@laceio/sdk 0.1.1 → 0.1.2-canary.0

package/dist/envelopes-CH25R-DN.cjs

@@ -0,0 +1,1722 @@
+const require_bytes_vo = require("./bytes.vo-BNRquqaO.cjs");
+const require_errors = require("./errors-BIftM8ZN.cjs");
+const require_grant_rules = require("./grant-rules-BzVTWXS7.cjs");
+//#region ../../packages/module/passport-account/node_modules/@noble/curves/abstract/montgomery.js
+/**
+* Montgomery curve methods. It's not really whole montgomery curve,
+* just bunch of very specific methods for X25519 / X448 from
+* [RFC 7748](https://www.rfc-editor.org/rfc/rfc7748)
+* @module
+*/
+/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
+const _0n$1 = BigInt(0);
+const _1n$1 = BigInt(1);
+const _2n$1 = BigInt(2);
+function validateOpts(curve) {
+	require_grant_rules.validateObject(curve, {
+		P: "bigint",
+		type: "string",
+		adjustScalarBytes: "function",
+		powPminus2: "function"
+	}, { randomBytes: "function" });
+	return Object.freeze({ ...curve });
+}
+/**
+* @param curveDef - Montgomery curve definition.
+* @returns ECDH helper namespace.
+* @throws If the curve definition or derived shared point is invalid. {@link Error}
+* @example
+* Perform one X25519 key exchange through the generic Montgomery helper.
+*
+* ```ts
+* import { x25519 } from '@noble/curves/ed25519.js';
+* const alice = x25519.keygen();
+* const shared = x25519.getSharedSecret(alice.secretKey, alice.publicKey);
+* ```
+*/
+function montgomery(curveDef) {
+	const { P, type, adjustScalarBytes, powPminus2, randomBytes: rand } = validateOpts(curveDef);
+	const is25519 = type === "x25519";
+	if (!is25519 && type !== "x448") throw new Error("invalid type");
+	const randomBytes_ = rand === void 0 ? require_grant_rules.randomBytes : rand;
+	const montgomeryBits = is25519 ? 255 : 448;
+	const fieldLen = is25519 ? 32 : 56;
+	const Gu = is25519 ? BigInt(9) : BigInt(5);
+	const a24 = is25519 ? BigInt(121665) : BigInt(39081);
+	const minScalar = is25519 ? _2n$1 ** BigInt(254) : _2n$1 ** BigInt(447);
+	const maxScalar = minScalar + (is25519 ? BigInt(8) * _2n$1 ** BigInt(251) - _1n$1 : BigInt(4) * _2n$1 ** BigInt(445) - _1n$1) + _1n$1;
+	const modP = (n) => require_grant_rules.mod(n, P);
+	const GuBytes = encodeU(Gu);
+	function encodeU(u) {
+		return require_grant_rules.numberToBytesLE(modP(u), fieldLen);
+	}
+	function decodeU(u) {
+		const _u = require_grant_rules.copyBytes(require_grant_rules.abytes(u, fieldLen, "uCoordinate"));
+		if (is25519) _u[31] &= 127;
+		return modP(require_grant_rules.bytesToNumberLE(_u));
+	}
+	function decodeScalar(scalar) {
+		return require_grant_rules.bytesToNumberLE(adjustScalarBytes(require_grant_rules.copyBytes(require_grant_rules.abytes(scalar, fieldLen, "scalar"))));
+	}
+	function scalarMult(scalar, u) {
+		const pu = montgomeryLadder(decodeU(u), decodeScalar(scalar));
+		if (pu === _0n$1) throw new Error("invalid private or public key received");
+		return encodeU(pu);
+	}
+	function scalarMultBase(scalar) {
+		return scalarMult(scalar, GuBytes);
+	}
+	const getPublicKey = scalarMultBase;
+	const getSharedSecret = scalarMult;
+	function cswap(swap, x_2, x_3) {
+		const dummy = modP(swap * (x_2 - x_3));
+		x_2 = modP(x_2 - dummy);
+		x_3 = modP(x_3 + dummy);
+		return {
+			x_2,
+			x_3
+		};
+	}
+	/**
+	* Montgomery x-only multiplication ladder for the selected X25519/X448 curve.
+	* @param pointU - decoded Montgomery u coordinate for the selected curve
+	* @param scalar - decoded clamped scalar by which the point is multiplied
+	* @returns resulting Montgomery u coordinate for the selected curve
+	*/
+	function montgomeryLadder(u, scalar) {
+		require_grant_rules.aInRange("u", u, _0n$1, P);
+		require_grant_rules.aInRange("scalar", scalar, minScalar, maxScalar);
+		const k = scalar;
+		const x_1 = u;
+		let x_2 = _1n$1;
+		let z_2 = _0n$1;
+		let x_3 = u;
+		let z_3 = _1n$1;
+		let swap = _0n$1;
+		for (let t = BigInt(montgomeryBits - 1); t >= _0n$1; t--) {
+			const k_t = k >> t & _1n$1;
+			swap ^= k_t;
+			({x_2, x_3} = cswap(swap, x_2, x_3));
+			({x_2: z_2, x_3: z_3} = cswap(swap, z_2, z_3));
+			swap = k_t;
+			const A = x_2 + z_2;
+			const AA = modP(A * A);
+			const B = x_2 - z_2;
+			const BB = modP(B * B);
+			const E = AA - BB;
+			const C = x_3 + z_3;
+			const DA = modP((x_3 - z_3) * A);
+			const CB = modP(C * B);
+			const dacb = DA + CB;
+			const da_cb = DA - CB;
+			x_3 = modP(dacb * dacb);
+			z_3 = modP(x_1 * modP(da_cb * da_cb));
+			x_2 = modP(AA * BB);
+			z_2 = modP(E * (AA + modP(a24 * E)));
+		}
+		({x_2, x_3} = cswap(swap, x_2, x_3));
+		({x_2: z_2, x_3: z_3} = cswap(swap, z_2, z_3));
+		const z2 = powPminus2(z_2);
+		return modP(x_2 * z2);
+	}
+	const lengths = {
+		secretKey: fieldLen,
+		publicKey: fieldLen,
+		seed: fieldLen
+	};
+	const randomSecretKey = (seed) => {
+		seed = seed === void 0 ? randomBytes_(fieldLen) : seed;
+		require_grant_rules.abytes(seed, lengths.seed, "seed");
+		return seed;
+	};
+	const utils = { randomSecretKey };
+	Object.freeze(lengths);
+	Object.freeze(utils);
+	return Object.freeze({
+		keygen: require_grant_rules.createKeygen(randomSecretKey, getPublicKey),
+		getSharedSecret,
+		getPublicKey,
+		scalarMult,
+		scalarMultBase,
+		utils,
+		GuBytes: GuBytes.slice(),
+		lengths
+	});
+}
+//#endregion
+//#region ../../packages/module/passport-account/node_modules/@noble/curves/abstract/oprf.js
+/**
+* RFC 9497: Oblivious Pseudorandom Functions (OPRFs) Using Prime-Order Groups.
+* https://www.rfc-editor.org/rfc/rfc9497
+*
+
+OPRF allows to interactively create an `Output = PRF(Input, serverSecretKey)`:
+
+- Server cannot calculate Output by itself: it doesn't know Input
+- Client cannot calculate Output by itself: it doesn't know server secretKey
+- An attacker interception the communication can't restore Input/Output/serverSecretKey and can't
+link Input to some value.
+
+## Issues
+
+- Low-entropy inputs (e.g. password '123') enable brute-forced dictionary attacks by the server
+(solveable by domain separation in POPRF)
+- High-level protocol needs to be constructed on top, because OPRF is low-level
+
+## Use cases
+
+1. **Password-Authenticated Key Exchange (PAKE):** Enables secure password login (e.g., OPAQUE)
+without revealing the password to the server.
+2. **Private Set Intersection (PSI):** Allows two parties to compute the intersection of their
+private sets without revealing non-intersecting elements.
+3. **Anonymous Credential Systems:** Supports issuance of anonymous, unlinkable credentials
+(e.g., Privacy Pass) using blind OPRF evaluation.
+4. **Private Information Retrieval (PIR):** Helps users query databases without revealing which
+item they accessed.
+5. **Encrypted Search / Secure Indexing:** Enables keyword search over encrypted data while keeping
+queries private.
+6. **Spam Prevention and Rate-Limiting:** Issues anonymous tokens to prevent abuse
+(e.g., CAPTCHA bypass) without compromising user privacy.
+
+## Modes
+
+- OPRF: simple mode, client doesn't need to know server public key
+- VOPRF: verifiable mode. It lets the client verify that the server used the
+secret key corresponding to a known public key
+- POPRF: partially oblivious mode, VOPRF + domain separation
+
+There is also non-interactive mode (Evaluate), which creates Output
+non-interactively with knowledge of the secret key.
+
+Flow:
+- (once) Server generates secret and public keys, distributes public keys to clients
+- deterministically: `deriveKeyPair` or just random: `generateKeyPair`
+- Client blinds input: `blind(secretInput)`
+- Server evaluates blinded input: `blindEvaluate` generated by client, sends result to client
+- Client creates output using result of evaluation via 'finalize'
+
+* @module
+*/
+/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
+const _DST_scalarBytes = /* @__PURE__ */ require_grant_rules.asciiToBytes(require_grant_rules._DST_scalar);
+/**
+* @param opts - OPRF ciphersuite options. See {@link OPRFOpts}.
+* @returns OPRF helper namespace.
+* @example
+* Instantiate an OPRF suite from curve-specific hashing hooks.
+*
+* ```ts
+* import { createOPRF } from '@noble/curves/abstract/oprf.js';
+* import { p256, p256_hasher } from '@noble/curves/nist.js';
+* import { sha256 } from '@noble/hashes/sha2.js';
+* const oprf = createOPRF({
+*   name: 'P256-SHA256',
+*   Point: p256.Point,
+*   hash: sha256,
+*   hashToGroup: p256_hasher.hashToCurve,
+*   hashToScalar: p256_hasher.hashToScalar,
+* });
+* const keys = oprf.oprf.generateKeyPair();
+* ```
+*/
+function createOPRF(opts) {
+	require_grant_rules.validateObject(opts, {
+		name: "string",
+		hash: "function",
+		hashToScalar: "function",
+		hashToGroup: "function"
+	});
+	require_grant_rules.validatePointCons(opts.Point);
+	const { name, Point, hash } = opts;
+	const { Fn } = Point;
+	const hashToGroup = (msg, ctx) => opts.hashToGroup(msg, { DST: require_grant_rules.concatBytes(require_grant_rules.asciiToBytes("HashToGroup-"), ctx) });
+	const hashToScalarPrefixed = (msg, ctx) => opts.hashToScalar(msg, { DST: require_grant_rules.concatBytes(_DST_scalarBytes, ctx) });
+	const randomScalar = (rng = require_grant_rules.randomBytes) => {
+		const t = require_grant_rules.mapHashToField(rng(require_grant_rules.getMinHashLength(Fn.ORDER)), Fn.ORDER, Fn.isLE);
+		return Fn.isLE ? require_grant_rules.bytesToNumberLE(t) : require_grant_rules.bytesToNumberBE(t);
+	};
+	const msm = (points, scalars) => require_grant_rules.pippenger(Point, points, scalars);
+	const getCtx = (mode) => require_grant_rules.concatBytes(require_grant_rules.asciiToBytes("OPRFV1-"), new Uint8Array([mode]), require_grant_rules.asciiToBytes("-" + name));
+	const ctxOPRF = getCtx(0);
+	const ctxVOPRF = getCtx(1);
+	const ctxPOPRF = getCtx(2);
+	function encode(...args) {
+		const res = [];
+		for (const a of args) if (typeof a === "number") res.push(require_grant_rules.numberToBytesBE(a, 2));
+		else if (typeof a === "string") res.push(require_grant_rules.asciiToBytes(a));
+		else {
+			require_grant_rules.abytes(a);
+			res.push(require_grant_rules.numberToBytesBE(a.length, 2), a);
+		}
+		return require_grant_rules.concatBytes(...res);
+	}
+	const inputBytes = (title, bytes) => {
+		require_grant_rules.abytes(bytes, void 0, title);
+		if (bytes.length > 65535) throw new Error(`"${title}" expected Uint8Array of length <= 65535, got length=${bytes.length}`);
+		return bytes;
+	};
+	const hashInput = (...bytes) => hash(encode(...bytes, "Finalize"));
+	function getTranscripts(B, C, D, ctx) {
+		const seed = hash(encode(B.toBytes(), require_grant_rules.concatBytes(require_grant_rules.asciiToBytes("Seed-"), ctx)));
+		const res = [];
+		for (let i = 0; i < C.length; i++) {
+			const Ci = C[i].toBytes();
+			const Di = D[i].toBytes();
+			const di = hashToScalarPrefixed(encode(seed, i, Ci, Di, "Composite"), ctx);
+			res.push(di);
+		}
+		return res;
+	}
+	function computeComposites(B, C, D, ctx) {
+		const T = getTranscripts(B, C, D, ctx);
+		return {
+			M: msm(C, T),
+			Z: msm(D, T)
+		};
+	}
+	function computeCompositesFast(k, B, C, D, ctx) {
+		const M = msm(C, getTranscripts(B, C, D, ctx));
+		return {
+			M,
+			Z: M.multiply(k)
+		};
+	}
+	function challengeTranscript(B, M, Z, t2, t3, ctx) {
+		const [Bm, a0, a1, a2, a3] = [
+			B,
+			M,
+			Z,
+			t2,
+			t3
+		].map((i) => i.toBytes());
+		return hashToScalarPrefixed(encode(Bm, a0, a1, a2, a3, "Challenge"), ctx);
+	}
+	function generateProof(ctx, k, B, C, D, rng) {
+		const { M, Z } = computeCompositesFast(k, B, C, D, ctx);
+		const r = randomScalar(rng);
+		const c = challengeTranscript(B, M, Z, Point.BASE.multiply(r), M.multiply(r), ctx);
+		return require_grant_rules.concatBytes(...[c, Fn.sub(r, Fn.mul(c, k))].map((i) => Fn.toBytes(i)));
+	}
+	function verifyProof(ctx, B, C, D, proof) {
+		require_grant_rules.abytes(proof, 2 * Fn.BYTES);
+		const { M, Z } = computeComposites(B, C, D, ctx);
+		const [c, s] = [proof.subarray(0, Fn.BYTES), proof.subarray(Fn.BYTES)].map((f) => Fn.fromBytes(f));
+		const expectedC = challengeTranscript(B, M, Z, Point.BASE.multiply(s).add(B.multiply(c)), M.multiply(s).add(Z.multiply(c)), ctx);
+		if (!Fn.eql(c, expectedC)) throw new Error("proof verification failed");
+	}
+	function generateKeyPair() {
+		const skS = randomScalar();
+		const pkS = Point.BASE.multiply(skS);
+		return {
+			secretKey: Fn.toBytes(skS),
+			publicKey: pkS.toBytes()
+		};
+	}
+	function deriveKeyPair(ctx, seed, info) {
+		require_grant_rules.abytes(seed, 32, "seed");
+		info = inputBytes("keyInfo", info);
+		const dst = require_grant_rules.concatBytes(require_grant_rules.asciiToBytes("DeriveKeyPair"), ctx);
+		const msg = require_grant_rules.concatBytes(seed, encode(info), Uint8Array.of(0));
+		for (let counter = 0; counter <= 255; counter++) {
+			msg[msg.length - 1] = counter;
+			const skS = opts.hashToScalar(msg, { DST: dst });
+			if (Fn.is0(skS)) continue;
+			return {
+				secretKey: Fn.toBytes(skS),
+				publicKey: Point.BASE.multiply(skS).toBytes()
+			};
+		}
+		throw new Error("Cannot derive key");
+	}
+	const wirePoint = (label, bytes) => {
+		const point = Point.fromBytes(bytes);
+		if (point.equals(Point.ZERO)) throw new Error(label + " point at infinity");
+		return point;
+	};
+	function blind(ctx, input, rng = require_grant_rules.randomBytes) {
+		input = inputBytes("input", input);
+		const blind = randomScalar(rng);
+		const inputPoint = hashToGroup(input, ctx);
+		if (inputPoint.equals(Point.ZERO)) throw new Error("Input point at infinity");
+		const blinded = inputPoint.multiply(blind);
+		return {
+			blind: Fn.toBytes(blind),
+			blinded: blinded.toBytes()
+		};
+	}
+	function evaluate(ctx, secretKey, input) {
+		input = inputBytes("input", input);
+		const skS = Fn.fromBytes(secretKey);
+		const inputPoint = hashToGroup(input, ctx);
+		if (inputPoint.equals(Point.ZERO)) throw new Error("Input point at infinity");
+		const unblinded = inputPoint.multiply(skS).toBytes();
+		return hashInput(input, unblinded);
+	}
+	const oprf = Object.freeze({
+		generateKeyPair,
+		deriveKeyPair: (seed, keyInfo) => deriveKeyPair(ctxOPRF, seed, keyInfo),
+		blind: (input, rng = require_grant_rules.randomBytes) => blind(ctxOPRF, input, rng),
+		blindEvaluate(secretKey, blindedPoint) {
+			const skS = Fn.fromBytes(secretKey);
+			return wirePoint("blinded", blindedPoint).multiply(skS).toBytes();
+		},
+		finalize(input, blindBytes, evaluatedBytes) {
+			input = inputBytes("input", input);
+			const blind = Fn.fromBytes(blindBytes);
+			const unblinded = wirePoint("evaluated", evaluatedBytes).multiply(Fn.inv(blind)).toBytes();
+			return hashInput(input, unblinded);
+		},
+		evaluate: (secretKey, input) => evaluate(ctxOPRF, secretKey, input)
+	});
+	const voprf = Object.freeze({
+		generateKeyPair,
+		deriveKeyPair: (seed, keyInfo) => deriveKeyPair(ctxVOPRF, seed, keyInfo),
+		blind: (input, rng = require_grant_rules.randomBytes) => blind(ctxVOPRF, input, rng),
+		blindEvaluateBatch(secretKey, publicKey, blinded, rng = require_grant_rules.randomBytes) {
+			if (!Array.isArray(blinded)) throw new Error("expected array");
+			const skS = Fn.fromBytes(secretKey);
+			const pkS = wirePoint("public key", publicKey);
+			const blindedPoints = blinded.map((i) => wirePoint("blinded", i));
+			const evaluated = blindedPoints.map((i) => i.multiply(skS));
+			const proof = generateProof(ctxVOPRF, skS, pkS, blindedPoints, evaluated, rng);
+			return {
+				evaluated: evaluated.map((i) => i.toBytes()),
+				proof
+			};
+		},
+		blindEvaluate(secretKey, publicKey, blinded, rng = require_grant_rules.randomBytes) {
+			const res = this.blindEvaluateBatch(secretKey, publicKey, [blinded], rng);
+			return {
+				evaluated: res.evaluated[0],
+				proof: res.proof
+			};
+		},
+		finalizeBatch(items, publicKey, proof) {
+			if (!Array.isArray(items)) throw new Error("expected array");
+			verifyProof(ctxVOPRF, wirePoint("public key", publicKey), items.map((i) => wirePoint("blinded", i.blinded)), items.map((i) => wirePoint("evaluated", i.evaluated)), proof);
+			return items.map((i) => oprf.finalize(i.input, i.blind, i.evaluated));
+		},
+		finalize(input, blind, evaluated, blinded, publicKey, proof) {
+			return this.finalizeBatch([{
+				input,
+				blind,
+				evaluated,
+				blinded
+			}], publicKey, proof)[0];
+		},
+		evaluate: (secretKey, input) => evaluate(ctxVOPRF, secretKey, input)
+	});
+	const poprf = (info) => {
+		info = inputBytes("info", info);
+		const m = hashToScalarPrefixed(encode("Info", info), ctxPOPRF);
+		const T = Point.BASE.multiply(m);
+		return Object.freeze({
+			generateKeyPair,
+			deriveKeyPair: (seed, keyInfo) => deriveKeyPair(ctxPOPRF, seed, keyInfo),
+			blind(input, publicKey, rng = require_grant_rules.randomBytes) {
+				input = inputBytes("input", input);
+				const pkS = wirePoint("public key", publicKey);
+				const tweakedKey = T.add(pkS);
+				if (tweakedKey.equals(Point.ZERO)) throw new Error("tweakedKey point at infinity");
+				const blind = randomScalar(rng);
+				const inputPoint = hashToGroup(input, ctxPOPRF);
+				if (inputPoint.equals(Point.ZERO)) throw new Error("Input point at infinity");
+				const blindedPoint = inputPoint.multiply(blind);
+				return {
+					blind: Fn.toBytes(blind),
+					blinded: blindedPoint.toBytes(),
+					tweakedKey: tweakedKey.toBytes()
+				};
+			},
+			blindEvaluateBatch(secretKey, blinded, rng = require_grant_rules.randomBytes) {
+				if (!Array.isArray(blinded)) throw new Error("expected array");
+				const skS = Fn.fromBytes(secretKey);
+				const t = Fn.add(skS, m);
+				const invT = Fn.inv(t);
+				const blindedPoints = blinded.map((i) => wirePoint("blinded", i));
+				const evalPoints = blindedPoints.map((i) => i.multiply(invT));
+				const proof = generateProof(ctxPOPRF, t, Point.BASE.multiply(t), evalPoints, blindedPoints, rng);
+				return {
+					evaluated: evalPoints.map((i) => i.toBytes()),
+					proof
+				};
+			},
+			blindEvaluate(secretKey, blinded, rng = require_grant_rules.randomBytes) {
+				const res = this.blindEvaluateBatch(secretKey, [blinded], rng);
+				return {
+					evaluated: res.evaluated[0],
+					proof: res.proof
+				};
+			},
+			finalizeBatch(items, proof, tweakedKey) {
+				if (!Array.isArray(items)) throw new Error("expected array");
+				const inputs = items.map((i) => inputBytes("input", i.input));
+				const evalPoints = items.map((i) => wirePoint("evaluated", i.evaluated));
+				verifyProof(ctxPOPRF, wirePoint("tweakedKey", tweakedKey), evalPoints, items.map((i) => wirePoint("blinded", i.blinded)), proof);
+				return items.map((i, j) => {
+					const blind = Fn.fromBytes(i.blind);
+					const point = evalPoints[j].multiply(Fn.inv(blind)).toBytes();
+					return hashInput(inputs[j], info, point);
+				});
+			},
+			finalize(input, blind, evaluated, blinded, proof, tweakedKey) {
+				return this.finalizeBatch([{
+					input,
+					blind,
+					evaluated,
+					blinded
+				}], proof, tweakedKey)[0];
+			},
+			evaluate(secretKey, input) {
+				input = inputBytes("input", input);
+				const skS = Fn.fromBytes(secretKey);
+				const inputPoint = hashToGroup(input, ctxPOPRF);
+				if (inputPoint.equals(Point.ZERO)) throw new Error("Input point at infinity");
+				const t = Fn.add(skS, m);
+				const invT = Fn.inv(t);
+				const unblinded = inputPoint.multiply(invT).toBytes();
+				return hashInput(input, info, unblinded);
+			}
+		});
+	};
+	const res = {
+		name,
+		oprf,
+		voprf,
+		poprf,
+		__tests: Object.freeze({ Fn })
+	};
+	return Object.freeze(res);
+}
+//#endregion
+//#region ../../packages/module/passport-account/node_modules/@noble/curves/ed25519.js
+/**
+* ed25519 Twisted Edwards curve with following addons:
+* - X25519 ECDH
+* - Ristretto cofactor elimination
+* - Elligator hash-to-group / point indistinguishability
+* @module
+*/
+/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
+const _0n = /* @__PURE__ */ BigInt(0), _1n = /* @__PURE__ */ BigInt(1), _2n = /* @__PURE__ */ BigInt(2), _3n = /* @__PURE__ */ BigInt(3);
+const _5n = /* @__PURE__ */ BigInt(5), _8n = /* @__PURE__ */ BigInt(8);
+const ed25519_CURVE_p = /* @__PURE__ */ BigInt("0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffed");
+const ed25519_CURVE = {
+	p: ed25519_CURVE_p,
+	n: BigInt("0x1000000000000000000000000000000014def9dea2f79cd65812631a5cf5d3ed"),
+	h: _8n,
+	a: BigInt("0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffec"),
+	d: BigInt("0x52036cee2b6ffe738cc740797779e89800700a4d4141d8ab75eb4dca135978a3"),
+	Gx: BigInt("0x216936d3cd6e53fec0a4e231fdd6dc5c692cc7609525a7b2c9562d608f25d51a"),
+	Gy: BigInt("0x6666666666666666666666666666666666666666666666666666666666666658")
+};
+function ed25519_pow_2_252_3(x) {
+	const _10n = BigInt(10), _20n = BigInt(20), _40n = BigInt(40), _80n = BigInt(80);
+	const P = ed25519_CURVE_p;
+	const b2 = x * x % P * x % P;
+	const b5 = require_grant_rules.pow2(require_grant_rules.pow2(b2, _2n, P) * b2 % P, _1n, P) * x % P;
+	const b10 = require_grant_rules.pow2(b5, _5n, P) * b5 % P;
+	const b20 = require_grant_rules.pow2(b10, _10n, P) * b10 % P;
+	const b40 = require_grant_rules.pow2(b20, _20n, P) * b20 % P;
+	const b80 = require_grant_rules.pow2(b40, _40n, P) * b40 % P;
+	return {
+		pow_p_5_8: require_grant_rules.pow2(require_grant_rules.pow2(require_grant_rules.pow2(require_grant_rules.pow2(b80, _80n, P) * b80 % P, _80n, P) * b80 % P, _10n, P) * b10 % P, _2n, P) * x % P,
+		b2
+	};
+}
+function adjustScalarBytes(bytes) {
+	bytes[0] &= 248;
+	bytes[31] &= 127;
+	bytes[31] |= 64;
+	return bytes;
+}
+const ED25519_SQRT_M1 = /* @__PURE__ */ BigInt("19681161376707505956807079304988542015446066515923890162744021073123829784752");
+function uvRatio(u, v) {
+	const P = ed25519_CURVE_p;
+	const v3 = require_grant_rules.mod(v * v * v, P);
+	const pow = ed25519_pow_2_252_3(u * require_grant_rules.mod(v3 * v3 * v, P)).pow_p_5_8;
+	let x = require_grant_rules.mod(u * v3 * pow, P);
+	const vx2 = require_grant_rules.mod(v * x * x, P);
+	const root1 = x;
+	const root2 = require_grant_rules.mod(x * ED25519_SQRT_M1, P);
+	const useRoot1 = vx2 === u;
+	const useRoot2 = vx2 === require_grant_rules.mod(-u, P);
+	const noRoot = vx2 === require_grant_rules.mod(-u * ED25519_SQRT_M1, P);
+	if (useRoot1) x = root1;
+	if (useRoot2 || noRoot) x = root2;
+	if (require_grant_rules.isNegativeLE(x, P)) x = require_grant_rules.mod(-x, P);
+	return {
+		isValid: useRoot1 || useRoot2,
+		value: x
+	};
+}
+const ed25519_Point = /* @__PURE__ */ require_grant_rules.edwards(ed25519_CURVE, { uvRatio });
+const Fp = ed25519_Point.Fp;
+const Fn = ed25519_Point.Fn;
+require_grant_rules.createFROST({
+	name: "FROST-ED25519-SHA512-v1",
+	Point: ed25519_Point,
+	validatePoint: (p) => {
+		p.assertValidity();
+		if (!p.isTorsionFree()) throw new Error("bad point: not torsion-free");
+	},
+	hash: require_grant_rules.sha512,
+	H2: ""
+});
+/**
+* ECDH using curve25519 aka x25519.
+* `getSharedSecret()` rejects low-order peer inputs by default, and seeded
+* `keygen(seed)` reuses the provided 32-byte seed buffer instead of copying it.
+* @example
+* Derive one shared secret between two X25519 peers.
+*
+* ```js
+* import { x25519 } from '@noble/curves/ed25519.js';
+* const alice = x25519.keygen();
+* const bob = x25519.keygen();
+* const shared = x25519.getSharedSecret(alice.secretKey, bob.publicKey);
+* ```
+*/
+const x25519 = /* @__PURE__ */ (() => {
+	const P = ed25519_CURVE_p;
+	return montgomery({
+		P,
+		type: "x25519",
+		powPminus2: (x) => {
+			const { pow_p_5_8, b2 } = ed25519_pow_2_252_3(x);
+			return require_grant_rules.mod(require_grant_rules.pow2(pow_p_5_8, _3n, P) * b2, P);
+		},
+		adjustScalarBytes
+	});
+})();
+const ELL2_C1 = (ed25519_CURVE_p + _3n) / _8n;
+const ELL2_C2 = Fp.pow(_2n, ELL2_C1);
+const ELL2_C3 = Fp.sqrt(Fp.neg(Fp.ONE));
+/**
+* RFC 9380 method `map_to_curve_elligator2_curve25519`. Experimental name: may be renamed later.
+* @private
+*/
+function _map_to_curve_elligator2_curve25519(u) {
+	const ELL2_C4 = (ed25519_CURVE_p - _5n) / _8n;
+	const ELL2_J = BigInt(486662);
+	let tv1 = Fp.sqr(u);
+	tv1 = Fp.mul(tv1, _2n);
+	let xd = Fp.add(tv1, Fp.ONE);
+	let x1n = Fp.neg(ELL2_J);
+	let tv2 = Fp.sqr(xd);
+	let gxd = Fp.mul(tv2, xd);
+	let gx1 = Fp.mul(tv1, ELL2_J);
+	gx1 = Fp.mul(gx1, x1n);
+	gx1 = Fp.add(gx1, tv2);
+	gx1 = Fp.mul(gx1, x1n);
+	let tv3 = Fp.sqr(gxd);
+	tv2 = Fp.sqr(tv3);
+	tv3 = Fp.mul(tv3, gxd);
+	tv3 = Fp.mul(tv3, gx1);
+	tv2 = Fp.mul(tv2, tv3);
+	let y11 = Fp.pow(tv2, ELL2_C4);
+	y11 = Fp.mul(y11, tv3);
+	let y12 = Fp.mul(y11, ELL2_C3);
+	tv2 = Fp.sqr(y11);
+	tv2 = Fp.mul(tv2, gxd);
+	let e1 = Fp.eql(tv2, gx1);
+	let y1 = Fp.cmov(y12, y11, e1);
+	let x2n = Fp.mul(x1n, tv1);
+	let y21 = Fp.mul(y11, u);
+	y21 = Fp.mul(y21, ELL2_C2);
+	let y22 = Fp.mul(y21, ELL2_C3);
+	let gx2 = Fp.mul(gx1, tv1);
+	tv2 = Fp.sqr(y21);
+	tv2 = Fp.mul(tv2, gxd);
+	let e2 = Fp.eql(tv2, gx2);
+	let y2 = Fp.cmov(y22, y21, e2);
+	tv2 = Fp.sqr(y1);
+	tv2 = Fp.mul(tv2, gxd);
+	let e3 = Fp.eql(tv2, gx1);
+	let xn = Fp.cmov(x2n, x1n, e3);
+	let y = Fp.cmov(y2, y1, e3);
+	let e4 = Fp.isOdd(y);
+	y = Fp.cmov(y, Fp.neg(y), e3 !== e4);
+	return {
+		xMn: xn,
+		xMd: xd,
+		yMn: y,
+		yMd: _1n
+	};
+}
+const ELL2_C1_EDWARDS = require_grant_rules.FpSqrtEven(Fp, Fp.neg(BigInt(486664)));
+function map_to_curve_elligator2_edwards25519(u) {
+	const { xMn, xMd, yMn, yMd } = _map_to_curve_elligator2_curve25519(u);
+	let xn = Fp.mul(xMn, yMd);
+	xn = Fp.mul(xn, ELL2_C1_EDWARDS);
+	let xd = Fp.mul(xMd, yMn);
+	let yn = Fp.sub(xMn, xMd);
+	let yd = Fp.add(xMn, xMd);
+	let tv1 = Fp.mul(xd, yd);
+	let e = Fp.eql(tv1, Fp.ZERO);
+	xn = Fp.cmov(xn, Fp.ZERO, e);
+	xd = Fp.cmov(xd, Fp.ONE, e);
+	yn = Fp.cmov(yn, Fp.ONE, e);
+	yd = Fp.cmov(yd, Fp.ONE, e);
+	const [xd_inv, yd_inv] = require_grant_rules.FpInvertBatch(Fp, [xd, yd], true);
+	return {
+		x: Fp.mul(xn, xd_inv),
+		y: Fp.mul(yn, yd_inv)
+	};
+}
+require_grant_rules.createHasher(ed25519_Point, (scalars) => map_to_curve_elligator2_edwards25519(scalars[0]), {
+	DST: "edwards25519_XMD:SHA-512_ELL2_RO_",
+	encodeDST: "edwards25519_XMD:SHA-512_ELL2_NU_",
+	p: ed25519_CURVE_p,
+	m: 1,
+	k: 128,
+	expand: "xmd",
+	hash: require_grant_rules.sha512
+});
+const SQRT_M1 = ED25519_SQRT_M1;
+const SQRT_AD_MINUS_ONE = /* @__PURE__ */ BigInt("25063068953384623474111414158702152701244531502492656460079210482610430750235");
+const INVSQRT_A_MINUS_D = /* @__PURE__ */ BigInt("54469307008909316920995813868745141605393597292927456921205312896311721017578");
+const ONE_MINUS_D_SQ = /* @__PURE__ */ BigInt("1159843021668779879193775521855586647937357759715417654439879720876111806838");
+const D_MINUS_ONE_SQ = /* @__PURE__ */ BigInt("40440834346308536858101042469323190826248399146238708352240133220865137265952");
+const invertSqrt = (number) => uvRatio(_1n, number);
+const MAX_255B = /* @__PURE__ */ BigInt("0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
+const bytes255ToNumberLE = (bytes) => Fp.create(require_grant_rules.bytesToNumberLE(bytes) & MAX_255B);
+/**
+* Computes Elligator map for Ristretto255.
+* Primary formula source is RFC 9496 §4.3.4 MAP; RFC 9380 Appendix B builds
+* `hash_to_ristretto255` on top of this helper.
+* Returns an internal Edwards representative, not a public `_RistrettoPoint`.
+*/
+function calcElligatorRistrettoMap(r0) {
+	const { d } = ed25519_CURVE;
+	const P = ed25519_CURVE_p;
+	const mod = (n) => Fp.create(n);
+	const r = mod(SQRT_M1 * r0 * r0);
+	const Ns = mod((r + _1n) * ONE_MINUS_D_SQ);
+	let c = BigInt(-1);
+	const D = mod((c - d * r) * mod(r + d));
+	let { isValid: Ns_D_is_sq, value: s } = uvRatio(Ns, D);
+	let s_ = mod(s * r0);
+	if (!require_grant_rules.isNegativeLE(s_, P)) s_ = mod(-s_);
+	if (!Ns_D_is_sq) s = s_;
+	if (!Ns_D_is_sq) c = r;
+	const Nt = mod(c * (r - _1n) * D_MINUS_ONE_SQ - D);
+	const s2 = s * s;
+	const W0 = mod((s + s) * D);
+	const W1 = mod(Nt * SQRT_AD_MINUS_ONE);
+	const W2 = mod(_1n - s2);
+	const W3 = mod(_1n + s2);
+	return new ed25519_Point(mod(W0 * W3), mod(W2 * W1), mod(W1 * W3), mod(W0 * W2));
+}
+/**
+* Wrapper over Edwards Point for ristretto255.
+*
+* Each ed25519/EdwardsPoint has 8 different equivalent points. This can be
+* a source of bugs for protocols like ring signatures. Ristretto was created to solve this.
+* Ristretto point operates in X:Y:Z:T extended coordinates like EdwardsPoint,
+* but it should work in its own namespace: do not combine those two.
+* See [RFC9496](https://www.rfc-editor.org/rfc/rfc9496).
+*/
+var _RistrettoPoint = class _RistrettoPoint extends require_grant_rules.PrimeEdwardsPoint {
+	static BASE = new _RistrettoPoint(ed25519_Point.BASE);
+	static ZERO = new _RistrettoPoint(ed25519_Point.ZERO);
+	static Fp = Fp;
+	static Fn = Fn;
+	constructor(ep) {
+		super(ep);
+	}
+	/**
+	* Create one Ristretto255 point from affine Edwards coordinates.
+	* This wraps the internal Edwards representative directly and is not a
+	* canonical ristretto255 decoding path.
+	* Use `toBytes()` / `fromBytes()` if canonical ristretto255 bytes matter.
+	*/
+	static fromAffine(ap) {
+		return new _RistrettoPoint(ed25519_Point.fromAffine(ap));
+	}
+	assertSame(other) {
+		if (!(other instanceof _RistrettoPoint)) throw new Error("RistrettoPoint expected");
+	}
+	init(ep) {
+		return new _RistrettoPoint(ep);
+	}
+	static fromBytes(bytes) {
+		require_grant_rules.abytes$1(bytes, 32);
+		const { a, d } = ed25519_CURVE;
+		const P = ed25519_CURVE_p;
+		const mod = (n) => Fp.create(n);
+		const s = bytes255ToNumberLE(bytes);
+		if (!require_grant_rules.equalBytes(Fp.toBytes(s), bytes) || require_grant_rules.isNegativeLE(s, P)) throw new Error("invalid ristretto255 encoding 1");
+		const s2 = mod(s * s);
+		const u1 = mod(_1n + a * s2);
+		const u2 = mod(_1n - a * s2);
+		const u1_2 = mod(u1 * u1);
+		const u2_2 = mod(u2 * u2);
+		const v = mod(a * d * u1_2 - u2_2);
+		const { isValid, value: I } = invertSqrt(mod(v * u2_2));
+		const Dx = mod(I * u2);
+		const Dy = mod(I * Dx * v);
+		let x = mod((s + s) * Dx);
+		if (require_grant_rules.isNegativeLE(x, P)) x = mod(-x);
+		const y = mod(u1 * Dy);
+		const t = mod(x * y);
+		if (!isValid || require_grant_rules.isNegativeLE(t, P) || y === _0n) throw new Error("invalid ristretto255 encoding 2");
+		return new _RistrettoPoint(new ed25519_Point(x, y, _1n, t));
+	}
+	/**
+	* Converts ristretto-encoded string to ristretto point.
+	* Described in [RFC9496](https://www.rfc-editor.org/rfc/rfc9496#name-decode).
+	* @param hex - Ristretto-encoded 32 bytes. Not every 32-byte string is valid ristretto encoding
+	*/
+	static fromHex(hex) {
+		return _RistrettoPoint.fromBytes(require_grant_rules.hexToBytes(hex));
+	}
+	/**
+	* Encodes ristretto point to Uint8Array.
+	* Described in [RFC9496](https://www.rfc-editor.org/rfc/rfc9496#name-encode).
+	*/
+	toBytes() {
+		let { X, Y, Z, T } = this.ep;
+		const P = ed25519_CURVE_p;
+		const mod = (n) => Fp.create(n);
+		const u1 = mod(mod(Z + Y) * mod(Z - Y));
+		const u2 = mod(X * Y);
+		const { value: invsqrt } = invertSqrt(mod(u1 * mod(u2 * u2)));
+		const D1 = mod(invsqrt * u1);
+		const D2 = mod(invsqrt * u2);
+		const zInv = mod(D1 * D2 * T);
+		let D;
+		if (require_grant_rules.isNegativeLE(T * zInv, P)) {
+			let _x = mod(Y * SQRT_M1);
+			let _y = mod(X * SQRT_M1);
+			X = _x;
+			Y = _y;
+			D = mod(D1 * INVSQRT_A_MINUS_D);
+		} else D = D2;
+		if (require_grant_rules.isNegativeLE(X * zInv, P)) Y = mod(-Y);
+		let s = mod((Z - Y) * D);
+		if (require_grant_rules.isNegativeLE(s, P)) s = mod(-s);
+		return Fp.toBytes(s);
+	}
+	/**
+	* Compares two Ristretto points.
+	* Described in [RFC9496](https://www.rfc-editor.org/rfc/rfc9496#name-equals).
+	*/
+	equals(other) {
+		this.assertSame(other);
+		const { X: X1, Y: Y1 } = this.ep;
+		const { X: X2, Y: Y2 } = other.ep;
+		const mod = (n) => Fp.create(n);
+		const one = mod(X1 * Y2) === mod(Y1 * X2);
+		const two = mod(Y1 * Y2) === mod(X1 * X2);
+		return one || two;
+	}
+	is0() {
+		return this.equals(_RistrettoPoint.ZERO);
+	}
+};
+Object.freeze(_RistrettoPoint.BASE);
+Object.freeze(_RistrettoPoint.ZERO);
+Object.freeze(_RistrettoPoint.prototype);
+Object.freeze(_RistrettoPoint);
+/**
+* Hashing to ristretto255 points / field. RFC 9380 methods.
+* `hashToCurve()` is RFC 9380 Appendix B, `deriveToCurve()` is the RFC 9496
+* §4.3.4 element-derivation building block, and `hashToScalar()` is a
+* library-specific helper for OPRF-style use.
+* @example
+* Hash one message onto ristretto255.
+*
+* ```ts
+* const point = ristretto255_hasher.hashToCurve(new TextEncoder().encode('hello noble'));
+* ```
+*/
+const ristretto255_hasher = Object.freeze({
+	Point: _RistrettoPoint,
+	hashToCurve(msg, options) {
+		const xmd = require_grant_rules.expand_message_xmd(msg, options?.DST === void 0 ? "ristretto255_XMD:SHA-512_R255MAP_RO_" : options.DST, 64, require_grant_rules.sha512);
+		return ristretto255_hasher.deriveToCurve(xmd);
+	},
+	hashToScalar(msg, options = { DST: require_grant_rules._DST_scalar }) {
+		const xmd = require_grant_rules.expand_message_xmd(msg, options.DST, 64, require_grant_rules.sha512);
+		return Fn.create(require_grant_rules.bytesToNumberLE(xmd));
+	},
+	deriveToCurve(bytes) {
+		require_grant_rules.abytes$1(bytes, 64);
+		const R1 = calcElligatorRistrettoMap(bytes255ToNumberLE(bytes.subarray(0, 32)));
+		const R2 = calcElligatorRistrettoMap(bytes255ToNumberLE(bytes.subarray(32, 64)));
+		return new _RistrettoPoint(R1.add(R2));
+	}
+});
+createOPRF({
+	name: "ristretto255-SHA512",
+	Point: _RistrettoPoint,
+	hash: require_grant_rules.sha512,
+	hashToGroup: ristretto255_hasher.hashToCurve,
+	hashToScalar: ristretto255_hasher.hashToScalar
+});
+require_grant_rules.createFROST({
+	name: "FROST-RISTRETTO255-SHA512-v1",
+	Point: _RistrettoPoint,
+	validatePoint: (p) => {
+		p.assertValidity();
+	},
+	hash: require_grant_rules.sha512
+});
+/**
+* The most inbox entries one open-inbox request carries, held by the
+* client that batches and the signer that answers alike: a busy inbox is
+* opened over several requests, so no single request holds the signer
+* decrypting without bound.
+*/
+const MAX_INBOX_ENTRIES_PER_REQUEST = 4096;
+const ENTRY_VERSION = 1;
+const ENTRY_SUITE = 1;
+const EPHEMERAL_KEY_OFFSET$1 = 2;
+const NONCE_OFFSET$1 = 34;
+const TAG_OFFSET$1 = 46;
+const CIPHERTEXT_OFFSET$1 = 62;
+const NONCE_LENGTH$2 = 12;
+const TAG_LENGTH$2 = 16;
+const KEY_LENGTH$2 = 32;
+const COIN_NONCE_LENGTH = 32;
+const COLOR_LENGTH = 32;
+const VALUE_LENGTH = 16;
+const PLAINTEXT_LENGTH = COIN_NONCE_LENGTH + COLOR_LENGTH + VALUE_LENGTH;
+const AEAD_TAG_BITS$2 = TAG_LENGTH$2 * 8;
+const VALUE_MAX = (1n << BigInt(VALUE_LENGTH * 8)) - 1n;
+const BYTE_BITS$1 = 8n;
+const BYTE_MASK$1 = 255n;
+const WRAPPING_KEY_INFO = new TextEncoder().encode("midnight:custody:inbox:v1");
+/**
+* The AES-256-GCM key that wraps one entry: HKDF-SHA256 over the X25519
+* shared secret with an empty salt and the fixed inbox label, imported
+* non-extractable so the key bytes never exist outside the shared secret,
+* which is zeroed once the key is derived.
+*/
+const wrappingKey = async (shared) => {
+	try {
+		const material = await crypto.subtle.importKey("raw", shared, "HKDF", false, ["deriveKey"]);
+		return await crypto.subtle.deriveKey({
+			name: "HKDF",
+			hash: "SHA-256",
+			salt: new Uint8Array(0),
+			info: WRAPPING_KEY_INFO
+		}, material, {
+			name: "AES-GCM",
+			length: KEY_LENGTH$2 * 8
+		}, false, ["encrypt", "decrypt"]);
+	} finally {
+		shared.fill(0);
+	}
+};
+const encodeValue = (value) => {
+	const bytes = new Uint8Array(VALUE_LENGTH);
+	let remaining = value;
+	for (let index = VALUE_LENGTH - 1; index >= 0; index -= 1) {
+		bytes[index] = Number(remaining & BYTE_MASK$1);
+		remaining >>= BYTE_BITS$1;
+	}
+	return bytes;
+};
+const decodeValue = (bytes) => bytes.reduce((value, byte) => value << BYTE_BITS$1 | BigInt(byte), 0n);
+const encodeCoin = ({ nonce, color, value }) => {
+	if (nonce.length !== COIN_NONCE_LENGTH || color.length !== COLOR_LENGTH) throw new Error(`An inbox coin description needs a ${COIN_NONCE_LENGTH}-byte nonce and a ${COLOR_LENGTH}-byte colour.`);
+	if (value < 0n || value > VALUE_MAX) throw new Error(`An inbox coin value must fit an unsigned 128-bit integer, got ${value}.`);
+	const plaintext = new Uint8Array(PLAINTEXT_LENGTH);
+	plaintext.set(nonce, 0);
+	plaintext.set(color, COIN_NONCE_LENGTH);
+	plaintext.set(encodeValue(value), COIN_NONCE_LENGTH + COLOR_LENGTH);
+	return plaintext;
+};
+const decodeCoin = (plaintext) => ({
+	nonce: plaintext.slice(0, COIN_NONCE_LENGTH),
+	color: plaintext.slice(COIN_NONCE_LENGTH, COIN_NONCE_LENGTH + COLOR_LENGTH),
+	value: decodeValue(plaintext.slice(COIN_NONCE_LENGTH + COLOR_LENGTH))
+});
+/**
+* Seals a coin description towards an account as an InboxEntry v1: the
+* plaintext is the coin nonce, colour and big-endian 128-bit value, wrapped
+* under a key agreed between a fresh ephemeral X25519 key and the
+* account's `enc_key`, with the version and suite bytes as associated
+* data; the trailing padding stays zero. The ephemeral secret is zeroed
+* before this returns.
+*/
+const sealInboxEntry = async (encPublicKey, coin) => {
+	const plaintext = encodeCoin(coin);
+	const ephemeral = x25519.keygen();
+	const entry = new Uint8Array(192);
+	entry[0] = ENTRY_VERSION;
+	entry[1] = ENTRY_SUITE;
+	try {
+		const key = await wrappingKey(x25519.getSharedSecret(ephemeral.secretKey, encPublicKey));
+		const nonce = crypto.getRandomValues(new Uint8Array(NONCE_LENGTH$2));
+		const sealed = new Uint8Array(await crypto.subtle.encrypt({
+			name: "AES-GCM",
+			iv: nonce,
+			additionalData: entry.slice(0, EPHEMERAL_KEY_OFFSET$1),
+			tagLength: AEAD_TAG_BITS$2
+		}, key, plaintext));
+		entry.set(ephemeral.publicKey, EPHEMERAL_KEY_OFFSET$1);
+		entry.set(nonce, NONCE_OFFSET$1);
+		entry.set(sealed.subarray(PLAINTEXT_LENGTH), TAG_OFFSET$1);
+		entry.set(sealed.subarray(0, PLAINTEXT_LENGTH), CIPHERTEXT_OFFSET$1);
+		return entry;
+	} finally {
+		ephemeral.secretKey.fill(0);
+		plaintext.fill(0);
+	}
+};
+/**
+* Opens an InboxEntry v1 with the account encryption secret. Resolves the
+* coin the entry describes, or null for an entry the inbox walk must skip
+* rather than fail on: one of another length, version or suite, one
+* sealed towards another key, or one whose authentication fails. The
+* contract accepts any bytes from anyone, so a null is noise, not an
+* error.
+*/
+const openInboxEntry = async (encSecret, entry) => {
+	if (entry.length !== 192 || entry[0] !== ENTRY_VERSION || entry[1] !== ENTRY_SUITE) return null;
+	try {
+		const key = await wrappingKey(x25519.getSharedSecret(encSecret, entry.slice(EPHEMERAL_KEY_OFFSET$1, NONCE_OFFSET$1)));
+		const sealed = new Uint8Array(PLAINTEXT_LENGTH + TAG_LENGTH$2);
+		sealed.set(entry.slice(CIPHERTEXT_OFFSET$1, CIPHERTEXT_OFFSET$1 + PLAINTEXT_LENGTH), 0);
+		sealed.set(entry.slice(TAG_OFFSET$1, CIPHERTEXT_OFFSET$1), PLAINTEXT_LENGTH);
+		const plaintext = new Uint8Array(await crypto.subtle.decrypt({
+			name: "AES-GCM",
+			iv: entry.slice(NONCE_OFFSET$1, TAG_OFFSET$1),
+			additionalData: entry.slice(0, EPHEMERAL_KEY_OFFSET$1),
+			tagLength: AEAD_TAG_BITS$2
+		}, key, sealed));
+		try {
+			return decodeCoin(plaintext);
+		} finally {
+			plaintext.fill(0);
+		}
+	} catch {
+		return null;
+	}
+};
+const SEAL_VERSION = 1;
+const SEAL_SUITE = 1;
+const EPHEMERAL_KEY_OFFSET = 2;
+const NONCE_OFFSET = 34;
+const TAG_OFFSET = 46;
+const CIPHERTEXT_OFFSET = 62;
+const NONCE_LENGTH$1 = 12;
+const TAG_LENGTH$1 = 16;
+const KEY_LENGTH$1 = 32;
+const SECRET_LENGTH = 32;
+const AEAD_TAG_BITS$1 = TAG_LENGTH$1 * 8;
+const VIEW_KEY_INFO = new TextEncoder().encode("midnight:account:grant:view:v1");
+const concat$1 = (...parts) => {
+	const joined = new Uint8Array(parts.reduce((length, part) => length + part.length, 0));
+	let offset = 0;
+	for (const part of parts) {
+		joined.set(part, offset);
+		offset += part.length;
+	}
+	return joined;
+};
+/**
+* The AES-256-GCM key that wraps one seal: HKDF-SHA256 over the X25519
+* shared secret with an empty salt and the view label followed by the
+* grant id, imported non-extractable; the shared secret is zeroed once
+* the key is derived.
+*/
+const sealingKey = async (shared, grantId) => {
+	try {
+		const material = await crypto.subtle.importKey("raw", shared, "HKDF", false, ["deriveKey"]);
+		return await crypto.subtle.deriveKey({
+			name: "HKDF",
+			hash: "SHA-256",
+			salt: new Uint8Array(0),
+			info: concat$1(VIEW_KEY_INFO, grantId)
+		}, material, {
+			name: "AES-GCM",
+			length: KEY_LENGTH$1 * 8
+		}, false, ["encrypt"]);
+	} finally {
+		shared.fill(0);
+	}
+};
+/**
+* Seals an account encryption secret towards a grantee's read key as a
+* GrantViewSeal v1: the secret is wrapped under a key agreed between a
+* fresh ephemeral X25519 key and the read key and derived with the grant
+* id in its label, with the version, suite, ephemeral key, grant id and
+* account as associated data, so the container opens only for that read
+* key, under that grant and for that account. A read key of small order
+* yields an all-zero shared secret, which the key agreement refuses. The
+* ephemeral secret is zeroed before this returns; the account secret is
+* the caller's to zero.
+*/
+const sealGrantView = async (encSecret, { grantId, account, readPublicKey }) => {
+	if (encSecret.length !== SECRET_LENGTH) throw new Error(`A grant view seals a ${SECRET_LENGTH}-byte secret, got ${encSecret.length} bytes.`);
+	const grantIdBytes = require_bytes_vo.ByteArray.fromHex(require_bytes_vo.HexBytes(grantId));
+	const accountBytes = require_bytes_vo.ByteArray.fromHex(require_bytes_vo.HexBytes(account));
+	const readKey = require_bytes_vo.ByteArray.fromHex(require_bytes_vo.HexBytes(readPublicKey));
+	const ephemeral = x25519.keygen();
+	const seal = new Uint8Array(94);
+	seal[0] = SEAL_VERSION;
+	seal[1] = SEAL_SUITE;
+	seal.set(ephemeral.publicKey, EPHEMERAL_KEY_OFFSET);
+	try {
+		const key = await sealingKey(x25519.getSharedSecret(ephemeral.secretKey, readKey), grantIdBytes);
+		const nonce = crypto.getRandomValues(new Uint8Array(NONCE_LENGTH$1));
+		const sealed = new Uint8Array(await crypto.subtle.encrypt({
+			name: "AES-GCM",
+			iv: nonce,
+			additionalData: concat$1(seal.slice(0, NONCE_OFFSET), grantIdBytes, accountBytes),
+			tagLength: AEAD_TAG_BITS$1
+		}, key, encSecret));
+		seal.set(nonce, NONCE_OFFSET);
+		seal.set(sealed.subarray(SECRET_LENGTH), TAG_OFFSET);
+		seal.set(sealed.subarray(0, SECRET_LENGTH), CIPHERTEXT_OFFSET);
+		return seal;
+	} finally {
+		ephemeral.secretKey.fill(0);
+	}
+};
+//#endregion
+//#region ../../packages/module/passport-account/src/acc/envelopes.ts
+/**
+* The Lace record kinds an Account Custody Contract inbox carries beside
+* the coin entries senders write: device envelopes, which deliver the
+* account secret and the roster key to one device's reader key; device
+* registrations, which name an enrolled device's reader and device keys
+* under the roster key; and grant records, which keep the bookkeeping of
+* a grant this device issued under a key only it derives. Each is one
+* 192-byte entry led by a type byte no custody standard reader knows, so
+* every other reader skips it as noise, and each opens to null rather
+* than an error when it is malformed, tampered with or addressed to
+* someone else, since anyone may append any bytes to the inbox.
+*/
+/** Type byte of a device envelope. */
+const DEVICE_ENVELOPE_TYPE = 209;
+/** Type byte of a device registration. */
+const DEVICE_REGISTRATION_TYPE = 210;
+/** Type byte of a grant record. */
+const GRANT_RECORD_TYPE = 211;
+const SUITE = 2;
+const KEY_LENGTH = 32;
+const NONCE_LENGTH = 12;
+const TAG_LENGTH = 16;
+const RECIPIENT_TAG_LENGTH = 32;
+const AEAD_TAG_BITS = TAG_LENGTH * 8;
+const MAX_COIN_VALUE_LENGTH = 16;
+const BYTE_BITS = 8n;
+const BYTE_MASK = 255n;
+const RECIPIENT_TAG_OFFSET = 2;
+const RECIPIENT_TAG_END = RECIPIENT_TAG_OFFSET + RECIPIENT_TAG_LENGTH;
+const ENVELOPE_EPHEMERAL_OFFSET = RECIPIENT_TAG_END;
+const ENVELOPE_NONCE_OFFSET = ENVELOPE_EPHEMERAL_OFFSET + KEY_LENGTH;
+const ENVELOPE_PLAINTEXT_LENGTH = KEY_LENGTH * 2;
+const REGISTRATION_NONCE_OFFSET = 2;
+const REGISTRATION_PLAINTEXT_LENGTH = KEY_LENGTH * 2;
+const RECORD_NONCE_OFFSET = RECIPIENT_TAG_END;
+const RECORD_PLAINTEXT_LENGTH = 192 - (RECORD_NONCE_OFFSET + NONCE_LENGTH + TAG_LENGTH);
+const encoder = new TextEncoder();
+const ENVELOPE_TAG_DOMAIN = encoder.encode("lace:passport:envelope-tag:v2");
+const ENVELOPE_KEY_INFO = encoder.encode("lace:passport:device-envelope:v1");
+const REGISTRATION_KEY_INFO = encoder.encode("lace:passport:device-registration:v1");
+const RECORD_KEY_INFO = encoder.encode("lace:passport:grant-record:v1");
+const RECORD_TAG_KEY_INFO = encoder.encode("lace:passport:grant-record-tag:v1");
+/**
+* The kinds of grant record part, by the byte that leads its plaintext.
+* The jubjub grant, object and view values come first, so the records
+* written before secp256k1 grantees read back unchanged.
+*/
+const RECORD_PART_KINDS = [
+	{
+		part: "grant",
+		granteeScheme: "jubjub-schnorr"
+	},
+	{ part: "object" },
+	{ part: "view" },
+	{
+		part: "grant",
+		granteeScheme: "secp256k1-ecdsa",
+		keyPrefix: 2
+	},
+	{
+		part: "grant",
+		granteeScheme: "secp256k1-ecdsa",
+		keyPrefix: 3
+	}
+];
+/**
+* A Jubjub device public key in the compressed 32-byte form a device
+* registration carries, as lowercase hex: the y coordinate little-endian
+* with the parity of x in its top bit.
+*/
+const encodeDevicePublicKey = (point) => require_bytes_vo.HexBytes.fromByteArray(require_grant_rules.jubjub.Point.fromAffine(point).toBytes());
+/**
+* The affine Jubjub point a compressed device public key names, or
+* undefined for hex that is no point on the curve.
+*/
+const decodeDevicePublicKey = (hex) => {
+	try {
+		return require_grant_rules.jubjub.Point.fromBytes(require_bytes_vo.ByteArray.fromHex(require_bytes_vo.HexBytes(hex))).toAffine();
+	} catch {
+		return;
+	}
+};
+const concat = (...parts) => {
+	const joined = new Uint8Array(parts.reduce((length, part) => length + part.length, 0));
+	let offset = 0;
+	for (const part of parts) {
+		joined.set(part, offset);
+		offset += part.length;
+	}
+	return joined;
+};
+const isZero = (bytes) => bytes.every((byte) => byte === 0);
+const equalBytes = (left, right) => left.length === right.length && left.every((byte, index) => byte === right[index]);
+/** Whether an entry is a 192-byte record of the given type and suite. */
+const isRecordOf = (entry, type) => entry.length === 192 && entry[0] === type && entry[1] === SUITE;
+/**
+* Whether an inbox entry is one of the Lace record kinds, which a coin
+* walk passes over rather than counts as noise.
+*/
+const isLaceRecord = (entry) => isRecordOf(entry, DEVICE_ENVELOPE_TYPE) || isRecordOf(entry, DEVICE_REGISTRATION_TYPE) || isRecordOf(entry, GRANT_RECORD_TYPE);
+/** Whether an inbox entry is a device registration. */
+const isDeviceRegistration = (entry) => isRecordOf(entry, DEVICE_REGISTRATION_TYPE);
+/**
+* The HMAC-SHA256 key HKDF-SHA256 derives from `material` under `info`
+* with an empty salt, imported non-extractable, so the key bytes never
+* exist outside it.
+*/
+const hmacKey = async (material, info) => {
+	const key = await crypto.subtle.importKey("raw", material, "HKDF", false, ["deriveKey"]);
+	return crypto.subtle.deriveKey({
+		name: "HKDF",
+		hash: "SHA-256",
+		salt: new Uint8Array(0),
+		info
+	}, key, {
+		name: "HMAC",
+		hash: "SHA-256",
+		length: KEY_LENGTH * 8
+	}, false, ["sign"]);
+};
+/**
+* The AES-256-GCM key HKDF-SHA256 derives from `material` under `info`,
+* imported non-extractable, so the key bytes never exist outside it.
+*/
+const aeadKey = async (material, info) => {
+	const key = await crypto.subtle.importKey("raw", material, "HKDF", false, ["deriveKey"]);
+	return crypto.subtle.deriveKey({
+		name: "HKDF",
+		hash: "SHA-256",
+		salt: new Uint8Array(0),
+		info
+	}, key, {
+		name: "AES-GCM",
+		length: KEY_LENGTH * 8
+	}, false, ["encrypt", "decrypt"]);
+};
+/** A fresh AEAD nonce. */
+const freshNonce = () => crypto.getRandomValues(new Uint8Array(NONCE_LENGTH));
+/**
+* The associated data of an entry: every byte before its AEAD tag, less
+* the recipient tag when it carries one, since that tag is computed over
+* the sealed entry and binds it in turn.
+*/
+const associatedData = ({ entry, nonceOffset, isTagged }) => {
+	const tagOffset = nonceOffset + NONCE_LENGTH;
+	return isTagged ? concat(entry.subarray(0, RECIPIENT_TAG_OFFSET), entry.subarray(RECIPIENT_TAG_END, tagOffset)) : entry.slice(0, tagOffset);
+};
+/**
+* Encrypts `plaintext` into `entry` behind its header: the AEAD tag
+* after the nonce the entry already holds at `nonceOffset`, and the
+* ciphertext after that, with the header as associated data, see
+* {@link associatedData}, so the header must be complete before this
+* runs, its recipient tag aside.
+*/
+const sealInto = async ({ key, entry, nonceOffset, isTagged, plaintext }) => {
+	const nonce = entry.slice(nonceOffset, nonceOffset + NONCE_LENGTH);
+	const tagOffset = nonceOffset + NONCE_LENGTH;
+	const sealed = new Uint8Array(await crypto.subtle.encrypt({
+		name: "AES-GCM",
+		iv: nonce,
+		additionalData: associatedData({
+			entry,
+			nonceOffset,
+			isTagged
+		}),
+		tagLength: AEAD_TAG_BITS
+	}, key, plaintext));
+	entry.set(sealed.subarray(plaintext.length), tagOffset);
+	entry.set(sealed.subarray(0, plaintext.length), tagOffset + TAG_LENGTH);
+};
+/**
+* Decrypts the ciphertext behind an entry's header, or null when the
+* authentication fails or the padding after the ciphertext is not zero.
+*/
+const openFrom = async ({ key, entry, nonceOffset, isTagged, plaintextLength }) => {
+	const tagOffset = nonceOffset + NONCE_LENGTH;
+	const ciphertextOffset = tagOffset + TAG_LENGTH;
+	if (!isZero(entry.subarray(ciphertextOffset + plaintextLength))) return null;
+	try {
+		return new Uint8Array(await crypto.subtle.decrypt({
+			name: "AES-GCM",
+			iv: entry.slice(nonceOffset, tagOffset),
+			additionalData: associatedData({
+				entry,
+				nonceOffset,
+				isTagged
+			}),
+			tagLength: AEAD_TAG_BITS
+		}, key, concat(entry.subarray(ciphertextOffset, ciphertextOffset + plaintextLength), entry.subarray(tagOffset, ciphertextOffset))));
+	} catch {
+		return null;
+	}
+};
+/**
+* The recipient tag of a device envelope: SHA-256 over the tag domain,
+* the type and suite bytes, the reader public key and every byte after
+* the tag, the ephemeral key, the nonce, the AEAD tag, the ciphertext
+* and the padding. A reader finds its envelopes by recomputing it, so
+* an entry that copies a genuine envelope's tag with any other byte
+* changed is not taken for one, and writing an entry that is takes the
+* reader public key. Two envelopes to the same reader share nothing on
+* chain, since each carries its own ephemeral key.
+*/
+const envelopeTag = (readerPublicKey, entry) => require_errors.sha256(concat(ENVELOPE_TAG_DOMAIN, entry.subarray(0, RECIPIENT_TAG_OFFSET), readerPublicKey, entry.subarray(RECIPIENT_TAG_END)));
+/** Whether an entry is a device envelope addressed to this reader public key. */
+const isAddressedTo = (entry, readerPublicKey) => isRecordOf(entry, DEVICE_ENVELOPE_TYPE) && equalBytes(entry.subarray(RECIPIENT_TAG_OFFSET, RECIPIENT_TAG_END), envelopeTag(readerPublicKey, entry));
+/**
+* Every envelope in an inbox addressed to this device, newest first: the
+* ones a keyring carries. Anyone who knows a reader key can append
+* envelopes tagged for it, so none is left out, and the live one is
+* found however many land after it, at the cost of opening each.
+*/
+const deviceEnvelopes = (entries, readerPublicKey) => entries.filter((entry) => isAddressedTo(entry, readerPublicKey)).reverse();
+/**
+* The AES-256-GCM key of one envelope: HKDF-SHA256 over the X25519 shared
+* secret, zeroed once the key is derived.
+*/
+const envelopeKey = async (shared) => {
+	try {
+		return await aeadKey(shared, ENVELOPE_KEY_INFO);
+	} finally {
+		shared.fill(0);
+	}
+};
+/**
+* Seals the account secret and the roster key to one device's reader key
+* as a device envelope: [0] type, [1] suite, [2..34) recipient tag,
+* [34..66) ephemeral X25519 public key, [66..78) nonce, [78..94) AEAD
+* tag, [94..158) the secret then the roster key, encrypted, and zero
+* padding to 192 bytes. The key is agreed between a fresh ephemeral key
+* and the reader key, everything before the AEAD tag but the recipient
+* tag is associated data, and the recipient tag, computed last, covers
+* the whole sealed envelope. The envelope carries no round or
+* `enc_key`: a reader trusts the secret only once it derives the
+* `enc_key` the ledger holds. The ephemeral secret is zeroed before this
+* returns.
+*/
+const sealDeviceEnvelope = async (readerPublicKey, { secret, rosterKey }) => {
+	const ephemeral = x25519.keygen();
+	const plaintext = concat(secret, rosterKey);
+	const entry = new Uint8Array(192);
+	entry[0] = DEVICE_ENVELOPE_TYPE;
+	entry[1] = SUITE;
+	entry.set(ephemeral.publicKey, ENVELOPE_EPHEMERAL_OFFSET);
+	entry.set(freshNonce(), ENVELOPE_NONCE_OFFSET);
+	try {
+		await sealInto({
+			key: await envelopeKey(x25519.getSharedSecret(ephemeral.secretKey, readerPublicKey)),
+			entry,
+			nonceOffset: ENVELOPE_NONCE_OFFSET,
+			isTagged: true,
+			plaintext
+		});
+		entry.set(envelopeTag(readerPublicKey, entry), RECIPIENT_TAG_OFFSET);
+		return entry;
+	} finally {
+		ephemeral.secretKey.fill(0);
+		plaintext.fill(0);
+	}
+};
+/**
+* Opens a device envelope with this device's reader secret. Resolves the
+* account secret and roster key it delivers, which the caller zeroes once
+* used, or null for an entry that is not an envelope, is addressed to
+* another reader or fails to authenticate.
+*/
+const openDeviceEnvelope = async (readerSecret, entry) => {
+	if (!isAddressedTo(entry, x25519.getPublicKey(readerSecret))) return null;
+	let key;
+	try {
+		key = await envelopeKey(x25519.getSharedSecret(readerSecret, entry.slice(ENVELOPE_EPHEMERAL_OFFSET, ENVELOPE_NONCE_OFFSET)));
+	} catch {
+		return null;
+	}
+	const plaintext = await openFrom({
+		key,
+		entry,
+		nonceOffset: ENVELOPE_NONCE_OFFSET,
+		isTagged: true,
+		plaintextLength: ENVELOPE_PLAINTEXT_LENGTH
+	});
+	if (!plaintext) return null;
+	try {
+		return {
+			secret: plaintext.slice(0, KEY_LENGTH),
+			rosterKey: plaintext.slice(KEY_LENGTH)
+		};
+	} finally {
+		plaintext.fill(0);
+	}
+};
+/**
+* Seals one enrolled device's reader and device keys under the roster key
+* as a device registration: [0] type, [1] suite, [2..14) nonce, [14..30)
+* AEAD tag, [30..94) the reader key then the device key, encrypted, and
+* zero padding to 192 bytes. Only a holder of the roster key, an enrolled
+* device, can write one that opens, and nothing on chain tells whose it
+* is.
+*/
+const sealDeviceRegistration = async (rosterKey, { readerPublicKey, devicePublicKey }) => {
+	const entry = new Uint8Array(192);
+	entry[0] = DEVICE_REGISTRATION_TYPE;
+	entry[1] = SUITE;
+	entry.set(freshNonce(), REGISTRATION_NONCE_OFFSET);
+	await sealInto({
+		key: await aeadKey(rosterKey, REGISTRATION_KEY_INFO),
+		entry,
+		nonceOffset: REGISTRATION_NONCE_OFFSET,
+		isTagged: false,
+		plaintext: concat(require_bytes_vo.ByteArray.fromHex(require_bytes_vo.HexBytes(readerPublicKey)), require_bytes_vo.ByteArray.fromHex(require_bytes_vo.HexBytes(devicePublicKey)))
+	});
+	return entry;
+};
+/**
+* Opens a device registration with the roster key: the device it names,
+* or null for an entry that is not a registration or was written under
+* another roster key.
+*/
+const openDeviceRegistration = async (rosterKey, entry) => {
+	if (!isRecordOf(entry, DEVICE_REGISTRATION_TYPE)) return null;
+	const plaintext = await openFrom({
+		key: await aeadKey(rosterKey, REGISTRATION_KEY_INFO),
+		entry,
+		nonceOffset: REGISTRATION_NONCE_OFFSET,
+		isTagged: false,
+		plaintextLength: REGISTRATION_PLAINTEXT_LENGTH
+	});
+	return plaintext && {
+		readerPublicKey: require_bytes_vo.HexBytes.fromByteArray(plaintext.slice(0, KEY_LENGTH)),
+		devicePublicKey: require_bytes_vo.HexBytes.fromByteArray(plaintext.slice(KEY_LENGTH))
+	};
+};
+/**
+* The keys of this device's grant records on one account, both derived
+* from its reader secret with the account address in the label: the
+* AES-256-GCM key and the key its recipient tags are computed under, so
+* only this device writes a record that opens or recognises one as its
+* own, and a record copied from another account is neither.
+*/
+const recordKeys = async (readerSecret, account) => {
+	const accountBytes = require_bytes_vo.ByteArray.fromHex(require_bytes_vo.HexBytes(account));
+	return {
+		key: await aeadKey(readerSecret, concat(RECORD_KEY_INFO, accountBytes)),
+		tagKey: await hmacKey(readerSecret, concat(RECORD_TAG_KEY_INFO, accountBytes))
+	};
+};
+/**
+* The recipient tag of a grant record: HMAC-SHA256 under the tag key
+* over the type and suite bytes and every byte after the tag, the
+* nonce, the AEAD tag and the ciphertext, so a copied tag with any other
+* byte changed is not taken for this device's.
+*/
+const recordTag = async (tagKey, entry) => new Uint8Array(await crypto.subtle.sign("HMAC", tagKey, concat(entry.subarray(0, RECIPIENT_TAG_OFFSET), entry.subarray(RECIPIENT_TAG_END))));
+const encodeAmount = (value) => {
+	const bytes = new Uint8Array(MAX_COIN_VALUE_LENGTH);
+	let remaining = BigInt(value);
+	for (let index = MAX_COIN_VALUE_LENGTH - 1; index >= 0; index -= 1) {
+		bytes[index] = Number(remaining & BYTE_MASK);
+		remaining >>= BYTE_BITS;
+	}
+	return bytes;
+};
+const decodeAmount = (bytes) => bytes.reduce((value, byte) => value << BYTE_BITS | BigInt(byte), 0n).toString();
+const hexBytes = (hex) => require_bytes_vo.ByteArray.fromHex(require_bytes_vo.HexBytes(hex));
+const encodeRecipient = (recipient) => concat(Uint8Array.of(Number(require_grant_rules.RECIPIENT_KINDS[recipient.kind])), recipient.kind === "any" ? new Uint8Array(KEY_LENGTH) : hexBytes(recipient.value));
+const RECIPIENT_BY_KIND = new Map(Object.entries(require_grant_rules.RECIPIENT_KINDS).map(([kind, value]) => [Number(value), kind]));
+const decodeRecipient = (bytes) => {
+	const kind = RECIPIENT_BY_KIND.get(bytes[0]);
+	const value = bytes.subarray(1);
+	if (kind === void 0) return null;
+	if (kind === "any") return isZero(value) ? { kind } : null;
+	return {
+		kind,
+		value: require_bytes_vo.HexBytes.fromByteArray(value)
+	};
+};
+/** The part byte of an object or a view part, which take one value each. */
+const partByteOf = (part) => RECORD_PART_KINDS.findIndex((kind) => kind.part === part);
+/**
+* The grantee field of a grant part and the part byte that names how it
+* reads back, see {@link RecordPartKind}.
+*
+* @throws Error when the key is not in a form the record holds: a 32-byte
+* jubjub key, or a 33-byte compressed secp256k1 key prefixed 02 or 03.
+*/
+const encodeGrantee = (part) => {
+	const key = hexBytes(part.granteePublicKey);
+	const keyPrefix = part.granteeScheme === "secp256k1-ecdsa" ? key[0] : void 0;
+	const field = keyPrefix === void 0 ? key : key.subarray(1);
+	const partByte = RECORD_PART_KINDS.findIndex((kind) => kind.part === "grant" && kind.granteeScheme === part.granteeScheme && kind.keyPrefix === keyPrefix);
+	if (partByte < 0 || field.length !== KEY_LENGTH) throw new Error(`Grant record cannot carry this '${part.granteeScheme}' grantee key`);
+	return {
+		partByte,
+		field
+	};
+};
+/**
+* The plaintext of one grant record part, 130 bytes: the part byte and
+* the grant id, then for a grant the slot, the scope salt, the grantee
+* field and the read key (zero for none); for an object the colour, the
+* recipient kind and value, and the coin bound as a big-endian 128-bit
+* integer; for a view the leading bytes of `enc_key` and the 94-byte
+* seal; zero padding after. The part byte of a grant also names the form
+* of its grantee key, see {@link RecordPartKind}, and a grant part whose
+* grantee the format cannot hold is refused before anything is written.
+*/
+const encodeRecordPart = (part) => {
+	const plaintext = new Uint8Array(RECORD_PLAINTEXT_LENGTH);
+	plaintext.set(hexBytes(part.grantId), 1);
+	const body = 1 + KEY_LENGTH;
+	switch (part.part) {
+		case "grant": {
+			const { partByte, field } = encodeGrantee(part);
+			plaintext[0] = partByte;
+			plaintext[body] = part.slot;
+			plaintext.set(hexBytes(part.scopeSalt), body + 1);
+			plaintext.set(field, body + 1 + KEY_LENGTH);
+			if (part.readPublicKey !== void 0) plaintext.set(hexBytes(part.readPublicKey), body + 1 + KEY_LENGTH * 2);
+			return plaintext;
+		}
+		case "object":
+			plaintext[0] = partByteOf(part.part);
+			plaintext.set(hexBytes(part.object.color), body);
+			plaintext.set(encodeRecipient(part.object.recipient), body + KEY_LENGTH);
+			plaintext.set(encodeAmount(part.object.maxCoinValue), body + KEY_LENGTH * 2 + 1);
+			return plaintext;
+		case "view":
+			plaintext[0] = partByteOf(part.part);
+			plaintext.set(hexBytes(part.encKeyPrefix), body);
+			plaintext.set(hexBytes(part.seal), body + 3);
+			return plaintext;
+	}
+};
+const decodeObject = (body) => {
+	const recipient = decodeRecipient(body.subarray(KEY_LENGTH, KEY_LENGTH * 2 + 1));
+	const amountOffset = KEY_LENGTH * 2 + 1;
+	if (!recipient || !isZero(body.subarray(amountOffset + MAX_COIN_VALUE_LENGTH))) return null;
+	return {
+		color: require_bytes_vo.HexBytes.fromByteArray(body.subarray(0, KEY_LENGTH)),
+		recipient,
+		maxCoinValue: decodeAmount(body.subarray(amountOffset, amountOffset + MAX_COIN_VALUE_LENGTH))
+	};
+};
+/** Reads a grant record part back, or null for a plaintext no writer produces. */
+const decodeRecordPart = (plaintext) => {
+	const kind = RECORD_PART_KINDS.at(plaintext[0]);
+	if (!kind) return null;
+	const grantId = require_grant_rules.GrantId(require_bytes_vo.HexBytes.fromByteArray(plaintext.slice(1, 33)));
+	const body = plaintext.subarray(1 + KEY_LENGTH);
+	switch (kind.part) {
+		case "grant": {
+			const field = body.subarray(1 + KEY_LENGTH, 1 + KEY_LENGTH * 2);
+			const readKey = body.subarray(1 + KEY_LENGTH * 2);
+			return {
+				part: kind.part,
+				grantId,
+				slot: require_grant_rules.GrantSlot(body[0]),
+				scopeSalt: require_grant_rules.GrantScopeSalt(require_bytes_vo.HexBytes.fromByteArray(body.subarray(1, 1 + KEY_LENGTH))),
+				granteeScheme: kind.granteeScheme,
+				granteePublicKey: require_bytes_vo.HexBytes.fromByteArray(kind.keyPrefix === void 0 ? field : concat(Uint8Array.of(kind.keyPrefix), field)),
+				...isZero(readKey) ? {} : { readPublicKey: require_bytes_vo.HexBytes.fromByteArray(readKey) }
+			};
+		}
+		case "object": {
+			const object = decodeObject(body);
+			return object && {
+				part: kind.part,
+				grantId,
+				object
+			};
+		}
+		case "view": return {
+			part: kind.part,
+			grantId,
+			encKeyPrefix: require_bytes_vo.HexBytes.fromByteArray(body.subarray(0, 3)),
+			seal: require_bytes_vo.HexBytes.fromByteArray(body.subarray(3, 97))
+		};
+	}
+};
+/**
+* Seals one part of a grant's bookkeeping for this device alone as a
+* grant record: [0] type, [1] suite, [2..34) recipient tag, [34..46)
+* nonce, [46..62) AEAD tag, [62..192) the 130-byte part, encrypted, with
+* everything before the AEAD tag but the recipient tag as associated
+* data. The key and the tag key are derived from this device's reader
+* secret and the account, so only this device writes a record that opens
+* and recognises its own on that account, and the tag, computed last
+* over the whole sealed record and its fresh nonce, links no two
+* records.
+*/
+const sealGrantRecord = async (readerSecret, account, part) => {
+	const { key, tagKey } = await recordKeys(readerSecret, account);
+	const plaintext = encodeRecordPart(part);
+	const entry = new Uint8Array(192);
+	entry[0] = GRANT_RECORD_TYPE;
+	entry[1] = SUITE;
+	entry.set(freshNonce(), RECORD_NONCE_OFFSET);
+	try {
+		await sealInto({
+			key,
+			entry,
+			nonceOffset: RECORD_NONCE_OFFSET,
+			isTagged: true,
+			plaintext
+		});
+		entry.set(await recordTag(tagKey, entry), RECIPIENT_TAG_OFFSET);
+		return entry;
+	} finally {
+		plaintext.fill(0);
+	}
+};
+/**
+* Opens a grant record of one account with this device's reader secret:
+* the part it holds, or null for an entry that is not a grant record,
+* carries another device's or another account's tag, fails to
+* authenticate or decodes to no part.
+*/
+const openGrantRecord = async (readerSecret, account, entry) => {
+	if (!isRecordOf(entry, GRANT_RECORD_TYPE)) return null;
+	const { key, tagKey } = await recordKeys(readerSecret, account);
+	if (!equalBytes(await recordTag(tagKey, entry), entry.subarray(RECIPIENT_TAG_OFFSET, RECIPIENT_TAG_END))) return null;
+	const plaintext = await openFrom({
+		key,
+		entry,
+		nonceOffset: RECORD_NONCE_OFFSET,
+		isTagged: true,
+		plaintextLength: RECORD_PLAINTEXT_LENGTH
+	});
+	if (!plaintext) return null;
+	try {
+		return decodeRecordPart(plaintext);
+	} catch {
+		return null;
+	} finally {
+		plaintext.fill(0);
+	}
+};
+//#endregion
+Object.defineProperty(exports, "MAX_INBOX_ENTRIES_PER_REQUEST", {
+	enumerable: true,
+	get: function() {
+		return MAX_INBOX_ENTRIES_PER_REQUEST;
+	}
+});
+Object.defineProperty(exports, "decodeDevicePublicKey", {
+	enumerable: true,
+	get: function() {
+		return decodeDevicePublicKey;
+	}
+});
+Object.defineProperty(exports, "deviceEnvelopes", {
+	enumerable: true,
+	get: function() {
+		return deviceEnvelopes;
+	}
+});
+Object.defineProperty(exports, "encodeDevicePublicKey", {
+	enumerable: true,
+	get: function() {
+		return encodeDevicePublicKey;
+	}
+});
+Object.defineProperty(exports, "isAddressedTo", {
+	enumerable: true,
+	get: function() {
+		return isAddressedTo;
+	}
+});
+Object.defineProperty(exports, "isDeviceRegistration", {
+	enumerable: true,
+	get: function() {
+		return isDeviceRegistration;
+	}
+});
+Object.defineProperty(exports, "isLaceRecord", {
+	enumerable: true,
+	get: function() {
+		return isLaceRecord;
+	}
+});
+Object.defineProperty(exports, "openDeviceEnvelope", {
+	enumerable: true,
+	get: function() {
+		return openDeviceEnvelope;
+	}
+});
+Object.defineProperty(exports, "openDeviceRegistration", {
+	enumerable: true,
+	get: function() {
+		return openDeviceRegistration;
+	}
+});
+Object.defineProperty(exports, "openGrantRecord", {
+	enumerable: true,
+	get: function() {
+		return openGrantRecord;
+	}
+});
+Object.defineProperty(exports, "openInboxEntry", {
+	enumerable: true,
+	get: function() {
+		return openInboxEntry;
+	}
+});
+Object.defineProperty(exports, "sealDeviceEnvelope", {
+	enumerable: true,
+	get: function() {
+		return sealDeviceEnvelope;
+	}
+});
+Object.defineProperty(exports, "sealDeviceRegistration", {
+	enumerable: true,
+	get: function() {
+		return sealDeviceRegistration;
+	}
+});
+Object.defineProperty(exports, "sealGrantRecord", {
+	enumerable: true,
+	get: function() {
+		return sealGrantRecord;
+	}
+});
+Object.defineProperty(exports, "sealGrantView", {
+	enumerable: true,
+	get: function() {
+		return sealGrantView;
+	}
+});
+Object.defineProperty(exports, "sealInboxEntry", {
+	enumerable: true,
+	get: function() {
+		return sealInboxEntry;
+	}
+});
+Object.defineProperty(exports, "x25519", {
+	enumerable: true,
+	get: function() {
+		return x25519;
+	}
+});