@kangentic/protocol 0.14.0 → 0.15.0

package/dist/index.cjs

@@ -41,6 +41,8 @@ __export(index_exports, {
   PUSH_ENVELOPE_MAX_FUTURE_SKEW_MS: () => PUSH_ENVELOPE_MAX_FUTURE_SKEW_MS,
   SecretstreamState: () => SecretstreamState,
   SessionFrameKind: () => SessionFrameKind,
+  UNSUPPORTED_VERB_ERROR_CODE: () => UNSUPPORTED_VERB_ERROR_CODE,
+  UnsupportedVerbError: () => UnsupportedVerbError,
   X25519_KEY_LENGTH: () => X25519_KEY_LENGTH,
   bytesToHex: () => bytesToHex,
   capabilitySetFromArray: () => capabilitySetFromArray,
@@ -77,6 +79,7 @@ __export(index_exports, {
   isRosterEntryExpired: () => isRosterEntryExpired,
   isSecureRelayAddress: () => isSecureRelayAddress,
   isTodoRole: () => isTodoRole,
+  isUnsupportedVerbError: () => isUnsupportedVerbError,
   openPairingConfirm: () => openPairingConfirm,
   openPushEnvelope: () => openPushEnvelope,
   parseActivityEventPayload: () => parseActivityEventPayload,
@@ -94,6 +97,7 @@ __export(index_exports, {
   parseSessionEventWire: () => parseSessionEventWire,
   parseSessionSummaryWire: () => parseSessionSummaryWire,
   parseSessionUsageWire: () => parseSessionUsageWire,
+  parseStartSessionResponsePayload: () => parseStartSessionResponsePayload,
   parseTerminalDimensionsWire: () => parseTerminalDimensionsWire,
   parseTranscriptEntriesWire: () => parseTranscriptEntriesWire,
   parseTranscriptEventPayload: () => parseTranscriptEventPayload,
@@ -116,64 +120,116 @@ function encodeProtocolVersion(version = PROTOCOL_VERSION) {
   return new TextEncoder().encode(`kangentic-bridge-v${version}`);
 }
 
+// ../../node_modules/@noble/hashes/_u64.js
+var U32_MASK64 = /* @__PURE__ */ (() => BigInt(2 ** 32 - 1))();
+var _32n = /* @__PURE__ */ BigInt(32);
+function fromBig(n, le = false) {
+  if (le)
+    return { h: Number(n & U32_MASK64), l: Number(n >> _32n & U32_MASK64) };
+  return { h: Number(n >> _32n & U32_MASK64) | 0, l: Number(n & U32_MASK64) | 0 };
+}
+function split(lst, le = false) {
+  const len = lst.length;
+  let Ah = new Uint32Array(len);
+  let Al = new Uint32Array(len);
+  for (let i2 = 0; i2 < len; i2++) {
+    const { h, l } = fromBig(lst[i2], le);
+    [Ah[i2], Al[i2]] = [h, l];
+  }
+  return [Ah, Al];
+}
+var fromNumH = (n) => n / 2 ** 32 | 0;
+var fromNumL = (n) => n >>> 0;
+function setU64FromNum(view, byteOffset, n, isLE3) {
+  const h = fromNumH(n);
+  const l = fromNumL(n);
+  view.setUint32(byteOffset, isLE3 ? l : h, isLE3);
+  view.setUint32(byteOffset + 4, isLE3 ? h : l, isLE3);
+}
+var shrSH = (h, _l, s) => h >>> s;
+var shrSL = (h, l, s) => h << 32 - s | l >>> s;
+var rotrSH = (h, l, s) => h >>> s | l << 32 - s;
+var rotrSL = (h, l, s) => h << 32 - s | l >>> s;
+var rotrBH = (h, l, s) => h << 64 - s | l >>> s - 32;
+var rotrBL = (h, l, s) => h >>> s - 32 | l << 64 - s;
+function add(Ah, Al, Bh, Bl) {
+  const l = (Al >>> 0) + (Bl >>> 0);
+  return { h: Ah + Bh + (l / 2 ** 32 | 0) | 0, l: l | 0 };
+}
+var add3L = (Al, Bl, Cl) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0);
+var add3H = (low, Ah, Bh, Ch) => Ah + Bh + Ch + (low / 2 ** 32 | 0) | 0;
+var add4L = (Al, Bl, Cl, Dl) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0);
+var add4H = (low, Ah, Bh, Ch, Dh) => Ah + Bh + Ch + Dh + (low / 2 ** 32 | 0) | 0;
+var add5L = (Al, Bl, Cl, Dl, El) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0) + (El >>> 0);
+var add5H = (low, Ah, Bh, Ch, Dh, Eh) => Ah + Bh + Ch + Dh + Eh + (low / 2 ** 32 | 0) | 0;
+
 // ../../node_modules/@noble/hashes/utils.js
 function isBytes(a) {
   return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array" && "BYTES_PER_ELEMENT" in a && a.BYTES_PER_ELEMENT === 1;
 }
+var atitle = (title) => title ? `"${title}" ` : "";
 function anumber(n, title = "") {
-  if (typeof n !== "number") {
-    const prefix = title && `"${title}" `;
-    throw new TypeError(`${prefix}expected number, got ${typeof n}`);
-  }
-  if (!Number.isSafeInteger(n) || n < 0) {
-    const prefix = title && `"${title}" `;
-    throw new RangeError(`${prefix}expected integer >= 0, got ${n}`);
-  }
+  if (typeof n !== "number")
+    throw new TypeError(atitle(title) + "expected number, got " + typeof n);
+  if (!Number.isSafeInteger(n) || n < 0)
+    throw new RangeError(atitle(title) + "expected integer >= 0, got " + n);
+  return n;
 }
 function abytes(value, length, title = "") {
+  if (isBytes(value) && (length === void 0 || value.length === length))
+    return value;
+  if (length !== void 0)
+    anumber(length, "length");
   const bytes = isBytes(value);
-  const len = value?.length;
-  const needsLen = length !== void 0;
-  if (!bytes || needsLen && len !== length) {
-    const prefix = title && `"${title}" `;
-    const ofLen = needsLen ? ` of length ${length}` : "";
-    const got = bytes ? `length=${len}` : `type=${typeof value}`;
-    const message = prefix + "expected Uint8Array" + ofLen + ", got " + got;
-    if (!bytes)
-      throw new TypeError(message);
-    throw new RangeError(message);
-  }
-  return value;
+  const ofLen = length !== void 0 ? ` of length ${length}` : "";
+  const got = bytes ? `length=${value.length}` : `type=${typeof value}`;
+  const message = atitle(title) + "expected Uint8Array" + ofLen + ", got " + got;
+  if (!bytes)
+    throw new TypeError(message);
+  throw new RangeError(message);
+}
+function copyBytes(bytes) {
+  return Uint8Array.from(abytes(bytes));
 }
 function ahash(h) {
   if (typeof h !== "function" || typeof h.create !== "function")
-    throw new TypeError("Hash must wrapped by utils.createHasher");
+    throw new TypeError("expected hash wrapped by utils.createHasher");
   anumber(h.outputLen);
   anumber(h.blockLen);
-  if (h.outputLen < 1)
-    throw new Error('"outputLen" must be >= 1');
-  if (h.blockLen < 1)
-    throw new Error('"blockLen" must be >= 1');
+  if (h.outputLen < 1 || h.blockLen < 1)
+    throw new Error("hash blockLen / outputLen must be >= 1");
 }
+var aobject = (value, label) => {
+  if (value === null || typeof value !== "object" || Array.isArray(value))
+    throw new TypeError((label === "object" ? "" : `"${label}" `) + "expected object, got type=" + typeof value);
+};
+var aopts = (value, label) => {
+  aobject(value, label);
+  const proto = Object.getPrototypeOf(value);
+  if (proto !== Object.prototype && proto !== null)
+    throw new TypeError(`"${label}" expected plain object`);
+  if (Object.hasOwn(value, "__proto__"))
+    throw new TypeError(`"${label}.__proto__" is not allowed`);
+};
 function aexists(instance, checkFinished = true) {
   if (instance.destroyed)
-    throw new Error("Hash instance has been destroyed");
+    throw new Error("hash was destroyed");
   if (checkFinished && instance.finished)
-    throw new Error("Hash#digest() has already been called");
+    throw new Error("digest() was already called");
 }
 function aoutput(out, instance) {
-  abytes(out, void 0, "digestInto() output");
+  abytes(out, void 0, "output");
   const min = instance.outputLen;
-  if (out.length < min) {
-    throw new RangeError('"digestInto() output" expected to be of length >=' + min);
+  if (!(out.length >= min)) {
+    throw new RangeError('"output" expected length >= ' + min);
   }
 }
 function u32(arr) {
   return new Uint32Array(arr.buffer, arr.byteOffset, Math.floor(arr.byteLength / 4));
 }
 function clean(...arrays) {
-  for (let i = 0; i < arrays.length; i++) {
-    arrays[i].fill(0);
+  for (let i2 = 0; i2 < arrays.length; i2++) {
+    arrays[i2].fill(0);
   }
 }
 function createView(arr) {
@@ -188,8 +244,8 @@ function byteSwap(word) {
 }
 var swap8IfBE = isLE ? (n) => n : (n) => byteSwap(n) >>> 0;
 function byteSwap32(arr) {
-  for (let i = 0; i < arr.length; i++) {
-    arr[i] = byteSwap(arr[i]);
+  for (let i2 = 0; i2 < arr.length; i2++) {
+    arr[i2] = byteSwap(arr[i2]);
   }
   return arr;
 }
@@ -198,26 +254,19 @@ var hasHexBuiltin = /* @__PURE__ */ (() => (
   // @ts-ignore
   typeof Uint8Array.from([]).toHex === "function" && typeof Uint8Array.fromHex === "function"
 ))();
-var hexes = /* @__PURE__ */ Array.from({ length: 256 }, (_, i) => i.toString(16).padStart(2, "0"));
+var hexes = /* @__PURE__ */ Array.from({ length: 256 }, (_, i2) => i2.toString(16).padStart(2, "0"));
 function bytesToHex(bytes) {
   abytes(bytes);
   if (hasHexBuiltin)
     return bytes.toHex();
   let hex = "";
-  for (let i = 0; i < bytes.length; i++) {
-    hex += hexes[bytes[i]];
+  for (let i2 = 0; i2 < bytes.length; i2++) {
+    hex += hexes[bytes[i2]];
   }
   return hex;
 }
-var asciis = { _0: 48, _9: 57, A: 65, F: 70, a: 97, f: 102 };
 function asciiToBase16(ch) {
-  if (ch >= asciis._0 && ch <= asciis._9)
-    return ch - asciis._0;
-  if (ch >= asciis.A && ch <= asciis.F)
-    return ch - (asciis.A - 10);
-  if (ch >= asciis.a && ch <= asciis.f)
-    return ch - (asciis.a - 10);
-  return;
+  return ch >= 48 && ch <= 57 ? ch - 48 : ch >= 65 && ch <= 70 ? ch - (65 - 10) : ch >= 97 && ch <= 102 ? ch - (97 - 10) : void 0;
 }
 function hexToBytes(hex) {
   if (typeof hex !== "string")
@@ -249,20 +298,30 @@ function hexToBytes(hex) {
 }
 function concatBytes(...arrays) {
   let sum = 0;
-  for (let i = 0; i < arrays.length; i++) {
-    const a = arrays[i];
+  for (let i2 = 0; i2 < arrays.length; i2++) {
+    const a = arrays[i2];
     abytes(a);
     sum += a.length;
   }
   const res = new Uint8Array(sum);
-  for (let i = 0, pad = 0; i < arrays.length; i++) {
-    const a = arrays[i];
+  for (let i2 = 0, pad = 0; i2 < arrays.length; i2++) {
+    const a = arrays[i2];
     res.set(a, pad);
     pad += a.length;
   }
   return res;
 }
+function checkOpts(defaults, opts, title = "opts") {
+  aopts(defaults, "defaults");
+  if (opts !== void 0)
+    aopts(opts, title);
+  const merged = Object.assign(/* @__PURE__ */ Object.create(null), defaults, opts);
+  return merged;
+}
 function createHasher(hashCons, info = {}) {
+  if (typeof hashCons !== "function")
+    throw new TypeError('"hashCons" expected function, got type=' + typeof hashCons);
+  info = checkOpts({}, info, "info");
   const hashC = (msg, opts) => hashCons(opts).update(msg).digest();
   const tmp = hashCons(void 0);
   hashC.outputLen = tmp.outputLen;
@@ -314,24 +373,28 @@ var HashMD = class {
     abytes(data);
     const { view, buffer, blockLen } = this;
     const len = data.length;
+    let processed = false;
     for (let pos = 0; pos < len; ) {
       const take = Math.min(blockLen - this.pos, len - pos);
       if (take === blockLen) {
         const dataView = createView(data);
         for (; blockLen <= len - pos; pos += blockLen)
           this.process(dataView, pos);
+        processed = true;
         continue;
       }
-      buffer.set(data.subarray(pos, pos + take), this.pos);
+      buffer.set(pos === 0 && take === len ? data : data.subarray(pos, pos + take), this.pos);
       this.pos += take;
       pos += take;
       if (this.pos === blockLen) {
         this.process(view, 0);
         this.pos = 0;
+        processed = true;
       }
     }
     this.length += data.length;
-    this.roundClean();
+    if (processed)
+      this.roundClean();
     return this;
   }
   digestInto(out) {
@@ -341,25 +404,22 @@ var HashMD = class {
     const { buffer, view, blockLen, isLE: isLE3 } = this;
     let { pos } = this;
     buffer[pos++] = 128;
-    clean(this.buffer.subarray(pos));
+    buffer.fill(0, pos);
     if (this.padOffset > blockLen - pos) {
       this.process(view, 0);
-      pos = 0;
+      buffer.fill(0);
     }
-    for (let i = pos; i < blockLen; i++)
-      buffer[i] = 0;
-    view.setBigUint64(blockLen - 8, BigInt(this.length * 8), isLE3);
+    setU64FromNum(view, blockLen - 8, this.length * 8, isLE3);
     this.process(view, 0);
-    const oview = createView(out);
+    this.roundClean();
+    const oview = out === buffer ? view : createView(out);
     const len = this.outputLen;
-    if (len % 4)
-      throw new Error("_sha2: outputLen must be aligned to 32bit");
     const outLen = len / 4;
     const state = this.get();
-    if (outLen > state.length)
-      throw new Error("_sha2: outputLen bigger than state");
-    for (let i = 0; i < outLen; i++)
-      oview.setUint32(4 * i, state[i], isLE3);
+    if (len % 4 || outLen > state.length)
+      throw new Error("invalid outputLen");
+    for (let i2 = 0; i2 < outLen; i2++)
+      oview.setUint32(4 * i2, state[i2], isLE3);
   }
   digest() {
     const { buffer, outputLen } = this;
@@ -368,15 +428,13 @@ var HashMD = class {
     this.destroy();
     return res;
   }
-  _cloneInto(to) {
-    to ||= new this.constructor();
-    to.set(...this.get());
-    const { blockLen, buffer, length, finished, destroyed, pos } = this;
+  _cloneIntoMeta(to) {
+    const { buffer, length, finished, destroyed, pos } = this;
     to.destroyed = destroyed;
     to.finished = finished;
     to.length = length;
     to.pos = pos;
-    if (length % blockLen)
+    if (pos)
       to.buffer.set(buffer);
     return to;
   }
@@ -413,41 +471,6 @@ var SHA512_IV = /* @__PURE__ */ Uint32Array.from([
   327033209
 ]);
 
-// ../../node_modules/@noble/hashes/_u64.js
-var U32_MASK64 = /* @__PURE__ */ BigInt(2 ** 32 - 1);
-var _32n = /* @__PURE__ */ BigInt(32);
-function fromBig(n, le = false) {
-  if (le)
-    return { h: Number(n & U32_MASK64), l: Number(n >> _32n & U32_MASK64) };
-  return { h: Number(n >> _32n & U32_MASK64) | 0, l: Number(n & U32_MASK64) | 0 };
-}
-function split(lst, le = false) {
-  const len = lst.length;
-  let Ah = new Uint32Array(len);
-  let Al = new Uint32Array(len);
-  for (let i = 0; i < len; i++) {
-    const { h, l } = fromBig(lst[i], le);
-    [Ah[i], Al[i]] = [h, l];
-  }
-  return [Ah, Al];
-}
-var shrSH = (h, _l, s) => h >>> s;
-var shrSL = (h, l, s) => h << 32 - s | l >>> s;
-var rotrSH = (h, l, s) => h >>> s | l << 32 - s;
-var rotrSL = (h, l, s) => h << 32 - s | l >>> s;
-var rotrBH = (h, l, s) => h << 64 - s | l >>> s - 32;
-var rotrBL = (h, l, s) => h >>> s - 32 | l << 64 - s;
-function add(Ah, Al, Bh, Bl) {
-  const l = (Al >>> 0) + (Bl >>> 0);
-  return { h: Ah + Bh + (l / 2 ** 32 | 0) | 0, l: l | 0 };
-}
-var add3L = (Al, Bl, Cl) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0);
-var add3H = (low, Ah, Bh, Ch) => Ah + Bh + Ch + (low / 2 ** 32 | 0) | 0;
-var add4L = (Al, Bl, Cl, Dl) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0);
-var add4H = (low, Ah, Bh, Ch, Dh) => Ah + Bh + Ch + Dh + (low / 2 ** 32 | 0) | 0;
-var add5L = (Al, Bl, Cl, Dl, El) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0) + (El >>> 0);
-var add5H = (low, Ah, Bh, Ch, Dh, Eh) => Ah + Bh + Ch + Dh + Eh + (low / 2 ** 32 | 0) | 0;
-
 // ../../node_modules/@noble/hashes/sha2.js
 var K512 = /* @__PURE__ */ (() => split([
   "0x428a2f98d728ae22",
@@ -536,8 +559,45 @@ var SHA512_Kl = /* @__PURE__ */ (() => K512[1])();
 var SHA512_W_H = /* @__PURE__ */ new Uint32Array(80);
 var SHA512_W_L = /* @__PURE__ */ new Uint32Array(80);
 var SHA2_64B = class extends HashMD {
-  constructor(outputLen) {
+  // We cannot use array here since array allows indexing by variable
+  // which means optimizer/compiler cannot use registers.
+  // h -- high 32 bits, l -- low 32 bits
+  // Numeric initializers matter: starting the fields as `undefined` changes
+  // V8's field representation and slows hashing down (measured on sha256).
+  Ah = 0;
+  Al = 0;
+  Bh = 0;
+  Bl = 0;
+  Ch = 0;
+  Cl = 0;
+  Dh = 0;
+  Dl = 0;
+  Eh = 0;
+  El = 0;
+  Fh = 0;
+  Fl = 0;
+  Gh = 0;
+  Gl = 0;
+  Hh = 0;
+  Hl = 0;
+  constructor(outputLen, IV) {
     super(128, outputLen, 16, false);
+    this.Ah = IV[0] | 0;
+    this.Al = IV[1] | 0;
+    this.Bh = IV[2] | 0;
+    this.Bl = IV[3] | 0;
+    this.Ch = IV[4] | 0;
+    this.Cl = IV[5] | 0;
+    this.Dh = IV[6] | 0;
+    this.Dl = IV[7] | 0;
+    this.Eh = IV[8] | 0;
+    this.El = IV[9] | 0;
+    this.Fh = IV[10] | 0;
+    this.Fl = IV[11] | 0;
+    this.Gh = IV[12] | 0;
+    this.Gl = IV[13] | 0;
+    this.Hh = IV[14] | 0;
+    this.Hl = IV[15] | 0;
   }
   // prettier-ignore
   get() {
@@ -563,33 +623,37 @@ var SHA2_64B = class extends HashMD {
     this.Hh = Hh | 0;
     this.Hl = Hl | 0;
   }
+  _cloneInto(to) {
+    (to ||= new this.constructor()).set(...this.get());
+    return this._cloneIntoMeta(to);
+  }
   process(view, offset) {
-    for (let i = 0; i < 16; i++, offset += 4) {
-      SHA512_W_H[i] = view.getUint32(offset);
-      SHA512_W_L[i] = view.getUint32(offset += 4);
+    for (let i2 = 0; i2 < 16; i2++, offset += 4) {
+      SHA512_W_H[i2] = view.getUint32(offset);
+      SHA512_W_L[i2] = view.getUint32(offset += 4);
     }
-    for (let i = 16; i < 80; i++) {
-      const W15h = SHA512_W_H[i - 15] | 0;
-      const W15l = SHA512_W_L[i - 15] | 0;
+    for (let i2 = 16; i2 < 80; i2++) {
+      const W15h = SHA512_W_H[i2 - 15] | 0;
+      const W15l = SHA512_W_L[i2 - 15] | 0;
       const s0h = rotrSH(W15h, W15l, 1) ^ rotrSH(W15h, W15l, 8) ^ shrSH(W15h, W15l, 7);
       const s0l = rotrSL(W15h, W15l, 1) ^ rotrSL(W15h, W15l, 8) ^ shrSL(W15h, W15l, 7);
-      const W2h = SHA512_W_H[i - 2] | 0;
-      const W2l = SHA512_W_L[i - 2] | 0;
+      const W2h = SHA512_W_H[i2 - 2] | 0;
+      const W2l = SHA512_W_L[i2 - 2] | 0;
       const s1h = rotrSH(W2h, W2l, 19) ^ rotrBH(W2h, W2l, 61) ^ shrSH(W2h, W2l, 6);
       const s1l = rotrSL(W2h, W2l, 19) ^ rotrBL(W2h, W2l, 61) ^ shrSL(W2h, W2l, 6);
-      const SUMl = add4L(s0l, s1l, SHA512_W_L[i - 7], SHA512_W_L[i - 16]);
-      const SUMh = add4H(SUMl, s0h, s1h, SHA512_W_H[i - 7], SHA512_W_H[i - 16]);
-      SHA512_W_H[i] = SUMh | 0;
-      SHA512_W_L[i] = SUMl | 0;
+      const SUMl = add4L(s0l, s1l, SHA512_W_L[i2 - 7], SHA512_W_L[i2 - 16]);
+      const SUMh = add4H(SUMl, s0h, s1h, SHA512_W_H[i2 - 7], SHA512_W_H[i2 - 16]);
+      SHA512_W_H[i2] = SUMh | 0;
+      SHA512_W_L[i2] = SUMl | 0;
     }
     let { Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl } = this;
-    for (let i = 0; i < 80; i++) {
+    for (let i2 = 0; i2 < 80; i2++) {
       const sigma1h = rotrSH(Eh, El, 14) ^ rotrSH(Eh, El, 18) ^ rotrBH(Eh, El, 41);
       const sigma1l = rotrSL(Eh, El, 14) ^ rotrSL(Eh, El, 18) ^ rotrBL(Eh, El, 41);
       const CHIh = Eh & Fh ^ ~Eh & Gh;
       const CHIl = El & Fl ^ ~El & Gl;
-      const T1ll = add5L(Hl, sigma1l, CHIl, SHA512_Kl[i], SHA512_W_L[i]);
-      const T1h = add5H(T1ll, Hh, sigma1h, CHIh, SHA512_Kh[i], SHA512_W_H[i]);
+      const T1ll = add5L(Hl, sigma1l, CHIl, SHA512_Kl[i2], SHA512_W_L[i2]);
+      const T1h = add5H(T1ll, Hh, sigma1h, CHIh, SHA512_Kh[i2], SHA512_W_H[i2]);
       const T1l = T1ll | 0;
       const sigma0h = rotrSH(Ah, Al, 28) ^ rotrBH(Ah, Al, 34) ^ rotrBH(Ah, Al, 39);
       const sigma0l = rotrSL(Ah, Al, 28) ^ rotrBL(Ah, Al, 34) ^ rotrBL(Ah, Al, 39);
@@ -632,24 +696,8 @@ var SHA2_64B = class extends HashMD {
   }
 };
 var _SHA512 = class extends SHA2_64B {
-  Ah = SHA512_IV[0] | 0;
-  Al = SHA512_IV[1] | 0;
-  Bh = SHA512_IV[2] | 0;
-  Bl = SHA512_IV[3] | 0;
-  Ch = SHA512_IV[4] | 0;
-  Cl = SHA512_IV[5] | 0;
-  Dh = SHA512_IV[6] | 0;
-  Dl = SHA512_IV[7] | 0;
-  Eh = SHA512_IV[8] | 0;
-  El = SHA512_IV[9] | 0;
-  Fh = SHA512_IV[10] | 0;
-  Fl = SHA512_IV[11] | 0;
-  Gh = SHA512_IV[12] | 0;
-  Gl = SHA512_IV[13] | 0;
-  Hh = SHA512_IV[14] | 0;
-  Hl = SHA512_IV[15] | 0;
   constructor() {
-    super(64);
+    super(64, SHA512_IV);
   }
 };
 var sha512 = /* @__PURE__ */ createHasher(
@@ -658,8 +706,26 @@ var sha512 = /* @__PURE__ */ createHasher(
 );
 
 // ../../node_modules/@noble/curves/utils.js
+function aarray(item, title, inner = () => {
+}) {
+  if (!Array.isArray(item))
+    throw new TypeError(`"${title}" expected array, got type=${typeof item}`);
+  for (let i2 = 0; i2 < item.length; i2++)
+    inner(item[i2], `${title}[${i2}]`);
+  return item;
+}
 var abytes2 = (value, length, title) => abytes(value, length, title);
 var anumber2 = anumber;
+function aobject2(value, title = "object") {
+  if (value === null || typeof value !== "object" || Array.isArray(value))
+    throw new TypeError(title === "object" ? "expected valid options object" : `"${title}" expected object, got type=${typeof value}`);
+  return value;
+}
+function afunction(value, title) {
+  if (typeof value !== "function")
+    throw new TypeError(`"${title}" is invalid: expected function, got ${typeof value}`);
+  return value;
+}
 var bytesToHex2 = bytesToHex;
 var concatBytes2 = (...arrays) => concatBytes(...arrays);
 var hexToBytes2 = (hex) => hexToBytes(hex);
@@ -667,11 +733,10 @@ var isBytes2 = isBytes;
 var randomBytes2 = (bytesLength) => randomBytes(bytesLength);
 var _0n = /* @__PURE__ */ BigInt(0);
 var _1n = /* @__PURE__ */ BigInt(1);
+var atitle2 = (title) => title ? `"${title}" ` : "";
 function abool(value, title = "") {
-  if (typeof value !== "boolean") {
-    const prefix = title && `"${title}" `;
-    throw new TypeError(prefix + "expected boolean, got type=" + typeof value);
-  }
+  if (typeof value !== "boolean")
+    throw new TypeError(atitle2(title) + "expected boolean, got type=" + typeof value);
   return value;
 }
 function abignumber(n) {
@@ -701,46 +766,28 @@ function bytesToNumberBE(bytes) {
   return hexToNumber(bytesToHex(bytes));
 }
 function bytesToNumberLE(bytes) {
-  return hexToNumber(bytesToHex(copyBytes(abytes(bytes)).reverse()));
+  return hexToNumber(bytesToHex(copyBytes2(abytes(bytes)).reverse()));
 }
 function numberToBytesBE(n, len) {
   anumber(len);
   if (len === 0)
-    throw new RangeError("zero length");
+    throw new Error("zero output length is invalid");
   n = abignumber(n);
+  const expectedLen = len * 2;
   const hex = n.toString(16);
-  if (hex.length > len * 2)
-    throw new RangeError("number too large");
-  return hexToBytes(hex.padStart(len * 2, "0"));
+  if (hex.length > expectedLen)
+    throw new RangeError("number is too large");
+  return hexToBytes(hex.padStart(expectedLen, "0"));
 }
 function numberToBytesLE(n, len) {
   return numberToBytesBE(n, len).reverse();
 }
-function equalBytes(a, b) {
-  a = abytes2(a);
-  b = abytes2(b);
-  if (a.length !== b.length)
-    return false;
-  let diff = 0;
-  for (let i = 0; i < a.length; i++)
-    diff |= a[i] ^ b[i];
-  return diff === 0;
-}
-function copyBytes(bytes) {
+function copyBytes2(bytes) {
   return Uint8Array.from(abytes2(bytes));
 }
-function asciiToBytes(ascii) {
-  if (typeof ascii !== "string")
-    throw new TypeError("ascii string expected, got " + typeof ascii);
-  return Uint8Array.from(ascii, (c, i) => {
-    const charCode = c.charCodeAt(0);
-    if (c.length !== 1 || charCode > 127) {
-      throw new RangeError(`string contains non-ASCII character "${ascii[i]}" with code ${charCode} at position ${i}`);
-    }
-    return charCode;
-  });
+function isPosBig(n) {
+  return typeof n === "bigint" && _0n <= n;
 }
-var isPosBig = (n) => typeof n === "bigint" && _0n <= n;
 function inRange(n, min, max2) {
   return isPosBig(n) && isPosBig(min) && isPosBig(max2) && min <= n && n < max2;
 }
@@ -751,32 +798,32 @@ function aInRange(title, n, min, max2) {
 function bitLen(n) {
   if (n < _0n)
     throw new Error("expected non-negative bigint, got " + n);
-  let len;
-  for (len = 0; n > _0n; n >>= _1n, len += 1)
-    ;
-  return len;
+  return n === _0n ? 0 : n.toString(2).length;
 }
-var bitMask = (n) => (_1n << BigInt(n)) - _1n;
-function validateObject(object, fields = {}, optFields = {}) {
-  if (Object.prototype.toString.call(object) !== "[object Object]")
-    throw new TypeError("expected valid options object");
+var bitMask = (n) => {
+  asafenumber(n, "n");
+  return (_1n << BigInt(n)) - _1n;
+};
+function validateObject(object, fields = {}, optFields = {}, title = "object") {
+  aobject2(object, title);
+  aobject2(fields, "fields");
+  aobject2(optFields, "optFields");
   function checkField(fieldName, expectedType, isOpt) {
-    if (!isOpt && expectedType !== "function" && !Object.hasOwn(object, fieldName))
-      throw new TypeError(`param "${fieldName}" is invalid: expected own property`);
+    const label = title === "object" ? `param "${String(fieldName)}"` : `"${title}.${String(fieldName)}"`;
     const val = object[fieldName];
+    if (!Object.hasOwn(object, fieldName) && (isOpt ? val !== void 0 : expectedType !== "function")) {
+      throw new TypeError(`${label} is invalid: expected own property`);
+    }
     if (isOpt && val === void 0)
       return;
     const current = typeof val;
     if (current !== expectedType || val === null)
-      throw new TypeError(`param "${fieldName}" is invalid: expected ${expectedType}, got ${current}`);
+      throw new TypeError(`${label} is invalid: expected ${expectedType}, got ${current}`);
   }
   const iter = (f, isOpt) => Object.entries(f).forEach(([k, v]) => checkField(k, v, isOpt));
   iter(fields, false);
   iter(optFields, true);
 }
-var notImplemented = () => {
-  throw new Error("not implemented");
-};
 
 // ../../node_modules/@noble/curves/abstract/modular.js
 var _0n2 = /* @__PURE__ */ BigInt(0);
@@ -788,17 +835,67 @@ var _5n = /* @__PURE__ */ BigInt(5);
 var _7n = /* @__PURE__ */ BigInt(7);
 var _8n = /* @__PURE__ */ BigInt(8);
 var _9n = /* @__PURE__ */ BigInt(9);
+var _15n = /* @__PURE__ */ BigInt(15);
 var _16n = /* @__PURE__ */ BigInt(16);
+var POW_WINDOWED_MIN = /* @__PURE__ */ BigInt("0x10000000000000000");
 function mod(a, b) {
   if (b <= _0n2)
     throw new Error("mod: expected positive modulus, got " + b);
   const result = a % b;
   return result >= _0n2 ? result : b + result;
 }
-function pow2(x, power, modulo) {
+function pow(num, power, modulo) {
+  if (modulo <= _1n2)
+    throw new Error("pow: expected modulus > 1, got " + modulo);
+  if (typeof power !== "bigint")
+    throw new TypeError("invalid exponent: expected bigint, got " + typeof power);
+  if (power < _0n2)
+    throw new Error("invalid exponent, negatives unsupported");
+  if (power === _0n2)
+    return _1n2;
+  if (power === _1n2)
+    return num;
+  let d = num % modulo;
+  if (d < _0n2)
+    d += modulo;
+  if (power < POW_WINDOWED_MIN) {
+    let p2 = _1n2;
+    while (power > _0n2) {
+      if (power & _1n2)
+        p2 = p2 * d % modulo;
+      d = d * d % modulo;
+      power >>= _1n2;
+    }
+    return p2;
+  }
+  const digits = [];
+  while (power > _0n2) {
+    digits.push(Number(power & _15n));
+    power >>= _4n;
+  }
+  const table = new Array(16);
+  table[0] = _1n2;
+  table[1] = d;
+  for (let i2 = 2; i2 < 16; i2++)
+    table[i2] = table[i2 - 1] * d % modulo;
+  let p = table[digits[digits.length - 1]];
+  for (let w = digits.length - 2; w >= 0; w--) {
+    p = p * p % modulo;
+    p = p * p % modulo;
+    p = p * p % modulo;
+    p = p * p % modulo;
+    const digit = digits[w];
+    if (digit !== 0)
+      p = p * table[digit] % modulo;
+  }
+  return p;
+}
+function pow2(x2, power, modulo) {
+  if (modulo <= _1n2)
+    throw new Error("pow2: expected modulus > 1, got " + modulo);
   if (power < _0n2)
     throw new Error("pow2: expected non-negative exponent, got " + power);
-  let res = x;
+  let res = x2;
   while (power-- > _0n2) {
     res *= res;
     res %= modulo;
@@ -808,28 +905,31 @@ function pow2(x, power, modulo) {
 function invert(number, modulo) {
   if (number === _0n2)
     throw new Error("invert: expected non-zero number");
-  if (modulo <= _0n2)
-    throw new Error("invert: expected positive modulus, got " + modulo);
+  if (modulo <= _1n2)
+    throw new Error("invert: expected modulus > 1, got " + modulo);
   let a = mod(number, modulo);
   let b = modulo;
-  let x = _0n2, y = _1n2, u = _1n2, v = _0n2;
+  let x2 = _0n2, u = _1n2;
   while (a !== _0n2) {
     const q = b / a;
     const r = b - a * q;
-    const m = x - u * q;
-    const n = y - v * q;
-    b = a, a = r, x = u, y = v, u = m, v = n;
+    const m = x2 - u * q;
+    b = a, a = r, x2 = u, u = m;
   }
   const gcd = b;
   if (gcd !== _1n2)
     throw new Error("invert: does not exist");
-  return mod(x, modulo);
+  return mod(x2, modulo);
 }
 function assertIsSquare(Fp2, root, n) {
   const F = Fp2;
   if (!F.eql(F.sqr(root), n))
     throw new Error("Cannot find square root");
 }
+function aoddModulus(order, fnName) {
+  if ((order & _1n2) === _0n2)
+    throw new Error(fnName + ": expected odd modulus, got " + order);
+}
 function sqrt3mod4(Fp2, n) {
   const F = Fp2;
   const p1div4 = (F.ORDER + _1n2) / _4n;
@@ -843,8 +943,8 @@ function sqrt5mod8(Fp2, n) {
   const n2 = F.mul(n, _2n);
   const v = F.pow(n2, p5div8);
   const nv = F.mul(n, v);
-  const i = F.mul(F.mul(nv, _2n), v);
-  const root = F.mul(nv, F.sub(i, F.ONE));
+  const i2 = F.mul(F.mul(nv, _2n), v);
+  const root = F.mul(nv, F.sub(i2, F.ONE));
   assertIsSquare(F, root, n);
   return root;
 }
@@ -874,6 +974,7 @@ function sqrt9mod16(P) {
 function tonelliShanks(P) {
   if (P < _3n)
     throw new Error("sqrt is not defined for small field");
+  aoddModulus(P, "tonelliShanks");
   let Q = P - _1n2;
   let S = 0;
   while (Q % _2n === _0n2) {
@@ -902,18 +1003,18 @@ function tonelliShanks(P) {
     let R = F.pow(n, Q1div2);
     while (!F.eql(t, F.ONE)) {
       if (F.is0(t))
-        return F.ZERO;
-      let i = 1;
+        throw new Error("Cannot find square root: probably non-prime P");
+      let i2 = 1;
       let t_tmp = F.sqr(t);
       while (!F.eql(t_tmp, F.ONE)) {
-        i++;
+        i2++;
         t_tmp = F.sqr(t_tmp);
-        if (i === M)
+        if (i2 === M)
           throw new Error("Cannot find square root");
       }
-      const exponent = _1n2 << BigInt(M - i - 1);
+      const exponent = _1n2 << BigInt(M - i2 - 1);
       const b = F.pow(c, exponent);
-      M = i;
+      M = i2;
       c = F.sqr(b);
       t = F.mul(t, c);
       R = F.mul(R, b);
@@ -922,6 +1023,7 @@ function tonelliShanks(P) {
   };
 }
 function FpSqrt(P) {
+  aoddModulus(P, "Fp.sqrt");
   if (P % _4n === _3n)
     return sqrt3mod4;
   if (P % _8n === _5n)
@@ -951,62 +1053,44 @@ var FIELD_FIELDS = [
   "sqrN"
 ];
 function validateField(field) {
-  const initial = {
-    ORDER: "bigint",
-    BYTES: "number",
-    BITS: "number"
-  };
-  const opts = FIELD_FIELDS.reduce((map, val) => {
-    map[val] = "function";
-    return map;
-  }, initial);
-  validateObject(field, opts);
+  aobject2(field, "field");
+  if (typeof field.ORDER !== "bigint")
+    throw new TypeError('param "ORDER" is invalid: expected bigint, got ' + typeof field.ORDER);
   asafenumber(field.BYTES, "BYTES");
   asafenumber(field.BITS, "BITS");
+  for (const name of FIELD_FIELDS)
+    afunction(field[name], "field." + name);
   if (field.BYTES < 1 || field.BITS < 1)
     throw new Error("invalid field: expected BYTES/BITS > 0");
   if (field.ORDER <= _1n2)
     throw new Error("invalid field: expected ORDER > 1, got " + field.ORDER);
   return field;
 }
-function FpPow(Fp2, num, power) {
-  const F = Fp2;
-  if (power < _0n2)
-    throw new Error("invalid exponent, negatives unsupported");
-  if (power === _0n2)
-    return F.ONE;
-  if (power === _1n2)
-    return num;
-  let p = F.ONE;
-  let d = num;
-  while (power > _0n2) {
-    if (power & _1n2)
-      p = F.mul(p, d);
-    d = F.sqr(d);
-    power >>= _1n2;
-  }
-  return p;
-}
 function FpInvertBatch(Fp2, nums, passZero = false) {
+  validateField(Fp2);
+  aarray(nums, "nums");
+  abool(passZero, "passZero");
   const F = Fp2;
   const inverted = new Array(nums.length).fill(passZero ? F.ZERO : void 0);
-  const multipliedAcc = nums.reduce((acc, num, i) => {
+  const multipliedAcc = nums.reduce((acc, num, i2) => {
     if (F.is0(num))
       return acc;
-    inverted[i] = acc;
+    inverted[i2] = acc;
     return F.mul(acc, num);
   }, F.ONE);
   const invertedAcc = F.inv(multipliedAcc);
-  nums.reduceRight((acc, num, i) => {
+  nums.reduceRight((acc, num, i2) => {
     if (F.is0(num))
       return acc;
-    inverted[i] = F.mul(acc, inverted[i]);
+    inverted[i2] = F.mul(acc, inverted[i2]);
     return F.mul(acc, num);
   }, invertedAcc);
   return inverted;
 }
 function FpLegendre(Fp2, n) {
+  validateField(Fp2);
   const F = Fp2;
+  aoddModulus(F.ORDER, "FpLegendre");
   const p1mod2 = (F.ORDER - _1n2) / _2n;
   const powered = F.pow(n, p1mod2);
   const yes = F.eql(powered, F.ONE);
@@ -1025,7 +1109,7 @@ function nLength(n, nBitLength) {
     throw new Error("invalid n length: expected positive bit length, got " + nBitLength);
   const bits2 = bitLen(n);
   if (nBitLength !== void 0 && nBitLength < bits2)
-    throw new Error(`invalid n length: expected bit length (${bits2}) >= n.length (${nBitLength})`);
+    throw new Error(`invalid n length: expected nBitLength (${nBitLength}) >= bitLen(n) (${bits2})`);
   const _nBitLength = nBitLength !== void 0 ? nBitLength : bits2;
   const nByteLength = Math.ceil(_nBitLength / 8);
   return { nBitLength: _nBitLength, nByteLength };
@@ -1102,7 +1186,7 @@ var _Field = class {
     return mod(lhs * rhs, this.ORDER);
   }
   pow(num, power) {
-    return FpPow(this, num, power);
+    return pow(num, power, this.ORDER);
   }
   div(lhs, rhs) {
     return mod(lhs * invert(rhs, this.ORDER), this.ORDER);
@@ -1156,7 +1240,7 @@ var _Field = class {
   }
   // TODO: we don't need it here, move out to separate fn
   invertBatch(lst) {
-    return FpInvertBatch(this, lst);
+    return FpInvertBatch(this, lst, true);
   }
   // We can't move this out because Fp6, Fp12 implement it
   // and it's unclear what to return in there.
@@ -1165,192 +1249,357 @@ var _Field = class {
     return condition ? b : a;
   }
 };
-Object.freeze(_Field.prototype);
 function Field(ORDER, opts = {}) {
+  Object.freeze(_Field.prototype);
   return new _Field(ORDER, opts);
 }
 
 // ../../node_modules/@noble/curves/abstract/curve.js
 var _0n3 = /* @__PURE__ */ BigInt(0);
 var _1n3 = /* @__PURE__ */ BigInt(1);
-function negateCt(condition, item) {
-  const neg = item.negate();
-  return condition ? neg : item;
+var _4n2 = /* @__PURE__ */ BigInt(4);
+var BLIND_BYTES = 16;
+var BLIND_BITS = 128;
+var FW_WINDOW = 5;
+var TABLE_BYTES_MAX = /* @__PURE__ */ (() => 2 ** 31)();
+function validatePointCons(Point) {
+  const pc = Point;
+  if (typeof pc !== "function")
+    throw new TypeError('"Point" expected constructor, got type=' + typeof Point);
+  afunction(pc.fromAffine, "Point.fromAffine");
+  afunction(pc.fromBytes, "Point.fromBytes");
+  afunction(pc.fromHex, "Point.fromHex");
+  aobject2(pc.BASE, "Point.BASE");
+  aobject2(pc.ZERO, "Point.ZERO");
+  validateField(pc.Fp);
+  validateField(pc.Fn);
 }
 function normalizeZ(c, points) {
+  validatePointCons(c);
+  validateMSMPoints(points, c);
   const invertedZs = FpInvertBatch(c.Fp, points.map((p) => p.Z));
-  return points.map((p, i) => c.fromAffine(p.toAffine(invertedZs[i])));
-}
-function validateW(W, bits2) {
-  if (!Number.isSafeInteger(W) || W <= 0 || W > bits2)
-    throw new Error("invalid window size, expected [1.." + bits2 + "], got W=" + W);
-}
-function calcWOpts(W, scalarBits) {
-  validateW(W, scalarBits);
-  const windows = Math.ceil(scalarBits / W) + 1;
-  const windowSize = 2 ** (W - 1);
-  const maxNumber = 2 ** W;
-  const mask = bitMask(W);
-  const shiftBy = BigInt(W);
-  return { windows, windowSize, mask, maxNumber, shiftBy };
-}
-function calcOffsets(n, window, wOpts) {
-  const { windowSize, mask, maxNumber, shiftBy } = wOpts;
-  let wbits2 = Number(n & mask);
-  let nextN = n >> shiftBy;
-  if (wbits2 > windowSize) {
-    wbits2 -= maxNumber;
-    nextN += _1n3;
-  }
-  const offsetStart = window * windowSize;
-  const offset = offsetStart + Math.abs(wbits2) - 1;
-  const isZero = wbits2 === 0;
-  const isNeg = wbits2 < 0;
-  const isNegF = window % 2 !== 0;
-  const offsetF = offsetStart;
-  return { nextN, offset, isZero, isNeg, isNegF, offsetF };
-}
-var pointPrecomputes = /* @__PURE__ */ new WeakMap();
+  return points.map((p, i2) => c.fromAffine(p.toAffine(invertedZs[i2])));
+}
+function validateW(W, bits2, min = 1) {
+  if (!Number.isSafeInteger(W) || W < min || W > bits2)
+    throw new Error("invalid window size, expected [" + min + ".." + bits2 + "], got W=" + W);
+}
+function validateTableBytes(numPoints, fpBytes) {
+  const bytes = numPoints * (4 * fpBytes + 128);
+  if (bytes > TABLE_BYTES_MAX)
+    throw new Error("invalid window size: table would need ~" + Math.ceil(bytes / 2 ** 20) + " MiB, max " + TABLE_BYTES_MAX / 2 ** 20 + " MiB");
+}
+function probeRandomBytes(randomBytes5, length) {
+  if (randomBytes5 === void 0)
+    return void 0;
+  afunction(randomBytes5, "randomBytes");
+  try {
+    const probe = randomBytes5(length);
+    if (!isBytes2(probe) || probe.length !== length)
+      return void 0;
+  } catch {
+    return void 0;
+  }
+  return randomBytes5;
+}
+function validateMSMPoints(points, c) {
+  aarray(points, "points");
+  points.forEach((p, i2) => {
+    if (!(p instanceof c))
+      throw new Error("invalid point at index " + i2);
+  });
+}
+function validateMSMScalars(scalars, field, maxScalar) {
+  if (!Array.isArray(scalars))
+    throw new Error("array of scalars expected");
+  scalars.forEach((s, i2) => {
+    const ok = maxScalar === void 0 ? field.isValid(s) : isPosBig(s) && s < maxScalar;
+    if (!ok)
+      throw new Error("invalid scalar at index " + i2);
+  });
+}
 var pointWindowSizes = /* @__PURE__ */ new WeakMap();
-function getW(P) {
+function getWindowSize(P) {
   return pointWindowSizes.get(P) || 1;
 }
-function assert0(n) {
+function oddMultiples(p, size) {
+  const dbl = p.double();
+  const t = [p];
+  for (let j = 1; j < size; j++)
+    t.push(t[j - 1].add(dbl));
+  return t;
+}
+function wnafDigits(n, W) {
+  const size = 2 ** W;
+  const half = size / 2;
+  const mask = BigInt(size - 1);
+  const d = [];
+  while (n > _0n3) {
+    let w = 0;
+    if (n & _1n3) {
+      w = Number(n & mask);
+      if (w >= half)
+        w -= size;
+      n -= BigInt(w);
+    }
+    d.push(w);
+    n >>= _1n3;
+  }
+  return d;
+}
+function signedWindowDigits(n, W, windows) {
+  const size = 2 ** W;
+  const half = size / 2;
+  const mask = BigInt(size - 1);
+  const shiftBy = BigInt(W);
+  const d = [];
+  for (let w = 0; w < windows; w++) {
+    let v = Number(n & mask);
+    n >>= shiftBy;
+    if (v > half) {
+      v -= size;
+      n += _1n3;
+    }
+    d.push(v);
+  }
   if (n !== _0n3)
-    throw new Error("invalid wNAF");
+    throw new Error("invalid wnaf");
+  return d;
+}
+function wnafWalk(zero, tables, digits) {
+  let max2 = 0;
+  for (const d of digits)
+    max2 = Math.max(max2, d.length);
+  let acc = zero;
+  for (let bit = max2 - 1; bit >= 0; bit--) {
+    if (bit !== max2 - 1)
+      acc = acc.double();
+    for (let i2 = 0; i2 < digits.length; i2++) {
+      const w = digits[i2][bit];
+      if (w) {
+        const item = tables[i2][Math.abs(w) - 1 >> 1];
+        acc = acc.add(w < 0 ? item.negate() : item);
+      }
+    }
+  }
+  return acc;
 }
-var wNAF = class {
+var ScalarMultiplier = class {
+  Point;
   BASE;
   ZERO;
-  Fn;
+  randomBytes;
+  wnafPrecomputes = /* @__PURE__ */ new WeakMap();
+  baseCanBeBlinded;
   bits;
   // Parametrized with a given Point class (not individual point)
-  constructor(Point, bits2) {
+  constructor(Point, randomBytes5) {
+    validatePointCons(Point);
+    this.randomBytes = probeRandomBytes(randomBytes5, BLIND_BYTES);
+    this.Point = Point;
     this.BASE = Point.BASE;
     this.ZERO = Point.ZERO;
-    this.Fn = Point.Fn;
-    this.bits = bits2;
-  }
-  // non-const time multiplication ladder
-  _unsafeLadder(elm, n, p = this.ZERO) {
-    let d = elm;
-    while (n > _0n3) {
-      if (n & _1n3)
-        p = p.add(d);
-      d = d.double();
-      n >>= _1n3;
-    }
-    return p;
+    this.bits = Point.Fn.BITS;
   }
   /**
-   * Creates a wNAF precomputation window. Used for caching.
-   * Default window size is set by `utils.precompute()` and is equal to 8.
-   * Number of precomputed points depends on the curve size:
-   * 2^(𝑊−1) * (Math.ceil(𝑛 / 𝑊) + 1), where:
-   * - 𝑊 is the window size
-   * - 𝑛 is the bitlength of the curve order.
-   * For a 256-bit curve and window size 8, the number of precomputed points is 128 * 33 = 4224.
+   * Creates a signed fixed-window wNAF precomputation table: for every window w, the
+   * multiples `[1..2^(W−1)]⋅2^(w⋅W)⋅P`, flattened. All doublings are baked into the table,
+   * so cached multiplication is additions-only. `windows = ceil(bits/W) + 1`: the extra
+   * window absorbs the final carry of signed-digit recoding.
+   * For a 256-bit curve and W=6, the table is 44⋅32 = 1408 points.
    * @param point - Point instance
    * @param W - window size
-   * @returns precomputed point tables flattened to a single array
+   * @param bits - scalar bitlength the table must cover
    */
-  precomputeWindow(point, W) {
-    const { windows, windowSize } = calcWOpts(W, this.bits);
-    const points = [];
-    let p = point;
-    let base = p;
-    for (let window = 0; window < windows; window++) {
-      base = p;
-      points.push(base);
-      for (let i = 1; i < windowSize; i++) {
-        base = base.add(p);
-        points.push(base);
+  buildWnafTable(point, W, bits2) {
+    const windows = Math.ceil(bits2 / W) + 1;
+    const half = 2 ** (W - 1);
+    const comp = [];
+    let base = point;
+    for (let w = 0; w < windows; w++) {
+      let acc = base;
+      for (let i2 = 0; i2 < half; i2++) {
+        comp.push(acc);
+        acc = acc.add(base);
       }
-      p = base.double();
+      base = comp[comp.length - 1].double();
     }
-    return points;
+    return { W, bits: bits2, windows, comp };
   }
   /**
-   * Implements ec multiplication using precomputed tables and w-ary non-adjacent form.
-   * More compact implementation:
-   * https://github.com/paulmillr/noble-secp256k1/blob/47cb1669b6e506ad66b35fe7d76132ae97465da2/index.ts#L502-L541
+   * Implements ec multiplication using precomputed signed fixed-window wNAF tables.
+   * Constant-time: fixed window count with one table addition per window — zero digits feed
+   * the fake accumulator — and no doublings; the lookup scans the whole window slice.
+   * Scalar bounds are validated by the public entry points ({@link ScalarMultiplier.mulCT},
+   * {@link ScalarMultiplier.mulCTBlinded}, {@link ScalarMultiplier.mulUnsafe});
+   * signedWindowDigits throws if `n` exceeds the table.
    * @returns real and fake (for const-time) points
    */
-  wNAF(W, precomputes, n) {
-    if (!this.Fn.isValid(n))
-      throw new Error("invalid scalar");
+  wnafCachedCT(precomputes, n) {
+    const { W, windows, comp } = precomputes;
+    const half = 2 ** (W - 1);
+    const digits = signedWindowDigits(n, W, windows);
     let p = this.ZERO;
     let f = this.BASE;
-    const wo = calcWOpts(W, this.bits);
-    for (let window = 0; window < wo.windows; window++) {
-      const { nextN, offset, isZero, isNeg, isNegF, offsetF } = calcOffsets(n, window, wo);
-      n = nextN;
-      if (isZero) {
-        f = f.add(negateCt(isNegF, precomputes[offsetF]));
-      } else {
-        p = p.add(negateCt(isNeg, precomputes[offset]));
-      }
+    for (let w = 0; w < windows; w++) {
+      const digit = digits[w];
+      const start = w * half;
+      const idx = Math.abs(digit) - 1;
+      let sel = comp[start];
+      for (let i2 = 1; i2 < half; i2++)
+        sel = i2 === idx ? comp[start + i2] : sel;
+      const neg = sel.negate();
+      if (digit === 0)
+        f = f.add(comp[start]);
+      else
+        p = p.add(digit < 0 ? neg : sel);
     }
-    assert0(n);
     return { p, f };
   }
-  /**
-   * Implements unsafe EC multiplication using precomputed tables
-   * and w-ary non-adjacent form.
-   * @param acc - accumulator point to add result of multiplication
-   * @returns point
-   */
-  wNAFUnsafe(W, precomputes, n, acc = this.ZERO) {
-    const wo = calcWOpts(W, this.bits);
-    for (let window = 0; window < wo.windows; window++) {
-      if (n === _0n3)
-        break;
-      const { nextN, offset, isZero, isNeg } = calcOffsets(n, window, wo);
-      n = nextN;
-      if (isZero) {
-        continue;
-      } else {
-        const item = precomputes[offset];
-        acc = acc.add(isNeg ? item.negate() : item);
-      }
-    }
-    assert0(n);
-    return acc;
-  }
-  getPrecomputes(W, point, transform) {
-    let comp = pointPrecomputes.get(point);
+  // Cache key is point identity plus (W, bits); at most two entries exist per point (public-width
+  // `Fn.BITS` and blinded `Fn.BITS + BLIND_BITS`). Callers must not reuse the same point with
+  // incompatible `transform(...)` layouts and expect a separate cache entry.
+  getWnafPrecomputes(W, point, bits2, transform) {
+    let entries = this.wnafPrecomputes.get(point);
+    let comp = entries?.find((entry) => entry.W === W && entry.bits === bits2);
     if (!comp) {
-      comp = this.precomputeWindow(point, W);
-      if (W !== 1) {
-        if (typeof transform === "function")
-          comp = transform(comp);
-        pointPrecomputes.set(point, comp);
+      comp = this.buildWnafTable(point, W, bits2);
+      if (typeof transform === "function")
+        comp = { ...comp, comp: transform(comp.comp) };
+      if (!entries) {
+        entries = [];
+        this.wnafPrecomputes.set(point, entries);
       }
+      entries.push(comp);
     }
     return comp;
   }
-  cached(point, scalar, transform) {
-    const W = getW(point);
-    return this.wNAF(W, this.getPrecomputes(W, point, transform), scalar);
+  assertPoint(point) {
+    if (!(point instanceof this.Point))
+      throw new TypeError('"point" expected Point instance, got type=' + typeof point);
+  }
+  // Shared prologue of the constant-time entry points. Rejects scalar 0: in key/signature-style
+  // callers a zero scalar means broken upstream plumbing, and concrete Points already reject it.
+  // Uses inRange instead of Fn.isValidNot0: validateField() only certifies the arithmetic subset.
+  validateMulInput(point, scalar) {
+    this.assertPoint(point);
+    if (!inRange(scalar, _1n3, this.Point.Fn.ORDER))
+      throw new Error("invalid scalar");
   }
-  unsafe(point, scalar, transform, prev) {
-    const W = getW(point);
+  // Constant-time dispatch shared by mulCT / mulCTBlinded. Un-precomputed points (W===1, e.g.
+  // ECDH peer keys) skip building a throwaway cached table in favor of a small fixed-window
+  // multiply. `n` must be < 2^bits.
+  runCT(point, n, bits2, transform) {
+    const W = getWindowSize(point);
     if (W === 1)
-      return this._unsafeLadder(point, scalar, prev);
-    return this.wNAFUnsafe(W, this.getPrecomputes(W, point, transform), scalar, prev);
+      return this.fixedWindowCT(point, n, bits2);
+    return this.wnafCachedCT(this.getWnafPrecomputes(W, point, bits2, transform), n);
+  }
+  mulCT(point, scalar, transform) {
+    this.validateMulInput(point, scalar);
+    return this.runCT(point, scalar, this.bits, transform);
+  }
+  mulCTBlinded(point, scalar, transform) {
+    this.validateMulInput(point, scalar);
+    if (this.randomBytes === void 0)
+      throw new Error("randomBytes is required for scalar blinding");
+    const bits2 = this.Point.Fn.BITS + BLIND_BITS;
+    const blind = this.randomBytes(BLIND_BYTES);
+    if (!isBytes2(blind) || blind.length !== BLIND_BYTES)
+      throw new Error("randomBytes returned invalid byte array");
+    blind[0] = blind[0] & 63 | 128;
+    const n = scalar + bytesToNumberBE(blind) * this.Point.Fn.ORDER;
+    return this.runCT(point, n, bits2, transform);
+  }
+  /**
+   * Constant-time multiplication `n*point` for an un-precomputed point, via a small fixed window.
+   * A cached wNAF table only pays off when reused; a flat 2^FW_WINDOW table (`size-1` adds) is
+   * far cheaper to build for a single use. The point-operation sequence is independent of `n`:
+   * build the table, then per window exactly FW_WINDOW doublings, a data-oblivious scan over
+   * every table entry, and one addition (adds the identity when the window digit is 0 — never
+   * skipped).
+   *
+   * `n` must be `< 2^bits`. Assumes complete addition (adding the identity costs the same as any
+   * add), which holds for the Weierstrass/Edwards point types used here. The table is left in
+   * projective form (no normalizeZ): normalizing this small a table costs more than the
+   * mixed-add savings it would buy for a single multiply.
+   * @returns real point `p`; `f` duplicates it only to match {@link wnafCachedCT}'s return shape
+   * (this path needs no fake accumulator — its op-count is already scalar-independent).
+   */
+  fixedWindowCT(point, n, bits2) {
+    const W = FW_WINDOW;
+    const size = 1 << W;
+    const mask = bitMask(W);
+    const table = new Array(size);
+    table[0] = this.ZERO;
+    for (let i2 = 1; i2 < size; i2++)
+      table[i2] = table[i2 - 1].add(point);
+    const windows = Math.ceil(bits2 / W);
+    let acc = this.ZERO;
+    for (let window = windows - 1; window >= 0; window--) {
+      if (window !== windows - 1)
+        for (let d = 0; d < W; d++)
+          acc = acc.double();
+      const digit = Number(n >> BigInt(window * W) & mask);
+      let sel = table[0];
+      for (let i2 = 1; i2 < size; i2++)
+        sel = i2 === digit ? table[i2] : sel;
+      acc = acc.add(sel);
+    }
+    return { p: acc, f: acc };
   }
-  // We calculate precomputes for elliptic curve point multiplication
-  // using windowed method. This specifies window size and
-  // stores precomputed values. Usually only base point would be precomputed.
-  createCache(P, W) {
+  shouldBlind(point, cofactor) {
+    if (this.randomBytes === void 0)
+      return false;
+    if (cofactor === _1n3)
+      return true;
+    if (point !== this.BASE)
+      return false;
+    if (this.baseCanBeBlinded === void 0)
+      this.baseCanBeBlinded = this.mulUnsafe(this.BASE, this.Point.Fn.ORDER).is0();
+    return this.baseCanBeBlinded;
+  }
+  mulSecret(point, scalar, cofactor, transform) {
+    return this.shouldBlind(point, cofactor) ? this.mulCTBlinded(point, scalar, transform) : this.mulCT(point, scalar, transform);
+  }
+  mulUnsafe(point, scalar, transform) {
+    this.assertPoint(point);
+    if (!isPosBig(scalar))
+      throw new Error("invalid scalar");
+    const W = getWindowSize(point);
+    if (W === 1 || scalar >= this.Point.Fn.ORDER)
+      return mulAddUnsafe(this.Point, [point], [scalar], true);
+    const precomputes = this.getWnafPrecomputes(W, point, this.bits, transform);
+    return this.wnafCachedCT(precomputes, scalar).p;
+  }
+  // Remembers the window size used for precomputed wNAF multiplication of the given point
+  // and drops any previously built tables. Usually only the base point is precomputed.
+  // W=1 resets the point to the un-precomputed (table-less) paths.
+  // W is additionally capped so tables stay under ~2 GiB ({@link TABLE_BYTES_MAX}).
+  setWindowSize(point, W) {
+    this.assertPoint(point);
     validateW(W, this.bits);
-    pointWindowSizes.set(P, W);
-    pointPrecomputes.delete(P);
+    const windows = Math.ceil((this.bits + BLIND_BITS) / W) + 1;
+    validateTableBytes(windows * 2 ** (W - 1), this.Point.Fp.BYTES);
+    pointWindowSizes.set(point, W);
+    this.wnafPrecomputes.delete(point);
   }
-  hasCache(elm) {
-    return getW(elm) !== 1;
+  // True when a window size is set: tables themselves are built lazily on first multiply.
+  hasWindowSize(point) {
+    return getWindowSize(point) !== 1;
   }
 };
+function mulAddUnsafe(c, points, scalars, allowOversized = false) {
+  validatePointCons(c);
+  validateMSMPoints(points, c);
+  abool(allowOversized, "allowOversized");
+  validateMSMScalars(scalars, c.Fn, allowOversized ? c.Fn.ORDER ** _4n2 : void 0);
+  if (points.length !== scalars.length)
+    throw new Error("arrays of points and scalars must have equal length");
+  const tables = points.map((p) => oddMultiples(p, 4));
+  const digits = scalars.map((n) => wnafDigits(n, 4));
+  return wnafWalk(c.ZERO, tables, digits);
+}
 function createField(order, field, isLE3) {
   if (field) {
     if (field.ORDER !== order)
@@ -1362,17 +1611,20 @@ function createField(order, field, isLE3) {
   }
 }
 function createCurveFields(type, CURVE, curveOpts = {}, FpFnLE) {
+  if (type !== "weierstrass" && type !== "edwards")
+    throw new Error('expected curve type "weierstrass" or "edwards"');
   if (FpFnLE === void 0)
     FpFnLE = type === "edwards";
   if (!CURVE || typeof CURVE !== "object")
     throw new Error(`expected valid ${type} CURVE object`);
+  validateObject(curveOpts);
   for (const p of ["p", "n", "h"]) {
     const val = CURVE[p];
-    if (!(typeof val === "bigint" && val > _0n3))
+    if (!(isPosBig(val) && val !== _0n3))
       throw new Error(`CURVE.${p} must be positive bigint`);
   }
   const Fp2 = createField(CURVE.p, curveOpts.Fp, FpFnLE);
-  const Fn2 = createField(CURVE.n, curveOpts.Fn, FpFnLE);
+  const Fn = createField(CURVE.n, curveOpts.Fn, FpFnLE);
   const _b2 = type === "weierstrass" ? "b" : "d";
   const params = ["Gx", "Gy", "a", _b2];
   for (const p of params) {
@@ -1380,7 +1632,7 @@ function createCurveFields(type, CURVE, curveOpts = {}, FpFnLE) {
       throw new Error(`CURVE.${p} must be valid field element of CURVE.Fp`);
   }
   CURVE = Object.freeze(Object.assign({}, CURVE));
-  return { CURVE, Fp: Fp2, Fn: Fn2 };
+  return { CURVE, Fp: Fp2, Fn };
 }
 function createKeygen(randomSecretKey, getPublicKey) {
   return function keygen(seed) {
@@ -1393,23 +1645,34 @@ function createKeygen(randomSecretKey, getPublicKey) {
 var _0n4 = /* @__PURE__ */ BigInt(0);
 var _1n4 = /* @__PURE__ */ BigInt(1);
 var _2n2 = /* @__PURE__ */ BigInt(2);
+var _4n3 = /* @__PURE__ */ BigInt(4);
 var _8n2 = /* @__PURE__ */ BigInt(8);
-function isEdValidXY(Fp2, CURVE, x, y) {
-  const x2 = Fp2.sqr(x);
+function isEdValidXY(Fp2, CURVE, x2, y) {
+  const x22 = Fp2.sqr(x2);
   const y2 = Fp2.sqr(y);
-  const left = Fp2.add(Fp2.mul(CURVE.a, x2), y2);
-  const right = Fp2.add(Fp2.ONE, Fp2.mul(CURVE.d, Fp2.mul(x2, y2)));
+  const left = Fp2.add(Fp2.mul(CURVE.a, x22), y2);
+  const right = Fp2.add(Fp2.ONE, Fp2.mul(CURVE.d, Fp2.mul(x22, y2)));
   return Fp2.eql(left, right);
 }
 function edwards(params, extraOpts = {}) {
+  validateObject(extraOpts, {}, {}, "extraOpts");
   const opts = extraOpts;
   const validated = createCurveFields("edwards", params, opts, opts.FpFnLE);
-  const { Fp: Fp2, Fn: Fn2 } = validated;
+  const { Fp: Fp2, Fn } = validated;
   let CURVE = validated.CURVE;
   const { h: cofactor } = CURVE;
-  validateObject(opts, {}, { uvRatio: "function" });
-  const MASK = _2n2 << BigInt(Fn2.BYTES * 8) - _1n4;
-  const modP = (n) => Fp2.create(n);
+  if (FpLegendre(Fp2, CURVE.a) !== 1)
+    throw new Error("edwards: CURVE.a must be a square in Fp for complete addition formulas");
+  if (FpLegendre(Fp2, CURVE.d) !== -1)
+    throw new Error("edwards: CURVE.d must be a non-square in Fp for complete addition formulas");
+  validateObject(opts, {}, { uvRatio: "function", randomBytes: "function" });
+  const randomBytes5 = opts.randomBytes === void 0 ? randomBytes2 : opts.randomBytes;
+  const MASK = _2n2 << BigInt(Fp2.BYTES * 8) - _1n4;
+  function isOdd(n) {
+    if (!Fp2.isOdd)
+      throw new Error("Field does not have .isOdd()");
+    return Fp2.isOdd(n);
+  }
   const uvRatio2 = opts.uvRatio === void 0 ? (u, v) => {
     try {
       return { isValid: true, value: Fp2.sqrt(Fp2.div(u, v)) };
@@ -1419,6 +1682,7 @@ function edwards(params, extraOpts = {}) {
   } : opts.uvRatio;
   if (!isEdValidXY(Fp2, CURVE, CURVE.Gx, CURVE.Gy))
     throw new Error("bad curve params: generator point");
+  const mulA = Fp2.eql(CURVE.a, Fp2.neg(Fp2.ONE)) ? (x2) => Fp2.neg(x2) : Fp2.eql(CURVE.a, Fp2.ONE) ? (x2) => x2 : (x2) => Fp2.mul(CURVE.a, x2);
   function acoord(title, n, banZero = false) {
     const min = banZero ? _1n4 : _0n4;
     aInRange("coordinate " + title, n, min, MASK);
@@ -1429,15 +1693,10 @@ function edwards(params, extraOpts = {}) {
       throw new Error("EdwardsPoint expected");
   }
   class Point {
-    // base / generator point
-    static BASE = new Point(CURVE.Gx, CURVE.Gy, _1n4, modP(CURVE.Gx * CURVE.Gy));
-    // zero / infinity / identity point
-    static ZERO = new Point(_0n4, _1n4, _1n4, _0n4);
-    // 0, 1, 1, 0
-    // math field
+    static BASE = new Point(CURVE.Gx, CURVE.Gy, Fp2.ONE, Fp2.mul(CURVE.Gx, CURVE.Gy));
+    static ZERO = new Point(Fp2.ZERO, Fp2.ONE, Fp2.ONE, Fp2.ZERO);
     static Fp = Fp2;
-    // scalar field
-    static Fn = Fn2;
+    static Fn = Fn;
     X;
     Y;
     Z;
@@ -1460,36 +1719,36 @@ function edwards(params, extraOpts = {}) {
     static fromAffine(p) {
       if (p instanceof Point)
         throw new Error("extended point not allowed");
-      const { x, y } = p || {};
-      acoord("x", x);
+      const { x: x2, y } = p || {};
+      acoord("x", x2);
       acoord("y", y);
-      return new Point(x, y, _1n4, modP(x * y));
+      return new Point(x2, y, Fp2.ONE, Fp2.mul(x2, y));
     }
     // Uses algo from RFC8032 5.1.3.
     static fromBytes(bytes, zip215 = false) {
       const len = Fp2.BYTES;
       const { a, d } = CURVE;
-      bytes = copyBytes(abytes2(bytes, len, "point"));
+      bytes = copyBytes2(abytes2(bytes, len, "point"));
       abool(zip215, "zip215");
-      const normed = copyBytes(bytes);
+      const normed = copyBytes2(bytes);
       const lastByte = bytes[len - 1];
       normed[len - 1] = lastByte & ~128;
       const y = bytesToNumberLE(normed);
       const max2 = zip215 ? MASK : Fp2.ORDER;
       aInRange("point.y", y, _0n4, max2);
-      const y2 = modP(y * y);
-      const u = modP(y2 - _1n4);
-      const v = modP(d * y2 - a);
-      let { isValid, value: x } = uvRatio2(u, v);
+      const y2 = Fp2.sqr(y);
+      const u = Fp2.sub(y2, Fp2.ONE);
+      const v = Fp2.sub(Fp2.mulN(d, y2), a);
+      let { isValid, value: x2 } = uvRatio2(u, v);
       if (!isValid)
         throw new Error("bad point: invalid y coordinate");
-      const isXOdd = (x & _1n4) === _1n4;
+      const isXOdd = isOdd(x2);
       const isLastByteOdd = (lastByte & 128) !== 0;
-      if (!zip215 && x === _0n4 && isLastByteOdd)
+      if (!zip215 && Fp2.is0(x2) && isLastByteOdd)
         throw new Error("bad point: x=0 and x_0=1");
       if (isLastByteOdd !== isXOdd)
-        x = modP(-x);
-      return Point.fromAffine({ x, y });
+        x2 = Fp2.neg(x2);
+      return Point.fromAffine({ x: x2, y });
     }
     static fromHex(hex, zip215 = false) {
       return Point.fromBytes(hexToBytes2(hex), zip215);
@@ -1500,8 +1759,8 @@ function edwards(params, extraOpts = {}) {
     get y() {
       return this.toAffine().y;
     }
-    precompute(windowSize = 8, isLazy = true) {
-      wnaf.createCache(this, windowSize);
+    precompute(windowSize = 6, isLazy = true) {
+      wnaf.setWindowSize(this, windowSize);
       if (!isLazy)
         this.multiply(_2n2);
       return this;
@@ -1513,18 +1772,18 @@ function edwards(params, extraOpts = {}) {
       if (p.is0())
         throw new Error("bad point: ZERO");
       const { X, Y, Z, T } = p;
-      const X2 = modP(X * X);
-      const Y2 = modP(Y * Y);
-      const Z2 = modP(Z * Z);
-      const Z4 = modP(Z2 * Z2);
-      const aX2 = modP(X2 * a);
-      const left = modP(Z2 * modP(aX2 + Y2));
-      const right = modP(Z4 + modP(d * modP(X2 * Y2)));
-      if (left !== right)
+      const X2 = Fp2.sqr(X);
+      const Y2 = Fp2.sqr(Y);
+      const Z2 = Fp2.sqr(Z);
+      const Z4 = Fp2.sqr(Z2);
+      const aX2 = Fp2.mul(X2, a);
+      const left = Fp2.mul(Fp2.add(aX2, Y2), Z2);
+      const right = Fp2.add(Z4, Fp2.mul(d, Fp2.mul(X2, Y2)));
+      if (!Fp2.eql(left, right))
         throw new Error("bad point: equation left != right (1)");
-      const XY = modP(X * Y);
-      const ZT = modP(Z * T);
-      if (XY !== ZT)
+      const XY = Fp2.mul(X, Y);
+      const ZT = Fp2.mul(Z, T);
+      if (!Fp2.eql(XY, ZT))
         throw new Error("bad point: equation left != right (2)");
     }
     // Compare one point to another.
@@ -1532,37 +1791,36 @@ function edwards(params, extraOpts = {}) {
       aedpoint(other);
       const { X: X1, Y: Y1, Z: Z1 } = this;
       const { X: X2, Y: Y2, Z: Z2 } = other;
-      const X1Z2 = modP(X1 * Z2);
-      const X2Z1 = modP(X2 * Z1);
-      const Y1Z2 = modP(Y1 * Z2);
-      const Y2Z1 = modP(Y2 * Z1);
-      return X1Z2 === X2Z1 && Y1Z2 === Y2Z1;
+      const X1Z2 = Fp2.mul(X1, Z2);
+      const X2Z1 = Fp2.mul(X2, Z1);
+      const Y1Z2 = Fp2.mul(Y1, Z2);
+      const Y2Z1 = Fp2.mul(Y2, Z1);
+      return Fp2.eql(X1Z2, X2Z1) && Fp2.eql(Y1Z2, Y2Z1);
     }
     is0() {
       return this.equals(Point.ZERO);
     }
     negate() {
-      return new Point(modP(-this.X), this.Y, this.Z, modP(-this.T));
+      return new Point(Fp2.neg(this.X), this.Y, this.Z, Fp2.neg(this.T));
     }
     // Fast algo for doubling Extended Point.
     // https://hyperelliptic.org/EFD/g1p/auto-twisted-extended.html#doubling-dbl-2008-hwcd
     // Cost: 4M + 4S + 1*a + 6add + 1*2.
     double() {
-      const { a } = CURVE;
       const { X: X1, Y: Y1, Z: Z1 } = this;
-      const A = modP(X1 * X1);
-      const B = modP(Y1 * Y1);
-      const C = modP(_2n2 * modP(Z1 * Z1));
-      const D = modP(a * A);
-      const x1y1 = X1 + Y1;
-      const E = modP(modP(x1y1 * x1y1) - A - B);
-      const G = D + B;
-      const F = G - C;
-      const H = D - B;
-      const X3 = modP(E * F);
-      const Y3 = modP(G * H);
-      const T3 = modP(E * H);
-      const Z3 = modP(F * G);
+      const A = Fp2.sqr(X1);
+      const B = Fp2.sqr(Y1);
+      const C = Fp2.mul(Fp2.sqr(Z1), _2n2);
+      const D = mulA(A);
+      const x1y1 = Fp2.addN(X1, Y1);
+      const E = Fp2.sub(Fp2.subN(Fp2.sqr(x1y1), A), B);
+      const G = Fp2.addN(D, B);
+      const F = Fp2.subN(G, C);
+      const H = Fp2.subN(D, B);
+      const X3 = Fp2.mul(E, F);
+      const Y3 = Fp2.mul(G, H);
+      const T3 = Fp2.mul(E, H);
+      const Z3 = Fp2.mul(F, G);
       return new Point(X3, Y3, Z3, T3);
     }
     // Fast algo for adding 2 Extended Points.
@@ -1570,21 +1828,21 @@ function edwards(params, extraOpts = {}) {
     // Cost: 9M + 1*a + 1*d + 7add.
     add(other) {
       aedpoint(other);
-      const { a, d } = CURVE;
+      const { d } = CURVE;
       const { X: X1, Y: Y1, Z: Z1, T: T1 } = this;
       const { X: X2, Y: Y2, Z: Z2, T: T2 } = other;
-      const A = modP(X1 * X2);
-      const B = modP(Y1 * Y2);
-      const C = modP(T1 * d * T2);
-      const D = modP(Z1 * Z2);
-      const E = modP((X1 + Y1) * (X2 + Y2) - A - B);
-      const F = D - C;
-      const G = D + C;
-      const H = modP(B - a * A);
-      const X3 = modP(E * F);
-      const Y3 = modP(G * H);
-      const T3 = modP(E * H);
-      const Z3 = modP(F * G);
+      const A = Fp2.mul(X1, X2);
+      const B = Fp2.mul(Y1, Y2);
+      const C = Fp2.mul(Fp2.mulN(T1, d), T2);
+      const D = Fp2.mul(Z1, Z2);
+      const E = Fp2.sub(Fp2.subN(Fp2.mulN(Fp2.addN(X1, Y1), Fp2.addN(X2, Y2)), A), B);
+      const F = Fp2.subN(D, C);
+      const G = Fp2.addN(D, C);
+      const H = Fp2.sub(B, mulA(A));
+      const X3 = Fp2.mul(E, F);
+      const Y3 = Fp2.mul(G, H);
+      const T3 = Fp2.mul(E, H);
+      const Z3 = Fp2.mul(F, G);
       return new Point(X3, Y3, Z3, T3);
     }
     subtract(other) {
@@ -1593,10 +1851,10 @@ function edwards(params, extraOpts = {}) {
     }
     // Constant-time multiplication.
     multiply(scalar) {
-      if (!Fn2.isValidNot0(scalar))
+      if (!Fn.isValidNot0(scalar))
         throw new RangeError("invalid scalar: expected 1 <= sc < curve.n");
-      const { p, f } = wnaf.cached(this, scalar, (p2) => normalizeZ(Point, p2));
-      return normalizeZ(Point, [p, f])[0];
+      const { p, f } = wnaf.mulSecret(this, scalar, cofactor, normalize);
+      return normalize([p, f])[0];
     }
     // Non-constant-time multiplication. Uses double-and-add algorithm.
     // It's faster, but should only be used when you don't care about
@@ -1604,13 +1862,13 @@ function edwards(params, extraOpts = {}) {
     // Keeps the same subgroup-scalar contract: 0 is allowed for public-scalar callers, but
     // n and larger values are rejected instead of being reduced mod n to the identity point.
     multiplyUnsafe(scalar) {
-      if (!Fn2.isValid(scalar))
+      if (!Fn.isValid(scalar))
         throw new RangeError("invalid scalar: expected 0 <= sc < curve.n");
       if (scalar === _0n4)
         return Point.ZERO;
       if (this.is0() || scalar === _1n4)
         return this;
-      return wnaf.unsafe(this, scalar, (p) => normalizeZ(Point, p));
+      return wnaf.mulUnsafe(this, scalar, normalize);
     }
     // Checks if point is of small order.
     // If you add something to small order point, you will have "dirty"
@@ -1622,35 +1880,43 @@ function edwards(params, extraOpts = {}) {
     // Multiplies point by curve order and checks if the result is 0.
     // Returns `false` is the point is dirty.
     isTorsionFree() {
-      return wnaf.unsafe(this, CURVE.n).is0();
+      return wnaf.mulUnsafe(this, CURVE.n).is0();
     }
     // Converts Extended point to default (x, y) coordinates.
     // Can accept precomputed Z^-1 - for example, from invertBatch.
     toAffine(invertedZ) {
       const p = this;
       let iz = invertedZ;
+      if (iz != null && typeof iz !== "bigint")
+        throw new TypeError('"invertedZ" expected bigint, got type=' + typeof iz);
       const { X, Y, Z } = p;
       const is0 = p.is0();
       if (iz == null)
-        iz = is0 ? _8n2 : Fp2.inv(Z);
-      const x = modP(X * iz);
-      const y = modP(Y * iz);
+        iz = is0 ? Fp2.create(_8n2) : Fp2.inv(Z);
+      const x2 = Fp2.mul(X, iz);
+      const y = Fp2.mul(Y, iz);
       const zz = Fp2.mul(Z, iz);
       if (is0)
-        return { x: _0n4, y: _1n4 };
-      if (zz !== _1n4)
+        return { x: Fp2.ZERO, y: Fp2.ONE };
+      if (!Fp2.eql(zz, Fp2.ONE))
         throw new Error("invZ was invalid");
-      return { x, y };
+      return { x: x2, y };
     }
     clearCofactor() {
       if (cofactor === _1n4)
         return this;
+      if (cofactor === _2n2)
+        return this.double();
+      if (cofactor === _4n3)
+        return this.double().double();
+      if (cofactor === _8n2)
+        return this.double().double().double();
       return this.multiplyUnsafe(cofactor);
     }
     toBytes() {
-      const { x, y } = this.toAffine();
+      const { x: x2, y } = this.toAffine();
       const bytes = Fp2.toBytes(y);
-      bytes[bytes.length - 1] |= x & _1n4 ? 128 : 0;
+      bytes[bytes.length - 1] |= isOdd(x2) ? 128 : 0;
       return bytes;
     }
     toHex() {
@@ -1660,94 +1926,16 @@ function edwards(params, extraOpts = {}) {
       return `<Point ${this.is0() ? "ZERO" : this.toHex()}>`;
     }
   }
-  const wnaf = new wNAF(Point, Fn2.BITS);
-  if (Fn2.BITS >= 8)
-    Point.BASE.precompute(8);
+  const normalize = (points) => normalizeZ(Point, points);
+  const wnaf = new ScalarMultiplier(Point, randomBytes5);
+  if (wnaf.bits >= 6)
+    Point.BASE.precompute(6);
   Object.freeze(Point.prototype);
   Object.freeze(Point);
   return Point;
 }
-var PrimeEdwardsPoint = class {
-  static BASE;
-  static ZERO;
-  static Fp;
-  static Fn;
-  ep;
-  /**
-   * Wrap one internal Edwards representative directly.
-   * This is not a canonical encoding boundary: alternate Edwards
-   * representatives may still describe the same abstract wrapper element.
-   */
-  constructor(ep) {
-    this.ep = ep;
-  }
-  // Static methods that must be implemented by subclasses
-  static fromBytes(_bytes) {
-    notImplemented();
-  }
-  static fromHex(_hex) {
-    notImplemented();
-  }
-  get x() {
-    return this.toAffine().x;
-  }
-  get y() {
-    return this.toAffine().y;
-  }
-  // Common implementations
-  clearCofactor() {
-    return this;
-  }
-  assertValidity() {
-    this.ep.assertValidity();
-  }
-  /**
-   * Return affine coordinates of the current internal Edwards representative.
-   * This is a convenience helper, not a canonical Ristretto/Decaf encoding.
-   * Equal abstract elements may expose different `x` / `y`; use
-   * `toBytes()` / `fromBytes()` for canonical roundtrips.
-   */
-  toAffine(invertedZ) {
-    return this.ep.toAffine(invertedZ);
-  }
-  toHex() {
-    return bytesToHex2(this.toBytes());
-  }
-  toString() {
-    return this.toHex();
-  }
-  isTorsionFree() {
-    return true;
-  }
-  isSmallOrder() {
-    return false;
-  }
-  add(other) {
-    this.assertSame(other);
-    return this.init(this.ep.add(other.ep));
-  }
-  subtract(other) {
-    this.assertSame(other);
-    return this.init(this.ep.subtract(other.ep));
-  }
-  multiply(scalar) {
-    return this.init(this.ep.multiply(scalar));
-  }
-  multiplyUnsafe(scalar) {
-    return this.init(this.ep.multiplyUnsafe(scalar));
-  }
-  double() {
-    return this.init(this.ep.double());
-  }
-  negate() {
-    return this.init(this.ep.negate());
-  }
-  precompute(windowSize, isLazy) {
-    this.ep.precompute(windowSize, isLazy);
-    return this;
-  }
-};
 function eddsa(Point, cHash, eddsaOpts = {}) {
+  validatePointCons(Point);
   if (typeof cHash !== "function")
     throw new Error('"hash" function param is required');
   const hash = cHash;
@@ -1758,10 +1946,12 @@ function eddsa(Point, cHash, eddsaOpts = {}) {
     domain: "function",
     prehash: "function",
     zip215: "boolean",
-    mapToCurve: "function"
+    mapToCurve: "function",
+    toMontgomery: "function",
+    toMontgomerySecret: "function"
   });
   const { prehash } = opts;
-  const { BASE, Fp: Fp2, Fn: Fn2 } = Point;
+  const { BASE, Fp: Fp2, Fn } = Point;
   const outputLen = hash.outputLen;
   const expectedLen = 2 * Fp2.BYTES;
   if (outputLen !== void 0) {
@@ -1770,6 +1960,8 @@ function eddsa(Point, cHash, eddsaOpts = {}) {
       throw new Error(`hash.outputLen must be ${expectedLen}, got ${outputLen}`);
   }
   const randomBytes5 = opts.randomBytes === void 0 ? randomBytes2 : opts.randomBytes;
+  const toMontgomery2 = opts.toMontgomery;
+  const toMontgomerySecret2 = opts.toMontgomerySecret;
   const adjustScalarBytes2 = opts.adjustScalarBytes === void 0 ? (bytes) => bytes : opts.adjustScalarBytes;
   const domain = opts.domain === void 0 ? (data, ctx, phflag) => {
     abool(phflag, "phflag");
@@ -1778,7 +1970,7 @@ function eddsa(Point, cHash, eddsaOpts = {}) {
     return data;
   } : opts.domain;
   function modN_LE(hash2) {
-    return Fn2.create(bytesToNumberLE(hash2));
+    return Fn.create(bytesToNumberLE(hash2));
   }
   function getPrivateScalar(key) {
     const len = lengths.secretKey;
@@ -1803,23 +1995,25 @@ function eddsa(Point, cHash, eddsaOpts = {}) {
     return modN_LE(hash(domain(msg, abytes2(context, void 0, "context"), !!prehash)));
   }
   function sign(msg, secretKey, options = {}) {
-    msg = abytes2(msg, void 0, "message");
+    validateObject(options, {}, {}, "options");
+    msg = copyBytes2(abytes2(msg, void 0, "message"));
     if (prehash)
       msg = prehash(msg);
     const { prefix, scalar, pointBytes } = getExtendedPublicKey(secretKey);
     const r = hashDomainToScalar(options.context, prefix, msg);
     const R = BASE.multiply(r).toBytes();
     const k = hashDomainToScalar(options.context, R, pointBytes, msg);
-    const s = Fn2.create(r + k * scalar);
-    if (!Fn2.isValid(s))
+    const s = Fn.create(r + k * scalar);
+    if (!Fn.isValid(s))
       throw new Error("sign failed: invalid s");
-    const rs = concatBytes2(R, Fn2.toBytes(s));
+    const rs = concatBytes2(R, Fn.toBytes(s));
     return abytes2(rs, lengths.signature, "result");
   }
   const verifyOpts = {
     zip215: opts.zip215
   };
   function verify(sig, msg, publicKey, options = verifyOpts) {
+    validateObject(options);
     const { context } = options;
     const zip215 = options.zip215 === void 0 ? !!verifyOpts.zip215 : options.zip215;
     const len = lengths.signature;
@@ -1873,29 +2067,16 @@ function eddsa(Point, cHash, eddsaOpts = {}) {
     randomSecretKey,
     isValidSecretKey,
     isValidPublicKey,
-    /**
-     * Converts ed public key to x public key. Uses formula:
-     * - ed25519:
-     *   - `(u, v) = ((1+y)/(1-y), sqrt(-486664)*u/x)`
-     *   - `(x, y) = (sqrt(-486664)*u/v, (u-1)/(u+1))`
-     * - ed448:
-     *   - `(u, v) = ((y-1)/(y+1), sqrt(156324)*u/x)`
-     *   - `(x, y) = (sqrt(156324)*u/v, (1+u)/(1-u))`
-     */
+    /** Converts an Edwards public key to a companion Montgomery public key. */
     toMontgomery(publicKey) {
-      const { y } = Point.fromBytes(publicKey);
-      const size = lengths.publicKey;
-      const is25519 = size === 32;
-      if (!is25519 && size !== 57)
-        throw new Error("only defined for 25519 and 448");
-      const u = is25519 ? Fp2.div(_1n4 + y, _1n4 - y) : Fp2.div(y - _1n4, y + _1n4);
-      return Fp2.toBytes(u);
+      if (toMontgomery2 === void 0)
+        throw new Error("Montgomery conversion is not supported for this curve");
+      return toMontgomery2(Point.fromBytes(publicKey));
     },
     toMontgomerySecret(secretKey) {
-      const size = lengths.secretKey;
-      abytes2(secretKey, size);
-      const hashed = hash(secretKey.subarray(0, size));
-      return adjustScalarBytes2(hashed).subarray(0, size);
+      if (toMontgomerySecret2 === void 0)
+        throw new Error("Montgomery conversion is not supported for this curve");
+      return toMontgomerySecret2(secretKey);
     }
   };
   Object.freeze(lengths);
@@ -1911,65 +2092,22 @@ function eddsa(Point, cHash, eddsaOpts = {}) {
   });
 }
 
-// ../../node_modules/@noble/curves/abstract/hash-to-curve.js
-function i2osp(value, length) {
-  asafenumber(value);
-  asafenumber(length);
-  if (length < 0 || length > 4)
-    throw new Error("invalid I2OSP length: " + length);
-  if (value < 0 || value > 2 ** (8 * length) - 1)
-    throw new Error("invalid I2OSP input: " + value);
-  const res = Array.from({ length }).fill(0);
-  for (let i = length - 1; i >= 0; i--) {
-    res[i] = value & 255;
-    value >>>= 8;
-  }
-  return new Uint8Array(res);
-}
-function strxor(a, b) {
-  const arr = new Uint8Array(a.length);
-  for (let i = 0; i < a.length; i++) {
-    arr[i] = a[i] ^ b[i];
-  }
-  return arr;
-}
-function normDST(DST) {
-  if (!isBytes2(DST) && typeof DST !== "string")
-    throw new Error("DST must be Uint8Array or ascii string");
-  const dst = typeof DST === "string" ? asciiToBytes(DST) : DST;
-  if (dst.length === 0)
-    throw new Error("DST must be non-empty");
-  return dst;
-}
-function expand_message_xmd(msg, DST, lenInBytes, H) {
-  abytes2(msg);
-  asafenumber(lenInBytes);
-  DST = normDST(DST);
-  if (DST.length > 255)
-    DST = H(concatBytes2(asciiToBytes("H2C-OVERSIZE-DST-"), DST));
-  const { outputLen: b_in_bytes, blockLen: r_in_bytes } = H;
-  const ell = Math.ceil(lenInBytes / b_in_bytes);
-  if (lenInBytes > 65535 || ell > 255)
-    throw new Error("expand_message_xmd: invalid lenInBytes");
-  const DST_prime = concatBytes2(DST, i2osp(DST.length, 1));
-  const Z_pad = new Uint8Array(r_in_bytes);
-  const l_i_b_str = i2osp(lenInBytes, 2);
-  const b = new Array(ell);
-  const b_0 = H(concatBytes2(Z_pad, msg, l_i_b_str, i2osp(0, 1), DST_prime));
-  b[0] = H(concatBytes2(b_0, i2osp(1, 1), DST_prime));
-  for (let i = 1; i < ell; i++) {
-    const args = [strxor(b_0, b[i - 1]), i2osp(i + 1, 1), DST_prime];
-    b[i] = H(concatBytes2(...args));
-  }
-  const pseudo_random_bytes = concatBytes2(...b);
-  return pseudo_random_bytes.slice(0, lenInBytes);
-}
-var _DST_scalar = "HashToScalar-";
-
 // ../../node_modules/@noble/curves/abstract/montgomery.js
-var _0n5 = BigInt(0);
-var _1n5 = BigInt(1);
-var _2n3 = BigInt(2);
+var _0n5 = /* @__PURE__ */ BigInt(0);
+var _1n5 = /* @__PURE__ */ BigInt(1);
+var _2n3 = /* @__PURE__ */ BigInt(2);
+function cmask(P, swap) {
+  return P + swap - (swap >> _1n5 << _1n5);
+}
+function cswap(P) {
+  const offset = BigInt(6) * P;
+  return (mask, x_2, x_3) => {
+    const sum = x_2 + x_3;
+    const d = offset + x_3 - x_2;
+    const a = (d * mask + x_2) % P;
+    return { x_2: a, x_3: sum - a };
+  };
+}
 function validateOpts(curve) {
   validateObject(curve, {
     P: "bigint",
@@ -1977,23 +2115,26 @@ function validateOpts(curve) {
     adjustScalarBytes: "function",
     powPminus2: "function"
   }, {
-    randomBytes: "function"
+    randomBytes: "function",
+    scalarMultBase: "function"
   });
   return Object.freeze({ ...curve });
 }
 function montgomery(curveDef) {
   const CURVE = validateOpts(curveDef);
   const { P, type, adjustScalarBytes: adjustScalarBytes2, powPminus2, randomBytes: rand } = CURVE;
+  const mulBaseHook = CURVE.scalarMultBase;
   const is25519 = type === "x25519";
   if (!is25519 && type !== "x448")
     throw new Error("invalid type");
   const randomBytes_ = rand === void 0 ? randomBytes2 : rand;
   const montgomeryBits = is25519 ? 255 : 448;
+  const swap = cswap(P);
   const fieldLen = is25519 ? 32 : 56;
   const Gu = is25519 ? BigInt(9) : BigInt(5);
   const a24 = is25519 ? BigInt(121665) : BigInt(39081);
   const minScalar = is25519 ? _2n3 ** BigInt(254) : _2n3 ** BigInt(447);
-  const maxAdded = is25519 ? BigInt(8) * _2n3 ** BigInt(251) - _1n5 : BigInt(4) * _2n3 ** BigInt(445) - _1n5;
+  const maxAdded = is25519 ? BigInt(8) * (_2n3 ** BigInt(251) - _1n5) : BigInt(4) * (_2n3 ** BigInt(445) - _1n5);
   const maxScalar = minScalar + maxAdded + _1n5;
   const modP = (n) => mod(n, P);
   const GuBytes = encodeU(Gu);
@@ -2001,31 +2142,42 @@ function montgomery(curveDef) {
     return numberToBytesLE(modP(u), fieldLen);
   }
   function decodeU(u) {
-    const _u = copyBytes(abytes2(u, fieldLen, "uCoordinate"));
+    const _u = copyBytes2(abytes2(u, fieldLen, "uCoordinate"));
     if (is25519)
       _u[31] &= 127;
     return modP(bytesToNumberLE(_u));
   }
   function decodeScalar(scalar) {
-    return bytesToNumberLE(adjustScalarBytes2(copyBytes(abytes2(scalar, fieldLen, "scalar"))));
-  }
+    return bytesToNumberLE(adjustScalarBytes2(copyBytes2(abytes2(scalar, fieldLen, "scalar"))));
+  }
+  const lowOrderU = new Set(is25519 ? [
+    _0n5,
+    _1n5,
+    P - _1n5,
+    BigInt("325606250916557431795983626356110631294008115727848805560023387167927233504"),
+    BigInt("39382357235489614581723060781553021112529911719440698176882885853963445705823")
+  ] : [_0n5, _1n5, P - _1n5]);
   function scalarMult(scalar, u) {
-    const pu = montgomeryLadder(decodeU(u), decodeScalar(scalar));
+    const pointU = decodeU(u);
+    if (lowOrderU.has(pointU))
+      throw new Error("invalid private or public key received");
+    const pu = montgomeryLadder(pointU, decodeScalar(scalar));
     if (pu === _0n5)
       throw new Error("invalid private or public key received");
     return encodeU(pu);
   }
   function scalarMultBase(scalar) {
-    return scalarMult(scalar, GuBytes);
+    if (mulBaseHook === void 0)
+      return scalarMult(scalar, GuBytes);
+    const k = decodeScalar(scalar);
+    aInRange("scalar", k, minScalar, maxScalar);
+    const pu = modP(mulBaseHook(k));
+    if (pu === _0n5)
+      throw new Error("invalid private or public key received");
+    return encodeU(pu);
   }
   const getPublicKey = scalarMultBase;
   const getSharedSecret = scalarMult;
-  function cswap(swap, x_2, x_3) {
-    const dummy = modP(swap * (x_2 - x_3));
-    x_2 = modP(x_2 - dummy);
-    x_3 = modP(x_3 + dummy);
-    return { x_2, x_3 };
-  }
   function montgomeryLadder(u, scalar) {
     aInRange("u", u, _0n5, P);
     aInRange("scalar", scalar, minScalar, maxScalar);
@@ -2035,13 +2187,11 @@ function montgomery(curveDef) {
     let z_2 = _0n5;
     let x_3 = u;
     let z_3 = _1n5;
-    let swap = _0n5;
+    const kx = k ^ k >> _1n5;
     for (let t = BigInt(montgomeryBits - 1); t >= _0n5; t--) {
-      const k_t = k >> t & _1n5;
-      swap ^= k_t;
-      ({ x_2, x_3 } = cswap(swap, x_2, x_3));
-      ({ x_2: z_2, x_3: z_3 } = cswap(swap, z_2, z_3));
-      swap = k_t;
+      const mask2 = cmask(P, kx >> t);
+      ({ x_2, x_3 } = swap(mask2, x_2, x_3));
+      ({ x_2: z_2, x_3: z_3 } = swap(mask2, z_2, z_3));
       const A = x_2 + z_2;
       const AA = modP(A * A);
       const B = x_2 - z_2;
@@ -2058,8 +2208,9 @@ function montgomery(curveDef) {
       x_2 = modP(AA * BB);
       z_2 = modP(E * (AA + modP(a24 * E)));
     }
-    ({ x_2, x_3 } = cswap(swap, x_2, x_3));
-    ({ x_2: z_2, x_3: z_3 } = cswap(swap, z_2, z_3));
+    const mask = cmask(P, k);
+    ({ x_2, x_3 } = swap(mask, x_2, x_3));
+    ({ x_2: z_2, x_3: z_3 } = swap(mask, z_2, z_3));
     const z2 = powPminus2(z_2);
     return modP(x_2 * z2);
   }
@@ -2105,13 +2256,13 @@ var ed25519_CURVE = /* @__PURE__ */ (() => ({
   Gx: BigInt("0x216936d3cd6e53fec0a4e231fdd6dc5c692cc7609525a7b2c9562d608f25d51a"),
   Gy: BigInt("0x6666666666666666666666666666666666666666666666666666666666666658")
 }))();
-function ed25519_pow_2_252_3(x) {
+function ed25519_pow_2_252_3(x2) {
   const _10n = BigInt(10), _20n = BigInt(20), _40n = BigInt(40), _80n = BigInt(80);
   const P = ed25519_CURVE_p;
-  const x2 = x * x % P;
-  const b2 = x2 * x % P;
+  const x22 = x2 * x2 % P;
+  const b2 = x22 * x2 % P;
   const b4 = pow2(b2, _2n4, P) * b2 % P;
-  const b5 = pow2(b4, _1n6, P) * x % P;
+  const b5 = pow2(b4, _1n6, P) * x2 % P;
   const b10 = pow2(b5, _5n2, P) * b5 % P;
   const b20 = pow2(b10, _10n, P) * b10 % P;
   const b40 = pow2(b20, _20n, P) * b20 % P;
@@ -2119,7 +2270,7 @@ function ed25519_pow_2_252_3(x) {
   const b160 = pow2(b80, _80n, P) * b80 % P;
   const b240 = pow2(b160, _80n, P) * b80 % P;
   const b250 = pow2(b240, _10n, P) * b10 % P;
-  const pow_p_5_8 = pow2(b250, _2n4, P) * x % P;
+  const pow_p_5_8 = pow2(b250, _2n4, P) * x2 % P;
   return { pow_p_5_8, b2 };
 }
 function adjustScalarBytes(bytes) {
@@ -2133,233 +2284,60 @@ function uvRatio(u, v) {
   const P = ed25519_CURVE_p;
   const v3 = mod(v * v * v, P);
   const v7 = mod(v3 * v3 * v, P);
-  const pow = ed25519_pow_2_252_3(u * v7).pow_p_5_8;
-  let x = mod(u * v3 * pow, P);
-  const vx2 = mod(v * x * x, P);
-  const root1 = x;
-  const root2 = mod(x * ED25519_SQRT_M1, P);
+  const pow3 = ed25519_pow_2_252_3(u * v7).pow_p_5_8;
+  let x2 = mod(u * v3 * pow3, P);
+  const vx2 = mod(v * x2 * x2, P);
+  const root1 = x2;
+  const root2 = mod(x2 * ED25519_SQRT_M1, P);
   const useRoot1 = vx2 === u;
   const useRoot2 = vx2 === mod(-u, P);
   const noRoot = vx2 === mod(-u * ED25519_SQRT_M1, P);
   if (useRoot1)
-    x = root1;
+    x2 = root1;
   if (useRoot2 || noRoot)
-    x = root2;
-  if (isNegativeLE(x, P))
-    x = mod(-x, P);
-  return { isValid: useRoot1 || useRoot2, value: x };
+    x2 = root2;
+  if (isNegativeLE(x2, P))
+    x2 = mod(-x2, P);
+  return { isValid: useRoot1 || useRoot2, value: x2 };
 }
 var ed25519_Point = /* @__PURE__ */ edwards(ed25519_CURVE, { uvRatio });
 var Fp = /* @__PURE__ */ (() => ed25519_Point.Fp)();
-var Fn = /* @__PURE__ */ (() => ed25519_Point.Fn)();
+function toMontgomery(point) {
+  const { y } = point;
+  return Fp.toBytes(Fp.div(_1n6 + y, _1n6 - y));
+}
+function toMontgomerySecret(secretKey) {
+  const size = ed25519_Point.Fp.BYTES;
+  abytes(secretKey, size);
+  return adjustScalarBytes(sha512(secretKey.subarray(0, size))).subarray(0, size);
+}
 function ed(opts) {
-  return eddsa(ed25519_Point, sha512, Object.assign({ adjustScalarBytes, zip215: true }, opts));
+  return eddsa(ed25519_Point, sha512, Object.assign({ adjustScalarBytes, toMontgomery, toMontgomerySecret, zip215: true }, opts));
 }
 var ed25519 = /* @__PURE__ */ ed({});
 var x25519 = /* @__PURE__ */ (() => {
   const P = ed25519_CURVE_p;
+  const powPminus2 = (x2) => {
+    const { pow_p_5_8, b2 } = ed25519_pow_2_252_3(x2);
+    return mod(pow2(pow_p_5_8, _3n2, P) * b2, P);
+  };
   return montgomery({
     P,
     type: "x25519",
-    powPminus2: (x) => {
-      const { pow_p_5_8, b2 } = ed25519_pow_2_252_3(x);
-      return mod(pow2(pow_p_5_8, _3n2, P) * b2, P);
-    },
-    adjustScalarBytes
+    powPminus2,
+    adjustScalarBytes,
+    // ~3x faster fixed-base: [k]B on the birationally-equivalent Edwards curve using cached
+    // base tables, mapped back via u = (1+y)/(1-y) = (Z+Y)/(Z-Y) with one Fermat inversion.
+    // Same construction as libsodium's crypto_scalarmult_curve25519_base.
+    scalarMultBase: (k) => {
+      const kn = mod(k, ed25519_Point.Fn.ORDER);
+      if (kn === _0n6)
+        return _0n6;
+      const p = ed25519_Point.BASE.multiply(kn);
+      return mod((p.Z + p.Y) * powPminus2(mod(p.Z - p.Y, P)), P);
+    }
   });
 })();
-var SQRT_M1 = ED25519_SQRT_M1;
-var SQRT_AD_MINUS_ONE = /* @__PURE__ */ BigInt("25063068953384623474111414158702152701244531502492656460079210482610430750235");
-var INVSQRT_A_MINUS_D = /* @__PURE__ */ BigInt("54469307008909316920995813868745141605393597292927456921205312896311721017578");
-var ONE_MINUS_D_SQ = /* @__PURE__ */ BigInt("1159843021668779879193775521855586647937357759715417654439879720876111806838");
-var D_MINUS_ONE_SQ = /* @__PURE__ */ BigInt("40440834346308536858101042469323190826248399146238708352240133220865137265952");
-var invertSqrt = (number) => uvRatio(_1n6, number);
-var MAX_255B = /* @__PURE__ */ BigInt("0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
-var bytes255ToNumberLE = (bytes) => Fp.create(bytesToNumberLE(bytes) & MAX_255B);
-function calcElligatorRistrettoMap(r0) {
-  const { d } = ed25519_CURVE;
-  const P = ed25519_CURVE_p;
-  const mod2 = (n) => Fp.create(n);
-  const r = mod2(SQRT_M1 * r0 * r0);
-  const Ns = mod2((r + _1n6) * ONE_MINUS_D_SQ);
-  let c = BigInt(-1);
-  const D = mod2((c - d * r) * mod2(r + d));
-  let { isValid: Ns_D_is_sq, value: s } = uvRatio(Ns, D);
-  let s_ = mod2(s * r0);
-  if (!isNegativeLE(s_, P))
-    s_ = mod2(-s_);
-  if (!Ns_D_is_sq)
-    s = s_;
-  if (!Ns_D_is_sq)
-    c = r;
-  const Nt = mod2(c * (r - _1n6) * D_MINUS_ONE_SQ - D);
-  const s2 = s * s;
-  const W0 = mod2((s + s) * D);
-  const W1 = mod2(Nt * SQRT_AD_MINUS_ONE);
-  const W2 = mod2(_1n6 - s2);
-  const W3 = mod2(_1n6 + s2);
-  return new ed25519_Point(mod2(W0 * W3), mod2(W2 * W1), mod2(W1 * W3), mod2(W0 * W2));
-}
-var _RistrettoPoint = class __RistrettoPoint extends PrimeEdwardsPoint {
-  // Do NOT change syntax: the following gymnastics is done,
-  // because typescript strips comments, which makes bundlers disable tree-shaking.
-  // prettier-ignore
-  static BASE = /* @__PURE__ */ (() => new __RistrettoPoint(ed25519_Point.BASE))();
-  // prettier-ignore
-  static ZERO = /* @__PURE__ */ (() => new __RistrettoPoint(ed25519_Point.ZERO))();
-  // prettier-ignore
-  static Fp = /* @__PURE__ */ (() => Fp)();
-  // prettier-ignore
-  static Fn = /* @__PURE__ */ (() => Fn)();
-  constructor(ep) {
-    super(ep);
-  }
-  /**
-   * Create one Ristretto255 point from affine Edwards coordinates.
-   * This wraps the internal Edwards representative directly and is not a
-   * canonical ristretto255 decoding path.
-   * Use `toBytes()` / `fromBytes()` if canonical ristretto255 bytes matter.
-   */
-  static fromAffine(ap) {
-    return new __RistrettoPoint(ed25519_Point.fromAffine(ap));
-  }
-  assertSame(other) {
-    if (!(other instanceof __RistrettoPoint))
-      throw new Error("RistrettoPoint expected");
-  }
-  init(ep) {
-    return new __RistrettoPoint(ep);
-  }
-  static fromBytes(bytes) {
-    abytes(bytes, 32);
-    const { a, d } = ed25519_CURVE;
-    const P = ed25519_CURVE_p;
-    const mod2 = (n) => Fp.create(n);
-    const s = bytes255ToNumberLE(bytes);
-    if (!equalBytes(Fp.toBytes(s), bytes) || isNegativeLE(s, P))
-      throw new Error("invalid ristretto255 encoding 1");
-    const s2 = mod2(s * s);
-    const u1 = mod2(_1n6 + a * s2);
-    const u2 = mod2(_1n6 - a * s2);
-    const u1_2 = mod2(u1 * u1);
-    const u2_2 = mod2(u2 * u2);
-    const v = mod2(a * d * u1_2 - u2_2);
-    const { isValid, value: I } = invertSqrt(mod2(v * u2_2));
-    const Dx = mod2(I * u2);
-    const Dy = mod2(I * Dx * v);
-    let x = mod2((s + s) * Dx);
-    if (isNegativeLE(x, P))
-      x = mod2(-x);
-    const y = mod2(u1 * Dy);
-    const t = mod2(x * y);
-    if (!isValid || isNegativeLE(t, P) || y === _0n6)
-      throw new Error("invalid ristretto255 encoding 2");
-    return new __RistrettoPoint(new ed25519_Point(x, y, _1n6, t));
-  }
-  /**
-   * Converts ristretto-encoded string to ristretto point.
-   * Described in [RFC9496](https://www.rfc-editor.org/rfc/rfc9496#name-decode).
-   * @param hex - Ristretto-encoded 32 bytes. Not every 32-byte string is valid ristretto encoding
-   */
-  static fromHex(hex) {
-    return __RistrettoPoint.fromBytes(hexToBytes(hex));
-  }
-  /**
-   * Encodes ristretto point to Uint8Array.
-   * Described in [RFC9496](https://www.rfc-editor.org/rfc/rfc9496#name-encode).
-   */
-  toBytes() {
-    let { X, Y, Z, T } = this.ep;
-    const P = ed25519_CURVE_p;
-    const mod2 = (n) => Fp.create(n);
-    const u1 = mod2(mod2(Z + Y) * mod2(Z - Y));
-    const u2 = mod2(X * Y);
-    const u2sq = mod2(u2 * u2);
-    const { value: invsqrt } = invertSqrt(mod2(u1 * u2sq));
-    const D1 = mod2(invsqrt * u1);
-    const D2 = mod2(invsqrt * u2);
-    const zInv = mod2(D1 * D2 * T);
-    let D;
-    if (isNegativeLE(T * zInv, P)) {
-      let _x = mod2(Y * SQRT_M1);
-      let _y = mod2(X * SQRT_M1);
-      X = _x;
-      Y = _y;
-      D = mod2(D1 * INVSQRT_A_MINUS_D);
-    } else {
-      D = D2;
-    }
-    if (isNegativeLE(X * zInv, P))
-      Y = mod2(-Y);
-    let s = mod2((Z - Y) * D);
-    if (isNegativeLE(s, P))
-      s = mod2(-s);
-    return Fp.toBytes(s);
-  }
-  /**
-   * Compares two Ristretto points.
-   * Described in [RFC9496](https://www.rfc-editor.org/rfc/rfc9496#name-equals).
-   */
-  equals(other) {
-    this.assertSame(other);
-    const { X: X1, Y: Y1 } = this.ep;
-    const { X: X2, Y: Y2 } = other.ep;
-    const mod2 = (n) => Fp.create(n);
-    const one = mod2(X1 * Y2) === mod2(Y1 * X2);
-    const two = mod2(Y1 * Y2) === mod2(X1 * X2);
-    return one || two;
-  }
-  is0() {
-    return this.equals(__RistrettoPoint.ZERO);
-  }
-};
-Object.freeze(_RistrettoPoint.BASE);
-Object.freeze(_RistrettoPoint.ZERO);
-Object.freeze(_RistrettoPoint.prototype);
-Object.freeze(_RistrettoPoint);
-var ristretto255_hasher = Object.freeze({
-  Point: _RistrettoPoint,
-  /**
-  * Spec: https://www.rfc-editor.org/rfc/rfc9380.html#name-hashing-to-ristretto255. Caveats:
-  * * There are no test vectors
-  * * encodeToCurve / mapToCurve is undefined
-  * * mapToCurve would be `calcElligatorRistrettoMap(scalars[0])`, not ristretto255_map!
-  * * hashToScalar is undefined too, so we just use OPRF implementation
-  * * We cannot re-use 'createHasher', because ristretto255_map is different algorithm/RFC
-    (os2ip -> bytes255ToNumberLE)
-  * * mapToCurve == calcElligatorRistrettoMap, hashToCurve == ristretto255_map
-  * * hashToScalar is undefined in RFC9380 for ristretto, so we use the OPRF
-    version here. Using `bytes255ToNumblerLE` will create a different result
-    if we use `bytes255ToNumberLE` as os2ip
-  * * current version is closest to spec.
-  */
-  hashToCurve(msg, options) {
-    const DST = options?.DST === void 0 ? "ristretto255_XMD:SHA-512_R255MAP_RO_" : options.DST;
-    const xmd = expand_message_xmd(msg, DST, 64, sha512);
-    return ristretto255_hasher.deriveToCurve(xmd);
-  },
-  hashToScalar(msg, options = { DST: _DST_scalar }) {
-    const xmd = expand_message_xmd(msg, options.DST, 64, sha512);
-    return Fn.create(bytesToNumberLE(xmd));
-  },
-  /**
-   * HashToCurve-like construction based on RFC 9496 (Element Derivation).
-   * Converts 64 uniform random bytes into a curve point.
-   *
-   * WARNING: This represents an older hash-to-curve construction from before
-   * RFC 9380 was finalized.
-   * It was later reused as a component in the newer
-   * `hash_to_ristretto255` function defined in RFC 9380.
-   */
-  deriveToCurve(bytes) {
-    abytes(bytes, 64);
-    const r1 = bytes255ToNumberLE(bytes.subarray(0, 32));
-    const R1 = calcElligatorRistrettoMap(r1);
-    const r2 = bytes255ToNumberLE(bytes.subarray(32, 64));
-    const R2 = calcElligatorRistrettoMap(r2);
-    return new _RistrettoPoint(R1.add(R2));
-  }
-});
 
 // ../../node_modules/@noble/hashes/_blake.js
 var BSIGMA = /* @__PURE__ */ Uint8Array.from([
@@ -2621,15 +2599,15 @@ var BSIGMA = /* @__PURE__ */ Uint8Array.from([
   1,
   9
 ]);
-function G1s(a, b, c, d, x) {
-  a = a + b + x | 0;
+function G1s(a, b, c, d, x2) {
+  a = a + b + x2 | 0;
   d = rotr(d ^ a, 16);
   c = c + d | 0;
   b = rotr(b ^ c, 12);
   return { a, b, c, d };
 }
-function G2s(a, b, c, d, x) {
-  a = a + b + x | 0;
+function G2s(a, b, c, d, x2) {
+  a = a + b + x2 | 0;
   d = rotr(d ^ a, 8);
   c = c + d | 0;
   b = rotr(b ^ c, 7);
@@ -2640,7 +2618,7 @@ function G2s(a, b, c, d, x) {
 function checkBlake2Opts(outputLen, opts = {}, keyLen, saltLen, persLen) {
   anumber(keyLen);
   if (outputLen <= 0 || outputLen > keyLen)
-    throw new Error("outputLen bigger than keyLen");
+    throw new Error('"dkLen" must be 1..' + keyLen + ", got " + outputLen);
   const { key, salt, personalization } = opts;
   if (key !== void 0 && (key.length < 1 || key.length > keyLen))
     throw new Error('"key" expected to be undefined or of length=1..' + keyLen);
@@ -2693,7 +2671,7 @@ var _BLAKE2 = class {
         swap32IfBE(data32);
         continue;
       }
-      buffer.set(data.subarray(pos, pos + take), this.pos);
+      buffer.set(pos === 0 && take === len ? data : data.subarray(pos, pos + take), this.pos);
       this.pos += take;
       this.length += take;
       pos += take;
@@ -2703,26 +2681,26 @@ var _BLAKE2 = class {
   digestInto(out) {
     aexists(this);
     aoutput(out, this);
+    if (out.byteOffset & 3)
+      throw new RangeError('"output" expected 4-byte aligned byteOffset, got ' + out.byteOffset);
     const { pos, buffer32 } = this;
     this.finished = true;
-    clean(this.buffer.subarray(pos));
+    this.buffer.fill(0, pos);
     swap32IfBE(buffer32);
     this.compress(buffer32, 0, true);
     swap32IfBE(buffer32);
-    if (out.byteOffset & 3)
-      throw new RangeError('"digestInto() output" expected 4-byte aligned byteOffset, got ' + out.byteOffset);
     const state = this.get();
-    const out32 = u32(out);
+    const out32 = out === this.buffer ? buffer32 : u32(out);
     const full = Math.floor(this.outputLen / 4);
-    for (let i = 0; i < full; i++)
-      out32[i] = swap8IfBE(state[i]);
+    for (let i2 = 0; i2 < full; i2++)
+      out32[i2] = swap8IfBE(state[i2]);
     const tail = this.outputLen % 4;
     if (!tail)
       return;
     const off = full * 4;
     const word = state[full];
-    for (let i = 0; i < tail; i++)
-      out[off + i] = word >>> 8 * i;
+    for (let i2 = 0; i2 < tail; i2++)
+      out[off + i2] = word >>> 8 * i2;
   }
   digest() {
     const { buffer, outputLen } = this;
@@ -2747,9 +2725,9 @@ var _BLAKE2 = class {
     return this._cloneInto();
   }
 };
-function compress(s, offset, msg, rounds, v0, v1, v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, v12, v13, v14, v15) {
+function _compress(s, offset, msg, rounds, v0, v1, v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, v12, v13, v14, v15) {
   let j = 0;
-  for (let i = 0; i < rounds; i++) {
+  for (let i2 = 0; i2 < rounds; i2++) {
     ({ a: v0, b: v4, c: v8, d: v12 } = G1s(v0, v4, v8, v12, msg[offset + s[j++]]));
     ({ a: v0, b: v4, c: v8, d: v12 } = G2s(v0, v4, v8, v12, msg[offset + s[j++]]));
     ({ a: v1, b: v5, c: v9, d: v13 } = G1s(v1, v5, v9, v13, msg[offset + s[j++]]));
@@ -2781,6 +2759,7 @@ var _BLAKE2s = class extends _BLAKE2 {
   v6 = B2S_IV[6] | 0;
   v7 = B2S_IV[7] | 0;
   constructor(opts = {}) {
+    opts = checkOpts({}, opts);
     const olen = opts.dkLen === void 0 ? 32 : opts.dkLen;
     super(64, olen);
     checkBlake2Opts(olen, opts, 32, 8, 8);
@@ -2793,13 +2772,13 @@ var _BLAKE2s = class extends _BLAKE2 {
     this.v0 ^= this.outputLen | keyLength << 8 | 1 << 16 | 1 << 24;
     if (salt !== void 0) {
       abytes(salt, void 0, "salt");
-      const slt = u32(salt);
+      const slt = u32(copyBytes(salt));
       this.v4 ^= swap8IfBE(slt[0]);
       this.v5 ^= swap8IfBE(slt[1]);
     }
     if (personalization !== void 0) {
       abytes(personalization, void 0, "personalization");
-      const pers = u32(personalization);
+      const pers = u32(copyBytes(personalization));
       this.v6 ^= swap8IfBE(pers[0]);
       this.v7 ^= swap8IfBE(pers[1]);
     }
@@ -2807,6 +2786,7 @@ var _BLAKE2s = class extends _BLAKE2 {
       const tmp = new Uint8Array(this.blockLen);
       tmp.set(key);
       this.update(tmp);
+      clean(tmp);
     }
   }
   get() {
@@ -2825,8 +2805,9 @@ var _BLAKE2s = class extends _BLAKE2 {
     this.v7 = v7 | 0;
   }
   compress(msg, offset, isLast) {
-    const { h, l } = fromBig(BigInt(this.length));
-    const { v0, v1, v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, v12, v13, v14, v15 } = compress(BSIGMA, offset, msg, 10, this.v0, this.v1, this.v2, this.v3, this.v4, this.v5, this.v6, this.v7, B2S_IV[0], B2S_IV[1], B2S_IV[2], B2S_IV[3], l ^ B2S_IV[4], h ^ B2S_IV[5], isLast ? ~B2S_IV[6] : B2S_IV[6], B2S_IV[7]);
+    const l = fromNumL(this.length);
+    const h = fromNumH(this.length);
+    const { v0, v1, v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, v12, v13, v14, v15 } = _compress(BSIGMA, offset, msg, 10, this.v0, this.v1, this.v2, this.v3, this.v4, this.v5, this.v6, this.v7, B2S_IV[0], B2S_IV[1], B2S_IV[2], B2S_IV[3], l ^ B2S_IV[4], h ^ B2S_IV[5], isLast ? ~B2S_IV[6] : B2S_IV[6], B2S_IV[7]);
     this.v0 ^= v0 ^ v8;
     this.v1 ^= v1 ^ v9;
     this.v2 ^= v2 ^ v10;
@@ -2858,18 +2839,18 @@ var _HMAC = class {
     abytes(key, void 0, "key");
     this.iHash = hash.create();
     if (typeof this.iHash.update !== "function")
-      throw new Error("Expected instance of class which extends utils.Hash");
+      throw new Error("expected Hash instance");
     this.blockLen = this.iHash.blockLen;
     this.outputLen = this.iHash.outputLen;
     const blockLen = this.blockLen;
     const pad = new Uint8Array(blockLen);
     pad.set(key.length > blockLen ? hash.create().update(key).digest() : key);
-    for (let i = 0; i < pad.length; i++)
-      pad[i] ^= 54;
+    for (let i2 = 0; i2 < pad.length; i2++)
+      pad[i2] ^= 54;
     this.iHash.update(pad);
     this.oHash = hash.create();
-    for (let i = 0; i < pad.length; i++)
-      pad[i] ^= 54 ^ 92;
+    for (let i2 = 0; i2 < pad.length; i2++)
+      pad[i2] ^= 54 ^ 92;
     this.oHash.update(pad);
     clean(pad);
   }
@@ -2895,12 +2876,13 @@ var _HMAC = class {
   }
   _cloneInto(to) {
     to ||= Object.create(Object.getPrototypeOf(this), {});
-    const { oHash, iHash, finished, destroyed, blockLen, outputLen } = this;
+    const { oHash, iHash, finished, destroyed, blockLen, outputLen, canXOF } = this;
     to = to;
     to.finished = finished;
     to.destroyed = destroyed;
     to.blockLen = blockLen;
     to.outputLen = outputLen;
+    to.canXOF = canXOF;
     to.oHash = oHash._cloneInto(to.oHash);
     to.iHash = iHash._cloneInto(to.iHash);
     return to;
@@ -2921,15 +2903,9 @@ var hmac = /* @__PURE__ */ (() => {
 })();
 
 // ../../node_modules/@noble/hashes/hkdf.js
-function extract(hash, ikm, salt) {
-  ahash(hash);
-  if (salt === void 0)
-    salt = new Uint8Array(hash.outputLen);
-  return hmac(hash, salt, ikm);
-}
 var HKDF_COUNTER = /* @__PURE__ */ Uint8Array.of(0);
 var EMPTY_BUFFER = /* @__PURE__ */ Uint8Array.of();
-function expand(hash, prk, info, length = 32) {
+function expand(hash, prk, info, length = 32, _recycled) {
   ahash(hash);
   anumber(length, "length");
   abytes(prk, void 0, "prk");
@@ -2943,99 +2919,144 @@ function expand(hash, prk, info, length = 32) {
     info = EMPTY_BUFFER;
   else
     abytes(info, void 0, "info");
-  const okm = new Uint8Array(blocks * olen);
-  const HMAC = hmac.create(hash, prk);
-  const HMACTmp = HMAC._cloneInto();
-  const T = new Uint8Array(HMAC.outputLen);
-  for (let counter = 0; counter < blocks; counter++) {
+  if (!blocks) {
+    if (_recycled)
+      clean(prk);
+    return new Uint8Array();
+  }
+  const okm = _recycled && blocks === 1 ? prk : new Uint8Array(blocks * olen);
+  const { iHash, oHash } = hmac.create(hash, prk);
+  const T = _recycled ? prk : new Uint8Array(olen);
+  const worker = blocks > 1 ? _recycled?.iHash || hash.create() : void 0;
+  for (let counter = 0; counter < blocks - 1; counter++) {
     HKDF_COUNTER[0] = counter + 1;
-    HMACTmp.update(counter === 0 ? EMPTY_BUFFER : T).update(info).update(HKDF_COUNTER).digestInto(T);
+    const iWork = iHash._cloneInto(worker);
+    if (counter)
+      iWork.update(T);
+    iWork.update(info).update(HKDF_COUNTER).digestInto(T);
+    oHash._cloneInto(worker).update(T).digestInto(T);
     okm.set(T, olen * counter);
-    HMAC._cloneInto(HMACTmp);
   }
-  HMAC.destroy();
-  HMACTmp.destroy();
-  clean(T, HKDF_COUNTER);
-  return okm.slice(0, length);
+  HKDF_COUNTER[0] = blocks;
+  if (blocks > 1)
+    iHash.update(T);
+  iHash.update(info).update(HKDF_COUNTER).digestInto(T);
+  oHash.update(T).digestInto(T);
+  okm.set(T, olen * (blocks - 1));
+  iHash.destroy();
+  oHash.destroy();
+  worker?.destroy();
+  if (T !== okm)
+    clean(T);
+  clean(HKDF_COUNTER);
+  if (length === okm.length)
+    return okm;
+  const res = okm.slice(0, length);
+  clean(okm);
+  return res;
 }
-var hkdf = (hash, ikm, salt, info, length) => expand(hash, extract(hash, ikm, salt), info, length);
+var hkdf = (hash, ikm, salt, info, length) => {
+  ahash(hash);
+  if (salt === void 0)
+    salt = new Uint8Array(hash.outputLen);
+  const HMAC = hmac.create(hash, salt).update(ikm);
+  return expand(hash, HMAC.digest(), info, length, HMAC);
+};
 
 // ../../node_modules/@noble/ciphers/utils.js
 function isBytes3(a) {
   return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array" && "BYTES_PER_ELEMENT" in a && a.BYTES_PER_ELEMENT === 1;
 }
-function abool2(b) {
-  if (typeof b !== "boolean")
-    throw new TypeError(`boolean expected, not ${b}`);
+var atitle3 = (title) => title ? `"${title}" ` : "";
+function abool2(value, title = "") {
+  if (typeof value !== "boolean")
+    throw new TypeError(atitle3(title) + "expected boolean, got type=" + typeof value);
+  return value;
 }
-function anumber3(n) {
+function anumber3(n, title = "") {
   if (typeof n !== "number")
-    throw new TypeError("number expected, got " + typeof n);
+    throw new TypeError(atitle3(title) + "expected number, got " + typeof n);
   if (!Number.isSafeInteger(n) || n < 0)
-    throw new RangeError("positive integer expected, got " + n);
+    throw new RangeError(atitle3(title) + "expected integer >= 0, got " + n);
+  return n;
 }
 function abytes3(value, length, title = "") {
+  if (isBytes3(value) && (length === void 0 || value.length === length))
+    return value;
+  if (length !== void 0)
+    anumber3(length, "length");
   const bytes = isBytes3(value);
-  const len = value?.length;
-  const needsLen = length !== void 0;
-  if (!bytes || needsLen && len !== length) {
-    const prefix = title && `"${title}" `;
-    const ofLen = needsLen ? ` of length ${length}` : "";
-    const got = bytes ? `length=${len}` : `type=${typeof value}`;
-    const message = prefix + "expected Uint8Array" + ofLen + ", got " + got;
-    if (!bytes)
-      throw new TypeError(message);
-    throw new RangeError(message);
-  }
-  return value;
-}
+  const ofLen = length !== void 0 ? ` of length ${length}` : "";
+  const got = bytes ? `length=${value.length}` : `type=${typeof value}`;
+  const message = atitle3(title) + "expected Uint8Array" + ofLen + ", got " + got;
+  if (!bytes)
+    throw new TypeError(message);
+  throw new RangeError(message);
+}
+var aobject3 = (value, label) => {
+  if (value === null || typeof value !== "object" || Array.isArray(value))
+    throw new TypeError(label === "object" ? "expected valid options object" : `"${label}" expected object, got type=${typeof value}`);
+};
 function aexists2(instance, checkFinished = true) {
   if (instance.destroyed)
-    throw new Error("Hash instance has been destroyed");
+    throw new Error("hash was destroyed");
   if (checkFinished && instance.finished)
-    throw new Error("Hash#digest() has already been called");
+    throw new Error("digest() was already called");
 }
-function aoutput2(out, instance, onlyAligned = false) {
+function aoutput2(out, instance) {
   abytes3(out, void 0, "output");
   const min = instance.outputLen;
-  if (out.length < min) {
-    throw new RangeError("digestInto() expects output buffer of length at least " + min);
+  if (!(out.length >= min)) {
+    throw new RangeError('"output" expected length >= ' + min);
   }
-  if (onlyAligned && !isAligned32(out))
-    throw new Error("invalid output, must be aligned");
 }
 function u322(arr) {
   return new Uint32Array(arr.buffer, arr.byteOffset, Math.floor(arr.byteLength / 4));
 }
 function clean2(...arrays) {
-  for (let i = 0; i < arrays.length; i++) {
-    arrays[i].fill(0);
+  for (let i2 = 0; i2 < arrays.length; i2++) {
+    arrays[i2].fill(0);
   }
 }
 function createView2(arr) {
   return new DataView(arr.buffer, arr.byteOffset, arr.byteLength);
 }
 var isLE2 = /* @__PURE__ */ (() => new Uint8Array(new Uint32Array([287454020]).buffer)[0] === 68)();
-var byteSwap2 = (word) => word << 24 & 4278190080 | word << 8 & 16711680 | word >>> 8 & 65280 | word >>> 24 & 255;
-var swap8IfBE2 = isLE2 ? (n) => n : (n) => byteSwap2(n) >>> 0;
-var byteSwap322 = (arr) => {
-  for (let i = 0; i < arr.length; i++)
-    arr[i] = byteSwap2(arr[i]);
+function byteSwap2(word) {
+  return word << 24 & 4278190080 | word << 8 & 16711680 | word >>> 8 & 65280 | word >>> 24 & 255;
+}
+function byteSwap322(arr) {
+  for (let i2 = 0; i2 < arr.length; i2++) {
+    arr[i2] = byteSwap2(arr[i2]);
+  }
   return arr;
-};
+}
 var swap32IfBE2 = isLE2 ? (u) => u : byteSwap322;
-function checkOpts(defaults, opts) {
-  if (opts == null || typeof opts !== "object")
-    throw new Error("options must be defined");
+function overlapBytes(a, b) {
+  if (!a.byteLength || !b.byteLength)
+    return false;
+  return a.buffer === b.buffer && // best we can do, may fail with an obscure Proxy
+  a.byteOffset < b.byteOffset + b.byteLength && // a starts before b end
+  b.byteOffset < a.byteOffset + a.byteLength;
+}
+function complexOverlapBytes(input, output) {
+  if (overlapBytes(input, output) && input.byteOffset < output.byteOffset)
+    throw new Error("complex overlap of input and output is not supported");
+}
+function checkOpts2(defaults, opts) {
+  aobject3(defaults, "defaults");
+  aobject3(opts, "opts");
   const merged = Object.assign(defaults, opts);
   return merged;
 }
-function equalBytes2(a, b) {
+function equalBytes(a, b) {
+  a = abytes3(a);
+  b = abytes3(b);
   if (a.length !== b.length)
     return false;
   let diff = 0;
-  for (let i = 0; i < a.length; i++)
-    diff |= a[i] ^ b[i];
+  for (let i2 = 0; i2 < a.length; i2++)
+    diff |= a[i2] ^ b[i2];
   return diff === 0;
 }
 function wrapMacConstructor(keyLen, macCons, fromMsg) {
@@ -3056,8 +3077,14 @@ var wrapCipher = /* @__NO_SIDE_EFFECTS__ */ (params, constructor) => {
       abytes3(nonce, params.varSizeNonce ? void 0 : params.nonceLength, "nonce");
     }
     const tagl = params.tagLength;
-    if (tagl && args[1] !== void 0)
-      abytes3(args[1], void 0, "AAD");
+    const aadStart = params.nonceLength !== void 0 ? 1 : 0;
+    if (!params.withAAD) {
+      for (let i2 = aadStart; i2 < args.length; i2++)
+        if (isBytes3(args[i2]))
+          throw new Error("AAD not supported");
+    }
+    if (params.withAAD && args[aadStart] !== void 0)
+      abytes3(args[aadStart], void 0, "AAD");
     const cipher = constructor(key, ...args);
     const checkOutput = (fnLength, output) => {
       if (output !== void 0) {
@@ -3072,14 +3099,14 @@ var wrapCipher = /* @__NO_SIDE_EFFECTS__ */ (params, constructor) => {
         if (called)
           throw new Error("cannot encrypt() twice with same key + nonce");
         called = true;
-        abytes3(data);
+        abytes3(data, void 0, "data");
         checkOutput(cipher.encrypt.length, output);
         return cipher.encrypt(data, output);
       },
       decrypt(data, output) {
-        abytes3(data);
+        abytes3(data, void 0, "data");
         if (tagl && data.length < tagl)
-          throw new Error('"ciphertext" expected length bigger than tagLength=' + tagl);
+          throw new Error('"ciphertext" expected length >= tagLength=' + tagl);
         checkOutput(cipher.decrypt.length, output);
         return cipher.decrypt(data, output);
       }
@@ -3092,9 +3119,7 @@ var wrapCipher = /* @__NO_SIDE_EFFECTS__ */ (params, constructor) => {
 function getOutput(expectedLength, out, onlyAligned = true) {
   if (out === void 0)
     return new Uint8Array(expectedLength);
-  abytes3(out, void 0, "output");
-  if (out.length !== expectedLength)
-    throw new Error('"output" expected Uint8Array of length ' + expectedLength + ", got: " + out.length);
+  abytes3(out, expectedLength, "output");
   if (onlyAligned && !isAligned32(out))
     throw new Error("invalid output, must be aligned");
   return out;
@@ -3112,7 +3137,7 @@ function u64Lengths(dataLength, aadLength, isLE3) {
 function isAligned32(bytes) {
   return bytes.byteOffset % 4 === 0;
 }
-function copyBytes2(bytes) {
+function copyBytes3(bytes) {
   return Uint8Array.from(abytes3(bytes));
 }
 
@@ -3173,7 +3198,7 @@ function runCipher(core, sigma, key, nonce, data, output, counter, rounds) {
   }
 }
 function createCipher(core, opts) {
-  const { allowShortKeys, extendNonceFn, counterLength, counterRight, rounds } = checkOpts({ allowShortKeys: false, counterLength: 8, counterRight: false, rounds: 20 }, opts);
+  const { allowShortKeys, extendNonceFn, counterLength, counterRight, rounds } = checkOpts2({ allowShortKeys: false, counterLength: 8, counterRight: false, rounds: 20 }, opts);
   if (typeof core !== "function")
     throw new Error("core must be a function");
   anumber3(counterLength);
@@ -3185,7 +3210,10 @@ function createCipher(core, opts) {
     abytes3(nonce, void 0, "nonce");
     abytes3(data, void 0, "data");
     const len = data.length;
+    const hasOutput = output !== void 0;
     output = getOutput(len, output, false);
+    if (hasOutput)
+      complexOverlapBytes(data, output);
     anumber3(counter);
     if (counter < 0 || counter >= MAX_COUNTER)
       throw new Error("arx: counter overflow");
@@ -3194,7 +3222,7 @@ function createCipher(core, opts) {
     let k;
     let sigma;
     if (l === 32) {
-      toClean.push(k = copyBytes2(key));
+      toClean.push(k = copyBytes3(key));
       sigma = sigma32_32;
     } else if (l === 16 && allowShortKeys) {
       k = new Uint8Array(32);
@@ -3207,11 +3235,11 @@ function createCipher(core, opts) {
       throw new Error("invalid key size");
     }
     if (!isLE2 || !isAligned32(nonce))
-      toClean.push(nonce = copyBytes2(nonce));
+      toClean.push(nonce = copyBytes3(nonce));
     let k32 = u322(k);
     if (extendNonceFn) {
       if (nonce.length !== 24)
-        throw new Error(`arx: extended nonce must be 24 bytes`);
+        throw new Error("arx: extended nonce must be 24 bytes");
       const n16 = nonce.subarray(0, 16);
       if (isLE2)
         extendNonceFn(sigma, k32, u322(n16), k32);
@@ -3244,8 +3272,8 @@ function createCipher(core, opts) {
 }
 
 // ../../node_modules/@noble/ciphers/_poly1305.js
-function u8to16(a, i) {
-  return a[i++] & 255 | (a[i++] & 255) << 8;
+function u8to16(a, i2) {
+  return a[i2++] & 255 | (a[i2++] & 255) << 8;
 }
 var Poly1305 = class {
   blockLen = 16;
@@ -3260,7 +3288,7 @@ var Poly1305 = class {
   destroyed = false;
   // Can be speed-up using BigUint64Array, at the cost of complexity
   constructor(key) {
-    key = copyBytes2(abytes3(key, 32, "key"));
+    key = copyBytes3(abytes3(key, 32, "key"));
     const t0 = u8to16(key, 0);
     const t1 = u8to16(key, 2);
     const t2 = u8to16(key, 4);
@@ -3279,8 +3307,8 @@ var Poly1305 = class {
     this.r[7] = (t5 >>> 11 | t6 << 5) & 8065;
     this.r[8] = (t6 >>> 8 | t7 << 8) & 8191;
     this.r[9] = t7 >>> 5 & 127;
-    for (let i = 0; i < 8; i++)
-      this.pad[i] = u8to16(key, 16 + 2 * i);
+    for (let i2 = 0; i2 < 8; i2++)
+      this.pad[i2] = u8to16(key, 16 + 2 * i2);
   }
   process(data, offset, isLast = false) {
     const hibit = isLast ? 0 : 1 << 11;
@@ -3395,10 +3423,10 @@ var Poly1305 = class {
     const g = new Uint16Array(10);
     let c = h[1] >>> 13;
     h[1] &= 8191;
-    for (let i = 2; i < 10; i++) {
-      h[i] += c;
-      c = h[i] >>> 13;
-      h[i] &= 8191;
+    for (let i2 = 2; i2 < 10; i2++) {
+      h[i2] += c;
+      c = h[i2] >>> 13;
+      h[i2] &= 8191;
     }
     h[0] += c * 5;
     c = h[0] >>> 13;
@@ -3410,18 +3438,18 @@ var Poly1305 = class {
     g[0] = h[0] + 5;
     c = g[0] >>> 13;
     g[0] &= 8191;
-    for (let i = 1; i < 10; i++) {
-      g[i] = h[i] + c;
-      c = g[i] >>> 13;
-      g[i] &= 8191;
+    for (let i2 = 1; i2 < 10; i2++) {
+      g[i2] = h[i2] + c;
+      c = g[i2] >>> 13;
+      g[i2] &= 8191;
     }
     g[9] -= 1 << 13;
     let mask = (c ^ 1) - 1;
-    for (let i = 0; i < 10; i++)
-      g[i] &= mask;
+    for (let i2 = 0; i2 < 10; i2++)
+      g[i2] &= mask;
     mask = ~mask;
-    for (let i = 0; i < 10; i++)
-      h[i] = h[i] & mask | g[i];
+    for (let i2 = 0; i2 < 10; i2++)
+      h[i2] = h[i2] & mask | g[i2];
     h[0] = (h[0] | h[1] << 13) & 65535;
     h[1] = (h[1] >>> 3 | h[2] << 10) & 65535;
     h[2] = (h[2] >>> 6 | h[3] << 7) & 65535;
@@ -3432,16 +3460,16 @@ var Poly1305 = class {
     h[7] = (h[8] >>> 8 | h[9] << 5) & 65535;
     let f = h[0] + pad[0];
     h[0] = f & 65535;
-    for (let i = 1; i < 8; i++) {
-      f = (h[i] + pad[i] | 0) + (f >>> 16) | 0;
-      h[i] = f & 65535;
+    for (let i2 = 1; i2 < 8; i2++) {
+      f = (h[i2] + pad[i2] | 0) + (f >>> 16) | 0;
+      h[i2] = f & 65535;
     }
     clean2(g);
   }
   update(data) {
     aexists2(this);
     abytes3(data);
-    data = copyBytes2(data);
+    data = copyBytes3(data);
     const { buffer, blockLen } = this;
     const len = data.length;
     for (let pos = 0; pos < len; ) {
@@ -3479,9 +3507,9 @@ var Poly1305 = class {
     }
     this.finalize();
     let opos = 0;
-    for (let i = 0; i < 8; i++) {
-      out[opos++] = h[i] >>> 0;
-      out[opos++] = h[i] >>> 8;
+    for (let i2 = 0; i2 < 8; i2++) {
+      out[opos++] = h[i2] >>> 0;
+      out[opos++] = h[i2] >>> 8;
     }
   }
   digest() {
@@ -3582,84 +3610,25 @@ function chachaCore(s, k, n, out, cnt, rounds = 20) {
   out[oi++] = y14 + x14 | 0;
   out[oi++] = y15 + x15 | 0;
 }
-function hchacha(s, k, i, out) {
-  let x00 = swap8IfBE2(s[0]), x01 = swap8IfBE2(s[1]), x02 = swap8IfBE2(s[2]), x03 = swap8IfBE2(s[3]), x04 = swap8IfBE2(k[0]), x05 = swap8IfBE2(k[1]), x06 = swap8IfBE2(k[2]), x07 = swap8IfBE2(k[3]), x08 = swap8IfBE2(k[4]), x09 = swap8IfBE2(k[5]), x10 = swap8IfBE2(k[6]), x11 = swap8IfBE2(k[7]), x12 = swap8IfBE2(i[0]), x13 = swap8IfBE2(i[1]), x14 = swap8IfBE2(i[2]), x15 = swap8IfBE2(i[3]);
-  for (let r = 0; r < 20; r += 2) {
-    x00 = x00 + x04 | 0;
-    x12 = rotl(x12 ^ x00, 16);
-    x08 = x08 + x12 | 0;
-    x04 = rotl(x04 ^ x08, 12);
-    x00 = x00 + x04 | 0;
-    x12 = rotl(x12 ^ x00, 8);
-    x08 = x08 + x12 | 0;
-    x04 = rotl(x04 ^ x08, 7);
-    x01 = x01 + x05 | 0;
-    x13 = rotl(x13 ^ x01, 16);
-    x09 = x09 + x13 | 0;
-    x05 = rotl(x05 ^ x09, 12);
-    x01 = x01 + x05 | 0;
-    x13 = rotl(x13 ^ x01, 8);
-    x09 = x09 + x13 | 0;
-    x05 = rotl(x05 ^ x09, 7);
-    x02 = x02 + x06 | 0;
-    x14 = rotl(x14 ^ x02, 16);
-    x10 = x10 + x14 | 0;
-    x06 = rotl(x06 ^ x10, 12);
-    x02 = x02 + x06 | 0;
-    x14 = rotl(x14 ^ x02, 8);
-    x10 = x10 + x14 | 0;
-    x06 = rotl(x06 ^ x10, 7);
-    x03 = x03 + x07 | 0;
-    x15 = rotl(x15 ^ x03, 16);
-    x11 = x11 + x15 | 0;
-    x07 = rotl(x07 ^ x11, 12);
-    x03 = x03 + x07 | 0;
-    x15 = rotl(x15 ^ x03, 8);
-    x11 = x11 + x15 | 0;
-    x07 = rotl(x07 ^ x11, 7);
-    x00 = x00 + x05 | 0;
-    x15 = rotl(x15 ^ x00, 16);
-    x10 = x10 + x15 | 0;
-    x05 = rotl(x05 ^ x10, 12);
-    x00 = x00 + x05 | 0;
-    x15 = rotl(x15 ^ x00, 8);
-    x10 = x10 + x15 | 0;
-    x05 = rotl(x05 ^ x10, 7);
-    x01 = x01 + x06 | 0;
-    x12 = rotl(x12 ^ x01, 16);
-    x11 = x11 + x12 | 0;
-    x06 = rotl(x06 ^ x11, 12);
-    x01 = x01 + x06 | 0;
-    x12 = rotl(x12 ^ x01, 8);
-    x11 = x11 + x12 | 0;
-    x06 = rotl(x06 ^ x11, 7);
-    x02 = x02 + x07 | 0;
-    x13 = rotl(x13 ^ x02, 16);
-    x08 = x08 + x13 | 0;
-    x07 = rotl(x07 ^ x08, 12);
-    x02 = x02 + x07 | 0;
-    x13 = rotl(x13 ^ x02, 8);
-    x08 = x08 + x13 | 0;
-    x07 = rotl(x07 ^ x08, 7);
-    x03 = x03 + x04 | 0;
-    x14 = rotl(x14 ^ x03, 16);
-    x09 = x09 + x14 | 0;
-    x04 = rotl(x04 ^ x09, 12);
-    x03 = x03 + x04 | 0;
-    x14 = rotl(x14 ^ x03, 8);
-    x09 = x09 + x14 | 0;
-    x04 = rotl(x04 ^ x09, 7);
-  }
+function hchacha(s, k, i2, out) {
+  const s2 = isLE2 ? s : swap32IfBE2(s.slice(0, 4));
+  const k2 = isLE2 ? k : swap32IfBE2(k.slice(0, 8));
+  const i22 = isLE2 ? i2 : swap32IfBE2(i2.slice(0, 4));
+  const t = new Uint32Array(16);
+  chachaCore(s2, k2, i22.subarray(1), t, i22[0]);
   let oi = 0;
-  out[oi++] = x00;
-  out[oi++] = x01;
-  out[oi++] = x02;
-  out[oi++] = x03;
-  out[oi++] = x12;
-  out[oi++] = x13;
-  out[oi++] = x14;
-  out[oi++] = x15;
+  out[oi++] = t[0] - s2[0] | 0;
+  out[oi++] = t[1] - s2[1] | 0;
+  out[oi++] = t[2] - s2[2] | 0;
+  out[oi++] = t[3] - s2[3] | 0;
+  out[oi++] = t[12] - i22[0] | 0;
+  out[oi++] = t[13] - i22[1] | 0;
+  out[oi++] = t[14] - i22[2] | 0;
+  out[oi++] = t[15] - i22[3] | 0;
   swap32IfBE2(out);
+  if (!isLE2)
+    clean2(s2, k2, i22);
+  clean2(t);
 }
 var chacha20 = /* @__PURE__ */ createCipher(chachaCore, {
   counterRight: false,
@@ -3713,7 +3682,7 @@ var _poly1305_aead = (xorStream) => (key, nonce, AAD) => {
       const data = ciphertext.subarray(0, -tagLength);
       const passedTag = ciphertext.subarray(-tagLength);
       const tag = computeTag(xorStream, key, nonce, data, AAD);
-      if (!equalBytes2(passedTag, tag)) {
+      if (!equalBytes(passedTag, tag)) {
         clean2(tag);
         throw new Error("invalid tag");
       }
@@ -3725,11 +3694,11 @@ var _poly1305_aead = (xorStream) => (key, nonce, AAD) => {
   };
 };
 var chacha20poly1305 = /* @__PURE__ */ wrapCipher(
-  { blockSize: 64, nonceLength: 12, tagLength: 16 },
+  { blockSize: 64, nonceLength: 12, tagLength: 16, withAAD: true },
   /* @__PURE__ */ _poly1305_aead(chacha20)
 );
 var xchacha20poly1305 = /* @__PURE__ */ wrapCipher(
-  { blockSize: 64, nonceLength: 24, tagLength: 16 },
+  { blockSize: 64, nonceLength: 24, tagLength: 16, withAAD: true },
   /* @__PURE__ */ _poly1305_aead(xchacha20)
 );
 
@@ -3780,8 +3749,8 @@ function hashBlake2s(data) {
 function noiseHkdf(chainingKey, inputKeyMaterial, numOutputs) {
   const output = hkdf(blake2s, inputKeyMaterial, chainingKey, new Uint8Array(0), numOutputs * HASH_LENGTH);
   const chunks = [];
-  for (let i = 0; i < numOutputs; i++) {
-    chunks.push(output.subarray(i * HASH_LENGTH, (i + 1) * HASH_LENGTH));
+  for (let i2 = 0; i2 < numOutputs; i2++) {
+    chunks.push(output.subarray(i2 * HASH_LENGTH, (i2 + 1) * HASH_LENGTH));
   }
   return chunks;
 }
@@ -3816,7 +3785,7 @@ function xaeadDecrypt(key, nonce, associatedData, ciphertext) {
   const cipher = xchacha20poly1305(key, nonce, associatedData);
   return cipher.decrypt(ciphertext);
 }
-function concatBytes4(...arrays) {
+function concatBytes3(...arrays) {
   const total = arrays.reduce((sum, arr) => sum + arr.length, 0);
   const result = new Uint8Array(total);
   let offset = 0;
@@ -3863,7 +3832,7 @@ var SymmetricState = class {
   hash;
   constructor(protocolName) {
     if (protocolName.length <= HASH_LENGTH) {
-      this.hash = concatBytes4(protocolName, new Uint8Array(HASH_LENGTH - protocolName.length));
+      this.hash = concatBytes3(protocolName, new Uint8Array(HASH_LENGTH - protocolName.length));
     } else {
       this.hash = hashBlake2s(protocolName);
     }
@@ -3876,7 +3845,7 @@ var SymmetricState = class {
     this.cipherState.initializeKey(tempKey);
   }
   mixHash(data) {
-    this.hash = hashBlake2s(concatBytes4(this.hash, data));
+    this.hash = hashBlake2s(concatBytes3(this.hash, data));
   }
   /** Processes a "psk" token: MixKeyAndHash(psk) per Noise section 9. */
   mixKeyAndHash(inputKeyMaterial) {
@@ -4036,7 +4005,7 @@ var HandshakeState = class {
       }
     }
     buffers.push(this.symmetricState.encryptAndHash(payload));
-    return { message: concatBytes4(...buffers), split: this.maybeSplit() };
+    return { message: concatBytes3(...buffers), split: this.maybeSplit() };
   }
   readMessage(message) {
     const tokens = this.nextTokens();
@@ -4166,7 +4135,7 @@ var SecretstreamState = class {
     const associatedData = Uint8Array.of(tag);
     const ciphertext = xaeadEncrypt(this.key, this.nonceForCounter(this.counter), associatedData, plaintext);
     this.counter += 1n;
-    return concatBytes4(associatedData, ciphertext);
+    return concatBytes3(associatedData, ciphertext);
   }
   /**
    * Decrypts one frame and advances this direction's counter. Throws if
@@ -4276,8 +4245,8 @@ function deriveShortAuthenticationString(handshakeHash) {
   const digitsValue = digitsRaw % 1e6;
   const digits = digitsValue.toString(10).padStart(6, "0");
   const emoji = [];
-  for (let i = 0; i < 5; i++) {
-    emoji.push(SAS_EMOJI_TABLE[bytes[4 + i] % SAS_EMOJI_TABLE.length]);
+  for (let i2 = 0; i2 < 5; i2++) {
+    emoji.push(SAS_EMOJI_TABLE[bytes[4 + i2] % SAS_EMOJI_TABLE.length]);
   }
   return { digits, emoji };
 }
@@ -4286,7 +4255,7 @@ function deriveShortAuthenticationString(handshakeHash) {
 var SESSION_SLOT_LABEL = "kangentic-session-slot-v1";
 var SESSION_SLOT_LENGTH = 16;
 function deriveSessionSlotId(desktopStaticPublicKey, phoneStaticPublicKey) {
-  const material = concatBytes4(desktopStaticPublicKey, phoneStaticPublicKey);
+  const material = concatBytes3(desktopStaticPublicKey, phoneStaticPublicKey);
   return bytesToHex(deriveLabeledKey(material, SESSION_SLOT_LABEL, SESSION_SLOT_LENGTH));
 }
 var PAIRING_SLOT_LABEL = "kangentic-pairing-slot-v1";
@@ -4382,13 +4351,13 @@ var fdeb = new u8([
 var clim = new u8([16, 17, 18, 0, 8, 7, 9, 6, 10, 5, 11, 4, 12, 3, 13, 2, 14, 1, 15]);
 var freb = function(eb, start) {
   var b = new u16(31);
-  for (var i = 0; i < 31; ++i) {
-    b[i] = start += 1 << eb[i - 1];
+  for (var i2 = 0; i2 < 31; ++i2) {
+    b[i2] = start += 1 << eb[i2 - 1];
   }
   var r = new i32(b[30]);
-  for (var i = 1; i < 30; ++i) {
-    for (var j = b[i]; j < b[i + 1]; ++j) {
-      r[j] = j - b[i] << 5 | i;
+  for (var i2 = 1; i2 < 30; ++i2) {
+    for (var j = b[i2]; j < b[i2 + 1]; ++j) {
+      r[j] = j - b[i2] << 5 | i2;
     }
   }
   return { b, r };
@@ -4411,25 +4380,25 @@ var x;
 var i;
 var hMap = (function(cd, mb, r) {
   var s = cd.length;
-  var i = 0;
+  var i2 = 0;
   var l = new u16(mb);
-  for (; i < s; ++i) {
-    if (cd[i])
-      ++l[cd[i] - 1];
+  for (; i2 < s; ++i2) {
+    if (cd[i2])
+      ++l[cd[i2] - 1];
   }
   var le = new u16(mb);
-  for (i = 1; i < mb; ++i) {
-    le[i] = le[i - 1] + l[i - 1] << 1;
+  for (i2 = 1; i2 < mb; ++i2) {
+    le[i2] = le[i2 - 1] + l[i2 - 1] << 1;
   }
   var co;
   if (r) {
     co = new u16(1 << mb);
     var rvb = 15 - mb;
-    for (i = 0; i < s; ++i) {
-      if (cd[i]) {
-        var sv = i << 4 | cd[i];
-        var r_1 = mb - cd[i];
-        var v = le[cd[i] - 1]++ << r_1;
+    for (i2 = 0; i2 < s; ++i2) {
+      if (cd[i2]) {
+        var sv = i2 << 4 | cd[i2];
+        var r_1 = mb - cd[i2];
+        var v = le[cd[i2] - 1]++ << r_1;
         for (var m = v | (1 << r_1) - 1; v <= m; ++v) {
           co[rev[v] >> rvb] = sv;
         }
@@ -4437,9 +4406,9 @@ var hMap = (function(cd, mb, r) {
     }
   } else {
     co = new u16(s);
-    for (i = 0; i < s; ++i) {
-      if (cd[i]) {
-        co[i] = rev[le[cd[i] - 1]++] >> 15 - cd[i];
+    for (i2 = 0; i2 < s; ++i2) {
+      if (cd[i2]) {
+        co[i2] = rev[le[cd[i2] - 1]++] >> 15 - cd[i2];
       }
     }
   }
@@ -4468,9 +4437,9 @@ var fdm = /* @__PURE__ */ hMap(fdt, 5, 0);
 var fdrm = /* @__PURE__ */ hMap(fdt, 5, 1);
 var max = function(a) {
   var m = a[0];
-  for (var i = 1; i < a.length; ++i) {
-    if (a[i] > m)
-      m = a[i];
+  for (var i2 = 1; i2 < a.length; ++i2) {
+    if (a[i2] > m)
+      m = a[i2];
   }
   return m;
 };
@@ -4563,28 +4532,28 @@ var inflt = function(dat, st, buf, dict) {
         pos += 14;
         var ldt = new u8(tl);
         var clt = new u8(19);
-        for (var i = 0; i < hcLen; ++i) {
-          clt[clim[i]] = bits(dat, pos + i * 3, 7);
+        for (var i2 = 0; i2 < hcLen; ++i2) {
+          clt[clim[i2]] = bits(dat, pos + i2 * 3, 7);
         }
         pos += hcLen * 3;
         var clb = max(clt), clbmsk = (1 << clb) - 1;
         var clm = hMap(clt, clb, 1);
-        for (var i = 0; i < tl; ) {
+        for (var i2 = 0; i2 < tl; ) {
           var r = clm[bits(dat, pos, clbmsk)];
           pos += r & 15;
           var s = r >> 4;
           if (s < 16) {
-            ldt[i++] = s;
+            ldt[i2++] = s;
           } else {
             var c = 0, n = 0;
             if (s == 16)
-              n = 3 + bits(dat, pos, 3), pos += 2, c = ldt[i - 1];
+              n = 3 + bits(dat, pos, 3), pos += 2, c = ldt[i2 - 1];
             else if (s == 17)
               n = 3 + bits(dat, pos, 7), pos += 3;
             else if (s == 18)
               n = 11 + bits(dat, pos, 127), pos += 7;
             while (n--)
-              ldt[i++] = c;
+              ldt[i2++] = c;
           }
         }
         var lt = ldt.subarray(0, hLit), dt = ldt.subarray(hLit);
@@ -4622,8 +4591,8 @@ var inflt = function(dat, st, buf, dict) {
       } else {
         var add2 = sym - 254;
         if (sym > 264) {
-          var i = sym - 257, b = fleb[i];
-          add2 = bits(dat, pos, (1 << b) - 1) + fl[i];
+          var i2 = sym - 257, b = fleb[i2];
+          add2 = bits(dat, pos, (1 << b) - 1) + fl[i2];
           pos += b;
         }
         var d = dm[bits16(dat, pos) & dms], dsym = d >> 4;
@@ -4675,9 +4644,9 @@ var wbits16 = function(d, p, v) {
 };
 var hTree = function(d, mb) {
   var t = [];
-  for (var i = 0; i < d.length; ++i) {
-    if (d[i])
-      t.push({ s: i, f: d[i] });
+  for (var i2 = 0; i2 < d.length; ++i2) {
+    if (d[i2])
+      t.push({ s: i2, f: d[i2] });
   }
   var s = t.length;
   var t2 = t.slice();
@@ -4692,28 +4661,28 @@ var hTree = function(d, mb) {
     return a.f - b.f;
   });
   t.push({ s: -1, f: 25001 });
-  var l = t[0], r = t[1], i0 = 0, i1 = 1, i2 = 2;
+  var l = t[0], r = t[1], i0 = 0, i1 = 1, i22 = 2;
   t[0] = { s: -1, f: l.f + r.f, l, r };
   while (i1 != s - 1) {
-    l = t[t[i0].f < t[i2].f ? i0++ : i2++];
-    r = t[i0 != i1 && t[i0].f < t[i2].f ? i0++ : i2++];
+    l = t[t[i0].f < t[i22].f ? i0++ : i22++];
+    r = t[i0 != i1 && t[i0].f < t[i22].f ? i0++ : i22++];
     t[i1++] = { s: -1, f: l.f + r.f, l, r };
   }
   var maxSym = t2[0].s;
-  for (var i = 1; i < s; ++i) {
-    if (t2[i].s > maxSym)
-      maxSym = t2[i].s;
+  for (var i2 = 1; i2 < s; ++i2) {
+    if (t2[i2].s > maxSym)
+      maxSym = t2[i2].s;
   }
   var tr = new u16(maxSym + 1);
   var mbt = ln(t[i1 - 1], tr, 0);
   if (mbt > mb) {
-    var i = 0, dt = 0;
+    var i2 = 0, dt = 0;
     var lft = mbt - mb, cst = 1 << lft;
     t2.sort(function(a, b) {
       return tr[b.s] - tr[a.s] || a.f - b.f;
     });
-    for (; i < s; ++i) {
-      var i2_1 = t2[i].s;
+    for (; i2 < s; ++i2) {
+      var i2_1 = t2[i2].s;
       if (tr[i2_1] > mb) {
         dt += cst - (1 << mbt - tr[i2_1]);
         tr[i2_1] = mb;
@@ -4722,14 +4691,14 @@ var hTree = function(d, mb) {
     }
     dt >>= lft;
     while (dt > 0) {
-      var i2_2 = t2[i].s;
+      var i2_2 = t2[i2].s;
       if (tr[i2_2] < mb)
         dt -= 1 << mb - tr[i2_2]++ - 1;
       else
-        ++i;
+        ++i2;
     }
-    for (; i >= 0 && dt; --i) {
-      var i2_3 = t2[i].s;
+    for (; i2 >= 0 && dt; --i2) {
+      var i2_3 = t2[i2].s;
       if (tr[i2_3] == mb) {
         --tr[i2_3];
         ++dt;
@@ -4751,8 +4720,8 @@ var lc = function(c) {
   var w = function(v) {
     cl[cli++] = v;
   };
-  for (var i = 1; i <= s; ++i) {
-    if (c[i] == cln && i != s)
+  for (var i2 = 1; i2 <= s; ++i2) {
+    if (c[i2] == cln && i2 != s)
       ++cls;
     else {
       if (!cln && cls > 2) {
@@ -4772,15 +4741,15 @@ var lc = function(c) {
       while (cls--)
         w(cln);
       cls = 1;
-      cln = c[i];
+      cln = c[i2];
     }
   }
   return { c: cl.subarray(0, cli), n: s };
 };
 var clen = function(cf, cl) {
   var l = 0;
-  for (var i = 0; i < cl.length; ++i)
-    l += cf[i] * cl[i];
+  for (var i2 = 0; i2 < cl.length; ++i2)
+    l += cf[i2] * cl[i2];
   return l;
 };
 var wfblk = function(out, pos, dat) {
@@ -4790,8 +4759,8 @@ var wfblk = function(out, pos, dat) {
   out[o + 1] = s >> 8;
   out[o + 2] = out[o] ^ 255;
   out[o + 3] = out[o + 1] ^ 255;
-  for (var i = 0; i < s; ++i)
-    out[o + i + 4] = dat[i];
+  for (var i2 = 0; i2 < s; ++i2)
+    out[o + i2 + 4] = dat[i2];
   return (o + 4 + s) * 8;
 };
 var wblk = function(dat, out, final, syms, lf, df, eb, li, bs, bl, p) {
@@ -4802,10 +4771,10 @@ var wblk = function(dat, out, final, syms, lf, df, eb, li, bs, bl, p) {
   var _c = lc(dlt), lclt = _c.c, nlc = _c.n;
   var _d = lc(ddt), lcdt = _d.c, ndc = _d.n;
   var lcfreq = new u16(19);
-  for (var i = 0; i < lclt.length; ++i)
-    ++lcfreq[lclt[i] & 31];
-  for (var i = 0; i < lcdt.length; ++i)
-    ++lcfreq[lcdt[i] & 31];
+  for (var i2 = 0; i2 < lclt.length; ++i2)
+    ++lcfreq[lclt[i2] & 31];
+  for (var i2 = 0; i2 < lcdt.length; ++i2)
+    ++lcfreq[lcdt[i2] & 31];
   var _e = hTree(lcfreq, 7), lct = _e.t, mlcb = _e.l;
   var nlcc = 19;
   for (; nlcc > 4 && !lct[clim[nlcc - 1]]; --nlcc)
@@ -4824,24 +4793,24 @@ var wblk = function(dat, out, final, syms, lf, df, eb, li, bs, bl, p) {
     wbits(out, p + 5, ndc - 1);
     wbits(out, p + 10, nlcc - 4);
     p += 14;
-    for (var i = 0; i < nlcc; ++i)
-      wbits(out, p + 3 * i, lct[clim[i]]);
+    for (var i2 = 0; i2 < nlcc; ++i2)
+      wbits(out, p + 3 * i2, lct[clim[i2]]);
     p += 3 * nlcc;
     var lcts = [lclt, lcdt];
     for (var it = 0; it < 2; ++it) {
       var clct = lcts[it];
-      for (var i = 0; i < clct.length; ++i) {
-        var len = clct[i] & 31;
+      for (var i2 = 0; i2 < clct.length; ++i2) {
+        var len = clct[i2] & 31;
         wbits(out, p, llm[len]), p += lct[len];
         if (len > 15)
-          wbits(out, p, clct[i] >> 5 & 127), p += clct[i] >> 12;
+          wbits(out, p, clct[i2] >> 5 & 127), p += clct[i2] >> 12;
       }
     }
   } else {
     lm = flm, ll = flt, dm = fdm, dl = fdt;
   }
-  for (var i = 0; i < li; ++i) {
-    var sym = syms[i];
+  for (var i2 = 0; i2 < li; ++i2) {
+    var sym = syms[i2];
     if (sym > 255) {
       var len = sym >> 18 & 31;
       wbits16(out, p, lm[len + 257]), p += ll[len + 257];
@@ -4874,36 +4843,36 @@ var dflt = function(dat, lvl, plvl, pre, post, st) {
     var msk_1 = (1 << plvl) - 1;
     var prev = st.p || new u16(32768), head = st.h || new u16(msk_1 + 1);
     var bs1_1 = Math.ceil(plvl / 3), bs2_1 = 2 * bs1_1;
-    var hsh = function(i2) {
-      return (dat[i2] ^ dat[i2 + 1] << bs1_1 ^ dat[i2 + 2] << bs2_1) & msk_1;
+    var hsh = function(i3) {
+      return (dat[i3] ^ dat[i3 + 1] << bs1_1 ^ dat[i3 + 2] << bs2_1) & msk_1;
     };
     var syms = new i32(25e3);
     var lf = new u16(288), df = new u16(32);
-    var lc_1 = 0, eb = 0, i = st.i || 0, li = 0, wi = st.w || 0, bs = 0;
-    for (; i + 2 < s; ++i) {
-      var hv = hsh(i);
-      var imod = i & 32767, pimod = head[hv];
+    var lc_1 = 0, eb = 0, i2 = st.i || 0, li = 0, wi = st.w || 0, bs = 0;
+    for (; i2 + 2 < s; ++i2) {
+      var hv = hsh(i2);
+      var imod = i2 & 32767, pimod = head[hv];
       prev[imod] = pimod;
       head[hv] = imod;
-      if (wi <= i) {
-        var rem = s - i;
+      if (wi <= i2) {
+        var rem = s - i2;
         if ((lc_1 > 7e3 || li > 24576) && (rem > 423 || !lst)) {
-          pos = wblk(dat, w, 0, syms, lf, df, eb, li, bs, i - bs, pos);
-          li = lc_1 = eb = 0, bs = i;
+          pos = wblk(dat, w, 0, syms, lf, df, eb, li, bs, i2 - bs, pos);
+          li = lc_1 = eb = 0, bs = i2;
           for (var j = 0; j < 286; ++j)
             lf[j] = 0;
           for (var j = 0; j < 30; ++j)
             df[j] = 0;
         }
         var l = 2, d = 0, ch_1 = c, dif = imod - pimod & 32767;
-        if (rem > 2 && hv == hsh(i - dif)) {
+        if (rem > 2 && hv == hsh(i2 - dif)) {
           var maxn = Math.min(n, rem) - 1;
-          var maxd = Math.min(32767, i);
+          var maxd = Math.min(32767, i2);
           var ml = Math.min(258, rem);
           while (dif <= maxd && --ch_1 && imod != pimod) {
-            if (dat[i + l] == dat[i + l - dif]) {
+            if (dat[i2 + l] == dat[i2 + l - dif]) {
               var nl = 0;
-              for (; nl < ml && dat[i + nl] == dat[i + nl - dif]; ++nl)
+              for (; nl < ml && dat[i2 + nl] == dat[i2 + nl - dif]; ++nl)
                 ;
               if (nl > l) {
                 l = nl, d = dif;
@@ -4912,7 +4881,7 @@ var dflt = function(dat, lvl, plvl, pre, post, st) {
                 var mmd = Math.min(dif, nl - 2);
                 var md = 0;
                 for (var j = 0; j < mmd; ++j) {
-                  var ti = i - dif + j & 32767;
+                  var ti = i2 - dif + j & 32767;
                   var pti = prev[ti];
                   var cd = ti - pti & 32767;
                   if (cd > md)
@@ -4930,32 +4899,32 @@ var dflt = function(dat, lvl, plvl, pre, post, st) {
           eb += fleb[lin] + fdeb[din];
           ++lf[257 + lin];
           ++df[din];
-          wi = i + l;
+          wi = i2 + l;
           ++lc_1;
         } else {
-          syms[li++] = dat[i];
-          ++lf[dat[i]];
+          syms[li++] = dat[i2];
+          ++lf[dat[i2]];
         }
       }
     }
-    for (i = Math.max(i, wi); i < s; ++i) {
-      syms[li++] = dat[i];
-      ++lf[dat[i]];
+    for (i2 = Math.max(i2, wi); i2 < s; ++i2) {
+      syms[li++] = dat[i2];
+      ++lf[dat[i2]];
     }
-    pos = wblk(dat, w, lst, syms, lf, df, eb, li, bs, i - bs, pos);
+    pos = wblk(dat, w, lst, syms, lf, df, eb, li, bs, i2 - bs, pos);
     if (!lst) {
       st.r = pos & 7 | w[pos / 8 | 0] << 3;
       pos -= 7;
-      st.h = head, st.p = prev, st.i = i, st.w = wi;
+      st.h = head, st.p = prev, st.i = i2, st.w = wi;
     }
   } else {
-    for (var i = st.w || 0; i < s + lst; i += 65535) {
-      var e = i + 65535;
+    for (var i2 = st.w || 0; i2 < s + lst; i2 += 65535) {
+      var e = i2 + 65535;
       if (e >= s) {
         w[pos / 8 | 0] = lst;
         e = s;
       }
-      pos = wfblk(w, pos + 1, dat.subarray(i, e));
+      pos = wfblk(w, pos + 1, dat.subarray(i2, e));
     }
     st.i = s;
   }
@@ -5000,7 +4969,8 @@ var CAPABILITY_VERBS = [
   "interactive-terminal",
   "board-tool-read",
   "board-tool-write",
-  "register-push"
+  "register-push",
+  "start-session"
 ];
 function isCapabilityVerb(value) {
   return CAPABILITY_VERBS.includes(value);
@@ -5036,6 +5006,23 @@ var COMPRESSION_THRESHOLD = 4 * 1024;
 var FRAME_FORMAT_DEFLATE = 1;
 var JSON_OPEN_BRACE = 123;
 var DEFLATE_HEADER_LENGTH = 5;
+var UNSUPPORTED_VERB_ERROR_CODE = "unsupported-verb";
+var UNSUPPORTED_VERB_ERROR_NAME = "UnsupportedVerbError";
+var UnsupportedVerbError = class extends Error {
+  requestId;
+  verb;
+  constructor(requestId, verb) {
+    super(`capability-request has an unsupported "verb": ${verb}`);
+    this.name = UNSUPPORTED_VERB_ERROR_NAME;
+    this.requestId = requestId;
+    this.verb = verb;
+  }
+};
+function isUnsupportedVerbError(error) {
+  if (!(error instanceof Error) || error.name !== UNSUPPORTED_VERB_ERROR_NAME) return false;
+  const candidate = error;
+  return typeof candidate.requestId === "string" && typeof candidate.verb === "string";
+}
 function encodeMessage(message) {
   const json = new TextEncoder().encode(JSON.stringify(message));
   if (json.length > MAX_DECODED_LENGTH) {
@@ -5114,8 +5101,9 @@ function validateBridgeMessage(value) {
       return { type: "heartbeat" };
     case "capability-request": {
       if (typeof value.requestId !== "string") throw new Error('capability-request missing "requestId"');
-      if (typeof value.verb !== "string" || !isCapabilityVerb(value.verb)) throw new Error('capability-request has an invalid "verb"');
+      if (typeof value.verb !== "string") throw new Error('capability-request has an invalid "verb"');
       if (!isJsonValue(value.payload)) throw new Error('capability-request has a non-JSON "payload"');
+      if (!isCapabilityVerb(value.verb)) throw new UnsupportedVerbError(value.requestId, value.verb);
       return { type: "capability-request", requestId: value.requestId, verb: value.verb, payload: value.payload };
     }
     case "capability-response": {
@@ -5123,12 +5111,14 @@ function validateBridgeMessage(value) {
       if (typeof value.ok !== "boolean") throw new Error('capability-response missing "ok"');
       if (value.payload !== void 0 && !isJsonValue(value.payload)) throw new Error('capability-response has a non-JSON "payload"');
       if (value.error !== void 0 && typeof value.error !== "string") throw new Error('capability-response has a non-string "error"');
+      if (value.code !== void 0 && typeof value.code !== "string") throw new Error('capability-response has a non-string "code"');
       return {
         type: "capability-response",
         requestId: value.requestId,
         ok: value.ok,
         payload: value.payload,
-        error: value.error
+        error: value.error,
+        code: value.code
       };
     }
     case "event": {
@@ -5163,20 +5153,20 @@ function unwrapSessionFrame(frame) {
 // src/wire/base64url.ts
 var ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
 var DECODE_MAP = {};
-for (let i = 0; i < ALPHABET.length; i++) DECODE_MAP[ALPHABET[i]] = i;
+for (let i2 = 0; i2 < ALPHABET.length; i2++) DECODE_MAP[ALPHABET[i2]] = i2;
 function base64UrlEncode(bytes) {
   let result = "";
-  let i = 0;
-  for (; i + 2 < bytes.length; i += 3) {
-    const chunk = bytes[i] << 16 | bytes[i + 1] << 8 | bytes[i + 2];
+  let i2 = 0;
+  for (; i2 + 2 < bytes.length; i2 += 3) {
+    const chunk = bytes[i2] << 16 | bytes[i2 + 1] << 8 | bytes[i2 + 2];
     result += ALPHABET[chunk >> 18 & 63] + ALPHABET[chunk >> 12 & 63] + ALPHABET[chunk >> 6 & 63] + ALPHABET[chunk & 63];
   }
-  const remaining = bytes.length - i;
+  const remaining = bytes.length - i2;
   if (remaining === 1) {
-    const chunk = bytes[i] << 16;
+    const chunk = bytes[i2] << 16;
     result += ALPHABET[chunk >> 18 & 63] + ALPHABET[chunk >> 12 & 63];
   } else if (remaining === 2) {
-    const chunk = bytes[i] << 16 | bytes[i + 1] << 8;
+    const chunk = bytes[i2] << 16 | bytes[i2 + 1] << 8;
     result += ALPHABET[chunk >> 18 & 63] + ALPHABET[chunk >> 12 & 63] + ALPHABET[chunk >> 6 & 63];
   }
   return result;
@@ -5233,7 +5223,7 @@ function sealPushEnvelope(pushKey, recipientStaticPublicKey, plaintext) {
   const nonce = randomBytes4(XCHACHA_NONCE_LENGTH);
   const encodedPlaintext = new TextEncoder().encode(JSON.stringify(plaintext));
   const ciphertext = xaeadEncrypt(pushKey, nonce, recipientStaticPublicKey, encodedPlaintext);
-  return base64UrlEncode(concatBytes4(nonce, ciphertext));
+  return base64UrlEncode(concatBytes3(nonce, ciphertext));
 }
 function openPushEnvelope(pushKey, recipientStaticPublicKey, blob) {
   const bytes = base64UrlDecode(blob);
@@ -5756,6 +5746,23 @@ function parseMoveTaskRequestPayload(payload) {
     projectId: payload.projectId
   };
 }
+function parseStartSessionRequestPayload(payload) {
+  if (!isRecord(payload)) throw new Error("start-session payload must be an object");
+  if (typeof payload.taskId !== "string") throw new Error('start-session payload missing "taskId"');
+  if (typeof payload.projectId !== "string") throw new Error('start-session payload missing "projectId"');
+  return {
+    taskId: payload.taskId,
+    projectId: payload.projectId
+  };
+}
+function parseStartSessionResponsePayload(payload) {
+  if (!isRecord(payload)) throw new Error("start-session response must be an object");
+  if (typeof payload.ok !== "boolean") throw new Error('start-session response missing "ok"');
+  if (payload.outcome !== "starting" && payload.outcome !== "live") {
+    throw new Error('start-session response has an invalid "outcome"');
+  }
+  return { ok: payload.ok, outcome: payload.outcome };
+}
 function parseAnswerPermissionPromptRequestPayload(payload) {
   if (!isRecord(payload)) throw new Error("answer-permission-prompt payload must be an object");
   if (typeof payload.sessionId !== "string") throw new Error('answer-permission-prompt payload missing "sessionId"');
@@ -5851,6 +5858,8 @@ function parseCapabilityRequestPayload(verb, payload) {
       return parseBoardToolRequestPayload(payload);
     case "register-push":
       return parseRegisterPushRequestPayload(payload);
+    case "start-session":
+      return parseStartSessionRequestPayload(payload);
     default: {
       const exhaustiveCheck = verb;
       throw new Error(`Unknown capability verb: ${String(exhaustiveCheck)}`);
@@ -5916,7 +5925,7 @@ function encodePairingQrPayload(payload) {
   }
   const expiresAtBytes = new TextEncoder().encode(payload.expiresAt);
   const protocolVersionBytes = new TextEncoder().encode(payload.protocolVersion);
-  const body = concatBytes4(
+  const body = concatBytes3(
     Uint8Array.of(PAYLOAD_VERSION),
     payload.desktopStaticPublicKey,
     payload.pairingToken,
@@ -5996,12 +6005,12 @@ function openPairingConfirm(initiatorToResponder, frame) {
 function uint32LengthPrefixed(bytes) {
   const prefix = new Uint8Array(4);
   new DataView(prefix.buffer).setUint32(0, bytes.length, false);
-  return concatBytes4(prefix, bytes);
+  return concatBytes3(prefix, bytes);
 }
 function encodeRosterEntryForSigning(entry) {
   const encoder = new TextEncoder();
   const sortedCapabilities = entry.capabilities.slice().sort().join(",");
-  return concatBytes4(
+  return concatBytes3(
     uint32LengthPrefixed(encoder.encode(entry.deviceId)),
     uint32LengthPrefixed(entry.staticPublicKey),
     uint32LengthPrefixed(encoder.encode(entry.displayName)),
@@ -6192,6 +6201,8 @@ function isBridgeEvent(value) {
   PUSH_ENVELOPE_MAX_FUTURE_SKEW_MS,
   SecretstreamState,
   SessionFrameKind,
+  UNSUPPORTED_VERB_ERROR_CODE,
+  UnsupportedVerbError,
   X25519_KEY_LENGTH,
   bytesToHex,
   capabilitySetFromArray,
@@ -6228,6 +6239,7 @@ function isBridgeEvent(value) {
   isRosterEntryExpired,
   isSecureRelayAddress,
   isTodoRole,
+  isUnsupportedVerbError,
   openPairingConfirm,
   openPushEnvelope,
   parseActivityEventPayload,
@@ -6245,6 +6257,7 @@ function isBridgeEvent(value) {
   parseSessionEventWire,
   parseSessionSummaryWire,
   parseSessionUsageWire,
+  parseStartSessionResponsePayload,
   parseTerminalDimensionsWire,
   parseTranscriptEntriesWire,
   parseTranscriptEventPayload,