_MASK64 = /* @__PURE__ */ (() => BigInt(2 ** 32 - 1))();
-var _32n = /* @__PURE__ */ BigInt(32);
-function fromBig(n, le = false) {
-	if (le) return {
-		h: Number(n & U32_MASK64),
-		l: Number(n >> _32n & U32_MASK64)
-	};
-	return {
-		h: Number(n >> _32n & U32_MASK64) | 0,
-		l: Number(n & U32_MASK64) | 0
-	};
-}
-function split(lst, le = false) {
-	const len = lst.length;
-	let Ah = new Uint32Array(len);
-	let Al = new Uint32Array(len);
-	for (let i = 0; i < len; i++) {
-		const { h, l } = fromBig(lst[i], le);
-		[Ah[i], Al[i]] = [h, l];
-	}
-	return [Ah, Al];
-}
-var fromNumH = (n) => n / 2 ** 32 | 0;
-var fromNumL = (n) => n >>> 0;
-function setU64FromNum(view, byteOffset, n, isLE) {
-	const h = fromNumH(n);
-	const l = fromNumL(n);
-	view.setUint32(byteOffset, isLE ? l : h, isLE);
-	view.setUint32(byteOffset + 4, isLE ? h : l, isLE);
-}
-var shrSH = (h, _l, s) => h >>> s;
-var shrSL = (h, l, s) => h << 32 - s | l >>> s;
-var rotrSH = (h, l, s) => h >>> s | l << 32 - s;
-var rotrSL = (h, l, s) => h << 32 - s | l >>> s;
-var rotrBH = (h, l, s) => h << 64 - s | l >>> s - 32;
-var rotrBL = (h, l, s) => h >>> s - 32 | l << 64 - s;
-function add(Ah, Al, Bh, Bl) {
-	const l = (Al >>> 0) + (Bl >>> 0);
-	return {
-		h: Ah + Bh + (l / 2 ** 32 | 0) | 0,
-		l: l | 0
-	};
-}
-var add3L = (Al, Bl, Cl) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0);
-var add3H = (low, Ah, Bh, Ch) => Ah + Bh + Ch + (low / 2 ** 32 | 0) | 0;
-var add4L = (Al, Bl, Cl, Dl) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0);
-var add4H = (low, Ah, Bh, Ch, Dh) => Ah + Bh + Ch + Dh + (low / 2 ** 32 | 0) | 0;
-var add5L = (Al, Bl, Cl, Dl, El) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0) + (El >>> 0);
-var add5H = (low, Ah, Bh, Ch, Dh, Eh) => Ah + Bh + Ch + Dh + Eh + (low / 2 ** 32 | 0) | 0;
-//#endregion
-//#region ../../../../../.pnpm-store/v11/links/@noble/hashes/2.4.0/a02ec2573a7b07204dfaf0508ab31b11f6a9bd74c18f15e8ab2933e00265fdfc/node_modules/@noble/hashes/utils.js
-/**
-* Checks if something is Uint8Array. Be careful: nodejs Buffer will return true.
-* @param a - value to test
-* @returns `true` when the value is a Uint8Array-compatible view.
-* @example
-* Check whether a value is a Uint8Array-compatible view.
-* ```ts
-* isBytes(new Uint8Array([1, 2, 3]));
-* ```
-*/
-function isBytes$1(a) {
-	return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array" && "BYTES_PER_ELEMENT" in a && a.BYTES_PER_ELEMENT === 1;
-}
-var atitle$1 = (title) => title ? `"${title}" ` : "";
-/**
-* Asserts something is a non-negative integer.
-* @param n - number to validate
-* @param title - label included in thrown errors
-* @returns The validated number.
-* @throws On wrong argument types. {@link TypeError}
-* @throws On wrong argument ranges or values. {@link RangeError}
-* @example
-* Validate a non-negative integer option.
-* ```ts
-* anumber(32, 'length');
-* ```
-*/
-function anumber$1(n, title = "") {
-	if (typeof n !== "number") throw new TypeError(atitle$1(title) + "expected number, got " + typeof n);
-	if (!Number.isSafeInteger(n) || n < 0) throw new RangeError(atitle$1(title) + "expected integer >= 0, got " + n);
-	return n;
-}
-/**
-* Asserts something is Uint8Array.
-* @param value - value to validate
-* @param length - optional exact length constraint
-* @param title - label included in thrown errors
-* @returns The validated byte array.
-* @throws On wrong argument types. {@link TypeError}
-* @throws On wrong argument ranges or values. {@link RangeError}
-* @example
-* Validate that a value is a byte array.
-* ```ts
-* abytes(new Uint8Array([1, 2, 3]));
-* ```
-*/
-function abytes$1(value, length, title = "") {
-	if (isBytes$1(value) && (length === void 0 || value.length === length)) return value;
-	if (length !== void 0) anumber$1(length, "length");
-	const bytes = isBytes$1(value);
-	const ofLen = length !== void 0 ? ` of length ${length}` : "";
-	const got = bytes ? `length=${value.length}` : `type=${typeof value}`;
-	const message = atitle$1(title) + "expected Uint8Array" + ofLen + ", got " + got;
-	if (!bytes) throw new TypeError(message);
-	throw new RangeError(message);
-}
-/**
-* Asserts something is a wrapped hash constructor.
-* @param h - hash constructor to validate
-* @throws On wrong argument types or invalid hash wrapper shape. {@link TypeError}
-* @throws On invalid hash metadata ranges or values. {@link RangeError}
-* @throws If the hash metadata allows empty outputs or block sizes. {@link Error}
-* @example
-* Validate a callable hash wrapper.
-* ```ts
-* import { ahash } from '@noble/hashes/utils.js';
-* import { sha256 } from '@noble/hashes/sha2.js';
-* ahash(sha256);
-* ```
-*/
-function ahash(h) {
-	if (typeof h !== "function" || typeof h.create !== "function") throw new TypeError("expected hash wrapped by utils.createHasher");
-	anumber$1(h.outputLen);
-	anumber$1(h.blockLen);
-	if (h.outputLen < 1 || h.blockLen < 1) throw new Error("hash blockLen / outputLen must be >= 1");
-}
-var aobject$1 = (value, label) => {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) throw new TypeError((label === "object" ? "" : `"${label}" `) + "expected object, got type=" + typeof value);
-};
-var aopts = (value, label) => {
-	aobject$1(value, label);
-	const proto = Object.getPrototypeOf(value);
-	if (proto !== Object.prototype && proto !== null) throw new TypeError(`"${label}" expected plain object`);
-	if (Object.hasOwn(value, "__proto__")) throw new TypeError(`"${label}.__proto__" is not allowed`);
-};
-/**
-* Asserts a hash instance has not been destroyed or finished.
-* @param instance - hash instance to validate
-* @param checkFinished - whether to reject finalized instances
-* @throws If the hash instance has already been destroyed or finalized. {@link Error}
-* @example
-* Validate that a hash instance is still usable.
-* ```ts
-* import { aexists } from '@noble/hashes/utils.js';
-* import { sha256 } from '@noble/hashes/sha2.js';
-* const hash = sha256.create();
-* aexists(hash);
-* ```
-*/
-function aexists(instance, checkFinished = true) {
-	if (instance.destroyed) throw new Error("hash was destroyed");
-	if (checkFinished && instance.finished) throw new Error("digest() was already called");
-}
-/**
-* Asserts output is a sufficiently-sized byte array.
-* @param out - destination buffer
-* @param instance - hash instance providing output length
-* Oversized buffers are allowed; downstream code only promises to fill the first `outputLen` bytes.
-* @throws On wrong argument types. {@link TypeError}
-* @throws On wrong argument ranges or values. {@link RangeError}
-* @example
-* Validate a caller-provided digest buffer.
-* ```ts
-* import { aoutput } from '@noble/hashes/utils.js';
-* import { sha256 } from '@noble/hashes/sha2.js';
-* const hash = sha256.create();
-* aoutput(new Uint8Array(hash.outputLen), hash);
-* ```
-*/
-function aoutput(out, instance) {
-	abytes$1(out, void 0, "output");
-	const min = instance.outputLen;
-	if (!(out.length >= min)) throw new RangeError("\"output\" expected length >= " + min);
-}
-/**
-* Zeroizes typed arrays in place. Warning: JS provides no guarantees.
-* @param arrays - arrays to overwrite with zeros
-* @example
-* Zeroize sensitive buffers in place.
-* ```ts
-* clean(new Uint8Array([1, 2, 3]));
-* ```
-*/
-function clean(...arrays) {
-	for (let i = 0; i < arrays.length; i++) arrays[i].fill(0);
-}
-/**
-* Creates a DataView for byte-level manipulation.
-* @param arr - source typed array
-* @returns DataView over the same buffer region.
-* @example
-* Create a DataView over an existing buffer.
-* ```ts
-* createView(new Uint8Array(4));
-* ```
-*/
-function createView(arr) {
-	return new DataView(arr.buffer, arr.byteOffset, arr.byteLength);
-}
-/**
-* Rotate-right operation for uint32 values.
-* @param word - source word
-* @param shift - shift amount in bits
-* @returns Rotated word.
-* @example
-* Rotate a 32-bit word to the right.
-* ```ts
-* rotr(0x12345678, 8);
-* ```
-*/
-function rotr(word, shift) {
-	return word << 32 - shift | word >>> shift;
-}
-var hasHexBuiltin = /* @__PURE__ */ (() => typeof Uint8Array.from([]).toHex === "function" && typeof Uint8Array.fromHex === "function")();
-var hexes = /* @__PURE__ */ Array.from({ length: 256 }, (_, i) => i.toString(16).padStart(2, "0"));
-/**
-* Convert byte array to hex string.
-* Uses the built-in function when available and assumes it matches the tested
-* fallback semantics.
-* @param bytes - bytes to encode
-* @returns Lowercase hexadecimal string.
-* @throws On wrong argument types. {@link TypeError}
-* @example
-* Convert bytes to lowercase hexadecimal.
-* ```ts
-* bytesToHex(Uint8Array.from([0xca, 0xfe, 0x01, 0x23])); // 'cafe0123'
-* ```
-*/
-function bytesToHex$1(bytes) {
-	abytes$1(bytes);
-	if (hasHexBuiltin) return bytes.toHex();
-	let hex = "";
-	for (let i = 0; i < bytes.length; i++) hex += hexes[bytes[i]];
-	return hex;
-}
-function asciiToBase16(ch) {
-	return ch >= 48 && ch <= 57 ? ch - 48 : ch >= 65 && ch <= 70 ? ch - 55 : ch >= 97 && ch <= 102 ? ch - 87 : void 0;
-}
-/**
-* Convert hex string to byte array. Uses built-in function, when available.
-* @param hex - hexadecimal string to decode
-* @returns Decoded bytes.
-* @throws On wrong argument types. {@link TypeError}
-* @throws On wrong argument ranges or values. {@link RangeError}
-* @example
-* Decode lowercase hexadecimal into bytes.
-* ```ts
-* hexToBytes('cafe0123'); // Uint8Array.from([0xca, 0xfe, 0x01, 0x23])
-* ```
-*/
-function hexToBytes$1(hex) {
-	if (typeof hex !== "string") throw new TypeError("hex string expected, got " + typeof hex);
-	if (hasHexBuiltin) try {
-		return Uint8Array.fromHex(hex);
-	} catch (error) {
-		if (error instanceof SyntaxError) throw new RangeError(error.message);
-		throw error;
-	}
-	const hl = hex.length;
-	const al = hl / 2;
-	if (hl % 2) throw new RangeError("hex string expected, got unpadded hex of length " + hl);
-	const array = new Uint8Array(al);
-	for (let ai = 0, hi = 0; ai < al; ai++, hi += 2) {
-		const n1 = asciiToBase16(hex.charCodeAt(hi));
-		const n2 = asciiToBase16(hex.charCodeAt(hi + 1));
-		if (n1 === void 0 || n2 === void 0) {
-			const char = hex[hi] + hex[hi + 1];
-			throw new RangeError("hex string expected, got non-hex character \"" + char + "\" at index " + hi);
-		}
-		array[ai] = n1 * 16 + n2;
-	}
-	return array;
-}
-/**
-* Copies several Uint8Arrays into one.
-* @param arrays - arrays to concatenate
-* @returns Concatenated byte array.
-* @throws On wrong argument types. {@link TypeError}
-* @example
-* Concatenate multiple byte arrays.
-* ```ts
-* concatBytes(new Uint8Array([1]), new Uint8Array([2]));
-* ```
-*/
-function concatBytes$1(...arrays) {
-	let sum = 0;
-	for (let i = 0; i < arrays.length; i++) {
-		const a = arrays[i];
-		abytes$1(a);
-		sum += a.length;
-	}
-	const res = new Uint8Array(sum);
-	for (let i = 0, pad = 0; i < arrays.length; i++) {
-		const a = arrays[i];
-		res.set(a, pad);
-		pad += a.length;
-	}
-	return res;
-}
-/**
-* Merges default options and passed options.
-* @param defaults - base option object
-* @param opts - user overrides
-* @param title - label included in thrown override errors
-* @returns Fresh merged option object with a null prototype.
-* @throws On wrong argument types. {@link TypeError}
-* @example
-* Merge user overrides onto default options.
-* ```ts
-* checkOpts({ dkLen: 32 }, { asyncTick: 10 });
-* ```
-*/
-function checkOpts(defaults, opts, title = "opts") {
-	aopts(defaults, "defaults");
-	if (opts !== void 0) aopts(opts, title);
-	return Object.assign(Object.create(null), defaults, opts);
-}
-/**
-* Creates a callable hash function from a stateful class constructor.
-* @param hashCons - hash constructor or factory
-* @param info - optional metadata such as DER OID
-* @returns Frozen callable hash wrapper with `.create()`.
-*   Wrapper construction eagerly calls `hashCons(undefined)` once to read
-*   `outputLen` / `blockLen`, so constructor side effects happen at module
-*   init time.
-* @throws On wrong argument types. {@link TypeError}
-* @example
-* Wrap a stateful hash constructor into a callable helper.
-* ```ts
-* import { createHasher } from '@noble/hashes/utils.js';
-* import { sha256 } from '@noble/hashes/sha2.js';
-* const wrapped = createHasher(sha256.create, { oid: sha256.oid });
-* wrapped(new Uint8Array([1]));
-* ```
-*/
-function createHasher(hashCons, info = {}) {
-	if (typeof hashCons !== "function") throw new TypeError("\"hashCons\" expected function, got type=" + typeof hashCons);
-	info = checkOpts({}, info, "info");
-	const hashC = (msg, opts) => hashCons(opts).update(msg).digest();
-	const tmp = hashCons(void 0);
-	hashC.outputLen = tmp.outputLen;
-	hashC.blockLen = tmp.blockLen;
-	hashC.canXOF = tmp.canXOF;
-	hashC.create = (opts) => hashCons(opts);
-	Object.assign(hashC, info);
-	return Object.freeze(hashC);
-}
-/**
-* Cryptographically secure PRNG backed by `crypto.getRandomValues`.
-* @param bytesLength - number of random bytes to generate
-* @returns Random bytes.
-* The platform `getRandomValues()` implementation still defines any
-* single-call length cap, and this helper rejects oversize requests
-* with a stable library `RangeError` instead of host-specific errors.
-* @throws On wrong argument types. {@link TypeError}
-* @throws On wrong argument ranges or values. {@link RangeError}
-* @throws If the current runtime does not provide `crypto.getRandomValues`. {@link Error}
-* @example
-* Generate a fresh random key or nonce.
-* ```ts
-* const key = randomBytes(16);
-* ```
-*/
-function randomBytes$1(bytesLength = 32) {
-	anumber$1(bytesLength, "bytesLength");
-	const cr = typeof globalThis === "object" ? globalThis.crypto : null;
-	if (typeof cr?.getRandomValues !== "function") throw new Error("crypto.getRandomValues must be defined");
-	if (bytesLength > 65536) throw new RangeError(`"bytesLength" expected <= 65536, got ${bytesLength}`);
-	return cr.getRandomValues(new Uint8Array(bytesLength));
-}
-/**
-* Creates OID metadata for NIST hashes with prefix `06 09 60 86 48 01 65 03 04 02`.
-* @param suffix - final OID byte for the selected hash.
-*   The helper accepts any byte even though only the documented NIST hash
-*   suffixes are meaningful downstream.
-* @returns Object containing the DER-encoded OID.
-* @example
-* Build OID metadata for a NIST hash.
-* ```ts
-* oidNist(0x01);
-* ```
-*/
-var oidNist = (suffix) => ({ oid: Uint8Array.from([
-	6,
-	9,
-	96,
-	134,
-	72,
-	1,
-	101,
-	3,
-	4,
-	2,
-	suffix
-]) });
-//#endregion
-//#region ../../../../../.pnpm-store/v11/links/@noble/hashes/2.4.0/a02ec2573a7b07204dfaf0508ab31b11f6a9bd74c18f15e8ab2933e00265fdfc/node_modules/@noble/hashes/_md.js
-/**
-* Internal Merkle-Damgard hash utils.
-* @module
-*/
-/**
-* Shared 32-bit conditional boolean primitive reused by SHA-256, SHA-1, and MD5 `F`.
-* Returns bits from `b` when `a` is set, otherwise from `c`.
-* The XOR form is equivalent to MD5's `F(X,Y,Z) = XY v not(X)Z` because the masked terms never
-* set the same bit.
-* @param a - selector word
-* @param b - word chosen when selector bit is set
-* @param c - word chosen when selector bit is clear
-* @returns Mixed 32-bit word.
-* @example
-* Combine three words with the shared 32-bit choice primitive.
-* ```ts
-* Chi(0xffffffff, 0x12345678, 0x87654321);
-* ```
-*/
-function Chi(a, b, c) {
-	return a & b ^ ~a & c;
-}
-/**
-* Shared 32-bit majority primitive reused by SHA-256 and SHA-1.
-* Returns bits shared by at least two inputs.
-* @param a - first input word
-* @param b - second input word
-* @param c - third input word
-* @returns Mixed 32-bit word.
-* @example
-* Combine three words with the shared 32-bit majority primitive.
-* ```ts
-* Maj(0xffffffff, 0x12345678, 0x87654321);
-* ```
-*/
-function Maj(a, b, c) {
-	return a & b ^ a & c ^ b & c;
-}
-/**
-* Merkle-Damgard hash construction base class.
-* Could be used to create MD5, RIPEMD, SHA1, SHA2.
-* Accepts only byte-aligned `Uint8Array` input, even when the underlying spec describes bit
-* strings with partial-byte tails.
-* @param blockLen - internal block size in bytes
-* @param outputLen - digest size in bytes
-* @param padOffset - trailing length field size in bytes
-* @param isLE - whether length and state words are encoded in little-endian
-* @example
-* Use a concrete subclass to get the shared Merkle-Damgard update/digest flow.
-* ```ts
-* import { _SHA1 } from '@noble/hashes/legacy.js';
-* const hash = new _SHA1();
-* hash.update(new Uint8Array([97, 98, 99]));
-* hash.digest();
-* ```
-*/
-var HashMD = class {
-	blockLen;
-	outputLen;
-	canXOF = false;
-	padOffset;
-	isLE;
-	buffer;
-	view;
-	finished = false;
-	length = 0;
-	pos = 0;
-	destroyed = false;
-	constructor(blockLen, outputLen, padOffset, isLE) {
-		this.blockLen = blockLen;
-		this.outputLen = outputLen;
-		this.padOffset = padOffset;
-		this.isLE = isLE;
-		this.buffer = new Uint8Array(blockLen);
-		this.view = createView(this.buffer);
-	}
-	update(data) {
-		aexists(this);
-		abytes$1(data);
-		const { view, buffer, blockLen } = this;
-		const len = data.length;
-		let processed = false;
-		for (let pos = 0; pos < len;) {
-			const take = Math.min(blockLen - this.pos, len - pos);
-			if (take === blockLen) {
-				const dataView = createView(data);
-				for (; blockLen <= len - pos; pos += blockLen) this.process(dataView, pos);
-				processed = true;
-				continue;
-			}
-			buffer.set(pos === 0 && take === len ? data : data.subarray(pos, pos + take), this.pos);
-			this.pos += take;
-			pos += take;
-			if (this.pos === blockLen) {
-				this.process(view, 0);
-				this.pos = 0;
-				processed = true;
-			}
-		}
-		this.length += data.length;
-		if (processed) this.roundClean();
-		return this;
-	}
-	digestInto(out) {
-		aexists(this);
-		aoutput(out, this);
-		this.finished = true;
-		const { buffer, view, blockLen, isLE } = this;
-		let { pos } = this;
-		buffer[pos++] = 128;
-		buffer.fill(0, pos);
-		if (this.padOffset > blockLen - pos) {
-			this.process(view, 0);
-			buffer.fill(0);
-		}
-		setU64FromNum(view, blockLen - 8, this.length * 8, isLE);
-		this.process(view, 0);
-		this.roundClean();
-		const oview = out === buffer ? view : createView(out);
-		const len = this.outputLen;
-		const outLen = len / 4;
-		const state = this.get();
-		if (len % 4 || outLen > state.length) throw new Error("invalid outputLen");
-		for (let i = 0; i < outLen; i++) oview.setUint32(4 * i, state[i], isLE);
-	}
-	digest() {
-		const { buffer, outputLen } = this;
-		this.digestInto(buffer);
-		const res = buffer.slice(0, outputLen);
-		this.destroy();
-		return res;
-	}
-	_cloneIntoMeta(to) {
-		const { buffer, length, finished, destroyed, pos } = this;
-		to.destroyed = destroyed;
-		to.finished = finished;
-		to.length = length;
-		to.pos = pos;
-		if (pos) to.buffer.set(buffer);
-		return to;
-	}
-	clone() {
-		return this._cloneInto();
-	}
-};
-/**
-* Initial SHA-2 state: fractional parts of square roots of first 16 primes 2..53.
-* Check out `test/misc/sha2-gen-iv.js` for recomputation guide.
-*/
-/** Initial SHA256 state from RFC 6234 §6.1: the first 32 bits of the fractional parts of the
-* square roots of the first eight prime numbers. Exported as a shared table; callers must treat
-* it as read-only because constructors copy words from it by index. */
-var SHA256_IV = /* @__PURE__ */ Uint32Array.from([
-	1779033703,
-	3144134277,
-	1013904242,
-	2773480762,
-	1359893119,
-	2600822924,
-	528734635,
-	1541459225
-]);
-/** Initial SHA512 state from RFC 6234 §6.3: eight RFC 64-bit `H(0)` words stored as sixteen
-* big-endian 32-bit halves. Derived from the fractional parts of the square roots of the first
-* eight prime numbers. Exported as a shared table; callers must treat it as read-only because
-* constructors copy halves from it by index. */
-var SHA512_IV = /* @__PURE__ */ Uint32Array.from([
-	1779033703,
-	4089235720,
-	3144134277,
-	2227873595,
-	1013904242,
-	4271175723,
-	2773480762,
-	1595750129,
-	1359893119,
-	2917565137,
-	2600822924,
-	725511199,
-	528734635,
-	4215389547,
-	1541459225,
-	327033209
-]);
-//#endregion
-//#region ../../../../../.pnpm-store/v11/links/@noble/hashes/2.4.0/a02ec2573a7b07204dfaf0508ab31b11f6a9bd74c18f15e8ab2933e00265fdfc/node_modules/@noble/hashes/sha2.js
-/**
-* SHA2 hash function. A.k.a. sha256, sha384, sha512, sha512_224, sha512_256.
-* SHA256 is the fastest hash implementable in JS, even faster than Blake3.
-* Check out {@link https://www.rfc-editor.org/rfc/rfc4634 | RFC 4634} and
-* {@link https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf | FIPS 180-4}.
-* @module
-*/
-/**
-* SHA-224 / SHA-256 round constants from RFC 6234 §5.1: the first 32 bits
-* of the cube roots of the first 64 primes (2..311).
-*/
-var SHA256_K = /* @__PURE__ */ Uint32Array.from([
-	1116352408,
-	1899447441,
-	3049323471,
-	3921009573,
-	961987163,
-	1508970993,
-	2453635748,
-	2870763221,
-	3624381080,
-	310598401,
-	607225278,
-	1426881987,
-	1925078388,
-	2162078206,
-	2614888103,
-	3248222580,
-	3835390401,
-	4022224774,
-	264347078,
-	604807628,
-	770255983,
-	1249150122,
-	1555081692,
-	1996064986,
-	2554220882,
-	2821834349,
-	2952996808,
-	3210313671,
-	3336571891,
-	3584528711,
-	113926993,
-	338241895,
-	666307205,
-	773529912,
-	1294757372,
-	1396182291,
-	1695183700,
-	1986661051,
-	2177026350,
-	2456956037,
-	2730485921,
-	2820302411,
-	3259730800,
-	3345764771,
-	3516065817,
-	3600352804,
-	4094571909,
-	275423344,
-	430227734,
-	506948616,
-	659060556,
-	883997877,
-	958139571,
-	1322822218,
-	1537002063,
-	1747873779,
-	1955562222,
-	2024104815,
-	2227730452,
-	2361852424,
-	2428436474,
-	2756734187,
-	3204031479,
-	3329325298
-]);
-/** Reusable SHA-224 / SHA-256 message schedule buffer `W_t` from RFC 6234 §6.2 step 1. */
-var SHA256_W = /* @__PURE__ */ new Uint32Array(64);
-/** Internal SHA-224 / SHA-256 compression engine from RFC 6234 §6.2. */
-var SHA2_32B = class extends HashMD {
-	A = 0;
-	B = 0;
-	C = 0;
-	D = 0;
-	E = 0;
-	F = 0;
-	G = 0;
-	H = 0;
-	constructor(outputLen, IV) {
-		super(64, outputLen, 8, false);
-		this.A = IV[0] | 0;
-		this.B = IV[1] | 0;
-		this.C = IV[2] | 0;
-		this.D = IV[3] | 0;
-		this.E = IV[4] | 0;
-		this.F = IV[5] | 0;
-		this.G = IV[6] | 0;
-		this.H = IV[7] | 0;
-	}
-	get() {
-		const { A, B, C, D, E, F, G, H } = this;
-		return [
-			A,
-			B,
-			C,
-			D,
-			E,
-			F,
-			G,
-			H
-		];
-	}
-	set(A, B, C, D, E, F, G, H) {
-		this.A = A | 0;
-		this.B = B | 0;
-		this.C = C | 0;
-		this.D = D | 0;
-		this.E = E | 0;
-		this.F = F | 0;
-		this.G = G | 0;
-		this.H = H | 0;
-	}
-	_cloneInto(to) {
-		(to ||= new this.constructor()).set(...this.get());
-		return this._cloneIntoMeta(to);
-	}
-	process(view, offset) {
-		for (let i = 0; i < 16; i++, offset += 4) SHA256_W[i] = view.getUint32(offset, false);
-		for (let i = 16; i < 64; i++) {
-			const W15 = SHA256_W[i - 15];
-			const W2 = SHA256_W[i - 2];
-			const s0 = rotr(W15, 7) ^ rotr(W15, 18) ^ W15 >>> 3;
-			const s1 = rotr(W2, 17) ^ rotr(W2, 19) ^ W2 >>> 10;
-			SHA256_W[i] = s1 + SHA256_W[i - 7] + s0 + SHA256_W[i - 16] | 0;
-		}
-		let { A, B, C, D, E, F, G, H } = this;
-		for (let i = 0; i < 64; i++) {
-			const sigma1 = rotr(E, 6) ^ rotr(E, 11) ^ rotr(E, 25);
-			const T1 = H + sigma1 + Chi(E, F, G) + SHA256_K[i] + SHA256_W[i] | 0;
-			const T2 = (rotr(A, 2) ^ rotr(A, 13) ^ rotr(A, 22)) + Maj(A, B, C) | 0;
-			H = G;
-			G = F;
-			F = E;
-			E = D + T1 | 0;
-			D = C;
-			C = B;
-			B = A;
-			A = T1 + T2 | 0;
-		}
-		A = A + this.A | 0;
-		B = B + this.B | 0;
-		C = C + this.C | 0;
-		D = D + this.D | 0;
-		E = E + this.E | 0;
-		F = F + this.F | 0;
-		G = G + this.G | 0;
-		H = H + this.H | 0;
-		this.set(A, B, C, D, E, F, G, H);
-	}
-	roundClean() {
-		clean(SHA256_W);
-	}
-	destroy() {
-		this.destroyed = true;
-		this.set(0, 0, 0, 0, 0, 0, 0, 0);
-		clean(this.buffer);
-	}
-};
-/** Internal SHA-256 hash class grounded in RFC 6234 §6.2. */
-var _SHA256 = class extends SHA2_32B {
-	constructor() {
-		super(32, SHA256_IV);
-	}
-};
-var K512 = /* @__PURE__ */ (() => split([
-	"0x428a2f98d728ae22",
-	"0x7137449123ef65cd",
-	"0xb5c0fbcfec4d3b2f",
-	"0xe9b5dba58189dbbc",
-	"0x3956c25bf348b538",
-	"0x59f111f1b605d019",
-	"0x923f82a4af194f9b",
-	"0xab1c5ed5da6d8118",
-	"0xd807aa98a3030242",
-	"0x12835b0145706fbe",
-	"0x243185be4ee4b28c",
-	"0x550c7dc3d5ffb4e2",
-	"0x72be5d74f27b896f",
-	"0x80deb1fe3b1696b1",
-	"0x9bdc06a725c71235",
-	"0xc19bf174cf692694",
-	"0xe49b69c19ef14ad2",
-	"0xefbe4786384f25e3",
-	"0x0fc19dc68b8cd5b5",
-	"0x240ca1cc77ac9c65",
-	"0x2de92c6f592b0275",
-	"0x4a7484aa6ea6e483",
-	"0x5cb0a9dcbd41fbd4",
-	"0x76f988da831153b5",
-	"0x983e5152ee66dfab",
-	"0xa831c66d2db43210",
-	"0xb00327c898fb213f",
-	"0xbf597fc7beef0ee4",
-	"0xc6e00bf33da88fc2",
-	"0xd5a79147930aa725",
-	"0x06ca6351e003826f",
-	"0x142929670a0e6e70",
-	"0x27b70a8546d22ffc",
-	"0x2e1b21385c26c926",
-	"0x4d2c6dfc5ac42aed",
-	"0x53380d139d95b3df",
-	"0x650a73548baf63de",
-	"0x766a0abb3c77b2a8",
-	"0x81c2c92e47edaee6",
-	"0x92722c851482353b",
-	"0xa2bfe8a14cf10364",
-	"0xa81a664bbc423001",
-	"0xc24b8b70d0f89791",
-	"0xc76c51a30654be30",
-	"0xd192e819d6ef5218",
-	"0xd69906245565a910",
-	"0xf40e35855771202a",
-	"0x106aa07032bbd1b8",
-	"0x19a4c116b8d2d0c8",
-	"0x1e376c085141ab53",
-	"0x2748774cdf8eeb99",
-	"0x34b0bcb5e19b48a8",
-	"0x391c0cb3c5c95a63",
-	"0x4ed8aa4ae3418acb",
-	"0x5b9cca4f7763e373",
-	"0x682e6ff3d6b2b8a3",
-	"0x748f82ee5defb2fc",
-	"0x78a5636f43172f60",
-	"0x84c87814a1f0ab72",
-	"0x8cc702081a6439ec",
-	"0x90befffa23631e28",
-	"0xa4506cebde82bde9",
-	"0xbef9a3f7b2c67915",
-	"0xc67178f2e372532b",
-	"0xca273eceea26619c",
-	"0xd186b8c721c0c207",
-	"0xeada7dd6cde0eb1e",
-	"0xf57d4f7fee6ed178",
-	"0x06f067aa72176fba",
-	"0x0a637dc5a2c898a6",
-	"0x113f9804bef90dae",
-	"0x1b710b35131c471b",
-	"0x28db77f523047d84",
-	"0x32caab7b40c72493",
-	"0x3c9ebe0a15c9bebc",
-	"0x431d67c49c100d4c",
-	"0x4cc5d4becb3e42b6",
-	"0x597f299cfc657e2a",
-	"0x5fcb6fab3ad6faec",
-	"0x6c44198c4a475817"
-].map((n) => BigInt(n))))();
-var SHA512_Kh = /* @__PURE__ */ (() => K512[0])();
-var SHA512_Kl = /* @__PURE__ */ (() => K512[1])();
-var SHA512_W_H = /* @__PURE__ */ new Uint32Array(80);
-var SHA512_W_L = /* @__PURE__ */ new Uint32Array(80);
-/** Internal SHA-384 / SHA-512 compression engine from RFC 6234 §6.4. */
-var SHA2_64B = class extends HashMD {
-	Ah = 0;
-	Al = 0;
-	Bh = 0;
-	Bl = 0;
-	Ch = 0;
-	Cl = 0;
-	Dh = 0;
-	Dl = 0;
-	Eh = 0;
-	El = 0;
-	Fh = 0;
-	Fl = 0;
-	Gh = 0;
-	Gl = 0;
-	Hh = 0;
-	Hl = 0;
-	constructor(outputLen, IV) {
-		super(128, outputLen, 16, false);
-		this.Ah = IV[0] | 0;
-		this.Al = IV[1] | 0;
-		this.Bh = IV[2] | 0;
-		this.Bl = IV[3] | 0;
-		this.Ch = IV[4] | 0;
-		this.Cl = IV[5] | 0;
-		this.Dh = IV[6] | 0;
-		this.Dl = IV[7] | 0;
-		this.Eh = IV[8] | 0;
-		this.El = IV[9] | 0;
-		this.Fh = IV[10] | 0;
-		this.Fl = IV[11] | 0;
-		this.Gh = IV[12] | 0;
-		this.Gl = IV[13] | 0;
-		this.Hh = IV[14] | 0;
-		this.Hl = IV[15] | 0;
-	}
-	get() {
-		const { Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl } = this;
-		return [
-			Ah,
-			Al,
-			Bh,
-			Bl,
-			Ch,
-			Cl,
-			Dh,
-			Dl,
-			Eh,
-			El,
-			Fh,
-			Fl,
-			Gh,
-			Gl,
-			Hh,
-			Hl
-		];
-	}
-	set(Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl) {
-		this.Ah = Ah | 0;
-		this.Al = Al | 0;
-		this.Bh = Bh | 0;
-		this.Bl = Bl | 0;
-		this.Ch = Ch | 0;
-		this.Cl = Cl | 0;
-		this.Dh = Dh | 0;
-		this.Dl = Dl | 0;
-		this.Eh = Eh | 0;
-		this.El = El | 0;
-		this.Fh = Fh | 0;
-		this.Fl = Fl | 0;
-		this.Gh = Gh | 0;
-		this.Gl = Gl | 0;
-		this.Hh = Hh | 0;
-		this.Hl = Hl | 0;
-	}
-	_cloneInto(to) {
-		(to ||= new this.constructor()).set(...this.get());
-		return this._cloneIntoMeta(to);
-	}
-	process(view, offset) {
-		for (let i = 0; i < 16; i++, offset += 4) {
-			SHA512_W_H[i] = view.getUint32(offset);
-			SHA512_W_L[i] = view.getUint32(offset += 4);
-		}
-		for (let i = 16; i < 80; i++) {
-			const W15h = SHA512_W_H[i - 15] | 0;
-			const W15l = SHA512_W_L[i - 15] | 0;
-			const s0h = rotrSH(W15h, W15l, 1) ^ rotrSH(W15h, W15l, 8) ^ shrSH(W15h, W15l, 7);
-			const s0l = rotrSL(W15h, W15l, 1) ^ rotrSL(W15h, W15l, 8) ^ shrSL(W15h, W15l, 7);
-			const W2h = SHA512_W_H[i - 2] | 0;
-			const W2l = SHA512_W_L[i - 2] | 0;
-			const s1h = rotrSH(W2h, W2l, 19) ^ rotrBH(W2h, W2l, 61) ^ shrSH(W2h, W2l, 6);
-			const SUMl = add4L(s0l, rotrSL(W2h, W2l, 19) ^ rotrBL(W2h, W2l, 61) ^ shrSL(W2h, W2l, 6), SHA512_W_L[i - 7], SHA512_W_L[i - 16]);
-			const SUMh = add4H(SUMl, s0h, s1h, SHA512_W_H[i - 7], SHA512_W_H[i - 16]);
-			SHA512_W_H[i] = SUMh | 0;
-			SHA512_W_L[i] = SUMl | 0;
-		}
-		let { Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl } = this;
-		for (let i = 0; i < 80; i++) {
-			const sigma1h = rotrSH(Eh, El, 14) ^ rotrSH(Eh, El, 18) ^ rotrBH(Eh, El, 41);
-			const sigma1l = rotrSL(Eh, El, 14) ^ rotrSL(Eh, El, 18) ^ rotrBL(Eh, El, 41);
-			const CHIh = Eh & Fh ^ ~Eh & Gh;
-			const CHIl = El & Fl ^ ~El & Gl;
-			const T1ll = add5L(Hl, sigma1l, CHIl, SHA512_Kl[i], SHA512_W_L[i]);
-			const T1h = add5H(T1ll, Hh, sigma1h, CHIh, SHA512_Kh[i], SHA512_W_H[i]);
-			const T1l = T1ll | 0;
-			const sigma0h = rotrSH(Ah, Al, 28) ^ rotrBH(Ah, Al, 34) ^ rotrBH(Ah, Al, 39);
-			const sigma0l = rotrSL(Ah, Al, 28) ^ rotrBL(Ah, Al, 34) ^ rotrBL(Ah, Al, 39);
-			const MAJh = Ah & Bh ^ Ah & Ch ^ Bh & Ch;
-			const MAJl = Al & Bl ^ Al & Cl ^ Bl & Cl;
-			Hh = Gh | 0;
-			Hl = Gl | 0;
-			Gh = Fh | 0;
-			Gl = Fl | 0;
-			Fh = Eh | 0;
-			Fl = El | 0;
-			({h: Eh, l: El} = add(Dh | 0, Dl | 0, T1h | 0, T1l | 0));
-			Dh = Ch | 0;
-			Dl = Cl | 0;
-			Ch = Bh | 0;
-			Cl = Bl | 0;
-			Bh = Ah | 0;
-			Bl = Al | 0;
-			const All = add3L(T1l, sigma0l, MAJl);
-			Ah = add3H(All, T1h, sigma0h, MAJh);
-			Al = All | 0;
-		}
-		({h: Ah, l: Al} = add(this.Ah | 0, this.Al | 0, Ah | 0, Al | 0));
-		({h: Bh, l: Bl} = add(this.Bh | 0, this.Bl | 0, Bh | 0, Bl | 0));
-		({h: Ch, l: Cl} = add(this.Ch | 0, this.Cl | 0, Ch | 0, Cl | 0));
-		({h: Dh, l: Dl} = add(this.Dh | 0, this.Dl | 0, Dh | 0, Dl | 0));
-		({h: Eh, l: El} = add(this.Eh | 0, this.El | 0, Eh | 0, El | 0));
-		({h: Fh, l: Fl} = add(this.Fh | 0, this.Fl | 0, Fh | 0, Fl | 0));
-		({h: Gh, l: Gl} = add(this.Gh | 0, this.Gl | 0, Gh | 0, Gl | 0));
-		({h: Hh, l: Hl} = add(this.Hh | 0, this.Hl | 0, Hh | 0, Hl | 0));
-		this.set(Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl);
-	}
-	roundClean() {
-		clean(SHA512_W_H, SHA512_W_L);
-	}
-	destroy() {
-		this.destroyed = true;
-		clean(this.buffer);
-		this.set(0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0);
-	}
-};
-/** Internal SHA-512 hash class grounded in RFC 6234 §6.3 and §6.4. */
-var _SHA512 = class extends SHA2_64B {
-	constructor() {
-		super(64, SHA512_IV);
-	}
-};
-/**
-* SHA2-256 hash function from RFC 4634. In JS it's the fastest: even faster than Blake3. Some info:
-*
-* - Trying 2^128 hashes would get 50% chance of collision, using birthday attack.
-* - BTC network is doing 2^70 hashes/sec (2^95 hashes/year) as per 2025.
-* - Each sha256 hash is executing 2^18 bit operations.
-* - Good 2024 ASICs can do 200Th/sec with 3500 watts of power, corresponding to 2^36 hashes/joule.
-* @param msg - message bytes to hash
-* @param opts - Reserved hash options.
-* @returns Digest bytes.
-* @example
-* Hash a message with SHA2-256.
-* ```ts
-* sha256(new Uint8Array([97, 98, 99]));
-* ```
-*/
-var sha256 = /* @__PURE__ */ createHasher(() => new _SHA256(), /* @__PURE__ */ oidNist(1));
-/**
-* SHA2-512 hash function from RFC 4634.
-* @param msg - message bytes to hash
-* @param opts - Reserved hash options.
-* @returns Digest bytes.
-* @example
-* Hash a message with SHA2-512.
-* ```ts
-* sha512(new Uint8Array([97, 98, 99]));
-* ```
-*/
-var sha512 = /* @__PURE__ */ createHasher(() => new _SHA512(), /* @__PURE__ */ oidNist(3));
-//#endregion
-//#region ../../../../../.pnpm-store/v11/links/@noble/curves/2.4.0/766129a921e8dfd2ef1de557b88b41133e3334d958e354fac1f5d17f98661627/node_modules/@noble/curves/utils.js
-/**
-* Hex, bytes and number utilities.
-* @module
-*/
-/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
-/**
-* Validates that a value is an array, optionally validating each element.
-* @param item - Value to validate.
-* @param title - Label included in thrown errors.
-* @param inner - Optional per-element validator, called with the element and its label.
-* @returns The validated array.
-* @example
-* Validate an array of points before batch processing.
-*
-* ```ts
-* aarray([1n, 2n], 'scalars');
-* ```
-*/
-function aarray(item, title, inner = () => {}) {
-	if (!Array.isArray(item)) throw new TypeError(`"${title}" expected array, got type=${typeof item}`);
-	for (let i = 0; i < item.length; i++) inner(item[i], `${title}[${i}]`);
-	return item;
-}
-/**
-* Validates that a value is a byte array.
-* @param value - Value to validate.
-* @param length - Optional exact byte length.
-* @param title - Optional field name.
-* @returns Original byte array.
-* @example
-* Reject non-byte input before passing data into curve code.
-*
-* ```ts
-* abytes(new Uint8Array(1));
-* ```
-*/
-var abytes = (value, length, title) => abytes$1(value, length, title);
-/**
-* Validates that a value is a non-negative safe integer.
-* @param n - Value to validate.
-* @param title - Optional field name.
-* @returns The validated number.
-* @example
-* Validate a numeric length before allocating buffers.
-*
-* ```ts
-* anumber(1);
-* ```
-*/
-var anumber = anumber$1;
-/**
-* Asserts something is a string.
-* @param value - Value to validate.
-* @param title - Label included in thrown errors.
-* @returns The validated string.
-* @throws On wrong argument types. {@link TypeError}
-* @example
-* Validate a label string.
-*
-* ```ts
-* astring('example', 'label');
-* ```
-*/
-function astring(value, title = "") {
-	if (typeof value !== "string") {
-		const prefix = title && `"${title}" `;
-		throw new TypeError(prefix + "expected string, got type=" + typeof value);
-	}
-	return value;
-}
-/**
-* Asserts something is a plain object-ish value, not null or array.
-* @param value - Value to validate.
-* @param title - Label included in thrown errors.
-* @returns The validated object.
-* @throws On wrong argument types. {@link TypeError}
-* @example
-* Validate an options object before checking fields.
-*
-* ```ts
-* aobject({ flag: true });
-* ```
-*/
-function aobject(value, title = "object") {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) throw new TypeError(title === "object" ? "expected valid options object" : `"${title}" expected object, got type=${typeof value}`);
-	return value;
-}
-/**
-* Asserts something is a function.
-* @param value - Value to validate.
-* @param title - Label included in thrown errors.
-* @returns The validated function.
-* @throws On wrong argument types. {@link TypeError}
-* @example
-* Validate a required method before calling it.
-*
-* ```ts
-* afunction(() => true, 'predicate');
-* ```
-*/
-function afunction(value, title) {
-	if (typeof value !== "function") throw new TypeError(`"${title}" is invalid: expected function, got ${typeof value}`);
-	return value;
-}
-/**
-* Encodes bytes as lowercase hex.
-* @param bytes - Bytes to encode.
-* @returns Lowercase hex string.
-* @example
-* Serialize bytes as hex for logging or fixtures.
-*
-* ```ts
-* bytesToHex(Uint8Array.of(1, 2, 3));
-* ```
-*/
-var bytesToHex = bytesToHex$1;
-/**
-* Concatenates byte arrays.
-* @param arrays - Byte arrays to join.
-* @returns Concatenated bytes.
-* @example
-* Join domain-separated chunks into one buffer.
-*
-* ```ts
-* concatBytes(Uint8Array.of(1), Uint8Array.of(2));
-* ```
-*/
-var concatBytes = (...arrays) => concatBytes$1(...arrays);
-/**
-* Decodes lowercase or uppercase hex into bytes.
-* @param hex - Hex string to decode.
-* @returns Decoded bytes.
-* @example
-* Parse fixture hex into bytes before hashing.
-*
-* ```ts
-* hexToBytes('0102');
-* ```
-*/
-var hexToBytes = (hex) => hexToBytes$1(hex);
-/**
-* Checks whether a value is a Uint8Array.
-* @param a - Value to inspect.
-* @returns `true` when `a` is a Uint8Array.
-* @example
-* Branch on byte input before decoding it.
-*
-* ```ts
-* isBytes(new Uint8Array(1));
-* ```
-*/
-var isBytes = isBytes$1;
-/**
-* Reads random bytes from the platform CSPRNG.
-* @param bytesLength - Number of random bytes to read.
-* @returns Fresh random bytes.
-* @example
-* Generate a random seed for a keypair.
-*
-* ```ts
-* randomBytes(2);
-* ```
-*/
-var randomBytes = (bytesLength) => randomBytes$1(bytesLength);
-var _0n$2 = /* @__PURE__ */ BigInt(0);
-var _1n$2 = /* @__PURE__ */ BigInt(1);
-var atitle = (title) => title ? `"${title}" ` : "";
-/**
-* Validates that a flag is boolean.
-* @param value - Value to validate.
-* @param title - Optional field name.
-* @returns Original value.
-* @throws On wrong argument types. {@link TypeError}
-* @example
-* Reject non-boolean option flags early.
-*
-* ```ts
-* abool(true);
-* ```
-*/
-function abool(value, title = "") {
-	if (typeof value !== "boolean") throw new TypeError(atitle(title) + "expected boolean, got type=" + typeof value);
-	return value;
-}
-/**
-* Validates that a value is a non-negative bigint or safe integer.
-* @param n - Value to validate.
-* @returns The same validated value.
-* @throws On wrong argument ranges or values. {@link RangeError}
-* @example
-* Validate one integer-like value before serializing it.
-*
-* ```ts
-* abignumber(1n);
-* ```
-*/
-function abignumber(n) {
-	if (typeof n === "bigint") {
-		if (!isPosBig(n)) throw new RangeError("positive bigint expected, got " + n);
-	} else anumber(n);
-	return n;
-}
-/**
-* Validates that a value is a safe integer.
-* @param value - Integer to validate.
-* @param title - Optional field name.
-* @throws On wrong argument types. {@link TypeError}
-* @throws On wrong argument ranges or values. {@link RangeError}
-* @example
-* Validate a window size before scalar arithmetic uses it.
-*
-* ```ts
-* asafenumber(1);
-* ```
-*/
-function asafenumber(value, title = "") {
-	if (typeof value !== "number") {
-		const prefix = title && `"${title}" `;
-		throw new TypeError(prefix + "expected number, got type=" + typeof value);
-	}
-	if (!Number.isSafeInteger(value)) {
-		const prefix = title && `"${title}" `;
-		throw new RangeError(prefix + "expected safe integer, got " + value);
-	}
-}
-/**
-* Encodes a bigint into even-length big-endian hex.
-* The historical "unpadded" name only means "no fixed-width field padding"; odd-length hex still
-* gets one leading zero nibble so the result always represents whole bytes.
-* @param num - Number to encode.
-* @returns Big-endian hex string.
-* @throws On wrong argument ranges or values. {@link RangeError}
-* @example
-* Encode a scalar into hex without a `0x` prefix.
-*
-* ```ts
-* numberToHexUnpadded(255n);
-* ```
-*/
-function numberToHexUnpadded(num) {
-	const hex = abignumber(num).toString(16);
-	return hex.length & 1 ? "0" + hex : hex;
-}
-/**
-* Parses a big-endian hex string into bigint.
-* Accepts odd-length hex through the native `BigInt('0x' + hex)` parser and currently surfaces the
-* same native `SyntaxError` for malformed hex instead of wrapping it in a library-specific error.
-* @param hex - Hex string without `0x`.
-* @returns Parsed bigint value.
-* @throws On wrong argument types. {@link TypeError}
-* @example
-* Parse a scalar from fixture hex.
-*
-* ```ts
-* hexToNumber('ff');
-* ```
-*/
-function hexToNumber(hex) {
-	if (typeof hex !== "string") throw new TypeError("hex string expected, got " + typeof hex);
-	return hex === "" ? _0n$2 : BigInt("0x" + hex);
-}
-/**
-* Parses big-endian bytes into bigint.
-* @param bytes - Bytes in big-endian order.
-* @returns Parsed bigint value.
-* @throws On wrong argument types. {@link TypeError}
-* @example
-* Read a scalar encoded in network byte order.
-*
-* ```ts
-* bytesToNumberBE(Uint8Array.of(1, 0));
-* ```
-*/
-function bytesToNumberBE(bytes) {
-	return hexToNumber(bytesToHex$1(bytes));
-}
-/**
-* Parses little-endian bytes into bigint.
-* @param bytes - Bytes in little-endian order.
-* @returns Parsed bigint value.
-* @throws On wrong argument types. {@link TypeError}
-* @example
-* Read a scalar encoded in little-endian form.
-*
-* ```ts
-* bytesToNumberLE(Uint8Array.of(1, 0));
-* ```
-*/
-function bytesToNumberLE(bytes) {
-	return hexToNumber(bytesToHex$1(copyBytes(abytes$1(bytes)).reverse()));
-}
-/**
-* Encodes a bigint into fixed-length big-endian bytes.
-* @param n - Number to encode.
-* @param len - Output length in bytes. Must be greater than zero.
-* @returns Big-endian byte array.
-* @throws On wrong argument ranges or values. {@link RangeError}
-* @throws If a documented runtime validation or state check fails. {@link Error}
-* @example
-* Serialize a scalar into a 32-byte field element.
-*
-* ```ts
-* numberToBytesBE(255n, 2);
-* ```
-*/
-function numberToBytesBE(n, len) {
-	anumber$1(len);
-	if (len === 0) throw new Error("zero output length is invalid");
-	n = abignumber(n);
-	const expectedLen = len * 2;
-	const hex = n.toString(16);
-	if (hex.length > expectedLen) throw new RangeError("number is too large");
-	return hexToBytes$1(hex.padStart(expectedLen, "0"));
-}
-/**
-* Encodes a bigint into fixed-length little-endian bytes.
-* @param n - Number to encode.
-* @param len - Output length in bytes.
-* @returns Little-endian byte array.
-* @throws On wrong argument ranges or values. {@link RangeError}
-* @throws If a documented runtime validation or state check fails. {@link Error}
-* @example
-* Serialize a scalar for little-endian protocols.
-*
-* ```ts
-* numberToBytesLE(255n, 2);
-* ```
-*/
-function numberToBytesLE(n, len) {
-	return numberToBytesBE(n, len).reverse();
-}
-/**
-* Copies Uint8Array. We can't use u8a.slice(), because u8a can be Buffer,
-* and Buffer#slice creates mutable copy. Never use Buffers!
-* @param bytes - Bytes to copy.
-* @returns Detached copy.
-* @example
-* Make an isolated copy before mutating serialized bytes.
-*
-* ```ts
-* copyBytes(Uint8Array.of(1, 2, 3));
-* ```
-*/
-function copyBytes(bytes) {
-	return Uint8Array.from(abytes(bytes));
-}
-/**
-* Checks whether n is non-negative bigint. Historical name.
-* @param n - candidate value
-* @returns `true` when the value is bigint and 0 or larger
-* @example
-* Check a candidate scalar before range validation.
-*
-* ```ts
-* isPosBig(2n);
-* ```
-*/
-function isPosBig(n) {
-	return typeof n === "bigint" && _0n$2 <= n;
-}
-/**
-* Checks whether a bigint lies inside a half-open range.
-* @param n - Candidate value.
-* @param min - Inclusive lower bound.
-* @param max - Exclusive upper bound.
-* @returns `true` when the value is inside the range.
-* @example
-* Check whether a candidate scalar fits the field order.
-*
-* ```ts
-* inRange(2n, 1n, 3n);
-* ```
-*/
-function inRange(n, min, max) {
-	return isPosBig(n) && isPosBig(min) && isPosBig(max) && min <= n && n < max;
-}
-/**
-* Asserts `min <= n < max`. NOTE: upper bound is exclusive.
-* @param title - Value label for error messages.
-* @param n - Candidate value.
-* @param min - Inclusive lower bound.
-* @param max - Exclusive upper bound.
-* Wrong-type inputs are not separated from out-of-range values here: they still flow through the
-* shared `RangeError` path because this is only a throwing wrapper around `inRange(...)`.
-* @throws On wrong argument ranges or values. {@link RangeError}
-* @example
-* Assert that a bigint stays within one half-open range.
-*
-* ```ts
-* aInRange('x', 2n, 1n, 256n);
-* ```
-*/
-function aInRange(title, n, min, max) {
-	if (!inRange(n, min, max)) throw new RangeError("expected valid " + title + ": " + min + " <= n < " + max + ", got " + n);
-}
-/**
-* Calculates amount of bits in a bigint.
-* Same as `n.toString(2).length`
-* TODO: merge with nLength in modular
-* @param n - Value to inspect.
-* @returns Bit length.
-* @throws If the value is negative. {@link Error}
-* @example
-* Measure the bit length of a scalar before serialization.
-*
-* ```ts
-* bitLen(8n);
-* ```
-*/
-function bitLen(n) {
-	if (n < _0n$2) throw new Error("expected non-negative bigint, got " + n);
-	return n === _0n$2 ? 0 : n.toString(2).length;
-}
-/**
-* Calculate mask for N bits. Not using ** operator with bigints because of old engines.
-* Same as BigInt(`0b${Array(i).fill('1').join('')}`)
-* @param n - Number of bits. Negative widths are currently passed through to raw bigint shift
-*   semantics and therefore produce `-1n`.
-* @returns Bitmask value.
-* @example
-* Calculate mask for N bits.
-*
-* ```ts
-* bitMask(4);
-* ```
-*/
-var bitMask = (n) => {
-	asafenumber(n, "n");
-	return (_1n$2 << BigInt(n)) - _1n$2;
-};
-/**
-* Minimal HMAC-DRBG from NIST 800-90 for RFC6979 sigs.
-* @param hashLen - Hash output size in bytes. Callers are expected to pass a positive length; `0`
-*   is not rejected here and would make the internal generate loop non-progressing.
-* @param qByteLen - Requested output size in bytes. Callers are expected to pass a positive length.
-* @param hmacFn - HMAC implementation.
-* @returns Function that will call DRBG until the predicate returns anything
-*   other than `undefined`.
-* @throws On wrong argument types. {@link TypeError}
-* @example
-* Build a deterministic nonce generator for RFC6979-style signing.
-*
-* ```ts
-* import { createHmacDrbg } from '@noble/curves/utils.js';
-* import { hmac } from '@noble/hashes/hmac.js';
-* import { sha256 } from '@noble/hashes/sha2.js';
-* const hmacFn = (key: Uint8Array, msg: Uint8Array) => hmac(sha256, key, msg);
-* const drbg = createHmacDrbg(32, 32, hmacFn);
-* const seed = new Uint8Array(32);
-* drbg(seed, (bytes) => bytes);
-* ```
-*/
-function createHmacDrbg(hashLen, qByteLen, hmacFn) {
-	anumber$1(hashLen, "hashLen");
-	anumber$1(qByteLen, "qByteLen");
-	if (typeof hmacFn !== "function") throw new TypeError("hmacFn must be a function");
-	const u8n = (len) => new Uint8Array(len);
-	const NULL = Uint8Array.of();
-	const byte0 = Uint8Array.of(0);
-	const byte1 = Uint8Array.of(1);
-	const _maxDrbgIters = 1e3;
-	let v = u8n(hashLen);
-	let k = u8n(hashLen);
-	let i = 0;
-	const reset = () => {
-		v.fill(1);
-		k.fill(0);
-		i = 0;
-	};
-	const h = (...msgs) => hmacFn(k, concatBytes(v, ...msgs));
-	const reseed = (seed = NULL) => {
-		k = h(byte0, seed);
-		v = h();
-		if (seed.length === 0) return;
-		k = h(byte1, seed);
-		v = h();
-	};
-	const gen = () => {
-		if (i++ >= _maxDrbgIters) throw new Error("drbg: tried max amount of iterations");
-		let len = 0;
-		const out = [];
-		while (len < qByteLen) {
-			v = h();
-			const sl = v.slice();
-			out.push(sl);
-			len += v.length;
-		}
-		return concatBytes(...out);
-	};
-	const genUntil = (seed, pred) => {
-		reset();
-		reseed(seed);
-		let res = void 0;
-		while ((res = pred(gen())) === void 0) reseed();
-		reset();
-		return res;
-	};
-	return genUntil;
-}
-/**
-* Validates declared required and optional field types on a plain object.
-* Extra keys are intentionally ignored because many callers validate only the subset they use from
-* richer option bags or runtime objects.
-* This walks field schemas and formats detailed errors, so avoid it on hot paths; use direct
-* one-line guards such as `aobject()`, `afunction()`, `abool()`, or `asafenumber()` instead.
-* @param object - Object to validate.
-* @param fields - Required field types.
-* @param optFields - Optional field types.
-* @param title - Object label included in thrown errors.
-* @throws On wrong argument types. {@link TypeError}
-* @example
-* Check user options before building a curve helper.
-*
-* ```ts
-* validateObject({ flag: true }, { flag: 'boolean' });
-* ```
-*/
-function validateObject(object, fields = {}, optFields = {}, title = "object") {
-	aobject(object, title);
-	aobject(fields, "fields");
-	aobject(optFields, "optFields");
-	function checkField(fieldName, expectedType, isOpt) {
-		const label = title === "object" ? `param "${String(fieldName)}"` : `"${title}.${String(fieldName)}"`;
-		const val = object[fieldName];
-		if (!Object.hasOwn(object, fieldName) && (isOpt ? val !== void 0 : expectedType !== "function")) throw new TypeError(`${label} is invalid: expected own property`);
-		if (isOpt && val === void 0) return;
-		const current = typeof val;
-		if (current !== expectedType || val === null) throw new TypeError(`${label} is invalid: expected ${expectedType}, got ${current}`);
-	}
-	const iter = (f, isOpt) => Object.entries(f).forEach(([k, v]) => checkField(k, v, isOpt));
-	iter(fields, false);
-	iter(optFields, true);
-}
-//#endregion
-//#region ../../../../../.pnpm-store/v11/links/@noble/curves/2.4.0/766129a921e8dfd2ef1de557b88b41133e3334d958e354fac1f5d17f98661627/node_modules/@noble/curves/abstract/modular.js
-/**
-* Utils for modular division and fields.
-* Field over 11 is a finite (Galois) field is integer number operations `mod 11`.
-* There is no division: it is replaced by modular multiplicative inverse.
-* @module
-*/
-/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
-var _0n$1 = /* @__PURE__ */ BigInt(0);
-var _1n$1 = /* @__PURE__ */ BigInt(1);
-var _2n = /* @__PURE__ */ BigInt(2);
-var _3n = /* @__PURE__ */ BigInt(3);
-var _4n$1 = /* @__PURE__ */ BigInt(4);
-var _5n = /* @__PURE__ */ BigInt(5);
-var _7n = /* @__PURE__ */ BigInt(7);
-var _8n = /* @__PURE__ */ BigInt(8);
-var _9n = /* @__PURE__ */ BigInt(9);
-var _15n = /* @__PURE__ */ BigInt(15);
-var _16n = /* @__PURE__ */ BigInt(16);
-var POW_WINDOWED_MIN = /* @__PURE__ */ BigInt("0x10000000000000000");
-/**
-* @param a - Dividend value.
-* @param b - Positive modulus.
-* @returns Reduced value in `[0, b)` only when `b` is positive.
-* @throws If the modulus is not positive. {@link Error}
-* @example
-* Normalize a bigint into one field residue.
-*
-* ```ts
-* mod(-1n, 5n);
-* ```
-*/
-function mod(a, b) {
-	if (b <= _0n$1) throw new Error("mod: expected positive modulus, got " + b);
-	const result = a % b;
-	return result >= _0n$1 ? result : b + result;
-}
-/**
-* Efficiently raise num to a power with modular reduction.
-* Unsafe in some contexts: uses ladder, so can expose bigint bits.
-* Low-level helper: callers that need canonical residues must pass a valid `num` for the chosen
-* modulus instead of relying on the `power===0/1` fast paths to normalize it.
-* @param num - Base value.
-* @param power - Exponent value.
-* @param modulo - Reduction modulus.
-* @returns Modular exponentiation result.
-* @throws If the modulus or exponent is invalid. {@link Error}
-* @example
-* Raise one bigint to a modular power.
-*
-* ```ts
-* pow(2n, 6n, 11n) // 64n % 11n == 9n
-* ```
-*/
-function pow(num, power, modulo) {
-	if (modulo <= _1n$1) throw new Error("pow: expected modulus > 1, got " + modulo);
-	if (typeof power !== "bigint") throw new TypeError("invalid exponent: expected bigint, got " + typeof power);
-	if (power < _0n$1) throw new Error("invalid exponent, negatives unsupported");
-	if (power === _0n$1) return _1n$1;
-	if (power === _1n$1) return num;
-	let d = num % modulo;
-	if (d < _0n$1) d += modulo;
-	if (power < POW_WINDOWED_MIN) {
-		let p = _1n$1;
-		while (power > _0n$1) {
-			if (power & _1n$1) p = p * d % modulo;
-			d = d * d % modulo;
-			power >>= _1n$1;
-		}
-		return p;
-	}
-	const digits = [];
-	while (power > _0n$1) {
-		digits.push(Number(power & _15n));
-		power >>= _4n$1;
-	}
-	const table = new Array(16);
-	table[0] = _1n$1;
-	table[1] = d;
-	for (let i = 2; i < 16; i++) table[i] = table[i - 1] * d % modulo;
-	let p = table[digits[digits.length - 1]];
-	for (let w = digits.length - 2; w >= 0; w--) {
-		p = p * p % modulo;
-		p = p * p % modulo;
-		p = p * p % modulo;
-		p = p * p % modulo;
-		const digit = digits[w];
-		if (digit !== 0) p = p * table[digit] % modulo;
-	}
-	return p;
-}
-/**
-* Does `x^(2^power)` mod p. `pow2(30, 4)` == `30^(2^4)`.
-* Low-level helper: callers that need canonical residues must pass a valid `x` for the chosen
-* modulus; the `power===0` fast path intentionally returns the input unchanged.
-* @param x - Base value.
-* @param power - Number of squarings.
-* @param modulo - Reduction modulus.
-* @returns Repeated-squaring result.
-* @throws If the exponent is negative. {@link Error}
-* @example
-* Apply repeated squaring inside one field.
-*
-* ```ts
-* pow2(3n, 2n, 11n);
-* ```
-*/
-function pow2(x, power, modulo) {
-	if (modulo <= _1n$1) throw new Error("pow2: expected modulus > 1, got " + modulo);
-	if (power < _0n$1) throw new Error("pow2: expected non-negative exponent, got " + power);
-	let res = x;
-	while (power-- > _0n$1) {
-		res *= res;
-		res %= modulo;
-	}
-	return res;
-}
-/**
-* Inverses number over modulo.
-* Implemented using the {@link https://brilliant.org/wiki/extended-euclidean-algorithm/ | extended Euclidean algorithm}.
-* @param number - Value to invert.
-* @param modulo - Modulus greater than 1.
-* @returns Multiplicative inverse.
-* @throws If the modulus is invalid or the inverse does not exist. {@link Error}
-* @example
-* Compute one modular inverse with the extended Euclidean algorithm.
-*
-* ```ts
-* invert(3n, 11n);
-* ```
-*/
-function invert(number, modulo) {
-	if (number === _0n$1) throw new Error("invert: expected non-zero number");
-	if (modulo <= _1n$1) throw new Error("invert: expected modulus > 1, got " + modulo);
-	let a = mod(number, modulo);
-	let b = modulo;
-	let x = _0n$1, u = _1n$1;
-	while (a !== _0n$1) {
-		const q = b / a;
-		const r = b - a * q;
-		const m = x - u * q;
-		b = a, a = r, x = u, u = m;
-	}
-	if (b !== _1n$1) throw new Error("invert: does not exist");
-	return mod(x, modulo);
-}
-/**
-* Inverses number over modulo using Fermat's little theorem: `a^(p-2) ≡ a⁻¹ (mod p)`.
-*
-* Unlike {@link invert} (extended Euclidean), the exponent `p-2` is a public constant, so the
-* underlying square-and-multiply has the same control flow for every secret `a`: there is no
-* data-dependent branching or loop count that could leak `a` through timing (e.g. Minerva-style
-* ECDSA nonce-inversion attacks). This is only "algorithmically" constant-time — JS bigint
-* multiplication/reduction is still value-dependent — and it is roughly 4x slower than
-* {@link invert}.
-*
-* REQUIRES a prime modulus; Fermat's theorem does not hold otherwise. The result is verified to be
-* a real inverse, so a non-prime modulus (or a non-invertible input) fails closed with an error
-* instead of returning a wrong value.
-* @param a - Value to invert.
-* @param prime - Prime modulus.
-* @returns Multiplicative inverse in `[1, prime)`.
-* @throws If the modulus is below 2, the input reduces to zero, or the inverse does not exist.
-*   {@link Error}
-* @example
-* Compute one modular inverse without secret-dependent branching.
-*
-* ```ts
-* invertCt(3n, 11n); // 4n, since 3 * 4 = 12 ≡ 1 (mod 11)
-* ```
-*/
-function invertCt(a, prime) {
-	if (prime <= _1n$1) throw new Error("invertCt: expected prime modulus > 1, got " + prime);
-	const an = mod(a, prime);
-	if (an === _0n$1) throw new Error("invertCt: expected non-zero number");
-	const inverse = pow(an, prime - _2n, prime);
-	if (mod(an * inverse, prime) !== _1n$1) throw new Error("invertCt: does not exist");
-	return inverse;
-}
-function assertIsSquare(Fp, root, n) {
-	const F = Fp;
-	if (!F.eql(F.sqr(root), n)) throw new Error("Cannot find square root");
-}
-function aoddModulus(order, fnName) {
-	if ((order & _1n$1) === _0n$1) throw new Error(fnName + ": expected odd modulus, got " + order);
-}
-function sqrt3mod4(Fp, n) {
-	const F = Fp;
-	const p1div4 = (F.ORDER + _1n$1) / _4n$1;
-	const root = F.pow(n, p1div4);
-	assertIsSquare(F, root, n);
-	return root;
-}
-function sqrt5mod8(Fp, n) {
-	const F = Fp;
-	const p5div8 = (F.ORDER - _5n) / _8n;
-	const n2 = F.mul(n, _2n);
-	const v = F.pow(n2, p5div8);
-	const nv = F.mul(n, v);
-	const i = F.mul(F.mul(nv, _2n), v);
-	const root = F.mul(nv, F.sub(i, F.ONE));
-	assertIsSquare(F, root, n);
-	return root;
-}
-function sqrt9mod16(P) {
-	const Fp_ = Field(P);
-	const tn = tonelliShanks(P);
-	const c1 = tn(Fp_, Fp_.neg(Fp_.ONE));
-	const c2 = tn(Fp_, c1);
-	const c3 = tn(Fp_, Fp_.neg(c1));
-	const c4 = (P + _7n) / _16n;
-	return ((Fp, n) => {
-		const F = Fp;
-		let tv1 = F.pow(n, c4);
-		let tv2 = F.mul(tv1, c1);
-		const tv3 = F.mul(tv1, c2);
-		const tv4 = F.mul(tv1, c3);
-		const e1 = F.eql(F.sqr(tv2), n);
-		const e2 = F.eql(F.sqr(tv3), n);
-		tv1 = F.cmov(tv1, tv2, e1);
-		tv2 = F.cmov(tv4, tv3, e2);
-		const e3 = F.eql(F.sqr(tv2), n);
-		const root = F.cmov(tv1, tv2, e3);
-		assertIsSquare(F, root, n);
-		return root;
-	});
-}
-/**
-* Tonelli-Shanks square root search algorithm.
-* This implementation is variable-time: it searches data-dependently for the first non-residue `Z`
-* and for the smallest `i` in the main loop, unlike RFC 9380 Appendix I.4's constant-time shape.
-* 1. {@link https://eprint.iacr.org/2012/685.pdf | eprint 2012/685}, page 12
-* 2. Square Roots from 1; 24, 51, 10 to Dan Shanks
-* @param P - field order
-* @returns function that takes field Fp (created from P) and number n
-* @throws If the field is too small, non-prime, or the square root does not exist. {@link Error}
-* @example
-* Construct a square-root helper for primes that need Tonelli-Shanks.
-*
-* ```ts
-* import { Field, tonelliShanks } from '@noble/curves/abstract/modular.js';
-* const Fp = Field(17n);
-* const sqrt = tonelliShanks(17n)(Fp, 4n);
-* ```
-*/
-function tonelliShanks(P) {
-	if (P < _3n) throw new Error("sqrt is not defined for small field");
-	aoddModulus(P, "tonelliShanks");
-	let Q = P - _1n$1;
-	let S = 0;
-	while (Q % _2n === _0n$1) {
-		Q /= _2n;
-		S++;
-	}
-	let Z = _2n;
-	const _Fp = Field(P);
-	while (FpLegendre(_Fp, Z) === 1) if (Z++ > 1e3) throw new Error("Cannot find square root: probably non-prime P");
-	if (S === 1) return sqrt3mod4;
-	let cc = _Fp.pow(Z, Q);
-	const Q1div2 = (Q + _1n$1) / _2n;
-	return function tonelliSlow(Fp, n) {
-		const F = Fp;
-		if (F.is0(n)) return n;
-		if (FpLegendre(F, n) !== 1) throw new Error("Cannot find square root");
-		let M = S;
-		let c = F.mul(F.ONE, cc);
-		let t = F.pow(n, Q);
-		let R = F.pow(n, Q1div2);
-		while (!F.eql(t, F.ONE)) {
-			if (F.is0(t)) throw new Error("Cannot find square root: probably non-prime P");
-			let i = 1;
-			let t_tmp = F.sqr(t);
-			while (!F.eql(t_tmp, F.ONE)) {
-				i++;
-				t_tmp = F.sqr(t_tmp);
-				if (i === M) throw new Error("Cannot find square root");
-			}
-			const exponent = _1n$1 << BigInt(M - i - 1);
-			const b = F.pow(c, exponent);
-			M = i;
-			c = F.sqr(b);
-			t = F.mul(t, c);
-			R = F.mul(R, b);
-		}
-		return R;
-	};
-}
-/**
-* Square root for a finite field. Will try optimized versions first:
-*
-* 1. P ≡ 3 (mod 4)
-* 2. P ≡ 5 (mod 8)
-* 3. P ≡ 9 (mod 16)
-* 4. Tonelli-Shanks algorithm
-*
-* Different algorithms can give different roots, it is up to user to decide which one they want.
-* For example there is FpSqrtOdd/FpSqrtEven to choose a root by oddness
-* (used for hash-to-curve).
-* @param P - Field order.
-* @returns Square-root helper. The generic fallback inherits Tonelli-Shanks' variable-time
-*   behavior and this selector assumes prime-field-style integer moduli.
-* @throws If the field is unsupported or the square root does not exist. {@link Error}
-* @example
-* Choose the square-root helper appropriate for one field modulus.
-*
-* ```ts
-* import { Field, FpSqrt } from '@noble/curves/abstract/modular.js';
-* const Fp = Field(17n);
-* const sqrt = FpSqrt(17n)(Fp, 4n);
-* ```
-*/
-function FpSqrt(P) {
-	aoddModulus(P, "Fp.sqrt");
-	if (P % _4n$1 === _3n) return sqrt3mod4;
-	if (P % _8n === _5n) return sqrt5mod8;
-	if (P % _16n === _9n) return sqrt9mod16(P);
-	return tonelliShanks(P);
-}
-/**
-* @param num - Value to inspect.
-* @param modulo - Field modulus.
-* @returns `true` when the least-significant little-endian bit is set.
-* @throws If the modulus is invalid for `mod(...)`. {@link Error}
-* @example
-* Inspect the low bit used by little-endian sign conventions.
-*
-* ```ts
-* isNegativeLE(3n, 11n);
-* ```
-*/
-var isNegativeLE = (num, modulo) => (mod(num, modulo) & _1n$1) === _1n$1;
-var FIELD_FIELDS = [
-	"create",
-	"isValid",
-	"is0",
-	"neg",
-	"inv",
-	"sqrt",
-	"sqr",
-	"eql",
-	"add",
-	"sub",
-	"mul",
-	"pow",
-	"div",
-	"addN",
-	"subN",
-	"mulN",
-	"sqrN"
-];
-/**
-* @param field - Field implementation.
-* @returns Validated field. This only checks the arithmetic subset needed by generic helpers; it
-*   does not guarantee full runtime-method coverage for serialization, batching, `cmov`, or
-*   field-specific extras beyond positive `BYTES` / `BITS`.
-* @throws If the field shape or numeric metadata are invalid. {@link Error}
-* @example
-* Check that a field implementation exposes the operations curve code expects.
-*
-* ```ts
-* import { Field, validateField } from '@noble/curves/abstract/modular.js';
-* const Fp = validateField(Field(17n));
-* ```
-*/
-function validateField(field) {
-	aobject(field, "field");
-	if (typeof field.ORDER !== "bigint") throw new TypeError("param \"ORDER\" is invalid: expected bigint, got " + typeof field.ORDER);
-	asafenumber(field.BYTES, "BYTES");
-	asafenumber(field.BITS, "BITS");
-	for (const name of FIELD_FIELDS) afunction(field[name], "field." + name);
-	if (field.BYTES < 1 || field.BITS < 1) throw new Error("invalid field: expected BYTES/BITS > 0");
-	if (field.ORDER <= _1n$1) throw new Error("invalid field: expected ORDER > 1, got " + field.ORDER);
-	return field;
-}
-function FpInvertBatch(Fp, nums, passZero = false) {
-	validateField(Fp);
-	aarray(nums, "nums");
-	abool(passZero, "passZero");
-	const F = Fp;
-	const inverted = new Array(nums.length).fill(passZero ? F.ZERO : void 0);
-	const multipliedAcc = nums.reduce((acc, num, i) => {
-		if (F.is0(num)) return acc;
-		inverted[i] = acc;
-		return F.mul(acc, num);
-	}, F.ONE);
-	const invertedAcc = F.inv(multipliedAcc);
-	nums.reduceRight((acc, num, i) => {
-		if (F.is0(num)) return acc;
-		inverted[i] = F.mul(acc, inverted[i]);
-		return F.mul(acc, num);
-	}, invertedAcc);
-	return inverted;
-}
-/**
-* Legendre symbol.
-* Legendre constant is used to calculate Legendre symbol (a | p)
-* which denotes the value of a^((p-1)/2) (mod p).
-*
-* * (a | p) ≡ 1    if a is a square (mod p), quadratic residue
-* * (a | p) ≡ -1   if a is not a square (mod p), quadratic non residue
-* * (a | p) ≡ 0    if a ≡ 0 (mod p)
-* @param Fp - Field implementation.
-* @param n - Value to inspect.
-* @returns Legendre symbol.
-* @throws If the powered value does not match a valid Legendre symbol. {@link Error}
-* @example
-* Compute the Legendre symbol of one field element.
-*
-* ```ts
-* import { Field, FpLegendre } from '@noble/curves/abstract/modular.js';
-* const Fp = Field(17n);
-* const symbol = FpLegendre(Fp, 4n);
-* ```
-*/
-function FpLegendre(Fp, n) {
-	validateField(Fp);
-	const F = Fp;
-	aoddModulus(F.ORDER, "FpLegendre");
-	const p1mod2 = (F.ORDER - _1n$1) / _2n;
-	const powered = F.pow(n, p1mod2);
-	const yes = F.eql(powered, F.ONE);
-	const zero = F.eql(powered, F.ZERO);
-	const no = F.eql(powered, F.neg(F.ONE));
-	if (!yes && !zero && !no) throw new Error("invalid Legendre symbol result");
-	return yes ? 1 : zero ? 0 : -1;
-}
-/**
-* @param n - Curve order. Callers are expected to pass a positive order.
-* @param nBitLength - Optional cached bit length. Callers are expected to pass a positive cached
-*   value when overriding the derived bit length.
-* @returns Byte and bit lengths.
-* @throws If the order or cached bit length is invalid. {@link Error}
-* @example
-* Measure the encoding sizes needed for one modulus.
-*
-* ```ts
-* nLength(255n);
-* ```
-*/
-function nLength(n, nBitLength) {
-	if (nBitLength !== void 0) anumber(nBitLength);
-	if (n <= _0n$1) throw new Error("invalid n length: expected positive n, got " + n);
-	if (nBitLength !== void 0 && nBitLength < 1) throw new Error("invalid n length: expected positive bit length, got " + nBitLength);
-	const bits = bitLen(n);
-	if (nBitLength !== void 0 && nBitLength < bits) throw new Error(`invalid n length: expected nBitLength (${nBitLength}) >= bitLen(n) (${bits})`);
-	const _nBitLength = nBitLength !== void 0 ? nBitLength : bits;
-	return {
-		nBitLength: _nBitLength,
-		nByteLength: Math.ceil(_nBitLength / 8)
-	};
-}
-var FIELD_SQRT = /* @__PURE__ */ new WeakMap();
-var _Field = class {
-	ORDER;
-	BITS;
-	BYTES;
-	isLE;
-	ZERO = _0n$1;
-	ONE = _1n$1;
-	_lengths;
-	_mod;
-	constructor(ORDER, opts = {}) {
-		if (ORDER <= _1n$1) throw new Error("invalid field: expected ORDER > 1, got " + ORDER);
-		let _nbitLength = void 0;
-		this.isLE = false;
-		if (opts != null && typeof opts === "object") {
-			if (typeof opts.BITS === "number") _nbitLength = opts.BITS;
-			if (typeof opts.sqrt === "function") Object.defineProperty(this, "sqrt", {
-				value: opts.sqrt,
-				enumerable: true
-			});
-			if (typeof opts.isLE === "boolean") this.isLE = opts.isLE;
-			if (opts.allowedLengths) this._lengths = Object.freeze(opts.allowedLengths.slice());
-			if (typeof opts.modFromBytes === "boolean") this._mod = opts.modFromBytes;
-		}
-		const { nBitLength, nByteLength } = nLength(ORDER, _nbitLength);
-		if (nByteLength > 2048) throw new Error("invalid field: expected ORDER of <= 2048 bytes");
-		this.ORDER = ORDER;
-		this.BITS = nBitLength;
-		this.BYTES = nByteLength;
-		Object.freeze(this);
-	}
-	create(num) {
-		return mod(num, this.ORDER);
-	}
-	isValid(num) {
-		if (typeof num !== "bigint") throw new TypeError("invalid field element: expected bigint, got " + typeof num);
-		return _0n$1 <= num && num < this.ORDER;
-	}
-	is0(num) {
-		return num === _0n$1;
-	}
-	isValidNot0(num) {
-		return !this.is0(num) && this.isValid(num);
-	}
-	isOdd(num) {
-		return (num & _1n$1) === _1n$1;
-	}
-	neg(num) {
-		return mod(-num, this.ORDER);
-	}
-	eql(lhs, rhs) {
-		return lhs === rhs;
-	}
-	sqr(num) {
-		return mod(num * num, this.ORDER);
-	}
-	add(lhs, rhs) {
-		return mod(lhs + rhs, this.ORDER);
-	}
-	sub(lhs, rhs) {
-		return mod(lhs - rhs, this.ORDER);
-	}
-	mul(lhs, rhs) {
-		return mod(lhs * rhs, this.ORDER);
-	}
-	pow(num, power) {
-		return pow(num, power, this.ORDER);
-	}
-	div(lhs, rhs) {
-		return mod(lhs * invert(rhs, this.ORDER), this.ORDER);
-	}
-	sqrN(num) {
-		return num * num;
-	}
-	addN(lhs, rhs) {
-		return lhs + rhs;
-	}
-	subN(lhs, rhs) {
-		return lhs - rhs;
-	}
-	mulN(lhs, rhs) {
-		return lhs * rhs;
-	}
-	inv(num) {
-		return invert(num, this.ORDER);
-	}
-	sqrt(num) {
-		let sqrt = FIELD_SQRT.get(this);
-		if (!sqrt) FIELD_SQRT.set(this, sqrt = FpSqrt(this.ORDER));
-		return sqrt(this, num);
-	}
-	toBytes(num) {
-		return this.isLE ? numberToBytesLE(num, this.BYTES) : numberToBytesBE(num, this.BYTES);
-	}
-	fromBytes(bytes, skipValidation = false) {
-		abytes(bytes);
-		const { _lengths: allowedLengths, BYTES, isLE, ORDER, _mod: modFromBytes } = this;
-		if (allowedLengths) {
-			if (bytes.length < 1 || !allowedLengths.includes(bytes.length) || bytes.length > BYTES) throw new Error("Field.fromBytes: expected " + allowedLengths + " bytes, got " + bytes.length);
-			const padded = new Uint8Array(BYTES);
-			padded.set(bytes, isLE ? 0 : padded.length - bytes.length);
-			bytes = padded;
-		}
-		if (bytes.length !== BYTES) throw new Error("Field.fromBytes: expected " + BYTES + " bytes, got " + bytes.length);
-		let scalar = isLE ? bytesToNumberLE(bytes) : bytesToNumberBE(bytes);
-		if (modFromBytes) scalar = mod(scalar, ORDER);
-		if (!skipValidation) {
-			if (!this.isValid(scalar)) throw new Error("invalid field element: outside of range 0..ORDER");
-		}
-		return scalar;
-	}
-	invertBatch(lst) {
-		return FpInvertBatch(this, lst, true);
-	}
-	cmov(a, b, condition) {
-		abool(condition, "condition");
-		return condition ? b : a;
-	}
-};
-/**
-* Creates a finite field. Major performance optimizations:
-* * 1. Denormalized operations like mulN instead of mul.
-* * 2. Identical object shape: never add or remove keys.
-* * 3. Frozen stable object shape; the lazy sqrt cache lives in a module-level `WeakMap`.
-* Fragile: always run a benchmark on a change.
-* Security note: operations and low-level serializers like `toBytes` don't check `isValid` for
-* all elements for performance and protocol-flexibility reasons; callers are responsible for
-* supplying valid elements when they need canonical field behavior.
-* This is low-level code, please make sure you know what you're doing.
-*
-* Note about field properties:
-* * CHARACTERISTIC p = prime number, number of elements in main subgroup.
-* * ORDER q = similar to cofactor in curves, may be composite `q = p^m`.
-*
-* @param ORDER - field order, probably prime, or could be composite
-* @param opts - Field options such as bit length or endianness. See {@link FieldOpts}.
-* @returns Frozen field instance with a stable object shape. This wrapper forwards `opts` straight
-*   into `_Field`, so it inherits `_Field`'s assumptions about cached sizes and `allowedLengths`.
-* @example
-* Construct one prime field with optional overrides.
-*
-* ```ts
-* Field(11n);
-* ```
-*/
-function Field(ORDER, opts = {}) {
-	Object.freeze(_Field.prototype);
-	return new _Field(ORDER, opts);
-}
-/**
-* Returns total number of bytes consumed by the field element.
-* For example, 32 bytes for usual 256-bit weierstrass curve.
-* @param fieldOrder - number of field elements, usually CURVE.n. Callers are expected to pass an
-*   order greater than 1.
-* @returns byte length of field
-* @throws If the field order is not a bigint. {@link Error}
-* @example
-* Read the fixed-width byte length of one field.
-*
-* ```ts
-* getFieldBytesLength(255n);
-* ```
-*/
-function getFieldBytesLength(fieldOrder) {
-	if (typeof fieldOrder !== "bigint") throw new Error("field order must be bigint");
-	if (fieldOrder <= _1n$1) throw new Error("field order must be greater than 1");
-	const bitLength = bitLen(fieldOrder - _1n$1);
-	return Math.ceil(bitLength / 8);
-}
-/**
-* Returns minimal amount of bytes that can be safely reduced
-* by field order.
-* Should be 2^-128 for 128-bit curve such as P256.
-* This is the reduction / modulo-bias lower bound; higher-level helpers may still impose a larger
-* absolute floor for policy reasons.
-* @param fieldOrder - number of field elements greater than 1, usually CURVE.n.
-* @returns byte length of target hash
-* @throws If the field order is invalid. {@link Error}
-* @example
-* Compute the minimum hash length needed for field reduction.
-*
-* ```ts
-* getMinHashLength(255n);
-* ```
-*/
-function getMinHashLength(fieldOrder) {
-	const length = getFieldBytesLength(fieldOrder);
-	return length + Math.ceil(length / 2);
-}
-/**
-* "Constant-time" private key generation utility.
-* Can take (n + n/2) or more bytes of uniform input e.g. from CSPRNG or KDF
-* and convert them into private scalar, with the modulo bias being negligible.
-* Needs at least 48 bytes of input for 32-byte private key. The implementation also keeps a hard
-* 16-byte minimum even when `getMinHashLength(...)` is smaller, so toy-small inputs do not look
-* accidentally acceptable for real scalar derivation.
-* See {@link https://research.kudelskisecurity.com/2020/07/28/the-definitive-guide-to-modulo-bias-and-how-to-avoid-it/ | Kudelski's modulo-bias guide},
-* {@link https://csrc.nist.gov/publications/detail/fips/186/5/final | FIPS 186-5 appendix A.2}, and
-* {@link https://www.rfc-editor.org/rfc/rfc9380#section-5 | RFC 9380 section 5}. Unlike RFC 9380
-* `hash_to_field`, this helper intentionally maps into the non-zero private-scalar range `1..n-1`.
-* @param key - Uniform input bytes.
-* @param fieldOrder - Size of subgroup.
-* @param isLE - interpret hash bytes as LE num
-* @returns valid private scalar
-* @throws If the hash length or field order is invalid for scalar reduction. {@link Error}
-* @example
-* Map hash output into a private scalar range.
-*
-* ```ts
-* mapHashToField(new Uint8Array(48).fill(1), 255n);
-* ```
-*/
-function mapHashToField(key, fieldOrder, isLE = false) {
-	abytes(key);
-	const len = key.length;
-	const fieldLen = getFieldBytesLength(fieldOrder);
-	const minLen = Math.max(getMinHashLength(fieldOrder), 16);
-	if (len < minLen || len > 1024) throw new Error("expected " + minLen + "-1024 bytes of input, got " + len);
-	const reduced = mod(isLE ? bytesToNumberLE(key) : bytesToNumberBE(key), fieldOrder - _1n$1) + _1n$1;
-	return isLE ? numberToBytesLE(reduced, fieldLen) : numberToBytesBE(reduced, fieldLen);
-}
-//#endregion
-//#region ../../../../../.pnpm-store/v11/links/@noble/curves/2.4.0/766129a921e8dfd2ef1de557b88b41133e3334d958e354fac1f5d17f98661627/node_modules/@noble/curves/abstract/curve.js
-/**
-* Methods for elliptic curve multiplication by scalars.
-* Contains wNAF-based ScalarMultiplier, pippenger.
-* @module
-*/
-/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
-var _0n = /* @__PURE__ */ BigInt(0);
-var _1n = /* @__PURE__ */ BigInt(1);
-var _4n = /* @__PURE__ */ BigInt(4);
-var BLIND_BYTES = 16;
-var BLIND_BITS = 128;
-var FW_WINDOW = 5;
-var TABLE_BYTES_MAX = /* @__PURE__ */ (() => 2 ** 31)();
-/**
-* Validates the static surface of a point constructor.
-* This is only a cheap sanity check for the constructor hooks and fields consumed by generic
-* factories; it does not certify `BASE`/`ZERO` semantics or prove the curve implementation itself.
-* @param Point - Runtime point constructor.
-* @throws On missing constructor hooks or malformed field metadata. {@link TypeError}
-* @example
-* Check that one point constructor exposes the static hooks generic helpers need.
-*
-* ```ts
-* import { ed25519 } from '@noble/curves/ed25519.js';
-* import { validatePointCons } from '@noble/curves/abstract/curve.js';
-* validatePointCons(ed25519.Point);
-* ```
-*/
-function validatePointCons(Point) {
-	const pc = Point;
-	if (typeof pc !== "function") throw new TypeError("\"Point\" expected constructor, got type=" + typeof Point);
-	afunction(pc.fromAffine, "Point.fromAffine");
-	afunction(pc.fromBytes, "Point.fromBytes");
-	afunction(pc.fromHex, "Point.fromHex");
-	aobject(pc.BASE, "Point.BASE");
-	aobject(pc.ZERO, "Point.ZERO");
-	validateField(pc.Fp);
-	validateField(pc.Fn);
-}
-/**
-* Takes a bunch of Projective Points but executes only one
-* inversion on all of them. Inversion is very slow operation,
-* so this improves performance massively.
-* Optimization: converts a list of projective points to a list of identical points with Z=1.
-* Input points are left unchanged; the normalized points are returned as fresh instances.
-* @param c - Point constructor.
-* @param points - Projective points.
-* @returns Fresh projective points reconstructed from normalized affine coordinates.
-* @example
-* Batch-normalize projective points with a single shared inversion.
-*
-* ```ts
-* import { normalizeZ } from '@noble/curves/abstract/curve.js';
-* import { p256 } from '@noble/curves/nist.js';
-* const points = normalizeZ(p256.Point, [p256.Point.BASE, p256.Point.BASE.double()]);
-* ```
-*/
-function normalizeZ(c, points) {
-	validatePointCons(c);
-	validateMSMPoints(points, c);
-	const invertedZs = FpInvertBatch(c.Fp, points.map((p) => p.Z));
-	return points.map((p, i) => c.fromAffine(p.toAffine(invertedZs[i])));
-}
-function validateW(W, bits, min = 1) {
-	if (!Number.isSafeInteger(W) || W < min || W > bits) throw new Error("invalid window size, expected [" + min + ".." + bits + "], got W=" + W);
-}
-function validateTableBytes(numPoints, fpBytes) {
-	const bytes = numPoints * (4 * fpBytes + 128);
-	if (bytes > TABLE_BYTES_MAX) throw new Error("invalid window size: table would need ~" + Math.ceil(bytes / 2 ** 20) + " MiB, max " + TABLE_BYTES_MAX / 2 ** 20 + " MiB");
-}
-/**
-* Probes an RNG once, at construction time: returns `undefined` when it is unavailable —
-* throws or returns malformed bytes — so callers can downgrade to their unblinded /
-* deterministic constant-time fallback. Blinding is defense-in-depth (DPA/template
-* hardening), not a correctness or key-secrecy requirement, so availability-based
-* downgrade is acceptable.
-*
-* The downgrade decision is deliberately static. After a successful probe the RNG becomes
-* part of the trusted contract: later misbehavior must fail closed in per-call validation
-* (throw), never downgrade — a dynamic fallback would let a tampered RNG silently strip
-* blinding on demand. A probe can only ever classify broken environments, not adversarial
-* RNGs: a stateful RNG can always behave while probed and misbehave later.
-* @param randomBytes - RNG to probe, or `undefined` when the environment provides none.
-* @param length - Byte length requested from the probe call.
-* @returns The RNG when the probe produced `length` valid bytes; `undefined` otherwise.
-* @example
-* Probe an RNG once before enabling scalar blinding.
-*
-* ```ts
-* import { probeRandomBytes } from '@noble/curves/abstract/curve.js';
-* import { randomBytes } from '@noble/hashes/utils.js';
-* const rng = probeRandomBytes(randomBytes, 16);
-* ```
-*/
-function probeRandomBytes(randomBytes, length) {
-	if (randomBytes === void 0) return void 0;
-	afunction(randomBytes, "randomBytes");
-	try {
-		const probe = randomBytes(length);
-		if (!isBytes(probe) || probe.length !== length) return void 0;
-	} catch {
-		return;
-	}
-	return randomBytes;
-}
-function validateMSMPoints(points, c) {
-	aarray(points, "points");
-	points.forEach((p, i) => {
-		if (!(p instanceof c)) throw new Error("invalid point at index " + i);
-	});
-}
-function validateMSMScalars(scalars, field, maxScalar) {
-	if (!Array.isArray(scalars)) throw new Error("array of scalars expected");
-	scalars.forEach((s, i) => {
-		if (!(maxScalar === void 0 ? field.isValid(s) : isPosBig(s) && s < maxScalar)) throw new Error("invalid scalar at index " + i);
-	});
-}
-var pointWindowSizes = /* @__PURE__ */ new WeakMap();
-function getWindowSize(P) {
-	return pointWindowSizes.get(P) || 1;
-}
-/** Table of odd multiples [1P, 3P, ..., (2⋅size−1)P]; width-W wNAF uses size = 2^(W−2). */
-function oddMultiples(p, size) {
-	const dbl = p.double();
-	const t = [p];
-	for (let j = 1; j < size; j++) t.push(t[j - 1].add(dbl));
-	return t;
-}
-/**
-* Width-W wNAF signed-digit recoding (W >= 2), LSB-first: digits are 0 or odd with
-* |digit| < 2^(W−1); nonzero density ~1/(W+1) (a nonzero digit is followed by W−1 zeros).
-*/
-function wnafDigits(n, W) {
-	const size = 2 ** W;
-	const half = size / 2;
-	const mask = BigInt(size - 1);
-	const d = [];
-	while (n > _0n) {
-		let w = 0;
-		if (n & _1n) {
-			w = Number(n & mask);
-			if (w >= half) w -= size;
-			n -= BigInt(w);
-		}
-		d.push(w);
-		n >>= _1n;
-	}
-	return d;
-}
-/**
-* Fixed-position signed-window recoding for precomputed wNAF: `n = Σ digits[w]⋅2^(w⋅W)` with
-* digits in `[−2^(W−1)+1, 2^(W−1)]`. Digit count is fixed by `windows` (callers reserve one
-* extra window for the final carry), so recoding length does not depend on the scalar.
-*/
-function signedWindowDigits(n, W, windows) {
-	const size = 2 ** W;
-	const half = size / 2;
-	const mask = BigInt(size - 1);
-	const shiftBy = BigInt(W);
-	const d = [];
-	for (let w = 0; w < windows; w++) {
-		let v = Number(n & mask);
-		n >>= shiftBy;
-		if (v > half) {
-			v -= size;
-			n += _1n;
-		}
-		d.push(v);
-	}
-	if (n !== _0n) throw new Error("invalid wnaf");
-	return d;
-}
-/**
-* Shared vartime walk over per-scalar wNAF digit streams: one doubling of a single shared
-* accumulator per bit position of the longest recoding, one signed table addition per
-* nonzero digit. `tables[i]` must hold the odd multiples of the i-th point.
-*/
-function wnafWalk(zero, tables, digits) {
-	let max = 0;
-	for (const d of digits) max = Math.max(max, d.length);
-	let acc = zero;
-	for (let bit = max - 1; bit >= 0; bit--) {
-		if (bit !== max - 1) acc = acc.double();
-		for (let i = 0; i < digits.length; i++) {
-			const w = digits[i][bit];
-			if (w) {
-				const item = tables[i][Math.abs(w) - 1 >> 1];
-				acc = acc.add(w < 0 ? item.negate() : item);
-			}
-		}
-	}
-	return acc;
-}
-/**
-* Elliptic curve multiplication of Point by scalar.
-* Routes between cached-table, fixed-window, and one-shot wNAF paths; entry points validate
-* their own scalars (`mulCT`/`mulCTBlinded`: `1 <= s < Fn.ORDER`; `mulUnsafe`: up to the
-* `Fn.ORDER^4` DoS cap via {@link mulAddUnsafe}).
-* Table generation is expensive and happens on first call of `multiply()`
-* (or eagerly via `precompute(W, false)`). By default, `BASE` point is precomputed.
-*
-* Cached algorithm is signed fixed-window wNAF:
-* - table stores, for every window w, the multiples `[1..2^(W−1)]⋅2^(w⋅W)⋅P` — all doublings
-*   are baked in, so a multiplication is exactly one table addition per window
-* - window count is fixed (`ceil(bits/W) + 1`), so the point-operation count is scalar-independent
-*   (basis of the constant-time path)
-* - for a 256-bit curve and W=6: 44⋅32 = 1408 table points, 44 additions per multiply
-* - secret scalars are additionally blinded (see {@link ScalarMultiplier.mulCTBlinded}), which
-*   widens tables by 128 bits
-* @param Point - Point constructor.
-* @param randomBytes - RNG used for scalar blinding; required by the blinded secret path.
-* @example
-* Elliptic curve multiplication of Point by scalar.
-*
-* ```ts
-* import { ScalarMultiplier } from '@noble/curves/abstract/curve.js';
-* import { p256 } from '@noble/curves/nist.js';
-* const mul = new ScalarMultiplier(p256.Point);
-* ```
-*/
-var ScalarMultiplier = class {
-	Point;
-	BASE;
-	ZERO;
-	randomBytes;
-	wnafPrecomputes = /* @__PURE__ */ new WeakMap();
-	baseCanBeBlinded;
-	bits;
-	constructor(Point, randomBytes) {
-		validatePointCons(Point);
-		this.randomBytes = probeRandomBytes(randomBytes, BLIND_BYTES);
-		this.Point = Point;
-		this.BASE = Point.BASE;
-		this.ZERO = Point.ZERO;
-		this.bits = Point.Fn.BITS;
-	}
-	/**
-	* Creates a signed fixed-window wNAF precomputation table: for every window w, the
-	* multiples `[1..2^(W−1)]⋅2^(w⋅W)⋅P`, flattened. All doublings are baked into the table,
-	* so cached multiplication is additions-only. `windows = ceil(bits/W) + 1`: the extra
-	* window absorbs the final carry of signed-digit recoding.
-	* For a 256-bit curve and W=6, the table is 44⋅32 = 1408 points.
-	* @param point - Point instance
-	* @param W - window size
-	* @param bits - scalar bitlength the table must cover
-	*/
-	buildWnafTable(point, W, bits) {
-		const windows = Math.ceil(bits / W) + 1;
-		const half = 2 ** (W - 1);
-		const comp = [];
-		let base = point;
-		for (let w = 0; w < windows; w++) {
-			let acc = base;
-			for (let i = 0; i < half; i++) {
-				comp.push(acc);
-				acc = acc.add(base);
-			}
-			base = comp[comp.length - 1].double();
-		}
-		return {
-			W,
-			bits,
-			windows,
-			comp
-		};
-	}
-	/**
-	* Implements ec multiplication using precomputed signed fixed-window wNAF tables.
-	* Constant-time: fixed window count with one table addition per window — zero digits feed
-	* the fake accumulator — and no doublings; the lookup scans the whole window slice.
-	* Scalar bounds are validated by the public entry points ({@link ScalarMultiplier.mulCT},
-	* {@link ScalarMultiplier.mulCTBlinded}, {@link ScalarMultiplier.mulUnsafe});
-	* signedWindowDigits throws if `n` exceeds the table.
-	* @returns real and fake (for const-time) points
-	*/
-	wnafCachedCT(precomputes, n) {
-		const { W, windows, comp } = precomputes;
-		const half = 2 ** (W - 1);
-		const digits = signedWindowDigits(n, W, windows);
-		let p = this.ZERO;
-		let f = this.BASE;
-		for (let w = 0; w < windows; w++) {
-			const digit = digits[w];
-			const start = w * half;
-			const idx = Math.abs(digit) - 1;
-			let sel = comp[start];
-			for (let i = 1; i < half; i++) sel = i === idx ? comp[start + i] : sel;
-			const neg = sel.negate();
-			if (digit === 0) f = f.add(comp[start]);
-			else p = p.add(digit < 0 ? neg : sel);
-		}
-		return {
-			p,
-			f
-		};
-	}
-	getWnafPrecomputes(W, point, bits, transform) {
-		let entries = this.wnafPrecomputes.get(point);
-		let comp = entries?.find((entry) => entry.W === W && entry.bits === bits);
-		if (!comp) {
-			comp = this.buildWnafTable(point, W, bits);
-			if (typeof transform === "function") comp = {
-				...comp,
-				comp: transform(comp.comp)
-			};
-			if (!entries) {
-				entries = [];
-				this.wnafPrecomputes.set(point, entries);
-			}
-			entries.push(comp);
-		}
-		return comp;
-	}
-	assertPoint(point) {
-		if (!(point instanceof this.Point)) throw new TypeError("\"point\" expected Point instance, got type=" + typeof point);
-	}
-	validateMulInput(point, scalar) {
-		this.assertPoint(point);
-		if (!inRange(scalar, _1n, this.Point.Fn.ORDER)) throw new Error("invalid scalar");
-	}
-	runCT(point, n, bits, transform) {
-		const W = getWindowSize(point);
-		if (W === 1) return this.fixedWindowCT(point, n, bits);
-		return this.wnafCachedCT(this.getWnafPrecomputes(W, point, bits, transform), n);
-	}
-	mulCT(point, scalar, transform) {
-		this.validateMulInput(point, scalar);
-		return this.runCT(point, scalar, this.bits, transform);
-	}
-	mulCTBlinded(point, scalar, transform) {
-		this.validateMulInput(point, scalar);
-		if (this.randomBytes === void 0) throw new Error("randomBytes is required for scalar blinding");
-		const bits = this.Point.Fn.BITS + BLIND_BITS;
-		const blind = this.randomBytes(BLIND_BYTES);
-		if (!isBytes(blind) || blind.length !== BLIND_BYTES) throw new Error("randomBytes returned invalid byte array");
-		blind[0] = blind[0] & 63 | 128;
-		const n = scalar + bytesToNumberBE(blind) * this.Point.Fn.ORDER;
-		return this.runCT(point, n, bits, transform);
-	}
-	/**
-	* Constant-time multiplication `n*point` for an un-precomputed point, via a small fixed window.
-	* A cached wNAF table only pays off when reused; a flat 2^FW_WINDOW table (`size-1` adds) is
-	* far cheaper to build for a single use. The point-operation sequence is independent of `n`:
-	* build the table, then per window exactly FW_WINDOW doublings, a data-oblivious scan over
-	* every table entry, and one addition (adds the identity when the window digit is 0 — never
-	* skipped).
-	*
-	* `n` must be `< 2^bits`. Assumes complete addition (adding the identity costs the same as any
-	* add), which holds for the Weierstrass/Edwards point types used here. The table is left in
-	* projective form (no normalizeZ): normalizing this small a table costs more than the
-	* mixed-add savings it would buy for a single multiply.
-	* @returns real point `p`; `f` duplicates it only to match {@link wnafCachedCT}'s return shape
-	* (this path needs no fake accumulator — its op-count is already scalar-independent).
-	*/
-	fixedWindowCT(point, n, bits) {
-		const W = FW_WINDOW;
-		const size = 32;
-		const mask = bitMask(W);
-		const table = new Array(size);
-		table[0] = this.ZERO;
-		for (let i = 1; i < size; i++) table[i] = table[i - 1].add(point);
-		const windows = Math.ceil(bits / W);
-		let acc = this.ZERO;
-		for (let window = windows - 1; window >= 0; window--) {
-			if (window !== windows - 1) for (let d = 0; d < W; d++) acc = acc.double();
-			const digit = Number(n >> BigInt(window * W) & mask);
-			let sel = table[0];
-			for (let i = 1; i < size; i++) sel = i === digit ? table[i] : sel;
-			acc = acc.add(sel);
-		}
-		return {
-			p: acc,
-			f: acc
-		};
-	}
-	shouldBlind(point, cofactor) {
-		if (this.randomBytes === void 0) return false;
-		if (cofactor === _1n) return true;
-		if (point !== this.BASE) return false;
-		if (this.baseCanBeBlinded === void 0) this.baseCanBeBlinded = this.mulUnsafe(this.BASE, this.Point.Fn.ORDER).is0();
-		return this.baseCanBeBlinded;
-	}
-	mulSecret(point, scalar, cofactor, transform) {
-		return this.shouldBlind(point, cofactor) ? this.mulCTBlinded(point, scalar, transform) : this.mulCT(point, scalar, transform);
-	}
-	mulUnsafe(point, scalar, transform) {
-		this.assertPoint(point);
-		if (!isPosBig(scalar)) throw new Error("invalid scalar");
-		const W = getWindowSize(point);
-		if (W === 1 || scalar >= this.Point.Fn.ORDER) return mulAddUnsafe(this.Point, [point], [scalar], true);
-		const precomputes = this.getWnafPrecomputes(W, point, this.bits, transform);
-		return this.wnafCachedCT(precomputes, scalar).p;
-	}
-	setWindowSize(point, W) {
-		this.assertPoint(point);
-		validateW(W, this.bits);
-		validateTableBytes((Math.ceil((this.bits + BLIND_BITS) / W) + 1) * 2 ** (W - 1), this.Point.Fp.BYTES);
-		pointWindowSizes.set(point, W);
-		this.wnafPrecomputes.delete(point);
-	}
-	hasWindowSize(point) {
-		return getWindowSize(point) !== 1;
-	}
-};
-/**
-* Combined multi-scalar multiplication `Σ scalars[i]⋅points[i]` via interleaved width-4 wNAF
-* (Strauss–Shamir). Every input gets its own table of odd multiples `[1P, 3P, 5P, 7P]` and
-* signed-digit recoding, but all walks share one doubling chain, so total cost is
-* `~bits` doublings + `L⋅bits/5` additions instead of `L⋅bits` doublings for separate
-* multiplications. Intended for the 2-4 point shapes of signature verification
-* (`R = u1⋅G + u2⋅P`); use {@link pippenger} for larger batches.
-*
-* Not constant-time: only for public inputs. Scalars must satisfy `0 <= s < Fn.ORDER`;
-* fold negative signs into the points before calling.
-* @param c - Point constructor.
-* @param points - Array of curve points.
-* @param scalars - Array of non-negative scalars, same length as points.
-* @param allowOversized - Replace the `s < Fn.ORDER` scalar check with a `Fn.ORDER^4` DoS cap.
-*   Off by default. For scalars that must NOT be reduced mod ORDER: torsion checks
-*   (`Fn.ORDER⋅P ≟ O`) and cofactor-clearing multiples. Walk length grows with `bitLen(s)`.
-* @returns Combined multiplication result; identity for empty input.
-* @throws If the point set or scalar set is invalid. {@link Error}
-* @example
-* Combined multi-scalar multiplication via Strauss–Shamir.
-*
-* ```ts
-* import { mulAddUnsafe } from '@noble/curves/abstract/curve.js';
-* import { p256 } from '@noble/curves/nist.js';
-* const G = p256.Point.BASE;
-* const R = mulAddUnsafe(p256.Point, [G, G.double()], [2n, 3n]); // 2⋅G + 3⋅(2⋅G)
-* ```
-*/
-function mulAddUnsafe(c, points, scalars, allowOversized = false) {
-	validatePointCons(c);
-	validateMSMPoints(points, c);
-	abool(allowOversized, "allowOversized");
-	validateMSMScalars(scalars, c.Fn, allowOversized ? c.Fn.ORDER ** _4n : void 0);
-	if (points.length !== scalars.length) throw new Error("arrays of points and scalars must have equal length");
-	const tables = points.map((p) => oddMultiples(p, 4));
-	const digits = scalars.map((n) => wnafDigits(n, 4));
-	return wnafWalk(c.ZERO, tables, digits);
-}
-function createField(order, field, isLE) {
-	if (field) {
-		if (field.ORDER !== order) throw new Error("Field.ORDER must match order: Fp == p, Fn == n");
-		validateField(field);
-		return field;
-	} else return Field(order, { isLE });
-}
-/**
-* Validates basic CURVE shape and field membership, then creates fields.
-* This does not prove that the generator is on-curve, that subgroup/order data are consistent, or
-* that the curve equation itself is otherwise sane.
-* @param type - Curve family.
-* @param CURVE - Curve parameters.
-* @param curveOpts - Optional field overrides. See {@link FpFn}:
-*   - `Fp` (optional): Optional base-field override.
-*   - `Fn` (optional): Optional scalar-field override.
-* @param FpFnLE - Whether field encoding is little-endian.
-* @returns Frozen curve parameters and fields.
-* @throws If the curve parameters or field overrides are invalid. {@link Error}
-* @example
-* Build curve fields from raw constants before constructing a curve instance.
-*
-* ```ts
-* const curve = createCurveFields('weierstrass', {
-*   p: 17n,
-*   n: 19n,
-*   h: 1n,
-*   a: 2n,
-*   b: 2n,
-*   Gx: 5n,
-*   Gy: 1n,
-* });
-* ```
-*/
-function createCurveFields(type, CURVE, curveOpts = {}, FpFnLE) {
-	if (type !== "weierstrass" && type !== "edwards") throw new Error("expected curve type \"weierstrass\" or \"edwards\"");
-	if (FpFnLE === void 0) FpFnLE = type === "edwards";
-	if (!CURVE || typeof CURVE !== "object") throw new Error(`expected valid ${type} CURVE object`);
-	validateObject(curveOpts);
-	for (const p of [
-		"p",
-		"n",
-		"h"
-	]) {
-		const val = CURVE[p];
-		if (!(isPosBig(val) && val !== _0n)) throw new Error(`CURVE.${p} must be positive bigint`);
-	}
-	const Fp = createField(CURVE.p, curveOpts.Fp, FpFnLE);
-	const Fn = createField(CURVE.n, curveOpts.Fn, FpFnLE);
-	const params = [
-		"Gx",
-		"Gy",
-		"a",
-		type === "weierstrass" ? "b" : "d"
-	];
-	for (const p of params) if (!Fp.isValid(CURVE[p])) throw new Error(`CURVE.${p} must be valid field element of CURVE.Fp`);
-	CURVE = Object.freeze(Object.assign({}, CURVE));
-	return {
-		CURVE,
-		Fp,
-		Fn
-	};
-}
-/**
-* @param randomSecretKey - Secret-key generator.
-* @param getPublicKey - Public-key derivation helper.
-* @returns Keypair generator.
-* @example
-* Build a `keygen()` helper from existing secret-key and public-key primitives.
-*
-* ```ts
-* import { createKeygen } from '@noble/curves/abstract/curve.js';
-* import { p256 } from '@noble/curves/nist.js';
-* const keygen = createKeygen(p256.utils.randomSecretKey, p256.getPublicKey);
-* const pair = keygen();
-* ```
-*/
-function createKeygen(randomSecretKey, getPublicKey) {
-	return function keygen(seed) {
-		const secretKey = randomSecretKey(seed);
-		return {
-			secretKey,
-			publicKey: getPublicKey(secretKey)
-		};
-	};
-}
-//#endregion
-export { isBytes as A, clean as B, bytesToHex as C, copyBytes as D, concatBytes as E, sha512 as F, randomBytes$1 as H, abytes$1 as I, aexists as L, randomBytes as M, validateObject as N, createHmacDrbg as O, sha256 as P, ahash as R, bitMask as S, bytesToNumberLE as T, concatBytes$1 as V, abool as _, normalizeZ as a, astring as b, FpLegendre as c, isNegativeLE as d, mapHashToField as f, abignumber as g, aInRange as h, mulAddUnsafe as i, numberToHexUnpadded as j, hexToBytes as k, getMinHashLength as l, pow2 as m, createCurveFields as n, probeRandomBytes as o, mod as p, createKeygen as r, validatePointCons as s, ScalarMultiplier as t, invertCt as u, abytes as v, bytesToNumberBE as w, bitLen as x, asafenumber as y, aoutput as z };