@laceio/sdk 0.1.1-canary.2 → 0.1.1

package/dist/envelopes-BkH1Qdxk.js

@@ -1,1620 +0,0 @@
-import { n as HexBytes, t as ByteArray } from "./bytes.vo-BB7_4JK6.js";
-import { A as equalBytes$1, C as aInRange, D as bytesToNumberLE, E as bytesToNumberBE, F as sha512, G as GrantScopeSalt, I as abytes$1, K as GrantId, L as hexToBytes, M as numberToBytesLE, N as randomBytes, O as concatBytes, P as validateObject, S as pow2, T as asciiToBytes, W as GrantSlot, _ as FpSqrtEven, b as mapHashToField, c as _DST_scalar, d as PrimeEdwardsPoint, f as edwards, g as FpInvertBatch, h as validatePointCons, j as numberToBytesBE, k as copyBytes, l as createHasher, m as pippenger, o as jubjub, p as createKeygen, q as sha256, s as createFROST, t as RECIPIENT_KINDS, u as expand_message_xmd, v as getMinHashLength, w as abytes, x as mod, y as isNegativeLE } from "./grant-rules-_xJHAT2M.js";
-//#region ../../packages/module/passport-account/node_modules/@noble/curves/abstract/montgomery.js
-/**
-* Montgomery curve methods. It's not really whole montgomery curve,
-* just bunch of very specific methods for X25519 / X448 from
-* [RFC 7748](https://www.rfc-editor.org/rfc/rfc7748)
-* @module
-*/
-/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
-const _0n$1 = BigInt(0);
-const _1n$1 = BigInt(1);
-const _2n$1 = BigInt(2);
-function validateOpts(curve) {
-	validateObject(curve, {
-		P: "bigint",
-		type: "string",
-		adjustScalarBytes: "function",
-		powPminus2: "function"
-	}, { randomBytes: "function" });
-	return Object.freeze({ ...curve });
-}
-/**
-* @param curveDef - Montgomery curve definition.
-* @returns ECDH helper namespace.
-* @throws If the curve definition or derived shared point is invalid. {@link Error}
-* @example
-* Perform one X25519 key exchange through the generic Montgomery helper.
-*
-* ```ts
-* import { x25519 } from '@noble/curves/ed25519.js';
-* const alice = x25519.keygen();
-* const shared = x25519.getSharedSecret(alice.secretKey, alice.publicKey);
-* ```
-*/
-function montgomery(curveDef) {
-	const { P, type, adjustScalarBytes, powPminus2, randomBytes: rand } = validateOpts(curveDef);
-	const is25519 = type === "x25519";
-	if (!is25519 && type !== "x448") throw new Error("invalid type");
-	const randomBytes_ = rand === void 0 ? randomBytes : rand;
-	const montgomeryBits = is25519 ? 255 : 448;
-	const fieldLen = is25519 ? 32 : 56;
-	const Gu = is25519 ? BigInt(9) : BigInt(5);
-	const a24 = is25519 ? BigInt(121665) : BigInt(39081);
-	const minScalar = is25519 ? _2n$1 ** BigInt(254) : _2n$1 ** BigInt(447);
-	const maxScalar = minScalar + (is25519 ? BigInt(8) * _2n$1 ** BigInt(251) - _1n$1 : BigInt(4) * _2n$1 ** BigInt(445) - _1n$1) + _1n$1;
-	const modP = (n) => mod(n, P);
-	const GuBytes = encodeU(Gu);
-	function encodeU(u) {
-		return numberToBytesLE(modP(u), fieldLen);
-	}
-	function decodeU(u) {
-		const _u = copyBytes(abytes(u, fieldLen, "uCoordinate"));
-		if (is25519) _u[31] &= 127;
-		return modP(bytesToNumberLE(_u));
-	}
-	function decodeScalar(scalar) {
-		return bytesToNumberLE(adjustScalarBytes(copyBytes(abytes(scalar, fieldLen, "scalar"))));
-	}
-	function scalarMult(scalar, u) {
-		const pu = montgomeryLadder(decodeU(u), decodeScalar(scalar));
-		if (pu === _0n$1) throw new Error("invalid private or public key received");
-		return encodeU(pu);
-	}
-	function scalarMultBase(scalar) {
-		return scalarMult(scalar, GuBytes);
-	}
-	const getPublicKey = scalarMultBase;
-	const getSharedSecret = scalarMult;
-	function cswap(swap, x_2, x_3) {
-		const dummy = modP(swap * (x_2 - x_3));
-		x_2 = modP(x_2 - dummy);
-		x_3 = modP(x_3 + dummy);
-		return {
-			x_2,
-			x_3
-		};
-	}
-	/**
-	* Montgomery x-only multiplication ladder for the selected X25519/X448 curve.
-	* @param pointU - decoded Montgomery u coordinate for the selected curve
-	* @param scalar - decoded clamped scalar by which the point is multiplied
-	* @returns resulting Montgomery u coordinate for the selected curve
-	*/
-	function montgomeryLadder(u, scalar) {
-		aInRange("u", u, _0n$1, P);
-		aInRange("scalar", scalar, minScalar, maxScalar);
-		const k = scalar;
-		const x_1 = u;
-		let x_2 = _1n$1;
-		let z_2 = _0n$1;
-		let x_3 = u;
-		let z_3 = _1n$1;
-		let swap = _0n$1;
-		for (let t = BigInt(montgomeryBits - 1); t >= _0n$1; t--) {
-			const k_t = k >> t & _1n$1;
-			swap ^= k_t;
-			({x_2, x_3} = cswap(swap, x_2, x_3));
-			({x_2: z_2, x_3: z_3} = cswap(swap, z_2, z_3));
-			swap = k_t;
-			const A = x_2 + z_2;
-			const AA = modP(A * A);
-			const B = x_2 - z_2;
-			const BB = modP(B * B);
-			const E = AA - BB;
-			const C = x_3 + z_3;
-			const DA = modP((x_3 - z_3) * A);
-			const CB = modP(C * B);
-			const dacb = DA + CB;
-			const da_cb = DA - CB;
-			x_3 = modP(dacb * dacb);
-			z_3 = modP(x_1 * modP(da_cb * da_cb));
-			x_2 = modP(AA * BB);
-			z_2 = modP(E * (AA + modP(a24 * E)));
-		}
-		({x_2, x_3} = cswap(swap, x_2, x_3));
-		({x_2: z_2, x_3: z_3} = cswap(swap, z_2, z_3));
-		const z2 = powPminus2(z_2);
-		return modP(x_2 * z2);
-	}
-	const lengths = {
-		secretKey: fieldLen,
-		publicKey: fieldLen,
-		seed: fieldLen
-	};
-	const randomSecretKey = (seed) => {
-		seed = seed === void 0 ? randomBytes_(fieldLen) : seed;
-		abytes(seed, lengths.seed, "seed");
-		return seed;
-	};
-	const utils = { randomSecretKey };
-	Object.freeze(lengths);
-	Object.freeze(utils);
-	return Object.freeze({
-		keygen: createKeygen(randomSecretKey, getPublicKey),
-		getSharedSecret,
-		getPublicKey,
-		scalarMult,
-		scalarMultBase,
-		utils,
-		GuBytes: GuBytes.slice(),
-		lengths
-	});
-}
-//#endregion
-//#region ../../packages/module/passport-account/node_modules/@noble/curves/abstract/oprf.js
-/**
-* RFC 9497: Oblivious Pseudorandom Functions (OPRFs) Using Prime-Order Groups.
-* https://www.rfc-editor.org/rfc/rfc9497
-*
-
-OPRF allows to interactively create an `Output = PRF(Input, serverSecretKey)`:
-
-- Server cannot calculate Output by itself: it doesn't know Input
-- Client cannot calculate Output by itself: it doesn't know server secretKey
-- An attacker interception the communication can't restore Input/Output/serverSecretKey and can't
-link Input to some value.
-
-## Issues
-
-- Low-entropy inputs (e.g. password '123') enable brute-forced dictionary attacks by the server
-(solveable by domain separation in POPRF)
-- High-level protocol needs to be constructed on top, because OPRF is low-level
-
-## Use cases
-
-1. **Password-Authenticated Key Exchange (PAKE):** Enables secure password login (e.g., OPAQUE)
-without revealing the password to the server.
-2. **Private Set Intersection (PSI):** Allows two parties to compute the intersection of their
-private sets without revealing non-intersecting elements.
-3. **Anonymous Credential Systems:** Supports issuance of anonymous, unlinkable credentials
-(e.g., Privacy Pass) using blind OPRF evaluation.
-4. **Private Information Retrieval (PIR):** Helps users query databases without revealing which
-item they accessed.
-5. **Encrypted Search / Secure Indexing:** Enables keyword search over encrypted data while keeping
-queries private.
-6. **Spam Prevention and Rate-Limiting:** Issues anonymous tokens to prevent abuse
-(e.g., CAPTCHA bypass) without compromising user privacy.
-
-## Modes
-
-- OPRF: simple mode, client doesn't need to know server public key
-- VOPRF: verifiable mode. It lets the client verify that the server used the
-secret key corresponding to a known public key
-- POPRF: partially oblivious mode, VOPRF + domain separation
-
-There is also non-interactive mode (Evaluate), which creates Output
-non-interactively with knowledge of the secret key.
-
-Flow:
-- (once) Server generates secret and public keys, distributes public keys to clients
-- deterministically: `deriveKeyPair` or just random: `generateKeyPair`
-- Client blinds input: `blind(secretInput)`
-- Server evaluates blinded input: `blindEvaluate` generated by client, sends result to client
-- Client creates output using result of evaluation via 'finalize'
-
-* @module
-*/
-/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
-const _DST_scalarBytes = /* @__PURE__ */ asciiToBytes(_DST_scalar);
-/**
-* @param opts - OPRF ciphersuite options. See {@link OPRFOpts}.
-* @returns OPRF helper namespace.
-* @example
-* Instantiate an OPRF suite from curve-specific hashing hooks.
-*
-* ```ts
-* import { createOPRF } from '@noble/curves/abstract/oprf.js';
-* import { p256, p256_hasher } from '@noble/curves/nist.js';
-* import { sha256 } from '@noble/hashes/sha2.js';
-* const oprf = createOPRF({
-*   name: 'P256-SHA256',
-*   Point: p256.Point,
-*   hash: sha256,
-*   hashToGroup: p256_hasher.hashToCurve,
-*   hashToScalar: p256_hasher.hashToScalar,
-* });
-* const keys = oprf.oprf.generateKeyPair();
-* ```
-*/
-function createOPRF(opts) {
-	validateObject(opts, {
-		name: "string",
-		hash: "function",
-		hashToScalar: "function",
-		hashToGroup: "function"
-	});
-	validatePointCons(opts.Point);
-	const { name, Point, hash } = opts;
-	const { Fn } = Point;
-	const hashToGroup = (msg, ctx) => opts.hashToGroup(msg, { DST: concatBytes(asciiToBytes("HashToGroup-"), ctx) });
-	const hashToScalarPrefixed = (msg, ctx) => opts.hashToScalar(msg, { DST: concatBytes(_DST_scalarBytes, ctx) });
-	const randomScalar = (rng = randomBytes) => {
-		const t = mapHashToField(rng(getMinHashLength(Fn.ORDER)), Fn.ORDER, Fn.isLE);
-		return Fn.isLE ? bytesToNumberLE(t) : bytesToNumberBE(t);
-	};
-	const msm = (points, scalars) => pippenger(Point, points, scalars);
-	const getCtx = (mode) => concatBytes(asciiToBytes("OPRFV1-"), new Uint8Array([mode]), asciiToBytes("-" + name));
-	const ctxOPRF = getCtx(0);
-	const ctxVOPRF = getCtx(1);
-	const ctxPOPRF = getCtx(2);
-	function encode(...args) {
-		const res = [];
-		for (const a of args) if (typeof a === "number") res.push(numberToBytesBE(a, 2));
-		else if (typeof a === "string") res.push(asciiToBytes(a));
-		else {
-			abytes(a);
-			res.push(numberToBytesBE(a.length, 2), a);
-		}
-		return concatBytes(...res);
-	}
-	const inputBytes = (title, bytes) => {
-		abytes(bytes, void 0, title);
-		if (bytes.length > 65535) throw new Error(`"${title}" expected Uint8Array of length <= 65535, got length=${bytes.length}`);
-		return bytes;
-	};
-	const hashInput = (...bytes) => hash(encode(...bytes, "Finalize"));
-	function getTranscripts(B, C, D, ctx) {
-		const seed = hash(encode(B.toBytes(), concatBytes(asciiToBytes("Seed-"), ctx)));
-		const res = [];
-		for (let i = 0; i < C.length; i++) {
-			const Ci = C[i].toBytes();
-			const Di = D[i].toBytes();
-			const di = hashToScalarPrefixed(encode(seed, i, Ci, Di, "Composite"), ctx);
-			res.push(di);
-		}
-		return res;
-	}
-	function computeComposites(B, C, D, ctx) {
-		const T = getTranscripts(B, C, D, ctx);
-		return {
-			M: msm(C, T),
-			Z: msm(D, T)
-		};
-	}
-	function computeCompositesFast(k, B, C, D, ctx) {
-		const M = msm(C, getTranscripts(B, C, D, ctx));
-		return {
-			M,
-			Z: M.multiply(k)
-		};
-	}
-	function challengeTranscript(B, M, Z, t2, t3, ctx) {
-		const [Bm, a0, a1, a2, a3] = [
-			B,
-			M,
-			Z,
-			t2,
-			t3
-		].map((i) => i.toBytes());
-		return hashToScalarPrefixed(encode(Bm, a0, a1, a2, a3, "Challenge"), ctx);
-	}
-	function generateProof(ctx, k, B, C, D, rng) {
-		const { M, Z } = computeCompositesFast(k, B, C, D, ctx);
-		const r = randomScalar(rng);
-		const c = challengeTranscript(B, M, Z, Point.BASE.multiply(r), M.multiply(r), ctx);
-		return concatBytes(...[c, Fn.sub(r, Fn.mul(c, k))].map((i) => Fn.toBytes(i)));
-	}
-	function verifyProof(ctx, B, C, D, proof) {
-		abytes(proof, 2 * Fn.BYTES);
-		const { M, Z } = computeComposites(B, C, D, ctx);
-		const [c, s] = [proof.subarray(0, Fn.BYTES), proof.subarray(Fn.BYTES)].map((f) => Fn.fromBytes(f));
-		const expectedC = challengeTranscript(B, M, Z, Point.BASE.multiply(s).add(B.multiply(c)), M.multiply(s).add(Z.multiply(c)), ctx);
-		if (!Fn.eql(c, expectedC)) throw new Error("proof verification failed");
-	}
-	function generateKeyPair() {
-		const skS = randomScalar();
-		const pkS = Point.BASE.multiply(skS);
-		return {
-			secretKey: Fn.toBytes(skS),
-			publicKey: pkS.toBytes()
-		};
-	}
-	function deriveKeyPair(ctx, seed, info) {
-		abytes(seed, 32, "seed");
-		info = inputBytes("keyInfo", info);
-		const dst = concatBytes(asciiToBytes("DeriveKeyPair"), ctx);
-		const msg = concatBytes(seed, encode(info), Uint8Array.of(0));
-		for (let counter = 0; counter <= 255; counter++) {
-			msg[msg.length - 1] = counter;
-			const skS = opts.hashToScalar(msg, { DST: dst });
-			if (Fn.is0(skS)) continue;
-			return {
-				secretKey: Fn.toBytes(skS),
-				publicKey: Point.BASE.multiply(skS).toBytes()
-			};
-		}
-		throw new Error("Cannot derive key");
-	}
-	const wirePoint = (label, bytes) => {
-		const point = Point.fromBytes(bytes);
-		if (point.equals(Point.ZERO)) throw new Error(label + " point at infinity");
-		return point;
-	};
-	function blind(ctx, input, rng = randomBytes) {
-		input = inputBytes("input", input);
-		const blind = randomScalar(rng);
-		const inputPoint = hashToGroup(input, ctx);
-		if (inputPoint.equals(Point.ZERO)) throw new Error("Input point at infinity");
-		const blinded = inputPoint.multiply(blind);
-		return {
-			blind: Fn.toBytes(blind),
-			blinded: blinded.toBytes()
-		};
-	}
-	function evaluate(ctx, secretKey, input) {
-		input = inputBytes("input", input);
-		const skS = Fn.fromBytes(secretKey);
-		const inputPoint = hashToGroup(input, ctx);
-		if (inputPoint.equals(Point.ZERO)) throw new Error("Input point at infinity");
-		const unblinded = inputPoint.multiply(skS).toBytes();
-		return hashInput(input, unblinded);
-	}
-	const oprf = Object.freeze({
-		generateKeyPair,
-		deriveKeyPair: (seed, keyInfo) => deriveKeyPair(ctxOPRF, seed, keyInfo),
-		blind: (input, rng = randomBytes) => blind(ctxOPRF, input, rng),
-		blindEvaluate(secretKey, blindedPoint) {
-			const skS = Fn.fromBytes(secretKey);
-			return wirePoint("blinded", blindedPoint).multiply(skS).toBytes();
-		},
-		finalize(input, blindBytes, evaluatedBytes) {
-			input = inputBytes("input", input);
-			const blind = Fn.fromBytes(blindBytes);
-			const unblinded = wirePoint("evaluated", evaluatedBytes).multiply(Fn.inv(blind)).toBytes();
-			return hashInput(input, unblinded);
-		},
-		evaluate: (secretKey, input) => evaluate(ctxOPRF, secretKey, input)
-	});
-	const voprf = Object.freeze({
-		generateKeyPair,
-		deriveKeyPair: (seed, keyInfo) => deriveKeyPair(ctxVOPRF, seed, keyInfo),
-		blind: (input, rng = randomBytes) => blind(ctxVOPRF, input, rng),
-		blindEvaluateBatch(secretKey, publicKey, blinded, rng = randomBytes) {
-			if (!Array.isArray(blinded)) throw new Error("expected array");
-			const skS = Fn.fromBytes(secretKey);
-			const pkS = wirePoint("public key", publicKey);
-			const blindedPoints = blinded.map((i) => wirePoint("blinded", i));
-			const evaluated = blindedPoints.map((i) => i.multiply(skS));
-			const proof = generateProof(ctxVOPRF, skS, pkS, blindedPoints, evaluated, rng);
-			return {
-				evaluated: evaluated.map((i) => i.toBytes()),
-				proof
-			};
-		},
-		blindEvaluate(secretKey, publicKey, blinded, rng = randomBytes) {
-			const res = this.blindEvaluateBatch(secretKey, publicKey, [blinded], rng);
-			return {
-				evaluated: res.evaluated[0],
-				proof: res.proof
-			};
-		},
-		finalizeBatch(items, publicKey, proof) {
-			if (!Array.isArray(items)) throw new Error("expected array");
-			verifyProof(ctxVOPRF, wirePoint("public key", publicKey), items.map((i) => wirePoint("blinded", i.blinded)), items.map((i) => wirePoint("evaluated", i.evaluated)), proof);
-			return items.map((i) => oprf.finalize(i.input, i.blind, i.evaluated));
-		},
-		finalize(input, blind, evaluated, blinded, publicKey, proof) {
-			return this.finalizeBatch([{
-				input,
-				blind,
-				evaluated,
-				blinded
-			}], publicKey, proof)[0];
-		},
-		evaluate: (secretKey, input) => evaluate(ctxVOPRF, secretKey, input)
-	});
-	const poprf = (info) => {
-		info = inputBytes("info", info);
-		const m = hashToScalarPrefixed(encode("Info", info), ctxPOPRF);
-		const T = Point.BASE.multiply(m);
-		return Object.freeze({
-			generateKeyPair,
-			deriveKeyPair: (seed, keyInfo) => deriveKeyPair(ctxPOPRF, seed, keyInfo),
-			blind(input, publicKey, rng = randomBytes) {
-				input = inputBytes("input", input);
-				const pkS = wirePoint("public key", publicKey);
-				const tweakedKey = T.add(pkS);
-				if (tweakedKey.equals(Point.ZERO)) throw new Error("tweakedKey point at infinity");
-				const blind = randomScalar(rng);
-				const inputPoint = hashToGroup(input, ctxPOPRF);
-				if (inputPoint.equals(Point.ZERO)) throw new Error("Input point at infinity");
-				const blindedPoint = inputPoint.multiply(blind);
-				return {
-					blind: Fn.toBytes(blind),
-					blinded: blindedPoint.toBytes(),
-					tweakedKey: tweakedKey.toBytes()
-				};
-			},
-			blindEvaluateBatch(secretKey, blinded, rng = randomBytes) {
-				if (!Array.isArray(blinded)) throw new Error("expected array");
-				const skS = Fn.fromBytes(secretKey);
-				const t = Fn.add(skS, m);
-				const invT = Fn.inv(t);
-				const blindedPoints = blinded.map((i) => wirePoint("blinded", i));
-				const evalPoints = blindedPoints.map((i) => i.multiply(invT));
-				const proof = generateProof(ctxPOPRF, t, Point.BASE.multiply(t), evalPoints, blindedPoints, rng);
-				return {
-					evaluated: evalPoints.map((i) => i.toBytes()),
-					proof
-				};
-			},
-			blindEvaluate(secretKey, blinded, rng = randomBytes) {
-				const res = this.blindEvaluateBatch(secretKey, [blinded], rng);
-				return {
-					evaluated: res.evaluated[0],
-					proof: res.proof
-				};
-			},
-			finalizeBatch(items, proof, tweakedKey) {
-				if (!Array.isArray(items)) throw new Error("expected array");
-				const inputs = items.map((i) => inputBytes("input", i.input));
-				const evalPoints = items.map((i) => wirePoint("evaluated", i.evaluated));
-				verifyProof(ctxPOPRF, wirePoint("tweakedKey", tweakedKey), evalPoints, items.map((i) => wirePoint("blinded", i.blinded)), proof);
-				return items.map((i, j) => {
-					const blind = Fn.fromBytes(i.blind);
-					const point = evalPoints[j].multiply(Fn.inv(blind)).toBytes();
-					return hashInput(inputs[j], info, point);
-				});
-			},
-			finalize(input, blind, evaluated, blinded, proof, tweakedKey) {
-				return this.finalizeBatch([{
-					input,
-					blind,
-					evaluated,
-					blinded
-				}], proof, tweakedKey)[0];
-			},
-			evaluate(secretKey, input) {
-				input = inputBytes("input", input);
-				const skS = Fn.fromBytes(secretKey);
-				const inputPoint = hashToGroup(input, ctxPOPRF);
-				if (inputPoint.equals(Point.ZERO)) throw new Error("Input point at infinity");
-				const t = Fn.add(skS, m);
-				const invT = Fn.inv(t);
-				const unblinded = inputPoint.multiply(invT).toBytes();
-				return hashInput(input, info, unblinded);
-			}
-		});
-	};
-	const res = {
-		name,
-		oprf,
-		voprf,
-		poprf,
-		__tests: Object.freeze({ Fn })
-	};
-	return Object.freeze(res);
-}
-//#endregion
-//#region ../../packages/module/passport-account/node_modules/@noble/curves/ed25519.js
-/**
-* ed25519 Twisted Edwards curve with following addons:
-* - X25519 ECDH
-* - Ristretto cofactor elimination
-* - Elligator hash-to-group / point indistinguishability
-* @module
-*/
-/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
-const _0n = /* @__PURE__ */ BigInt(0), _1n = /* @__PURE__ */ BigInt(1), _2n = /* @__PURE__ */ BigInt(2), _3n = /* @__PURE__ */ BigInt(3);
-const _5n = /* @__PURE__ */ BigInt(5), _8n = /* @__PURE__ */ BigInt(8);
-const ed25519_CURVE_p = /* @__PURE__ */ BigInt("0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffed");
-const ed25519_CURVE = {
-	p: ed25519_CURVE_p,
-	n: BigInt("0x1000000000000000000000000000000014def9dea2f79cd65812631a5cf5d3ed"),
-	h: _8n,
-	a: BigInt("0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffec"),
-	d: BigInt("0x52036cee2b6ffe738cc740797779e89800700a4d4141d8ab75eb4dca135978a3"),
-	Gx: BigInt("0x216936d3cd6e53fec0a4e231fdd6dc5c692cc7609525a7b2c9562d608f25d51a"),
-	Gy: BigInt("0x6666666666666666666666666666666666666666666666666666666666666658")
-};
-function ed25519_pow_2_252_3(x) {
-	const _10n = BigInt(10), _20n = BigInt(20), _40n = BigInt(40), _80n = BigInt(80);
-	const P = ed25519_CURVE_p;
-	const b2 = x * x % P * x % P;
-	const b5 = pow2(pow2(b2, _2n, P) * b2 % P, _1n, P) * x % P;
-	const b10 = pow2(b5, _5n, P) * b5 % P;
-	const b20 = pow2(b10, _10n, P) * b10 % P;
-	const b40 = pow2(b20, _20n, P) * b20 % P;
-	const b80 = pow2(b40, _40n, P) * b40 % P;
-	return {
-		pow_p_5_8: pow2(pow2(pow2(pow2(b80, _80n, P) * b80 % P, _80n, P) * b80 % P, _10n, P) * b10 % P, _2n, P) * x % P,
-		b2
-	};
-}
-function adjustScalarBytes(bytes) {
-	bytes[0] &= 248;
-	bytes[31] &= 127;
-	bytes[31] |= 64;
-	return bytes;
-}
-const ED25519_SQRT_M1 = /* @__PURE__ */ BigInt("19681161376707505956807079304988542015446066515923890162744021073123829784752");
-function uvRatio(u, v) {
-	const P = ed25519_CURVE_p;
-	const v3 = mod(v * v * v, P);
-	const pow = ed25519_pow_2_252_3(u * mod(v3 * v3 * v, P)).pow_p_5_8;
-	let x = mod(u * v3 * pow, P);
-	const vx2 = mod(v * x * x, P);
-	const root1 = x;
-	const root2 = mod(x * ED25519_SQRT_M1, P);
-	const useRoot1 = vx2 === u;
-	const useRoot2 = vx2 === mod(-u, P);
-	const noRoot = vx2 === mod(-u * ED25519_SQRT_M1, P);
-	if (useRoot1) x = root1;
-	if (useRoot2 || noRoot) x = root2;
-	if (isNegativeLE(x, P)) x = mod(-x, P);
-	return {
-		isValid: useRoot1 || useRoot2,
-		value: x
-	};
-}
-const ed25519_Point = /* @__PURE__ */ edwards(ed25519_CURVE, { uvRatio });
-const Fp = ed25519_Point.Fp;
-const Fn = ed25519_Point.Fn;
-createFROST({
-	name: "FROST-ED25519-SHA512-v1",
-	Point: ed25519_Point,
-	validatePoint: (p) => {
-		p.assertValidity();
-		if (!p.isTorsionFree()) throw new Error("bad point: not torsion-free");
-	},
-	hash: sha512,
-	H2: ""
-});
-/**
-* ECDH using curve25519 aka x25519.
-* `getSharedSecret()` rejects low-order peer inputs by default, and seeded
-* `keygen(seed)` reuses the provided 32-byte seed buffer instead of copying it.
-* @example
-* Derive one shared secret between two X25519 peers.
-*
-* ```js
-* import { x25519 } from '@noble/curves/ed25519.js';
-* const alice = x25519.keygen();
-* const bob = x25519.keygen();
-* const shared = x25519.getSharedSecret(alice.secretKey, bob.publicKey);
-* ```
-*/
-const x25519 = /* @__PURE__ */ (() => {
-	const P = ed25519_CURVE_p;
-	return montgomery({
-		P,
-		type: "x25519",
-		powPminus2: (x) => {
-			const { pow_p_5_8, b2 } = ed25519_pow_2_252_3(x);
-			return mod(pow2(pow_p_5_8, _3n, P) * b2, P);
-		},
-		adjustScalarBytes
-	});
-})();
-const ELL2_C1 = (ed25519_CURVE_p + _3n) / _8n;
-const ELL2_C2 = Fp.pow(_2n, ELL2_C1);
-const ELL2_C3 = Fp.sqrt(Fp.neg(Fp.ONE));
-/**
-* RFC 9380 method `map_to_curve_elligator2_curve25519`. Experimental name: may be renamed later.
-* @private
-*/
-function _map_to_curve_elligator2_curve25519(u) {
-	const ELL2_C4 = (ed25519_CURVE_p - _5n) / _8n;
-	const ELL2_J = BigInt(486662);
-	let tv1 = Fp.sqr(u);
-	tv1 = Fp.mul(tv1, _2n);
-	let xd = Fp.add(tv1, Fp.ONE);
-	let x1n = Fp.neg(ELL2_J);
-	let tv2 = Fp.sqr(xd);
-	let gxd = Fp.mul(tv2, xd);
-	let gx1 = Fp.mul(tv1, ELL2_J);
-	gx1 = Fp.mul(gx1, x1n);
-	gx1 = Fp.add(gx1, tv2);
-	gx1 = Fp.mul(gx1, x1n);
-	let tv3 = Fp.sqr(gxd);
-	tv2 = Fp.sqr(tv3);
-	tv3 = Fp.mul(tv3, gxd);
-	tv3 = Fp.mul(tv3, gx1);
-	tv2 = Fp.mul(tv2, tv3);
-	let y11 = Fp.pow(tv2, ELL2_C4);
-	y11 = Fp.mul(y11, tv3);
-	let y12 = Fp.mul(y11, ELL2_C3);
-	tv2 = Fp.sqr(y11);
-	tv2 = Fp.mul(tv2, gxd);
-	let e1 = Fp.eql(tv2, gx1);
-	let y1 = Fp.cmov(y12, y11, e1);
-	let x2n = Fp.mul(x1n, tv1);
-	let y21 = Fp.mul(y11, u);
-	y21 = Fp.mul(y21, ELL2_C2);
-	let y22 = Fp.mul(y21, ELL2_C3);
-	let gx2 = Fp.mul(gx1, tv1);
-	tv2 = Fp.sqr(y21);
-	tv2 = Fp.mul(tv2, gxd);
-	let e2 = Fp.eql(tv2, gx2);
-	let y2 = Fp.cmov(y22, y21, e2);
-	tv2 = Fp.sqr(y1);
-	tv2 = Fp.mul(tv2, gxd);
-	let e3 = Fp.eql(tv2, gx1);
-	let xn = Fp.cmov(x2n, x1n, e3);
-	let y = Fp.cmov(y2, y1, e3);
-	let e4 = Fp.isOdd(y);
-	y = Fp.cmov(y, Fp.neg(y), e3 !== e4);
-	return {
-		xMn: xn,
-		xMd: xd,
-		yMn: y,
-		yMd: _1n
-	};
-}
-const ELL2_C1_EDWARDS = FpSqrtEven(Fp, Fp.neg(BigInt(486664)));
-function map_to_curve_elligator2_edwards25519(u) {
-	const { xMn, xMd, yMn, yMd } = _map_to_curve_elligator2_curve25519(u);
-	let xn = Fp.mul(xMn, yMd);
-	xn = Fp.mul(xn, ELL2_C1_EDWARDS);
-	let xd = Fp.mul(xMd, yMn);
-	let yn = Fp.sub(xMn, xMd);
-	let yd = Fp.add(xMn, xMd);
-	let tv1 = Fp.mul(xd, yd);
-	let e = Fp.eql(tv1, Fp.ZERO);
-	xn = Fp.cmov(xn, Fp.ZERO, e);
-	xd = Fp.cmov(xd, Fp.ONE, e);
-	yn = Fp.cmov(yn, Fp.ONE, e);
-	yd = Fp.cmov(yd, Fp.ONE, e);
-	const [xd_inv, yd_inv] = FpInvertBatch(Fp, [xd, yd], true);
-	return {
-		x: Fp.mul(xn, xd_inv),
-		y: Fp.mul(yn, yd_inv)
-	};
-}
-createHasher(ed25519_Point, (scalars) => map_to_curve_elligator2_edwards25519(scalars[0]), {
-	DST: "edwards25519_XMD:SHA-512_ELL2_RO_",
-	encodeDST: "edwards25519_XMD:SHA-512_ELL2_NU_",
-	p: ed25519_CURVE_p,
-	m: 1,
-	k: 128,
-	expand: "xmd",
-	hash: sha512
-});
-const SQRT_M1 = ED25519_SQRT_M1;
-const SQRT_AD_MINUS_ONE = /* @__PURE__ */ BigInt("25063068953384623474111414158702152701244531502492656460079210482610430750235");
-const INVSQRT_A_MINUS_D = /* @__PURE__ */ BigInt("54469307008909316920995813868745141605393597292927456921205312896311721017578");
-const ONE_MINUS_D_SQ = /* @__PURE__ */ BigInt("1159843021668779879193775521855586647937357759715417654439879720876111806838");
-const D_MINUS_ONE_SQ = /* @__PURE__ */ BigInt("40440834346308536858101042469323190826248399146238708352240133220865137265952");
-const invertSqrt = (number) => uvRatio(_1n, number);
-const MAX_255B = /* @__PURE__ */ BigInt("0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
-const bytes255ToNumberLE = (bytes) => Fp.create(bytesToNumberLE(bytes) & MAX_255B);
-/**
-* Computes Elligator map for Ristretto255.
-* Primary formula source is RFC 9496 §4.3.4 MAP; RFC 9380 Appendix B builds
-* `hash_to_ristretto255` on top of this helper.
-* Returns an internal Edwards representative, not a public `_RistrettoPoint`.
-*/
-function calcElligatorRistrettoMap(r0) {
-	const { d } = ed25519_CURVE;
-	const P = ed25519_CURVE_p;
-	const mod = (n) => Fp.create(n);
-	const r = mod(SQRT_M1 * r0 * r0);
-	const Ns = mod((r + _1n) * ONE_MINUS_D_SQ);
-	let c = BigInt(-1);
-	const D = mod((c - d * r) * mod(r + d));
-	let { isValid: Ns_D_is_sq, value: s } = uvRatio(Ns, D);
-	let s_ = mod(s * r0);
-	if (!isNegativeLE(s_, P)) s_ = mod(-s_);
-	if (!Ns_D_is_sq) s = s_;
-	if (!Ns_D_is_sq) c = r;
-	const Nt = mod(c * (r - _1n) * D_MINUS_ONE_SQ - D);
-	const s2 = s * s;
-	const W0 = mod((s + s) * D);
-	const W1 = mod(Nt * SQRT_AD_MINUS_ONE);
-	const W2 = mod(_1n - s2);
-	const W3 = mod(_1n + s2);
-	return new ed25519_Point(mod(W0 * W3), mod(W2 * W1), mod(W1 * W3), mod(W0 * W2));
-}
-/**
-* Wrapper over Edwards Point for ristretto255.
-*
-* Each ed25519/EdwardsPoint has 8 different equivalent points. This can be
-* a source of bugs for protocols like ring signatures. Ristretto was created to solve this.
-* Ristretto point operates in X:Y:Z:T extended coordinates like EdwardsPoint,
-* but it should work in its own namespace: do not combine those two.
-* See [RFC9496](https://www.rfc-editor.org/rfc/rfc9496).
-*/
-var _RistrettoPoint = class _RistrettoPoint extends PrimeEdwardsPoint {
-	static BASE = new _RistrettoPoint(ed25519_Point.BASE);
-	static ZERO = new _RistrettoPoint(ed25519_Point.ZERO);
-	static Fp = Fp;
-	static Fn = Fn;
-	constructor(ep) {
-		super(ep);
-	}
-	/**
-	* Create one Ristretto255 point from affine Edwards coordinates.
-	* This wraps the internal Edwards representative directly and is not a
-	* canonical ristretto255 decoding path.
-	* Use `toBytes()` / `fromBytes()` if canonical ristretto255 bytes matter.
-	*/
-	static fromAffine(ap) {
-		return new _RistrettoPoint(ed25519_Point.fromAffine(ap));
-	}
-	assertSame(other) {
-		if (!(other instanceof _RistrettoPoint)) throw new Error("RistrettoPoint expected");
-	}
-	init(ep) {
-		return new _RistrettoPoint(ep);
-	}
-	static fromBytes(bytes) {
-		abytes$1(bytes, 32);
-		const { a, d } = ed25519_CURVE;
-		const P = ed25519_CURVE_p;
-		const mod = (n) => Fp.create(n);
-		const s = bytes255ToNumberLE(bytes);
-		if (!equalBytes$1(Fp.toBytes(s), bytes) || isNegativeLE(s, P)) throw new Error("invalid ristretto255 encoding 1");
-		const s2 = mod(s * s);
-		const u1 = mod(_1n + a * s2);
-		const u2 = mod(_1n - a * s2);
-		const u1_2 = mod(u1 * u1);
-		const u2_2 = mod(u2 * u2);
-		const v = mod(a * d * u1_2 - u2_2);
-		const { isValid, value: I } = invertSqrt(mod(v * u2_2));
-		const Dx = mod(I * u2);
-		const Dy = mod(I * Dx * v);
-		let x = mod((s + s) * Dx);
-		if (isNegativeLE(x, P)) x = mod(-x);
-		const y = mod(u1 * Dy);
-		const t = mod(x * y);
-		if (!isValid || isNegativeLE(t, P) || y === _0n) throw new Error("invalid ristretto255 encoding 2");
-		return new _RistrettoPoint(new ed25519_Point(x, y, _1n, t));
-	}
-	/**
-	* Converts ristretto-encoded string to ristretto point.
-	* Described in [RFC9496](https://www.rfc-editor.org/rfc/rfc9496#name-decode).
-	* @param hex - Ristretto-encoded 32 bytes. Not every 32-byte string is valid ristretto encoding
-	*/
-	static fromHex(hex) {
-		return _RistrettoPoint.fromBytes(hexToBytes(hex));
-	}
-	/**
-	* Encodes ristretto point to Uint8Array.
-	* Described in [RFC9496](https://www.rfc-editor.org/rfc/rfc9496#name-encode).
-	*/
-	toBytes() {
-		let { X, Y, Z, T } = this.ep;
-		const P = ed25519_CURVE_p;
-		const mod = (n) => Fp.create(n);
-		const u1 = mod(mod(Z + Y) * mod(Z - Y));
-		const u2 = mod(X * Y);
-		const { value: invsqrt } = invertSqrt(mod(u1 * mod(u2 * u2)));
-		const D1 = mod(invsqrt * u1);
-		const D2 = mod(invsqrt * u2);
-		const zInv = mod(D1 * D2 * T);
-		let D;
-		if (isNegativeLE(T * zInv, P)) {
-			let _x = mod(Y * SQRT_M1);
-			let _y = mod(X * SQRT_M1);
-			X = _x;
-			Y = _y;
-			D = mod(D1 * INVSQRT_A_MINUS_D);
-		} else D = D2;
-		if (isNegativeLE(X * zInv, P)) Y = mod(-Y);
-		let s = mod((Z - Y) * D);
-		if (isNegativeLE(s, P)) s = mod(-s);
-		return Fp.toBytes(s);
-	}
-	/**
-	* Compares two Ristretto points.
-	* Described in [RFC9496](https://www.rfc-editor.org/rfc/rfc9496#name-equals).
-	*/
-	equals(other) {
-		this.assertSame(other);
-		const { X: X1, Y: Y1 } = this.ep;
-		const { X: X2, Y: Y2 } = other.ep;
-		const mod = (n) => Fp.create(n);
-		const one = mod(X1 * Y2) === mod(Y1 * X2);
-		const two = mod(Y1 * Y2) === mod(X1 * X2);
-		return one || two;
-	}
-	is0() {
-		return this.equals(_RistrettoPoint.ZERO);
-	}
-};
-Object.freeze(_RistrettoPoint.BASE);
-Object.freeze(_RistrettoPoint.ZERO);
-Object.freeze(_RistrettoPoint.prototype);
-Object.freeze(_RistrettoPoint);
-/**
-* Hashing to ristretto255 points / field. RFC 9380 methods.
-* `hashToCurve()` is RFC 9380 Appendix B, `deriveToCurve()` is the RFC 9496
-* §4.3.4 element-derivation building block, and `hashToScalar()` is a
-* library-specific helper for OPRF-style use.
-* @example
-* Hash one message onto ristretto255.
-*
-* ```ts
-* const point = ristretto255_hasher.hashToCurve(new TextEncoder().encode('hello noble'));
-* ```
-*/
-const ristretto255_hasher = Object.freeze({
-	Point: _RistrettoPoint,
-	hashToCurve(msg, options) {
-		const xmd = expand_message_xmd(msg, options?.DST === void 0 ? "ristretto255_XMD:SHA-512_R255MAP_RO_" : options.DST, 64, sha512);
-		return ristretto255_hasher.deriveToCurve(xmd);
-	},
-	hashToScalar(msg, options = { DST: _DST_scalar }) {
-		const xmd = expand_message_xmd(msg, options.DST, 64, sha512);
-		return Fn.create(bytesToNumberLE(xmd));
-	},
-	deriveToCurve(bytes) {
-		abytes$1(bytes, 64);
-		const R1 = calcElligatorRistrettoMap(bytes255ToNumberLE(bytes.subarray(0, 32)));
-		const R2 = calcElligatorRistrettoMap(bytes255ToNumberLE(bytes.subarray(32, 64)));
-		return new _RistrettoPoint(R1.add(R2));
-	}
-});
-createOPRF({
-	name: "ristretto255-SHA512",
-	Point: _RistrettoPoint,
-	hash: sha512,
-	hashToGroup: ristretto255_hasher.hashToCurve,
-	hashToScalar: ristretto255_hasher.hashToScalar
-});
-createFROST({
-	name: "FROST-RISTRETTO255-SHA512-v1",
-	Point: _RistrettoPoint,
-	validatePoint: (p) => {
-		p.assertValidity();
-	},
-	hash: sha512
-});
-/**
-* The most inbox entries one open-inbox request carries, held by the
-* client that batches and the signer that answers alike: a busy inbox is
-* opened over several requests, so no single request holds the signer
-* decrypting without bound.
-*/
-const MAX_INBOX_ENTRIES_PER_REQUEST = 4096;
-const ENTRY_VERSION = 1;
-const ENTRY_SUITE = 1;
-const EPHEMERAL_KEY_OFFSET$1 = 2;
-const NONCE_OFFSET$1 = 34;
-const TAG_OFFSET$1 = 46;
-const CIPHERTEXT_OFFSET$1 = 62;
-const NONCE_LENGTH$2 = 12;
-const TAG_LENGTH$2 = 16;
-const KEY_LENGTH$2 = 32;
-const COIN_NONCE_LENGTH = 32;
-const COLOR_LENGTH = 32;
-const VALUE_LENGTH = 16;
-const PLAINTEXT_LENGTH = COIN_NONCE_LENGTH + COLOR_LENGTH + VALUE_LENGTH;
-const AEAD_TAG_BITS$2 = TAG_LENGTH$2 * 8;
-const VALUE_MAX = (1n << BigInt(VALUE_LENGTH * 8)) - 1n;
-const BYTE_BITS$1 = 8n;
-const BYTE_MASK$1 = 255n;
-const WRAPPING_KEY_INFO = new TextEncoder().encode("midnight:custody:inbox:v1");
-/**
-* The AES-256-GCM key that wraps one entry: HKDF-SHA256 over the X25519
-* shared secret with an empty salt and the fixed inbox label, imported
-* non-extractable so the key bytes never exist outside the shared secret,
-* which is zeroed once the key is derived.
-*/
-const wrappingKey = async (shared) => {
-	try {
-		const material = await crypto.subtle.importKey("raw", shared, "HKDF", false, ["deriveKey"]);
-		return await crypto.subtle.deriveKey({
-			name: "HKDF",
-			hash: "SHA-256",
-			salt: new Uint8Array(0),
-			info: WRAPPING_KEY_INFO
-		}, material, {
-			name: "AES-GCM",
-			length: KEY_LENGTH$2 * 8
-		}, false, ["encrypt", "decrypt"]);
-	} finally {
-		shared.fill(0);
-	}
-};
-const encodeValue = (value) => {
-	const bytes = new Uint8Array(VALUE_LENGTH);
-	let remaining = value;
-	for (let index = VALUE_LENGTH - 1; index >= 0; index -= 1) {
-		bytes[index] = Number(remaining & BYTE_MASK$1);
-		remaining >>= BYTE_BITS$1;
-	}
-	return bytes;
-};
-const decodeValue = (bytes) => bytes.reduce((value, byte) => value << BYTE_BITS$1 | BigInt(byte), 0n);
-const encodeCoin = ({ nonce, color, value }) => {
-	if (nonce.length !== COIN_NONCE_LENGTH || color.length !== COLOR_LENGTH) throw new Error(`An inbox coin description needs a ${COIN_NONCE_LENGTH}-byte nonce and a ${COLOR_LENGTH}-byte colour.`);
-	if (value < 0n || value > VALUE_MAX) throw new Error(`An inbox coin value must fit an unsigned 128-bit integer, got ${value}.`);
-	const plaintext = new Uint8Array(PLAINTEXT_LENGTH);
-	plaintext.set(nonce, 0);
-	plaintext.set(color, COIN_NONCE_LENGTH);
-	plaintext.set(encodeValue(value), COIN_NONCE_LENGTH + COLOR_LENGTH);
-	return plaintext;
-};
-const decodeCoin = (plaintext) => ({
-	nonce: plaintext.slice(0, COIN_NONCE_LENGTH),
-	color: plaintext.slice(COIN_NONCE_LENGTH, COIN_NONCE_LENGTH + COLOR_LENGTH),
-	value: decodeValue(plaintext.slice(COIN_NONCE_LENGTH + COLOR_LENGTH))
-});
-/**
-* Seals a coin description towards an account as an InboxEntry v1: the
-* plaintext is the coin nonce, colour and big-endian 128-bit value, wrapped
-* under a key agreed between a fresh ephemeral X25519 key and the
-* account's `enc_key`, with the version and suite bytes as associated
-* data; the trailing padding stays zero. The ephemeral secret is zeroed
-* before this returns.
-*/
-const sealInboxEntry = async (encPublicKey, coin) => {
-	const plaintext = encodeCoin(coin);
-	const ephemeral = x25519.keygen();
-	const entry = new Uint8Array(192);
-	entry[0] = ENTRY_VERSION;
-	entry[1] = ENTRY_SUITE;
-	try {
-		const key = await wrappingKey(x25519.getSharedSecret(ephemeral.secretKey, encPublicKey));
-		const nonce = crypto.getRandomValues(new Uint8Array(NONCE_LENGTH$2));
-		const sealed = new Uint8Array(await crypto.subtle.encrypt({
-			name: "AES-GCM",
-			iv: nonce,
-			additionalData: entry.slice(0, EPHEMERAL_KEY_OFFSET$1),
-			tagLength: AEAD_TAG_BITS$2
-		}, key, plaintext));
-		entry.set(ephemeral.publicKey, EPHEMERAL_KEY_OFFSET$1);
-		entry.set(nonce, NONCE_OFFSET$1);
-		entry.set(sealed.subarray(PLAINTEXT_LENGTH), TAG_OFFSET$1);
-		entry.set(sealed.subarray(0, PLAINTEXT_LENGTH), CIPHERTEXT_OFFSET$1);
-		return entry;
-	} finally {
-		ephemeral.secretKey.fill(0);
-		plaintext.fill(0);
-	}
-};
-/**
-* Opens an InboxEntry v1 with the account encryption secret. Resolves the
-* coin the entry describes, or null for an entry the inbox walk must skip
-* rather than fail on: one of another length, version or suite, one
-* sealed towards another key, or one whose authentication fails. The
-* contract accepts any bytes from anyone, so a null is noise, not an
-* error.
-*/
-const openInboxEntry = async (encSecret, entry) => {
-	if (entry.length !== 192 || entry[0] !== ENTRY_VERSION || entry[1] !== ENTRY_SUITE) return null;
-	try {
-		const key = await wrappingKey(x25519.getSharedSecret(encSecret, entry.slice(EPHEMERAL_KEY_OFFSET$1, NONCE_OFFSET$1)));
-		const sealed = new Uint8Array(PLAINTEXT_LENGTH + TAG_LENGTH$2);
-		sealed.set(entry.slice(CIPHERTEXT_OFFSET$1, CIPHERTEXT_OFFSET$1 + PLAINTEXT_LENGTH), 0);
-		sealed.set(entry.slice(TAG_OFFSET$1, CIPHERTEXT_OFFSET$1), PLAINTEXT_LENGTH);
-		const plaintext = new Uint8Array(await crypto.subtle.decrypt({
-			name: "AES-GCM",
-			iv: entry.slice(NONCE_OFFSET$1, TAG_OFFSET$1),
-			additionalData: entry.slice(0, EPHEMERAL_KEY_OFFSET$1),
-			tagLength: AEAD_TAG_BITS$2
-		}, key, sealed));
-		try {
-			return decodeCoin(plaintext);
-		} finally {
-			plaintext.fill(0);
-		}
-	} catch {
-		return null;
-	}
-};
-const SEAL_VERSION = 1;
-const SEAL_SUITE = 1;
-const EPHEMERAL_KEY_OFFSET = 2;
-const NONCE_OFFSET = 34;
-const TAG_OFFSET = 46;
-const CIPHERTEXT_OFFSET = 62;
-const NONCE_LENGTH$1 = 12;
-const TAG_LENGTH$1 = 16;
-const KEY_LENGTH$1 = 32;
-const SECRET_LENGTH = 32;
-const AEAD_TAG_BITS$1 = TAG_LENGTH$1 * 8;
-const VIEW_KEY_INFO = new TextEncoder().encode("midnight:account:grant:view:v1");
-const concat$1 = (...parts) => {
-	const joined = new Uint8Array(parts.reduce((length, part) => length + part.length, 0));
-	let offset = 0;
-	for (const part of parts) {
-		joined.set(part, offset);
-		offset += part.length;
-	}
-	return joined;
-};
-/**
-* The AES-256-GCM key that wraps one seal: HKDF-SHA256 over the X25519
-* shared secret with an empty salt and the view label followed by the
-* grant id, imported non-extractable; the shared secret is zeroed once
-* the key is derived.
-*/
-const sealingKey = async (shared, grantId) => {
-	try {
-		const material = await crypto.subtle.importKey("raw", shared, "HKDF", false, ["deriveKey"]);
-		return await crypto.subtle.deriveKey({
-			name: "HKDF",
-			hash: "SHA-256",
-			salt: new Uint8Array(0),
-			info: concat$1(VIEW_KEY_INFO, grantId)
-		}, material, {
-			name: "AES-GCM",
-			length: KEY_LENGTH$1 * 8
-		}, false, ["encrypt"]);
-	} finally {
-		shared.fill(0);
-	}
-};
-/**
-* Seals an account encryption secret towards a grantee's read key as a
-* GrantViewSeal v1: the secret is wrapped under a key agreed between a
-* fresh ephemeral X25519 key and the read key and derived with the grant
-* id in its label, with the version, suite, ephemeral key, grant id and
-* account as associated data, so the container opens only for that read
-* key, under that grant and for that account. A read key of small order
-* yields an all-zero shared secret, which the key agreement refuses. The
-* ephemeral secret is zeroed before this returns; the account secret is
-* the caller's to zero.
-*/
-const sealGrantView = async (encSecret, { grantId, account, readPublicKey }) => {
-	if (encSecret.length !== SECRET_LENGTH) throw new Error(`A grant view seals a ${SECRET_LENGTH}-byte secret, got ${encSecret.length} bytes.`);
-	const grantIdBytes = ByteArray.fromHex(HexBytes(grantId));
-	const accountBytes = ByteArray.fromHex(HexBytes(account));
-	const readKey = ByteArray.fromHex(HexBytes(readPublicKey));
-	const ephemeral = x25519.keygen();
-	const seal = new Uint8Array(94);
-	seal[0] = SEAL_VERSION;
-	seal[1] = SEAL_SUITE;
-	seal.set(ephemeral.publicKey, EPHEMERAL_KEY_OFFSET);
-	try {
-		const key = await sealingKey(x25519.getSharedSecret(ephemeral.secretKey, readKey), grantIdBytes);
-		const nonce = crypto.getRandomValues(new Uint8Array(NONCE_LENGTH$1));
-		const sealed = new Uint8Array(await crypto.subtle.encrypt({
-			name: "AES-GCM",
-			iv: nonce,
-			additionalData: concat$1(seal.slice(0, NONCE_OFFSET), grantIdBytes, accountBytes),
-			tagLength: AEAD_TAG_BITS$1
-		}, key, encSecret));
-		seal.set(nonce, NONCE_OFFSET);
-		seal.set(sealed.subarray(SECRET_LENGTH), TAG_OFFSET);
-		seal.set(sealed.subarray(0, SECRET_LENGTH), CIPHERTEXT_OFFSET);
-		return seal;
-	} finally {
-		ephemeral.secretKey.fill(0);
-	}
-};
-//#endregion
-//#region ../../packages/module/passport-account/src/acc/envelopes.ts
-/**
-* The Lace record kinds an Account Custody Contract inbox carries beside
-* the coin entries senders write: device envelopes, which deliver the
-* account secret and the roster key to one device's reader key; device
-* registrations, which name an enrolled device's reader and device keys
-* under the roster key; and grant records, which keep the bookkeeping of
-* a grant this device issued under a key only it derives. Each is one
-* 192-byte entry led by a type byte no custody standard reader knows, so
-* every other reader skips it as noise, and each opens to null rather
-* than an error when it is malformed, tampered with or addressed to
-* someone else, since anyone may append any bytes to the inbox.
-*/
-/** Type byte of a device envelope. */
-const DEVICE_ENVELOPE_TYPE = 209;
-/** Type byte of a device registration. */
-const DEVICE_REGISTRATION_TYPE = 210;
-/** Type byte of a grant record. */
-const GRANT_RECORD_TYPE = 211;
-const SUITE = 2;
-const KEY_LENGTH = 32;
-const NONCE_LENGTH = 12;
-const TAG_LENGTH = 16;
-const RECIPIENT_TAG_LENGTH = 32;
-const AEAD_TAG_BITS = TAG_LENGTH * 8;
-const MAX_COIN_VALUE_LENGTH = 16;
-const BYTE_BITS = 8n;
-const BYTE_MASK = 255n;
-const RECIPIENT_TAG_OFFSET = 2;
-const RECIPIENT_TAG_END = RECIPIENT_TAG_OFFSET + RECIPIENT_TAG_LENGTH;
-const ENVELOPE_EPHEMERAL_OFFSET = RECIPIENT_TAG_END;
-const ENVELOPE_NONCE_OFFSET = ENVELOPE_EPHEMERAL_OFFSET + KEY_LENGTH;
-const ENVELOPE_PLAINTEXT_LENGTH = KEY_LENGTH * 2;
-const REGISTRATION_NONCE_OFFSET = 2;
-const REGISTRATION_PLAINTEXT_LENGTH = KEY_LENGTH * 2;
-const RECORD_NONCE_OFFSET = RECIPIENT_TAG_END;
-const RECORD_PLAINTEXT_LENGTH = 192 - (RECORD_NONCE_OFFSET + NONCE_LENGTH + TAG_LENGTH);
-const encoder = new TextEncoder();
-const ENVELOPE_TAG_DOMAIN = encoder.encode("lace:passport:envelope-tag:v2");
-const ENVELOPE_KEY_INFO = encoder.encode("lace:passport:device-envelope:v1");
-const REGISTRATION_KEY_INFO = encoder.encode("lace:passport:device-registration:v1");
-const RECORD_KEY_INFO = encoder.encode("lace:passport:grant-record:v1");
-const RECORD_TAG_KEY_INFO = encoder.encode("lace:passport:grant-record-tag:v1");
-/**
-* The kinds of grant record part, by the byte that leads its plaintext.
-* The jubjub grant, object and view values come first, so the records
-* written before secp256k1 grantees read back unchanged.
-*/
-const RECORD_PART_KINDS = [
-	{
-		part: "grant",
-		granteeScheme: "jubjub-schnorr"
-	},
-	{ part: "object" },
-	{ part: "view" },
-	{
-		part: "grant",
-		granteeScheme: "secp256k1-ecdsa",
-		keyPrefix: 2
-	},
-	{
-		part: "grant",
-		granteeScheme: "secp256k1-ecdsa",
-		keyPrefix: 3
-	}
-];
-/**
-* A Jubjub device public key in the compressed 32-byte form a device
-* registration carries, as lowercase hex: the y coordinate little-endian
-* with the parity of x in its top bit.
-*/
-const encodeDevicePublicKey = (point) => HexBytes.fromByteArray(jubjub.Point.fromAffine(point).toBytes());
-/**
-* The affine Jubjub point a compressed device public key names, or
-* undefined for hex that is no point on the curve.
-*/
-const decodeDevicePublicKey = (hex) => {
-	try {
-		return jubjub.Point.fromBytes(ByteArray.fromHex(HexBytes(hex))).toAffine();
-	} catch {
-		return;
-	}
-};
-const concat = (...parts) => {
-	const joined = new Uint8Array(parts.reduce((length, part) => length + part.length, 0));
-	let offset = 0;
-	for (const part of parts) {
-		joined.set(part, offset);
-		offset += part.length;
-	}
-	return joined;
-};
-const isZero = (bytes) => bytes.every((byte) => byte === 0);
-const equalBytes = (left, right) => left.length === right.length && left.every((byte, index) => byte === right[index]);
-/** Whether an entry is a 192-byte record of the given type and suite. */
-const isRecordOf = (entry, type) => entry.length === 192 && entry[0] === type && entry[1] === SUITE;
-/**
-* Whether an inbox entry is one of the Lace record kinds, which a coin
-* walk passes over rather than counts as noise.
-*/
-const isLaceRecord = (entry) => isRecordOf(entry, DEVICE_ENVELOPE_TYPE) || isRecordOf(entry, DEVICE_REGISTRATION_TYPE) || isRecordOf(entry, GRANT_RECORD_TYPE);
-/** Whether an inbox entry is a device registration. */
-const isDeviceRegistration = (entry) => isRecordOf(entry, DEVICE_REGISTRATION_TYPE);
-/**
-* The HMAC-SHA256 key HKDF-SHA256 derives from `material` under `info`
-* with an empty salt, imported non-extractable, so the key bytes never
-* exist outside it.
-*/
-const hmacKey = async (material, info) => {
-	const key = await crypto.subtle.importKey("raw", material, "HKDF", false, ["deriveKey"]);
-	return crypto.subtle.deriveKey({
-		name: "HKDF",
-		hash: "SHA-256",
-		salt: new Uint8Array(0),
-		info
-	}, key, {
-		name: "HMAC",
-		hash: "SHA-256",
-		length: KEY_LENGTH * 8
-	}, false, ["sign"]);
-};
-/**
-* The AES-256-GCM key HKDF-SHA256 derives from `material` under `info`,
-* imported non-extractable, so the key bytes never exist outside it.
-*/
-const aeadKey = async (material, info) => {
-	const key = await crypto.subtle.importKey("raw", material, "HKDF", false, ["deriveKey"]);
-	return crypto.subtle.deriveKey({
-		name: "HKDF",
-		hash: "SHA-256",
-		salt: new Uint8Array(0),
-		info
-	}, key, {
-		name: "AES-GCM",
-		length: KEY_LENGTH * 8
-	}, false, ["encrypt", "decrypt"]);
-};
-/** A fresh AEAD nonce. */
-const freshNonce = () => crypto.getRandomValues(new Uint8Array(NONCE_LENGTH));
-/**
-* The associated data of an entry: every byte before its AEAD tag, less
-* the recipient tag when it carries one, since that tag is computed over
-* the sealed entry and binds it in turn.
-*/
-const associatedData = ({ entry, nonceOffset, isTagged }) => {
-	const tagOffset = nonceOffset + NONCE_LENGTH;
-	return isTagged ? concat(entry.subarray(0, RECIPIENT_TAG_OFFSET), entry.subarray(RECIPIENT_TAG_END, tagOffset)) : entry.slice(0, tagOffset);
-};
-/**
-* Encrypts `plaintext` into `entry` behind its header: the AEAD tag
-* after the nonce the entry already holds at `nonceOffset`, and the
-* ciphertext after that, with the header as associated data, see
-* {@link associatedData}, so the header must be complete before this
-* runs, its recipient tag aside.
-*/
-const sealInto = async ({ key, entry, nonceOffset, isTagged, plaintext }) => {
-	const nonce = entry.slice(nonceOffset, nonceOffset + NONCE_LENGTH);
-	const tagOffset = nonceOffset + NONCE_LENGTH;
-	const sealed = new Uint8Array(await crypto.subtle.encrypt({
-		name: "AES-GCM",
-		iv: nonce,
-		additionalData: associatedData({
-			entry,
-			nonceOffset,
-			isTagged
-		}),
-		tagLength: AEAD_TAG_BITS
-	}, key, plaintext));
-	entry.set(sealed.subarray(plaintext.length), tagOffset);
-	entry.set(sealed.subarray(0, plaintext.length), tagOffset + TAG_LENGTH);
-};
-/**
-* Decrypts the ciphertext behind an entry's header, or null when the
-* authentication fails or the padding after the ciphertext is not zero.
-*/
-const openFrom = async ({ key, entry, nonceOffset, isTagged, plaintextLength }) => {
-	const tagOffset = nonceOffset + NONCE_LENGTH;
-	const ciphertextOffset = tagOffset + TAG_LENGTH;
-	if (!isZero(entry.subarray(ciphertextOffset + plaintextLength))) return null;
-	try {
-		return new Uint8Array(await crypto.subtle.decrypt({
-			name: "AES-GCM",
-			iv: entry.slice(nonceOffset, tagOffset),
-			additionalData: associatedData({
-				entry,
-				nonceOffset,
-				isTagged
-			}),
-			tagLength: AEAD_TAG_BITS
-		}, key, concat(entry.subarray(ciphertextOffset, ciphertextOffset + plaintextLength), entry.subarray(tagOffset, ciphertextOffset))));
-	} catch {
-		return null;
-	}
-};
-/**
-* The recipient tag of a device envelope: SHA-256 over the tag domain,
-* the type and suite bytes, the reader public key and every byte after
-* the tag, the ephemeral key, the nonce, the AEAD tag, the ciphertext
-* and the padding. A reader finds its envelopes by recomputing it, so
-* an entry that copies a genuine envelope's tag with any other byte
-* changed is not taken for one, and writing an entry that is takes the
-* reader public key. Two envelopes to the same reader share nothing on
-* chain, since each carries its own ephemeral key.
-*/
-const envelopeTag = (readerPublicKey, entry) => sha256(concat(ENVELOPE_TAG_DOMAIN, entry.subarray(0, RECIPIENT_TAG_OFFSET), readerPublicKey, entry.subarray(RECIPIENT_TAG_END)));
-/** Whether an entry is a device envelope addressed to this reader public key. */
-const isAddressedTo = (entry, readerPublicKey) => isRecordOf(entry, DEVICE_ENVELOPE_TYPE) && equalBytes(entry.subarray(RECIPIENT_TAG_OFFSET, RECIPIENT_TAG_END), envelopeTag(readerPublicKey, entry));
-/**
-* Every envelope in an inbox addressed to this device, newest first: the
-* ones a keyring carries. Anyone who knows a reader key can append
-* envelopes tagged for it, so none is left out, and the live one is
-* found however many land after it, at the cost of opening each.
-*/
-const deviceEnvelopes = (entries, readerPublicKey) => entries.filter((entry) => isAddressedTo(entry, readerPublicKey)).reverse();
-/**
-* The AES-256-GCM key of one envelope: HKDF-SHA256 over the X25519 shared
-* secret, zeroed once the key is derived.
-*/
-const envelopeKey = async (shared) => {
-	try {
-		return await aeadKey(shared, ENVELOPE_KEY_INFO);
-	} finally {
-		shared.fill(0);
-	}
-};
-/**
-* Seals the account secret and the roster key to one device's reader key
-* as a device envelope: [0] type, [1] suite, [2..34) recipient tag,
-* [34..66) ephemeral X25519 public key, [66..78) nonce, [78..94) AEAD
-* tag, [94..158) the secret then the roster key, encrypted, and zero
-* padding to 192 bytes. The key is agreed between a fresh ephemeral key
-* and the reader key, everything before the AEAD tag but the recipient
-* tag is associated data, and the recipient tag, computed last, covers
-* the whole sealed envelope. The envelope carries no round or
-* `enc_key`: a reader trusts the secret only once it derives the
-* `enc_key` the ledger holds. The ephemeral secret is zeroed before this
-* returns.
-*/
-const sealDeviceEnvelope = async (readerPublicKey, { secret, rosterKey }) => {
-	const ephemeral = x25519.keygen();
-	const plaintext = concat(secret, rosterKey);
-	const entry = new Uint8Array(192);
-	entry[0] = DEVICE_ENVELOPE_TYPE;
-	entry[1] = SUITE;
-	entry.set(ephemeral.publicKey, ENVELOPE_EPHEMERAL_OFFSET);
-	entry.set(freshNonce(), ENVELOPE_NONCE_OFFSET);
-	try {
-		await sealInto({
-			key: await envelopeKey(x25519.getSharedSecret(ephemeral.secretKey, readerPublicKey)),
-			entry,
-			nonceOffset: ENVELOPE_NONCE_OFFSET,
-			isTagged: true,
-			plaintext
-		});
-		entry.set(envelopeTag(readerPublicKey, entry), RECIPIENT_TAG_OFFSET);
-		return entry;
-	} finally {
-		ephemeral.secretKey.fill(0);
-		plaintext.fill(0);
-	}
-};
-/**
-* Opens a device envelope with this device's reader secret. Resolves the
-* account secret and roster key it delivers, which the caller zeroes once
-* used, or null for an entry that is not an envelope, is addressed to
-* another reader or fails to authenticate.
-*/
-const openDeviceEnvelope = async (readerSecret, entry) => {
-	if (!isAddressedTo(entry, x25519.getPublicKey(readerSecret))) return null;
-	let key;
-	try {
-		key = await envelopeKey(x25519.getSharedSecret(readerSecret, entry.slice(ENVELOPE_EPHEMERAL_OFFSET, ENVELOPE_NONCE_OFFSET)));
-	} catch {
-		return null;
-	}
-	const plaintext = await openFrom({
-		key,
-		entry,
-		nonceOffset: ENVELOPE_NONCE_OFFSET,
-		isTagged: true,
-		plaintextLength: ENVELOPE_PLAINTEXT_LENGTH
-	});
-	if (!plaintext) return null;
-	try {
-		return {
-			secret: plaintext.slice(0, KEY_LENGTH),
-			rosterKey: plaintext.slice(KEY_LENGTH)
-		};
-	} finally {
-		plaintext.fill(0);
-	}
-};
-/**
-* Seals one enrolled device's reader and device keys under the roster key
-* as a device registration: [0] type, [1] suite, [2..14) nonce, [14..30)
-* AEAD tag, [30..94) the reader key then the device key, encrypted, and
-* zero padding to 192 bytes. Only a holder of the roster key, an enrolled
-* device, can write one that opens, and nothing on chain tells whose it
-* is.
-*/
-const sealDeviceRegistration = async (rosterKey, { readerPublicKey, devicePublicKey }) => {
-	const entry = new Uint8Array(192);
-	entry[0] = DEVICE_REGISTRATION_TYPE;
-	entry[1] = SUITE;
-	entry.set(freshNonce(), REGISTRATION_NONCE_OFFSET);
-	await sealInto({
-		key: await aeadKey(rosterKey, REGISTRATION_KEY_INFO),
-		entry,
-		nonceOffset: REGISTRATION_NONCE_OFFSET,
-		isTagged: false,
-		plaintext: concat(ByteArray.fromHex(HexBytes(readerPublicKey)), ByteArray.fromHex(HexBytes(devicePublicKey)))
-	});
-	return entry;
-};
-/**
-* Opens a device registration with the roster key: the device it names,
-* or null for an entry that is not a registration or was written under
-* another roster key.
-*/
-const openDeviceRegistration = async (rosterKey, entry) => {
-	if (!isRecordOf(entry, DEVICE_REGISTRATION_TYPE)) return null;
-	const plaintext = await openFrom({
-		key: await aeadKey(rosterKey, REGISTRATION_KEY_INFO),
-		entry,
-		nonceOffset: REGISTRATION_NONCE_OFFSET,
-		isTagged: false,
-		plaintextLength: REGISTRATION_PLAINTEXT_LENGTH
-	});
-	return plaintext && {
-		readerPublicKey: HexBytes.fromByteArray(plaintext.slice(0, KEY_LENGTH)),
-		devicePublicKey: HexBytes.fromByteArray(plaintext.slice(KEY_LENGTH))
-	};
-};
-/**
-* The keys of this device's grant records on one account, both derived
-* from its reader secret with the account address in the label: the
-* AES-256-GCM key and the key its recipient tags are computed under, so
-* only this device writes a record that opens or recognises one as its
-* own, and a record copied from another account is neither.
-*/
-const recordKeys = async (readerSecret, account) => {
-	const accountBytes = ByteArray.fromHex(HexBytes(account));
-	return {
-		key: await aeadKey(readerSecret, concat(RECORD_KEY_INFO, accountBytes)),
-		tagKey: await hmacKey(readerSecret, concat(RECORD_TAG_KEY_INFO, accountBytes))
-	};
-};
-/**
-* The recipient tag of a grant record: HMAC-SHA256 under the tag key
-* over the type and suite bytes and every byte after the tag, the
-* nonce, the AEAD tag and the ciphertext, so a copied tag with any other
-* byte changed is not taken for this device's.
-*/
-const recordTag = async (tagKey, entry) => new Uint8Array(await crypto.subtle.sign("HMAC", tagKey, concat(entry.subarray(0, RECIPIENT_TAG_OFFSET), entry.subarray(RECIPIENT_TAG_END))));
-const encodeAmount = (value) => {
-	const bytes = new Uint8Array(MAX_COIN_VALUE_LENGTH);
-	let remaining = BigInt(value);
-	for (let index = MAX_COIN_VALUE_LENGTH - 1; index >= 0; index -= 1) {
-		bytes[index] = Number(remaining & BYTE_MASK);
-		remaining >>= BYTE_BITS;
-	}
-	return bytes;
-};
-const decodeAmount = (bytes) => bytes.reduce((value, byte) => value << BYTE_BITS | BigInt(byte), 0n).toString();
-const hexBytes = (hex) => ByteArray.fromHex(HexBytes(hex));
-const encodeRecipient = (recipient) => concat(Uint8Array.of(Number(RECIPIENT_KINDS[recipient.kind])), recipient.kind === "any" ? new Uint8Array(KEY_LENGTH) : hexBytes(recipient.value));
-const RECIPIENT_BY_KIND = new Map(Object.entries(RECIPIENT_KINDS).map(([kind, value]) => [Number(value), kind]));
-const decodeRecipient = (bytes) => {
-	const kind = RECIPIENT_BY_KIND.get(bytes[0]);
-	const value = bytes.subarray(1);
-	if (kind === void 0) return null;
-	if (kind === "any") return isZero(value) ? { kind } : null;
-	return {
-		kind,
-		value: HexBytes.fromByteArray(value)
-	};
-};
-/** The part byte of an object or a view part, which take one value each. */
-const partByteOf = (part) => RECORD_PART_KINDS.findIndex((kind) => kind.part === part);
-/**
-* The grantee field of a grant part and the part byte that names how it
-* reads back, see {@link RecordPartKind}.
-*
-* @throws Error when the key is not in a form the record holds: a 32-byte
-* jubjub key, or a 33-byte compressed secp256k1 key prefixed 02 or 03.
-*/
-const encodeGrantee = (part) => {
-	const key = hexBytes(part.granteePublicKey);
-	const keyPrefix = part.granteeScheme === "secp256k1-ecdsa" ? key[0] : void 0;
-	const field = keyPrefix === void 0 ? key : key.subarray(1);
-	const partByte = RECORD_PART_KINDS.findIndex((kind) => kind.part === "grant" && kind.granteeScheme === part.granteeScheme && kind.keyPrefix === keyPrefix);
-	if (partByte < 0 || field.length !== KEY_LENGTH) throw new Error(`Grant record cannot carry this '${part.granteeScheme}' grantee key`);
-	return {
-		partByte,
-		field
-	};
-};
-/**
-* The plaintext of one grant record part, 130 bytes: the part byte and
-* the grant id, then for a grant the slot, the scope salt, the grantee
-* field and the read key (zero for none); for an object the colour, the
-* recipient kind and value, and the coin bound as a big-endian 128-bit
-* integer; for a view the leading bytes of `enc_key` and the 94-byte
-* seal; zero padding after. The part byte of a grant also names the form
-* of its grantee key, see {@link RecordPartKind}, and a grant part whose
-* grantee the format cannot hold is refused before anything is written.
-*/
-const encodeRecordPart = (part) => {
-	const plaintext = new Uint8Array(RECORD_PLAINTEXT_LENGTH);
-	plaintext.set(hexBytes(part.grantId), 1);
-	const body = 1 + KEY_LENGTH;
-	switch (part.part) {
-		case "grant": {
-			const { partByte, field } = encodeGrantee(part);
-			plaintext[0] = partByte;
-			plaintext[body] = part.slot;
-			plaintext.set(hexBytes(part.scopeSalt), body + 1);
-			plaintext.set(field, body + 1 + KEY_LENGTH);
-			if (part.readPublicKey !== void 0) plaintext.set(hexBytes(part.readPublicKey), body + 1 + KEY_LENGTH * 2);
-			return plaintext;
-		}
-		case "object":
-			plaintext[0] = partByteOf(part.part);
-			plaintext.set(hexBytes(part.object.color), body);
-			plaintext.set(encodeRecipient(part.object.recipient), body + KEY_LENGTH);
-			plaintext.set(encodeAmount(part.object.maxCoinValue), body + KEY_LENGTH * 2 + 1);
-			return plaintext;
-		case "view":
-			plaintext[0] = partByteOf(part.part);
-			plaintext.set(hexBytes(part.encKeyPrefix), body);
-			plaintext.set(hexBytes(part.seal), body + 3);
-			return plaintext;
-	}
-};
-const decodeObject = (body) => {
-	const recipient = decodeRecipient(body.subarray(KEY_LENGTH, KEY_LENGTH * 2 + 1));
-	const amountOffset = KEY_LENGTH * 2 + 1;
-	if (!recipient || !isZero(body.subarray(amountOffset + MAX_COIN_VALUE_LENGTH))) return null;
-	return {
-		color: HexBytes.fromByteArray(body.subarray(0, KEY_LENGTH)),
-		recipient,
-		maxCoinValue: decodeAmount(body.subarray(amountOffset, amountOffset + MAX_COIN_VALUE_LENGTH))
-	};
-};
-/** Reads a grant record part back, or null for a plaintext no writer produces. */
-const decodeRecordPart = (plaintext) => {
-	const kind = RECORD_PART_KINDS.at(plaintext[0]);
-	if (!kind) return null;
-	const grantId = GrantId(HexBytes.fromByteArray(plaintext.slice(1, 33)));
-	const body = plaintext.subarray(1 + KEY_LENGTH);
-	switch (kind.part) {
-		case "grant": {
-			const field = body.subarray(1 + KEY_LENGTH, 1 + KEY_LENGTH * 2);
-			const readKey = body.subarray(1 + KEY_LENGTH * 2);
-			return {
-				part: kind.part,
-				grantId,
-				slot: GrantSlot(body[0]),
-				scopeSalt: GrantScopeSalt(HexBytes.fromByteArray(body.subarray(1, 1 + KEY_LENGTH))),
-				granteeScheme: kind.granteeScheme,
-				granteePublicKey: HexBytes.fromByteArray(kind.keyPrefix === void 0 ? field : concat(Uint8Array.of(kind.keyPrefix), field)),
-				...isZero(readKey) ? {} : { readPublicKey: HexBytes.fromByteArray(readKey) }
-			};
-		}
-		case "object": {
-			const object = decodeObject(body);
-			return object && {
-				part: kind.part,
-				grantId,
-				object
-			};
-		}
-		case "view": return {
-			part: kind.part,
-			grantId,
-			encKeyPrefix: HexBytes.fromByteArray(body.subarray(0, 3)),
-			seal: HexBytes.fromByteArray(body.subarray(3, 97))
-		};
-	}
-};
-/**
-* Seals one part of a grant's bookkeeping for this device alone as a
-* grant record: [0] type, [1] suite, [2..34) recipient tag, [34..46)
-* nonce, [46..62) AEAD tag, [62..192) the 130-byte part, encrypted, with
-* everything before the AEAD tag but the recipient tag as associated
-* data. The key and the tag key are derived from this device's reader
-* secret and the account, so only this device writes a record that opens
-* and recognises its own on that account, and the tag, computed last
-* over the whole sealed record and its fresh nonce, links no two
-* records.
-*/
-const sealGrantRecord = async (readerSecret, account, part) => {
-	const { key, tagKey } = await recordKeys(readerSecret, account);
-	const plaintext = encodeRecordPart(part);
-	const entry = new Uint8Array(192);
-	entry[0] = GRANT_RECORD_TYPE;
-	entry[1] = SUITE;
-	entry.set(freshNonce(), RECORD_NONCE_OFFSET);
-	try {
-		await sealInto({
-			key,
-			entry,
-			nonceOffset: RECORD_NONCE_OFFSET,
-			isTagged: true,
-			plaintext
-		});
-		entry.set(await recordTag(tagKey, entry), RECIPIENT_TAG_OFFSET);
-		return entry;
-	} finally {
-		plaintext.fill(0);
-	}
-};
-/**
-* Opens a grant record of one account with this device's reader secret:
-* the part it holds, or null for an entry that is not a grant record,
-* carries another device's or another account's tag, fails to
-* authenticate or decodes to no part.
-*/
-const openGrantRecord = async (readerSecret, account, entry) => {
-	if (!isRecordOf(entry, GRANT_RECORD_TYPE)) return null;
-	const { key, tagKey } = await recordKeys(readerSecret, account);
-	if (!equalBytes(await recordTag(tagKey, entry), entry.subarray(RECIPIENT_TAG_OFFSET, RECIPIENT_TAG_END))) return null;
-	const plaintext = await openFrom({
-		key,
-		entry,
-		nonceOffset: RECORD_NONCE_OFFSET,
-		isTagged: true,
-		plaintextLength: RECORD_PLAINTEXT_LENGTH
-	});
-	if (!plaintext) return null;
-	try {
-		return decodeRecordPart(plaintext);
-	} catch {
-		return null;
-	} finally {
-		plaintext.fill(0);
-	}
-};
-//#endregion
-export { x25519 as _, isDeviceRegistration as a, openDeviceRegistration as c, sealDeviceRegistration as d, sealGrantRecord as f, sealInboxEntry as g, openInboxEntry as h, isAddressedTo as i, openGrantRecord as l, MAX_INBOX_ENTRIES_PER_REQUEST as m, deviceEnvelopes as n, isLaceRecord as o, sealGrantView as p, encodeDevicePublicKey as r, openDeviceEnvelope as s, decodeDevicePublicKey as t, sealDeviceEnvelope as u };