@t2000/cli 8.0.0 → 8.0.2

package/dist/index.js

@@ -17198,7 +17198,7 @@ var require_bitmapper = __commonJS({
     function bitRetriever(data, depth) {
       let leftOver = [];
       let i = 0;
-      function split3() {
+      function split4() {
         if (i === data.length) {
           throw new Error("Ran out of data");
         }
@@ -17241,7 +17241,7 @@ var require_bitmapper = __commonJS({
       return {
         get: function(count) {
           while (leftOver.length < count) {
-            split3();
+            split4();
           }
           let returner = leftOver.slice(0, count);
           leftOver = leftOver.slice(count);
@@ -22171,24 +22171,24 @@ function invert(number, modulo) {
     throw new Error("invert: does not exist");
   return mod(x, modulo);
 }
-function assertIsSquare(Fp, root, n) {
-  if (!Fp.eql(Fp.sqr(root), n))
+function assertIsSquare(Fp2, root, n) {
+  if (!Fp2.eql(Fp2.sqr(root), n))
     throw new Error("Cannot find square root");
 }
-function sqrt3mod4(Fp, n) {
-  const p1div4 = (Fp.ORDER + _1n2) / _4n;
-  const root = Fp.pow(n, p1div4);
-  assertIsSquare(Fp, root, n);
+function sqrt3mod4(Fp2, n) {
+  const p1div4 = (Fp2.ORDER + _1n2) / _4n;
+  const root = Fp2.pow(n, p1div4);
+  assertIsSquare(Fp2, root, n);
   return root;
 }
-function sqrt5mod8(Fp, n) {
-  const p5div8 = (Fp.ORDER - _5n) / _8n;
-  const n2 = Fp.mul(n, _2n);
-  const v = Fp.pow(n2, p5div8);
-  const nv = Fp.mul(n, v);
-  const i = Fp.mul(Fp.mul(nv, _2n), v);
-  const root = Fp.mul(nv, Fp.sub(i, Fp.ONE));
-  assertIsSquare(Fp, root, n);
+function sqrt5mod8(Fp2, n) {
+  const p5div8 = (Fp2.ORDER - _5n) / _8n;
+  const n2 = Fp2.mul(n, _2n);
+  const v = Fp2.pow(n2, p5div8);
+  const nv = Fp2.mul(n, v);
+  const i = Fp2.mul(Fp2.mul(nv, _2n), v);
+  const root = Fp2.mul(nv, Fp2.sub(i, Fp2.ONE));
+  assertIsSquare(Fp2, root, n);
   return root;
 }
 function sqrt9mod16(P) {
@@ -22198,18 +22198,18 @@ function sqrt9mod16(P) {
   const c2 = tn(Fp_, c1);
   const c3 = tn(Fp_, Fp_.neg(c1));
   const c4 = (P + _7n) / _16n;
-  return (Fp, n) => {
-    let tv1 = Fp.pow(n, c4);
-    let tv2 = Fp.mul(tv1, c1);
-    const tv3 = Fp.mul(tv1, c2);
-    const tv4 = Fp.mul(tv1, c3);
-    const e1 = Fp.eql(Fp.sqr(tv2), n);
-    const e2 = Fp.eql(Fp.sqr(tv3), n);
-    tv1 = Fp.cmov(tv1, tv2, e1);
-    tv2 = Fp.cmov(tv4, tv3, e2);
-    const e3 = Fp.eql(Fp.sqr(tv2), n);
-    const root = Fp.cmov(tv1, tv2, e3);
-    assertIsSquare(Fp, root, n);
+  return (Fp2, n) => {
+    let tv1 = Fp2.pow(n, c4);
+    let tv2 = Fp2.mul(tv1, c1);
+    const tv3 = Fp2.mul(tv1, c2);
+    const tv4 = Fp2.mul(tv1, c3);
+    const e1 = Fp2.eql(Fp2.sqr(tv2), n);
+    const e2 = Fp2.eql(Fp2.sqr(tv3), n);
+    tv1 = Fp2.cmov(tv1, tv2, e1);
+    tv2 = Fp2.cmov(tv4, tv3, e2);
+    const e3 = Fp2.eql(Fp2.sqr(tv2), n);
+    const root = Fp2.cmov(tv1, tv2, e3);
+    assertIsSquare(Fp2, root, n);
     return root;
   };
 }
@@ -22232,32 +22232,32 @@ function tonelliShanks(P) {
     return sqrt3mod4;
   let cc = _Fp.pow(Z, Q);
   const Q1div2 = (Q + _1n2) / _2n;
-  return function tonelliSlow(Fp, n) {
-    if (Fp.is0(n))
+  return function tonelliSlow(Fp2, n) {
+    if (Fp2.is0(n))
       return n;
-    if (FpLegendre(Fp, n) !== 1)
+    if (FpLegendre(Fp2, n) !== 1)
       throw new Error("Cannot find square root");
     let M = S;
-    let c = Fp.mul(Fp.ONE, cc);
-    let t = Fp.pow(n, Q);
-    let R = Fp.pow(n, Q1div2);
-    while (!Fp.eql(t, Fp.ONE)) {
-      if (Fp.is0(t))
-        return Fp.ZERO;
+    let c = Fp2.mul(Fp2.ONE, cc);
+    let t = Fp2.pow(n, Q);
+    let R = Fp2.pow(n, Q1div2);
+    while (!Fp2.eql(t, Fp2.ONE)) {
+      if (Fp2.is0(t))
+        return Fp2.ZERO;
       let i = 1;
-      let t_tmp = Fp.sqr(t);
-      while (!Fp.eql(t_tmp, Fp.ONE)) {
+      let t_tmp = Fp2.sqr(t);
+      while (!Fp2.eql(t_tmp, Fp2.ONE)) {
         i++;
-        t_tmp = Fp.sqr(t_tmp);
+        t_tmp = Fp2.sqr(t_tmp);
         if (i === M)
           throw new Error("Cannot find square root");
       }
       const exponent = _1n2 << BigInt(M - i - 1);
-      const b = Fp.pow(c, exponent);
+      const b = Fp2.pow(c, exponent);
       M = i;
-      c = Fp.sqr(b);
-      t = Fp.mul(t, c);
-      R = Fp.mul(R, b);
+      c = Fp2.sqr(b);
+      t = Fp2.mul(t, c);
+      R = Fp2.mul(R, b);
     }
     return R;
   };
@@ -22304,46 +22304,46 @@ function validateField(field) {
   validateObject(field, opts);
   return field;
 }
-function FpPow(Fp, num, power) {
+function FpPow(Fp2, num, power) {
   if (power < _0n2)
     throw new Error("invalid exponent, negatives unsupported");
   if (power === _0n2)
-    return Fp.ONE;
+    return Fp2.ONE;
   if (power === _1n2)
     return num;
-  let p = Fp.ONE;
+  let p = Fp2.ONE;
   let d = num;
   while (power > _0n2) {
     if (power & _1n2)
-      p = Fp.mul(p, d);
-    d = Fp.sqr(d);
+      p = Fp2.mul(p, d);
+    d = Fp2.sqr(d);
     power >>= _1n2;
   }
   return p;
 }
-function FpInvertBatch(Fp, nums, passZero = false) {
-  const inverted = new Array(nums.length).fill(passZero ? Fp.ZERO : void 0);
+function FpInvertBatch(Fp2, nums, passZero = false) {
+  const inverted = new Array(nums.length).fill(passZero ? Fp2.ZERO : void 0);
   const multipliedAcc = nums.reduce((acc, num, i) => {
-    if (Fp.is0(num))
+    if (Fp2.is0(num))
       return acc;
     inverted[i] = acc;
-    return Fp.mul(acc, num);
-  }, Fp.ONE);
-  const invertedAcc = Fp.inv(multipliedAcc);
+    return Fp2.mul(acc, num);
+  }, Fp2.ONE);
+  const invertedAcc = Fp2.inv(multipliedAcc);
   nums.reduceRight((acc, num, i) => {
-    if (Fp.is0(num))
+    if (Fp2.is0(num))
       return acc;
-    inverted[i] = Fp.mul(acc, inverted[i]);
-    return Fp.mul(acc, num);
+    inverted[i] = Fp2.mul(acc, inverted[i]);
+    return Fp2.mul(acc, num);
   }, invertedAcc);
   return inverted;
 }
-function FpLegendre(Fp, n) {
-  const p1mod2 = (Fp.ORDER - _1n2) / _2n;
-  const powered = Fp.pow(n, p1mod2);
-  const yes = Fp.eql(powered, Fp.ONE);
-  const zero = Fp.eql(powered, Fp.ZERO);
-  const no = Fp.eql(powered, Fp.neg(Fp.ONE));
+function FpLegendre(Fp2, n) {
+  const p1mod2 = (Fp2.ORDER - _1n2) / _2n;
+  const powered = Fp2.pow(n, p1mod2);
+  const yes = Fp2.eql(powered, Fp2.ONE);
+  const zero = Fp2.eql(powered, Fp2.ZERO);
+  const no = Fp2.eql(powered, Fp2.neg(Fp2.ONE));
   if (!yes && !zero && !no)
     throw new Error("invalid Legendre symbol result");
   return yes ? 1 : zero ? 0 : -1;
@@ -22694,16 +22694,16 @@ function createCurveFields(type, CURVE, curveOpts = {}, FpFnLE) {
     if (!(typeof val === "bigint" && val > _0n3))
       throw new Error(`CURVE.${p} must be positive bigint`);
   }
-  const Fp = createField(CURVE.p, curveOpts.Fp, FpFnLE);
-  const Fn = createField(CURVE.n, curveOpts.Fn, FpFnLE);
+  const Fp2 = createField(CURVE.p, curveOpts.Fp, FpFnLE);
+  const Fn2 = createField(CURVE.n, curveOpts.Fn, FpFnLE);
   const _b = type === "weierstrass" ? "b" : "d";
   const params = ["Gx", "Gy", "a", _b];
   for (const p of params) {
-    if (!Fp.isValid(CURVE[p]))
+    if (!Fp2.isValid(CURVE[p]))
       throw new Error(`CURVE.${p} must be valid field element of CURVE.Fp`);
   }
   CURVE = Object.freeze(Object.assign({}, CURVE));
-  return { CURVE, Fp, Fn };
+  return { CURVE, Fp: Fp2, Fn: Fn2 };
 }
 function createKeygen(randomSecretKey, getPublicKey) {
   return function keygen(seed) {
@@ -22717,29 +22717,29 @@ var _0n4 = BigInt(0);
 var _1n4 = BigInt(1);
 var _2n2 = BigInt(2);
 var _8n2 = BigInt(8);
-function isEdValidXY(Fp, CURVE, x, y) {
-  const x2 = Fp.sqr(x);
-  const y2 = Fp.sqr(y);
-  const left = Fp.add(Fp.mul(CURVE.a, x2), y2);
-  const right = Fp.add(Fp.ONE, Fp.mul(CURVE.d, Fp.mul(x2, y2)));
-  return Fp.eql(left, right);
+function isEdValidXY(Fp2, CURVE, x, y) {
+  const x2 = Fp2.sqr(x);
+  const y2 = Fp2.sqr(y);
+  const left = Fp2.add(Fp2.mul(CURVE.a, x2), y2);
+  const right = Fp2.add(Fp2.ONE, Fp2.mul(CURVE.d, Fp2.mul(x2, y2)));
+  return Fp2.eql(left, right);
 }
 function edwards(params, extraOpts = {}) {
   const validated = createCurveFields("edwards", params, extraOpts, extraOpts.FpFnLE);
-  const { Fp, Fn } = validated;
+  const { Fp: Fp2, Fn: Fn2 } = validated;
   let CURVE = validated.CURVE;
   const { h: cofactor } = CURVE;
   validateObject(extraOpts, {}, { uvRatio: "function" });
-  const MASK = _2n2 << BigInt(Fn.BYTES * 8) - _1n4;
-  const modP = (n) => Fp.create(n);
-  const uvRatio2 = extraOpts.uvRatio || ((u, v) => {
+  const MASK = _2n2 << BigInt(Fn2.BYTES * 8) - _1n4;
+  const modP = (n) => Fp2.create(n);
+  const uvRatio3 = extraOpts.uvRatio || ((u, v) => {
     try {
-      return { isValid: true, value: Fp.sqrt(Fp.div(u, v)) };
+      return { isValid: true, value: Fp2.sqrt(Fp2.div(u, v)) };
     } catch (e) {
       return { isValid: false, value: _0n4 };
     }
   });
-  if (!isEdValidXY(Fp, CURVE, CURVE.Gx, CURVE.Gy))
+  if (!isEdValidXY(Fp2, CURVE, CURVE.Gx, CURVE.Gy))
     throw new Error("bad curve params: generator point");
   function acoord(title, n, banZero = false) {
     const min = banZero ? _1n4 : _0n4;
@@ -22754,10 +22754,10 @@ function edwards(params, extraOpts = {}) {
     const { X, Y, Z } = p;
     const is0 = p.is0();
     if (iz == null)
-      iz = is0 ? _8n2 : Fp.inv(Z);
+      iz = is0 ? _8n2 : Fp2.inv(Z);
     const x = modP(X * iz);
     const y = modP(Y * iz);
-    const zz = Fp.mul(Z, iz);
+    const zz = Fp2.mul(Z, iz);
     if (is0)
       return { x: _0n4, y: _1n4 };
     if (zz !== _1n4)
@@ -22791,9 +22791,9 @@ function edwards(params, extraOpts = {}) {
     static ZERO = new Point(_0n4, _1n4, _1n4, _0n4);
     // 0, 1, 1, 0
     // math field
-    static Fp = Fp;
+    static Fp = Fp2;
     // scalar field
-    static Fn = Fn;
+    static Fn = Fn2;
     X;
     Y;
     Z;
@@ -22818,7 +22818,7 @@ function edwards(params, extraOpts = {}) {
     }
     // Uses algo from RFC8032 5.1.3.
     static fromBytes(bytes, zip215 = false) {
-      const len = Fp.BYTES;
+      const len = Fp2.BYTES;
       const { a, d } = CURVE;
       bytes = copyBytes(abytes(bytes, len, "point"));
       abool(zip215, "zip215");
@@ -22826,12 +22826,12 @@ function edwards(params, extraOpts = {}) {
       const lastByte = bytes[len - 1];
       normed[len - 1] = lastByte & ~128;
       const y = bytesToNumberLE(normed);
-      const max = zip215 ? MASK : Fp.ORDER;
+      const max = zip215 ? MASK : Fp2.ORDER;
       aInRange("point.y", y, _0n4, max);
       const y2 = modP(y * y);
       const u = modP(y2 - _1n4);
       const v = modP(d * y2 - a);
-      let { isValid, value: x } = uvRatio2(u, v);
+      let { isValid, value: x } = uvRatio3(u, v);
       if (!isValid)
         throw new Error("bad point: invalid y coordinate");
       const isXOdd = (x & _1n4) === _1n4;
@@ -22926,7 +22926,7 @@ function edwards(params, extraOpts = {}) {
     }
     // Constant-time multiplication.
     multiply(scalar) {
-      if (!Fn.isValidNot0(scalar))
+      if (!Fn2.isValidNot0(scalar))
         throw new Error("invalid scalar: expected 1 <= sc < curve.n");
       const { p, f } = wnaf.cached(this, scalar, (p2) => normalizeZ(Point, p2));
       return normalizeZ(Point, [p, f])[0];
@@ -22937,7 +22937,7 @@ function edwards(params, extraOpts = {}) {
     // Does NOT allow scalars higher than CURVE.n.
     // Accepts optional accumulator to merge with multiply (important for sparse scalars)
     multiplyUnsafe(scalar, acc = Point.ZERO) {
-      if (!Fn.isValid(scalar))
+      if (!Fn2.isValid(scalar))
         throw new Error("invalid scalar: expected 0 <= sc < curve.n");
       if (scalar === _0n4)
         return Point.ZERO;
@@ -22969,7 +22969,7 @@ function edwards(params, extraOpts = {}) {
     }
     toBytes() {
       const { x, y } = this.toAffine();
-      const bytes = Fp.toBytes(y);
+      const bytes = Fp2.toBytes(y);
       bytes[bytes.length - 1] |= x & _1n4 ? 128 : 0;
       return bytes;
     }
@@ -22980,7 +22980,7 @@ function edwards(params, extraOpts = {}) {
       return `<Point ${this.is0() ? "ZERO" : this.toHex()}>`;
     }
   }
-  const wnaf = new wNAF(Point, Fn.BITS);
+  const wnaf = new wNAF(Point, Fn2.BITS);
   Point.BASE.precompute(8);
   return Point;
 }
@@ -22995,9 +22995,9 @@ function eddsa(Point, cHash, eddsaOpts = {}) {
     mapToCurve: "function"
   });
   const { prehash } = eddsaOpts;
-  const { BASE, Fp, Fn } = Point;
+  const { BASE, Fp: Fp2, Fn: Fn2 } = Point;
   const randomBytes3 = eddsaOpts.randomBytes || randomBytes;
-  const adjustScalarBytes2 = eddsaOpts.adjustScalarBytes || ((bytes) => bytes);
+  const adjustScalarBytes3 = eddsaOpts.adjustScalarBytes || ((bytes) => bytes);
   const domain = eddsaOpts.domain || ((data, ctx, phflag) => {
     abool(phflag, "phflag");
     if (ctx.length || phflag)
@@ -23005,13 +23005,13 @@ function eddsa(Point, cHash, eddsaOpts = {}) {
     return data;
   });
   function modN_LE(hash) {
-    return Fn.create(bytesToNumberLE(hash));
+    return Fn2.create(bytesToNumberLE(hash));
   }
   function getPrivateScalar(key) {
     const len = lengths.secretKey;
     abytes(key, lengths.secretKey, "secretKey");
     const hashed = abytes(cHash(key), 2 * len, "hashedSecretKey");
-    const head = adjustScalarBytes2(hashed.slice(0, len));
+    const head = adjustScalarBytes3(hashed.slice(0, len));
     const prefix = hashed.slice(len, 2 * len);
     const scalar = modN_LE(head);
     return { head, prefix, scalar };
@@ -23037,10 +23037,10 @@ function eddsa(Point, cHash, eddsaOpts = {}) {
     const r = hashDomainToScalar(options.context, prefix, msg);
     const R = BASE.multiply(r).toBytes();
     const k = hashDomainToScalar(options.context, R, pointBytes, msg);
-    const s = Fn.create(r + k * scalar);
-    if (!Fn.isValid(s))
+    const s = Fn2.create(r + k * scalar);
+    if (!Fn2.isValid(s))
       throw new Error("sign failed: invalid s");
-    const rs = concatBytes(R, Fn.toBytes(s));
+    const rs = concatBytes(R, Fn2.toBytes(s));
     return abytes(rs, lengths.signature, "result");
   }
   const verifyOpts = { zip215: true };
@@ -23071,7 +23071,7 @@ function eddsa(Point, cHash, eddsaOpts = {}) {
     const RkA = R.add(A.multiplyUnsafe(k));
     return RkA.subtract(SB).clearCofactor().is0();
   }
-  const _size = Fp.BYTES;
+  const _size = Fp2.BYTES;
   const lengths = {
     secretKey: _size,
     publicKey: _size,
@@ -23082,7 +23082,7 @@ function eddsa(Point, cHash, eddsaOpts = {}) {
     return abytes(seed, lengths.seed, "seed");
   }
   function isValidSecretKey(key) {
-    return isBytes(key) && key.length === Fn.BYTES;
+    return isBytes(key) && key.length === Fn2.BYTES;
   }
   function isValidPublicKey(key, zip215) {
     try {
@@ -23111,14 +23111,14 @@ function eddsa(Point, cHash, eddsaOpts = {}) {
       const is25519 = size === 32;
       if (!is25519 && size !== 57)
         throw new Error("only defined for 25519 and 448");
-      const u = is25519 ? Fp.div(_1n4 + y, _1n4 - y) : Fp.div(y - _1n4, y + _1n4);
-      return Fp.toBytes(u);
+      const u = is25519 ? Fp2.div(_1n4 + y, _1n4 - y) : Fp2.div(y - _1n4, y + _1n4);
+      return Fp2.toBytes(u);
     },
     toMontgomerySecret(secretKey) {
       const size = lengths.secretKey;
       abytes(secretKey, size);
       const hashed = cHash(secretKey.subarray(0, size));
-      return adjustScalarBytes2(hashed).subarray(0, size);
+      return adjustScalarBytes3(hashed).subarray(0, size);
     }
   };
   return Object.freeze({
@@ -24315,9 +24315,9 @@ function randomBytes2(bytesLength = 32) {
 function setBigUint64(view, byteOffset, value, isLE) {
   if (typeof view.setBigUint64 === "function")
     return view.setBigUint64(byteOffset, value, isLE);
-  const _32n2 = BigInt(32);
+  const _32n3 = BigInt(32);
   const _u32_max = BigInt(4294967295);
-  const wh = Number(value >> _32n2 & _u32_max);
+  const wh = Number(value >> _32n3 & _u32_max);
   const wl = Number(value & _u32_max);
   const h = isLE ? 4 : 0;
   const l = isLE ? 0 : 4;
@@ -24430,6 +24430,59 @@ var SHA256_IV3 = /* @__PURE__ */ Uint32Array.from([
   528734635,
   1541459225
 ]);
+var SHA512_IV3 = /* @__PURE__ */ Uint32Array.from([
+  1779033703,
+  4089235720,
+  3144134277,
+  2227873595,
+  1013904242,
+  4271175723,
+  2773480762,
+  1595750129,
+  1359893119,
+  2917565137,
+  2600822924,
+  725511199,
+  528734635,
+  4215389547,
+  1541459225,
+  327033209
+]);
+
+// ../../node_modules/.pnpm/@noble+hashes@1.8.0/node_modules/@noble/hashes/esm/_u64.js
+var U32_MASK642 = /* @__PURE__ */ BigInt(2 ** 32 - 1);
+var _32n2 = /* @__PURE__ */ BigInt(32);
+function fromBig2(n, le = false) {
+  if (le)
+    return { h: Number(n & U32_MASK642), l: Number(n >> _32n2 & U32_MASK642) };
+  return { h: Number(n >> _32n2 & U32_MASK642) | 0, l: Number(n & U32_MASK642) | 0 };
+}
+function split3(lst, le = false) {
+  const len = lst.length;
+  let Ah = new Uint32Array(len);
+  let Al = new Uint32Array(len);
+  for (let i = 0; i < len; i++) {
+    const { h, l } = fromBig2(lst[i], le);
+    [Ah[i], Al[i]] = [h, l];
+  }
+  return [Ah, Al];
+}
+var shrSH3 = (h, _l, s) => h >>> s;
+var shrSL3 = (h, l, s) => h << 32 - s | l >>> s;
+var rotrSH3 = (h, l, s) => h >>> s | l << 32 - s;
+var rotrSL3 = (h, l, s) => h << 32 - s | l >>> s;
+var rotrBH3 = (h, l, s) => h << 64 - s | l >>> s - 32;
+var rotrBL3 = (h, l, s) => h >>> s - 32 | l << 64 - s;
+function add3(Ah, Al, Bh, Bl) {
+  const l = (Al >>> 0) + (Bl >>> 0);
+  return { h: Ah + Bh + (l / 2 ** 32 | 0) | 0, l: l | 0 };
+}
+var add3L3 = (Al, Bl, Cl) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0);
+var add3H3 = (low, Ah, Bh, Ch) => Ah + Bh + Ch + (low / 2 ** 32 | 0) | 0;
+var add4L3 = (Al, Bl, Cl, Dl) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0);
+var add4H3 = (low, Ah, Bh, Ch, Dh) => Ah + Bh + Ch + Dh + (low / 2 ** 32 | 0) | 0;
+var add5L3 = (Al, Bl, Cl, Dl, El) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0) + (El >>> 0);
+var add5H3 = (low, Ah, Bh, Ch, Dh, Eh) => Ah + Bh + Ch + Dh + Eh + (low / 2 ** 32 | 0) | 0;
 
 // ../../node_modules/.pnpm/@noble+hashes@1.8.0/node_modules/@noble/hashes/esm/sha2.js
 var SHA256_K = /* @__PURE__ */ Uint32Array.from([
@@ -24569,75 +24622,205 @@ var SHA256 = class extends HashMD3 {
     clean3(this.buffer);
   }
 };
-var sha2562 = /* @__PURE__ */ createHasher3(() => new SHA256());
-
-// ../../node_modules/.pnpm/@noble+hashes@1.8.0/node_modules/@noble/hashes/esm/hmac.js
-var HMAC = class extends Hash {
-  constructor(hash, _key) {
-    super();
-    this.finished = false;
-    this.destroyed = false;
-    ahash3(hash);
-    const key = toBytes(_key);
-    this.iHash = hash.create();
-    if (typeof this.iHash.update !== "function")
-      throw new Error("Expected instance of class which extends utils.Hash");
-    this.blockLen = this.iHash.blockLen;
-    this.outputLen = this.iHash.outputLen;
-    const blockLen = this.blockLen;
-    const pad = new Uint8Array(blockLen);
-    pad.set(key.length > blockLen ? hash.create().update(key).digest() : key);
-    for (let i = 0; i < pad.length; i++)
-      pad[i] ^= 54;
-    this.iHash.update(pad);
-    this.oHash = hash.create();
-    for (let i = 0; i < pad.length; i++)
-      pad[i] ^= 54 ^ 92;
-    this.oHash.update(pad);
-    clean3(pad);
-  }
-  update(buf) {
-    aexists3(this);
-    this.iHash.update(buf);
-    return this;
+var K5123 = /* @__PURE__ */ (() => split3([
+  "0x428a2f98d728ae22",
+  "0x7137449123ef65cd",
+  "0xb5c0fbcfec4d3b2f",
+  "0xe9b5dba58189dbbc",
+  "0x3956c25bf348b538",
+  "0x59f111f1b605d019",
+  "0x923f82a4af194f9b",
+  "0xab1c5ed5da6d8118",
+  "0xd807aa98a3030242",
+  "0x12835b0145706fbe",
+  "0x243185be4ee4b28c",
+  "0x550c7dc3d5ffb4e2",
+  "0x72be5d74f27b896f",
+  "0x80deb1fe3b1696b1",
+  "0x9bdc06a725c71235",
+  "0xc19bf174cf692694",
+  "0xe49b69c19ef14ad2",
+  "0xefbe4786384f25e3",
+  "0x0fc19dc68b8cd5b5",
+  "0x240ca1cc77ac9c65",
+  "0x2de92c6f592b0275",
+  "0x4a7484aa6ea6e483",
+  "0x5cb0a9dcbd41fbd4",
+  "0x76f988da831153b5",
+  "0x983e5152ee66dfab",
+  "0xa831c66d2db43210",
+  "0xb00327c898fb213f",
+  "0xbf597fc7beef0ee4",
+  "0xc6e00bf33da88fc2",
+  "0xd5a79147930aa725",
+  "0x06ca6351e003826f",
+  "0x142929670a0e6e70",
+  "0x27b70a8546d22ffc",
+  "0x2e1b21385c26c926",
+  "0x4d2c6dfc5ac42aed",
+  "0x53380d139d95b3df",
+  "0x650a73548baf63de",
+  "0x766a0abb3c77b2a8",
+  "0x81c2c92e47edaee6",
+  "0x92722c851482353b",
+  "0xa2bfe8a14cf10364",
+  "0xa81a664bbc423001",
+  "0xc24b8b70d0f89791",
+  "0xc76c51a30654be30",
+  "0xd192e819d6ef5218",
+  "0xd69906245565a910",
+  "0xf40e35855771202a",
+  "0x106aa07032bbd1b8",
+  "0x19a4c116b8d2d0c8",
+  "0x1e376c085141ab53",
+  "0x2748774cdf8eeb99",
+  "0x34b0bcb5e19b48a8",
+  "0x391c0cb3c5c95a63",
+  "0x4ed8aa4ae3418acb",
+  "0x5b9cca4f7763e373",
+  "0x682e6ff3d6b2b8a3",
+  "0x748f82ee5defb2fc",
+  "0x78a5636f43172f60",
+  "0x84c87814a1f0ab72",
+  "0x8cc702081a6439ec",
+  "0x90befffa23631e28",
+  "0xa4506cebde82bde9",
+  "0xbef9a3f7b2c67915",
+  "0xc67178f2e372532b",
+  "0xca273eceea26619c",
+  "0xd186b8c721c0c207",
+  "0xeada7dd6cde0eb1e",
+  "0xf57d4f7fee6ed178",
+  "0x06f067aa72176fba",
+  "0x0a637dc5a2c898a6",
+  "0x113f9804bef90dae",
+  "0x1b710b35131c471b",
+  "0x28db77f523047d84",
+  "0x32caab7b40c72493",
+  "0x3c9ebe0a15c9bebc",
+  "0x431d67c49c100d4c",
+  "0x4cc5d4becb3e42b6",
+  "0x597f299cfc657e2a",
+  "0x5fcb6fab3ad6faec",
+  "0x6c44198c4a475817"
+].map((n) => BigInt(n))))();
+var SHA512_Kh3 = /* @__PURE__ */ (() => K5123[0])();
+var SHA512_Kl3 = /* @__PURE__ */ (() => K5123[1])();
+var SHA512_W_H3 = /* @__PURE__ */ new Uint32Array(80);
+var SHA512_W_L3 = /* @__PURE__ */ new Uint32Array(80);
+var SHA512 = class extends HashMD3 {
+  constructor(outputLen = 64) {
+    super(128, outputLen, 16, false);
+    this.Ah = SHA512_IV3[0] | 0;
+    this.Al = SHA512_IV3[1] | 0;
+    this.Bh = SHA512_IV3[2] | 0;
+    this.Bl = SHA512_IV3[3] | 0;
+    this.Ch = SHA512_IV3[4] | 0;
+    this.Cl = SHA512_IV3[5] | 0;
+    this.Dh = SHA512_IV3[6] | 0;
+    this.Dl = SHA512_IV3[7] | 0;
+    this.Eh = SHA512_IV3[8] | 0;
+    this.El = SHA512_IV3[9] | 0;
+    this.Fh = SHA512_IV3[10] | 0;
+    this.Fl = SHA512_IV3[11] | 0;
+    this.Gh = SHA512_IV3[12] | 0;
+    this.Gl = SHA512_IV3[13] | 0;
+    this.Hh = SHA512_IV3[14] | 0;
+    this.Hl = SHA512_IV3[15] | 0;
   }
-  digestInto(out) {
-    aexists3(this);
-    abytes3(out, this.outputLen);
-    this.finished = true;
-    this.iHash.digestInto(out);
-    this.oHash.update(out);
-    this.oHash.digestInto(out);
-    this.destroy();
+  // prettier-ignore
+  get() {
+    const { Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl } = this;
+    return [Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl];
   }
-  digest() {
-    const out = new Uint8Array(this.oHash.outputLen);
-    this.digestInto(out);
-    return out;
+  // prettier-ignore
+  set(Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl) {
+    this.Ah = Ah | 0;
+    this.Al = Al | 0;
+    this.Bh = Bh | 0;
+    this.Bl = Bl | 0;
+    this.Ch = Ch | 0;
+    this.Cl = Cl | 0;
+    this.Dh = Dh | 0;
+    this.Dl = Dl | 0;
+    this.Eh = Eh | 0;
+    this.El = El | 0;
+    this.Fh = Fh | 0;
+    this.Fl = Fl | 0;
+    this.Gh = Gh | 0;
+    this.Gl = Gl | 0;
+    this.Hh = Hh | 0;
+    this.Hl = Hl | 0;
   }
-  _cloneInto(to) {
-    to || (to = Object.create(Object.getPrototypeOf(this), {}));
-    const { oHash, iHash, finished, destroyed, blockLen, outputLen } = this;
-    to = to;
-    to.finished = finished;
-    to.destroyed = destroyed;
-    to.blockLen = blockLen;
-    to.outputLen = outputLen;
-    to.oHash = oHash._cloneInto(to.oHash);
-    to.iHash = iHash._cloneInto(to.iHash);
-    return to;
+  process(view, offset) {
+    for (let i = 0; i < 16; i++, offset += 4) {
+      SHA512_W_H3[i] = view.getUint32(offset);
+      SHA512_W_L3[i] = view.getUint32(offset += 4);
+    }
+    for (let i = 16; i < 80; i++) {
+      const W15h = SHA512_W_H3[i - 15] | 0;
+      const W15l = SHA512_W_L3[i - 15] | 0;
+      const s0h = rotrSH3(W15h, W15l, 1) ^ rotrSH3(W15h, W15l, 8) ^ shrSH3(W15h, W15l, 7);
+      const s0l = rotrSL3(W15h, W15l, 1) ^ rotrSL3(W15h, W15l, 8) ^ shrSL3(W15h, W15l, 7);
+      const W2h = SHA512_W_H3[i - 2] | 0;
+      const W2l = SHA512_W_L3[i - 2] | 0;
+      const s1h = rotrSH3(W2h, W2l, 19) ^ rotrBH3(W2h, W2l, 61) ^ shrSH3(W2h, W2l, 6);
+      const s1l = rotrSL3(W2h, W2l, 19) ^ rotrBL3(W2h, W2l, 61) ^ shrSL3(W2h, W2l, 6);
+      const SUMl = add4L3(s0l, s1l, SHA512_W_L3[i - 7], SHA512_W_L3[i - 16]);
+      const SUMh = add4H3(SUMl, s0h, s1h, SHA512_W_H3[i - 7], SHA512_W_H3[i - 16]);
+      SHA512_W_H3[i] = SUMh | 0;
+      SHA512_W_L3[i] = SUMl | 0;
+    }
+    let { Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl } = this;
+    for (let i = 0; i < 80; i++) {
+      const sigma1h = rotrSH3(Eh, El, 14) ^ rotrSH3(Eh, El, 18) ^ rotrBH3(Eh, El, 41);
+      const sigma1l = rotrSL3(Eh, El, 14) ^ rotrSL3(Eh, El, 18) ^ rotrBL3(Eh, El, 41);
+      const CHIh = Eh & Fh ^ ~Eh & Gh;
+      const CHIl = El & Fl ^ ~El & Gl;
+      const T1ll = add5L3(Hl, sigma1l, CHIl, SHA512_Kl3[i], SHA512_W_L3[i]);
+      const T1h = add5H3(T1ll, Hh, sigma1h, CHIh, SHA512_Kh3[i], SHA512_W_H3[i]);
+      const T1l = T1ll | 0;
+      const sigma0h = rotrSH3(Ah, Al, 28) ^ rotrBH3(Ah, Al, 34) ^ rotrBH3(Ah, Al, 39);
+      const sigma0l = rotrSL3(Ah, Al, 28) ^ rotrBL3(Ah, Al, 34) ^ rotrBL3(Ah, Al, 39);
+      const MAJh = Ah & Bh ^ Ah & Ch ^ Bh & Ch;
+      const MAJl = Al & Bl ^ Al & Cl ^ Bl & Cl;
+      Hh = Gh | 0;
+      Hl = Gl | 0;
+      Gh = Fh | 0;
+      Gl = Fl | 0;
+      Fh = Eh | 0;
+      Fl = El | 0;
+      ({ h: Eh, l: El } = add3(Dh | 0, Dl | 0, T1h | 0, T1l | 0));
+      Dh = Ch | 0;
+      Dl = Cl | 0;
+      Ch = Bh | 0;
+      Cl = Bl | 0;
+      Bh = Ah | 0;
+      Bl = Al | 0;
+      const All = add3L3(T1l, sigma0l, MAJl);
+      Ah = add3H3(All, T1h, sigma0h, MAJh);
+      Al = All | 0;
+    }
+    ({ h: Ah, l: Al } = add3(this.Ah | 0, this.Al | 0, Ah | 0, Al | 0));
+    ({ h: Bh, l: Bl } = add3(this.Bh | 0, this.Bl | 0, Bh | 0, Bl | 0));
+    ({ h: Ch, l: Cl } = add3(this.Ch | 0, this.Cl | 0, Ch | 0, Cl | 0));
+    ({ h: Dh, l: Dl } = add3(this.Dh | 0, this.Dl | 0, Dh | 0, Dl | 0));
+    ({ h: Eh, l: El } = add3(this.Eh | 0, this.El | 0, Eh | 0, El | 0));
+    ({ h: Fh, l: Fl } = add3(this.Fh | 0, this.Fl | 0, Fh | 0, Fl | 0));
+    ({ h: Gh, l: Gl } = add3(this.Gh | 0, this.Gl | 0, Gh | 0, Gl | 0));
+    ({ h: Hh, l: Hl } = add3(this.Hh | 0, this.Hl | 0, Hh | 0, Hl | 0));
+    this.set(Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl);
   }
-  clone() {
-    return this._cloneInto();
+  roundClean() {
+    clean3(SHA512_W_H3, SHA512_W_L3);
   }
   destroy() {
-    this.destroyed = true;
-    this.oHash.destroy();
-    this.iHash.destroy();
+    clean3(this.buffer);
+    this.set(0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0);
   }
 };
-var hmac3 = (hash, key, message) => new HMAC(hash, key).update(message).digest();
-hmac3.create = (hash, key) => new HMAC(hash, key);
+var sha2562 = /* @__PURE__ */ createHasher3(() => new SHA256());
+var sha5123 = /* @__PURE__ */ createHasher3(() => new SHA512());
 
 // ../../node_modules/.pnpm/@noble+curves@1.9.7/node_modules/@noble/curves/esm/utils.js
 var _0n5 = /* @__PURE__ */ BigInt(0);
@@ -24701,6 +24884,17 @@ function ensureBytes(title, hex, expectedLength) {
     throw new Error(title + " of length " + expectedLength + " expected, got " + len);
   return res;
 }
+function equalBytes(a, b) {
+  if (a.length !== b.length)
+    return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++)
+    diff |= a[i] ^ b[i];
+  return diff === 0;
+}
+function copyBytes2(bytes) {
+  return Uint8Array.from(bytes);
+}
 var isPosBig2 = (n) => typeof n === "bigint" && _0n5 <= n;
 function inRange2(n, min, max) {
   return isPosBig2(n) && isPosBig2(min) && isPosBig2(max) && min <= n && n < max;
@@ -24780,6 +24974,9 @@ function _validateObject(object, fields, optFields = {}) {
   Object.entries(fields).forEach(([k, v]) => checkField(k, v, false));
   Object.entries(optFields).forEach(([k, v]) => checkField(k, v, true));
 }
+var notImplemented2 = () => {
+  throw new Error("not implemented");
+};
 function memoized2(fn) {
   const map = /* @__PURE__ */ new WeakMap();
   return (arg, ...args) => {
@@ -24835,24 +25032,24 @@ function invert2(number, modulo) {
     throw new Error("invert: does not exist");
   return mod2(x, modulo);
 }
-function assertIsSquare2(Fp, root, n) {
-  if (!Fp.eql(Fp.sqr(root), n))
+function assertIsSquare2(Fp2, root, n) {
+  if (!Fp2.eql(Fp2.sqr(root), n))
     throw new Error("Cannot find square root");
 }
-function sqrt3mod42(Fp, n) {
-  const p1div4 = (Fp.ORDER + _1n7) / _4n2;
-  const root = Fp.pow(n, p1div4);
-  assertIsSquare2(Fp, root, n);
+function sqrt3mod42(Fp2, n) {
+  const p1div4 = (Fp2.ORDER + _1n7) / _4n2;
+  const root = Fp2.pow(n, p1div4);
+  assertIsSquare2(Fp2, root, n);
   return root;
 }
-function sqrt5mod82(Fp, n) {
-  const p5div8 = (Fp.ORDER - _5n3) / _8n4;
-  const n2 = Fp.mul(n, _2n4);
-  const v = Fp.pow(n2, p5div8);
-  const nv = Fp.mul(n, v);
-  const i = Fp.mul(Fp.mul(nv, _2n4), v);
-  const root = Fp.mul(nv, Fp.sub(i, Fp.ONE));
-  assertIsSquare2(Fp, root, n);
+function sqrt5mod82(Fp2, n) {
+  const p5div8 = (Fp2.ORDER - _5n3) / _8n4;
+  const n2 = Fp2.mul(n, _2n4);
+  const v = Fp2.pow(n2, p5div8);
+  const nv = Fp2.mul(n, v);
+  const i = Fp2.mul(Fp2.mul(nv, _2n4), v);
+  const root = Fp2.mul(nv, Fp2.sub(i, Fp2.ONE));
+  assertIsSquare2(Fp2, root, n);
   return root;
 }
 function sqrt9mod162(P) {
@@ -24862,18 +25059,18 @@ function sqrt9mod162(P) {
   const c2 = tn(Fp_, c1);
   const c3 = tn(Fp_, Fp_.neg(c1));
   const c4 = (P + _7n2) / _16n2;
-  return (Fp, n) => {
-    let tv1 = Fp.pow(n, c4);
-    let tv2 = Fp.mul(tv1, c1);
-    const tv3 = Fp.mul(tv1, c2);
-    const tv4 = Fp.mul(tv1, c3);
-    const e1 = Fp.eql(Fp.sqr(tv2), n);
-    const e2 = Fp.eql(Fp.sqr(tv3), n);
-    tv1 = Fp.cmov(tv1, tv2, e1);
-    tv2 = Fp.cmov(tv4, tv3, e2);
-    const e3 = Fp.eql(Fp.sqr(tv2), n);
-    const root = Fp.cmov(tv1, tv2, e3);
-    assertIsSquare2(Fp, root, n);
+  return (Fp2, n) => {
+    let tv1 = Fp2.pow(n, c4);
+    let tv2 = Fp2.mul(tv1, c1);
+    const tv3 = Fp2.mul(tv1, c2);
+    const tv4 = Fp2.mul(tv1, c3);
+    const e1 = Fp2.eql(Fp2.sqr(tv2), n);
+    const e2 = Fp2.eql(Fp2.sqr(tv3), n);
+    tv1 = Fp2.cmov(tv1, tv2, e1);
+    tv2 = Fp2.cmov(tv4, tv3, e2);
+    const e3 = Fp2.eql(Fp2.sqr(tv2), n);
+    const root = Fp2.cmov(tv1, tv2, e3);
+    assertIsSquare2(Fp2, root, n);
     return root;
   };
 }
@@ -24896,32 +25093,32 @@ function tonelliShanks2(P) {
     return sqrt3mod42;
   let cc = _Fp.pow(Z, Q);
   const Q1div2 = (Q + _1n7) / _2n4;
-  return function tonelliSlow(Fp, n) {
-    if (Fp.is0(n))
+  return function tonelliSlow(Fp2, n) {
+    if (Fp2.is0(n))
       return n;
-    if (FpLegendre2(Fp, n) !== 1)
+    if (FpLegendre2(Fp2, n) !== 1)
       throw new Error("Cannot find square root");
     let M = S;
-    let c = Fp.mul(Fp.ONE, cc);
-    let t = Fp.pow(n, Q);
-    let R = Fp.pow(n, Q1div2);
-    while (!Fp.eql(t, Fp.ONE)) {
-      if (Fp.is0(t))
-        return Fp.ZERO;
+    let c = Fp2.mul(Fp2.ONE, cc);
+    let t = Fp2.pow(n, Q);
+    let R = Fp2.pow(n, Q1div2);
+    while (!Fp2.eql(t, Fp2.ONE)) {
+      if (Fp2.is0(t))
+        return Fp2.ZERO;
       let i = 1;
-      let t_tmp = Fp.sqr(t);
-      while (!Fp.eql(t_tmp, Fp.ONE)) {
+      let t_tmp = Fp2.sqr(t);
+      while (!Fp2.eql(t_tmp, Fp2.ONE)) {
         i++;
-        t_tmp = Fp.sqr(t_tmp);
+        t_tmp = Fp2.sqr(t_tmp);
         if (i === M)
           throw new Error("Cannot find square root");
       }
       const exponent = _1n7 << BigInt(M - i - 1);
-      const b = Fp.pow(c, exponent);
+      const b = Fp2.pow(c, exponent);
       M = i;
-      c = Fp.sqr(b);
-      t = Fp.mul(t, c);
-      R = Fp.mul(R, b);
+      c = Fp2.sqr(b);
+      t = Fp2.mul(t, c);
+      R = Fp2.mul(R, b);
     }
     return R;
   };
@@ -24935,6 +25132,7 @@ function FpSqrt2(P) {
     return sqrt9mod162(P);
   return tonelliShanks2(P);
 }
+var isNegativeLE2 = (num, modulo) => (mod2(num, modulo) & _1n7) === _1n7;
 var FIELD_FIELDS2 = [
   "create",
   "isValid",
@@ -24968,46 +25166,46 @@ function validateField2(field) {
   _validateObject(field, opts);
   return field;
 }
-function FpPow2(Fp, num, power) {
+function FpPow2(Fp2, num, power) {
   if (power < _0n6)
     throw new Error("invalid exponent, negatives unsupported");
   if (power === _0n6)
-    return Fp.ONE;
+    return Fp2.ONE;
   if (power === _1n7)
     return num;
-  let p = Fp.ONE;
+  let p = Fp2.ONE;
   let d = num;
   while (power > _0n6) {
     if (power & _1n7)
-      p = Fp.mul(p, d);
-    d = Fp.sqr(d);
+      p = Fp2.mul(p, d);
+    d = Fp2.sqr(d);
     power >>= _1n7;
   }
   return p;
 }
-function FpInvertBatch2(Fp, nums, passZero = false) {
-  const inverted = new Array(nums.length).fill(passZero ? Fp.ZERO : void 0);
+function FpInvertBatch2(Fp2, nums, passZero = false) {
+  const inverted = new Array(nums.length).fill(passZero ? Fp2.ZERO : void 0);
   const multipliedAcc = nums.reduce((acc, num, i) => {
-    if (Fp.is0(num))
+    if (Fp2.is0(num))
       return acc;
     inverted[i] = acc;
-    return Fp.mul(acc, num);
-  }, Fp.ONE);
-  const invertedAcc = Fp.inv(multipliedAcc);
+    return Fp2.mul(acc, num);
+  }, Fp2.ONE);
+  const invertedAcc = Fp2.inv(multipliedAcc);
   nums.reduceRight((acc, num, i) => {
-    if (Fp.is0(num))
+    if (Fp2.is0(num))
       return acc;
-    inverted[i] = Fp.mul(acc, inverted[i]);
-    return Fp.mul(acc, num);
+    inverted[i] = Fp2.mul(acc, inverted[i]);
+    return Fp2.mul(acc, num);
   }, invertedAcc);
   return inverted;
 }
-function FpLegendre2(Fp, n) {
-  const p1mod2 = (Fp.ORDER - _1n7) / _2n4;
-  const powered = Fp.pow(n, p1mod2);
-  const yes = Fp.eql(powered, Fp.ONE);
-  const zero = Fp.eql(powered, Fp.ZERO);
-  const no = Fp.eql(powered, Fp.neg(Fp.ONE));
+function FpLegendre2(Fp2, n) {
+  const p1mod2 = (Fp2.ORDER - _1n7) / _2n4;
+  const powered = Fp2.pow(n, p1mod2);
+  const yes = Fp2.eql(powered, Fp2.ONE);
+  const zero = Fp2.eql(powered, Fp2.ZERO);
+  const no = Fp2.eql(powered, Fp2.neg(Fp2.ONE));
   if (!yes && !zero && !no)
     throw new Error("invalid Legendre symbol result");
   return yes ? 1 : zero ? 0 : -1;
@@ -25307,130 +25505,972 @@ var wNAF2 = class {
     }
     return comp;
   }
-  cached(point, scalar, transform) {
-    const W = getW2(point);
-    return this.wNAF(W, this.getPrecomputes(W, point, transform), scalar);
+  cached(point, scalar, transform) {
+    const W = getW2(point);
+    return this.wNAF(W, this.getPrecomputes(W, point, transform), scalar);
+  }
+  unsafe(point, scalar, transform, prev) {
+    const W = getW2(point);
+    if (W === 1)
+      return this._unsafeLadder(point, scalar, prev);
+    return this.wNAFUnsafe(W, this.getPrecomputes(W, point, transform), scalar, prev);
+  }
+  // We calculate precomputes for elliptic curve point multiplication
+  // using windowed method. This specifies window size and
+  // stores precomputed values. Usually only base point would be precomputed.
+  createCache(P, W) {
+    validateW2(W, this.bits);
+    pointWindowSizes2.set(P, W);
+    pointPrecomputes2.delete(P);
+  }
+  hasCache(elm) {
+    return getW2(elm) !== 1;
+  }
+};
+function mulEndoUnsafe(Point, point, k1, k2) {
+  let acc = point;
+  let p1 = Point.ZERO;
+  let p2 = Point.ZERO;
+  while (k1 > _0n7 || k2 > _0n7) {
+    if (k1 & _1n8)
+      p1 = p1.add(acc);
+    if (k2 & _1n8)
+      p2 = p2.add(acc);
+    acc = acc.double();
+    k1 >>= _1n8;
+    k2 >>= _1n8;
+  }
+  return { p1, p2 };
+}
+function pippenger(c, fieldN, points, scalars) {
+  validateMSMPoints(points, c);
+  validateMSMScalars(scalars, fieldN);
+  const plength = points.length;
+  const slength = scalars.length;
+  if (plength !== slength)
+    throw new Error("arrays of points and scalars must have equal length");
+  const zero = c.ZERO;
+  const wbits = bitLen2(BigInt(plength));
+  let windowSize = 1;
+  if (wbits > 12)
+    windowSize = wbits - 3;
+  else if (wbits > 4)
+    windowSize = wbits - 2;
+  else if (wbits > 0)
+    windowSize = 2;
+  const MASK = bitMask2(windowSize);
+  const buckets = new Array(Number(MASK) + 1).fill(zero);
+  const lastBits = Math.floor((fieldN.BITS - 1) / windowSize) * windowSize;
+  let sum = zero;
+  for (let i = lastBits; i >= 0; i -= windowSize) {
+    buckets.fill(zero);
+    for (let j = 0; j < slength; j++) {
+      const scalar = scalars[j];
+      const wbits2 = Number(scalar >> BigInt(i) & MASK);
+      buckets[wbits2] = buckets[wbits2].add(points[j]);
+    }
+    let resI = zero;
+    for (let j = buckets.length - 1, sumI = zero; j > 0; j--) {
+      sumI = sumI.add(buckets[j]);
+      resI = resI.add(sumI);
+    }
+    sum = sum.add(resI);
+    if (i !== 0)
+      for (let j = 0; j < windowSize; j++)
+        sum = sum.double();
+  }
+  return sum;
+}
+function createField2(order, field, isLE) {
+  if (field) {
+    if (field.ORDER !== order)
+      throw new Error("Field.ORDER must match order: Fp == p, Fn == n");
+    validateField2(field);
+    return field;
+  } else {
+    return Field2(order, { isLE });
+  }
+}
+function _createCurveFields(type, CURVE, curveOpts = {}, FpFnLE) {
+  if (FpFnLE === void 0)
+    FpFnLE = type === "edwards";
+  if (!CURVE || typeof CURVE !== "object")
+    throw new Error(`expected valid ${type} CURVE object`);
+  for (const p of ["p", "n", "h"]) {
+    const val = CURVE[p];
+    if (!(typeof val === "bigint" && val > _0n7))
+      throw new Error(`CURVE.${p} must be positive bigint`);
+  }
+  const Fp2 = createField2(CURVE.p, curveOpts.Fp, FpFnLE);
+  const Fn2 = createField2(CURVE.n, curveOpts.Fn, FpFnLE);
+  const _b = type === "weierstrass" ? "b" : "d";
+  const params = ["Gx", "Gy", "a", _b];
+  for (const p of params) {
+    if (!Fp2.isValid(CURVE[p]))
+      throw new Error(`CURVE.${p} must be valid field element of CURVE.Fp`);
+  }
+  CURVE = Object.freeze(Object.assign({}, CURVE));
+  return { CURVE, Fp: Fp2, Fn: Fn2 };
+}
+
+// ../../node_modules/.pnpm/@noble+curves@1.9.7/node_modules/@noble/curves/esm/abstract/edwards.js
+var _0n8 = BigInt(0);
+var _1n9 = BigInt(1);
+var _2n5 = BigInt(2);
+var _8n5 = BigInt(8);
+function isEdValidXY2(Fp2, CURVE, x, y) {
+  const x2 = Fp2.sqr(x);
+  const y2 = Fp2.sqr(y);
+  const left = Fp2.add(Fp2.mul(CURVE.a, x2), y2);
+  const right = Fp2.add(Fp2.ONE, Fp2.mul(CURVE.d, Fp2.mul(x2, y2)));
+  return Fp2.eql(left, right);
+}
+function edwards2(params, extraOpts = {}) {
+  const validated = _createCurveFields("edwards", params, extraOpts, extraOpts.FpFnLE);
+  const { Fp: Fp2, Fn: Fn2 } = validated;
+  let CURVE = validated.CURVE;
+  const { h: cofactor } = CURVE;
+  _validateObject(extraOpts, {}, { uvRatio: "function" });
+  const MASK = _2n5 << BigInt(Fn2.BYTES * 8) - _1n9;
+  const modP = (n) => Fp2.create(n);
+  const uvRatio3 = extraOpts.uvRatio || ((u, v) => {
+    try {
+      return { isValid: true, value: Fp2.sqrt(Fp2.div(u, v)) };
+    } catch (e) {
+      return { isValid: false, value: _0n8 };
+    }
+  });
+  if (!isEdValidXY2(Fp2, CURVE, CURVE.Gx, CURVE.Gy))
+    throw new Error("bad curve params: generator point");
+  function acoord(title, n, banZero = false) {
+    const min = banZero ? _1n9 : _0n8;
+    aInRange2("coordinate " + title, n, min, MASK);
+    return n;
+  }
+  function aextpoint(other) {
+    if (!(other instanceof Point))
+      throw new Error("ExtendedPoint expected");
+  }
+  const toAffineMemo = memoized2((p, iz) => {
+    const { X, Y, Z } = p;
+    const is0 = p.is0();
+    if (iz == null)
+      iz = is0 ? _8n5 : Fp2.inv(Z);
+    const x = modP(X * iz);
+    const y = modP(Y * iz);
+    const zz = Fp2.mul(Z, iz);
+    if (is0)
+      return { x: _0n8, y: _1n9 };
+    if (zz !== _1n9)
+      throw new Error("invZ was invalid");
+    return { x, y };
+  });
+  const assertValidMemo = memoized2((p) => {
+    const { a, d } = CURVE;
+    if (p.is0())
+      throw new Error("bad point: ZERO");
+    const { X, Y, Z, T } = p;
+    const X2 = modP(X * X);
+    const Y2 = modP(Y * Y);
+    const Z2 = modP(Z * Z);
+    const Z4 = modP(Z2 * Z2);
+    const aX2 = modP(X2 * a);
+    const left = modP(Z2 * modP(aX2 + Y2));
+    const right = modP(Z4 + modP(d * modP(X2 * Y2)));
+    if (left !== right)
+      throw new Error("bad point: equation left != right (1)");
+    const XY = modP(X * Y);
+    const ZT = modP(Z * T);
+    if (XY !== ZT)
+      throw new Error("bad point: equation left != right (2)");
+    return true;
+  });
+  class Point {
+    constructor(X, Y, Z, T) {
+      this.X = acoord("x", X);
+      this.Y = acoord("y", Y);
+      this.Z = acoord("z", Z, true);
+      this.T = acoord("t", T);
+      Object.freeze(this);
+    }
+    static CURVE() {
+      return CURVE;
+    }
+    static fromAffine(p) {
+      if (p instanceof Point)
+        throw new Error("extended point not allowed");
+      const { x, y } = p || {};
+      acoord("x", x);
+      acoord("y", y);
+      return new Point(x, y, _1n9, modP(x * y));
+    }
+    // Uses algo from RFC8032 5.1.3.
+    static fromBytes(bytes, zip215 = false) {
+      const len = Fp2.BYTES;
+      const { a, d } = CURVE;
+      bytes = copyBytes2(_abytes2(bytes, len, "point"));
+      _abool2(zip215, "zip215");
+      const normed = copyBytes2(bytes);
+      const lastByte = bytes[len - 1];
+      normed[len - 1] = lastByte & ~128;
+      const y = bytesToNumberLE2(normed);
+      const max = zip215 ? MASK : Fp2.ORDER;
+      aInRange2("point.y", y, _0n8, max);
+      const y2 = modP(y * y);
+      const u = modP(y2 - _1n9);
+      const v = modP(d * y2 - a);
+      let { isValid, value: x } = uvRatio3(u, v);
+      if (!isValid)
+        throw new Error("bad point: invalid y coordinate");
+      const isXOdd = (x & _1n9) === _1n9;
+      const isLastByteOdd = (lastByte & 128) !== 0;
+      if (!zip215 && x === _0n8 && isLastByteOdd)
+        throw new Error("bad point: x=0 and x_0=1");
+      if (isLastByteOdd !== isXOdd)
+        x = modP(-x);
+      return Point.fromAffine({ x, y });
+    }
+    static fromHex(bytes, zip215 = false) {
+      return Point.fromBytes(ensureBytes("point", bytes), zip215);
+    }
+    get x() {
+      return this.toAffine().x;
+    }
+    get y() {
+      return this.toAffine().y;
+    }
+    precompute(windowSize = 8, isLazy = true) {
+      wnaf.createCache(this, windowSize);
+      if (!isLazy)
+        this.multiply(_2n5);
+      return this;
+    }
+    // Useful in fromAffine() - not for fromBytes(), which always created valid points.
+    assertValidity() {
+      assertValidMemo(this);
+    }
+    // Compare one point to another.
+    equals(other) {
+      aextpoint(other);
+      const { X: X1, Y: Y1, Z: Z1 } = this;
+      const { X: X2, Y: Y2, Z: Z2 } = other;
+      const X1Z2 = modP(X1 * Z2);
+      const X2Z1 = modP(X2 * Z1);
+      const Y1Z2 = modP(Y1 * Z2);
+      const Y2Z1 = modP(Y2 * Z1);
+      return X1Z2 === X2Z1 && Y1Z2 === Y2Z1;
+    }
+    is0() {
+      return this.equals(Point.ZERO);
+    }
+    negate() {
+      return new Point(modP(-this.X), this.Y, this.Z, modP(-this.T));
+    }
+    // Fast algo for doubling Extended Point.
+    // https://hyperelliptic.org/EFD/g1p/auto-twisted-extended.html#doubling-dbl-2008-hwcd
+    // Cost: 4M + 4S + 1*a + 6add + 1*2.
+    double() {
+      const { a } = CURVE;
+      const { X: X1, Y: Y1, Z: Z1 } = this;
+      const A = modP(X1 * X1);
+      const B = modP(Y1 * Y1);
+      const C = modP(_2n5 * modP(Z1 * Z1));
+      const D = modP(a * A);
+      const x1y1 = X1 + Y1;
+      const E = modP(modP(x1y1 * x1y1) - A - B);
+      const G = D + B;
+      const F = G - C;
+      const H = D - B;
+      const X3 = modP(E * F);
+      const Y3 = modP(G * H);
+      const T3 = modP(E * H);
+      const Z3 = modP(F * G);
+      return new Point(X3, Y3, Z3, T3);
+    }
+    // Fast algo for adding 2 Extended Points.
+    // https://hyperelliptic.org/EFD/g1p/auto-twisted-extended.html#addition-add-2008-hwcd
+    // Cost: 9M + 1*a + 1*d + 7add.
+    add(other) {
+      aextpoint(other);
+      const { a, d } = CURVE;
+      const { X: X1, Y: Y1, Z: Z1, T: T1 } = this;
+      const { X: X2, Y: Y2, Z: Z2, T: T2 } = other;
+      const A = modP(X1 * X2);
+      const B = modP(Y1 * Y2);
+      const C = modP(T1 * d * T2);
+      const D = modP(Z1 * Z2);
+      const E = modP((X1 + Y1) * (X2 + Y2) - A - B);
+      const F = D - C;
+      const G = D + C;
+      const H = modP(B - a * A);
+      const X3 = modP(E * F);
+      const Y3 = modP(G * H);
+      const T3 = modP(E * H);
+      const Z3 = modP(F * G);
+      return new Point(X3, Y3, Z3, T3);
+    }
+    subtract(other) {
+      return this.add(other.negate());
+    }
+    // Constant-time multiplication.
+    multiply(scalar) {
+      if (!Fn2.isValidNot0(scalar))
+        throw new Error("invalid scalar: expected 1 <= sc < curve.n");
+      const { p, f } = wnaf.cached(this, scalar, (p2) => normalizeZ2(Point, p2));
+      return normalizeZ2(Point, [p, f])[0];
+    }
+    // Non-constant-time multiplication. Uses double-and-add algorithm.
+    // It's faster, but should only be used when you don't care about
+    // an exposed private key e.g. sig verification.
+    // Does NOT allow scalars higher than CURVE.n.
+    // Accepts optional accumulator to merge with multiply (important for sparse scalars)
+    multiplyUnsafe(scalar, acc = Point.ZERO) {
+      if (!Fn2.isValid(scalar))
+        throw new Error("invalid scalar: expected 0 <= sc < curve.n");
+      if (scalar === _0n8)
+        return Point.ZERO;
+      if (this.is0() || scalar === _1n9)
+        return this;
+      return wnaf.unsafe(this, scalar, (p) => normalizeZ2(Point, p), acc);
+    }
+    // Checks if point is of small order.
+    // If you add something to small order point, you will have "dirty"
+    // point with torsion component.
+    // Multiplies point by cofactor and checks if the result is 0.
+    isSmallOrder() {
+      return this.multiplyUnsafe(cofactor).is0();
+    }
+    // Multiplies point by curve order and checks if the result is 0.
+    // Returns `false` is the point is dirty.
+    isTorsionFree() {
+      return wnaf.unsafe(this, CURVE.n).is0();
+    }
+    // Converts Extended point to default (x, y) coordinates.
+    // Can accept precomputed Z^-1 - for example, from invertBatch.
+    toAffine(invertedZ) {
+      return toAffineMemo(this, invertedZ);
+    }
+    clearCofactor() {
+      if (cofactor === _1n9)
+        return this;
+      return this.multiplyUnsafe(cofactor);
+    }
+    toBytes() {
+      const { x, y } = this.toAffine();
+      const bytes = Fp2.toBytes(y);
+      bytes[bytes.length - 1] |= x & _1n9 ? 128 : 0;
+      return bytes;
+    }
+    toHex() {
+      return bytesToHex2(this.toBytes());
+    }
+    toString() {
+      return `<Point ${this.is0() ? "ZERO" : this.toHex()}>`;
+    }
+    // TODO: remove
+    get ex() {
+      return this.X;
+    }
+    get ey() {
+      return this.Y;
+    }
+    get ez() {
+      return this.Z;
+    }
+    get et() {
+      return this.T;
+    }
+    static normalizeZ(points) {
+      return normalizeZ2(Point, points);
+    }
+    static msm(points, scalars) {
+      return pippenger(Point, Fn2, points, scalars);
+    }
+    _setWindowSize(windowSize) {
+      this.precompute(windowSize);
+    }
+    toRawBytes() {
+      return this.toBytes();
+    }
+  }
+  Point.BASE = new Point(CURVE.Gx, CURVE.Gy, _1n9, modP(CURVE.Gx * CURVE.Gy));
+  Point.ZERO = new Point(_0n8, _1n9, _1n9, _0n8);
+  Point.Fp = Fp2;
+  Point.Fn = Fn2;
+  const wnaf = new wNAF2(Point, Fn2.BITS);
+  Point.BASE.precompute(8);
+  return Point;
+}
+var PrimeEdwardsPoint2 = class {
+  constructor(ep) {
+    this.ep = ep;
+  }
+  // Static methods that must be implemented by subclasses
+  static fromBytes(_bytes) {
+    notImplemented2();
+  }
+  static fromHex(_hex) {
+    notImplemented2();
+  }
+  get x() {
+    return this.toAffine().x;
+  }
+  get y() {
+    return this.toAffine().y;
+  }
+  // Common implementations
+  clearCofactor() {
+    return this;
+  }
+  assertValidity() {
+    this.ep.assertValidity();
+  }
+  toAffine(invertedZ) {
+    return this.ep.toAffine(invertedZ);
+  }
+  toHex() {
+    return bytesToHex2(this.toBytes());
+  }
+  toString() {
+    return this.toHex();
+  }
+  isTorsionFree() {
+    return true;
+  }
+  isSmallOrder() {
+    return false;
+  }
+  add(other) {
+    this.assertSame(other);
+    return this.init(this.ep.add(other.ep));
+  }
+  subtract(other) {
+    this.assertSame(other);
+    return this.init(this.ep.subtract(other.ep));
+  }
+  multiply(scalar) {
+    return this.init(this.ep.multiply(scalar));
+  }
+  multiplyUnsafe(scalar) {
+    return this.init(this.ep.multiplyUnsafe(scalar));
+  }
+  double() {
+    return this.init(this.ep.double());
+  }
+  negate() {
+    return this.init(this.ep.negate());
+  }
+  precompute(windowSize, isLazy) {
+    return this.init(this.ep.precompute(windowSize, isLazy));
+  }
+  /** @deprecated use `toBytes` */
+  toRawBytes() {
+    return this.toBytes();
+  }
+};
+function eddsa2(Point, cHash, eddsaOpts = {}) {
+  if (typeof cHash !== "function")
+    throw new Error('"hash" function param is required');
+  _validateObject(eddsaOpts, {}, {
+    adjustScalarBytes: "function",
+    randomBytes: "function",
+    domain: "function",
+    prehash: "function",
+    mapToCurve: "function"
+  });
+  const { prehash } = eddsaOpts;
+  const { BASE, Fp: Fp2, Fn: Fn2 } = Point;
+  const randomBytes3 = eddsaOpts.randomBytes || randomBytes2;
+  const adjustScalarBytes3 = eddsaOpts.adjustScalarBytes || ((bytes) => bytes);
+  const domain = eddsaOpts.domain || ((data, ctx, phflag) => {
+    _abool2(phflag, "phflag");
+    if (ctx.length || phflag)
+      throw new Error("Contexts/pre-hash are not supported");
+    return data;
+  });
+  function modN_LE(hash) {
+    return Fn2.create(bytesToNumberLE2(hash));
+  }
+  function getPrivateScalar(key) {
+    const len = lengths.secretKey;
+    key = ensureBytes("private key", key, len);
+    const hashed = ensureBytes("hashed private key", cHash(key), 2 * len);
+    const head = adjustScalarBytes3(hashed.slice(0, len));
+    const prefix = hashed.slice(len, 2 * len);
+    const scalar = modN_LE(head);
+    return { head, prefix, scalar };
+  }
+  function getExtendedPublicKey(secretKey) {
+    const { head, prefix, scalar } = getPrivateScalar(secretKey);
+    const point = BASE.multiply(scalar);
+    const pointBytes = point.toBytes();
+    return { head, prefix, scalar, point, pointBytes };
+  }
+  function getPublicKey(secretKey) {
+    return getExtendedPublicKey(secretKey).pointBytes;
+  }
+  function hashDomainToScalar(context = Uint8Array.of(), ...msgs) {
+    const msg = concatBytes2(...msgs);
+    return modN_LE(cHash(domain(msg, ensureBytes("context", context), !!prehash)));
+  }
+  function sign(msg, secretKey, options = {}) {
+    msg = ensureBytes("message", msg);
+    if (prehash)
+      msg = prehash(msg);
+    const { prefix, scalar, pointBytes } = getExtendedPublicKey(secretKey);
+    const r = hashDomainToScalar(options.context, prefix, msg);
+    const R = BASE.multiply(r).toBytes();
+    const k = hashDomainToScalar(options.context, R, pointBytes, msg);
+    const s = Fn2.create(r + k * scalar);
+    if (!Fn2.isValid(s))
+      throw new Error("sign failed: invalid s");
+    const rs = concatBytes2(R, Fn2.toBytes(s));
+    return _abytes2(rs, lengths.signature, "result");
+  }
+  const verifyOpts = { zip215: true };
+  function verify(sig, msg, publicKey, options = verifyOpts) {
+    const { context, zip215 } = options;
+    const len = lengths.signature;
+    sig = ensureBytes("signature", sig, len);
+    msg = ensureBytes("message", msg);
+    publicKey = ensureBytes("publicKey", publicKey, lengths.publicKey);
+    if (zip215 !== void 0)
+      _abool2(zip215, "zip215");
+    if (prehash)
+      msg = prehash(msg);
+    const mid = len / 2;
+    const r = sig.subarray(0, mid);
+    const s = bytesToNumberLE2(sig.subarray(mid, len));
+    let A, R, SB;
+    try {
+      A = Point.fromBytes(publicKey, zip215);
+      R = Point.fromBytes(r, zip215);
+      SB = BASE.multiplyUnsafe(s);
+    } catch (error) {
+      return false;
+    }
+    if (!zip215 && A.isSmallOrder())
+      return false;
+    const k = hashDomainToScalar(context, R.toBytes(), A.toBytes(), msg);
+    const RkA = R.add(A.multiplyUnsafe(k));
+    return RkA.subtract(SB).clearCofactor().is0();
+  }
+  const _size = Fp2.BYTES;
+  const lengths = {
+    secretKey: _size,
+    publicKey: _size,
+    signature: 2 * _size,
+    seed: _size
+  };
+  function randomSecretKey(seed = randomBytes3(lengths.seed)) {
+    return _abytes2(seed, lengths.seed, "seed");
+  }
+  function keygen(seed) {
+    const secretKey = utils.randomSecretKey(seed);
+    return { secretKey, publicKey: getPublicKey(secretKey) };
+  }
+  function isValidSecretKey(key) {
+    return isBytes3(key) && key.length === Fn2.BYTES;
+  }
+  function isValidPublicKey(key, zip215) {
+    try {
+      return !!Point.fromBytes(key, zip215);
+    } catch (error) {
+      return false;
+    }
+  }
+  const utils = {
+    getExtendedPublicKey,
+    randomSecretKey,
+    isValidSecretKey,
+    isValidPublicKey,
+    /**
+     * Converts ed public key to x public key. Uses formula:
+     * - ed25519:
+     *   - `(u, v) = ((1+y)/(1-y), sqrt(-486664)*u/x)`
+     *   - `(x, y) = (sqrt(-486664)*u/v, (u-1)/(u+1))`
+     * - ed448:
+     *   - `(u, v) = ((y-1)/(y+1), sqrt(156324)*u/x)`
+     *   - `(x, y) = (sqrt(156324)*u/v, (1+u)/(1-u))`
+     */
+    toMontgomery(publicKey) {
+      const { y } = Point.fromBytes(publicKey);
+      const size = lengths.publicKey;
+      const is25519 = size === 32;
+      if (!is25519 && size !== 57)
+        throw new Error("only defined for 25519 and 448");
+      const u = is25519 ? Fp2.div(_1n9 + y, _1n9 - y) : Fp2.div(y - _1n9, y + _1n9);
+      return Fp2.toBytes(u);
+    },
+    toMontgomerySecret(secretKey) {
+      const size = lengths.secretKey;
+      _abytes2(secretKey, size);
+      const hashed = cHash(secretKey.subarray(0, size));
+      return adjustScalarBytes3(hashed).subarray(0, size);
+    },
+    /** @deprecated */
+    randomPrivateKey: randomSecretKey,
+    /** @deprecated */
+    precompute(windowSize = 8, point = Point.BASE) {
+      return point.precompute(windowSize, false);
+    }
+  };
+  return Object.freeze({
+    keygen,
+    getPublicKey,
+    sign,
+    verify,
+    utils,
+    Point,
+    lengths
+  });
+}
+function _eddsa_legacy_opts_to_new(c) {
+  const CURVE = {
+    a: c.a,
+    d: c.d,
+    p: c.Fp.ORDER,
+    n: c.n,
+    h: c.h,
+    Gx: c.Gx,
+    Gy: c.Gy
+  };
+  const Fp2 = c.Fp;
+  const Fn2 = Field2(CURVE.n, c.nBitLength, true);
+  const curveOpts = { Fp: Fp2, Fn: Fn2, uvRatio: c.uvRatio };
+  const eddsaOpts = {
+    randomBytes: c.randomBytes,
+    adjustScalarBytes: c.adjustScalarBytes,
+    domain: c.domain,
+    prehash: c.prehash,
+    mapToCurve: c.mapToCurve
+  };
+  return { CURVE, curveOpts, hash: c.hash, eddsaOpts };
+}
+function _eddsa_new_output_to_legacy(c, eddsa3) {
+  const Point = eddsa3.Point;
+  const legacy = Object.assign({}, eddsa3, {
+    ExtendedPoint: Point,
+    CURVE: c,
+    nBitLength: Point.Fn.BITS,
+    nByteLength: Point.Fn.BYTES
+  });
+  return legacy;
+}
+function twistedEdwards(c) {
+  const { CURVE, curveOpts, hash, eddsaOpts } = _eddsa_legacy_opts_to_new(c);
+  const Point = edwards2(CURVE, curveOpts);
+  const EDDSA = eddsa2(Point, hash, eddsaOpts);
+  return _eddsa_new_output_to_legacy(c, EDDSA);
+}
+
+// ../../node_modules/.pnpm/@noble+curves@1.9.7/node_modules/@noble/curves/esm/ed25519.js
+var _0n9 = /* @__PURE__ */ BigInt(0);
+var _1n10 = BigInt(1);
+var _2n6 = BigInt(2);
+var _3n3 = BigInt(3);
+var _5n4 = BigInt(5);
+var _8n6 = BigInt(8);
+var ed25519_CURVE_p2 = BigInt("0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffed");
+var ed25519_CURVE2 = /* @__PURE__ */ (() => ({
+  p: ed25519_CURVE_p2,
+  n: BigInt("0x1000000000000000000000000000000014def9dea2f79cd65812631a5cf5d3ed"),
+  h: _8n6,
+  a: BigInt("0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffec"),
+  d: BigInt("0x52036cee2b6ffe738cc740797779e89800700a4d4141d8ab75eb4dca135978a3"),
+  Gx: BigInt("0x216936d3cd6e53fec0a4e231fdd6dc5c692cc7609525a7b2c9562d608f25d51a"),
+  Gy: BigInt("0x6666666666666666666666666666666666666666666666666666666666666658")
+}))();
+function ed25519_pow_2_252_32(x) {
+  const _10n = BigInt(10), _20n = BigInt(20), _40n = BigInt(40), _80n = BigInt(80);
+  const P = ed25519_CURVE_p2;
+  const x2 = x * x % P;
+  const b2 = x2 * x % P;
+  const b4 = pow22(b2, _2n6, P) * b2 % P;
+  const b5 = pow22(b4, _1n10, P) * x % P;
+  const b10 = pow22(b5, _5n4, P) * b5 % P;
+  const b20 = pow22(b10, _10n, P) * b10 % P;
+  const b40 = pow22(b20, _20n, P) * b20 % P;
+  const b80 = pow22(b40, _40n, P) * b40 % P;
+  const b160 = pow22(b80, _80n, P) * b80 % P;
+  const b240 = pow22(b160, _80n, P) * b80 % P;
+  const b250 = pow22(b240, _10n, P) * b10 % P;
+  const pow_p_5_8 = pow22(b250, _2n6, P) * x % P;
+  return { pow_p_5_8, b2 };
+}
+function adjustScalarBytes2(bytes) {
+  bytes[0] &= 248;
+  bytes[31] &= 127;
+  bytes[31] |= 64;
+  return bytes;
+}
+var ED25519_SQRT_M12 = /* @__PURE__ */ BigInt("19681161376707505956807079304988542015446066515923890162744021073123829784752");
+function uvRatio2(u, v) {
+  const P = ed25519_CURVE_p2;
+  const v3 = mod2(v * v * v, P);
+  const v7 = mod2(v3 * v3 * v, P);
+  const pow = ed25519_pow_2_252_32(u * v7).pow_p_5_8;
+  let x = mod2(u * v3 * pow, P);
+  const vx2 = mod2(v * x * x, P);
+  const root1 = x;
+  const root2 = mod2(x * ED25519_SQRT_M12, P);
+  const useRoot1 = vx2 === u;
+  const useRoot2 = vx2 === mod2(-u, P);
+  const noRoot = vx2 === mod2(-u * ED25519_SQRT_M12, P);
+  if (useRoot1)
+    x = root1;
+  if (useRoot2 || noRoot)
+    x = root2;
+  if (isNegativeLE2(x, P))
+    x = mod2(-x, P);
+  return { isValid: useRoot1 || useRoot2, value: x };
+}
+var Fp = /* @__PURE__ */ (() => Field2(ed25519_CURVE2.p, { isLE: true }))();
+var Fn = /* @__PURE__ */ (() => Field2(ed25519_CURVE2.n, { isLE: true }))();
+var ed25519Defaults = /* @__PURE__ */ (() => ({
+  ...ed25519_CURVE2,
+  Fp,
+  hash: sha5123,
+  adjustScalarBytes: adjustScalarBytes2,
+  // dom2
+  // Ratio of u to v. Allows us to combine inversion and square root. Uses algo from RFC8032 5.1.3.
+  // Constant-time, u/√v
+  uvRatio: uvRatio2
+}))();
+var ed255192 = /* @__PURE__ */ (() => twistedEdwards(ed25519Defaults))();
+var SQRT_M1 = ED25519_SQRT_M12;
+var SQRT_AD_MINUS_ONE = /* @__PURE__ */ BigInt("25063068953384623474111414158702152701244531502492656460079210482610430750235");
+var INVSQRT_A_MINUS_D = /* @__PURE__ */ BigInt("54469307008909316920995813868745141605393597292927456921205312896311721017578");
+var ONE_MINUS_D_SQ = /* @__PURE__ */ BigInt("1159843021668779879193775521855586647937357759715417654439879720876111806838");
+var D_MINUS_ONE_SQ = /* @__PURE__ */ BigInt("40440834346308536858101042469323190826248399146238708352240133220865137265952");
+var invertSqrt = (number) => uvRatio2(_1n10, number);
+var MAX_255B = /* @__PURE__ */ BigInt("0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
+var bytes255ToNumberLE = (bytes) => ed255192.Point.Fp.create(bytesToNumberLE2(bytes) & MAX_255B);
+function calcElligatorRistrettoMap(r0) {
+  const { d } = ed25519_CURVE2;
+  const P = ed25519_CURVE_p2;
+  const mod3 = (n) => Fp.create(n);
+  const r = mod3(SQRT_M1 * r0 * r0);
+  const Ns = mod3((r + _1n10) * ONE_MINUS_D_SQ);
+  let c = BigInt(-1);
+  const D = mod3((c - d * r) * mod3(r + d));
+  let { isValid: Ns_D_is_sq, value: s } = uvRatio2(Ns, D);
+  let s_ = mod3(s * r0);
+  if (!isNegativeLE2(s_, P))
+    s_ = mod3(-s_);
+  if (!Ns_D_is_sq)
+    s = s_;
+  if (!Ns_D_is_sq)
+    c = r;
+  const Nt = mod3(c * (r - _1n10) * D_MINUS_ONE_SQ - D);
+  const s2 = s * s;
+  const W0 = mod3((s + s) * D);
+  const W1 = mod3(Nt * SQRT_AD_MINUS_ONE);
+  const W2 = mod3(_1n10 - s2);
+  const W3 = mod3(_1n10 + s2);
+  return new ed255192.Point(mod3(W0 * W3), mod3(W2 * W1), mod3(W1 * W3), mod3(W0 * W2));
+}
+function ristretto255_map(bytes) {
+  abytes3(bytes, 64);
+  const r1 = bytes255ToNumberLE(bytes.subarray(0, 32));
+  const R1 = calcElligatorRistrettoMap(r1);
+  const r2 = bytes255ToNumberLE(bytes.subarray(32, 64));
+  const R2 = calcElligatorRistrettoMap(r2);
+  return new _RistrettoPoint(R1.add(R2));
+}
+var _RistrettoPoint = class __RistrettoPoint extends PrimeEdwardsPoint2 {
+  constructor(ep) {
+    super(ep);
+  }
+  static fromAffine(ap) {
+    return new __RistrettoPoint(ed255192.Point.fromAffine(ap));
+  }
+  assertSame(other) {
+    if (!(other instanceof __RistrettoPoint))
+      throw new Error("RistrettoPoint expected");
+  }
+  init(ep) {
+    return new __RistrettoPoint(ep);
+  }
+  /** @deprecated use `import { ristretto255_hasher } from '@noble/curves/ed25519.js';` */
+  static hashToCurve(hex) {
+    return ristretto255_map(ensureBytes("ristrettoHash", hex, 64));
+  }
+  static fromBytes(bytes) {
+    abytes3(bytes, 32);
+    const { a, d } = ed25519_CURVE2;
+    const P = ed25519_CURVE_p2;
+    const mod3 = (n) => Fp.create(n);
+    const s = bytes255ToNumberLE(bytes);
+    if (!equalBytes(Fp.toBytes(s), bytes) || isNegativeLE2(s, P))
+      throw new Error("invalid ristretto255 encoding 1");
+    const s2 = mod3(s * s);
+    const u1 = mod3(_1n10 + a * s2);
+    const u2 = mod3(_1n10 - a * s2);
+    const u1_2 = mod3(u1 * u1);
+    const u2_2 = mod3(u2 * u2);
+    const v = mod3(a * d * u1_2 - u2_2);
+    const { isValid, value: I } = invertSqrt(mod3(v * u2_2));
+    const Dx = mod3(I * u2);
+    const Dy = mod3(I * Dx * v);
+    let x = mod3((s + s) * Dx);
+    if (isNegativeLE2(x, P))
+      x = mod3(-x);
+    const y = mod3(u1 * Dy);
+    const t = mod3(x * y);
+    if (!isValid || isNegativeLE2(t, P) || y === _0n9)
+      throw new Error("invalid ristretto255 encoding 2");
+    return new __RistrettoPoint(new ed255192.Point(x, y, _1n10, t));
+  }
+  /**
+   * Converts ristretto-encoded string to ristretto point.
+   * Described in [RFC9496](https://www.rfc-editor.org/rfc/rfc9496#name-decode).
+   * @param hex Ristretto-encoded 32 bytes. Not every 32-byte string is valid ristretto encoding
+   */
+  static fromHex(hex) {
+    return __RistrettoPoint.fromBytes(ensureBytes("ristrettoHex", hex, 32));
   }
-  unsafe(point, scalar, transform, prev) {
-    const W = getW2(point);
-    if (W === 1)
-      return this._unsafeLadder(point, scalar, prev);
-    return this.wNAFUnsafe(W, this.getPrecomputes(W, point, transform), scalar, prev);
+  static msm(points, scalars) {
+    return pippenger(__RistrettoPoint, ed255192.Point.Fn, points, scalars);
   }
-  // We calculate precomputes for elliptic curve point multiplication
-  // using windowed method. This specifies window size and
-  // stores precomputed values. Usually only base point would be precomputed.
-  createCache(P, W) {
-    validateW2(W, this.bits);
-    pointWindowSizes2.set(P, W);
-    pointPrecomputes2.delete(P);
+  /**
+   * Encodes ristretto point to Uint8Array.
+   * Described in [RFC9496](https://www.rfc-editor.org/rfc/rfc9496#name-encode).
+   */
+  toBytes() {
+    let { X, Y, Z, T } = this.ep;
+    const P = ed25519_CURVE_p2;
+    const mod3 = (n) => Fp.create(n);
+    const u1 = mod3(mod3(Z + Y) * mod3(Z - Y));
+    const u2 = mod3(X * Y);
+    const u2sq = mod3(u2 * u2);
+    const { value: invsqrt } = invertSqrt(mod3(u1 * u2sq));
+    const D1 = mod3(invsqrt * u1);
+    const D2 = mod3(invsqrt * u2);
+    const zInv = mod3(D1 * D2 * T);
+    let D;
+    if (isNegativeLE2(T * zInv, P)) {
+      let _x = mod3(Y * SQRT_M1);
+      let _y = mod3(X * SQRT_M1);
+      X = _x;
+      Y = _y;
+      D = mod3(D1 * INVSQRT_A_MINUS_D);
+    } else {
+      D = D2;
+    }
+    if (isNegativeLE2(X * zInv, P))
+      Y = mod3(-Y);
+    let s = mod3((Z - Y) * D);
+    if (isNegativeLE2(s, P))
+      s = mod3(-s);
+    return Fp.toBytes(s);
   }
-  hasCache(elm) {
-    return getW2(elm) !== 1;
+  /**
+   * Compares two Ristretto points.
+   * Described in [RFC9496](https://www.rfc-editor.org/rfc/rfc9496#name-equals).
+   */
+  equals(other) {
+    this.assertSame(other);
+    const { X: X1, Y: Y1 } = this.ep;
+    const { X: X2, Y: Y2 } = other.ep;
+    const mod3 = (n) => Fp.create(n);
+    const one = mod3(X1 * Y2) === mod3(Y1 * X2);
+    const two = mod3(Y1 * Y2) === mod3(X1 * X2);
+    return one || two;
+  }
+  is0() {
+    return this.equals(__RistrettoPoint.ZERO);
   }
 };
-function mulEndoUnsafe(Point, point, k1, k2) {
-  let acc = point;
-  let p1 = Point.ZERO;
-  let p2 = Point.ZERO;
-  while (k1 > _0n7 || k2 > _0n7) {
-    if (k1 & _1n8)
-      p1 = p1.add(acc);
-    if (k2 & _1n8)
-      p2 = p2.add(acc);
-    acc = acc.double();
-    k1 >>= _1n8;
-    k2 >>= _1n8;
+_RistrettoPoint.BASE = /* @__PURE__ */ (() => new _RistrettoPoint(ed255192.Point.BASE))();
+_RistrettoPoint.ZERO = /* @__PURE__ */ (() => new _RistrettoPoint(ed255192.Point.ZERO))();
+_RistrettoPoint.Fp = /* @__PURE__ */ (() => Fp)();
+_RistrettoPoint.Fn = /* @__PURE__ */ (() => Fn)();
+
+// ../../node_modules/.pnpm/@noble+hashes@1.8.0/node_modules/@noble/hashes/esm/hmac.js
+var HMAC = class extends Hash {
+  constructor(hash, _key) {
+    super();
+    this.finished = false;
+    this.destroyed = false;
+    ahash3(hash);
+    const key = toBytes(_key);
+    this.iHash = hash.create();
+    if (typeof this.iHash.update !== "function")
+      throw new Error("Expected instance of class which extends utils.Hash");
+    this.blockLen = this.iHash.blockLen;
+    this.outputLen = this.iHash.outputLen;
+    const blockLen = this.blockLen;
+    const pad = new Uint8Array(blockLen);
+    pad.set(key.length > blockLen ? hash.create().update(key).digest() : key);
+    for (let i = 0; i < pad.length; i++)
+      pad[i] ^= 54;
+    this.iHash.update(pad);
+    this.oHash = hash.create();
+    for (let i = 0; i < pad.length; i++)
+      pad[i] ^= 54 ^ 92;
+    this.oHash.update(pad);
+    clean3(pad);
   }
-  return { p1, p2 };
-}
-function pippenger(c, fieldN, points, scalars) {
-  validateMSMPoints(points, c);
-  validateMSMScalars(scalars, fieldN);
-  const plength = points.length;
-  const slength = scalars.length;
-  if (plength !== slength)
-    throw new Error("arrays of points and scalars must have equal length");
-  const zero = c.ZERO;
-  const wbits = bitLen2(BigInt(plength));
-  let windowSize = 1;
-  if (wbits > 12)
-    windowSize = wbits - 3;
-  else if (wbits > 4)
-    windowSize = wbits - 2;
-  else if (wbits > 0)
-    windowSize = 2;
-  const MASK = bitMask2(windowSize);
-  const buckets = new Array(Number(MASK) + 1).fill(zero);
-  const lastBits = Math.floor((fieldN.BITS - 1) / windowSize) * windowSize;
-  let sum = zero;
-  for (let i = lastBits; i >= 0; i -= windowSize) {
-    buckets.fill(zero);
-    for (let j = 0; j < slength; j++) {
-      const scalar = scalars[j];
-      const wbits2 = Number(scalar >> BigInt(i) & MASK);
-      buckets[wbits2] = buckets[wbits2].add(points[j]);
-    }
-    let resI = zero;
-    for (let j = buckets.length - 1, sumI = zero; j > 0; j--) {
-      sumI = sumI.add(buckets[j]);
-      resI = resI.add(sumI);
-    }
-    sum = sum.add(resI);
-    if (i !== 0)
-      for (let j = 0; j < windowSize; j++)
-        sum = sum.double();
+  update(buf) {
+    aexists3(this);
+    this.iHash.update(buf);
+    return this;
   }
-  return sum;
-}
-function createField2(order, field, isLE) {
-  if (field) {
-    if (field.ORDER !== order)
-      throw new Error("Field.ORDER must match order: Fp == p, Fn == n");
-    validateField2(field);
-    return field;
-  } else {
-    return Field2(order, { isLE });
+  digestInto(out) {
+    aexists3(this);
+    abytes3(out, this.outputLen);
+    this.finished = true;
+    this.iHash.digestInto(out);
+    this.oHash.update(out);
+    this.oHash.digestInto(out);
+    this.destroy();
   }
-}
-function _createCurveFields(type, CURVE, curveOpts = {}, FpFnLE) {
-  if (FpFnLE === void 0)
-    FpFnLE = type === "edwards";
-  if (!CURVE || typeof CURVE !== "object")
-    throw new Error(`expected valid ${type} CURVE object`);
-  for (const p of ["p", "n", "h"]) {
-    const val = CURVE[p];
-    if (!(typeof val === "bigint" && val > _0n7))
-      throw new Error(`CURVE.${p} must be positive bigint`);
+  digest() {
+    const out = new Uint8Array(this.oHash.outputLen);
+    this.digestInto(out);
+    return out;
   }
-  const Fp = createField2(CURVE.p, curveOpts.Fp, FpFnLE);
-  const Fn = createField2(CURVE.n, curveOpts.Fn, FpFnLE);
-  const _b = type === "weierstrass" ? "b" : "d";
-  const params = ["Gx", "Gy", "a", _b];
-  for (const p of params) {
-    if (!Fp.isValid(CURVE[p]))
-      throw new Error(`CURVE.${p} must be valid field element of CURVE.Fp`);
+  _cloneInto(to) {
+    to || (to = Object.create(Object.getPrototypeOf(this), {}));
+    const { oHash, iHash, finished, destroyed, blockLen, outputLen } = this;
+    to = to;
+    to.finished = finished;
+    to.destroyed = destroyed;
+    to.blockLen = blockLen;
+    to.outputLen = outputLen;
+    to.oHash = oHash._cloneInto(to.oHash);
+    to.iHash = iHash._cloneInto(to.iHash);
+    return to;
   }
-  CURVE = Object.freeze(Object.assign({}, CURVE));
-  return { CURVE, Fp, Fn };
-}
+  clone() {
+    return this._cloneInto();
+  }
+  destroy() {
+    this.destroyed = true;
+    this.oHash.destroy();
+    this.iHash.destroy();
+  }
+};
+var hmac3 = (hash, key, message) => new HMAC(hash, key).update(message).digest();
+hmac3.create = (hash, key) => new HMAC(hash, key);
 
 // ../../node_modules/.pnpm/@noble+curves@1.9.7/node_modules/@noble/curves/esm/abstract/weierstrass.js
-var divNearest = (num, den) => (num + (num >= 0 ? den : -den) / _2n5) / den;
+var divNearest = (num, den) => (num + (num >= 0 ? den : -den) / _2n7) / den;
 function _splitEndoScalar(k, basis, n) {
   const [[a1, b1], [a2, b2]] = basis;
   const c1 = divNearest(b2 * k, n);
   const c2 = divNearest(-b1 * k, n);
   let k1 = k - c1 * a1 - c2 * a2;
   let k2 = -c1 * b1 - c2 * b2;
-  const k1neg = k1 < _0n8;
-  const k2neg = k2 < _0n8;
+  const k1neg = k1 < _0n10;
+  const k2neg = k2 < _0n10;
   if (k1neg)
     k1 = -k1;
   if (k2neg)
     k2 = -k2;
-  const MAX_NUM = bitMask2(Math.ceil(bitLen2(n) / 2)) + _1n9;
-  if (k1 < _0n8 || k1 >= MAX_NUM || k2 < _0n8 || k2 >= MAX_NUM) {
+  const MAX_NUM = bitMask2(Math.ceil(bitLen2(n) / 2)) + _1n11;
+  if (k1 < _0n10 || k1 >= MAX_NUM || k2 < _0n10 || k2 >= MAX_NUM) {
     throw new Error("splitScalar (endomorphism): failed, k=" + k);
   }
   return { k1neg, k1, k2neg, k2 };
@@ -25518,7 +26558,7 @@ var DER = {
   _int: {
     encode(num) {
       const { Err: E } = DER;
-      if (num < _0n8)
+      if (num < _0n10)
         throw new E("integer: negative integers are not allowed");
       let hex = numberToHexUnpadded(num);
       if (Number.parseInt(hex[0], 16) & 8)
@@ -25556,31 +26596,31 @@ var DER = {
     return tlv.encode(48, seq);
   }
 };
-var _0n8 = BigInt(0);
-var _1n9 = BigInt(1);
-var _2n5 = BigInt(2);
-var _3n3 = BigInt(3);
+var _0n10 = BigInt(0);
+var _1n11 = BigInt(1);
+var _2n7 = BigInt(2);
+var _3n4 = BigInt(3);
 var _4n3 = BigInt(4);
-function _normFnElement(Fn, key) {
-  const { BYTES: expected } = Fn;
+function _normFnElement(Fn2, key) {
+  const { BYTES: expected } = Fn2;
   let num;
   if (typeof key === "bigint") {
     num = key;
   } else {
     let bytes = ensureBytes("private key", key);
     try {
-      num = Fn.fromBytes(bytes);
+      num = Fn2.fromBytes(bytes);
     } catch (error) {
       throw new Error(`invalid private key: expected ui8a of size ${expected}, got ${typeof key}`);
     }
   }
-  if (!Fn.isValidNot0(num))
+  if (!Fn2.isValidNot0(num))
     throw new Error("invalid private key: out of range [1..N-1]");
   return num;
 }
 function weierstrassN(params, extraOpts = {}) {
   const validated = _createCurveFields("weierstrass", params, extraOpts);
-  const { Fp, Fn } = validated;
+  const { Fp: Fp2, Fn: Fn2 } = validated;
   let CURVE = validated.CURVE;
   const { h: cofactor, n: CURVE_ORDER } = CURVE;
   _validateObject(extraOpts, {}, {
@@ -25594,25 +26634,25 @@ function weierstrassN(params, extraOpts = {}) {
   });
   const { endo } = extraOpts;
   if (endo) {
-    if (!Fp.is0(CURVE.a) || typeof endo.beta !== "bigint" || !Array.isArray(endo.basises)) {
+    if (!Fp2.is0(CURVE.a) || typeof endo.beta !== "bigint" || !Array.isArray(endo.basises)) {
       throw new Error('invalid endo: expected "beta": bigint and "basises": array');
     }
   }
-  const lengths = getWLengths(Fp, Fn);
+  const lengths = getWLengths(Fp2, Fn2);
   function assertCompressionIsSupported() {
-    if (!Fp.isOdd)
+    if (!Fp2.isOdd)
       throw new Error("compression is not supported: Field does not have .isOdd()");
   }
   function pointToBytes(_c, point, isCompressed) {
     const { x, y } = point.toAffine();
-    const bx = Fp.toBytes(x);
+    const bx = Fp2.toBytes(x);
     _abool2(isCompressed, "isCompressed");
     if (isCompressed) {
       assertCompressionIsSupported();
-      const hasEvenY = !Fp.isOdd(y);
+      const hasEvenY = !Fp2.isOdd(y);
       return concatBytes2(pprefix(hasEvenY), bx);
     } else {
-      return concatBytes2(Uint8Array.of(4), bx, Fp.toBytes(y));
+      return concatBytes2(Uint8Array.of(4), bx, Fp2.toBytes(y));
     }
   }
   function pointFromBytes(bytes) {
@@ -25622,27 +26662,27 @@ function weierstrassN(params, extraOpts = {}) {
     const head = bytes[0];
     const tail = bytes.subarray(1);
     if (length === comp && (head === 2 || head === 3)) {
-      const x = Fp.fromBytes(tail);
-      if (!Fp.isValid(x))
+      const x = Fp2.fromBytes(tail);
+      if (!Fp2.isValid(x))
         throw new Error("bad point: is not on curve, wrong x");
       const y2 = weierstrassEquation(x);
       let y;
       try {
-        y = Fp.sqrt(y2);
+        y = Fp2.sqrt(y2);
       } catch (sqrtError) {
         const err = sqrtError instanceof Error ? ": " + sqrtError.message : "";
         throw new Error("bad point: is not on curve, sqrt error" + err);
       }
       assertCompressionIsSupported();
-      const isYOdd = Fp.isOdd(y);
+      const isYOdd = Fp2.isOdd(y);
       const isHeadOdd = (head & 1) === 1;
       if (isHeadOdd !== isYOdd)
-        y = Fp.neg(y);
+        y = Fp2.neg(y);
       return { x, y };
     } else if (length === uncomp && head === 4) {
-      const L = Fp.BYTES;
-      const x = Fp.fromBytes(tail.subarray(0, L));
-      const y = Fp.fromBytes(tail.subarray(L, L * 2));
+      const L = Fp2.BYTES;
+      const x = Fp2.fromBytes(tail.subarray(0, L));
+      const y = Fp2.fromBytes(tail.subarray(L, L * 2));
       if (!isValidXY(x, y))
         throw new Error("bad point: is not on curve");
       return { x, y };
@@ -25653,23 +26693,23 @@ function weierstrassN(params, extraOpts = {}) {
   const encodePoint = extraOpts.toBytes || pointToBytes;
   const decodePoint = extraOpts.fromBytes || pointFromBytes;
   function weierstrassEquation(x) {
-    const x2 = Fp.sqr(x);
-    const x3 = Fp.mul(x2, x);
-    return Fp.add(Fp.add(x3, Fp.mul(x, CURVE.a)), CURVE.b);
+    const x2 = Fp2.sqr(x);
+    const x3 = Fp2.mul(x2, x);
+    return Fp2.add(Fp2.add(x3, Fp2.mul(x, CURVE.a)), CURVE.b);
   }
   function isValidXY(x, y) {
-    const left = Fp.sqr(y);
+    const left = Fp2.sqr(y);
     const right = weierstrassEquation(x);
-    return Fp.eql(left, right);
+    return Fp2.eql(left, right);
   }
   if (!isValidXY(CURVE.Gx, CURVE.Gy))
     throw new Error("bad curve params: generator point");
-  const _4a3 = Fp.mul(Fp.pow(CURVE.a, _3n3), _4n3);
-  const _27b2 = Fp.mul(Fp.sqr(CURVE.b), BigInt(27));
-  if (Fp.is0(Fp.add(_4a3, _27b2)))
+  const _4a3 = Fp2.mul(Fp2.pow(CURVE.a, _3n4), _4n3);
+  const _27b2 = Fp2.mul(Fp2.sqr(CURVE.b), BigInt(27));
+  if (Fp2.is0(Fp2.add(_4a3, _27b2)))
     throw new Error("bad curve params: a or b");
   function acoord(title, n, banZero = false) {
-    if (!Fp.isValid(n) || banZero && Fp.is0(n))
+    if (!Fp2.isValid(n) || banZero && Fp2.is0(n))
       throw new Error(`bad point coordinate ${title}`);
     return n;
   }
@@ -25680,32 +26720,32 @@ function weierstrassN(params, extraOpts = {}) {
   function splitEndoScalarN(k) {
     if (!endo || !endo.basises)
       throw new Error("no endo");
-    return _splitEndoScalar(k, endo.basises, Fn.ORDER);
+    return _splitEndoScalar(k, endo.basises, Fn2.ORDER);
   }
   const toAffineMemo = memoized2((p, iz) => {
     const { X, Y, Z } = p;
-    if (Fp.eql(Z, Fp.ONE))
+    if (Fp2.eql(Z, Fp2.ONE))
       return { x: X, y: Y };
     const is0 = p.is0();
     if (iz == null)
-      iz = is0 ? Fp.ONE : Fp.inv(Z);
-    const x = Fp.mul(X, iz);
-    const y = Fp.mul(Y, iz);
-    const zz = Fp.mul(Z, iz);
+      iz = is0 ? Fp2.ONE : Fp2.inv(Z);
+    const x = Fp2.mul(X, iz);
+    const y = Fp2.mul(Y, iz);
+    const zz = Fp2.mul(Z, iz);
     if (is0)
-      return { x: Fp.ZERO, y: Fp.ZERO };
-    if (!Fp.eql(zz, Fp.ONE))
+      return { x: Fp2.ZERO, y: Fp2.ZERO };
+    if (!Fp2.eql(zz, Fp2.ONE))
       throw new Error("invZ was invalid");
     return { x, y };
   });
   const assertValidMemo = memoized2((p) => {
     if (p.is0()) {
-      if (extraOpts.allowInfinityPoint && !Fp.is0(p.Y))
+      if (extraOpts.allowInfinityPoint && !Fp2.is0(p.Y))
         return;
       throw new Error("bad point: ZERO");
     }
     const { x, y } = p.toAffine();
-    if (!Fp.isValid(x) || !Fp.isValid(y))
+    if (!Fp2.isValid(x) || !Fp2.isValid(y))
       throw new Error("bad point: x or y not field elements");
     if (!isValidXY(x, y))
       throw new Error("bad point: equation left != right");
@@ -25714,7 +26754,7 @@ function weierstrassN(params, extraOpts = {}) {
     return true;
   });
   function finishEndo(endoBeta, k1p, k2p, k1neg, k2neg) {
-    k2p = new Point(Fp.mul(k2p.X, endoBeta), k2p.Y, k2p.Z);
+    k2p = new Point(Fp2.mul(k2p.X, endoBeta), k2p.Y, k2p.Z);
     k1p = negateCt2(k1neg, k1p);
     k2p = negateCt2(k2neg, k2p);
     return k1p.add(k2p);
@@ -25733,13 +26773,13 @@ function weierstrassN(params, extraOpts = {}) {
     /** Does NOT validate if the point is valid. Use `.assertValidity()`. */
     static fromAffine(p) {
       const { x, y } = p || {};
-      if (!p || !Fp.isValid(x) || !Fp.isValid(y))
+      if (!p || !Fp2.isValid(x) || !Fp2.isValid(y))
         throw new Error("invalid affine point");
       if (p instanceof Point)
         throw new Error("projective point not allowed");
-      if (Fp.is0(x) && Fp.is0(y))
+      if (Fp2.is0(x) && Fp2.is0(y))
         return Point.ZERO;
-      return new Point(x, y, Fp.ONE);
+      return new Point(x, y, Fp2.ONE);
     }
     static fromBytes(bytes) {
       const P = Point.fromAffine(decodePoint(_abytes2(bytes, void 0, "point")));
@@ -25764,7 +26804,7 @@ function weierstrassN(params, extraOpts = {}) {
     precompute(windowSize = 8, isLazy = true) {
       wnaf.createCache(this, windowSize);
       if (!isLazy)
-        this.multiply(_3n3);
+        this.multiply(_3n4);
       return this;
     }
     // TODO: return `this`
@@ -25774,22 +26814,22 @@ function weierstrassN(params, extraOpts = {}) {
     }
     hasEvenY() {
       const { y } = this.toAffine();
-      if (!Fp.isOdd)
+      if (!Fp2.isOdd)
         throw new Error("Field doesn't support isOdd");
-      return !Fp.isOdd(y);
+      return !Fp2.isOdd(y);
     }
     /** Compare one point to another. */
     equals(other) {
       aprjpoint(other);
       const { X: X1, Y: Y1, Z: Z1 } = this;
       const { X: X2, Y: Y2, Z: Z2 } = other;
-      const U1 = Fp.eql(Fp.mul(X1, Z2), Fp.mul(X2, Z1));
-      const U2 = Fp.eql(Fp.mul(Y1, Z2), Fp.mul(Y2, Z1));
+      const U1 = Fp2.eql(Fp2.mul(X1, Z2), Fp2.mul(X2, Z1));
+      const U2 = Fp2.eql(Fp2.mul(Y1, Z2), Fp2.mul(Y2, Z1));
       return U1 && U2;
     }
     /** Flips point to one corresponding to (x, -y) in Affine coordinates. */
     negate() {
-      return new Point(this.X, Fp.neg(this.Y), this.Z);
+      return new Point(this.X, Fp2.neg(this.Y), this.Z);
     }
     // Renes-Costello-Batina exception-free doubling formula.
     // There is 30% faster Jacobian formula, but it is not complete.
@@ -25797,40 +26837,40 @@ function weierstrassN(params, extraOpts = {}) {
     // Cost: 8M + 3S + 3*a + 2*b3 + 15add.
     double() {
       const { a, b } = CURVE;
-      const b3 = Fp.mul(b, _3n3);
+      const b3 = Fp2.mul(b, _3n4);
       const { X: X1, Y: Y1, Z: Z1 } = this;
-      let X3 = Fp.ZERO, Y3 = Fp.ZERO, Z3 = Fp.ZERO;
-      let t0 = Fp.mul(X1, X1);
-      let t1 = Fp.mul(Y1, Y1);
-      let t2 = Fp.mul(Z1, Z1);
-      let t3 = Fp.mul(X1, Y1);
-      t3 = Fp.add(t3, t3);
-      Z3 = Fp.mul(X1, Z1);
-      Z3 = Fp.add(Z3, Z3);
-      X3 = Fp.mul(a, Z3);
-      Y3 = Fp.mul(b3, t2);
-      Y3 = Fp.add(X3, Y3);
-      X3 = Fp.sub(t1, Y3);
-      Y3 = Fp.add(t1, Y3);
-      Y3 = Fp.mul(X3, Y3);
-      X3 = Fp.mul(t3, X3);
-      Z3 = Fp.mul(b3, Z3);
-      t2 = Fp.mul(a, t2);
-      t3 = Fp.sub(t0, t2);
-      t3 = Fp.mul(a, t3);
-      t3 = Fp.add(t3, Z3);
-      Z3 = Fp.add(t0, t0);
-      t0 = Fp.add(Z3, t0);
-      t0 = Fp.add(t0, t2);
-      t0 = Fp.mul(t0, t3);
-      Y3 = Fp.add(Y3, t0);
-      t2 = Fp.mul(Y1, Z1);
-      t2 = Fp.add(t2, t2);
-      t0 = Fp.mul(t2, t3);
-      X3 = Fp.sub(X3, t0);
-      Z3 = Fp.mul(t2, t1);
-      Z3 = Fp.add(Z3, Z3);
-      Z3 = Fp.add(Z3, Z3);
+      let X3 = Fp2.ZERO, Y3 = Fp2.ZERO, Z3 = Fp2.ZERO;
+      let t0 = Fp2.mul(X1, X1);
+      let t1 = Fp2.mul(Y1, Y1);
+      let t2 = Fp2.mul(Z1, Z1);
+      let t3 = Fp2.mul(X1, Y1);
+      t3 = Fp2.add(t3, t3);
+      Z3 = Fp2.mul(X1, Z1);
+      Z3 = Fp2.add(Z3, Z3);
+      X3 = Fp2.mul(a, Z3);
+      Y3 = Fp2.mul(b3, t2);
+      Y3 = Fp2.add(X3, Y3);
+      X3 = Fp2.sub(t1, Y3);
+      Y3 = Fp2.add(t1, Y3);
+      Y3 = Fp2.mul(X3, Y3);
+      X3 = Fp2.mul(t3, X3);
+      Z3 = Fp2.mul(b3, Z3);
+      t2 = Fp2.mul(a, t2);
+      t3 = Fp2.sub(t0, t2);
+      t3 = Fp2.mul(a, t3);
+      t3 = Fp2.add(t3, Z3);
+      Z3 = Fp2.add(t0, t0);
+      t0 = Fp2.add(Z3, t0);
+      t0 = Fp2.add(t0, t2);
+      t0 = Fp2.mul(t0, t3);
+      Y3 = Fp2.add(Y3, t0);
+      t2 = Fp2.mul(Y1, Z1);
+      t2 = Fp2.add(t2, t2);
+      t0 = Fp2.mul(t2, t3);
+      X3 = Fp2.sub(X3, t0);
+      Z3 = Fp2.mul(t2, t1);
+      Z3 = Fp2.add(Z3, Z3);
+      Z3 = Fp2.add(Z3, Z3);
       return new Point(X3, Y3, Z3);
     }
     // Renes-Costello-Batina exception-free addition formula.
@@ -25841,49 +26881,49 @@ function weierstrassN(params, extraOpts = {}) {
       aprjpoint(other);
       const { X: X1, Y: Y1, Z: Z1 } = this;
       const { X: X2, Y: Y2, Z: Z2 } = other;
-      let X3 = Fp.ZERO, Y3 = Fp.ZERO, Z3 = Fp.ZERO;
+      let X3 = Fp2.ZERO, Y3 = Fp2.ZERO, Z3 = Fp2.ZERO;
       const a = CURVE.a;
-      const b3 = Fp.mul(CURVE.b, _3n3);
-      let t0 = Fp.mul(X1, X2);
-      let t1 = Fp.mul(Y1, Y2);
-      let t2 = Fp.mul(Z1, Z2);
-      let t3 = Fp.add(X1, Y1);
-      let t4 = Fp.add(X2, Y2);
-      t3 = Fp.mul(t3, t4);
-      t4 = Fp.add(t0, t1);
-      t3 = Fp.sub(t3, t4);
-      t4 = Fp.add(X1, Z1);
-      let t5 = Fp.add(X2, Z2);
-      t4 = Fp.mul(t4, t5);
-      t5 = Fp.add(t0, t2);
-      t4 = Fp.sub(t4, t5);
-      t5 = Fp.add(Y1, Z1);
-      X3 = Fp.add(Y2, Z2);
-      t5 = Fp.mul(t5, X3);
-      X3 = Fp.add(t1, t2);
-      t5 = Fp.sub(t5, X3);
-      Z3 = Fp.mul(a, t4);
-      X3 = Fp.mul(b3, t2);
-      Z3 = Fp.add(X3, Z3);
-      X3 = Fp.sub(t1, Z3);
-      Z3 = Fp.add(t1, Z3);
-      Y3 = Fp.mul(X3, Z3);
-      t1 = Fp.add(t0, t0);
-      t1 = Fp.add(t1, t0);
-      t2 = Fp.mul(a, t2);
-      t4 = Fp.mul(b3, t4);
-      t1 = Fp.add(t1, t2);
-      t2 = Fp.sub(t0, t2);
-      t2 = Fp.mul(a, t2);
-      t4 = Fp.add(t4, t2);
-      t0 = Fp.mul(t1, t4);
-      Y3 = Fp.add(Y3, t0);
-      t0 = Fp.mul(t5, t4);
-      X3 = Fp.mul(t3, X3);
-      X3 = Fp.sub(X3, t0);
-      t0 = Fp.mul(t3, t1);
-      Z3 = Fp.mul(t5, Z3);
-      Z3 = Fp.add(Z3, t0);
+      const b3 = Fp2.mul(CURVE.b, _3n4);
+      let t0 = Fp2.mul(X1, X2);
+      let t1 = Fp2.mul(Y1, Y2);
+      let t2 = Fp2.mul(Z1, Z2);
+      let t3 = Fp2.add(X1, Y1);
+      let t4 = Fp2.add(X2, Y2);
+      t3 = Fp2.mul(t3, t4);
+      t4 = Fp2.add(t0, t1);
+      t3 = Fp2.sub(t3, t4);
+      t4 = Fp2.add(X1, Z1);
+      let t5 = Fp2.add(X2, Z2);
+      t4 = Fp2.mul(t4, t5);
+      t5 = Fp2.add(t0, t2);
+      t4 = Fp2.sub(t4, t5);
+      t5 = Fp2.add(Y1, Z1);
+      X3 = Fp2.add(Y2, Z2);
+      t5 = Fp2.mul(t5, X3);
+      X3 = Fp2.add(t1, t2);
+      t5 = Fp2.sub(t5, X3);
+      Z3 = Fp2.mul(a, t4);
+      X3 = Fp2.mul(b3, t2);
+      Z3 = Fp2.add(X3, Z3);
+      X3 = Fp2.sub(t1, Z3);
+      Z3 = Fp2.add(t1, Z3);
+      Y3 = Fp2.mul(X3, Z3);
+      t1 = Fp2.add(t0, t0);
+      t1 = Fp2.add(t1, t0);
+      t2 = Fp2.mul(a, t2);
+      t4 = Fp2.mul(b3, t4);
+      t1 = Fp2.add(t1, t2);
+      t2 = Fp2.sub(t0, t2);
+      t2 = Fp2.mul(a, t2);
+      t4 = Fp2.add(t4, t2);
+      t0 = Fp2.mul(t1, t4);
+      Y3 = Fp2.add(Y3, t0);
+      t0 = Fp2.mul(t5, t4);
+      X3 = Fp2.mul(t3, X3);
+      X3 = Fp2.sub(X3, t0);
+      t0 = Fp2.mul(t3, t1);
+      Z3 = Fp2.mul(t5, Z3);
+      Z3 = Fp2.add(Z3, t0);
       return new Point(X3, Y3, Z3);
     }
     subtract(other) {
@@ -25903,7 +26943,7 @@ function weierstrassN(params, extraOpts = {}) {
      */
     multiply(scalar) {
       const { endo: endo2 } = extraOpts;
-      if (!Fn.isValidNot0(scalar))
+      if (!Fn2.isValidNot0(scalar))
         throw new Error("invalid scalar: out of range");
       let point, fake;
       const mul = (n) => wnaf.cached(this, n, (p) => normalizeZ2(Point, p));
@@ -25928,11 +26968,11 @@ function weierstrassN(params, extraOpts = {}) {
     multiplyUnsafe(sc) {
       const { endo: endo2 } = extraOpts;
       const p = this;
-      if (!Fn.isValid(sc))
+      if (!Fn2.isValid(sc))
         throw new Error("invalid scalar: out of range");
-      if (sc === _0n8 || p.is0())
+      if (sc === _0n10 || p.is0())
         return Point.ZERO;
-      if (sc === _1n9)
+      if (sc === _1n11)
         return p;
       if (wnaf.hasCache(this))
         return this.multiply(sc);
@@ -25961,7 +27001,7 @@ function weierstrassN(params, extraOpts = {}) {
      */
     isTorsionFree() {
       const { isTorsionFree } = extraOpts;
-      if (cofactor === _1n9)
+      if (cofactor === _1n11)
         return true;
       if (isTorsionFree)
         return isTorsionFree(Point, this);
@@ -25969,7 +27009,7 @@ function weierstrassN(params, extraOpts = {}) {
     }
     clearCofactor() {
       const { clearCofactor } = extraOpts;
-      if (cofactor === _1n9)
+      if (cofactor === _1n11)
         return this;
       if (clearCofactor)
         return clearCofactor(Point, this);
@@ -26009,17 +27049,17 @@ function weierstrassN(params, extraOpts = {}) {
       return normalizeZ2(Point, points);
     }
     static msm(points, scalars) {
-      return pippenger(Point, Fn, points, scalars);
+      return pippenger(Point, Fn2, points, scalars);
     }
     static fromPrivateKey(privateKey) {
-      return Point.BASE.multiply(_normFnElement(Fn, privateKey));
+      return Point.BASE.multiply(_normFnElement(Fn2, privateKey));
     }
   }
-  Point.BASE = new Point(CURVE.Gx, CURVE.Gy, Fp.ONE);
-  Point.ZERO = new Point(Fp.ZERO, Fp.ONE, Fp.ZERO);
-  Point.Fp = Fp;
-  Point.Fn = Fn;
-  const bits = Fn.BITS;
+  Point.BASE = new Point(CURVE.Gx, CURVE.Gy, Fp2.ONE);
+  Point.ZERO = new Point(Fp2.ZERO, Fp2.ONE, Fp2.ZERO);
+  Point.Fp = Fp2;
+  Point.Fn = Fn2;
+  const bits = Fn2.BITS;
   const wnaf = new wNAF2(Point, extraOpts.endo ? Math.ceil(bits / 2) : bits);
   Point.BASE.precompute(8);
   return Point;
@@ -26027,22 +27067,22 @@ function weierstrassN(params, extraOpts = {}) {
 function pprefix(hasEvenY) {
   return Uint8Array.of(hasEvenY ? 2 : 3);
 }
-function getWLengths(Fp, Fn) {
+function getWLengths(Fp2, Fn2) {
   return {
-    secretKey: Fn.BYTES,
-    publicKey: 1 + Fp.BYTES,
-    publicKeyUncompressed: 1 + 2 * Fp.BYTES,
+    secretKey: Fn2.BYTES,
+    publicKey: 1 + Fp2.BYTES,
+    publicKeyUncompressed: 1 + 2 * Fp2.BYTES,
     publicKeyHasPrefix: true,
-    signature: 2 * Fn.BYTES
+    signature: 2 * Fn2.BYTES
   };
 }
 function ecdh(Point, ecdhOpts = {}) {
-  const { Fn } = Point;
+  const { Fn: Fn2 } = Point;
   const randomBytes_ = ecdhOpts.randomBytes || randomBytes2;
-  const lengths = Object.assign(getWLengths(Point.Fp, Fn), { seed: getMinHashLength(Fn.ORDER) });
+  const lengths = Object.assign(getWLengths(Point.Fp, Fn2), { seed: getMinHashLength(Fn2.ORDER) });
   function isValidSecretKey(secretKey) {
     try {
-      return !!_normFnElement(Fn, secretKey);
+      return !!_normFnElement(Fn2, secretKey);
     } catch (error) {
       return false;
     }
@@ -26061,10 +27101,10 @@ function ecdh(Point, ecdhOpts = {}) {
     }
   }
   function randomSecretKey(seed = randomBytes_(lengths.seed)) {
-    return mapHashToField(_abytes2(seed, lengths.seed, "seed"), Fn.ORDER);
+    return mapHashToField(_abytes2(seed, lengths.seed, "seed"), Fn2.ORDER);
   }
   function getPublicKey(secretKey, isCompressed = true) {
-    return Point.BASE.multiply(_normFnElement(Fn, secretKey)).toBytes(isCompressed);
+    return Point.BASE.multiply(_normFnElement(Fn2, secretKey)).toBytes(isCompressed);
   }
   function keygen(seed) {
     const secretKey = randomSecretKey(seed);
@@ -26076,7 +27116,7 @@ function ecdh(Point, ecdhOpts = {}) {
     if (item instanceof Point)
       return true;
     const { secretKey, publicKey, publicKeyUncompressed } = lengths;
-    if (Fn.allowedLengths || secretKey === publicKey)
+    if (Fn2.allowedLengths || secretKey === publicKey)
       return void 0;
     const l = ensureBytes("key", item).length;
     return l === publicKey || l === publicKeyUncompressed;
@@ -26086,7 +27126,7 @@ function ecdh(Point, ecdhOpts = {}) {
       throw new Error("first arg must be private key");
     if (isProbPub(publicKeyB) === false)
       throw new Error("second arg must be public key");
-    const s = _normFnElement(Fn, secretKeyA);
+    const s = _normFnElement(Fn2, secretKeyA);
     const b = Point.fromHex(publicKeyB);
     return b.multiply(s).toBytes(isCompressed);
   }
@@ -26097,7 +27137,7 @@ function ecdh(Point, ecdhOpts = {}) {
     // TODO: remove
     isValidPrivateKey: isValidSecretKey,
     randomPrivateKey: randomSecretKey,
-    normPrivateKeyToScalar: (key) => _normFnElement(Fn, key),
+    normPrivateKeyToScalar: (key) => _normFnElement(Fn2, key),
     precompute(windowSize = 8, point = Point.BASE) {
       return point.precompute(windowSize, false);
     }
@@ -26115,8 +27155,8 @@ function ecdsa(Point, hash, ecdsaOpts = {}) {
   });
   const randomBytes3 = ecdsaOpts.randomBytes || randomBytes2;
   const hmac4 = ecdsaOpts.hmac || ((key, ...msgs) => hmac3(hash, key, concatBytes2(...msgs)));
-  const { Fp, Fn } = Point;
-  const { ORDER: CURVE_ORDER, BITS: fnBits } = Fn;
+  const { Fp: Fp2, Fn: Fn2 } = Point;
+  const { ORDER: CURVE_ORDER, BITS: fnBits } = Fn2;
   const { keygen, getPublicKey, getSharedSecret, utils, lengths } = ecdh(Point, ecdsaOpts);
   const defaultSigOpts = {
     prehash: false,
@@ -26127,11 +27167,11 @@ function ecdsa(Point, hash, ecdsaOpts = {}) {
   };
   const defaultSigOpts_format = "compact";
   function isBiggerThanHalfOrder(number) {
-    const HALF = CURVE_ORDER >> _1n9;
+    const HALF = CURVE_ORDER >> _1n11;
     return number > HALF;
   }
   function validateRS(title, num) {
-    if (!Fn.isValidNot0(num))
+    if (!Fn2.isValidNot0(num))
       throw new Error(`invalid signature ${title}: out of range 1..Point.Fn.ORDER`);
     return num;
   }
@@ -26161,10 +27201,10 @@ function ecdsa(Point, hash, ecdsaOpts = {}) {
         format = "compact";
         bytes = bytes.subarray(1);
       }
-      const L = Fn.BYTES;
+      const L = Fn2.BYTES;
       const r = bytes.subarray(0, L);
       const s = bytes.subarray(L, L * 2);
-      return new Signature(Fn.fromBytes(r), Fn.fromBytes(s), recid);
+      return new Signature(Fn2.fromBytes(r), Fn2.fromBytes(s), recid);
     }
     static fromHex(hex, format) {
       return this.fromBytes(hexToBytes2(hex), format);
@@ -26173,22 +27213,22 @@ function ecdsa(Point, hash, ecdsaOpts = {}) {
       return new Signature(this.r, this.s, recovery);
     }
     recoverPublicKey(messageHash) {
-      const FIELD_ORDER = Fp.ORDER;
+      const FIELD_ORDER = Fp2.ORDER;
       const { r, s, recovery: rec } = this;
       if (rec == null || ![0, 1, 2, 3].includes(rec))
         throw new Error("recovery id invalid");
-      const hasCofactor = CURVE_ORDER * _2n5 < FIELD_ORDER;
+      const hasCofactor = CURVE_ORDER * _2n7 < FIELD_ORDER;
       if (hasCofactor && rec > 1)
         throw new Error("recovery id is ambiguous for h>1 curve");
       const radj = rec === 2 || rec === 3 ? r + CURVE_ORDER : r;
-      if (!Fp.isValid(radj))
+      if (!Fp2.isValid(radj))
         throw new Error("recovery id 2 or 3 invalid");
-      const x = Fp.toBytes(radj);
+      const x = Fp2.toBytes(radj);
       const R = Point.fromBytes(concatBytes2(pprefix((rec & 1) === 0), x));
-      const ir = Fn.inv(radj);
+      const ir = Fn2.inv(radj);
       const h = bits2int_modN(ensureBytes("msgHash", messageHash));
-      const u1 = Fn.create(-h * ir);
-      const u2 = Fn.create(s * ir);
+      const u1 = Fn2.create(-h * ir);
+      const u2 = Fn2.create(s * ir);
       const Q = Point.BASE.multiplyUnsafe(u1).add(R.multiplyUnsafe(u2));
       if (Q.is0())
         throw new Error("point at infinify");
@@ -26203,8 +27243,8 @@ function ecdsa(Point, hash, ecdsaOpts = {}) {
       validateSigFormat(format);
       if (format === "der")
         return hexToBytes2(DER.hexFromSig(this));
-      const r = Fn.toBytes(this.r);
-      const s = Fn.toBytes(this.s);
+      const r = Fn2.toBytes(this.r);
+      const s = Fn2.toBytes(this.s);
       if (format === "recovered") {
         if (this.recovery == null)
           throw new Error("recovery bit must be present");
@@ -26225,7 +27265,7 @@ function ecdsa(Point, hash, ecdsaOpts = {}) {
       return Signature.fromBytes(ensureBytes("sig", hex), "der");
     }
     normalizeS() {
-      return this.hasHighS() ? new Signature(this.r, Fn.neg(this.s), this.recovery) : this;
+      return this.hasHighS() ? new Signature(this.r, Fn2.neg(this.s), this.recovery) : this;
     }
     toDERRawBytes() {
       return this.toBytes("der");
@@ -26248,12 +27288,12 @@ function ecdsa(Point, hash, ecdsaOpts = {}) {
     return delta > 0 ? num >> BigInt(delta) : num;
   };
   const bits2int_modN = ecdsaOpts.bits2int_modN || function bits2int_modN_def(bytes) {
-    return Fn.create(bits2int(bytes));
+    return Fn2.create(bits2int(bytes));
   };
   const ORDER_MASK = bitMask2(fnBits);
   function int2octets(num) {
-    aInRange2("num < 2^" + fnBits, num, _0n8, ORDER_MASK);
-    return Fn.toBytes(num);
+    aInRange2("num < 2^" + fnBits, num, _0n10, ORDER_MASK);
+    return Fn2.toBytes(num);
   }
   function validateMsgAndHash(message, prehash) {
     _abytes2(message, void 0, "message");
@@ -26265,7 +27305,7 @@ function ecdsa(Point, hash, ecdsaOpts = {}) {
     const { lowS, prehash, extraEntropy } = validateSigOpts(opts, defaultSigOpts);
     message = validateMsgAndHash(message, prehash);
     const h1int = bits2int_modN(message);
-    const d = _normFnElement(Fn, privateKey);
+    const d = _normFnElement(Fn2, privateKey);
     const seedArgs = [int2octets(d), int2octets(h1int)];
     if (extraEntropy != null && extraEntropy !== false) {
       const e = extraEntropy === true ? randomBytes3(lengths.secretKey) : extraEntropy;
@@ -26275,20 +27315,20 @@ function ecdsa(Point, hash, ecdsaOpts = {}) {
     const m = h1int;
     function k2sig(kBytes) {
       const k = bits2int(kBytes);
-      if (!Fn.isValidNot0(k))
+      if (!Fn2.isValidNot0(k))
         return;
-      const ik = Fn.inv(k);
+      const ik = Fn2.inv(k);
       const q = Point.BASE.multiply(k).toAffine();
-      const r = Fn.create(q.x);
-      if (r === _0n8)
+      const r = Fn2.create(q.x);
+      if (r === _0n10)
         return;
-      const s = Fn.create(ik * Fn.create(m + r * d));
-      if (s === _0n8)
+      const s = Fn2.create(ik * Fn2.create(m + r * d));
+      if (s === _0n10)
         return;
-      let recovery = (q.x === r ? 0 : 2) | Number(q.y & _1n9);
+      let recovery = (q.x === r ? 0 : 2) | Number(q.y & _1n11);
       let normS = s;
       if (lowS && isBiggerThanHalfOrder(s)) {
-        normS = Fn.neg(s);
+        normS = Fn2.neg(s);
         recovery ^= 1;
       }
       return new Signature(r, normS, recovery);
@@ -26298,7 +27338,7 @@ function ecdsa(Point, hash, ecdsaOpts = {}) {
   function sign(message, secretKey, opts = {}) {
     message = ensureBytes("message", message);
     const { seed, k2sig } = prepSig(message, secretKey, opts);
-    const drbg = createHmacDrbg(hash.outputLen, Fn.BYTES, hmac4);
+    const drbg = createHmacDrbg(hash.outputLen, Fn2.BYTES, hmac4);
     const sig = drbg(seed, k2sig);
     return sig;
   }
@@ -26344,13 +27384,13 @@ function ecdsa(Point, hash, ecdsaOpts = {}) {
         return false;
       const { r, s } = sig;
       const h = bits2int_modN(message);
-      const is = Fn.inv(s);
-      const u1 = Fn.create(h * is);
-      const u2 = Fn.create(r * is);
+      const is = Fn2.inv(s);
+      const u1 = Fn2.create(h * is);
+      const u2 = Fn2.create(r * is);
       const R = Point.BASE.multiplyUnsafe(u1).add(P.multiplyUnsafe(u2));
       if (R.is0())
         return false;
-      const v = Fn.create(R.x);
+      const v = Fn2.create(R.x);
       return v === r;
     } catch (e) {
       return false;
@@ -26385,16 +27425,16 @@ function _weierstrass_legacy_opts_to_new(c) {
     Gx: c.Gx,
     Gy: c.Gy
   };
-  const Fp = c.Fp;
+  const Fp2 = c.Fp;
   let allowedLengths = c.allowedPrivateKeyLengths ? Array.from(new Set(c.allowedPrivateKeyLengths.map((l) => Math.ceil(l / 2)))) : void 0;
-  const Fn = Field2(CURVE.n, {
+  const Fn2 = Field2(CURVE.n, {
     BITS: c.nBitLength,
     allowedLengths,
     modFromBytes: c.wrapPrivateKey
   });
   const curveOpts = {
-    Fp,
-    Fn,
+    Fp: Fp2,
+    Fn: Fn2,
     allowInfinityPoint: c.allowInfinityPoint,
     endo: c.endo,
     isTorsionFree: c.isTorsionFree,
@@ -26452,25 +27492,25 @@ var secp256k1_ENDO = {
     [BigInt("0x114ca50f7a8e2f3f657c1108d9d44cfd8"), BigInt("0x3086d221a7d46bcde86c90e49284eb15")]
   ]
 };
-var _2n6 = /* @__PURE__ */ BigInt(2);
+var _2n8 = /* @__PURE__ */ BigInt(2);
 function sqrtMod(y) {
   const P = secp256k1_CURVE.p;
-  const _3n4 = BigInt(3), _6n = BigInt(6), _11n = BigInt(11), _22n = BigInt(22);
+  const _3n5 = BigInt(3), _6n = BigInt(6), _11n = BigInt(11), _22n = BigInt(22);
   const _23n = BigInt(23), _44n = BigInt(44), _88n = BigInt(88);
   const b2 = y * y * y % P;
   const b3 = b2 * b2 * y % P;
-  const b6 = pow22(b3, _3n4, P) * b3 % P;
-  const b9 = pow22(b6, _3n4, P) * b3 % P;
-  const b11 = pow22(b9, _2n6, P) * b2 % P;
+  const b6 = pow22(b3, _3n5, P) * b3 % P;
+  const b9 = pow22(b6, _3n5, P) * b3 % P;
+  const b11 = pow22(b9, _2n8, P) * b2 % P;
   const b22 = pow22(b11, _11n, P) * b11 % P;
   const b44 = pow22(b22, _22n, P) * b22 % P;
   const b88 = pow22(b44, _44n, P) * b44 % P;
   const b176 = pow22(b88, _88n, P) * b88 % P;
   const b220 = pow22(b176, _44n, P) * b44 % P;
-  const b223 = pow22(b220, _3n4, P) * b3 % P;
+  const b223 = pow22(b220, _3n5, P) * b3 % P;
   const t1 = pow22(b223, _23n, P) * b22 % P;
   const t2 = pow22(t1, _6n, P) * b2 % P;
-  const root = pow22(t2, _2n6, P);
+  const root = pow22(t2, _2n8, P);
   if (!Fpk1.eql(Fpk1.sqr(root), y))
     throw new Error("Cannot find square root");
   return root;
@@ -28193,7 +29233,7 @@ function resolveApiKey(apiKey) {
   if (!key) {
     throw new T2000Error(
       "INVALID_KEY",
-      "No Private API key. Pass `apiKey` or set T2000_API_KEY. Generate one at agents.t2000.ai/manage (Pro/Max)."
+      "No Private Inference key. Pass `apiKey` or set T2000_API_KEY. Generate one at agents.t2000.ai/manage."
     );
   }
   return key;
@@ -28371,7 +29411,24 @@ function jcs(value) {
 function verifyReceiptSignature(receipt, signingKeyHex) {
   try {
     const sig = receipt.signature;
-    if (sig?.algo !== "ecdsa-secp256k1" || !sig.value) {
+    if (!sig?.value) {
+      return false;
+    }
+    const endorsed = hexToBytes2(signingKeyHex.replace(/^0x/, ""));
+    const sigBytes = hexToBytes2(sig.value);
+    if (sig.algo === "ed25519") {
+      if (sigBytes.length !== 64 || endorsed.length !== 32) {
+        return false;
+      }
+      const { value: _omitted, ...sigRest } = sig;
+      const canonical2 = {
+        ...receipt,
+        signature: sigRest
+      };
+      const msg = new TextEncoder().encode(jcs(canonical2));
+      return ed255192.verify(sigBytes, msg, endorsed);
+    }
+    if (sig.algo !== "ecdsa-secp256k1") {
       return false;
     }
     const canonical = {
@@ -28387,7 +29444,6 @@ function verifyReceiptSignature(receipt, signingKeyHex) {
       signature: { algo: sig.algo, key_id: sig.key_id ?? "" }
     };
     const prehash = sha2563(new TextEncoder().encode(jcs(canonical)));
-    const sigBytes = hexToBytes2(sig.value);
     if (sigBytes.length !== 65) {
       return false;
     }
@@ -28399,8 +29455,7 @@ function verifyReceiptSignature(receipt, signingKeyHex) {
       return false;
     }
     const recovered = secp256k1.Signature.fromCompact(sigBytes.slice(0, 64)).addRecoveryBit(v).recoverPublicKey(prehash).toHex(false);
-    const endorsed = bytesToHex2(hexToBytes2(signingKeyHex.replace(/^0x/, "")));
-    return recovered.toLowerCase() === endorsed.toLowerCase();
+    return recovered.toLowerCase() === bytesToHex2(endorsed).toLowerCase();
   } catch {
     return false;
   }
@@ -28900,9 +29955,9 @@ var T2000 = class _T2000 extends import_index2.default {
   //
   // Inference as a wallet verb — the agent's brain + wallet in one package.
   // Key-based today (`apiKey` / `T2000_API_KEY`); the x402 no-key pay-per-call
-  // path is a later add. The model runs on the t2000 Private API (ZDR; a
+  // path is a later add. The model runs on t2000 Private Inference (ZDR; a
   // `phala/*` confidential tier runs in a GPU-TEE).
-  /** Non-streaming chat completion against the Private API. */
+  /** Non-streaming chat completion against Private Inference. */
   async chat(params) {
     return chatCompletion(params);
   }
@@ -28911,7 +29966,7 @@ var T2000 = class _T2000 extends import_index2.default {
   chatStream(params) {
     return chatCompletionStream(params);
   }
-  /** The Private API model catalog (`GET /v1/models`). */
+  /** The Private Inference model catalog (`GET /v1/models`). */
   async models(opts) {
     return listModels(opts);
   }
@@ -32619,8 +33674,8 @@ function numOrUndef(v) {
 }
 function registerChat(program3) {
   program3.command("chat").argument("<message...>", "Your prompt").description(
-    "Chat with a model on the t2000 Private API (OpenAI-compatible, ZDR; a phala/* tier is GPU-TEE confidential). Needs an API key \u2014 generate one at agents.t2000.ai/manage, then pass --api-key or set T2000_API_KEY."
-  ).option("--model <id>", `Model id (default ${DEFAULT_MODEL}; see \`t2 models\`)`, DEFAULT_MODEL).option("--system <text>", "System prompt").option("--max-tokens <n>", "Max output tokens").option("--temperature <t>", "Sampling temperature (0\u20132)").option("--no-stream", "Wait for the full response instead of streaming").option("--api-key <key>", "Private API key (or set T2000_API_KEY)").option("--api <url>", "API base URL (default https://api.t2000.ai/v1)").action(
+    "Chat with a model on t2000 Private Inference (OpenAI-compatible, ZDR; a phala/* tier is GPU-TEE confidential). Needs an API key \u2014 generate one at agents.t2000.ai/manage, then pass --api-key or set T2000_API_KEY."
+  ).option("--model <id>", `Model id (default ${DEFAULT_MODEL}; see \`t2 models\`)`, DEFAULT_MODEL).option("--system <text>", "System prompt").option("--max-tokens <n>", "Max output tokens").option("--temperature <t>", "Sampling temperature (0\u20132)").option("--no-stream", "Wait for the full response instead of streaming").option("--api-key <key>", "Private Inference key (or set T2000_API_KEY)").option("--api <url>", "API base URL (default https://api.t2000.ai/v1)").action(
     async (messageParts, opts) => {
       try {
         const messages = [];
@@ -32668,7 +33723,7 @@ function registerChat(program3) {
       }
     }
   );
-  program3.command("models").description("List the t2000 Private API model catalog (id \xB7 privacy tier \xB7 per-1M pricing).").option("--api-key <key>", "Private API key (or set T2000_API_KEY)").option("--api <url>", "API base URL (default https://api.t2000.ai/v1)").action(async (opts) => {
+  program3.command("models").description("List the t2000 Private Inference model catalog (id \xB7 privacy tier \xB7 per-1M pricing).").option("--api-key <key>", "Private Inference key (or set T2000_API_KEY)").option("--api <url>", "API base URL (default https://api.t2000.ai/v1)").action(async (opts) => {
     try {
       const models = await listModels({ apiKey: opts.apiKey, apiBase: opts.api });
       if (isJsonMode()) {
@@ -33122,7 +34177,7 @@ function registerMcpStart(parent) {
   parent.command("start", { isDefault: true }).description("Start MCP server (stdio transport \u2014 for AI client integration)").option("--key <path>", "Custom wallet path (default ~/.t2000/wallet.key)").action(async (opts) => {
     let mod3;
     try {
-      mod3 = await import("./dist-BOOS6EPV.js");
+      mod3 = await import("./dist-JNPBEKR5.js");
     } catch {
       console.error("MCP server not installed. Run:\n  npm install -g @t2000/mcp");
       process.exit(1);
@@ -33752,27 +34807,6 @@ function registerAgentCreate(group) {
 
 // src/commands/agent/index.ts
 var DEFAULT_API_BASE4 = process.env.T2000_API_URL ?? "https://api.t2000.ai/v1";
-function normalizeTopupAsset(input) {
-  return input?.toLowerCase() === "usdsui" ? "USDsui" : "USDC";
-}
-async function fundCredit(agent, base, amountStr, assetOpt) {
-  const amount = Number.parseFloat(amountStr);
-  if (Number.isNaN(amount) || amount <= 0) {
-    throw new Error(`amount must be a positive number (got "${amountStr}").`);
-  }
-  const asset = normalizeTopupAsset(assetOpt);
-  const cfg = await fetchJson2(`${base}/agent/topup`, { method: "GET" });
-  const treasury = cfg.treasury;
-  if (!treasury) {
-    throw new Error("Could not resolve the t2000 treasury address.");
-  }
-  const sent = await agent.send({ to: treasury, amount, asset });
-  const topup = await fetchJson2(`${base}/agent/topup`, {
-    method: "POST",
-    body: { address: agent.address(), digest: sent.tx }
-  });
-  return { amount, asset, balanceUsd: topup.balanceUsd };
-}
 async function fetchJson2(url, init) {
   const res = await fetch(url, {
     method: init.method,
@@ -33788,105 +34822,16 @@ async function fetchJson2(url, init) {
   return json;
 }
 function registerAgent(program3) {
-  const group = program3.command("agent").description("Agent ID \u2014 onboard this wallet to the t2000 API (api.t2000.ai)").addHelpText(
+  const group = program3.command("agent").description("Agent ID \u2014 on-chain identity for this wallet (register \xB7 handle \xB7 profile \xB7 ownership)").addHelpText(
     "after",
     `
 Subcommands:
   $ t2 agent create --name "Atlas Research"  Wallet + Agent ID + profile in one pass
-  $ t2 agent onboard --fund 5               Fund 5 USDC \u2192 mint an API key (ready to call)
-  $ t2 agent onboard --fund 5 --asset USDsui
-  $ t2 agent onboard                        Already funded \u2192 just mint a key
+  $ t2 agent register                        Existing wallet \u2192 on-chain Agent ID (gasless)
+  $ t2 agent handle alice                    Claim @alice
 `
   );
   registerAgentCreate(group);
-  group.command("onboard").description(
-    "Buy-side setup: fund credit (gasless USDC/USDsui) + mint a Private API key. Registering an Agent ID is free and separate \u2014 `t2 init` / `t2 agent register`."
-  ).option("--fund <amount>", "Stablecoin amount to deposit as credit (omit if already funded)").option("--asset <asset>", "USDC (default) or USDsui", "USDC").option("--key <path>", "Custom wallet path (default ~/.t2000/wallet.key)").option("--api <url>", `API base URL (default ${DEFAULT_API_BASE4})`).action(
-    async (opts) => {
-      try {
-        const base = opts.api ?? DEFAULT_API_BASE4;
-        const agent = await withAgent({ keyPath: opts.key });
-        const address = agent.address();
-        if (opts.fund !== void 0) {
-          const funded = await fundCredit(agent, base, opts.fund, opts.asset);
-          if (!isJsonMode()) {
-            printSuccess(
-              `Funded ${formatUsd(funded.amount)} ${funded.asset} \u2192 credit $${funded.balanceUsd}`
-            );
-          }
-        }
-        const challenge = await fetchJson2(`${base}/agent/challenge`, {
-          method: "POST",
-          body: { address }
-        });
-        const nonce = challenge.nonce;
-        if (!nonce) {
-          throw new Error("Failed to get a challenge nonce.");
-        }
-        const message = new TextEncoder().encode(`t2000-agent-keys:${nonce}`);
-        const { signature } = await agent.keypair.signPersonalMessage(message);
-        const minted = await fetchJson2(`${base}/agent/keys`, {
-          method: "POST",
-          body: { address, nonce, signature }
-        });
-        const key = minted.key;
-        if (!key) {
-          throw new Error("Failed to mint an API key.");
-        }
-        let registered = false;
-        try {
-          await registerWallet({ keypair: agent.keypair, address, base });
-          registered = true;
-        } catch {
-        }
-        if (isJsonMode()) {
-          printJson({ address, apiKey: key, baseUrl: base, registered });
-          return;
-        }
-        printBlank();
-        printSuccess("Agent onboarded \u2014 API key minted (shown once, store it now)");
-        printKeyValue("Address", truncateAddress(address));
-        printKeyValue("API key", key);
-        printKeyValue(
-          "Agent ID",
-          registered ? "registered" : "pending (retry: t2 agent register)"
-        );
-        printKeyValue("Base URL", base);
-        printBlank();
-        printInfo(`export OPENAI_BASE_URL=${base}  OPENAI_API_KEY=${key}`);
-        printBlank();
-      } catch (error) {
-        handleError(error);
-      }
-    }
-  );
-  group.command("topup").argument("<amount>", "Stablecoin amount to deposit as credit").description(
-    "Top up this wallet's t2000 credit with gasless USDC/USDsui (no new key). The 'never runs dry' primitive \u2014 call it on a 402 or a schedule."
-  ).option("--asset <asset>", "USDC (default) or USDsui", "USDC").option("--key <path>", "Custom wallet path (default ~/.t2000/wallet.key)").option("--api <url>", `API base URL (default ${DEFAULT_API_BASE4})`).action(
-    async (amount, opts) => {
-      try {
-        const base = opts.api ?? DEFAULT_API_BASE4;
-        const agent = await withAgent({ keyPath: opts.key });
-        const funded = await fundCredit(agent, base, amount, opts.asset);
-        if (isJsonMode()) {
-          printJson({
-            address: agent.address(),
-            funded: funded.amount,
-            asset: funded.asset,
-            balanceUsd: funded.balanceUsd
-          });
-          return;
-        }
-        printBlank();
-        printSuccess(
-          `Topped up ${formatUsd(funded.amount)} ${funded.asset} \u2192 credit $${funded.balanceUsd}`
-        );
-        printBlank();
-      } catch (error) {
-        handleError(error);
-      }
-    }
-  );
   group.command("register").description(
     "Register this wallet on-chain as an Agent ID (sponsored, gasless). Idempotent \u2014 safe to re-run."
   ).option("--key <path>", "Custom wallet path (default ~/.t2000/wallet.key)").option("--api <url>", `API base URL (default ${DEFAULT_API_BASE4})`).action(async (opts) => {
@@ -34197,8 +35142,8 @@ Examples:
   $ t2 balance                         Show USDC / USDsui / SUI holdings
   $ t2 send 5 USDC alice.sui           Send 5 USDC (gasless; asset required)
   $ t2 swap 100 USDC SUI               Swap 100 USDC for SUI via Cetus
-  $ t2 chat "Summarize Sui in 3 lines" Private inference (OpenAI-compatible; needs T2000_API_KEY)
-  $ t2 models                          List the Private API model catalog
+  $ t2 chat "Summarize Sui in 3 lines" Private Inference (OpenAI-compatible; needs T2000_API_KEY)
+  $ t2 models                          List the Private Inference model catalog
   $ t2 pay <url> --estimate            Preview an x402 service's price + input schema (no payment)
   $ t2 services search "image"         Discover x402 services in the gateway catalog
   $ t2 agents                          Look up the agent directory (agents.t2000.ai)
@@ -34245,6 +35190,8 @@ program2.parse();
 @noble/curves/esm/utils.js:
 @noble/curves/esm/abstract/modular.js:
 @noble/curves/esm/abstract/curve.js:
+@noble/curves/esm/abstract/edwards.js:
+@noble/curves/esm/ed25519.js:
 @noble/curves/esm/abstract/weierstrass.js:
 @noble/curves/esm/_shortw_utils.js:
 @noble/curves/esm/secp256k1.js: