@laceio/sdk 0.1.0 → 0.1.1-canary.0

package/dist/envelopes-B3QCzo5p.js

@@ -0,0 +1,2658 @@
+import { n as HexBytes, t as ByteArray } from "./bytes.vo-CziaOsba.js";
+import { A as isBytes, B as GrantScopeSalt, C as bytesToHex, D as copyBytes, E as concatBytes, F as sha512, H as sha256, I as abytes$1, L as hexToBytes$1, M as numberToBytesLE, N as randomBytes, O as equalBytes$1, P as validateObject, R as utf8ToBytes, S as asciiToBytes, T as bytesToNumberLE, V as GrantId, _ as mod, b as abytes, c as edwards, d as validatePointCons, f as FpInvertBatch, g as mapHashToField, h as isNegativeLE, j as numberToBytesBE, k as hexToBytes, l as createKeygen, m as getMinHashLength, o as jubjub, p as FpSqrtEven, s as PrimeEdwardsPoint, t as RECIPIENT_KINDS, u as pippenger, v as pow2, w as bytesToNumberBE, x as asafenumber, y as aInRange, z as GrantSlot } from "./grant-rules-qLrKUIR3.js";
+import { C as GrantScopeInvalidError, g as GrantLimitReachedError } from "./errors-pkQdxW-7.js";
+//#region ../../packages/contract/passport/src/grants.ts
+/**
+* Most active grants Lace lets an account hold at once; the contract sets
+* no limit.
+*/
+const MAX_GRANTS = 16;
+const DECIMAL_PATTERN = /^\d+$/;
+const BYTES32_HEX_PATTERN = /^[0-9a-f]{64}$/;
+const UINT128_MAX = (1n << 128n) - 1n;
+const BYTE_BITS$2 = 8n;
+/** The prime of Curve25519, the bound a canonical X25519 encoding stays under. */
+const CURVE25519_PRIME = (1n << 255n) - 19n;
+/**
+* The twelve X25519 public keys of small order, as lowercase hex: the
+* points a shared secret with them is all zero or predictable, which the
+* scoped grants standard refuses as a read key. The last seven are also
+* non-canonical encodings of the first five.
+*/
+const LOW_ORDER_READ_KEYS = new Set([
+	"0000000000000000000000000000000000000000000000000000000000000000",
+	"0100000000000000000000000000000000000000000000000000000000000000",
+	"e0eb7a7c3b41b8ae1656e3faf19fc46ada098deb9c32b1fd866205165f49b800",
+	"5f9c95bca3508c24b1d0b1559c83ef5b04445cc4581c8e86d8224eddd09f1157",
+	"ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f",
+	"edffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f",
+	"eeffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f",
+	"cdeb7a7c3b41b8ae1656e3faf19fc46ada098deb9c32b1fd866205165f49b880",
+	"4c9c95bca3508c24b1d0b1559c83ef5b04445cc4581c8e86d8224eddd09f11d7",
+	"d9ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+	"daffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+	"dbffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
+]);
+const requireBytes32Hex = (field, value) => {
+	if (!BYTES32_HEX_PATTERN.test(value)) throw new GrantScopeInvalidError(`${field} must be 32 bytes as lowercase hex`);
+};
+/**
+* The 32-byte little-endian integer a hex X25519 public key encodes.
+*/
+const decodeLittleEndian = (hex) => {
+	let value = 0n;
+	for (let index = hex.length - 2; index >= 0; index -= 2) value = value << BYTE_BITS$2 | BigInt(Number.parseInt(hex.slice(index, index + 2), 16));
+	return value;
+};
+/**
+* Whether a hex X25519 public key is one the account seals secrets to: 32
+* bytes of lowercase hex in the canonical encoding of a coordinate below
+* the curve prime, and none of the small-order points, whose shared
+* secret is all zero or predictable and would seal to nobody. A grant's
+* read key and a device's reader key are both held to it.
+*/
+const isSealableX25519Key = (value) => BYTES32_HEX_PATTERN.test(value) && !LOW_ORDER_READ_KEYS.has(value) && decodeLittleEndian(value) < CURVE25519_PRIME;
+/**
+* Holds a read public key to what the scoped grants standard admits, see
+* {@link isSealableX25519Key}.
+*
+* @throws {@link GrantScopeInvalidError} when the key is malformed,
+* non-canonical or of small order.
+*/
+const requireReadPublicKey = (value) => {
+	requireBytes32Hex("read public key", value);
+	if (LOW_ORDER_READ_KEYS.has(value)) throw new GrantScopeInvalidError("read public key has small order");
+	if (!isSealableX25519Key(value)) throw new GrantScopeInvalidError("read public key is not a canonical X25519 encoding");
+};
+const parseUint128 = (field, value) => {
+	if (!DECIMAL_PATTERN.test(value)) throw new GrantScopeInvalidError(`${field} must be a non-negative decimal integer, got "${value}"`);
+	const amount = BigInt(value);
+	if (amount > UINT128_MAX) throw new GrantScopeInvalidError(`${field} exceeds the 128-bit maximum`);
+	return amount;
+};
+/**
+* Checks a requested grant against the rules the contract and the account
+* impose, so a doomed request fails before any key ceremony or proof.
+*
+* @throws {@link GrantLimitReachedError} when the account already holds
+* MAX_GRANTS active grants.
+* @throws {@link GrantScopeInvalidError} when the scope breaks a rule: no
+* operation, a malformed key, recipient or caller, a malformed amount, a cap
+* below the per-call cap, an expiry that is not a whole second in the future,
+* a rolling window, which a JavaScript caller can still pass, a read grant
+* without an rp id, or a read grant without a canonical, large-order read
+* public key.
+*/
+const validateGrantScope = (scope, { nowSeconds, grantCount }) => {
+	if (grantCount >= 16) throw new GrantLimitReachedError();
+	if (scope.operations.length === 0) throw new GrantScopeInvalidError("A grant must allow at least one operation");
+	requireBytes32Hex("grantee public key", scope.grantee.publicKey);
+	if (scope.recipient.kind !== "any") requireBytes32Hex("recipient value", scope.recipient.value);
+	if (scope.caller !== void 0) requireBytes32Hex("caller", scope.caller);
+	parseUint128("maxCoinValue", scope.maxCoinValue);
+	const perCallCap = parseUint128("perCallCap", scope.perCallCap);
+	if (parseUint128("cap", scope.cap) < perCallCap) throw new GrantScopeInvalidError("cap must not be below the per-call cap");
+	if (scope.expiresAt !== null) {
+		if (!Number.isInteger(scope.expiresAt)) throw new GrantScopeInvalidError("expiresAt must be a whole number of seconds");
+		if (scope.expiresAt <= nowSeconds) throw new GrantScopeInvalidError("expiresAt must be in the future");
+	}
+	if ("window" in scope) throw new GrantScopeInvalidError("A grant carries no rolling window: the contract reserves the window bounds");
+	if (scope.read && !scope.rpId) throw new GrantScopeInvalidError("A read grant requires an rp id");
+	if (scope.read) {
+		if (scope.readPublicKey === void 0) throw new GrantScopeInvalidError("A read grant requires the read public key the viewing secret is sealed to");
+		requireReadPublicKey(scope.readPublicKey);
+	} else if (scope.readPublicKey !== void 0) throw new GrantScopeInvalidError("A read public key is only given with a read grant");
+};
+//#endregion
+//#region ../../packages/module/passport-account/node_modules/@noble/curves/abstract/fft.js
+function checkU32(n) {
+	if (!Number.isSafeInteger(n) || n < 0 || n > 4294967295) throw new Error("wrong u32 integer:" + n);
+	return n;
+}
+/**
+* @param n - Input value.
+* @returns Next power of two within the u32/array-length domain.
+* @throws If `n` is not a valid unsigned 32-bit integer. {@link Error}
+* @example
+* Round an integer up to the FFT size it needs.
+*
+* ```ts
+* nextPowerOfTwo(9);
+* ```
+*/
+function nextPowerOfTwo(n) {
+	checkU32(n);
+	if (n <= 1) return 1;
+	if (n > 2147483648) throw new Error("nextPowerOfTwo overflow: result does not fit u32");
+	return 1 << log2(n - 1) + 1 >>> 0;
+}
+/**
+* Similar to `bitLen(x)-1` but much faster for small integers, like indices.
+* @param n - Input value.
+* @returns Base-2 logarithm. For `n = 0`, the current implementation returns `-1`.
+* @throws If `n` is not a valid unsigned 32-bit integer. {@link Error}
+* @example
+* Compute the radix-2 stage count for one transform size.
+*
+* ```ts
+* log2(8);
+* ```
+*/
+function log2(n) {
+	checkU32(n);
+	return 31 - Math.clz32(n);
+}
+function poly(field, roots, create, fft, length) {
+	const F = field;
+	const _create = create || ((len, elm) => new Array(len).fill(elm ?? F.ZERO));
+	const isPoly = (x) => {
+		if (Array.isArray(x)) return true;
+		if (!ArrayBuffer.isView(x)) return false;
+		const v = x;
+		return typeof v.length === "number" && typeof v.slice === "function" && typeof v[Symbol.iterator] === "function";
+	};
+	const checkLength = (...lst) => {
+		if (!lst.length) return 0;
+		for (const i of lst) if (!isPoly(i)) throw new Error("poly: not polynomial: " + i);
+		const L = lst[0].length;
+		for (let i = 1; i < lst.length; i++) if (lst[i].length !== L) throw new Error(`poly: mismatched lengths ${L} vs ${lst[i].length}`);
+		if (length !== void 0 && L !== length) throw new Error(`poly: expected fixed length ${length}, got ${L}`);
+		return L;
+	};
+	function findOmegaIndex(x, n, brp = false) {
+		const bits = log2(n);
+		const omega = brp ? roots.brp(bits) : roots.roots(bits);
+		for (let i = 0; i < n; i++) if (F.eql(x, omega[i])) return i;
+		return -1;
+	}
+	return {
+		roots,
+		create: _create,
+		length,
+		extend: (a, len) => {
+			checkLength(a);
+			const out = _create(len, F.ZERO);
+			for (let i = 0; i < Math.min(a.length, len); i++) out[i] = a[i];
+			return out;
+		},
+		degree: (a) => {
+			checkLength(a);
+			for (let i = a.length - 1; i >= 0; i--) if (!F.is0(a[i])) return i;
+			return -1;
+		},
+		add: (a, b) => {
+			const len = checkLength(a, b);
+			const out = _create(len);
+			for (let i = 0; i < len; i++) out[i] = F.add(a[i], b[i]);
+			return out;
+		},
+		sub: (a, b) => {
+			const len = checkLength(a, b);
+			const out = _create(len);
+			for (let i = 0; i < len; i++) out[i] = F.sub(a[i], b[i]);
+			return out;
+		},
+		dot: (a, b) => {
+			const len = checkLength(a, b);
+			const out = _create(len);
+			for (let i = 0; i < len; i++) out[i] = F.mul(a[i], b[i]);
+			return out;
+		},
+		mul: (a, b) => {
+			if (isPoly(b)) {
+				const len = checkLength(a, b);
+				if (fft) {
+					const A = fft.direct(a, false, true);
+					const B = fft.direct(b, false, true);
+					for (let i = 0; i < A.length; i++) A[i] = F.mul(A[i], B[i]);
+					return fft.inverse(A, true, false);
+				} else {
+					const res = _create(len);
+					for (let i = 0; i < len; i++) for (let j = 0; j < len; j++) {
+						const k = (i + j) % len;
+						res[k] = F.add(res[k], F.mul(a[i], b[j]));
+					}
+					return res;
+				}
+			} else {
+				const out = _create(checkLength(a));
+				for (let i = 0; i < out.length; i++) out[i] = F.mul(a[i], b);
+				return out;
+			}
+		},
+		convolve(a, b) {
+			const len = nextPowerOfTwo(a.length + b.length - 1);
+			return this.mul(this.extend(a, len), this.extend(b, len));
+		},
+		shift(p, factor) {
+			const out = _create(checkLength(p));
+			out[0] = p[0];
+			for (let i = 1, power = F.ONE; i < p.length; i++) {
+				power = F.mul(power, factor);
+				out[i] = F.mul(p[i], power);
+			}
+			return out;
+		},
+		clone: (a) => {
+			checkLength(a);
+			const out = _create(a.length);
+			for (let i = 0; i < a.length; i++) out[i] = a[i];
+			return out;
+		},
+		eval: (a, basis) => {
+			checkLength(a, basis);
+			let acc = F.ZERO;
+			for (let i = 0; i < a.length; i++) acc = F.add(acc, F.mul(a[i], basis[i]));
+			return acc;
+		},
+		monomial: {
+			basis: (x, n) => {
+				const out = _create(n);
+				let pow = F.ONE;
+				for (let i = 0; i < n; i++) {
+					out[i] = pow;
+					pow = F.mul(pow, x);
+				}
+				return out;
+			},
+			eval: (a, x) => {
+				checkLength(a);
+				let acc = F.ZERO;
+				for (let i = a.length - 1; i >= 0; i--) acc = F.add(F.mul(acc, x), a[i]);
+				return acc;
+			}
+		},
+		lagrange: {
+			basis: (x, n, brp = false, weights) => {
+				const bits = log2(n);
+				const cache = weights || (brp ? roots.brp(bits) : roots.roots(bits));
+				const out = _create(n);
+				const idx = findOmegaIndex(x, n, brp);
+				if (idx !== -1) {
+					out[idx] = F.ONE;
+					return out;
+				}
+				const tm = F.pow(x, BigInt(n));
+				const c = F.mul(F.sub(tm, F.ONE), F.inv(BigInt(n)));
+				const denom = _create(n);
+				for (let i = 0; i < n; i++) denom[i] = F.sub(x, cache[i]);
+				const inv = F.invertBatch(denom);
+				for (let i = 0; i < n; i++) out[i] = F.mul(c, F.mul(cache[i], inv[i]));
+				return out;
+			},
+			eval(a, x, brp = false) {
+				checkLength(a);
+				const idx = findOmegaIndex(x, a.length, brp);
+				if (idx !== -1) return a[idx];
+				const L = this.basis(x, a.length, brp);
+				let acc = F.ZERO;
+				for (let i = 0; i < a.length; i++) if (!F.is0(a[i])) acc = F.add(acc, F.mul(a[i], L[i]));
+				return acc;
+			}
+		},
+		vanishing(roots) {
+			checkLength(roots);
+			const out = _create(roots.length + 1, F.ZERO);
+			out[0] = F.ONE;
+			for (const r of roots) {
+				const neg = F.neg(r);
+				for (let j = out.length - 1; j > 0; j--) out[j] = F.add(F.mul(out[j], neg), out[j - 1]);
+				out[0] = F.mul(out[0], neg);
+			}
+			return out;
+		}
+	};
+}
+//#endregion
+//#region ../../packages/module/passport-account/node_modules/@noble/curves/abstract/hash-to-curve.js
+const os2ip = bytesToNumberBE;
+function i2osp(value, length) {
+	asafenumber(value);
+	asafenumber(length);
+	if (length < 0 || length > 4) throw new Error("invalid I2OSP length: " + length);
+	if (value < 0 || value > 2 ** (8 * length) - 1) throw new Error("invalid I2OSP input: " + value);
+	const res = Array.from({ length }).fill(0);
+	for (let i = length - 1; i >= 0; i--) {
+		res[i] = value & 255;
+		value >>>= 8;
+	}
+	return new Uint8Array(res);
+}
+function strxor(a, b) {
+	const arr = new Uint8Array(a.length);
+	for (let i = 0; i < a.length; i++) arr[i] = a[i] ^ b[i];
+	return arr;
+}
+function normDST(DST) {
+	if (!isBytes(DST) && typeof DST !== "string") throw new Error("DST must be Uint8Array or ascii string");
+	const dst = typeof DST === "string" ? asciiToBytes(DST) : DST;
+	if (dst.length === 0) throw new Error("DST must be non-empty");
+	return dst;
+}
+/**
+* Produces a uniformly random byte string using a cryptographic hash
+* function H that outputs b bits.
+* See {@link https://www.rfc-editor.org/rfc/rfc9380#section-5.3.1 | RFC 9380 section 5.3.1}.
+* @param msg - Input message.
+* @param DST - Domain separation tag. This helper normalizes DST, rejects empty DSTs, and
+*   oversize-hashes DST when needed.
+* @param lenInBytes - Output length.
+* @param H - Hash function.
+* @returns Uniform byte string.
+* @throws If the message, DST, hash, or output length is invalid. {@link Error}
+* @example
+* Expand one message into uniform bytes with the XMD construction.
+*
+* ```ts
+* import { expand_message_xmd } from '@noble/curves/abstract/hash-to-curve.js';
+* import { sha256 } from '@noble/hashes/sha2.js';
+* const uniform = expand_message_xmd(new TextEncoder().encode('hello noble'), 'DST', 32, sha256);
+* ```
+*/
+function expand_message_xmd(msg, DST, lenInBytes, H) {
+	abytes(msg);
+	asafenumber(lenInBytes);
+	DST = normDST(DST);
+	if (DST.length > 255) DST = H(concatBytes(asciiToBytes("H2C-OVERSIZE-DST-"), DST));
+	const { outputLen: b_in_bytes, blockLen: r_in_bytes } = H;
+	const ell = Math.ceil(lenInBytes / b_in_bytes);
+	if (lenInBytes > 65535 || ell > 255) throw new Error("expand_message_xmd: invalid lenInBytes");
+	const DST_prime = concatBytes(DST, i2osp(DST.length, 1));
+	const Z_pad = new Uint8Array(r_in_bytes);
+	const l_i_b_str = i2osp(lenInBytes, 2);
+	const b = new Array(ell);
+	const b_0 = H(concatBytes(Z_pad, msg, l_i_b_str, i2osp(0, 1), DST_prime));
+	b[0] = H(concatBytes(b_0, i2osp(1, 1), DST_prime));
+	for (let i = 1; i < ell; i++) b[i] = H(concatBytes(...[
+		strxor(b_0, b[i - 1]),
+		i2osp(i + 1, 1),
+		DST_prime
+	]));
+	return concatBytes(...b).slice(0, lenInBytes);
+}
+/**
+* Produces a uniformly random byte string using an extendable-output function (XOF) H.
+* 1. The collision resistance of H MUST be at least k bits.
+* 2. H MUST be an XOF that has been proved indifferentiable from
+*    a random oracle under a reasonable cryptographic assumption.
+* See {@link https://www.rfc-editor.org/rfc/rfc9380#section-5.3.2 | RFC 9380 section 5.3.2}.
+* @param msg - Input message.
+* @param DST - Domain separation tag. This helper normalizes DST, rejects empty DSTs, and
+*   oversize-hashes DST when needed.
+* @param lenInBytes - Output length.
+* @param k - Target security level.
+* @param H - XOF hash function.
+* @returns Uniform byte string.
+* @throws If the message, DST, XOF, or output length is invalid. {@link Error}
+* @example
+* Expand one message into uniform bytes with the XOF construction.
+*
+* ```ts
+* import { expand_message_xof } from '@noble/curves/abstract/hash-to-curve.js';
+* import { shake256 } from '@noble/hashes/sha3.js';
+* const uniform = expand_message_xof(
+*   new TextEncoder().encode('hello noble'),
+*   'DST',
+*   32,
+*   128,
+*   shake256
+* );
+* ```
+*/
+function expand_message_xof(msg, DST, lenInBytes, k, H) {
+	abytes(msg);
+	asafenumber(lenInBytes);
+	DST = normDST(DST);
+	if (DST.length > 255) {
+		const dkLen = Math.ceil(2 * k / 8);
+		DST = H.create({ dkLen }).update(asciiToBytes("H2C-OVERSIZE-DST-")).update(DST).digest();
+	}
+	if (lenInBytes > 65535 || DST.length > 255) throw new Error("expand_message_xof: invalid lenInBytes");
+	return H.create({ dkLen: lenInBytes }).update(msg).update(i2osp(lenInBytes, 2)).update(DST).update(i2osp(DST.length, 1)).digest();
+}
+/**
+* Hashes arbitrary-length byte strings to a list of one or more elements of a finite field F.
+* See {@link https://www.rfc-editor.org/rfc/rfc9380#section-5.2 | RFC 9380 section 5.2}.
+* @param msg - Input message bytes.
+* @param count - Number of field elements to derive. Must be `>= 1`.
+* @param options - RFC 9380 options. See {@link H2COpts}. `m` must be `>= 1`.
+* @returns `[u_0, ..., u_(count - 1)]`, a list of field elements.
+* @throws If the expander choice or RFC 9380 options are invalid. {@link Error}
+* @example
+* Hash one message into field elements before mapping it onto a curve.
+*
+* ```ts
+* import { hash_to_field } from '@noble/curves/abstract/hash-to-curve.js';
+* import { sha256 } from '@noble/hashes/sha2.js';
+* const scalars = hash_to_field(new TextEncoder().encode('hello noble'), 2, {
+*   DST: 'DST',
+*   p: 17n,
+*   m: 1,
+*   k: 128,
+*   expand: 'xmd',
+*   hash: sha256,
+* });
+* ```
+*/
+function hash_to_field(msg, count, options) {
+	validateObject(options, {
+		p: "bigint",
+		m: "number",
+		k: "number",
+		hash: "function"
+	});
+	const { p, k, m, hash, expand, DST } = options;
+	asafenumber(hash.outputLen, "valid hash");
+	abytes(msg);
+	asafenumber(count);
+	if (count < 1) throw new Error("hash_to_field: expected count >= 1");
+	if (m < 1) throw new Error("hash_to_field: expected m >= 1");
+	const log2p = p.toString(2).length;
+	const L = Math.ceil((log2p + k) / 8);
+	const len_in_bytes = count * m * L;
+	let prb;
+	if (expand === "xmd") prb = expand_message_xmd(msg, DST, len_in_bytes, hash);
+	else if (expand === "xof") prb = expand_message_xof(msg, DST, len_in_bytes, k, hash);
+	else if (expand === "_internal_pass") prb = msg;
+	else throw new Error("expand must be \"xmd\" or \"xof\"");
+	const u = new Array(count);
+	for (let i = 0; i < count; i++) {
+		const e = new Array(m);
+		for (let j = 0; j < m; j++) {
+			const elm_offset = L * (j + i * m);
+			e[j] = mod(os2ip(prb.subarray(elm_offset, elm_offset + L)), p);
+		}
+		u[i] = e;
+	}
+	return u;
+}
+const _DST_scalar = "HashToScalar-";
+/**
+* Creates hash-to-curve methods from EC Point and mapToCurve function. See {@link H2CHasher}.
+* @param Point - Point constructor.
+* @param mapToCurve - Map-to-curve function.
+* @param defaults - Default hash-to-curve options. This object is frozen in place and reused as
+*   the shared defaults bundle for the returned helpers.
+* @returns Hash-to-curve helper namespace.
+* @throws If the map-to-curve callback or default hash-to-curve options are invalid. {@link Error}
+* @example
+* Bundle hash-to-curve, hash-to-scalar, and encode-to-curve helpers for one curve.
+*
+* ```ts
+* import { createHasher } from '@noble/curves/abstract/hash-to-curve.js';
+* import { p256 } from '@noble/curves/nist.js';
+* import { sha256 } from '@noble/hashes/sha2.js';
+* const hasher = createHasher(p256.Point, () => p256.Point.BASE.toAffine(), {
+*   DST: 'P256_XMD:SHA-256_SSWU_RO_',
+*   encodeDST: 'P256_XMD:SHA-256_SSWU_NU_',
+*   p: p256.Point.Fp.ORDER,
+*   m: 1,
+*   k: 128,
+*   expand: 'xmd',
+*   hash: sha256,
+* });
+* const point = hasher.encodeToCurve(new TextEncoder().encode('hello noble'));
+* ```
+*/
+function createHasher(Point, mapToCurve, defaults) {
+	if (typeof mapToCurve !== "function") throw new Error("mapToCurve() must be defined");
+	const snapshot = (src) => Object.freeze({
+		...src,
+		DST: isBytes(src.DST) ? copyBytes(src.DST) : src.DST,
+		...src.encodeDST === void 0 ? {} : { encodeDST: isBytes(src.encodeDST) ? copyBytes(src.encodeDST) : src.encodeDST }
+	});
+	const safeDefaults = snapshot(defaults);
+	function map(num) {
+		return Point.fromAffine(mapToCurve(num));
+	}
+	function clear(initial) {
+		const P = initial.clearCofactor();
+		if (P.equals(Point.ZERO)) return Point.ZERO;
+		P.assertValidity();
+		return P;
+	}
+	return Object.freeze({
+		get defaults() {
+			return snapshot(safeDefaults);
+		},
+		Point,
+		hashToCurve(msg, options) {
+			const u = hash_to_field(msg, 2, Object.assign({}, safeDefaults, options));
+			const u0 = map(u[0]);
+			const u1 = map(u[1]);
+			return clear(u0.add(u1));
+		},
+		encodeToCurve(msg, options) {
+			const optsDst = safeDefaults.encodeDST ? { DST: safeDefaults.encodeDST } : {};
+			return clear(map(hash_to_field(msg, 1, Object.assign({}, safeDefaults, optsDst, options))[0]));
+		},
+		mapToCurve(scalars) {
+			if (safeDefaults.m === 1) {
+				if (typeof scalars !== "bigint") throw new Error("expected bigint (m=1)");
+				return clear(map([scalars]));
+			}
+			if (!Array.isArray(scalars)) throw new Error("expected array of bigints");
+			for (const i of scalars) if (typeof i !== "bigint") throw new Error("expected array of bigints");
+			return clear(map(scalars));
+		},
+		hashToScalar(msg, options) {
+			const N = Point.Fn.ORDER;
+			return hash_to_field(msg, 1, Object.assign({}, safeDefaults, {
+				p: N,
+				m: 1,
+				DST: _DST_scalar
+			}, options))[0][0];
+		}
+	});
+}
+//#endregion
+//#region ../../packages/module/passport-account/node_modules/@noble/curves/abstract/frost.js
+/**
+* FROST: Flexible Round-Optimized Schnorr Threshold Protocol for Two-Round Schnorr Signatures.
+*
+* See [RFC 9591](https://datatracker.ietf.org/doc/rfc9591/) and [frost.zfnd.org](https://frost.zfnd.org).
+* @module
+*/
+const validateSigners = (signers) => {
+	if (!Number.isSafeInteger(signers.min) || !Number.isSafeInteger(signers.max)) throw new Error("Wrong signers info: min=" + signers.min + " max=" + signers.max);
+	if (signers.min < 2 || signers.max < 2 || signers.min > signers.max) throw new Error("Wrong signers info: min=" + signers.min + " max=" + signers.max);
+};
+const validateCommitmentsNum = (signers, len) => {
+	if (len < signers.min || len > signers.max) throw new Error("Wrong number of commitments=" + len);
+};
+var AggErr = class extends Error {
+	cheaters;
+	constructor(msg, cheaters) {
+		super(msg);
+		this.cheaters = cheaters;
+	}
+};
+function createFROST(opts) {
+	validateObject(opts, {
+		name: "string",
+		hash: "function"
+	}, {
+		hashToScalar: "function",
+		validatePoint: "function",
+		parsePublicKey: "function",
+		adjustScalar: "function",
+		adjustPoint: "function",
+		challenge: "function",
+		adjustNonces: "function",
+		adjustSecret: "function",
+		adjustPublic: "function",
+		adjustGroupCommitmentShare: "function",
+		adjustDKG: "function"
+	});
+	validatePointCons(opts.Point);
+	const { Point } = opts;
+	const Fn = opts.Fn === void 0 ? Point.Fn : opts.Fn;
+	const hashBytes = opts.hash;
+	const hashToScalar = opts.hashToScalar === void 0 ? (msg, opts = { DST: new Uint8Array() }) => {
+		const t = hashBytes(concatBytes(opts.DST, msg));
+		return Fn.create(Fn.isLE ? bytesToNumberLE(t) : bytesToNumberBE(t));
+	} : opts.hashToScalar;
+	const H1Prefix = utf8ToBytes(opts.H1 !== void 0 ? opts.H1 : opts.name + "rho");
+	const H2Prefix = utf8ToBytes(opts.H2 !== void 0 ? opts.H2 : opts.name + "chal");
+	const H3Prefix = utf8ToBytes(opts.H3 !== void 0 ? opts.H3 : opts.name + "nonce");
+	const H4Prefix = utf8ToBytes(opts.H4 !== void 0 ? opts.H4 : opts.name + "msg");
+	const H5Prefix = utf8ToBytes(opts.H5 !== void 0 ? opts.H5 : opts.name + "com");
+	const HDKGPrefix = utf8ToBytes(opts.HDKG !== void 0 ? opts.HDKG : opts.name + "dkg");
+	const HIDPrefix = utf8ToBytes(opts.HID !== void 0 ? opts.HID : opts.name + "id");
+	const H1 = (msg) => hashToScalar(msg, { DST: H1Prefix });
+	const H2 = (msg) => hashToScalar(msg, { DST: H2Prefix });
+	const H3 = (msg) => hashToScalar(msg, { DST: H3Prefix });
+	const H4 = (msg) => hashBytes(concatBytes(H4Prefix, msg));
+	const H5 = (msg) => hashBytes(concatBytes(H5Prefix, msg));
+	const HDKG = (msg) => hashToScalar(msg, { DST: HDKGPrefix });
+	const HID = (msg) => hashToScalar(msg, { DST: HIDPrefix });
+	const randomScalar = (rng = randomBytes) => {
+		const t = mapHashToField(rng(getMinHashLength(Fn.ORDER)), Fn.ORDER, Fn.isLE);
+		return Fn.isLE ? bytesToNumberLE(t) : bytesToNumberBE(t);
+	};
+	const serializePoint = (p) => p.toBytes();
+	const parsePoint = (bytes) => {
+		const p = Point.fromBytes(bytes);
+		if (opts.validatePoint) opts.validatePoint(p);
+		return p;
+	};
+	const nonceCommitments = (identifier, nonces) => ({
+		identifier,
+		hiding: serializePoint(Point.BASE.multiply(Fn.fromBytes(nonces.hiding))),
+		binding: serializePoint(Point.BASE.multiply(Fn.fromBytes(nonces.binding)))
+	});
+	const adjustPoint = opts.adjustPoint === void 0 ? (n) => n : opts.adjustPoint;
+	const validateIdentifier = (n) => {
+		if (!Fn.isValid(n) || Fn.is0(n)) throw new Error("Invalid identifier " + n);
+		return n;
+	};
+	const serializeIdentifier = (id) => bytesToHex(Fn.toBytes(validateIdentifier(id)));
+	const parseIdentifier = (id) => {
+		const n = validateIdentifier(Fn.fromBytes(hexToBytes(id)));
+		if (serializeIdentifier(n) !== id) throw new Error("expected canonical identifier hex");
+		return n;
+	};
+	const Signature = {
+		encode: (R, z) => {
+			let res = concatBytes(serializePoint(R), Fn.toBytes(z));
+			if (opts.adjustTx) res = opts.adjustTx.encode(res);
+			return res;
+		},
+		decode: (sig) => {
+			if (opts.adjustTx) sig = opts.adjustTx.decode(sig);
+			return {
+				R: parsePoint(sig.subarray(0, -Fn.BYTES)),
+				z: Fn.fromBytes(sig.subarray(-Fn.BYTES))
+			};
+		}
+	};
+	const genPointScalarPair = (rng = randomBytes) => {
+		let n = randomScalar(rng);
+		if (opts.adjustScalar) n = opts.adjustScalar(n);
+		let p = Point.BASE.multiply(n);
+		return {
+			scalar: n,
+			point: p
+		};
+	};
+	const nrErr = "roots are unavailable in FROST polynomial mode";
+	const Poly = poly(Fn, {
+		info: {
+			G: Fn.ZERO,
+			oddFactor: Fn.ZERO,
+			powerOfTwo: 0
+		},
+		roots() {
+			throw new Error(nrErr);
+		},
+		brp() {
+			throw new Error(nrErr);
+		},
+		inverse() {
+			throw new Error(nrErr);
+		},
+		omega() {
+			throw new Error(nrErr);
+		},
+		clear() {}
+	});
+	const msm = (points, scalars) => pippenger(Point, points, scalars);
+	const polynomialEvaluate = (x, coeffs) => {
+		if (!coeffs.length) throw new Error("empty coefficients");
+		return Poly.monomial.eval(coeffs, x);
+	};
+	const deriveInterpolatingValue = (L, xi) => {
+		const err = "invalid parameters";
+		if (!L.some((x) => Fn.eql(x, xi))) throw new Error(err);
+		const Lset = new Set(L);
+		if (Lset.size !== L.length) throw new Error(err);
+		if (!Lset.has(xi)) throw new Error(err);
+		let num = Fn.ONE;
+		let den = Fn.ONE;
+		for (const x of L) {
+			if (Fn.eql(x, xi)) continue;
+			num = Fn.mul(num, x);
+			den = Fn.mul(den, Fn.sub(x, xi));
+		}
+		return Fn.div(num, den);
+	};
+	const evalutateVSS = (identifier, commitment) => {
+		return msm(commitment, Poly.monomial.basis(identifier, commitment.length));
+	};
+	const generateSecretPolynomial = (signers, secret, coeffs, rng = randomBytes) => {
+		validateSigners(signers);
+		const secretScalar = secret === void 0 ? randomScalar(rng) : Fn.fromBytes(secret);
+		if (!coeffs) {
+			coeffs = [];
+			for (let i = 0; i < signers.min - 1; i++) coeffs.push(randomScalar(rng));
+		}
+		if (coeffs.length !== signers.min - 1) throw new Error("wrong coefficients length");
+		const coefficients = [secretScalar, ...coeffs];
+		return {
+			coefficients,
+			commitment: coefficients.map((i) => Point.BASE.multiply(i)),
+			secret: secretScalar
+		};
+	};
+	const ProofOfKnowledge = {
+		challenge: (id, verKey, R) => HDKG(concatBytes(Fn.toBytes(id), serializePoint(verKey), serializePoint(R))),
+		compute(id, coefficents, commitments, rng = randomBytes) {
+			if (coefficents.length < 1) throw new Error("coefficients should have at least one element");
+			const { point: R, scalar: k } = genPointScalarPair(rng);
+			const verKey = commitments[0];
+			const c = this.challenge(id, verKey, R);
+			const mu = Fn.add(k, Fn.mul(coefficents[0], c));
+			return Signature.encode(R, mu);
+		},
+		validate(id, commitment, proof) {
+			if (commitment.length < 1) throw new Error("commitment should have at least one element");
+			const { R, z } = Signature.decode(proof);
+			const phi = parsePoint(commitment[0]);
+			const c = this.challenge(id, phi, R);
+			if (!R.equals(Point.BASE.multiply(z).subtract(phi.multiply(c)))) throw new Error("invalid proof of knowledge");
+		}
+	};
+	const Basic = {
+		challenge: (R, PK, msg) => {
+			if (opts.challenge) return opts.challenge(R, PK, msg);
+			return H2(concatBytes(serializePoint(R), serializePoint(PK), msg));
+		},
+		sign(msg, sk, rng = randomBytes) {
+			const { point: R, scalar: r } = genPointScalarPair(rng);
+			const PK = Point.BASE.multiply(sk);
+			const c = this.challenge(R, PK, msg);
+			return [R, Fn.add(r, Fn.mul(c, sk))];
+		},
+		verify(msg, R, z, PK) {
+			if (opts.adjustPoint) PK = opts.adjustPoint(PK);
+			if (opts.adjustPoint) R = opts.adjustPoint(R);
+			const c = this.challenge(R, PK, msg);
+			const zB = Point.BASE.multiply(z);
+			const cA = PK.multiply(c);
+			let check = zB.subtract(cA).subtract(R);
+			if (check.clearCofactor) check = check.clearCofactor();
+			return Point.ZERO.equals(check);
+		}
+	};
+	const validateSecretShare = (identifier, commitment, signingShare) => {
+		if (!Point.BASE.multiply(signingShare).equals(evalutateVSS(identifier, commitment))) throw new Error("invalid secret share");
+	};
+	const Identifier = {
+		fromNumber(n) {
+			if (!Number.isSafeInteger(n)) throw new Error("expected safe interger");
+			return serializeIdentifier(BigInt(n));
+		},
+		derive(s) {
+			if (typeof s !== "string") throw new Error("wrong identifier string: " + s);
+			return serializeIdentifier(HID(utf8ToBytes(s)));
+		}
+	};
+	const generateNonce = (secret, rng = randomBytes) => H3(concatBytes(rng(32), Fn.toBytes(secret)));
+	const getGroupCommitment = (GPK, commitmentList, msg) => {
+		const CL = commitmentList.map((i) => [
+			i.identifier,
+			parseIdentifier(i.identifier),
+			parsePoint(i.hiding),
+			parsePoint(i.binding)
+		]);
+		CL.sort((a, b) => a[1] < b[1] ? -1 : a[1] > b[1] ? 1 : 0);
+		const Cbytes = [];
+		for (const [_, id, hC, bC] of CL) Cbytes.push(Fn.toBytes(id), serializePoint(hC), serializePoint(bC));
+		const encodedCommitmentHash = H5(concatBytes(...Cbytes));
+		const rhoPrefix = concatBytes(serializePoint(GPK), H4(msg), encodedCommitmentHash);
+		const bindingFactors = {};
+		for (const [i, id] of CL) bindingFactors[i] = H1(concatBytes(rhoPrefix, Fn.toBytes(id)));
+		const points = [];
+		const scalars = [];
+		for (const [i, _, hC, bC] of CL) {
+			if (Point.ZERO.equals(hC) || Point.ZERO.equals(bC)) throw new Error("infinity commitment");
+			points.push(hC, bC);
+			scalars.push(Fn.ONE, bindingFactors[i]);
+		}
+		const groupCommitment = msm(points, scalars);
+		return {
+			identifiers: CL.map((i) => i[1]),
+			groupCommitment,
+			bindingFactors
+		};
+	};
+	const prepareShare = (PK, commitmentList, msg, identifier) => {
+		const GPK = adjustPoint(parsePoint(PK));
+		const id = parseIdentifier(identifier);
+		const { identifiers, groupCommitment, bindingFactors } = getGroupCommitment(GPK, commitmentList, msg);
+		const bindingFactor = bindingFactors[identifier];
+		return {
+			lambda: deriveInterpolatingValue(identifiers, id),
+			challenge: Basic.challenge(groupCommitment, GPK, msg),
+			bindingFactor,
+			groupCommitment
+		};
+	};
+	Object.freeze(Identifier);
+	const frost = {
+		Identifier,
+		DKG: Object.freeze({
+			round1: (id, signers, secret, rng = randomBytes) => {
+				validateSigners(signers);
+				const idNum = parseIdentifier(id);
+				const { coefficients, commitment } = generateSecretPolynomial(signers, secret, void 0, rng);
+				const proofOfKnowledge = ProofOfKnowledge.compute(idNum, coefficients, commitment, rng);
+				const commitmentBytes = commitment.map(serializePoint);
+				return {
+					public: {
+						identifier: serializeIdentifier(idNum),
+						commitment: commitmentBytes,
+						proofOfKnowledge
+					},
+					secret: {
+						identifier: idNum,
+						coefficients,
+						commitment: commitment.map(serializePoint),
+						signers: {
+							min: signers.min,
+							max: signers.max
+						},
+						step: 1
+					}
+				};
+			},
+			round2: (secret, others) => {
+				if (others.length !== secret.signers.max - 1) throw new Error("wrong number of round1 packages");
+				if (!secret.coefficients || secret.step === 3) throw new Error("round3 package used in round2");
+				const res = {};
+				for (const p of others) {
+					if (p.commitment.length !== secret.signers.min) throw new Error("wrong number of commitments");
+					const id = parseIdentifier(p.identifier);
+					if (id === secret.identifier) throw new Error("duplicate id=" + serializeIdentifier(id));
+					ProofOfKnowledge.validate(id, p.commitment, p.proofOfKnowledge);
+					for (const c of p.commitment) parsePoint(c);
+					if (res[p.identifier]) throw new Error("Duplicate id=" + id);
+					const signingShare = Fn.toBytes(polynomialEvaluate(id, secret.coefficients));
+					res[p.identifier] = {
+						identifier: serializeIdentifier(secret.identifier),
+						signingShare
+					};
+				}
+				secret.step = 2;
+				return res;
+			},
+			round3: (secret, round1, round2) => {
+				if (round1.length !== secret.signers.max - 1) throw new Error("wrong length of round1 packages");
+				if (!secret.coefficients || secret.step !== 2) throw new Error("round2 package used in round3");
+				if (round2.length !== round1.length) throw new Error("wrong length of round2 packages");
+				const merged = {};
+				for (const r1 of round1) {
+					if (!r1.identifier || !r1.commitment) throw new Error("wrong round1 share");
+					merged[r1.identifier] = { ...r1 };
+				}
+				for (const r2 of round2) {
+					if (!r2.identifier || !r2.signingShare) throw new Error("wrong round2 share");
+					if (!merged[r2.identifier]) throw new Error("round1 share for " + r2.identifier + " is missing");
+					merged[r2.identifier].signingShare = r2.signingShare;
+				}
+				if (Object.keys(merged).length !== round1.length) throw new Error("mismatch identifiers between rounds");
+				let signingShare = Fn.ZERO;
+				if (secret.commitment.length !== secret.signers.min) throw new Error("wrong commitments length");
+				const localCommitment = secret.commitment.map(parsePoint);
+				const localShare = polynomialEvaluate(secret.identifier, secret.coefficients);
+				validateSecretShare(secret.identifier, localCommitment, localShare);
+				const localCommitmentBytes = localCommitment.map(serializePoint);
+				const commitments = { [serializeIdentifier(secret.identifier)]: localCommitmentBytes };
+				for (const k in merged) {
+					const v = merged[k];
+					if (!v.signingShare || !v.commitment) throw new Error("mismatch identifiers");
+					const id = parseIdentifier(k);
+					const signingSharePart = Fn.fromBytes(v.signingShare);
+					const commitment = v.commitment.map(parsePoint);
+					validateSecretShare(secret.identifier, commitment, signingSharePart);
+					signingShare = Fn.add(signingShare, signingSharePart);
+					const idSer = serializeIdentifier(id);
+					if (commitments[idSer]) throw new Error("duplicated id=" + idSer);
+					commitments[idSer] = v.commitment;
+				}
+				signingShare = Fn.add(signingShare, localShare);
+				const mergedCommitment = new Array(secret.signers.min).fill(Point.ZERO);
+				for (const k in commitments) {
+					const v = commitments[k];
+					if (v.length !== secret.signers.min) throw new Error("wrong commitments length");
+					for (let i = 0; i < v.length; i++) mergedCommitment[i] = mergedCommitment[i].add(parsePoint(v[i]));
+				}
+				const mergedCommitmentBytes = mergedCommitment.map(serializePoint);
+				const verifyingShares = {};
+				for (const k in commitments) verifyingShares[k] = serializePoint(evalutateVSS(parseIdentifier(k), mergedCommitment));
+				let res = {
+					public: {
+						signers: {
+							min: secret.signers.min,
+							max: secret.signers.max
+						},
+						commitments: mergedCommitmentBytes,
+						verifyingShares: Object.fromEntries(Object.entries(verifyingShares).map(([k, v]) => [k, v.slice()]))
+					},
+					secret: {
+						identifier: serializeIdentifier(secret.identifier),
+						signingShare: Fn.toBytes(signingShare)
+					}
+				};
+				if (opts.adjustDKG) res = opts.adjustDKG(res);
+				for (let i = 0; i < secret.coefficients.length; i++) secret.coefficients[i] -= secret.coefficients[i];
+				delete secret.coefficients;
+				secret.step = 3;
+				return res;
+			},
+			clean(secret) {
+				secret.identifier -= secret.identifier;
+				if (secret.coefficients) for (let i = 0; i < secret.coefficients.length; i++) secret.coefficients[i] -= secret.coefficients[i];
+				secret.step = 3;
+			}
+		}),
+		trustedDealer(signers, identifiers, secret, rng = randomBytes) {
+			validateSigners(signers);
+			if (identifiers === void 0) {
+				identifiers = [];
+				for (let i = 1; i <= signers.max; i++) identifiers.push(Identifier.fromNumber(i));
+			} else if (!Array.isArray(identifiers) || identifiers.length !== signers.max) throw new Error("identifiers should be array of " + signers.max);
+			const identifierNums = {};
+			for (const id of identifiers) {
+				const idNum = parseIdentifier(id);
+				if (id in identifierNums) throw new Error("duplicated id=" + id);
+				identifierNums[id] = idNum;
+			}
+			const sp = generateSecretPolynomial(signers, secret, void 0, rng);
+			const commitmentBytes = sp.commitment.map(serializePoint);
+			const secretShares = {};
+			const verifyingShares = {};
+			for (const id of identifiers) {
+				const signingShare = polynomialEvaluate(identifierNums[id], sp.coefficients);
+				verifyingShares[id] = serializePoint(Point.BASE.multiply(signingShare));
+				secretShares[id] = {
+					identifier: id,
+					signingShare: Fn.toBytes(signingShare)
+				};
+			}
+			return {
+				public: {
+					signers: {
+						min: signers.min,
+						max: signers.max
+					},
+					commitments: commitmentBytes,
+					verifyingShares
+				},
+				secretShares
+			};
+		},
+		validateSecret(secret, pub) {
+			validateSecretShare(parseIdentifier(secret.identifier), pub.commitments.map(parsePoint), Fn.fromBytes(secret.signingShare));
+		},
+		commit(secret, rng = randomBytes) {
+			const secretScalar = Fn.fromBytes(secret.signingShare);
+			const hiding = generateNonce(secretScalar, rng);
+			const binding = generateNonce(secretScalar, rng);
+			const nonces = {
+				hiding: Fn.toBytes(hiding),
+				binding: Fn.toBytes(binding)
+			};
+			return {
+				nonces,
+				commitments: nonceCommitments(secret.identifier, nonces)
+			};
+		},
+		signShare(secret, pub, nonces, commitmentList, msg) {
+			validateCommitmentsNum(pub.signers, commitmentList.length);
+			const hidingNonce0 = Fn.fromBytes(nonces.hiding);
+			const bindingNonce0 = Fn.fromBytes(nonces.binding);
+			if (Fn.is0(hidingNonce0) || Fn.is0(bindingNonce0)) throw new Error("signing nonces already used");
+			const expectedCommitment = {
+				identifier: secret.identifier,
+				hiding: serializePoint(Point.BASE.multiply(hidingNonce0)),
+				binding: serializePoint(Point.BASE.multiply(bindingNonce0))
+			};
+			const commitment = commitmentList.find((i) => i.identifier === secret.identifier);
+			if (!commitment) throw new Error("missing signer commitment");
+			if (bytesToHex(commitment.hiding) !== bytesToHex(expectedCommitment.hiding) || bytesToHex(commitment.binding) !== bytesToHex(expectedCommitment.binding)) throw new Error("incorrect signer commitment");
+			if (opts.adjustSecret) secret = opts.adjustSecret(secret, pub);
+			if (opts.adjustPublic) pub = opts.adjustPublic(pub);
+			const SK = Fn.fromBytes(secret.signingShare);
+			const { lambda, challenge, bindingFactor, groupCommitment } = prepareShare(pub.commitments[0], commitmentList, msg, secret.identifier);
+			const N = opts.adjustNonces ? opts.adjustNonces(groupCommitment, nonces) : nonces;
+			const hidingNonce = opts.adjustNonces ? Fn.fromBytes(N.hiding) : hidingNonce0;
+			const bindingNonce = opts.adjustNonces ? Fn.fromBytes(N.binding) : bindingNonce0;
+			const t = Fn.mul(Fn.mul(lambda, SK), challenge);
+			const t2 = Fn.mul(bindingNonce, bindingFactor);
+			const r = Fn.toBytes(Fn.add(Fn.add(hidingNonce, t2), t));
+			nonces.hiding.fill(0);
+			nonces.binding.fill(0);
+			return r;
+		},
+		verifyShare(pub, commitmentList, msg, identifier, sigShare) {
+			if (opts.adjustPublic) pub = opts.adjustPublic(pub);
+			const comm = commitmentList.find((i) => i.identifier === identifier);
+			if (!comm) throw new Error("cannot find identifier commitment");
+			const PK = parsePoint(pub.verifyingShares[identifier]);
+			const hidingNonceCommitment = parsePoint(comm.hiding);
+			const bindingNonceCommitment = parsePoint(comm.binding);
+			const { lambda, challenge, bindingFactor, groupCommitment } = prepareShare(pub.commitments[0], commitmentList, msg, identifier);
+			let commShare = hidingNonceCommitment.add(bindingNonceCommitment.multiply(bindingFactor));
+			if (opts.adjustGroupCommitmentShare) commShare = opts.adjustGroupCommitmentShare(groupCommitment, commShare);
+			const l = Point.BASE.multiply(Fn.fromBytes(sigShare));
+			const r = commShare.add(PK.multiply(Fn.mul(challenge, lambda)));
+			return l.equals(r);
+		},
+		aggregate(pub, commitmentList, msg, sigShares) {
+			if (opts.adjustPublic) pub = opts.adjustPublic(pub);
+			try {
+				validateCommitmentsNum(pub.signers, commitmentList.length);
+			} catch {
+				throw new AggErr("aggregation failed", []);
+			}
+			const ids = commitmentList.map((i) => i.identifier);
+			if (ids.length !== Object.keys(sigShares).length) throw new AggErr("aggregation failed", []);
+			for (const id of ids) if (!(id in sigShares) || !(id in pub.verifyingShares)) throw new AggErr("aggregation failed", []);
+			const GPK = parsePoint(pub.commitments[0]);
+			const { groupCommitment } = getGroupCommitment(GPK, commitmentList, msg);
+			let z = Fn.ZERO;
+			for (const id of ids) z = Fn.add(z, Fn.fromBytes(sigShares[id]));
+			if (!Basic.verify(msg, groupCommitment, z, GPK)) {
+				const cheaters = [];
+				for (const id of ids) if (!this.verifyShare(pub, commitmentList, msg, id, sigShares[id])) cheaters.push(id);
+				throw new AggErr("aggregation failed", cheaters);
+			}
+			return Signature.encode(groupCommitment, z);
+		},
+		sign(msg, secretKey) {
+			let sk = Fn.fromBytes(secretKey);
+			if (opts.adjustScalar) sk = opts.adjustScalar(sk);
+			const [R, z] = Basic.sign(msg, sk);
+			return Signature.encode(R, z);
+		},
+		verify(sig, msg, publicKey) {
+			const PK = opts.parsePublicKey ? opts.parsePublicKey(publicKey) : parsePoint(publicKey);
+			const { R, z } = Signature.decode(sig);
+			return Basic.verify(msg, R, z, PK);
+		},
+		combineSecret(shares, signers) {
+			validateSigners(signers);
+			if (!Array.isArray(shares) || shares.length < signers.min) throw new Error("wrong secret shares array");
+			const points = [];
+			const seen = {};
+			for (const s of shares) {
+				const idNum = parseIdentifier(s.identifier);
+				const id = serializeIdentifier(idNum);
+				if (seen[id]) throw new Error("duplicated id=" + id);
+				seen[id] = true;
+				points.push([idNum, Fn.fromBytes(s.signingShare)]);
+			}
+			const xCoords = points.map(([x]) => x);
+			let res = Fn.ZERO;
+			for (const [x, y] of points) res = Fn.add(res, Fn.mul(y, deriveInterpolatingValue(xCoords, x)));
+			return Fn.toBytes(res);
+		},
+		utils: Object.freeze({
+			Fn,
+			randomScalar: (rng = randomBytes) => Fn.toBytes(genPointScalarPair(rng).scalar),
+			generateSecretPolynomial: (signers, secret, coeffs, rng) => {
+				const res = generateSecretPolynomial(signers, secret, coeffs, rng);
+				return {
+					...res,
+					commitment: res.commitment.map(serializePoint)
+				};
+			}
+		})
+	};
+	return Object.freeze(frost);
+}
+//#endregion
+//#region ../../packages/module/passport-account/node_modules/@noble/curves/abstract/montgomery.js
+/**
+* Montgomery curve methods. It's not really whole montgomery curve,
+* just bunch of very specific methods for X25519 / X448 from
+* [RFC 7748](https://www.rfc-editor.org/rfc/rfc7748)
+* @module
+*/
+/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
+const _0n$1 = BigInt(0);
+const _1n$1 = BigInt(1);
+const _2n$1 = BigInt(2);
+function validateOpts(curve) {
+	validateObject(curve, {
+		P: "bigint",
+		type: "string",
+		adjustScalarBytes: "function",
+		powPminus2: "function"
+	}, { randomBytes: "function" });
+	return Object.freeze({ ...curve });
+}
+/**
+* @param curveDef - Montgomery curve definition.
+* @returns ECDH helper namespace.
+* @throws If the curve definition or derived shared point is invalid. {@link Error}
+* @example
+* Perform one X25519 key exchange through the generic Montgomery helper.
+*
+* ```ts
+* import { x25519 } from '@noble/curves/ed25519.js';
+* const alice = x25519.keygen();
+* const shared = x25519.getSharedSecret(alice.secretKey, alice.publicKey);
+* ```
+*/
+function montgomery(curveDef) {
+	const { P, type, adjustScalarBytes, powPminus2, randomBytes: rand } = validateOpts(curveDef);
+	const is25519 = type === "x25519";
+	if (!is25519 && type !== "x448") throw new Error("invalid type");
+	const randomBytes_ = rand === void 0 ? randomBytes : rand;
+	const montgomeryBits = is25519 ? 255 : 448;
+	const fieldLen = is25519 ? 32 : 56;
+	const Gu = is25519 ? BigInt(9) : BigInt(5);
+	const a24 = is25519 ? BigInt(121665) : BigInt(39081);
+	const minScalar = is25519 ? _2n$1 ** BigInt(254) : _2n$1 ** BigInt(447);
+	const maxScalar = minScalar + (is25519 ? BigInt(8) * _2n$1 ** BigInt(251) - _1n$1 : BigInt(4) * _2n$1 ** BigInt(445) - _1n$1) + _1n$1;
+	const modP = (n) => mod(n, P);
+	const GuBytes = encodeU(Gu);
+	function encodeU(u) {
+		return numberToBytesLE(modP(u), fieldLen);
+	}
+	function decodeU(u) {
+		const _u = copyBytes(abytes(u, fieldLen, "uCoordinate"));
+		if (is25519) _u[31] &= 127;
+		return modP(bytesToNumberLE(_u));
+	}
+	function decodeScalar(scalar) {
+		return bytesToNumberLE(adjustScalarBytes(copyBytes(abytes(scalar, fieldLen, "scalar"))));
+	}
+	function scalarMult(scalar, u) {
+		const pu = montgomeryLadder(decodeU(u), decodeScalar(scalar));
+		if (pu === _0n$1) throw new Error("invalid private or public key received");
+		return encodeU(pu);
+	}
+	function scalarMultBase(scalar) {
+		return scalarMult(scalar, GuBytes);
+	}
+	const getPublicKey = scalarMultBase;
+	const getSharedSecret = scalarMult;
+	function cswap(swap, x_2, x_3) {
+		const dummy = modP(swap * (x_2 - x_3));
+		x_2 = modP(x_2 - dummy);
+		x_3 = modP(x_3 + dummy);
+		return {
+			x_2,
+			x_3
+		};
+	}
+	/**
+	* Montgomery x-only multiplication ladder for the selected X25519/X448 curve.
+	* @param pointU - decoded Montgomery u coordinate for the selected curve
+	* @param scalar - decoded clamped scalar by which the point is multiplied
+	* @returns resulting Montgomery u coordinate for the selected curve
+	*/
+	function montgomeryLadder(u, scalar) {
+		aInRange("u", u, _0n$1, P);
+		aInRange("scalar", scalar, minScalar, maxScalar);
+		const k = scalar;
+		const x_1 = u;
+		let x_2 = _1n$1;
+		let z_2 = _0n$1;
+		let x_3 = u;
+		let z_3 = _1n$1;
+		let swap = _0n$1;
+		for (let t = BigInt(montgomeryBits - 1); t >= _0n$1; t--) {
+			const k_t = k >> t & _1n$1;
+			swap ^= k_t;
+			({x_2, x_3} = cswap(swap, x_2, x_3));
+			({x_2: z_2, x_3: z_3} = cswap(swap, z_2, z_3));
+			swap = k_t;
+			const A = x_2 + z_2;
+			const AA = modP(A * A);
+			const B = x_2 - z_2;
+			const BB = modP(B * B);
+			const E = AA - BB;
+			const C = x_3 + z_3;
+			const DA = modP((x_3 - z_3) * A);
+			const CB = modP(C * B);
+			const dacb = DA + CB;
+			const da_cb = DA - CB;
+			x_3 = modP(dacb * dacb);
+			z_3 = modP(x_1 * modP(da_cb * da_cb));
+			x_2 = modP(AA * BB);
+			z_2 = modP(E * (AA + modP(a24 * E)));
+		}
+		({x_2, x_3} = cswap(swap, x_2, x_3));
+		({x_2: z_2, x_3: z_3} = cswap(swap, z_2, z_3));
+		const z2 = powPminus2(z_2);
+		return modP(x_2 * z2);
+	}
+	const lengths = {
+		secretKey: fieldLen,
+		publicKey: fieldLen,
+		seed: fieldLen
+	};
+	const randomSecretKey = (seed) => {
+		seed = seed === void 0 ? randomBytes_(fieldLen) : seed;
+		abytes(seed, lengths.seed, "seed");
+		return seed;
+	};
+	const utils = { randomSecretKey };
+	Object.freeze(lengths);
+	Object.freeze(utils);
+	return Object.freeze({
+		keygen: createKeygen(randomSecretKey, getPublicKey),
+		getSharedSecret,
+		getPublicKey,
+		scalarMult,
+		scalarMultBase,
+		utils,
+		GuBytes: GuBytes.slice(),
+		lengths
+	});
+}
+//#endregion
+//#region ../../packages/module/passport-account/node_modules/@noble/curves/abstract/oprf.js
+/**
+* RFC 9497: Oblivious Pseudorandom Functions (OPRFs) Using Prime-Order Groups.
+* https://www.rfc-editor.org/rfc/rfc9497
+*
+
+OPRF allows to interactively create an `Output = PRF(Input, serverSecretKey)`:
+
+- Server cannot calculate Output by itself: it doesn't know Input
+- Client cannot calculate Output by itself: it doesn't know server secretKey
+- An attacker interception the communication can't restore Input/Output/serverSecretKey and can't
+link Input to some value.
+
+## Issues
+
+- Low-entropy inputs (e.g. password '123') enable brute-forced dictionary attacks by the server
+(solveable by domain separation in POPRF)
+- High-level protocol needs to be constructed on top, because OPRF is low-level
+
+## Use cases
+
+1. **Password-Authenticated Key Exchange (PAKE):** Enables secure password login (e.g., OPAQUE)
+without revealing the password to the server.
+2. **Private Set Intersection (PSI):** Allows two parties to compute the intersection of their
+private sets without revealing non-intersecting elements.
+3. **Anonymous Credential Systems:** Supports issuance of anonymous, unlinkable credentials
+(e.g., Privacy Pass) using blind OPRF evaluation.
+4. **Private Information Retrieval (PIR):** Helps users query databases without revealing which
+item they accessed.
+5. **Encrypted Search / Secure Indexing:** Enables keyword search over encrypted data while keeping
+queries private.
+6. **Spam Prevention and Rate-Limiting:** Issues anonymous tokens to prevent abuse
+(e.g., CAPTCHA bypass) without compromising user privacy.
+
+## Modes
+
+- OPRF: simple mode, client doesn't need to know server public key
+- VOPRF: verifiable mode. It lets the client verify that the server used the
+secret key corresponding to a known public key
+- POPRF: partially oblivious mode, VOPRF + domain separation
+
+There is also non-interactive mode (Evaluate), which creates Output
+non-interactively with knowledge of the secret key.
+
+Flow:
+- (once) Server generates secret and public keys, distributes public keys to clients
+- deterministically: `deriveKeyPair` or just random: `generateKeyPair`
+- Client blinds input: `blind(secretInput)`
+- Server evaluates blinded input: `blindEvaluate` generated by client, sends result to client
+- Client creates output using result of evaluation via 'finalize'
+
+* @module
+*/
+/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
+const _DST_scalarBytes = /* @__PURE__ */ asciiToBytes(_DST_scalar);
+/**
+* @param opts - OPRF ciphersuite options. See {@link OPRFOpts}.
+* @returns OPRF helper namespace.
+* @example
+* Instantiate an OPRF suite from curve-specific hashing hooks.
+*
+* ```ts
+* import { createOPRF } from '@noble/curves/abstract/oprf.js';
+* import { p256, p256_hasher } from '@noble/curves/nist.js';
+* import { sha256 } from '@noble/hashes/sha2.js';
+* const oprf = createOPRF({
+*   name: 'P256-SHA256',
+*   Point: p256.Point,
+*   hash: sha256,
+*   hashToGroup: p256_hasher.hashToCurve,
+*   hashToScalar: p256_hasher.hashToScalar,
+* });
+* const keys = oprf.oprf.generateKeyPair();
+* ```
+*/
+function createOPRF(opts) {
+	validateObject(opts, {
+		name: "string",
+		hash: "function",
+		hashToScalar: "function",
+		hashToGroup: "function"
+	});
+	validatePointCons(opts.Point);
+	const { name, Point, hash } = opts;
+	const { Fn } = Point;
+	const hashToGroup = (msg, ctx) => opts.hashToGroup(msg, { DST: concatBytes(asciiToBytes("HashToGroup-"), ctx) });
+	const hashToScalarPrefixed = (msg, ctx) => opts.hashToScalar(msg, { DST: concatBytes(_DST_scalarBytes, ctx) });
+	const randomScalar = (rng = randomBytes) => {
+		const t = mapHashToField(rng(getMinHashLength(Fn.ORDER)), Fn.ORDER, Fn.isLE);
+		return Fn.isLE ? bytesToNumberLE(t) : bytesToNumberBE(t);
+	};
+	const msm = (points, scalars) => pippenger(Point, points, scalars);
+	const getCtx = (mode) => concatBytes(asciiToBytes("OPRFV1-"), new Uint8Array([mode]), asciiToBytes("-" + name));
+	const ctxOPRF = getCtx(0);
+	const ctxVOPRF = getCtx(1);
+	const ctxPOPRF = getCtx(2);
+	function encode(...args) {
+		const res = [];
+		for (const a of args) if (typeof a === "number") res.push(numberToBytesBE(a, 2));
+		else if (typeof a === "string") res.push(asciiToBytes(a));
+		else {
+			abytes(a);
+			res.push(numberToBytesBE(a.length, 2), a);
+		}
+		return concatBytes(...res);
+	}
+	const inputBytes = (title, bytes) => {
+		abytes(bytes, void 0, title);
+		if (bytes.length > 65535) throw new Error(`"${title}" expected Uint8Array of length <= 65535, got length=${bytes.length}`);
+		return bytes;
+	};
+	const hashInput = (...bytes) => hash(encode(...bytes, "Finalize"));
+	function getTranscripts(B, C, D, ctx) {
+		const seed = hash(encode(B.toBytes(), concatBytes(asciiToBytes("Seed-"), ctx)));
+		const res = [];
+		for (let i = 0; i < C.length; i++) {
+			const Ci = C[i].toBytes();
+			const Di = D[i].toBytes();
+			const di = hashToScalarPrefixed(encode(seed, i, Ci, Di, "Composite"), ctx);
+			res.push(di);
+		}
+		return res;
+	}
+	function computeComposites(B, C, D, ctx) {
+		const T = getTranscripts(B, C, D, ctx);
+		return {
+			M: msm(C, T),
+			Z: msm(D, T)
+		};
+	}
+	function computeCompositesFast(k, B, C, D, ctx) {
+		const M = msm(C, getTranscripts(B, C, D, ctx));
+		return {
+			M,
+			Z: M.multiply(k)
+		};
+	}
+	function challengeTranscript(B, M, Z, t2, t3, ctx) {
+		const [Bm, a0, a1, a2, a3] = [
+			B,
+			M,
+			Z,
+			t2,
+			t3
+		].map((i) => i.toBytes());
+		return hashToScalarPrefixed(encode(Bm, a0, a1, a2, a3, "Challenge"), ctx);
+	}
+	function generateProof(ctx, k, B, C, D, rng) {
+		const { M, Z } = computeCompositesFast(k, B, C, D, ctx);
+		const r = randomScalar(rng);
+		const c = challengeTranscript(B, M, Z, Point.BASE.multiply(r), M.multiply(r), ctx);
+		return concatBytes(...[c, Fn.sub(r, Fn.mul(c, k))].map((i) => Fn.toBytes(i)));
+	}
+	function verifyProof(ctx, B, C, D, proof) {
+		abytes(proof, 2 * Fn.BYTES);
+		const { M, Z } = computeComposites(B, C, D, ctx);
+		const [c, s] = [proof.subarray(0, Fn.BYTES), proof.subarray(Fn.BYTES)].map((f) => Fn.fromBytes(f));
+		const expectedC = challengeTranscript(B, M, Z, Point.BASE.multiply(s).add(B.multiply(c)), M.multiply(s).add(Z.multiply(c)), ctx);
+		if (!Fn.eql(c, expectedC)) throw new Error("proof verification failed");
+	}
+	function generateKeyPair() {
+		const skS = randomScalar();
+		const pkS = Point.BASE.multiply(skS);
+		return {
+			secretKey: Fn.toBytes(skS),
+			publicKey: pkS.toBytes()
+		};
+	}
+	function deriveKeyPair(ctx, seed, info) {
+		abytes(seed, 32, "seed");
+		info = inputBytes("keyInfo", info);
+		const dst = concatBytes(asciiToBytes("DeriveKeyPair"), ctx);
+		const msg = concatBytes(seed, encode(info), Uint8Array.of(0));
+		for (let counter = 0; counter <= 255; counter++) {
+			msg[msg.length - 1] = counter;
+			const skS = opts.hashToScalar(msg, { DST: dst });
+			if (Fn.is0(skS)) continue;
+			return {
+				secretKey: Fn.toBytes(skS),
+				publicKey: Point.BASE.multiply(skS).toBytes()
+			};
+		}
+		throw new Error("Cannot derive key");
+	}
+	const wirePoint = (label, bytes) => {
+		const point = Point.fromBytes(bytes);
+		if (point.equals(Point.ZERO)) throw new Error(label + " point at infinity");
+		return point;
+	};
+	function blind(ctx, input, rng = randomBytes) {
+		input = inputBytes("input", input);
+		const blind = randomScalar(rng);
+		const inputPoint = hashToGroup(input, ctx);
+		if (inputPoint.equals(Point.ZERO)) throw new Error("Input point at infinity");
+		const blinded = inputPoint.multiply(blind);
+		return {
+			blind: Fn.toBytes(blind),
+			blinded: blinded.toBytes()
+		};
+	}
+	function evaluate(ctx, secretKey, input) {
+		input = inputBytes("input", input);
+		const skS = Fn.fromBytes(secretKey);
+		const inputPoint = hashToGroup(input, ctx);
+		if (inputPoint.equals(Point.ZERO)) throw new Error("Input point at infinity");
+		const unblinded = inputPoint.multiply(skS).toBytes();
+		return hashInput(input, unblinded);
+	}
+	const oprf = Object.freeze({
+		generateKeyPair,
+		deriveKeyPair: (seed, keyInfo) => deriveKeyPair(ctxOPRF, seed, keyInfo),
+		blind: (input, rng = randomBytes) => blind(ctxOPRF, input, rng),
+		blindEvaluate(secretKey, blindedPoint) {
+			const skS = Fn.fromBytes(secretKey);
+			return wirePoint("blinded", blindedPoint).multiply(skS).toBytes();
+		},
+		finalize(input, blindBytes, evaluatedBytes) {
+			input = inputBytes("input", input);
+			const blind = Fn.fromBytes(blindBytes);
+			const unblinded = wirePoint("evaluated", evaluatedBytes).multiply(Fn.inv(blind)).toBytes();
+			return hashInput(input, unblinded);
+		},
+		evaluate: (secretKey, input) => evaluate(ctxOPRF, secretKey, input)
+	});
+	const voprf = Object.freeze({
+		generateKeyPair,
+		deriveKeyPair: (seed, keyInfo) => deriveKeyPair(ctxVOPRF, seed, keyInfo),
+		blind: (input, rng = randomBytes) => blind(ctxVOPRF, input, rng),
+		blindEvaluateBatch(secretKey, publicKey, blinded, rng = randomBytes) {
+			if (!Array.isArray(blinded)) throw new Error("expected array");
+			const skS = Fn.fromBytes(secretKey);
+			const pkS = wirePoint("public key", publicKey);
+			const blindedPoints = blinded.map((i) => wirePoint("blinded", i));
+			const evaluated = blindedPoints.map((i) => i.multiply(skS));
+			const proof = generateProof(ctxVOPRF, skS, pkS, blindedPoints, evaluated, rng);
+			return {
+				evaluated: evaluated.map((i) => i.toBytes()),
+				proof
+			};
+		},
+		blindEvaluate(secretKey, publicKey, blinded, rng = randomBytes) {
+			const res = this.blindEvaluateBatch(secretKey, publicKey, [blinded], rng);
+			return {
+				evaluated: res.evaluated[0],
+				proof: res.proof
+			};
+		},
+		finalizeBatch(items, publicKey, proof) {
+			if (!Array.isArray(items)) throw new Error("expected array");
+			verifyProof(ctxVOPRF, wirePoint("public key", publicKey), items.map((i) => wirePoint("blinded", i.blinded)), items.map((i) => wirePoint("evaluated", i.evaluated)), proof);
+			return items.map((i) => oprf.finalize(i.input, i.blind, i.evaluated));
+		},
+		finalize(input, blind, evaluated, blinded, publicKey, proof) {
+			return this.finalizeBatch([{
+				input,
+				blind,
+				evaluated,
+				blinded
+			}], publicKey, proof)[0];
+		},
+		evaluate: (secretKey, input) => evaluate(ctxVOPRF, secretKey, input)
+	});
+	const poprf = (info) => {
+		info = inputBytes("info", info);
+		const m = hashToScalarPrefixed(encode("Info", info), ctxPOPRF);
+		const T = Point.BASE.multiply(m);
+		return Object.freeze({
+			generateKeyPair,
+			deriveKeyPair: (seed, keyInfo) => deriveKeyPair(ctxPOPRF, seed, keyInfo),
+			blind(input, publicKey, rng = randomBytes) {
+				input = inputBytes("input", input);
+				const pkS = wirePoint("public key", publicKey);
+				const tweakedKey = T.add(pkS);
+				if (tweakedKey.equals(Point.ZERO)) throw new Error("tweakedKey point at infinity");
+				const blind = randomScalar(rng);
+				const inputPoint = hashToGroup(input, ctxPOPRF);
+				if (inputPoint.equals(Point.ZERO)) throw new Error("Input point at infinity");
+				const blindedPoint = inputPoint.multiply(blind);
+				return {
+					blind: Fn.toBytes(blind),
+					blinded: blindedPoint.toBytes(),
+					tweakedKey: tweakedKey.toBytes()
+				};
+			},
+			blindEvaluateBatch(secretKey, blinded, rng = randomBytes) {
+				if (!Array.isArray(blinded)) throw new Error("expected array");
+				const skS = Fn.fromBytes(secretKey);
+				const t = Fn.add(skS, m);
+				const invT = Fn.inv(t);
+				const blindedPoints = blinded.map((i) => wirePoint("blinded", i));
+				const evalPoints = blindedPoints.map((i) => i.multiply(invT));
+				const proof = generateProof(ctxPOPRF, t, Point.BASE.multiply(t), evalPoints, blindedPoints, rng);
+				return {
+					evaluated: evalPoints.map((i) => i.toBytes()),
+					proof
+				};
+			},
+			blindEvaluate(secretKey, blinded, rng = randomBytes) {
+				const res = this.blindEvaluateBatch(secretKey, [blinded], rng);
+				return {
+					evaluated: res.evaluated[0],
+					proof: res.proof
+				};
+			},
+			finalizeBatch(items, proof, tweakedKey) {
+				if (!Array.isArray(items)) throw new Error("expected array");
+				const inputs = items.map((i) => inputBytes("input", i.input));
+				const evalPoints = items.map((i) => wirePoint("evaluated", i.evaluated));
+				verifyProof(ctxPOPRF, wirePoint("tweakedKey", tweakedKey), evalPoints, items.map((i) => wirePoint("blinded", i.blinded)), proof);
+				return items.map((i, j) => {
+					const blind = Fn.fromBytes(i.blind);
+					const point = evalPoints[j].multiply(Fn.inv(blind)).toBytes();
+					return hashInput(inputs[j], info, point);
+				});
+			},
+			finalize(input, blind, evaluated, blinded, proof, tweakedKey) {
+				return this.finalizeBatch([{
+					input,
+					blind,
+					evaluated,
+					blinded
+				}], proof, tweakedKey)[0];
+			},
+			evaluate(secretKey, input) {
+				input = inputBytes("input", input);
+				const skS = Fn.fromBytes(secretKey);
+				const inputPoint = hashToGroup(input, ctxPOPRF);
+				if (inputPoint.equals(Point.ZERO)) throw new Error("Input point at infinity");
+				const t = Fn.add(skS, m);
+				const invT = Fn.inv(t);
+				const unblinded = inputPoint.multiply(invT).toBytes();
+				return hashInput(input, info, unblinded);
+			}
+		});
+	};
+	const res = {
+		name,
+		oprf,
+		voprf,
+		poprf,
+		__tests: Object.freeze({ Fn })
+	};
+	return Object.freeze(res);
+}
+//#endregion
+//#region ../../packages/module/passport-account/node_modules/@noble/curves/ed25519.js
+/**
+* ed25519 Twisted Edwards curve with following addons:
+* - X25519 ECDH
+* - Ristretto cofactor elimination
+* - Elligator hash-to-group / point indistinguishability
+* @module
+*/
+/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
+const _0n = /* @__PURE__ */ BigInt(0), _1n = /* @__PURE__ */ BigInt(1), _2n = /* @__PURE__ */ BigInt(2), _3n = /* @__PURE__ */ BigInt(3);
+const _5n = /* @__PURE__ */ BigInt(5), _8n = /* @__PURE__ */ BigInt(8);
+const ed25519_CURVE_p = /* @__PURE__ */ BigInt("0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffed");
+const ed25519_CURVE = {
+	p: ed25519_CURVE_p,
+	n: BigInt("0x1000000000000000000000000000000014def9dea2f79cd65812631a5cf5d3ed"),
+	h: _8n,
+	a: BigInt("0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffec"),
+	d: BigInt("0x52036cee2b6ffe738cc740797779e89800700a4d4141d8ab75eb4dca135978a3"),
+	Gx: BigInt("0x216936d3cd6e53fec0a4e231fdd6dc5c692cc7609525a7b2c9562d608f25d51a"),
+	Gy: BigInt("0x6666666666666666666666666666666666666666666666666666666666666658")
+};
+function ed25519_pow_2_252_3(x) {
+	const _10n = BigInt(10), _20n = BigInt(20), _40n = BigInt(40), _80n = BigInt(80);
+	const P = ed25519_CURVE_p;
+	const b2 = x * x % P * x % P;
+	const b5 = pow2(pow2(b2, _2n, P) * b2 % P, _1n, P) * x % P;
+	const b10 = pow2(b5, _5n, P) * b5 % P;
+	const b20 = pow2(b10, _10n, P) * b10 % P;
+	const b40 = pow2(b20, _20n, P) * b20 % P;
+	const b80 = pow2(b40, _40n, P) * b40 % P;
+	return {
+		pow_p_5_8: pow2(pow2(pow2(pow2(b80, _80n, P) * b80 % P, _80n, P) * b80 % P, _10n, P) * b10 % P, _2n, P) * x % P,
+		b2
+	};
+}
+function adjustScalarBytes(bytes) {
+	bytes[0] &= 248;
+	bytes[31] &= 127;
+	bytes[31] |= 64;
+	return bytes;
+}
+const ED25519_SQRT_M1 = /* @__PURE__ */ BigInt("19681161376707505956807079304988542015446066515923890162744021073123829784752");
+function uvRatio(u, v) {
+	const P = ed25519_CURVE_p;
+	const v3 = mod(v * v * v, P);
+	const pow = ed25519_pow_2_252_3(u * mod(v3 * v3 * v, P)).pow_p_5_8;
+	let x = mod(u * v3 * pow, P);
+	const vx2 = mod(v * x * x, P);
+	const root1 = x;
+	const root2 = mod(x * ED25519_SQRT_M1, P);
+	const useRoot1 = vx2 === u;
+	const useRoot2 = vx2 === mod(-u, P);
+	const noRoot = vx2 === mod(-u * ED25519_SQRT_M1, P);
+	if (useRoot1) x = root1;
+	if (useRoot2 || noRoot) x = root2;
+	if (isNegativeLE(x, P)) x = mod(-x, P);
+	return {
+		isValid: useRoot1 || useRoot2,
+		value: x
+	};
+}
+const ed25519_Point = /* @__PURE__ */ edwards(ed25519_CURVE, { uvRatio });
+const Fp = ed25519_Point.Fp;
+const Fn = ed25519_Point.Fn;
+createFROST({
+	name: "FROST-ED25519-SHA512-v1",
+	Point: ed25519_Point,
+	validatePoint: (p) => {
+		p.assertValidity();
+		if (!p.isTorsionFree()) throw new Error("bad point: not torsion-free");
+	},
+	hash: sha512,
+	H2: ""
+});
+/**
+* ECDH using curve25519 aka x25519.
+* `getSharedSecret()` rejects low-order peer inputs by default, and seeded
+* `keygen(seed)` reuses the provided 32-byte seed buffer instead of copying it.
+* @example
+* Derive one shared secret between two X25519 peers.
+*
+* ```js
+* import { x25519 } from '@noble/curves/ed25519.js';
+* const alice = x25519.keygen();
+* const bob = x25519.keygen();
+* const shared = x25519.getSharedSecret(alice.secretKey, bob.publicKey);
+* ```
+*/
+const x25519 = /* @__PURE__ */ (() => {
+	const P = ed25519_CURVE_p;
+	return montgomery({
+		P,
+		type: "x25519",
+		powPminus2: (x) => {
+			const { pow_p_5_8, b2 } = ed25519_pow_2_252_3(x);
+			return mod(pow2(pow_p_5_8, _3n, P) * b2, P);
+		},
+		adjustScalarBytes
+	});
+})();
+const ELL2_C1 = (ed25519_CURVE_p + _3n) / _8n;
+const ELL2_C2 = Fp.pow(_2n, ELL2_C1);
+const ELL2_C3 = Fp.sqrt(Fp.neg(Fp.ONE));
+/**
+* RFC 9380 method `map_to_curve_elligator2_curve25519`. Experimental name: may be renamed later.
+* @private
+*/
+function _map_to_curve_elligator2_curve25519(u) {
+	const ELL2_C4 = (ed25519_CURVE_p - _5n) / _8n;
+	const ELL2_J = BigInt(486662);
+	let tv1 = Fp.sqr(u);
+	tv1 = Fp.mul(tv1, _2n);
+	let xd = Fp.add(tv1, Fp.ONE);
+	let x1n = Fp.neg(ELL2_J);
+	let tv2 = Fp.sqr(xd);
+	let gxd = Fp.mul(tv2, xd);
+	let gx1 = Fp.mul(tv1, ELL2_J);
+	gx1 = Fp.mul(gx1, x1n);
+	gx1 = Fp.add(gx1, tv2);
+	gx1 = Fp.mul(gx1, x1n);
+	let tv3 = Fp.sqr(gxd);
+	tv2 = Fp.sqr(tv3);
+	tv3 = Fp.mul(tv3, gxd);
+	tv3 = Fp.mul(tv3, gx1);
+	tv2 = Fp.mul(tv2, tv3);
+	let y11 = Fp.pow(tv2, ELL2_C4);
+	y11 = Fp.mul(y11, tv3);
+	let y12 = Fp.mul(y11, ELL2_C3);
+	tv2 = Fp.sqr(y11);
+	tv2 = Fp.mul(tv2, gxd);
+	let e1 = Fp.eql(tv2, gx1);
+	let y1 = Fp.cmov(y12, y11, e1);
+	let x2n = Fp.mul(x1n, tv1);
+	let y21 = Fp.mul(y11, u);
+	y21 = Fp.mul(y21, ELL2_C2);
+	let y22 = Fp.mul(y21, ELL2_C3);
+	let gx2 = Fp.mul(gx1, tv1);
+	tv2 = Fp.sqr(y21);
+	tv2 = Fp.mul(tv2, gxd);
+	let e2 = Fp.eql(tv2, gx2);
+	let y2 = Fp.cmov(y22, y21, e2);
+	tv2 = Fp.sqr(y1);
+	tv2 = Fp.mul(tv2, gxd);
+	let e3 = Fp.eql(tv2, gx1);
+	let xn = Fp.cmov(x2n, x1n, e3);
+	let y = Fp.cmov(y2, y1, e3);
+	let e4 = Fp.isOdd(y);
+	y = Fp.cmov(y, Fp.neg(y), e3 !== e4);
+	return {
+		xMn: xn,
+		xMd: xd,
+		yMn: y,
+		yMd: _1n
+	};
+}
+const ELL2_C1_EDWARDS = FpSqrtEven(Fp, Fp.neg(BigInt(486664)));
+function map_to_curve_elligator2_edwards25519(u) {
+	const { xMn, xMd, yMn, yMd } = _map_to_curve_elligator2_curve25519(u);
+	let xn = Fp.mul(xMn, yMd);
+	xn = Fp.mul(xn, ELL2_C1_EDWARDS);
+	let xd = Fp.mul(xMd, yMn);
+	let yn = Fp.sub(xMn, xMd);
+	let yd = Fp.add(xMn, xMd);
+	let tv1 = Fp.mul(xd, yd);
+	let e = Fp.eql(tv1, Fp.ZERO);
+	xn = Fp.cmov(xn, Fp.ZERO, e);
+	xd = Fp.cmov(xd, Fp.ONE, e);
+	yn = Fp.cmov(yn, Fp.ONE, e);
+	yd = Fp.cmov(yd, Fp.ONE, e);
+	const [xd_inv, yd_inv] = FpInvertBatch(Fp, [xd, yd], true);
+	return {
+		x: Fp.mul(xn, xd_inv),
+		y: Fp.mul(yn, yd_inv)
+	};
+}
+createHasher(ed25519_Point, (scalars) => map_to_curve_elligator2_edwards25519(scalars[0]), {
+	DST: "edwards25519_XMD:SHA-512_ELL2_RO_",
+	encodeDST: "edwards25519_XMD:SHA-512_ELL2_NU_",
+	p: ed25519_CURVE_p,
+	m: 1,
+	k: 128,
+	expand: "xmd",
+	hash: sha512
+});
+const SQRT_M1 = ED25519_SQRT_M1;
+const SQRT_AD_MINUS_ONE = /* @__PURE__ */ BigInt("25063068953384623474111414158702152701244531502492656460079210482610430750235");
+const INVSQRT_A_MINUS_D = /* @__PURE__ */ BigInt("54469307008909316920995813868745141605393597292927456921205312896311721017578");
+const ONE_MINUS_D_SQ = /* @__PURE__ */ BigInt("1159843021668779879193775521855586647937357759715417654439879720876111806838");
+const D_MINUS_ONE_SQ = /* @__PURE__ */ BigInt("40440834346308536858101042469323190826248399146238708352240133220865137265952");
+const invertSqrt = (number) => uvRatio(_1n, number);
+const MAX_255B = /* @__PURE__ */ BigInt("0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
+const bytes255ToNumberLE = (bytes) => Fp.create(bytesToNumberLE(bytes) & MAX_255B);
+/**
+* Computes Elligator map for Ristretto255.
+* Primary formula source is RFC 9496 §4.3.4 MAP; RFC 9380 Appendix B builds
+* `hash_to_ristretto255` on top of this helper.
+* Returns an internal Edwards representative, not a public `_RistrettoPoint`.
+*/
+function calcElligatorRistrettoMap(r0) {
+	const { d } = ed25519_CURVE;
+	const P = ed25519_CURVE_p;
+	const mod = (n) => Fp.create(n);
+	const r = mod(SQRT_M1 * r0 * r0);
+	const Ns = mod((r + _1n) * ONE_MINUS_D_SQ);
+	let c = BigInt(-1);
+	const D = mod((c - d * r) * mod(r + d));
+	let { isValid: Ns_D_is_sq, value: s } = uvRatio(Ns, D);
+	let s_ = mod(s * r0);
+	if (!isNegativeLE(s_, P)) s_ = mod(-s_);
+	if (!Ns_D_is_sq) s = s_;
+	if (!Ns_D_is_sq) c = r;
+	const Nt = mod(c * (r - _1n) * D_MINUS_ONE_SQ - D);
+	const s2 = s * s;
+	const W0 = mod((s + s) * D);
+	const W1 = mod(Nt * SQRT_AD_MINUS_ONE);
+	const W2 = mod(_1n - s2);
+	const W3 = mod(_1n + s2);
+	return new ed25519_Point(mod(W0 * W3), mod(W2 * W1), mod(W1 * W3), mod(W0 * W2));
+}
+/**
+* Wrapper over Edwards Point for ristretto255.
+*
+* Each ed25519/EdwardsPoint has 8 different equivalent points. This can be
+* a source of bugs for protocols like ring signatures. Ristretto was created to solve this.
+* Ristretto point operates in X:Y:Z:T extended coordinates like EdwardsPoint,
+* but it should work in its own namespace: do not combine those two.
+* See [RFC9496](https://www.rfc-editor.org/rfc/rfc9496).
+*/
+var _RistrettoPoint = class _RistrettoPoint extends PrimeEdwardsPoint {
+	static BASE = new _RistrettoPoint(ed25519_Point.BASE);
+	static ZERO = new _RistrettoPoint(ed25519_Point.ZERO);
+	static Fp = Fp;
+	static Fn = Fn;
+	constructor(ep) {
+		super(ep);
+	}
+	/**
+	* Create one Ristretto255 point from affine Edwards coordinates.
+	* This wraps the internal Edwards representative directly and is not a
+	* canonical ristretto255 decoding path.
+	* Use `toBytes()` / `fromBytes()` if canonical ristretto255 bytes matter.
+	*/
+	static fromAffine(ap) {
+		return new _RistrettoPoint(ed25519_Point.fromAffine(ap));
+	}
+	assertSame(other) {
+		if (!(other instanceof _RistrettoPoint)) throw new Error("RistrettoPoint expected");
+	}
+	init(ep) {
+		return new _RistrettoPoint(ep);
+	}
+	static fromBytes(bytes) {
+		abytes$1(bytes, 32);
+		const { a, d } = ed25519_CURVE;
+		const P = ed25519_CURVE_p;
+		const mod = (n) => Fp.create(n);
+		const s = bytes255ToNumberLE(bytes);
+		if (!equalBytes$1(Fp.toBytes(s), bytes) || isNegativeLE(s, P)) throw new Error("invalid ristretto255 encoding 1");
+		const s2 = mod(s * s);
+		const u1 = mod(_1n + a * s2);
+		const u2 = mod(_1n - a * s2);
+		const u1_2 = mod(u1 * u1);
+		const u2_2 = mod(u2 * u2);
+		const v = mod(a * d * u1_2 - u2_2);
+		const { isValid, value: I } = invertSqrt(mod(v * u2_2));
+		const Dx = mod(I * u2);
+		const Dy = mod(I * Dx * v);
+		let x = mod((s + s) * Dx);
+		if (isNegativeLE(x, P)) x = mod(-x);
+		const y = mod(u1 * Dy);
+		const t = mod(x * y);
+		if (!isValid || isNegativeLE(t, P) || y === _0n) throw new Error("invalid ristretto255 encoding 2");
+		return new _RistrettoPoint(new ed25519_Point(x, y, _1n, t));
+	}
+	/**
+	* Converts ristretto-encoded string to ristretto point.
+	* Described in [RFC9496](https://www.rfc-editor.org/rfc/rfc9496#name-decode).
+	* @param hex - Ristretto-encoded 32 bytes. Not every 32-byte string is valid ristretto encoding
+	*/
+	static fromHex(hex) {
+		return _RistrettoPoint.fromBytes(hexToBytes$1(hex));
+	}
+	/**
+	* Encodes ristretto point to Uint8Array.
+	* Described in [RFC9496](https://www.rfc-editor.org/rfc/rfc9496#name-encode).
+	*/
+	toBytes() {
+		let { X, Y, Z, T } = this.ep;
+		const P = ed25519_CURVE_p;
+		const mod = (n) => Fp.create(n);
+		const u1 = mod(mod(Z + Y) * mod(Z - Y));
+		const u2 = mod(X * Y);
+		const { value: invsqrt } = invertSqrt(mod(u1 * mod(u2 * u2)));
+		const D1 = mod(invsqrt * u1);
+		const D2 = mod(invsqrt * u2);
+		const zInv = mod(D1 * D2 * T);
+		let D;
+		if (isNegativeLE(T * zInv, P)) {
+			let _x = mod(Y * SQRT_M1);
+			let _y = mod(X * SQRT_M1);
+			X = _x;
+			Y = _y;
+			D = mod(D1 * INVSQRT_A_MINUS_D);
+		} else D = D2;
+		if (isNegativeLE(X * zInv, P)) Y = mod(-Y);
+		let s = mod((Z - Y) * D);
+		if (isNegativeLE(s, P)) s = mod(-s);
+		return Fp.toBytes(s);
+	}
+	/**
+	* Compares two Ristretto points.
+	* Described in [RFC9496](https://www.rfc-editor.org/rfc/rfc9496#name-equals).
+	*/
+	equals(other) {
+		this.assertSame(other);
+		const { X: X1, Y: Y1 } = this.ep;
+		const { X: X2, Y: Y2 } = other.ep;
+		const mod = (n) => Fp.create(n);
+		const one = mod(X1 * Y2) === mod(Y1 * X2);
+		const two = mod(Y1 * Y2) === mod(X1 * X2);
+		return one || two;
+	}
+	is0() {
+		return this.equals(_RistrettoPoint.ZERO);
+	}
+};
+Object.freeze(_RistrettoPoint.BASE);
+Object.freeze(_RistrettoPoint.ZERO);
+Object.freeze(_RistrettoPoint.prototype);
+Object.freeze(_RistrettoPoint);
+/**
+* Hashing to ristretto255 points / field. RFC 9380 methods.
+* `hashToCurve()` is RFC 9380 Appendix B, `deriveToCurve()` is the RFC 9496
+* §4.3.4 element-derivation building block, and `hashToScalar()` is a
+* library-specific helper for OPRF-style use.
+* @example
+* Hash one message onto ristretto255.
+*
+* ```ts
+* const point = ristretto255_hasher.hashToCurve(new TextEncoder().encode('hello noble'));
+* ```
+*/
+const ristretto255_hasher = Object.freeze({
+	Point: _RistrettoPoint,
+	hashToCurve(msg, options) {
+		const xmd = expand_message_xmd(msg, options?.DST === void 0 ? "ristretto255_XMD:SHA-512_R255MAP_RO_" : options.DST, 64, sha512);
+		return ristretto255_hasher.deriveToCurve(xmd);
+	},
+	hashToScalar(msg, options = { DST: _DST_scalar }) {
+		const xmd = expand_message_xmd(msg, options.DST, 64, sha512);
+		return Fn.create(bytesToNumberLE(xmd));
+	},
+	deriveToCurve(bytes) {
+		abytes$1(bytes, 64);
+		const R1 = calcElligatorRistrettoMap(bytes255ToNumberLE(bytes.subarray(0, 32)));
+		const R2 = calcElligatorRistrettoMap(bytes255ToNumberLE(bytes.subarray(32, 64)));
+		return new _RistrettoPoint(R1.add(R2));
+	}
+});
+createOPRF({
+	name: "ristretto255-SHA512",
+	Point: _RistrettoPoint,
+	hash: sha512,
+	hashToGroup: ristretto255_hasher.hashToCurve,
+	hashToScalar: ristretto255_hasher.hashToScalar
+});
+createFROST({
+	name: "FROST-RISTRETTO255-SHA512-v1",
+	Point: _RistrettoPoint,
+	validatePoint: (p) => {
+		p.assertValidity();
+	},
+	hash: sha512
+});
+/**
+* The most inbox entries one open-inbox request carries, held by the
+* client that batches and the signer that answers alike: a busy inbox is
+* opened over several requests, so no single request holds the signer
+* decrypting without bound.
+*/
+const MAX_INBOX_ENTRIES_PER_REQUEST = 4096;
+const ENTRY_VERSION = 1;
+const ENTRY_SUITE = 1;
+const EPHEMERAL_KEY_OFFSET$1 = 2;
+const NONCE_OFFSET$1 = 34;
+const TAG_OFFSET$1 = 46;
+const CIPHERTEXT_OFFSET$1 = 62;
+const NONCE_LENGTH$2 = 12;
+const TAG_LENGTH$2 = 16;
+const KEY_LENGTH$2 = 32;
+const COIN_NONCE_LENGTH = 32;
+const COLOR_LENGTH = 32;
+const VALUE_LENGTH = 16;
+const PLAINTEXT_LENGTH = COIN_NONCE_LENGTH + COLOR_LENGTH + VALUE_LENGTH;
+const AEAD_TAG_BITS$2 = TAG_LENGTH$2 * 8;
+const VALUE_MAX = (1n << BigInt(VALUE_LENGTH * 8)) - 1n;
+const BYTE_BITS$1 = 8n;
+const BYTE_MASK$1 = 255n;
+const WRAPPING_KEY_INFO = new TextEncoder().encode("midnight:custody:inbox:v1");
+/**
+* The AES-256-GCM key that wraps one entry: HKDF-SHA256 over the X25519
+* shared secret with an empty salt and the fixed inbox label, imported
+* non-extractable so the key bytes never exist outside the shared secret,
+* which is zeroed once the key is derived.
+*/
+const wrappingKey = async (shared) => {
+	try {
+		const material = await crypto.subtle.importKey("raw", shared, "HKDF", false, ["deriveKey"]);
+		return await crypto.subtle.deriveKey({
+			name: "HKDF",
+			hash: "SHA-256",
+			salt: new Uint8Array(0),
+			info: WRAPPING_KEY_INFO
+		}, material, {
+			name: "AES-GCM",
+			length: KEY_LENGTH$2 * 8
+		}, false, ["encrypt", "decrypt"]);
+	} finally {
+		shared.fill(0);
+	}
+};
+const encodeValue = (value) => {
+	const bytes = new Uint8Array(VALUE_LENGTH);
+	let remaining = value;
+	for (let index = VALUE_LENGTH - 1; index >= 0; index -= 1) {
+		bytes[index] = Number(remaining & BYTE_MASK$1);
+		remaining >>= BYTE_BITS$1;
+	}
+	return bytes;
+};
+const decodeValue = (bytes) => bytes.reduce((value, byte) => value << BYTE_BITS$1 | BigInt(byte), 0n);
+const encodeCoin = ({ nonce, color, value }) => {
+	if (nonce.length !== COIN_NONCE_LENGTH || color.length !== COLOR_LENGTH) throw new Error(`An inbox coin description needs a ${COIN_NONCE_LENGTH}-byte nonce and a ${COLOR_LENGTH}-byte colour.`);
+	if (value < 0n || value > VALUE_MAX) throw new Error(`An inbox coin value must fit an unsigned 128-bit integer, got ${value}.`);
+	const plaintext = new Uint8Array(PLAINTEXT_LENGTH);
+	plaintext.set(nonce, 0);
+	plaintext.set(color, COIN_NONCE_LENGTH);
+	plaintext.set(encodeValue(value), COIN_NONCE_LENGTH + COLOR_LENGTH);
+	return plaintext;
+};
+const decodeCoin = (plaintext) => ({
+	nonce: plaintext.slice(0, COIN_NONCE_LENGTH),
+	color: plaintext.slice(COIN_NONCE_LENGTH, COIN_NONCE_LENGTH + COLOR_LENGTH),
+	value: decodeValue(plaintext.slice(COIN_NONCE_LENGTH + COLOR_LENGTH))
+});
+/**
+* Seals a coin description towards an account as an InboxEntry v1: the
+* plaintext is the coin nonce, colour and big-endian 128-bit value, wrapped
+* under a key agreed between a fresh ephemeral X25519 key and the
+* account's `enc_key`, with the version and suite bytes as associated
+* data; the trailing padding stays zero. The ephemeral secret is zeroed
+* before this returns.
+*/
+const sealInboxEntry = async (encPublicKey, coin) => {
+	const plaintext = encodeCoin(coin);
+	const ephemeral = x25519.keygen();
+	const entry = new Uint8Array(192);
+	entry[0] = ENTRY_VERSION;
+	entry[1] = ENTRY_SUITE;
+	try {
+		const key = await wrappingKey(x25519.getSharedSecret(ephemeral.secretKey, encPublicKey));
+		const nonce = crypto.getRandomValues(new Uint8Array(NONCE_LENGTH$2));
+		const sealed = new Uint8Array(await crypto.subtle.encrypt({
+			name: "AES-GCM",
+			iv: nonce,
+			additionalData: entry.slice(0, EPHEMERAL_KEY_OFFSET$1),
+			tagLength: AEAD_TAG_BITS$2
+		}, key, plaintext));
+		entry.set(ephemeral.publicKey, EPHEMERAL_KEY_OFFSET$1);
+		entry.set(nonce, NONCE_OFFSET$1);
+		entry.set(sealed.subarray(PLAINTEXT_LENGTH), TAG_OFFSET$1);
+		entry.set(sealed.subarray(0, PLAINTEXT_LENGTH), CIPHERTEXT_OFFSET$1);
+		return entry;
+	} finally {
+		ephemeral.secretKey.fill(0);
+		plaintext.fill(0);
+	}
+};
+/**
+* Opens an InboxEntry v1 with the account encryption secret. Resolves the
+* coin the entry describes, or null for an entry the inbox walk must skip
+* rather than fail on: one of another length, version or suite, one
+* sealed towards another key, or one whose authentication fails. The
+* contract accepts any bytes from anyone, so a null is noise, not an
+* error.
+*/
+const openInboxEntry = async (encSecret, entry) => {
+	if (entry.length !== 192 || entry[0] !== ENTRY_VERSION || entry[1] !== ENTRY_SUITE) return null;
+	try {
+		const key = await wrappingKey(x25519.getSharedSecret(encSecret, entry.slice(EPHEMERAL_KEY_OFFSET$1, NONCE_OFFSET$1)));
+		const sealed = new Uint8Array(PLAINTEXT_LENGTH + TAG_LENGTH$2);
+		sealed.set(entry.slice(CIPHERTEXT_OFFSET$1, CIPHERTEXT_OFFSET$1 + PLAINTEXT_LENGTH), 0);
+		sealed.set(entry.slice(TAG_OFFSET$1, CIPHERTEXT_OFFSET$1), PLAINTEXT_LENGTH);
+		const plaintext = new Uint8Array(await crypto.subtle.decrypt({
+			name: "AES-GCM",
+			iv: entry.slice(NONCE_OFFSET$1, TAG_OFFSET$1),
+			additionalData: entry.slice(0, EPHEMERAL_KEY_OFFSET$1),
+			tagLength: AEAD_TAG_BITS$2
+		}, key, sealed));
+		try {
+			return decodeCoin(plaintext);
+		} finally {
+			plaintext.fill(0);
+		}
+	} catch {
+		return null;
+	}
+};
+const SEAL_VERSION = 1;
+const SEAL_SUITE = 1;
+const EPHEMERAL_KEY_OFFSET = 2;
+const NONCE_OFFSET = 34;
+const TAG_OFFSET = 46;
+const CIPHERTEXT_OFFSET = 62;
+const NONCE_LENGTH$1 = 12;
+const TAG_LENGTH$1 = 16;
+const KEY_LENGTH$1 = 32;
+const SECRET_LENGTH = 32;
+const AEAD_TAG_BITS$1 = TAG_LENGTH$1 * 8;
+const VIEW_KEY_INFO = new TextEncoder().encode("midnight:account:grant:view:v1");
+const concat$1 = (...parts) => {
+	const joined = new Uint8Array(parts.reduce((length, part) => length + part.length, 0));
+	let offset = 0;
+	for (const part of parts) {
+		joined.set(part, offset);
+		offset += part.length;
+	}
+	return joined;
+};
+/**
+* The AES-256-GCM key that wraps one seal: HKDF-SHA256 over the X25519
+* shared secret with an empty salt and the view label followed by the
+* grant id, imported non-extractable; the shared secret is zeroed once
+* the key is derived.
+*/
+const sealingKey = async (shared, grantId) => {
+	try {
+		const material = await crypto.subtle.importKey("raw", shared, "HKDF", false, ["deriveKey"]);
+		return await crypto.subtle.deriveKey({
+			name: "HKDF",
+			hash: "SHA-256",
+			salt: new Uint8Array(0),
+			info: concat$1(VIEW_KEY_INFO, grantId)
+		}, material, {
+			name: "AES-GCM",
+			length: KEY_LENGTH$1 * 8
+		}, false, ["encrypt"]);
+	} finally {
+		shared.fill(0);
+	}
+};
+/**
+* Seals an account encryption secret towards a grantee's read key as a
+* GrantViewSeal v1: the secret is wrapped under a key agreed between a
+* fresh ephemeral X25519 key and the read key and derived with the grant
+* id in its label, with the version, suite, ephemeral key, grant id and
+* account as associated data, so the container opens only for that read
+* key, under that grant and for that account. A read key of small order
+* yields an all-zero shared secret, which the key agreement refuses. The
+* ephemeral secret is zeroed before this returns; the account secret is
+* the caller's to zero.
+*/
+const sealGrantView = async (encSecret, { grantId, account, readPublicKey }) => {
+	if (encSecret.length !== SECRET_LENGTH) throw new Error(`A grant view seals a ${SECRET_LENGTH}-byte secret, got ${encSecret.length} bytes.`);
+	const grantIdBytes = ByteArray.fromHex(HexBytes(grantId));
+	const accountBytes = ByteArray.fromHex(HexBytes(account));
+	const readKey = ByteArray.fromHex(HexBytes(readPublicKey));
+	const ephemeral = x25519.keygen();
+	const seal = new Uint8Array(94);
+	seal[0] = SEAL_VERSION;
+	seal[1] = SEAL_SUITE;
+	seal.set(ephemeral.publicKey, EPHEMERAL_KEY_OFFSET);
+	try {
+		const key = await sealingKey(x25519.getSharedSecret(ephemeral.secretKey, readKey), grantIdBytes);
+		const nonce = crypto.getRandomValues(new Uint8Array(NONCE_LENGTH$1));
+		const sealed = new Uint8Array(await crypto.subtle.encrypt({
+			name: "AES-GCM",
+			iv: nonce,
+			additionalData: concat$1(seal.slice(0, NONCE_OFFSET), grantIdBytes, accountBytes),
+			tagLength: AEAD_TAG_BITS$1
+		}, key, encSecret));
+		seal.set(nonce, NONCE_OFFSET);
+		seal.set(sealed.subarray(SECRET_LENGTH), TAG_OFFSET);
+		seal.set(sealed.subarray(0, SECRET_LENGTH), CIPHERTEXT_OFFSET);
+		return seal;
+	} finally {
+		ephemeral.secretKey.fill(0);
+	}
+};
+//#endregion
+//#region ../../packages/module/passport-account/src/acc/envelopes.ts
+/**
+* The Lace record kinds an Account Custody Contract inbox carries beside
+* the coin entries senders write: device envelopes, which deliver the
+* account secret and the roster key to one device's reader key; device
+* registrations, which name an enrolled device's reader and device keys
+* under the roster key; and grant records, which keep the bookkeeping of
+* a grant this device issued under a key only it derives. Each is one
+* 192-byte entry led by a type byte no custody standard reader knows, so
+* every other reader skips it as noise, and each opens to null rather
+* than an error when it is malformed, tampered with or addressed to
+* someone else, since anyone may append any bytes to the inbox.
+*/
+/** Type byte of a device envelope. */
+const DEVICE_ENVELOPE_TYPE = 209;
+/** Type byte of a device registration. */
+const DEVICE_REGISTRATION_TYPE = 210;
+/** Type byte of a grant record. */
+const GRANT_RECORD_TYPE = 211;
+const SUITE = 2;
+const KEY_LENGTH = 32;
+const NONCE_LENGTH = 12;
+const TAG_LENGTH = 16;
+const RECIPIENT_TAG_LENGTH = 32;
+const AEAD_TAG_BITS = TAG_LENGTH * 8;
+const MAX_COIN_VALUE_LENGTH = 16;
+const BYTE_BITS = 8n;
+const BYTE_MASK = 255n;
+const RECIPIENT_TAG_OFFSET = 2;
+const RECIPIENT_TAG_END = RECIPIENT_TAG_OFFSET + RECIPIENT_TAG_LENGTH;
+const ENVELOPE_EPHEMERAL_OFFSET = RECIPIENT_TAG_END;
+const ENVELOPE_NONCE_OFFSET = ENVELOPE_EPHEMERAL_OFFSET + KEY_LENGTH;
+const ENVELOPE_PLAINTEXT_LENGTH = KEY_LENGTH * 2;
+const REGISTRATION_NONCE_OFFSET = 2;
+const REGISTRATION_PLAINTEXT_LENGTH = KEY_LENGTH * 2;
+const RECORD_NONCE_OFFSET = RECIPIENT_TAG_END;
+const RECORD_PLAINTEXT_LENGTH = 192 - (RECORD_NONCE_OFFSET + NONCE_LENGTH + TAG_LENGTH);
+const encoder = new TextEncoder();
+const ENVELOPE_TAG_DOMAIN = encoder.encode("lace:passport:envelope-tag:v2");
+const ENVELOPE_KEY_INFO = encoder.encode("lace:passport:device-envelope:v1");
+const REGISTRATION_KEY_INFO = encoder.encode("lace:passport:device-registration:v1");
+const RECORD_KEY_INFO = encoder.encode("lace:passport:grant-record:v1");
+const RECORD_TAG_KEY_INFO = encoder.encode("lace:passport:grant-record-tag:v1");
+/** The parts of a grant record, by the byte that leads its plaintext. */
+const RECORD_PARTS = [
+	"grant",
+	"object",
+	"view"
+];
+/**
+* A Jubjub device public key in the compressed 32-byte form a device
+* registration carries, as lowercase hex: the y coordinate little-endian
+* with the parity of x in its top bit.
+*/
+const encodeDevicePublicKey = (point) => HexBytes.fromByteArray(jubjub.Point.fromAffine(point).toBytes());
+/**
+* The affine Jubjub point a compressed device public key names, or
+* undefined for hex that is no point on the curve.
+*/
+const decodeDevicePublicKey = (hex) => {
+	try {
+		return jubjub.Point.fromBytes(ByteArray.fromHex(HexBytes(hex))).toAffine();
+	} catch {
+		return;
+	}
+};
+const concat = (...parts) => {
+	const joined = new Uint8Array(parts.reduce((length, part) => length + part.length, 0));
+	let offset = 0;
+	for (const part of parts) {
+		joined.set(part, offset);
+		offset += part.length;
+	}
+	return joined;
+};
+const isZero = (bytes) => bytes.every((byte) => byte === 0);
+const equalBytes = (left, right) => left.length === right.length && left.every((byte, index) => byte === right[index]);
+/** Whether an entry is a 192-byte record of the given type and suite. */
+const isRecordOf = (entry, type) => entry.length === 192 && entry[0] === type && entry[1] === SUITE;
+/**
+* Whether an inbox entry is one of the Lace record kinds, which a coin
+* walk passes over rather than counts as noise.
+*/
+const isLaceRecord = (entry) => isRecordOf(entry, DEVICE_ENVELOPE_TYPE) || isRecordOf(entry, DEVICE_REGISTRATION_TYPE) || isRecordOf(entry, GRANT_RECORD_TYPE);
+/** Whether an inbox entry is a device registration. */
+const isDeviceRegistration = (entry) => isRecordOf(entry, DEVICE_REGISTRATION_TYPE);
+/**
+* The HMAC-SHA256 key HKDF-SHA256 derives from `material` under `info`
+* with an empty salt, imported non-extractable, so the key bytes never
+* exist outside it.
+*/
+const hmacKey = async (material, info) => {
+	const key = await crypto.subtle.importKey("raw", material, "HKDF", false, ["deriveKey"]);
+	return crypto.subtle.deriveKey({
+		name: "HKDF",
+		hash: "SHA-256",
+		salt: new Uint8Array(0),
+		info
+	}, key, {
+		name: "HMAC",
+		hash: "SHA-256",
+		length: KEY_LENGTH * 8
+	}, false, ["sign"]);
+};
+/**
+* The AES-256-GCM key HKDF-SHA256 derives from `material` under `info`,
+* imported non-extractable, so the key bytes never exist outside it.
+*/
+const aeadKey = async (material, info) => {
+	const key = await crypto.subtle.importKey("raw", material, "HKDF", false, ["deriveKey"]);
+	return crypto.subtle.deriveKey({
+		name: "HKDF",
+		hash: "SHA-256",
+		salt: new Uint8Array(0),
+		info
+	}, key, {
+		name: "AES-GCM",
+		length: KEY_LENGTH * 8
+	}, false, ["encrypt", "decrypt"]);
+};
+/** A fresh AEAD nonce. */
+const freshNonce = () => crypto.getRandomValues(new Uint8Array(NONCE_LENGTH));
+/**
+* The associated data of an entry: every byte before its AEAD tag, less
+* the recipient tag when it carries one, since that tag is computed over
+* the sealed entry and binds it in turn.
+*/
+const associatedData = ({ entry, nonceOffset, isTagged }) => {
+	const tagOffset = nonceOffset + NONCE_LENGTH;
+	return isTagged ? concat(entry.subarray(0, RECIPIENT_TAG_OFFSET), entry.subarray(RECIPIENT_TAG_END, tagOffset)) : entry.slice(0, tagOffset);
+};
+/**
+* Encrypts `plaintext` into `entry` behind its header: the AEAD tag
+* after the nonce the entry already holds at `nonceOffset`, and the
+* ciphertext after that, with the header as associated data, see
+* {@link associatedData}, so the header must be complete before this
+* runs, its recipient tag aside.
+*/
+const sealInto = async ({ key, entry, nonceOffset, isTagged, plaintext }) => {
+	const nonce = entry.slice(nonceOffset, nonceOffset + NONCE_LENGTH);
+	const tagOffset = nonceOffset + NONCE_LENGTH;
+	const sealed = new Uint8Array(await crypto.subtle.encrypt({
+		name: "AES-GCM",
+		iv: nonce,
+		additionalData: associatedData({
+			entry,
+			nonceOffset,
+			isTagged
+		}),
+		tagLength: AEAD_TAG_BITS
+	}, key, plaintext));
+	entry.set(sealed.subarray(plaintext.length), tagOffset);
+	entry.set(sealed.subarray(0, plaintext.length), tagOffset + TAG_LENGTH);
+};
+/**
+* Decrypts the ciphertext behind an entry's header, or null when the
+* authentication fails or the padding after the ciphertext is not zero.
+*/
+const openFrom = async ({ key, entry, nonceOffset, isTagged, plaintextLength }) => {
+	const tagOffset = nonceOffset + NONCE_LENGTH;
+	const ciphertextOffset = tagOffset + TAG_LENGTH;
+	if (!isZero(entry.subarray(ciphertextOffset + plaintextLength))) return null;
+	try {
+		return new Uint8Array(await crypto.subtle.decrypt({
+			name: "AES-GCM",
+			iv: entry.slice(nonceOffset, tagOffset),
+			additionalData: associatedData({
+				entry,
+				nonceOffset,
+				isTagged
+			}),
+			tagLength: AEAD_TAG_BITS
+		}, key, concat(entry.subarray(ciphertextOffset, ciphertextOffset + plaintextLength), entry.subarray(tagOffset, ciphertextOffset))));
+	} catch {
+		return null;
+	}
+};
+/**
+* The recipient tag of a device envelope: SHA-256 over the tag domain,
+* the type and suite bytes, the reader public key and every byte after
+* the tag, the ephemeral key, the nonce, the AEAD tag, the ciphertext
+* and the padding. A reader finds its envelopes by recomputing it, so
+* an entry that copies a genuine envelope's tag with any other byte
+* changed is not taken for one, and writing an entry that is takes the
+* reader public key. Two envelopes to the same reader share nothing on
+* chain, since each carries its own ephemeral key.
+*/
+const envelopeTag = (readerPublicKey, entry) => sha256(concat(ENVELOPE_TAG_DOMAIN, entry.subarray(0, RECIPIENT_TAG_OFFSET), readerPublicKey, entry.subarray(RECIPIENT_TAG_END)));
+/** Whether an entry is a device envelope addressed to this reader public key. */
+const isAddressedTo = (entry, readerPublicKey) => isRecordOf(entry, DEVICE_ENVELOPE_TYPE) && equalBytes(entry.subarray(RECIPIENT_TAG_OFFSET, RECIPIENT_TAG_END), envelopeTag(readerPublicKey, entry));
+/**
+* Every envelope in an inbox addressed to this device, newest first: the
+* ones a keyring carries. Anyone who knows a reader key can append
+* envelopes tagged for it, so none is left out, and the live one is
+* found however many land after it, at the cost of opening each.
+*/
+const deviceEnvelopes = (entries, readerPublicKey) => entries.filter((entry) => isAddressedTo(entry, readerPublicKey)).reverse();
+/**
+* The AES-256-GCM key of one envelope: HKDF-SHA256 over the X25519 shared
+* secret, zeroed once the key is derived.
+*/
+const envelopeKey = async (shared) => {
+	try {
+		return await aeadKey(shared, ENVELOPE_KEY_INFO);
+	} finally {
+		shared.fill(0);
+	}
+};
+/**
+* Seals the account secret and the roster key to one device's reader key
+* as a device envelope: [0] type, [1] suite, [2..34) recipient tag,
+* [34..66) ephemeral X25519 public key, [66..78) nonce, [78..94) AEAD
+* tag, [94..158) the secret then the roster key, encrypted, and zero
+* padding to 192 bytes. The key is agreed between a fresh ephemeral key
+* and the reader key, everything before the AEAD tag but the recipient
+* tag is associated data, and the recipient tag, computed last, covers
+* the whole sealed envelope. The envelope carries no round or
+* `enc_key`: a reader trusts the secret only once it derives the
+* `enc_key` the ledger holds. The ephemeral secret is zeroed before this
+* returns.
+*/
+const sealDeviceEnvelope = async (readerPublicKey, { secret, rosterKey }) => {
+	const ephemeral = x25519.keygen();
+	const plaintext = concat(secret, rosterKey);
+	const entry = new Uint8Array(192);
+	entry[0] = DEVICE_ENVELOPE_TYPE;
+	entry[1] = SUITE;
+	entry.set(ephemeral.publicKey, ENVELOPE_EPHEMERAL_OFFSET);
+	entry.set(freshNonce(), ENVELOPE_NONCE_OFFSET);
+	try {
+		await sealInto({
+			key: await envelopeKey(x25519.getSharedSecret(ephemeral.secretKey, readerPublicKey)),
+			entry,
+			nonceOffset: ENVELOPE_NONCE_OFFSET,
+			isTagged: true,
+			plaintext
+		});
+		entry.set(envelopeTag(readerPublicKey, entry), RECIPIENT_TAG_OFFSET);
+		return entry;
+	} finally {
+		ephemeral.secretKey.fill(0);
+		plaintext.fill(0);
+	}
+};
+/**
+* Opens a device envelope with this device's reader secret. Resolves the
+* account secret and roster key it delivers, which the caller zeroes once
+* used, or null for an entry that is not an envelope, is addressed to
+* another reader or fails to authenticate.
+*/
+const openDeviceEnvelope = async (readerSecret, entry) => {
+	if (!isAddressedTo(entry, x25519.getPublicKey(readerSecret))) return null;
+	let key;
+	try {
+		key = await envelopeKey(x25519.getSharedSecret(readerSecret, entry.slice(ENVELOPE_EPHEMERAL_OFFSET, ENVELOPE_NONCE_OFFSET)));
+	} catch {
+		return null;
+	}
+	const plaintext = await openFrom({
+		key,
+		entry,
+		nonceOffset: ENVELOPE_NONCE_OFFSET,
+		isTagged: true,
+		plaintextLength: ENVELOPE_PLAINTEXT_LENGTH
+	});
+	if (!plaintext) return null;
+	try {
+		return {
+			secret: plaintext.slice(0, KEY_LENGTH),
+			rosterKey: plaintext.slice(KEY_LENGTH)
+		};
+	} finally {
+		plaintext.fill(0);
+	}
+};
+/**
+* Seals one enrolled device's reader and device keys under the roster key
+* as a device registration: [0] type, [1] suite, [2..14) nonce, [14..30)
+* AEAD tag, [30..94) the reader key then the device key, encrypted, and
+* zero padding to 192 bytes. Only a holder of the roster key, an enrolled
+* device, can write one that opens, and nothing on chain tells whose it
+* is.
+*/
+const sealDeviceRegistration = async (rosterKey, { readerPublicKey, devicePublicKey }) => {
+	const entry = new Uint8Array(192);
+	entry[0] = DEVICE_REGISTRATION_TYPE;
+	entry[1] = SUITE;
+	entry.set(freshNonce(), REGISTRATION_NONCE_OFFSET);
+	await sealInto({
+		key: await aeadKey(rosterKey, REGISTRATION_KEY_INFO),
+		entry,
+		nonceOffset: REGISTRATION_NONCE_OFFSET,
+		isTagged: false,
+		plaintext: concat(ByteArray.fromHex(HexBytes(readerPublicKey)), ByteArray.fromHex(HexBytes(devicePublicKey)))
+	});
+	return entry;
+};
+/**
+* Opens a device registration with the roster key: the device it names,
+* or null for an entry that is not a registration or was written under
+* another roster key.
+*/
+const openDeviceRegistration = async (rosterKey, entry) => {
+	if (!isRecordOf(entry, DEVICE_REGISTRATION_TYPE)) return null;
+	const plaintext = await openFrom({
+		key: await aeadKey(rosterKey, REGISTRATION_KEY_INFO),
+		entry,
+		nonceOffset: REGISTRATION_NONCE_OFFSET,
+		isTagged: false,
+		plaintextLength: REGISTRATION_PLAINTEXT_LENGTH
+	});
+	return plaintext && {
+		readerPublicKey: HexBytes.fromByteArray(plaintext.slice(0, KEY_LENGTH)),
+		devicePublicKey: HexBytes.fromByteArray(plaintext.slice(KEY_LENGTH))
+	};
+};
+/**
+* The keys of this device's grant records on one account, both derived
+* from its reader secret with the account address in the label: the
+* AES-256-GCM key and the key its recipient tags are computed under, so
+* only this device writes a record that opens or recognises one as its
+* own, and a record copied from another account is neither.
+*/
+const recordKeys = async (readerSecret, account) => {
+	const accountBytes = ByteArray.fromHex(HexBytes(account));
+	return {
+		key: await aeadKey(readerSecret, concat(RECORD_KEY_INFO, accountBytes)),
+		tagKey: await hmacKey(readerSecret, concat(RECORD_TAG_KEY_INFO, accountBytes))
+	};
+};
+/**
+* The recipient tag of a grant record: HMAC-SHA256 under the tag key
+* over the type and suite bytes and every byte after the tag, the
+* nonce, the AEAD tag and the ciphertext, so a copied tag with any other
+* byte changed is not taken for this device's.
+*/
+const recordTag = async (tagKey, entry) => new Uint8Array(await crypto.subtle.sign("HMAC", tagKey, concat(entry.subarray(0, RECIPIENT_TAG_OFFSET), entry.subarray(RECIPIENT_TAG_END))));
+const encodeAmount = (value) => {
+	const bytes = new Uint8Array(MAX_COIN_VALUE_LENGTH);
+	let remaining = BigInt(value);
+	for (let index = MAX_COIN_VALUE_LENGTH - 1; index >= 0; index -= 1) {
+		bytes[index] = Number(remaining & BYTE_MASK);
+		remaining >>= BYTE_BITS;
+	}
+	return bytes;
+};
+const decodeAmount = (bytes) => bytes.reduce((value, byte) => value << BYTE_BITS | BigInt(byte), 0n).toString();
+const hexBytes = (hex) => ByteArray.fromHex(HexBytes(hex));
+const encodeRecipient = (recipient) => concat(Uint8Array.of(Number(RECIPIENT_KINDS[recipient.kind])), recipient.kind === "any" ? new Uint8Array(KEY_LENGTH) : hexBytes(recipient.value));
+const RECIPIENT_BY_KIND = new Map(Object.entries(RECIPIENT_KINDS).map(([kind, value]) => [Number(value), kind]));
+const decodeRecipient = (bytes) => {
+	const kind = RECIPIENT_BY_KIND.get(bytes[0]);
+	const value = bytes.subarray(1);
+	if (kind === void 0) return null;
+	if (kind === "any") return isZero(value) ? { kind } : null;
+	return {
+		kind,
+		value: HexBytes.fromByteArray(value)
+	};
+};
+/**
+* The plaintext of one grant record part, 130 bytes: the part byte and
+* the grant id, then for a grant the slot, the scope salt, the grantee
+* key and the read key (zero for none); for an object the colour, the
+* recipient kind and value, and the coin bound as a big-endian 128-bit
+* integer; for a view the leading bytes of `enc_key` and the 94-byte
+* seal; zero padding after.
+*/
+const encodeRecordPart = (part) => {
+	const plaintext = new Uint8Array(RECORD_PLAINTEXT_LENGTH);
+	plaintext[0] = RECORD_PARTS.indexOf(part.part);
+	plaintext.set(hexBytes(part.grantId), 1);
+	const body = 1 + KEY_LENGTH;
+	switch (part.part) {
+		case "grant":
+			plaintext[body] = part.slot;
+			plaintext.set(hexBytes(part.scopeSalt), body + 1);
+			plaintext.set(hexBytes(part.granteePublicKey), body + 1 + KEY_LENGTH);
+			if (part.readPublicKey !== void 0) plaintext.set(hexBytes(part.readPublicKey), body + 1 + KEY_LENGTH * 2);
+			return plaintext;
+		case "object":
+			plaintext.set(hexBytes(part.object.color), body);
+			plaintext.set(encodeRecipient(part.object.recipient), body + KEY_LENGTH);
+			plaintext.set(encodeAmount(part.object.maxCoinValue), body + KEY_LENGTH * 2 + 1);
+			return plaintext;
+		case "view":
+			plaintext.set(hexBytes(part.encKeyPrefix), body);
+			plaintext.set(hexBytes(part.seal), body + 3);
+			return plaintext;
+	}
+};
+const decodeObject = (body) => {
+	const recipient = decodeRecipient(body.subarray(KEY_LENGTH, KEY_LENGTH * 2 + 1));
+	const amountOffset = KEY_LENGTH * 2 + 1;
+	if (!recipient || !isZero(body.subarray(amountOffset + MAX_COIN_VALUE_LENGTH))) return null;
+	return {
+		color: HexBytes.fromByteArray(body.subarray(0, KEY_LENGTH)),
+		recipient,
+		maxCoinValue: decodeAmount(body.subarray(amountOffset, amountOffset + MAX_COIN_VALUE_LENGTH))
+	};
+};
+/** Reads a grant record part back, or null for a plaintext no writer produces. */
+const decodeRecordPart = (plaintext) => {
+	const part = RECORD_PARTS[plaintext[0]];
+	const grantId = GrantId(HexBytes.fromByteArray(plaintext.slice(1, 33)));
+	const body = plaintext.subarray(1 + KEY_LENGTH);
+	switch (part) {
+		case "grant": {
+			const readKey = body.subarray(1 + KEY_LENGTH * 2);
+			return {
+				part,
+				grantId,
+				slot: GrantSlot(body[0]),
+				scopeSalt: GrantScopeSalt(HexBytes.fromByteArray(body.subarray(1, 1 + KEY_LENGTH))),
+				granteePublicKey: HexBytes.fromByteArray(body.subarray(1 + KEY_LENGTH, 1 + KEY_LENGTH * 2)),
+				...isZero(readKey) ? {} : { readPublicKey: HexBytes.fromByteArray(readKey) }
+			};
+		}
+		case "object": {
+			const object = decodeObject(body);
+			return object && {
+				part,
+				grantId,
+				object
+			};
+		}
+		case "view": return {
+			part,
+			grantId,
+			encKeyPrefix: HexBytes.fromByteArray(body.subarray(0, 3)),
+			seal: HexBytes.fromByteArray(body.subarray(3, 97))
+		};
+		default: return null;
+	}
+};
+/**
+* Seals one part of a grant's bookkeeping for this device alone as a
+* grant record: [0] type, [1] suite, [2..34) recipient tag, [34..46)
+* nonce, [46..62) AEAD tag, [62..192) the 130-byte part, encrypted, with
+* everything before the AEAD tag but the recipient tag as associated
+* data. The key and the tag key are derived from this device's reader
+* secret and the account, so only this device writes a record that opens
+* and recognises its own on that account, and the tag, computed last
+* over the whole sealed record and its fresh nonce, links no two
+* records.
+*/
+const sealGrantRecord = async (readerSecret, account, part) => {
+	const { key, tagKey } = await recordKeys(readerSecret, account);
+	const plaintext = encodeRecordPart(part);
+	const entry = new Uint8Array(192);
+	entry[0] = GRANT_RECORD_TYPE;
+	entry[1] = SUITE;
+	entry.set(freshNonce(), RECORD_NONCE_OFFSET);
+	try {
+		await sealInto({
+			key,
+			entry,
+			nonceOffset: RECORD_NONCE_OFFSET,
+			isTagged: true,
+			plaintext
+		});
+		entry.set(await recordTag(tagKey, entry), RECIPIENT_TAG_OFFSET);
+		return entry;
+	} finally {
+		plaintext.fill(0);
+	}
+};
+/**
+* Opens a grant record of one account with this device's reader secret:
+* the part it holds, or null for an entry that is not a grant record,
+* carries another device's or another account's tag, fails to
+* authenticate or decodes to no part.
+*/
+const openGrantRecord = async (readerSecret, account, entry) => {
+	if (!isRecordOf(entry, GRANT_RECORD_TYPE)) return null;
+	const { key, tagKey } = await recordKeys(readerSecret, account);
+	if (!equalBytes(await recordTag(tagKey, entry), entry.subarray(RECIPIENT_TAG_OFFSET, RECIPIENT_TAG_END))) return null;
+	const plaintext = await openFrom({
+		key,
+		entry,
+		nonceOffset: RECORD_NONCE_OFFSET,
+		isTagged: true,
+		plaintextLength: RECORD_PLAINTEXT_LENGTH
+	});
+	if (!plaintext) return null;
+	try {
+		return decodeRecordPart(plaintext);
+	} catch {
+		return null;
+	} finally {
+		plaintext.fill(0);
+	}
+};
+//#endregion
+export { x25519 as _, isDeviceRegistration as a, validateGrantScope as b, openDeviceRegistration as c, sealDeviceRegistration as d, sealGrantRecord as f, sealInboxEntry as g, openInboxEntry as h, isAddressedTo as i, openGrantRecord as l, MAX_INBOX_ENTRIES_PER_REQUEST as m, deviceEnvelopes as n, isLaceRecord as o, sealGrantView as p, encodeDevicePublicKey as r, openDeviceEnvelope as s, decodeDevicePublicKey as t, sealDeviceEnvelope as u, MAX_GRANTS as v, isSealableX25519Key as y };